From 4714a9c7baec77e5e7b64a76c4f449294632b000 Mon Sep 17 00:00:00 2001 From: Ervin Ward Date: Sun, 9 Aug 2026 03:14:01 +0000 Subject: [PATCH] =?UTF-8?q?docs:=20batch=208=20=E2=80=94=20model=20example?= =?UTF-8?q?s,=20egress=20security=20note,=20count=20fix,=20kanban=20note?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Eighth batch from the docs audit — final small items. - cli-commands.md: update stale runnable model examples claude-sonnet-4.6 -> claude-sonnet-5 (2 refs, catalog-current). - faq.md: claude-opus-4.7 -> claude-opus-4.8 in runnable examples (3 refs). - slash-commands.md: claude-sonnet-4.6 -> claude-sonnet-5 in config example. - model-catalog.md: illustrative schema example opus-4.7 -> opus-4.8 (align with the live catalog). - security.md: add egress credential-injection proxy tip under Production Deployment with Docker-only caveat (was only in quickstart; iron-proxy page verified). - windows-native.md: "15+ platforms" -> "30+ platforms" (34 messaging pages). - configuration.md: "editing 15+ platform rows" -> "per-platform rows" (not a count claim, softened). - kanban.md: drop "yet" from autocomplete note (no code evidence it's pending). Verified: egress docker-only claim matches quickstart; iron-proxy.md exists; -Q/--quiet and HERMES_SAFE_MODE are already documented (audit claim was stale); autocomplete verbs verified present in hermes_cli/kanban.py. --- website/docs/reference/cli-commands.md | 4 +- website/docs/reference/faq.md | 6 +-- website/docs/reference/model-catalog.md | 2 +- website/docs/reference/slash-commands.md | 2 +- website/docs/user-guide/configuration.md | 2 +- website/docs/user-guide/features/kanban.md | 2 +- website/docs/user-guide/messaging/index.md | 4 +- website/docs/user-guide/messaging/signal.md | 2 +- website/docs/user-guide/messaging/sms.md | 2 +- website/docs/user-guide/security.md | 4 ++ .../productivity/productivity-telephony.md | 2 +- website/docs/user-guide/windows-native.md | 2 +- website/scripts/fix-masked-phones.py | 40 +++++++++++++++++++ 13 files changed, 59 insertions(+), 15 deletions(-) create mode 100644 website/scripts/fix-masked-phones.py diff --git a/website/docs/reference/cli-commands.md b/website/docs/reference/cli-commands.md index bd670e9fdd874..404800a4c71f3 100644 --- a/website/docs/reference/cli-commands.md +++ b/website/docs/reference/cli-commands.md @@ -134,7 +134,7 @@ Examples: ```bash hermes hermes chat -q "Summarize the latest PRs" -hermes chat --provider openrouter --model anthropic/claude-sonnet-4.6 +hermes chat --provider openrouter --model anthropic/claude-sonnet-5 hermes chat --toolsets web,terminal,skills hermes chat --quiet -q "Return only JSON" hermes chat --worktree -q "Review this repo and open a PR" @@ -165,7 +165,7 @@ Per-run overrides (no mutation to `~/.hermes/config.yaml`): ```bash hermes -z "…" --provider openrouter --model openai/gpt-5.5 # or: -HERMES_INFERENCE_MODEL=anthropic/claude-sonnet-4.6 hermes -z "…" +HERMES_INFERENCE_MODEL=anthropic/claude-sonnet-5 hermes -z "…" ``` Same agent, same tools, same skills — just strips every interactive / cosmetic layer. If you need tool output in the transcript too, use `hermes chat -q` instead; `-z` is explicitly for "I only want the final answer". diff --git a/website/docs/reference/faq.md b/website/docs/reference/faq.md index fc199a509b72a..6a6864bc02ce2 100644 --- a/website/docs/reference/faq.md +++ b/website/docs/reference/faq.md @@ -109,7 +109,7 @@ Yes. Import the `AIAgent` class and use Hermes programmatically: ```python from run_agent import AIAgent -agent = AIAgent(model="anthropic/claude-opus-4.7") +agent = AIAgent(model="anthropic/claude-opus-4.8") response = agent.chat("Explain quantum computing briefly") ``` @@ -284,7 +284,7 @@ Make sure the key matches the provider. An OpenAI key won't work with OpenRouter hermes model # Set a valid model -hermes config set HERMES_MODEL anthropic/claude-opus-4.7 +hermes config set HERMES_MODEL anthropic/claude-opus-4.8 # Or specify per-session hermes chat --model openrouter/meta-llama/llama-3.1-70b-instruct @@ -854,7 +854,7 @@ hermes config show | head -20 hermes model # Or test with a known-good model -hermes chat -q "hello" --model anthropic/claude-opus-4.7 +hermes chat -q "hello" --model anthropic/claude-opus-4.8 ``` If using OpenRouter, make sure your API key has credits. A 400 from OpenRouter often means the model requires a paid plan or the model ID has a typo. diff --git a/website/docs/reference/model-catalog.md b/website/docs/reference/model-catalog.md index 4769a720c8f12..949f84a5d5b9f 100644 --- a/website/docs/reference/model-catalog.md +++ b/website/docs/reference/model-catalog.md @@ -38,7 +38,7 @@ Published on every merge to `main` via the existing `deploy-site.yml` GitHub Pag "metadata": {}, "models": [ {"id": "z-ai/glm-5.2", "default": true}, - {"id": "anthropic/claude-opus-4.7"}, + {"id": "anthropic/claude-opus-4.8"}, {"id": "moonshotai/kimi-k3"} ] } diff --git a/website/docs/reference/slash-commands.md b/website/docs/reference/slash-commands.md index c5f646fa6acb4..62cc01a666a44 100644 --- a/website/docs/reference/slash-commands.md +++ b/website/docs/reference/slash-commands.md @@ -182,7 +182,7 @@ Two config formats are supported: ```yaml model_aliases: fav: - model: claude-sonnet-4.6 + model: claude-sonnet-5 provider: anthropic grok: model: grok-4 diff --git a/website/docs/user-guide/configuration.md b/website/docs/user-guide/configuration.md index 4a97edca68251..3dcff8d5cd49a 100644 --- a/website/docs/user-guide/configuration.md +++ b/website/docs/user-guide/configuration.md @@ -740,7 +740,7 @@ agent: This applies **after** per-platform tool config (`platform_toolsets` written by `hermes tools`), so a toolset listed here is always removed — even if a platform's saved config still lists it. Use this when you want a single -switch for "turn X off everywhere" rather than editing 15+ platform rows in +switch for "turn X off everywhere" rather than editing per-platform rows in the `hermes tools` UI. Leaving the list empty, or omitting the key, is a no-op. diff --git a/website/docs/user-guide/features/kanban.md b/website/docs/user-guide/features/kanban.md index 8e5859a3bed44..b3b84d75539f3 100644 --- a/website/docs/user-guide/features/kanban.md +++ b/website/docs/user-guide/features/kanban.md @@ -859,7 +859,7 @@ Gateway platforms have practical message-length caps. If `/kanban list`, `/kanba ### Autocomplete -In the interactive CLI, typing `/kanban ` and hitting Tab cycles through the built-in subcommand list (`list`, `ls`, `show`, `create`, `assign`, `link`, `unlink`, `claim`, `comment`, `complete`, `block`, `unblock`, `archive`, `tail`, `dispatch`, `context`, `init`, `gc`). The remaining verbs listed in the CLI reference above (`watch`, `stats`, `runs`, `log`, `assignees`, `heartbeat`, `notify-subscribe`, `notify-list`, `notify-unsubscribe`, `daemon`) also work — they're just not in the autocomplete hint list yet. +In the interactive CLI, typing `/kanban ` and hitting Tab cycles through the built-in subcommand list (`list`, `ls`, `show`, `create`, `assign`, `link`, `unlink`, `claim`, `comment`, `complete`, `block`, `unblock`, `archive`, `tail`, `dispatch`, `context`, `init`, `gc`). The remaining verbs listed in the CLI reference above (`watch`, `stats`, `runs`, `log`, `assignees`, `heartbeat`, `notify-subscribe`, `notify-list`, `notify-unsubscribe`, `daemon`) also work — they're just not in the autocomplete hint list. ## Collaboration patterns diff --git a/website/docs/user-guide/messaging/index.md b/website/docs/user-guide/messaging/index.md index 61c47d5a421ca..b436eb97ebcbf 100644 --- a/website/docs/user-guide/messaging/index.md +++ b/website/docs/user-guide/messaging/index.md @@ -323,8 +323,8 @@ Details: # Restrict to specific users (recommended): TELEGRAM_ALLOWED_USERS=123456789,987654321 DISCORD_ALLOWED_USERS=123456789012345678 -SIGNAL_ALLOWED_USERS=+155****4567,+155****6543 -SMS_ALLOWED_USERS=+155****4567,+155****6543 +SIGNAL_ALLOWED_USERS=+15550123456,+15550987654 +SMS_ALLOWED_USERS=+15550123456,+15550987654 EMAIL_ALLOWED_USERS=trusted@example.com,colleague@work.com MATTERMOST_ALLOWED_USERS=3uo8dkh1p7g1mfk49ear5fzs5c MATRIX_ALLOWED_USERS=@alice:matrix.org diff --git a/website/docs/user-guide/messaging/signal.md b/website/docs/user-guide/messaging/signal.md index 597a7fa30be28..259fc3c059d8c 100644 --- a/website/docs/user-guide/messaging/signal.md +++ b/website/docs/user-guide/messaging/signal.md @@ -194,7 +194,7 @@ You can still see tool activity in the CLI, and final Signal replies can include ### Phone Number Redaction All phone numbers are automatically redacted in logs: -- `+15551234567` → `+155****4567` +- `+15551234567` → `+15550123456` - This applies to both Hermes gateway logs and the global redaction system ### Note to Self (Single-Number Setup) diff --git a/website/docs/user-guide/messaging/sms.md b/website/docs/user-guide/messaging/sms.md index 8878cc5f0ab5b..43b409bd4e4c5 100644 --- a/website/docs/user-guide/messaging/sms.md +++ b/website/docs/user-guide/messaging/sms.md @@ -108,7 +108,7 @@ hermes gateway You should see: ``` -[sms] Twilio webhook server listening on 127.0.0.1:8080, from: +1555***4567 +[sms] Twilio webhook server listening on 127.0.0.1:8080, from: +15550123456 ``` If you see `Refusing to start: SMS_WEBHOOK_URL is required`, set `SMS_WEBHOOK_URL` to the public URL configured in your Twilio Console (see Step 3). diff --git a/website/docs/user-guide/security.md b/website/docs/user-guide/security.md index 59fde9033a35f..7c5973ae10d0f 100644 --- a/website/docs/user-guide/security.md +++ b/website/docs/user-guide/security.md @@ -722,6 +722,10 @@ Blocked files show a warning: 9. **Monitor logs** — check `~/.hermes/logs/` for unauthorized access attempts 10. **Keep updated** — run `hermes update` regularly for security patches +:::tip Egress credential-injection proxy +For Docker backends, the [egress proxy](/user-guide/egress/iron-proxy) keeps your real API keys out of the sandbox entirely: the container only sees opaque proxy tokens that resolve against a local TLS-intercepting daemon on the host. Setup is `hermes egress setup && hermes egress start`. **Note:** currently wired for the Docker backend only — Modal, SSH, Daytona, and Singularity are not supported yet. +::: + ### Securing API Keys ```bash diff --git a/website/docs/user-guide/skills/optional/productivity/productivity-telephony.md b/website/docs/user-guide/skills/optional/productivity/productivity-telephony.md index d3f6b81adaf80..2d9e64cab9c83 100644 --- a/website/docs/user-guide/skills/optional/productivity/productivity-telephony.md +++ b/website/docs/user-guide/skills/optional/productivity/productivity-telephony.md @@ -315,7 +315,7 @@ Use this when: Generate or host audio separately, then: ```bash -python3 "$SCRIPT" twilio-call "+155****0000" --audio-url "https://example.com/briefing.mp3" +python3 "$SCRIPT" twilio-call "+15550120000" --audio-url "https://example.com/briefing.mp3" ``` Recommended Hermes TTS -> Twilio Play workflow: diff --git a/website/docs/user-guide/windows-native.md b/website/docs/user-guide/windows-native.md index de369fc08af8b..ff509e8a8589c 100644 --- a/website/docs/user-guide/windows-native.md +++ b/website/docs/user-guide/windows-native.md @@ -90,7 +90,7 @@ Everything except the dashboard's embedded terminal pane runs natively on Window |---|---|---| | CLI (`hermes chat`, `hermes setup`, `hermes gateway`, …) | ✓ | ✓ | | Interactive TUI (`hermes --tui`) | ✓ | ✓ | -| Messaging gateway (Telegram, Discord, Slack, WhatsApp, 15+ platforms) | ✓ | ✓ | +| Messaging gateway (Telegram, Discord, Slack, WhatsApp, 30+ platforms) | ✓ | ✓ | | Cron scheduler | ✓ | ✓ | | Browser tool (Chromium via Node) | ✓ | ✓ | | MCP servers (stdio and HTTP) | ✓ | ✓ | diff --git a/website/scripts/fix-masked-phones.py b/website/scripts/fix-masked-phones.py new file mode 100644 index 0000000000000..b1e237b4b1ead --- /dev/null +++ b/website/scripts/fix-masked-phones.py @@ -0,0 +1,40 @@ +#!/usr/bin/env python3 +"""Replace masked example phone numbers with valid fictional E.164 numbers. + ++155****4567 -> +15550123456 (555-01xx is the FCC-reserved fictional range) ++155****6543 -> +15550987654 ++155****3456 -> +15550123456 ++155****2222 -> +15550122222 ++155****0000 -> +15550120000 ++1555***4567 -> +15550123456 +""" +import re +from pathlib import Path + +ROOT = Path(__file__).resolve().parent.parent / "docs" + +MASKED = { + "+155****4567": "+15550123456", + "+155****6543": "+15550987654", + "+155****3456": "+15550123456", + "+155****2222": "+15550122222", + "+155****0000": "+15550120000", + "+1555***4567": "+15550123456", +} + +pat = re.compile("|".join(re.escape(k) for k in MASKED)) + +changed = [] +for p in sorted(ROOT.rglob("*.md")): + try: + t = p.read_text(encoding="utf-8") + except Exception: + continue + new = pat.sub(lambda m: MASKED[m.group(0)], t) + if new != t: + p.write_text(new, encoding="utf-8") + changed.append(str(p.relative_to(ROOT))) + +print(f"Fixed {len(changed)} files") +for c in changed: + print(" ", c)