chore: sync with NousResearch/hermes-agent upstream (v0.4.0, 31 commits) - #16

Merged

lws803 merged 33 commits into

mainfrom

sync-upstream-main

Mar 24, 2026

Commits on Mar 23, 2026

fix(security): add SSRF protection to vision_tools and web_tools (hardened)

teknium1
and
dieutx
authored
0791efe
fix(vision): make SSRF redirect guard async for httpx.AsyncClient
teknium1
committed
ad5f973
fix(config): log warning instead of silently swallowing config.yaml errors (#2683)

authored
f9c2565
fix(security): prevent shell injection in _expand_path via ~user path suffix (#2047)

teknium1
and
Gutslabs
authored
73a88a0
feat(config): support ${ENV_VAR} substitution in config.yaml (#2684)

teknium1
and
teyrebaz33
authored
4ff73fb
fix(gateway): prevent stale memory overwrites by flush agent (#2670)

authored
48b5bc6

Commits on Mar 24, 2026

chore: release v0.4.0 (v2026.3.23)
teknium1
committed
8416bc2
docs: revise v0.4.0 changelog — fix feature attribution, reorder sections
teknium1
committed
6e97a3b
fix: add macOS Homebrew paths to browser and terminal PATH resolution
teknium1
authored
1345e93
feat(cli, agent): add tool generation callback for streaming updates
teknium1
committed
87e2626
fix(cli): ensure single closure of streaming boxes during tool generation
teknium1
committed
4313b8a
fix(auth): preserve 'custom' provider instead of silently remapping to 'openrouter'
teknium1
authored
2f1c4fb
feat(model): /model command overhaul — Phases 2, 3, 5
teknium1
authored
b641ee8
fix: remove litellm/typer/platformdirs from hermes-agent deps (supply chain compromise) (#2796)
teknium1
authored
18cbd18
fix(gateway): detect virtualenv path instead of hardcoding venv/ (#2797)

teknium1
and
Hermes
authored
ce39f9c
refactor(model): extract shared switch_model() from CLI and gateway handlers
teknium1
authored
2e52427
fix(agent): ensure first delta is fired during reasoning updates
teknium1
committed
a312ee7
docs: update all docs for /model command overhaul and custom provider support
teknium1
authored
773d3bb
fix: make browser command timeout configurable via config.yaml (#2801)
teknium1
authored
98b5570
fix(tools): handle 402 insufficient credits error in vision tool (#2802)

teknium1
and
dlkakbs
authored
2233f76
refactor: remove mini-swe-agent dependency — inline Docker/Modal backends (#2804)
teknium1
authored
02b38b9
docs: fix stale and incorrect documentation across 18 files
teknium1
authored
ee3f3e7
fix: reject relative cwd paths for container terminal backends
teknium1
committed
677b11d
docs: add missing skills, CLI commands, and messaging env vars
teknium1
authored
e2c81c6
chore: remove all remaining mini-swe-agent references
teknium1
committed
ad1bf16
feat: env var passthrough for skills and user config (#2807)
teknium1
authored
745859b
chore: pin all dependency version ranges (supply chain hardening) (#2810)
teknium1
authored
c9b7605
refactor: update mini_swe_runner to use Hermes built-in backends
teknium1
committed
177e432
chore: regenerate uv.lock with hashes, use lockfile in setup (#2812)
teknium1
authored
624e4a8
ci: add supply chain audit workflow for PR scanning (#2816)
teknium1
authored
ac5b8a4
docs: document 9 previously undocumented features
teknium1
authored
ebcb81b
docs: fix api-server response storage — SQLite, not in-memory (#2819)
teknium1
authored
9718334
chore: sync with NousResearch/hermes-agent upstream (31 commits, v0.4.0)

lws803
and
claude
committed
2de7481

Navigation Menu

chore: sync with NousResearch/hermes-agent upstream (v0.4.0, 31 commits) - #16

chore: sync with NousResearch/hermes-agent upstream (v0.4.0, 31 commits)#16
lws803 merged 33 commits into
mainfrom
sync-upstream-main

Commits on Mar 23, 2026

fix(security): add SSRF protection to vision_tools and web_tools (hardened)

fix(vision): make SSRF redirect guard async for httpx.AsyncClient

fix(config): log warning instead of silently swallowing config.yaml errors (#2683)

fix(security): prevent shell injection in _expand_path via ~user path suffix (#2047)

feat(config): support ${ENV_VAR} substitution in config.yaml (#2684)

fix(gateway): prevent stale memory overwrites by flush agent (#2670)

Commits on Mar 24, 2026

chore: release v0.4.0 (v2026.3.23)

docs: revise v0.4.0 changelog — fix feature attribution, reorder sections

fix: add macOS Homebrew paths to browser and terminal PATH resolution

feat(cli, agent): add tool generation callback for streaming updates

fix(cli): ensure single closure of streaming boxes during tool generation

fix(auth): preserve 'custom' provider instead of silently remapping to 'openrouter'

feat(model): /model command overhaul — Phases 2, 3, 5

fix: remove litellm/typer/platformdirs from hermes-agent deps (supply chain compromise) (#2796)

fix(gateway): detect virtualenv path instead of hardcoding venv/ (#2797)

refactor(model): extract shared switch_model() from CLI and gateway handlers

fix(agent): ensure first delta is fired during reasoning updates

docs: update all docs for /model command overhaul and custom provider support

fix: make browser command timeout configurable via config.yaml (#2801)

fix(tools): handle 402 insufficient credits error in vision tool (#2802)

refactor: remove mini-swe-agent dependency — inline Docker/Modal backends (#2804)

docs: fix stale and incorrect documentation across 18 files

fix: reject relative cwd paths for container terminal backends

docs: add missing skills, CLI commands, and messaging env vars

chore: remove all remaining mini-swe-agent references

feat: env var passthrough for skills and user config (#2807)

chore: pin all dependency version ranges (supply chain hardening) (#2810)

refactor: update mini_swe_runner to use Hermes built-in backends

chore: regenerate uv.lock with hashes, use lockfile in setup (#2812)

ci: add supply chain audit workflow for PR scanning (#2816)

docs: document 9 previously undocumented features

docs: fix api-server response storage — SQLite, not in-memory (#2819)

chore: sync with NousResearch/hermes-agent upstream (31 commits, v0.4.0)