fix(gateway): multiplex wave 2 — port-binding degradation, dashboard guard, scoped picker//profile/api_server (7-PR cluster salvage) by teknium1 · Pull Request #65700 · NousResearch/hermes-agent

teknium1 · 2026-07-16T13:59:07Z

Summary

Second consolidated multiplex salvage wave: a misconfigured secondary profile no longer takes down the whole gateway, the dashboard refuses to write that misconfiguration in the first place, and the model picker, /profile, Feishu websocket mode, secondary-adapter auth callbacks, and default-listener api_server requests all resolve the correct profile. Closes #52796, closes #62791, closes #52563, closes #61276.

Cherry-picks/rebuilds from six contributors (authorship preserved, rebase merge) plus integration commits.

Salvaged work

fix(dashboard): reject port-binding channels on secondary multiplexed profiles (#62791) #62803 (@PRATHAMESH75) — dashboard PUT /api/messaging/platforms/<id> returns 409 before writing a port-binding platform enable on a secondary multiplexed profile (Dashboard allows invalid port-binding channels on secondary multiplexed profiles #62791: the dashboard used to persist the invalid config and the shared gateway died for ALL profiles on next start). Also centralizes PORT_BINDING_PLATFORM_VALUES into gateway/config.py — one policy for gateway startup and dashboard validation. Disable/clear stays allowed (recovery path). @Ahmett101 submitted the competing fix(dashboard): reject port-binding platforms on secondary multiplexed profiles #62801 first (same day) — credited.
fix(gateway): skip port-conflicting multiplex profiles #55724 (@Christopher-Schulze) — SecondaryPortBindingConfigError(MultiplexConfigError): the secondary-startup loop catches only the port-binding subtype, logs "Skipping secondary profile …", and keeps every other MultiplexConfigError (e.g. open-dm-policy violations) fatal (Gateway: multiplex_profiles config conflict causes fatal exit (should degrade, not die) #52796: one bad profile killed the whole multiplexer).
fix(gateway): allow Feishu websocket mode in multiplex profiles #52587 (@liuhao1024) — Feishu in websocket mode (its default) binds no port and is no longer blocked on secondary profiles; only webhook mode counts as port-binding. Mode logic integrated into the centralized constant as platform_binds_port() + PORT_BINDING_CONDITIONAL_MODES, so the gateway batch check and any future consumer share it (Feishu misclassified as port-binding platform, breaking multiplexed Feishu profiles #52563).
fix(gateway): preserve multiplex profile in model picker #63447 (@cresslank) — /model picker on multiplexed gateways: resolves the adapter via _adapter_for_source (was the last default-map straggler in the picker path), runs the selection callback under the routed profile's scope, and --global persists to the routed profile's config.
fix(gateway): /profile reports the profile serving the source on multiplexed gateways #62244 (@CocaKova, 2 commits) — /profile reports the profile actually serving the chat (source-stamped), gated on multiplex_profiles; previously URL-prefix and routing-rule chats were told "default".
fix(gateway): scope authz allowlist reads to the routed profile #61985 (@rlaehddus302, subset) — _make_adapter_auth_check(platform, profile_name=...): secondary adapters bind their auth callback to their own profile, so adapter-internal auth checks (e.g. Slack thread-context fetch, which fire OUTSIDE the wrapped message handler) resolve the routed profile's adapter and pairing store. The PR's authz_mixin hunks were dropped — superseded by _auth_env from fix(gateway): multiplex credential isolation — authz, Slack, WeChat, secondary adapters (4-PR cluster salvage) #65629.
fix(gateway): scope api_server secrets under multiplex profiles #61283 (@giggling-ginger, rebuilt) — _profile_scope(None) in api_server now enters the DEFAULT profile's runtime scope when multiplex is active instead of nullcontext(). Plain requests on the default listener (api_server's primary path — it's port-binding, so it lives on default) crashed with UnscopedSecretError on the first credential read ([Bug]: gateway.multiplex_profiles model error #61276). The PR's original diff predated the /p/<profile>/ routing rewrite (7aa21e3); rebuilt on the _profile_scope seam, regression tests ported.

Not salvaged (closing separately with evidence)

refactor(gateway): centralize port-binding platform constants and multiplex profile validation #64005 / fix(dashboard): reject port-binding platforms on secondary multiplexed profiles #62801 (@Ahmett101) — byte-identical diffs of each other; fix(dashboard): reject port-binding channels on secondary multiplexed profiles (#62791) #62803 is the strictly cleaner implementation of the same fix (blocks clear_env recovery, mis-resolves "current" profile, hand-rolled yaml reader drops the env override).
fix(gateway): resolve per-profile home channel in multiplex mode #60743 (@lexiismadd) — home-channel core superseded by fix(gateway): multiplex credential isolation — authz, Slack, WeChat, secondary adapters (4-PR cluster salvage) #65629 + scoped config loads; bundles an undisclosed per-profile session-DB feature that needs a fresh implementation with tests.
feat(feishu): seed adapter extra from YAML config for multi-profile support #64245 (@zmlgit) — platforms.feishu.extra already works end-to-end on main (config deep-merge + adapter extra-first reads).

Validation

Check	Result
targeted sweep (`multiplex or port_binding or profile or picker or feishu or api_server`)	1,131 passed, 0 failed
Live E2E — dashboard (real FastAPI TestClient, temp profiles)	secondary enable → 409; default enable → 200; secondary disable → 200 (recovery preserved)
Live E2E — gateway (real `_start_one_profile_adapters`, bad+good profiles)	bad profile skipped with warning, good profile connected, nothing fatal
Live E2E — scope (real `.env` files)	api_server default-listener installs default scope, profile `.env` beats process env, teardown restores fail-closed; single-profile no-op unchanged
`platform_binds_port`	feishu websocket/default → False, feishu webhook → True, api_server → True, telegram → False; run.py uses the same function object (no drift)
ruff	clean

Infographic

… profiles The Channels API (PUT /api/messaging/platforms/{id}) accepted and persisted enabling a port-binding platform on a secondary profile while gateway.multiplex_profiles is on — a config the gateway only rejects on its next start, aborting startup with MultiplexConfigError for every multiplexed profile. Validate before any .env/config.yaml write and return 409 for the enable attempt. Disabling and clearing env stay allowed so an already-invalid profile can be repaired. The port-binding platform set moves to gateway/config.py (PORT_BINDING_PLATFORM_VALUES) as the single source of truth shared by gateway startup validation and the dashboard, so the two policies cannot drift. Platform config mutations now get a names-only audit log line. Fixes #62791

The #62803 branch predates PR #64636's Telegram token-shape validation on the messaging platform PUT endpoint; align the new guard test's fixture with the validated format.

…e multiplexer's On a multiplexed gateway the process-level active profile is always the multiplexer's own (usually "default"), so /profile answered "default" in every chat regardless of which profile actually served it — making per-chat persona routing look broken when it was working. Report source.profile (stamped by the /p/<profile>/ URL prefix, a per-credential adapter, or a room->profile map) and resolve the displayed home under that profile's runtime scope, mirroring the scoped /reset banner (#59003). Unstamped sources fall back to the active profile and default home, so single-profile gateways are unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Review follow-up: honor source.profile and enter _profile_runtime_scope only when gateway.multiplex_profiles is on, mirroring the gating in _run_agent, _reset_notice_session_info, and _resolve_profile_for_key. When multiplexing is off (the default) a stamped source is ignored and /profile reports the active profile and default home, byte-identical to before this PR. The stamped-source test now enables multiplexing (it previously exercised the ungated path under the default config), and a new regression asserts the stamp is ignored when multiplexing is off. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Feishu was unconditionally listed in _PORT_BINDING_PLATFORM_VALUES, causing the multiplexer to reject ALL Feishu secondary profiles. But Feishu in websocket mode (the default) uses an outbound WebSocket connection and does NOT bind an HTTP port — only webhook/callback mode needs a listener. Add _platform_binds_port() helper that checks connection-dependent platforms (currently only Feishu) against their actual config before raising MultiplexConfigError. Feishu websocket profiles are now allowed; Feishu webhook profiles still raise as before. Fixes #52563

…tegration With the mode-conditional check centralized, default (websocket) Feishu no longer counts as port-binding in the secondary batch report — pin the fixture to connection_mode=webhook so the test still exercises the multi-platform report path.

Subset of PR #61985: _make_adapter_auth_check gains a profile_name parameter and secondary-profile adapters (started in _start_one_profile_adapters) bind it, so the auth callback's SessionSource resolves the routed profile's adapter and pairing store instead of silently falling back to the default profile. This is the gap left open by the #65629 merge — adapter-internal auth checks (e.g. Slack thread-context fetch) fire outside the wrapped message handler. The PR's authz_mixin.py hunks are dropped: main's _auth_env (merged via PR #65629) already covers the scoped allowlist reads they targeted.

Rebuilt from PR #61283 onto the /p/<profile>/ routing world (7aa21e3): _profile_scope(None) now enters the DEFAULT profile's runtime scope when multiplexing is active instead of returning nullcontext(). api_server is a port-binding platform living on the default profile, so plain requests (no /p/ prefix) are the primary path — with fail-closed get_secret they crashed with UnscopedSecretError on the first credential read (#61276). All three wrapped call sites (chat-completions executor, /v1/runs agent construction and _run_sync) inherit the fix through the one seam. Single-profile gateways keep the no-op. Regression tests ported from the original PR to the _profile_scope seam. Fixes #61276

…vage)

tonydwb

Code Review Summary

Verdict: Comment

Overview

Large multiplex wave 2 fix: port-binding degradation, dashboard guard, scoped picker/profile/api_server
1000 additions, 88 deletions
Part of a 7-PR cluster salvage

Assessment

Well-scoped fix addressing multiple related issues
get_secret fail-closed behavior for unscoped agents is a security improvement
The multiplex secret scope change is the core fix — ensures credentials don't leak across agent instances
Dashboard guard adds protection against undefined profile states

Suggestion

Given the scope (7-PR cluster salvage), recommend human reviewer verify integration across the full cluster

Reviewed by Hermes Agent

…7.7 ➔ v2026.7.20) (#10) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/gabrielcosi/hermes-agent](https://github.com/NousResearch/hermes-agent) | patch | `v2026.7.7` → `v2026.7.20` | --- ### Release Notes <details> <summary>NousResearch/hermes-agent (ghcr.io/gabrielcosi/hermes-agent)</summary> ### [`v2026.7.20`](https://github.com/NousResearch/hermes-agent/releases/tag/v2026.7.20): Hermes Agent v0.19.0 (2026.7.20) — The Quicksilver Release [Compare Source](https://github.com/NousResearch/hermes-agent/compare/v2026.7.7...v2026.7.20) ##### Hermes Agent v0.19.0 (v2026.7.20) **Release Date:** July 20, 2026 **Since v0.18.0:** \~2,245 commits · \~1,065 merged PRs · \~2,465 files changed · \~300,000 insertions · \~36,000 deletions · **\~3,300 issues closed** · **450+ community contributors** > **The Quicksilver Release.** Hermes is the messenger god, and this window we made him move like it. First-turn time-to-first-token dropped **\~80% on every platform**, reasoning streams live by default, the desktop app got a \~20-PR speed overhaul (14× faster streaming markdown, virtualized diffs, snappy session switching), and the TUI renders markdown incrementally. Around that speed spine: you can now **manage your Nous subscription without leaving the terminal**, plug **Bitwarden and 1Password** straight into Hermes, let **smart approvals** judge flagged commands for you by default, **watch your subagents work live**, and trust that a finished response **survives a gateway crash** thanks to a durable delivery ledger. This release also rolls up everything from the v0.18.1 and v0.18.2 infrastructure patch tags — those windows are fully documented here. *** ##### ✨ Highlights - **Hermes got dramatically faster — first token in a fraction of the time** — Cold-start "Initializing agent..." used to eat \~4.3 seconds before your first turn even reached the model; it's now \~0.9s, an \~80% cut that applies to the CLI, gateway, TUI, desktop, and cron alike. Round 2 attacked what you *see* while waiting: reasoning models now stream their thinking live by default (no more staring at a spinner for 30 seconds), and the response box paints per token instead of per line. If Hermes ever felt like it took a deep breath before answering, that breath is gone. ([#59332](https://github.com/NousResearch/hermes-agent/pull/59332), [#59389](https://github.com/NousResearch/hermes-agent/pull/59389) — [@teknium1](https://github.com/teknium1)) - **The desktop app speed wave — 20+ targeted perf PRs** — Long replies used to cost 14× more CPU in the markdown splitter than they do now; giant diffs froze the review pane until we virtualized it; switching sessions thrashes layout no more. Streaming no longer re-renders the sidebar and every tool row per token, profile backends pre-warm on hover intent, and boot-hidden panes mount at idle instead of on the cold-start critical path. The net effect: the desktop app feels like a native app under load, even with huge transcripts and busy agents. ([#67154](https://github.com/NousResearch/hermes-agent/pull/67154), [#67818](https://github.com/NousResearch/hermes-agent/pull/67818), [#65898](https://github.com/NousResearch/hermes-agent/pull/65898), [#66033](https://github.com/NousResearch/hermes-agent/pull/66033), [#66747](https://github.com/NousResearch/hermes-agent/pull/66747), [#67742](https://github.com/NousResearch/hermes-agent/pull/67742) and more — [@OutThisLife](https://github.com/OutThisLife)) - **Manage your Nous plan from the terminal — `/subscription` and `/topup`** — Changing your subscription used to mean a trip to the billing website. Now `/subscription` opens a full flow right in the TUI or classic CLI: see your plan and remaining allowance, preview exactly what an upgrade costs ("Pay $46.30 & upgrade now") or when a downgrade takes effect, and apply it — with scheduled-change banners and undo. The desktop app got a matching billing settings tab. Your wallet never has to leave the keyboard. ([#51639](https://github.com/NousResearch/hermes-agent/pull/51639), [#61054](https://github.com/NousResearch/hermes-agent/pull/61054), [#61067](https://github.com/NousResearch/hermes-agent/pull/61067) — [@alt-glitch](https://github.com/alt-glitch)) - **Smart approvals are now the default** — When Hermes wants to run a flagged command, an LLM reviewer now assesses it independently instead of asking you to approve every single one — and each verdict covers only that exact command, so a later command matching the same pattern gets its own review. Combined with the new **user-defined deny rules** (which block commands even under yolo mode) and `/deny <reason>` (which tells the agent *why* you refused so it course-corrects), day-to-day approval fatigue drops sharply without giving up control. ([#62661](https://github.com/NousResearch/hermes-agent/pull/62661), [#59164](https://github.com/NousResearch/hermes-agent/pull/59164), [#54518](https://github.com/NousResearch/hermes-agent/pull/54518) — [@teknium1](https://github.com/teknium1)) - **Plug your password manager into Hermes — Bitwarden & 1Password secret sources** — API keys no longer have to live in a plaintext `.env`. A new pluggable `SecretSource` interface lets Hermes fetch secrets from Bitwarden and 1Password (`op://` references) at load time, with multiple vaults enabled simultaneously, deterministic precedence, conflict warnings, and per-variable provenance. This consolidated eleven competing community PRs into one orchestrated interface — future vault providers drop in as plugins. ([#59498](https://github.com/NousResearch/hermes-agent/pull/59498) — [@teknium1](https://github.com/teknium1), 1Password provider salvaged from [@hwrdprkns](https://github.com/hwrdprkns)) - **Watch your subagents work — live transcripts + durable background delegation** — `delegate_task` dispatches now return live transcript files you can `tail -f` the moment the subagents launch: every tool call, result, and streamed reply, one human-readable log per child. And background delegation completions are now **durable** — if the process restarts mid-run, results are restored and delivered through an ownership-checked ledger instead of vanishing. Fan out a fleet, watch any worker live, and never lose the results. ([#67479](https://github.com/NousResearch/hermes-agent/pull/67479), [#63494](https://github.com/NousResearch/hermes-agent/pull/63494) — [@teknium1](https://github.com/teknium1)) - **A finished answer can no longer be lost — the delivery-obligation ledger** — If the gateway died between generating your response and confirming the platform actually delivered it, that answer used to be silently gone (and you'd paid for the turn). Final responses are now recorded in a durable ledger in `state.db` around the platform send and **redelivered on the next boot** — closing a P1 silent-loss window for Telegram, Discord, Slack, and every other channel. ([#67181](https://github.com/NousResearch/hermes-agent/pull/67181) — [@teknium1](https://github.com/teknium1)) - **One gateway, many profiles — profile-based message routing** — A single multiplexed gateway sharing one bot token can now route specific guilds, channels, or threads to different profiles — each with fully isolated config, skills, memory, and secrets. Point your work Discord server at the `work` profile and your hobby server at `personal`, from one bot. A second multiplex hardening wave means one misconfigured profile can no longer take down the whole gateway. ([#64835](https://github.com/NousResearch/hermes-agent/pull/64835) salvaging [@Burgunthy](https://github.com/Burgunthy), [#65700](https://github.com/NousResearch/hermes-agent/pull/65700), [#60589](https://github.com/NousResearch/hermes-agent/pull/60589) — [@teknium1](https://github.com/teknium1), [@benbarclay](https://github.com/benbarclay) + six salvaged contributors) - **New providers and the newest frontier models** — Fireworks AI and DeepInfra land as first-class providers (Fireworks with cost estimation and a [#2](https://github.com/NousResearch/hermes-agent/issues/2) slot in the provider picker), Upstage Solar joins via salvage, and the model catalogs picked up **GPT-5.6 (Sol/Terra/Luna + Pro variants, wired end-to-end across every route)**, **grok-4.5 (GA)**, **moonshotai/kimi-k3**, **claude-fable-5 / claude-sonnet-5**, and GA **tencent/hy3** — plus LM Studio JIT model loading for local setups. ([#62593](https://github.com/NousResearch/hermes-agent/pull/62593), [#63969](https://github.com/NousResearch/hermes-agent/pull/63969), [#61616](https://github.com/NousResearch/hermes-agent/pull/61616) — [@kshitijk4poor](https://github.com/kshitijk4poor) completing [@rob-maron](https://github.com/rob-maron)'s [#61578](https://github.com/NousResearch/hermes-agent/issues/61578), [#60887](https://github.com/NousResearch/hermes-agent/pull/60887), [#65913](https://github.com/NousResearch/hermes-agent/pull/65913), [#64541](https://github.com/NousResearch/hermes-agent/pull/64541), [#65472](https://github.com/NousResearch/hermes-agent/pull/65472)) - **Crank the thinking to max — new reasoning effort tiers and per-model control** — Reasoning effort gained `max` and `ultra` levels (GPT-5.6 and Codex's top tiers), selectable everywhere from the CLI to the desktop, with sane clamping on providers with smaller scales. You can now also pin **per-model reasoning-effort overrides** in config, set **per-slot effort in MoA presets** (your advisors think hard, your synthesizer stays fast), and per-task effort for auxiliary models. Thinking depth is now a dial, not a global switch. ([#62650](https://github.com/NousResearch/hermes-agent/pull/62650), [#64458](https://github.com/NousResearch/hermes-agent/pull/64458), [#64631](https://github.com/NousResearch/hermes-agent/pull/64631), [#64597](https://github.com/NousResearch/hermes-agent/pull/64597) — [@teknium1](https://github.com/teknium1)) - **Your sessions, your data — export everything** — `hermes sessions export` now writes Markdown, Quarto, HTML, prompt-only, and even Hugging Face-ready trace formats, with the full filter surface (age, workspace, platform), an opt-in `--redact` secret-scrubbing pass, and compacted-session lineage stitched into one logical export. Pair with the new prune filters and bulk archive to keep your session store tidy. Your conversation history is a real dataset now, not a black box. ([#60186](https://github.com/NousResearch/hermes-agent/pull/60186) salvaging [@web3blind](https://github.com/web3blind), [#60492](https://github.com/NousResearch/hermes-agent/pull/60492), [#60507](https://github.com/NousResearch/hermes-agent/pull/60507), [#59327](https://github.com/NousResearch/hermes-agent/pull/59327) — [@teknium1](https://github.com/teknium1)) - **Security hardening round** — This window closed a long list of credential-surface gaps: Vertex credentials scoped away from subprocess env and through profile secret scopes, media/vision/image-gen local-file reads routed through one shared credential-read guard, a webhook body-size-cap sweep across every aiohttp server, bot-token redaction in Telegram transport errors, Fireworks token prefixes added to the redactor, six P1 browser/MEDIA/.env hardening PRs salvaged in one pass, and CI hardened against untrusted-ref interpolation. ([#57660](https://github.com/NousResearch/hermes-agent/pull/57660), [#58709](https://github.com/NousResearch/hermes-agent/pull/58709), [#59215](https://github.com/NousResearch/hermes-agent/pull/59215), [#56582](https://github.com/NousResearch/hermes-agent/pull/56582), [#57842](https://github.com/NousResearch/hermes-agent/pull/57842) — [@teknium1](https://github.com/teknium1), [@srojk34](https://github.com/srojk34), [@kshitijk4poor](https://github.com/kshitijk4poor), [@jquesnelle](https://github.com/jquesnelle)) *** ##### ⚡ Performance — the speed spine ##### First-turn latency (all platforms) - **\~80% TTFT cut** — Discord capability detection off the critical path (token-keyed 24h disk cache + background refresh), Ollama probe skipped for known non-Ollama providers, agent-init blocking work removed; cold submit→dispatch \~4.3s → \~0.9s ([#59332](https://github.com/NousResearch/hermes-agent/pull/59332) — [@teknium1](https://github.com/teknium1)) - **Perceived-latency round 2** — `display.show_reasoning` default ON (watch the model think instead of a spinner), per-token response-box painting with width-aware force-flush, prompt-build caching, mtime-cached timezone resolution ([#59389](https://github.com/NousResearch/hermes-agent/pull/59389) — [@teknium1](https://github.com/teknium1)) - Segment mixed tool batches to recover lost concurrency; drop per-call base64 re-serialization from request-size estimates ([#64460](https://github.com/NousResearch/hermes-agent/pull/64460), [#67788](https://github.com/NousResearch/hermes-agent/pull/67788) — [@teknium1](https://github.com/teknium1), [@OutThisLife](https://github.com/OutThisLife)) ##### Desktop speed wave - 14× less splitter CPU via incremental block lexing for streaming markdown; virtualized review-pane diffs (no more full-Shiki freeze); snappy session switching on large transcripts; killed the layout-thrash cascade on session switch ([#67154](https://github.com/NousResearch/hermes-agent/pull/67154), [#67818](https://github.com/NousResearch/hermes-agent/pull/67818), [#65898](https://github.com/NousResearch/hermes-agent/pull/65898), [#66033](https://github.com/NousResearch/hermes-agent/pull/66033) — [@OutThisLife](https://github.com/OutThisLife)) - Cut startup serialization + per-turn REST amplification; pre-warm profile backends and gateway sockets on hover intent; idle-mount boot-hidden panes; fast model picker + dialogs ([#66747](https://github.com/NousResearch/hermes-agent/pull/66747), [#66347](https://github.com/NousResearch/hermes-agent/pull/66347), [#67857](https://github.com/NousResearch/hermes-agent/pull/67857), [#66470](https://github.com/NousResearch/hermes-agent/pull/66470) — [@OutThisLife](https://github.com/OutThisLife)) - Stop per-token sidebar + tool-row re-renders during streaming; stop eager JSON.stringify of every tool's args/result; scope tool-diff subscriptions; batch sidebar session slices into one profile-DB pass; targeted file-tree revalidation; rAF-coalesced sash resizes ([#67742](https://github.com/NousResearch/hermes-agent/pull/67742), [#67842](https://github.com/NousResearch/hermes-agent/pull/67842), [#67195](https://github.com/NousResearch/hermes-agent/pull/67195), [#67245](https://github.com/NousResearch/hermes-agent/pull/67245), [#67824](https://github.com/NousResearch/hermes-agent/pull/67824), [#67838](https://github.com/NousResearch/hermes-agent/pull/67838), [#67844](https://github.com/NousResearch/hermes-agent/pull/67844) — [@OutThisLife](https://github.com/OutThisLife)) - Systematized perf benchmark harness with trustworthy cold-start + first-token measurement, replacing 12 one-off scripts ([#67466](https://github.com/NousResearch/hermes-agent/pull/67466), [#67697](https://github.com/NousResearch/hermes-agent/pull/67697) — [@OutThisLife](https://github.com/OutThisLife)) ##### Everywhere else - TUI renders streamed markdown incrementally per block ([#67236](https://github.com/NousResearch/hermes-agent/pull/67236) — [@OutThisLife](https://github.com/OutThisLife)) - Skill discovery cached by scan signature; snapshot manifest builds \~5× faster; text prefilter before AST parse in tool discovery ([#61414](https://github.com/NousResearch/hermes-agent/pull/61414), [#61131](https://github.com/NousResearch/hermes-agent/pull/61131), [#63941](https://github.com/NousResearch/hermes-agent/pull/63941) — [@kshitijk4poor](https://github.com/kshitijk4poor), [@ethernet8023](https://github.com/ethernet8023)) - Copy-on-write message prep instead of full deepcopy; model-metadata probe-cache cluster; gateway `session.resume` model + display history from one SELECT ([#61133](https://github.com/NousResearch/hermes-agent/pull/61133), [#61368](https://github.com/NousResearch/hermes-agent/pull/61368), [#67247](https://github.com/NousResearch/hermes-agent/pull/67247) — [@kshitijk4poor](https://github.com/kshitijk4poor), [@OutThisLife](https://github.com/OutThisLife)) - `hermes update` skips npm install when Node manifests are unchanged; dashboard session-list payloads trimmed + messages paginated ([#61580](https://github.com/NousResearch/hermes-agent/pull/61580), [#60883](https://github.com/NousResearch/hermes-agent/pull/60883) — [@kshitijk4poor](https://github.com/kshitijk4poor)) - Byte-stable gateway system prompts — pinned session-context render keeps the prompt cache alive across turns ([#67403](https://github.com/NousResearch/hermes-agent/pull/67403) — [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🏗️ Core Agent & Architecture ##### Providers & models - **Fireworks AI provider** with cost estimation + cached picker price columns, promoted to [#2](https://github.com/NousResearch/hermes-agent/issues/2) in provider pickers ([#62593](https://github.com/NousResearch/hermes-agent/pull/62593), [#65476](https://github.com/NousResearch/hermes-agent/pull/65476), [#65214](https://github.com/NousResearch/hermes-agent/pull/65214) — [@teknium1](https://github.com/teknium1)) - **DeepInfra** hardened integration; **Upstage Solar** provider ([#42231](https://github.com/NousResearch/hermes-agent/issues/42231) salvage) ([#63969](https://github.com/NousResearch/hermes-agent/pull/63969), [#64541](https://github.com/NousResearch/hermes-agent/pull/64541) — [@kshitijk4poor](https://github.com/kshitijk4poor)) - **GPT-5.6 (Sol/Terra/Luna + Pro) end-to-end** — context lengths, native/Codex catalogs, pricing, compaction caps across every route ([#61616](https://github.com/NousResearch/hermes-agent/pull/61616) — [@kshitijk4poor](https://github.com/kshitijk4poor), building on [@rob-maron](https://github.com/rob-maron)) - grok-4.5 (GA) catalog + reasoning allowlist; kimi-k3 on Nous Portal + OpenRouter (kimi-k2.x retired) + K3 discovery on the Kimi Coding endpoint; claude-fable-5 / claude-sonnet-5 / fugu-ultra curated; GA tencent/hy3 ([#60887](https://github.com/NousResearch/hermes-agent/pull/60887), [#65913](https://github.com/NousResearch/hermes-agent/pull/65913), [#65922](https://github.com/NousResearch/hermes-agent/pull/65922), [#56617](https://github.com/NousResearch/hermes-agent/pull/56617), [#60943](https://github.com/NousResearch/hermes-agent/pull/60943) — [@teknium1](https://github.com/teknium1)) - Catalog-labeled silent default (GLM-5.2) + bare-provider `/model` cost-safe routing; LM Studio JIT load mode; adaptive thinking for Kimi-family Anthropic endpoints ([#64771](https://github.com/NousResearch/hermes-agent/pull/64771), [#65472](https://github.com/NousResearch/hermes-agent/pull/65472), [#67606](https://github.com/NousResearch/hermes-agent/pull/67606) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) - GLM-5.2 native reasoning\_effort controls; Gemini request-context improvements; extra HTTP headers for LLM API calls; per-client model routing on the API server ([#58884](https://github.com/NousResearch/hermes-agent/pull/58884), [#61873](https://github.com/NousResearch/hermes-agent/pull/61873) — [@vishal-dharm](https://github.com/vishal-dharm), [#57038](https://github.com/NousResearch/hermes-agent/pull/57038), [#57028](https://github.com/NousResearch/hermes-agent/pull/57028) — [@teknium1](https://github.com/teknium1)) - **Claude Sonnet 5 fully wired** — curated lists, intro pricing, and metadata across every route ([#67932](https://github.com/NousResearch/hermes-agent/pull/67932) — [@teknium1](https://github.com/teknium1)) - **Hide providers you don't use** — `enabled: false` per-provider flag + `excluded_providers` config scrub unwanted providers from `/model` pickers and built-in resolution ([#67971](https://github.com/NousResearch/hermes-agent/pull/67971) — [@teknium1](https://github.com/teknium1)) - Bedrock catalog wave: real context-window probing from the live endpoint, 1M-context rows for current-gen Claude + Fable, geo-prefix parity, versioned profile-ID pricing, Opus 4.8/4.7 rows ([#68007](https://github.com/NousResearch/hermes-agent/pull/68007), [#67977](https://github.com/NousResearch/hermes-agent/pull/67977), [#68005](https://github.com/NousResearch/hermes-agent/pull/68005), [#67976](https://github.com/NousResearch/hermes-agent/pull/67976) — [@teknium1](https://github.com/teknium1)) - kimi-k3 rollout completed across Kimi-direct catalog surfaces with 1M context on canonical Kimi Coding endpoints ([#68108](https://github.com/NousResearch/hermes-agent/pull/68108) — [@teknium1](https://github.com/teknium1)) - Provider pickers: Qwen providers folded into one group row; collapsible provider groups in the desktop model picker; friendlier TUI model display grouping same-endpoint providers ([#67758](https://github.com/NousResearch/hermes-agent/pull/67758), [#67904](https://github.com/NousResearch/hermes-agent/pull/67904), [#67908](https://github.com/NousResearch/hermes-agent/pull/67908) — [@teknium1](https://github.com/teknium1)) ##### Reasoning & MoA - `max` + `ultra` effort levels across every surface and route ([#62650](https://github.com/NousResearch/hermes-agent/pull/62650) — [@teknium1](https://github.com/teknium1)) - Per-model reasoning\_effort overrides via a unified resolution chokepoint; per-task auxiliary effort; per-slot MoA preset effort; session-scoped `/reasoning` in the CLI ([#64458](https://github.com/NousResearch/hermes-agent/pull/64458), [#64597](https://github.com/NousResearch/hermes-agent/pull/64597), [#64631](https://github.com/NousResearch/hermes-agent/pull/64631), [#67946](https://github.com/NousResearch/hermes-agent/pull/67946) — [@teknium1](https://github.com/teknium1)) - MoA: `reference_max_tokens` to cap advisor output and cut latency; per-preset fanout cadence (`user_turn` runs advisors once per user turn); stale presets surfaced without retries; half-filled preset saves rejected at the API boundary; aggregator resolves reasoning like an acting model ([#56756](https://github.com/NousResearch/hermes-agent/pull/56756), [#57591](https://github.com/NousResearch/hermes-agent/pull/57591), [#64756](https://github.com/NousResearch/hermes-agent/pull/64756) — [@teknium1](https://github.com/teknium1)) ##### Delegation, approvals & the agent loop - Live subagent transcripts + durable background completions (see Highlights) ([#67479](https://github.com/NousResearch/hermes-agent/pull/67479), [#63494](https://github.com/NousResearch/hermes-agent/pull/63494) — [@teknium1](https://github.com/teknium1)) - Smart approvals default; user-defined deny rules (block even under yolo); `/deny <reason>` relays the denial reason; plugin `pre_tool_call` approve action escalates to a human gate (re-landed with rule keys) ([#62661](https://github.com/NousResearch/hermes-agent/pull/62661), [#59164](https://github.com/NousResearch/hermes-agent/pull/59164), [#54518](https://github.com/NousResearch/hermes-agent/pull/54518), [#60504](https://github.com/NousResearch/hermes-agent/pull/60504) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) - Unified delegation concurrency caps (`max_async_children` deprecated); explain long provider waits on the live status line; deterministic tool-output risk exposure ([#56955](https://github.com/NousResearch/hermes-agent/pull/56955), [#64775](https://github.com/NousResearch/hermes-agent/pull/64775), [#61793](https://github.com/NousResearch/hermes-agent/pull/61793) — [@teknium1](https://github.com/teknium1)) - Codex: live TUI/desktop tool cards for the app-server runtime, commentary streamed as visible interim messages, compaction routed through `thread/compact/start`, max-output truncation recovery, oversized message ids dropped on replay, banked usage-limit resets via `/usage reset` ([#66514](https://github.com/NousResearch/hermes-agent/pull/66514), [#66115](https://github.com/NousResearch/hermes-agent/pull/66115), [#60114](https://github.com/NousResearch/hermes-agent/pull/60114), [#58155](https://github.com/NousResearch/hermes-agent/pull/58155), [#62225](https://github.com/NousResearch/hermes-agent/pull/62225) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor), [@JoaoMarcos44](https://github.com/JoaoMarcos44), [#64280](https://github.com/NousResearch/hermes-agent/pull/64280) — [@teknium1](https://github.com/teknium1)) - Hooks: oversized hook-injected context spills to disk ([#20468](https://github.com/NousResearch/hermes-agent/pull/20468) — [@teknium1](https://github.com/teknium1)) - Vibe reactions — floating hearts on affection across CLI/TUI/desktop, token-free core detection ([#62016](https://github.com/NousResearch/hermes-agent/pull/62016) — [@OutThisLife](https://github.com/OutThisLife)) ##### Secrets & config - Pluggable `SecretSource` interface + Bitwarden & 1Password providers (see Highlights) ([#59498](https://github.com/NousResearch/hermes-agent/pull/59498) — [@teknium1](https://github.com/teknium1), [@hwrdprkns](https://github.com/hwrdprkns)) - `hermes config get` / `unset`; warn on unknown root config keys + doctor deprecated-key reporting; `display.timestamp_format` ([#65540](https://github.com/NousResearch/hermes-agent/pull/65540), [#67370](https://github.com/NousResearch/hermes-agent/pull/67370), [#40622](https://github.com/NousResearch/hermes-agent/pull/40622) — [@teknium1](https://github.com/teknium1)) - Auxiliary model usage recorded per task in session accounting; conversation-scoped Nous Portal usage tags across aux/MoA/delegate calls; `--usage-file` JSON report for `hermes -z` ([#65537](https://github.com/NousResearch/hermes-agent/pull/65537), [#65468](https://github.com/NousResearch/hermes-agent/pull/65468), [#59615](https://github.com/NousResearch/hermes-agent/pull/59615) — [@teknium1](https://github.com/teknium1)) ##### Sessions & compression - Sessions export: Markdown/QMD/HTML/prompt-only/trace formats, HF upload, `--redact`, unified filters; full prune filter surface + bulk archive; CLI workspace filter + restore-cwd-on-resume ([#60186](https://github.com/NousResearch/hermes-agent/pull/60186), [#60492](https://github.com/NousResearch/hermes-agent/pull/60492), [#60507](https://github.com/NousResearch/hermes-agent/pull/60507), [#59327](https://github.com/NousResearch/hermes-agent/pull/59327), [#63091](https://github.com/NousResearch/hermes-agent/pull/63091) — [@teknium1](https://github.com/teknium1), [@web3blind](https://github.com/web3blind)) - Compression: preserve human intent and durable handoffs; retain prompt cache when memory is unchanged; flatten multimodal content for the summarizer keeping image handles; gateway compression routing integrity ([#67275](https://github.com/NousResearch/hermes-agent/pull/67275), [#67916](https://github.com/NousResearch/hermes-agent/pull/67916), [#65046](https://github.com/NousResearch/hermes-agent/pull/65046), [#56868](https://github.com/NousResearch/hermes-agent/pull/56868) — [@kshitijk4poor](https://github.com/kshitijk4poor), [@teknium1](https://github.com/teknium1)) - Gateway session metadata consolidated into state.db; routing index moved to state.db (sessions.json now an optional legacy mirror); exact API bytes persisted in an `api_content` sidecar ([#58899](https://github.com/NousResearch/hermes-agent/pull/58899), [#59203](https://github.com/NousResearch/hermes-agent/pull/59203), [#67274](https://github.com/NousResearch/hermes-agent/pull/67274) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🌐 Gateway, Fleet & Relay - **Durable delivery-obligation ledger** for final responses (see Highlights) ([#67181](https://github.com/NousResearch/hermes-agent/pull/67181) — [@teknium1](https://github.com/teknium1)) - **Profile-based routing for inbound messages** + multiplex hardening wave 2 + `GATEWAY_MULTIPLEX_PROFILES` override (see Highlights) ([#64835](https://github.com/NousResearch/hermes-agent/pull/64835), [#65700](https://github.com/NousResearch/hermes-agent/pull/65700), [#60589](https://github.com/NousResearch/hermes-agent/pull/60589) — [@teknium1](https://github.com/teknium1), [@benbarclay](https://github.com/benbarclay) + salvaged contributors) - Per-session turn lease + conversation-scope funnel; unified session reset boundaries (reset sessions stay reset); truthful runtime readiness checks; per-channel model and system prompt overrides; per-session `/model` overrides persist across restarts ([#67401](https://github.com/NousResearch/hermes-agent/pull/67401), [#65783](https://github.com/NousResearch/hermes-agent/pull/65783), [#62645](https://github.com/NousResearch/hermes-agent/pull/62645), [#56967](https://github.com/NousResearch/hermes-agent/pull/56967), [#57030](https://github.com/NousResearch/hermes-agent/pull/57030) — [@teknium1](https://github.com/teknium1)) - Session auto-reset default off; `/sessions search <query>`; webhook payload filters + route scripts; platform HTTP event callback routing; configurable long-running status phrases ([#60194](https://github.com/NousResearch/hermes-agent/pull/60194), [#57685](https://github.com/NousResearch/hermes-agent/pull/57685), [#60944](https://github.com/NousResearch/hermes-agent/pull/60944), [#65702](https://github.com/NousResearch/hermes-agent/pull/65702), [#58872](https://github.com/NousResearch/hermes-agent/pull/58872) — [@teknium1](https://github.com/teknium1)) - Relay: generic OIDC client-credentials provisioning (NAS-free), routed profile carried from the connector wire source, channel context consumed from the connector; Nous auth forensics + `nous_session_valid` on `/api/status` for hosted self-heal; Docker re-seeds a terminally-dead Nous bootstrap session on boot ([#60730](https://github.com/NousResearch/hermes-agent/pull/60730), [#60586](https://github.com/NousResearch/hermes-agent/pull/60586), [#64649](https://github.com/NousResearch/hermes-agent/pull/64649), [#59976](https://github.com/NousResearch/hermes-agent/pull/59976), [#59969](https://github.com/NousResearch/hermes-agent/pull/59969), [#59983](https://github.com/NousResearch/hermes-agent/pull/59983) — [@benbarclay](https://github.com/benbarclay)) ##### 📱 Messaging Platforms - **Inline choice pickers** for `/reasoning` and `/fast` on Telegram, Discord, and Matrix — one-tap native buttons instead of typing ([#65799](https://github.com/NousResearch/hermes-agent/pull/65799) — [@teknium1](https://github.com/teknium1)) - WhatsApp: native Baileys polls (clarify renders as a poll), locations, rich inbound metadata; dashboard pairing flow ([#58865](https://github.com/NousResearch/hermes-agent/pull/58865), [#60571](https://github.com/NousResearch/hermes-agent/pull/60571) — [@teknium1](https://github.com/teknium1)) - Discord: recover messages missed during reconnect; auto-created threads renamed to generated session titles; configurable interactive view timeout; opt-in owner mentions on exec-approval prompts; optional admin-only gate for approval buttons ([#66149](https://github.com/NousResearch/hermes-agent/pull/66149), [#60187](https://github.com/NousResearch/hermes-agent/pull/60187), [#60230](https://github.com/NousResearch/hermes-agent/pull/60230), [#60493](https://github.com/NousResearch/hermes-agent/pull/60493), [#51751](https://github.com/NousResearch/hermes-agent/pull/51751) — [@teknium1](https://github.com/teknium1)) - Slack: live per-tool status line ([#67080](https://github.com/NousResearch/hermes-agent/pull/67080) — [@teknium1](https://github.com/teknium1), salvaging [#62007](https://github.com/NousResearch/hermes-agent/issues/62007)) - Telegram: per-topic free-response allowlist; Google Chat clarify prompts rendered as cards ([#65543](https://github.com/NousResearch/hermes-agent/pull/65543), [#65546](https://github.com/NousResearch/hermes-agent/pull/65546) — [@teknium1](https://github.com/teknium1)) - Voice: `stt.echo_transcripts` toggle; MEDIA: captions attached to the media bubble on standalone sends; `display.tool_progress: log` option ([#58859](https://github.com/NousResearch/hermes-agent/pull/58859), [#61415](https://github.com/NousResearch/hermes-agent/pull/61415), [#57014](https://github.com/NousResearch/hermes-agent/pull/57014) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🖥️ Hermes Desktop App - **Contribution-driven shell on a layout-tree model** — panes, zones, and layouts as data; plugin-scoped i18n locale bundles followed ([#60638](https://github.com/NousResearch/hermes-agent/pull/60638), [#67303](https://github.com/NousResearch/hermes-agent/pull/67303) — [@OutThisLife](https://github.com/OutThisLife)) - **Capabilities page** — Skills/Tools/MCP + Hub in one place, with responsive overlay nav; CLI/dashboard parity for skills hub, MCP test/toggle/catalog, maintenance ops, log filters; five UX fixes from live testing ([#57590](https://github.com/NousResearch/hermes-agent/pull/57590), [#57441](https://github.com/NousResearch/hermes-agent/pull/57441), [#67482](https://github.com/NousResearch/hermes-agent/pull/67482) — [@OutThisLife](https://github.com/OutThisLife), [@teknium1](https://github.com/teknium1)) - **Hermes Cloud connection mode** (salvage of [#55402](https://github.com/NousResearch/hermes-agent/issues/55402)); soft gateway switch + gateway-settings polish; terminal execution backend picker with health probes ([#61912](https://github.com/NousResearch/hermes-agent/pull/61912), [#61916](https://github.com/NousResearch/hermes-agent/pull/61916), [#67203](https://github.com/NousResearch/hermes-agent/pull/67203) — [@OutThisLife](https://github.com/OutThisLife), [@teknium1](https://github.com/teknium1)) - Keybind hint tooltips + keybinds settings tab + unified worktree dialog; base-branch picker for new worktrees; green unread dot for background-finished sessions; background-task sidebar indicators; grouped tool calls across text-less messages; auto-scrolling window for long tool-call runs ([#65204](https://github.com/NousResearch/hermes-agent/pull/65204), [#62243](https://github.com/NousResearch/hermes-agent/pull/62243), [#65109](https://github.com/NousResearch/hermes-agent/pull/65109), [#65174](https://github.com/NousResearch/hermes-agent/pull/65174), [#61147](https://github.com/NousResearch/hermes-agent/pull/61147), [#57913](https://github.com/NousResearch/hermes-agent/pull/57913) — [@ethernet8023](https://github.com/ethernet8023), [@OutThisLife](https://github.com/OutThisLife)) - Session + project color system (inherit from project, per-session override, shared across sidebar/tabs); unified active-project identity in chat status; workspace path status action ([#67469](https://github.com/NousResearch/hermes-agent/pull/67469), [#67681](https://github.com/NousResearch/hermes-agent/pull/67681), [#67282](https://github.com/NousResearch/hermes-agent/pull/67282), [#63086](https://github.com/NousResearch/hermes-agent/pull/63086) — [@OutThisLife](https://github.com/OutThisLife)) - Declarative memory-provider panel + full-config modal; config-defined TTS/STT providers + xAI TTS params; custom endpoint settings; per-job cron model picker; profile-aware approval mode control; UI scale setting; Ctrl/Cmd+wheel zoom; chat backdrop toggle; `/journey` opens the memory graph overlay ([#67206](https://github.com/NousResearch/hermes-agent/pull/67206) salvaging [@erosika](https://github.com/erosika), [#67209](https://github.com/NousResearch/hermes-agent/pull/67209), [#67759](https://github.com/NousResearch/hermes-agent/pull/67759) — [@austinpickett](https://github.com/austinpickett), [#67472](https://github.com/NousResearch/hermes-agent/pull/67472), [#63520](https://github.com/NousResearch/hermes-agent/pull/63520), [#60457](https://github.com/NousResearch/hermes-agent/pull/60457), [#67029](https://github.com/NousResearch/hermes-agent/pull/67029), [#64598](https://github.com/NousResearch/hermes-agent/pull/64598), [#57267](https://github.com/NousResearch/hermes-agent/pull/57267) — [@teknium1](https://github.com/teknium1), [@OutThisLife](https://github.com/OutThisLife)) - Full TypeScript conversion of the desktop tree ([#57855](https://github.com/NousResearch/hermes-agent/pull/57855) — [@ethernet8023](https://github.com/ethernet8023)) ##### 📊 Web Dashboard - Memory provider switching; safe session import flow; WhatsApp pairing; Discord-specific toolsets editable from the web UI; clarified manual Telegram bot setup ([#60569](https://github.com/NousResearch/hermes-agent/pull/60569), [#63699](https://github.com/NousResearch/hermes-agent/pull/63699), [#60571](https://github.com/NousResearch/hermes-agent/pull/60571), [#65361](https://github.com/NousResearch/hermes-agent/pull/65361), [#64636](https://github.com/NousResearch/hermes-agent/pull/64636) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor), [@shannonsands](https://github.com/shannonsands)) - Terminal keep-alive + reattach for dashboard chat sessions; heavy turns isolated in a compute host; paste/drop images into Chat; `browser.headed` schema toggle; profile + gateway topology on `/api/status`; mobile/hosted OpenAI OAuth login ([#60515](https://github.com/NousResearch/hermes-agent/pull/60515), [#65895](https://github.com/NousResearch/hermes-agent/pull/65895), [#61929](https://github.com/NousResearch/hermes-agent/pull/61929), [#67046](https://github.com/NousResearch/hermes-agent/pull/67046), [#60537](https://github.com/NousResearch/hermes-agent/pull/60537), [#61330](https://github.com/NousResearch/hermes-agent/pull/61330) — [@teknium1](https://github.com/teknium1), [@OutThisLife](https://github.com/OutThisLife), [@benbarclay](https://github.com/benbarclay)) - `hermes serve` is a true headless backend (no web UI build/mount) ([#55923](https://github.com/NousResearch/hermes-agent/pull/55923) — [@OutThisLife](https://github.com/OutThisLife)) ##### 🧰 CLI & TUI - `/subscription` + `/topup` terminal billing (see Highlights) ([#51639](https://github.com/NousResearch/hermes-agent/pull/51639) — [@alt-glitch](https://github.com/alt-glitch)) - **`/model --once`** — one-turn model override that reverts automatically ([#67113](https://github.com/NousResearch/hermes-agent/pull/67113) — [@teknium1](https://github.com/teknium1), salvaging [#29923](https://github.com/NousResearch/hermes-agent/issues/29923)) - **Stacked slash-skill invocations** — `/skill-a /skill-b do XYZ` loads both skills in order (Claude Code port), with autocomplete + ghost text ([#57987](https://github.com/NousResearch/hermes-agent/pull/57987), [#58763](https://github.com/NousResearch/hermes-agent/pull/58763) — [@teknium1](https://github.com/teknium1)) - `--safe-mode` troubleshooting flag; uninstall dry-run; TLS failures fail fast with fix hints; `/compact` alias + preview flags; pip/Homebrew installs warned unsupported ([#45300](https://github.com/NousResearch/hermes-agent/pull/45300), [#60111](https://github.com/NousResearch/hermes-agent/pull/60111), [#57992](https://github.com/NousResearch/hermes-agent/pull/57992), [#57029](https://github.com/NousResearch/hermes-agent/pull/57029), [#57225](https://github.com/NousResearch/hermes-agent/pull/57225) — [@teknium1](https://github.com/teknium1), [@ethernet8023](https://github.com/ethernet8023)) - TUI: model picker refresh support; custom skill bundles dispatched as agent turns; banner sizes skills display to terminal width ([#59782](https://github.com/NousResearch/hermes-agent/pull/59782) — [@helix4u](https://github.com/helix4u), [#62859](https://github.com/NousResearch/hermes-agent/pull/62859) — [@Adolanium](https://github.com/Adolanium), [#40624](https://github.com/NousResearch/hermes-agent/pull/40624) — [@teknium1](https://github.com/teknium1)) - Hermes Console REPL + perf follow-ups; `hermes curator usage` all-skills view; entry-point plugins surfaced in `hermes plugins list` ([#57781](https://github.com/NousResearch/hermes-agent/pull/57781) — [@kshitijk4poor](https://github.com/kshitijk4poor), [#36727](https://github.com/NousResearch/hermes-agent/pull/36727), [#40623](https://github.com/NousResearch/hermes-agent/pull/40623) — [@teknium1](https://github.com/teknium1)) ##### 🔧 Tool System, Skills & MCP - MCP: `mcp__server__tool` naming convention; server log notifications surfaced in agent.log; hosted OAuth completed across Dashboard + Desktop; configurable `redirect_uri`/`redirect_host` for proxied/WAF setups; OAuth callback port races closed; Blender added to the MCP catalog with a curated 4-tool default ([#52750](https://github.com/NousResearch/hermes-agent/pull/52750), [#57416](https://github.com/NousResearch/hermes-agent/pull/57416), [#66151](https://github.com/NousResearch/hermes-agent/pull/66151), [#65610](https://github.com/NousResearch/hermes-agent/pull/65610), [#65622](https://github.com/NousResearch/hermes-agent/pull/65622), [#64463](https://github.com/NousResearch/hermes-agent/pull/64463) — [@teknium1](https://github.com/teknium1), [@benbarclay](https://github.com/benbarclay)) - Skills: `security/unbroker` (autonomous data-broker removal) + blind opt-out hardening; `unreal-mcp` companion skill; blender-mcp reworked around the catalog entry; humanizer pattern expansion; `mcp-oauth-remote-gateway` optional skill ([#57438](https://github.com/NousResearch/hermes-agent/pull/57438), [#57902](https://github.com/NousResearch/hermes-agent/pull/57902), [#65989](https://github.com/NousResearch/hermes-agent/pull/65989), [#64715](https://github.com/NousResearch/hermes-agent/pull/64715) — [@SHL0MS](https://github.com/SHL0MS), [#65066](https://github.com/NousResearch/hermes-agent/pull/65066), [#65486](https://github.com/NousResearch/hermes-agent/pull/65486) — [@teknium1](https://github.com/teknium1)) - Browser: full snapshots stored on truncation, eval denylist opt-in; computer\_use follows cua-driver's verify→escalate ladder ([#65923](https://github.com/NousResearch/hermes-agent/pull/65923), [#67123](https://github.com/NousResearch/hermes-agent/pull/67123) — [@teknium1](https://github.com/teknium1)) - Kanban: modal create-task dialog + editable board project directory; Done-card results made obvious; grab-to-pan board scrolling; attachment toolset + CLI with SSRF-guarded URL fetch; project directory captured at board creation ([#66333](https://github.com/NousResearch/hermes-agent/pull/66333), [#63638](https://github.com/NousResearch/hermes-agent/pull/63638), [#60226](https://github.com/NousResearch/hermes-agent/pull/60226), [#65698](https://github.com/NousResearch/hermes-agent/pull/65698), [#63249](https://github.com/NousResearch/hermes-agent/pull/63249) — [@teknium1](https://github.com/teknium1)) - Cron: durable execution audit history; one-shot stale-removal race fixed; run-claim TTL derived from HERMES\_CRON\_TIMEOUT ([#61791](https://github.com/NousResearch/hermes-agent/pull/61791) — [@teknium1](https://github.com/teknium1), [#62014](https://github.com/NousResearch/hermes-agent/pull/62014) — [@PRATHAMESH75](https://github.com/PRATHAMESH75), [#59567](https://github.com/NousResearch/hermes-agent/pull/59567)) - mem0: self-hosted dashboard backend + recall tuning + setup-wizard mode ([#56943](https://github.com/NousResearch/hermes-agent/pull/56943), [#60494](https://github.com/NousResearch/hermes-agent/pull/60494) — [@kshitijk4poor](https://github.com/kshitijk4poor), [@teknium1](https://github.com/teknium1)) - Image gen: Codex image inputs; unsupported Codex image accounts classified; tool args recursively normalized by schema (cline port) ([#57017](https://github.com/NousResearch/hermes-agent/pull/57017), [#63627](https://github.com/NousResearch/hermes-agent/pull/63627), [#52220](https://github.com/NousResearch/hermes-agent/pull/52220) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🔒 Security & Reliability - Vertex: credential/project/region resolution through the profile secret scope; `VERTEX_CREDENTIALS_PATH`/`GOOGLE_APPLICATION_CREDENTIALS` stripped from subprocess env ([#56680](https://github.com/NousResearch/hermes-agent/pull/56680), [#56582](https://github.com/NousResearch/hermes-agent/pull/56582) — [@srojk34](https://github.com/srojk34)) - Six P1 hardening PRs salvaged in one pass — browser guards, MEDIA anchoring, .env lockdown, delegate ACP transport ([#57660](https://github.com/NousResearch/hermes-agent/pull/57660) — [@teknium1](https://github.com/teknium1)) - Media/vision/image-gen local-file reads routed through the shared credential-read guard; native image routing guarded by file-safety policy; unified image-source resolver + terminal-backend confinement ([#58709](https://github.com/NousResearch/hermes-agent/pull/58709), [#58752](https://github.com/NousResearch/hermes-agent/pull/58752), [#57890](https://github.com/NousResearch/hermes-agent/pull/57890) — [@teknium1](https://github.com/teknium1)) - Webhook body-cap sweep: explicit `client_max_size` on 3 uncapped aiohttp servers + completion sweep; Raft chunked-request body limit; timestamp-bound V2 webhook signatures ([#59180](https://github.com/NousResearch/hermes-agent/pull/59180), [#59215](https://github.com/NousResearch/hermes-agent/pull/59215), [#58902](https://github.com/NousResearch/hermes-agent/pull/58902), [#58508](https://github.com/NousResearch/hermes-agent/pull/58508) — [@teknium1](https://github.com/teknium1), [@srojk34](https://github.com/srojk34)) - Redaction: Fireworks token prefixes + Telegram transport errors; env-lookup false positives fixed for KEY=value and JSON/YAML config fields; bot tokens scrubbed from Telegram connect/send errors ([#58501](https://github.com/NousResearch/hermes-agent/pull/58501), [#58534](https://github.com/NousResearch/hermes-agent/pull/58534), [#58915](https://github.com/NousResearch/hermes-agent/pull/58915), [#58893](https://github.com/NousResearch/hermes-agent/pull/58893) — [@teknium1](https://github.com/teknium1)) - computer-use: subprocess env sanitized across all five cua-driver spawn sites ([#58889](https://github.com/NousResearch/hermes-agent/pull/58889), [#59165](https://github.com/NousResearch/hermes-agent/pull/59165) — [@teknium1](https://github.com/teknium1)) - Dashboard: managed-files credential guard widened past .env + dir-tree gap closed; OAuth token TOCTOU closed with atomic 0o600 writes; stale dashboards can't recreate deleted profiles ([#58222](https://github.com/NousResearch/hermes-agent/pull/58222) — [@kshitijk4poor](https://github.com/kshitijk4poor), [#60236](https://github.com/NousResearch/hermes-agent/pull/60236) — [@teknium1](https://github.com/teknium1), [#49435](https://github.com/NousResearch/hermes-agent/pull/49435) — [@LeonSGP43](https://github.com/LeonSGP43)) - CI: untrusted refs passed through env, not `run:` interpolation; JS/TS tests wired into CI with source-regex tests banned; js-autofix pushes via PR instead of direct-to-main ([#57842](https://github.com/NousResearch/hermes-agent/pull/57842) — [@jquesnelle](https://github.com/jquesnelle), [#60707](https://github.com/NousResearch/hermes-agent/pull/60707), [#65186](https://github.com/NousResearch/hermes-agent/pull/65186) — [@ethernet8023](https://github.com/ethernet8023)) - Docker: terminal network toggle with full-path coverage; Git Bash Mandatory-ASLR install failures detected; Windows updater console hidden during handoff ([#59149](https://github.com/NousResearch/hermes-agent/pull/59149) — [@teknium1](https://github.com/teknium1), [#64651](https://github.com/NousResearch/hermes-agent/pull/64651), [#66040](https://github.com/NousResearch/hermes-agent/pull/66040) — [@helix4u](https://github.com/helix4u)) - Anthropic: request-local clients so the stale/interrupt watchdog never corrupts SQLite; per-profile OAuth file; OAuth login 429 fixed (UA must not be claude-code/) ([#67238](https://github.com/NousResearch/hermes-agent/pull/67238) — [@OutThisLife](https://github.com/OutThisLife), [#59339](https://github.com/NousResearch/hermes-agent/pull/59339), [#58178](https://github.com/NousResearch/hermes-agent/pull/58178) — [@teknium1](https://github.com/teknium1)) - Gateway/agent: tool\_call\_id deduplicated across pre-API sanitizers; background review inherits parent reasoning\_config for Anthropic cache parity; `/new` memory extraction moved off the command path ([#58350](https://github.com/NousResearch/hermes-agent/pull/58350), [#64379](https://github.com/NousResearch/hermes-agent/pull/64379), [#61139](https://github.com/NousResearch/hermes-agent/pull/61139) — [@teknium1](https://github.com/teknium1), [@kshitijk4poor](https://github.com/kshitijk4poor)) ##### 🔁 Reverted in this window (for the record) - iron-proxy credential-injection egress firewall ([#30179](https://github.com/NousResearch/hermes-agent/issues/30179) → reverted in [#58489](https://github.com/NousResearch/hermes-agent/pull/58489)) — not shipping in this release - dynamic-workflow orchestration skill (landed, then reverted) — not shipping - memory provider-actions extension point (landed, then reverted) — not shipping - Note: the plugin `pre_tool_call` approve escalation was reverted mid-window but **re-landed** in [#60504](https://github.com/NousResearch/hermes-agent/pull/60504) and ships in this release. ##### 👥 Contributors **450+ people** contributed to this release (via commits, co-author trailers, and salvaged PRs) — the biggest contributor window yet. Thank you, all of you. ##### Core team - [@teknium1](https://github.com/teknium1) — release lead; TTFT perf wave, delivery + delegation durability, smart approvals, SecretSource, gateway multiplex + profile routing, sessions export, security round, and a \~290-PR community salvage burn - [@OutThisLife](https://github.com/OutThisLife) — desktop app (the speed wave, layout-tree shell, Capabilities page, session colors, vibe reactions, TUI incremental markdown, perf harness) - [@kshitijk4poor](https://github.com/kshitijk4poor) — GPT-5.6 end-to-end, DeepInfra + Upstage Solar providers, perf cluster, compression integrity, mem0, dashboard guards - [@ethernet8023](https://github.com/ethernet8023) — CI overhaul (JS/TS tests wired in, autofix-via-PR, python speedups), desktop keybinds/worktrees/status indicators, full desktop TypeScript conversion - [@benbarclay](https://github.com/benbarclay) — relay OIDC provisioning, gateway multiplex override, Nous auth self-heal, hosted MCP OAuth groundwork - [@alt-glitch](https://github.com/alt-glitch) — terminal billing (`/subscription`, `/topup`), desktop billing tab - [@helix4u](https://github.com/helix4u) — desktop provider/model UX, TUI model picker refresh, Windows install/updater hardening - [@austinpickett](https://github.com/austinpickett) — desktop custom endpoint settings - [@SHL0MS](https://github.com/SHL0MS) — unbroker + unreal-mcp skills, humanizer expansion ##### Top community contributors - [@srojk34](https://github.com/srojk34) — security hardening: Vertex credential/project/region scoping through the profile secret scope, subprocess env stripping, Raft chunked-request body limits - [@HexLab98](https://github.com/HexLab98) — 11 fixes across MCP capability gating, Windows installer PATH, desktop cron editing, gateway systemd warnings - [@UnathiCodex](https://github.com/UnathiCodex) — desktop stability: zoom across display moves, LaTeX rendering, resume-stall and runtime-readiness fixes - [@xxxigm](https://github.com/xxxigm) — `<think>` leak fix after thinking-only retry flush, dashboard auth/theme/PTY fixes - [@erosika](https://github.com/erosika) — desktop declarative memory-provider panel + honcho recall/timeout correctness - [@Frowtek](https://github.com/Frowtek) — credential security: master stores never mounted into skill sandboxes, live-transcript redaction, dashboard api\_key precedence - [@necoweb3](https://github.com/necoweb3) — browser private-page CDP guard, cron one-shot liveness, gateway compression fail-closed - [@DavidMetcalfe](https://github.com/DavidMetcalfe) — desktop updater version pill, Local/custom endpoint exposure, sidebar collapse behavior - [@shannonsands](https://github.com/shannonsands) — dashboard: mobile channel setup, Discord toolsets from web UI, Telegram setup clarity - [@vishal-dharm](https://github.com/vishal-dharm) — Gemini request-context improvements - [@PRATHAMESH75](https://github.com/PRATHAMESH75) — cron one-shot stale-removal race, dashboard multiplex port-binding guard - [@alelpoan](https://github.com/alelpoan), [@embwl0x](https://github.com/embwl0x), [@Adolanium](https://github.com/Adolanium), [@giggling-ginger](https://github.com/giggling-ginger), [@Drexuxux](https://github.com/Drexuxux), [@frizikk](https://github.com/frizikk), [@JoaoMarcos44](https://github.com/JoaoMarcos44), [@wesleysimplici](https://github.com/wesleysimplici), [@LeonSGP43](https://github.com/LeonSGP43), [@pierrenode](https://github.com/pierrenode), [@simpolism](https://github.com/simpolism), [@MorAlekss](https://github.com/MorAlekss), [@r266-tech](https://github.com/r266-tech), [@WadydX](https://github.com/WadydX), [@nv-kasikritc](https://github.com/nv-kasikritc) — targeted fixes across desktop, TUI, gateway, cron, webhook, nix, and browser surfaces - Salvaged-work authors whose PRs were cherry-picked with credit this window: [@Burgunthy](https://github.com/Burgunthy) (profile routing), [@web3blind](https://github.com/web3blind) (sessions export), [@hwrdprkns](https://github.com/hwrdprkns) (1Password), [@Christopher-Schulze](https://github.com/Christopher-Schulze), [@Ahmett101](https://github.com/Ahmett101), [@sjiangtao2024](https://github.com/sjiangtao2024), and many more — see the salvage PR bodies for full attribution ##### All contributors [@0-CYBERDYNE-SYSTEMS-0](https://github.com/0-CYBERDYNE-SYSTEMS-0), [@0disoft](https://github.com/0disoft), [@0xbyt4](https://github.com/0xbyt4), [@100yenadmin](https://github.com/100yenadmin), [@17324393074](https://github.com/17324393074), [@2751738943](https://github.com/2751738943), [@8294](https://github.com/8294), [@abhibansal-sg](https://github.com/abhibansal-sg), [@adambiggs](https://github.com/adambiggs), [@Adolanium](https://github.com/Adolanium), [@aeyeopsdev](https://github.com/aeyeopsdev), [@aguung](https://github.com/aguung), [@AhmetArif0](https://github.com/AhmetArif0), [@Ahmett101](https://github.com/Ahmett101), [@ai-ag2026](https://github.com/ai-ag2026), [@AIalliAI](https://github.com/AIalliAI), [@ajzrva-sys](https://github.com/ajzrva-sys), [@alastraz](https://github.com/alastraz), [@alelpoan](https://github.com/alelpoan), [@alex-fireworks](https://github.com/alex-fireworks), [@alex-heritier](https://github.com/alex-heritier), [@alex107ivanov](https://github.com/alex107ivanov), [@AlexFucuson9](https://github.com/AlexFucuson9), [@Alix-007](https://github.com/Alix-007), [@allenliang2022](https://github.com/allenliang2022), [@Almurat123](https://github.com/Almurat123), [@AlsayedHoota](https://github.com/AlsayedHoota), [@alt-glitch](https://github.com/alt-glitch), [@alvarosanchez](https://github.com/alvarosanchez), [@amanning3390](https://github.com/amanning3390), [@AmAzing129](https://github.com/AmAzing129), [@AndreasHiltner](https://github.com/AndreasHiltner), [@andrewhomeyer](https://github.com/andrewhomeyer), [@annguyenNous](https://github.com/annguyenNous), [@ansel-f](https://github.com/ansel-f), [@antydizajn](https://github.com/antydizajn), [@arminanton](https://github.com/arminanton), [@arnispiekus](https://github.com/arnispiekus), [@asimons81](https://github.com/asimons81), [@asscan](https://github.com/asscan), [@ats3v](https://github.com/ats3v), [@austinlaw076](https://github.com/austinlaw076), [@austinpickett](https://github.com/austinpickett), [@avifenesh](https://github.com/avifenesh), [@aydnOktay](https://github.com/aydnOktay), [@Bartok9](https://github.com/Bartok9), [@bautrey](https://github.com/bautrey), [@bbednarski9](https://github.com/bbednarski9), [@bbopen](https://github.com/bbopen), [@benbarclay](https://github.com/benbarclay), [@bigstar0920](https://github.com/bigstar0920), [@binhnt92](https://github.com/binhnt92), [@bird](https://github.com/bird), [@Black0Fox0](https://github.com/Black0Fox0), [@BlackishGreen33](https://github.com/BlackishGreen33), [@bo](https://github.com/bo).fu, [@brendandebeasi](https://github.com/brendandebeasi), [@briandevans](https://github.com/briandevans), [@BROCCOLO1D](https://github.com/BROCCOLO1D), [@Bruce-anle](https://github.com/Bruce-anle), [@brunz-me](https://github.com/brunz-me), [@Burgunthy](https://github.com/Burgunthy), [@bytesnail](https://github.com/bytesnail), [@catbearlove1-lang](https://github.com/catbearlove1-lang), [@Cdddo](https://github.com/Cdddo), [@cgarwood82](https://github.com/cgarwood82), [@CharmingGroot](https://github.com/CharmingGroot), [@chouqin](https://github.com/chouqin), [@Christopher-Schulze](https://github.com/Christopher-Schulze), [@claudlos](https://github.com/claudlos), [@CocaKova](https://github.com/CocaKova), [@Code-suphub](https://github.com/Code-suphub), [@CodeForgeNet](https://github.com/CodeForgeNet), [@craigdfrench](https://github.com/craigdfrench), [@CrazyBoyM](https://github.com/CrazyBoyM), [@crazywriter1](https://github.com/crazywriter1), [@cresslank](https://github.com/cresslank), [@cruzanstx](https://github.com/cruzanstx), [@cyrkstudios](https://github.com/cyrkstudios), [@danilofalcao](https://github.com/danilofalcao), [@datachainsystems](https://github.com/datachainsystems), [@DatTheMaster](https://github.com/DatTheMaster), [@davidb73-hub](https://github.com/davidb73-hub), [@davidgut1982](https://github.com/davidgut1982), [@DavidMetcalfe](https://github.com/DavidMetcalfe), [@davidrobertson](https://github.com/davidrobertson), [@deacon-botdoctor](https://github.com/deacon-botdoctor), [@DECK6](https://github.com/DECK6), [@deepujain](https://github.com/deepujain), [@derek2000139](https://github.com/derek2000139), [@designnotdrum](https://github.com/designnotdrum), [@deusyu](https://github.com/deusyu), [@devatnull](https://github.com/devatnull), [@devorun](https://github.com/devorun), [@dexhunter](https://github.com/dexhunter), [@dfein38347g](https://github.com/dfein38347g), [@Dhravya](https://github.com/Dhravya), [@DictatorBacon](https://github.com/DictatorBacon), [@digitalbase](https://github.com/digitalbase), [@dlkakbs](https://github.com/dlkakbs), [@dmabry](https://github.com/dmabry), [@DNAlec](https://github.com/DNAlec), [@dodo-reach](https://github.com/dodo-reach), [@doncazper](https://github.com/doncazper), [@dorokuma](https://github.com/dorokuma), [@doxe0x](https://github.com/doxe0x), [@Drexuxux](https://github.com/Drexuxux), [@dschnurbusch](https://github.com/dschnurbusch), [@Dusk1e](https://github.com/Dusk1e), [@EdderTalmor](https://github.com/EdderTalmor), [@egilewski](https://github.com/egilewski), [@elashera](https://github.com/elashera), [@Elektrofussel](https://github.com/Elektrofussel), [@eliteworkstation94-ai](https://github.com/eliteworkstation94-ai), [@embwl0x](https://github.com/embwl0x), [@emo-eth](https://github.com/emo-eth), [@emozilla](https://github.com/emozilla), [@enzo-adami](https://github.com/enzo-adami), [@Epoxidex](https://github.com/Epoxidex), [@ErnestHysa](https://github.com/ErnestHysa), [@Erosika](https://github.com/Erosika), [@esthonjr](https://github.com/esthonjr), [@ethernet8023](https://github.com/ethernet8023), [@evefromwayback](https://github.com/evefromwayback), [@evelynburger](https://github.com/evelynburger), [@F4TB0Yz](https://github.com/F4TB0Yz), [@falkoro](https://github.com/falkoro), [@fanyangCS](https://github.com/fanyangCS), [@firefly](https://github.com/firefly), [@fjlaowan1983](https://github.com/fjlaowan1983), [@flewe](https://github.com/flewe), [@flo1t](https://github.com/flo1t), [@flow-digital-ny](https://github.com/flow-digital-ny), [@floze-the-genius](https://github.com/floze-the-genius), [@frizikk](https://github.com/frizikk), [@Frowtek](https://github.com/Frowtek), [@FuryMartin](https://github.com/FuryMartin), [@fyzanshaik](https://github.com/fyzanshaik), [@gauravsaxena1997](https://github.com/gauravsaxena1997), [@geoffreybutler94](https://github.com/geoffreybutler94), [@georgedrury](https://github.com/georgedrury), [@gigakun3030](https://github.com/gigakun3030), [@giggling-ginger](https://github.com/giggling-ginger), [@Git-on-my-level](https://github.com/Git-on-my-level), [@gitcommit90](https://github.com/gitcommit90), [@githubespresso407](https://github.com/githubespresso407), [@gnodet](https://github.com/gnodet), [@GottZ](https://github.com/G…

… multiplex_profiles Replace raw os.getenv("TELEGRAM_ALLOWED_USERS") reads in the Telegram adapter's pre-filter with gateway.authz_mixin._auth_env so the served profile's .env is consulted when its secret scope is installed. This mirrors the gateway-layer fix in PRs NousResearch#61985/NousResearch#65629/NousResearch#65700 down to the adapter pre-filter, fixing the Telegram mirror of issue NousResearch#72348. See README.md for details, scope notes, and end-to-end test evidence. Fixes NousResearch#72348 (Telegram mirror)

PRATHAMESH75 and others added 12 commits July 16, 2026 06:48

test: valid-shape Telegram token in port-binding guard fixture

8dfaa20

The #62803 branch predates PR #64636's Telegram token-shape validation on the messaging platform PUT endpoint; align the new guard test's fixture with the validated format.

fix(gateway): skip port-conflicting multiplex profiles

89f3634

fix(gateway): preserve multiplex profile in model picker

f3628e8

chore(release): map rlaehddus302's email in AUTHOR_MAP (PR #61985 sal…

74d3fb7

…vage)

test: accept profile_name kwarg in auth-check stubs

eb58ffd

tonydwb reviewed Jul 16, 2026

View reviewed changes

teknium1 merged commit c3b2af9 into main Jul 16, 2026
33 checks passed

teknium1 deleted the salvage/multiplex-wave2 branch July 16, 2026 14:17

BrewTestBot mentioned this pull request Jul 20, 2026

hermes-agent 2026.7.20 Homebrew/homebrew-core#294218

Merged

1 task

This was referenced Jul 20, 2026

Upstream Hermes v2026.7.20 disponible (ultimo sync: v2026.6.5) samuelgradientai-sys/clawksis-agent#63

Open

chore: bump NousResearch/hermes-agent version from v2026.7.7.2 to v2026.7.20 Docker-Hub-sirmark/docker-hermes-agent#16

Merged

tomfuertes mentioned this pull request Jul 21, 2026

chore: bump Hermes to v2026.7.20 (0.19.0) notambourine/hermes-agent-template#27

Merged

cal88 mentioned this pull request Jul 27, 2026

[Bug]: Discord adapter allow/deny gates are process-global, breaking per-profile isolation under multiplex_profiles #72348

Closed

1 task

teknium1 mentioned this pull request Aug 1, 2026

fix(gateway): make Discord/Telegram allow/deny gates per-profile under multiplex #75970

Merged

Navigation Menu

Uh oh!

fix(gateway): multiplex wave 2 — port-binding degradation, dashboard guard, scoped picker//profile/api_server (7-PR cluster salvage) - #65700

fix(gateway): multiplex wave 2 — port-binding degradation, dashboard guard, scoped picker//profile/api_server (7-PR cluster salvage)#65700
teknium1 merged 12 commits into
mainfrom
salvage/multiplex-wave2

teknium1 commented Jul 16, 2026

Uh oh!

tonydwb left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

Uh oh!

Conversation

teknium1 commented Jul 16, 2026

Summary

Salvaged work

Not salvaged (closing separately with evidence)

Validation

Infographic

Uh oh!

tonydwb left a comment

Choose a reason for hiding this comment

Code Review Summary

Overview

Assessment

Suggestion

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants