Update dependency NousResearch/hermes-agent to v2026.7.1#209
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2026.6.19→v2026.7.1Release Notes
NousResearch/hermes-agent (NousResearch/hermes-agent)
v2026.7.1: Hermes Agent v0.18.0 (2026.7.1) — The Judgment ReleaseCompare Source
Hermes Agent v0.18.0 (v2026.7.1)
Release Date: July 1, 2026
Since v0.17.0: ~1,720 commits · 998 merged PRs · 2,215 files changed · ~251,000 insertions · ~41,000 deletions · 949 issues closed · 370+ community contributors
🎯 The P0/P1 Clean Sweep — 100% resolved
This is the release headline. For a week and a half the team hammered the priority backlog day and night, and every single P0 and P1 across the whole repo is now closed:
That's ~692 highest-priority items resolved in twelve days — and at the moment the sweep completed, the open P0/P1 count hit 0 across the entire repo. The final cluster to fall was the interrupt-protected-compression sibling-fork bug (issue #56391) and its fix (#56416), closed on an all-nighter right before this release cut.
Special shoutout to @kshitijk4poor, who burned through the priority backlog day and night alongside the core team — the cron reliability wave, the compression-fork fix, the credential-exfil hardening, and a huge share of the P1 closures are his.
We're keeping P0/P1 at 0 from here forward. 🫡
✨ Highlights
Mixture-of-Agents is now a first-class model you can pick — MoA used to be a mode you toggled; now every named MoA preset shows up as a selectable model under a
moaprovider, right alongside Claude, GPT, and Grok in every model picker (CLI, TUI, desktop, gateway). Pick "my-council" the same way you'd pick any model, and Hermes routes your prompt through that ensemble automatically. An ensemble of frontier models deliberating on your hardest questions is now one selection away, on every surface. (#46081, #53548, #53561 — @teknium1)See every model's reasoning, then watch the answer stream in — When a MoA ensemble runs, each reference model's full output now renders as its own labelled block — you can read what GPT-5 thought, what Claude thought, and what Grok thought, before the aggregator synthesizes them into one answer. And that final answer now streams to you live instead of appearing all at once after a long silence. This works in the CLI, the TUI, and the desktop app. You get to watch the committee deliberate, not just read the verdict. (#53793, #53855, #55625, #56101 — @teknium1)
The agent verifies its own work — "done" means proven, not claimed — Hermes now records verification evidence for coding work and can decide it's finished by actually running your project's checks, not by asserting success.
/goalgained completion contracts: you state what "done" looks like, and the standing-goal loop judges completion against that evidence instead of stopping when the model feels like it. There's apre_verifyhook for wiring in custom checks and a one-time migration that tunes the defaults sensibly. The difference between "I think I fixed it" and "the tests pass, here's proof." (#50501, #52285, #55413, #53552 — @teknium1, @OutThisLife)/learn— turn anything into a reusable skill by describing it — Run/learn <anything>and Hermes distills a reusable skill out of whatever you point it at — a directory, a URL, or just the workflow you walked it through five minutes ago. It writes the skill to the standards in your CONTRIBUTING.md automatically. The next time you need that workflow, it's already there. Teaching Hermes a new trick is now a single command, not a manual skill-authoring session. (#51506, #52372 — @teknium1)/journey— a playable timeline of everything Hermes has learned about you — The CLI and TUI gained/journey, a learning timeline that shows the memories and skills Hermes has accumulated over time — and you can edit or delete any of them right from the view. Pair it with the desktop's new memory graph (a top-down, playable radial timeline of memories and skills) and for the first time you can actually see what your agent knows, watch it grow, and prune what's wrong. Your agent's memory stops being a black box. (#55555, #55859, #55226 — @OutThisLife)Delegate a pile of work and keep going — background fan-out —
delegate_taskcan now fan out multiple subagents that all run in the background: your chat is never blocked, and when every subagent finishes, their results come back as a single consolidated turn. Kick off "research these five competitors in parallel" or "audit these three modules," then carry on with something else while a small fleet works. When it's all done, you get one clean summary instead of babysitting each one. (#49734 — @teknium1)First-class coding Projects in the desktop app — The desktop app gained real, per-profile Projects — a sidebar of your codebases, a coding rail, a review pane, git worktree management, and agent-facing project tools, all backed by a proper
project → repo → lanemodel. Instead of scattered chat sessions, your coding work is organized into projects the agent understands and can act on. It's the desktop turning into an actual coding cockpit. (#49037, #54385, #54517 — @OutThisLife)Run Hermes at scale — scale-to-zero and drain coordination — The gateway can now go dormant when idle and quiesce cleanly before a restart, migration, or auto-update — without dropping in-flight conversations. A hosted or relay-only Hermes can scale to zero when nobody's talking to it and wake back up on demand, and disruptive lifecycle actions coordinate an external drain so nobody gets cut off mid-turn. Running Hermes for a team or as a hosted service just got a lot more production-grade. (#52243, #52937, #54824 — @teknium1, @benbarclay)
Cheaper self-improvement — smarter background review — The post-turn self-improvement fork (the one that decides whether to save a memory or skill) now routes to an auxiliary model, digests context instead of replaying the whole conversation, and adapts its cadence — so the "learn from what just happened" loop that runs after your turns costs a fraction of what it used to. You keep the self-improvement, you stop paying full main-model price for it. (#49252 — @teknium1)
Compose your next prompt in your editor —
/prompt—/promptopens your$EDITORso you can hand-write a long, multi-line prompt in real markdown instead of fighting a one-line input box. Draft a detailed spec, a structured question, or a big paste, save, and it's queued as your next message. Small thing, huge quality-of-life win for anyone who writes Hermes more than a sentence at a time. (#50509 — @teknium1)Google Vertex AI — Gemini through your GCP service account, no static key — Vertex AI is now a first-class provider for Gemini models over Vertex's OpenAI-compatible endpoint. The reason a plain custom-provider setup always died mid-session is that Vertex has no static API key — every request needs a short-lived OAuth2 access token (~1h TTL) minted from a service-account JSON or Application Default Credentials. Hermes now mints and auto-refreshes those tokens for you, so if your org runs Gemini through Google Cloud, you point Hermes at your service account and it just works — no token-pasting, no mid-session expiry. (#56363 — @teknium1, @slawt)
Security round — This window hardened several surfaces: MCP-config persistence attack surface locked down, cron
base_urloverrides that could exfiltrate provider credentials blocked, a non-reusable sentinel for prefix secrets in file reads, Slack app-level (xapp-) token redaction, a browser cloud-metadata floor enforced on every backend, and anaiohttpCVE floor across the lazy messaging paths. Fewer ways for a prompt-injected or misconfigured session to leak a credential. (#50476, #56196, #54166, #56227, #52349, #56237 — @teknium1, @kshitijk4poor, @claudlos)🧠 Mixture-of-Agents (MoA)
MoA graduated from a mode to a first-class part of the model system this window.
moa; pick it in any model picker and Hermes routes through the ensemble (#46081, #53561, #53775 — @teknium1)/moais now one-shot sugar — runs a single prompt through the default preset and restores your model afterward; persistent switching goes through the model picker (#53548 — @teknium1)moa.save_traces) for debugging and eval (#56101 — @teknium1)call_llmchokepoint; HermesBench results documented (#55991, #53206 — @teknium1)✅ Verification & Goals — the agent proves its work
/goal— state what "done" looks like; the standing-goal loop judges against evidence, not the model's say-so (#50501 — @teknium1)/goal wait <pid>— park the standing-goal loop on a background process instead of re-poking the agent (#50503 — @teknium1)agent.coding_context; gateway exposes verification status (#52285, #52286 — @OutThisLife)pre_verifyhook + coding guidance config; verification stop loop + ad-hoc verification scripts (#55413, #52296, #52297 — @OutThisLife)🎓 Self-Improvement (Learn / Journey)
/learn <anything>— distill a reusable skill from a directory, URL, or a workflow you just walked through; honors CONTRIBUTING.md skill standards and mixed requirements (#51506, #52372, #55956 — @teknium1)/journey— CLI + TUI learning timeline of accumulated memories and skills, with in-place edit/delete (#55555, #55859 — @OutThisLife)memorygraph in the desktop — playable radial timeline of memories + skills over time (#55226 — @OutThisLife)🖥️ Hermes Desktop App
Coding cockpit
project → repo → lane); remote-gateway-aware folder picker + git cockpit (status, review, worktrees) (#49037, #54385 — @OutThisLife)UX & surfaces
Refactor wave (composer / god-file de-entangle)
thread.tsx,sidebar/index.tsx, onboarding overlay, anduse-prompt-actionsgod files into focused modules; shared WebSocket layer decoupling desktop from dashboard (hermes serve) (#55500, #55842, #55451, #55453, #55807, #55504, #54568 — @OutThisLife)/learnruns don't freeze; fast session switching under load (#52273, #52620 — @OutThisLife)📊 Web Dashboard
client_secret) support in self-hosted OIDC (#54846, #50551, #55344 — @teknium1, @benbarclay)OPTIONAL_ENV_VARS; list & add arbitrary custom.envkeys on the Keys page; expose cron job execution fields; backup import/create/download (#54546, #54552, #53551, #54611 — @benbarclay, @teknium1)🏗️ Core Agent & Architecture
Delegation & subagents
delegate_task(#49734, #52756 — @teknium1, @OutThisLife)Agent loop, tools & coding context
llm.oneshotgateway RPC; expose coding-context project facts (project.factsRPC) (#51261, #51259 — @OutThisLife)web_extracttruncate-and-store instead of LLM summarization; concurrent @-reference expansion (#54843, #55207 — @teknium1, @kshitijk4poor)/reasoning full(uncapped thinking);/timestamps+ timestamps in/history;/promptcomposes in$EDITOR(#55166, #50499, #50506, #50509 — @teknium1)HERMES_WRITE_SAFE_ROOTdirs; opt-in HTTP/WS body capture to an isolated, share-excludedgui_bodies.log(#53292, #49044 — @kshitijk4poor)Compression & sessions
in_placedefault to True with a guard fix (#49739, #52658 — @teknium1)projects.dband kanban boards in the pre-update snapshot (#52990 — @kshitijk4poor)Providers & models
NOUS_INFERENCE_BASE_URLenv override for Nous OAuth; keep Nous auth fresh for idle dashboard/gateway agents (#52270, #50567 — @benbarclay, @teknium1)🌐 Gateway, Fleet & Relay
Scale-to-zero & drain
restart_drain_timeoutto 0 to kill a systemd crash loop; self-heal a gateway stranded in draining/degraded (#54066, #55397 — @teknium1)Relay (Phase 5 / 6)
passthrough_forwardover WS; multi-platform-per-agent identity + per-frame egress; forward stable instance id at self-provision; declare relevance policy to the connector (#51595, #51572, #50702, #52830, #50772, #51248 — @benbarclay)source.platform; adoptscope_idwire key; purge platform-specific scope terminology (#52306, #55289, #56016 — @benbarclay)Gateway core & rendering
SendResult.error_kind); per-platformtyping_indicatortoggle; per-category context breakdown in/usage(#50342, #55394, #55204 — @teknium1)📱 Messaging Platforms
--no-assistantflag for manifest generation (#56102, #51487 — @teknium1)-#subtext viadisplay.reasoning_style(#51168 — @teknium1)send_video/send_voice/send_document; photon sidecar upgraded to spectrum-ts v8 with tapback correlation; Raft gateway setup wizard (#53598, #49308, #53451, #56230 — @teknium1)🔧 Tool System, Skills & MCP
/learndistillation (see Self-Improvement);cloudflare-temporary-deployoptional skill; creative-ideation v2.1.0 method library (#50849, #42402 — @teknium1, @SHL0MS)ctx.profile_namefor session-agnostic profile access (#50346 — @teknium1)⚡ Performance
CSafeLoader(#54448, #54486 — @teknium1)handoff_stateindex to curb write-lock contention; single-passlist_profilesalias map + skill-count cache + event-loop offload (#54752, #54770 — @kshitijk4poor, @teknium1)🔒 Security & Reliability
base_urloverrides that exfiltrate provider credentials; non-reusable sentinel for prefix secrets in file reads (#50476, #56196, #54166 — @teknium1, @kshitijk4poor)xapp-) tokens; browser cloud-metadata floor on all backends (CDP non-local); re-check private-network guard afterbrowser_backnavigation; scope/resumeand/sessionsto caller origin (IDOR);aiohttp3.14.1 CVE floor across lazy messaging paths + pin-drift guard (#56227, #52349, #56526, #56378, #56237 — @teknium1, @claudlos, @kshitijk4poor)BaseException+ heartbeat-aware status; layer enabled MCP servers onto per-job toolsets; guard cron model-tool path + auto-resume loop breaker (#51051, #50062, #50016, #50117, #56240 — @kshitijk4poor, @teknium1)🔁 Reverts (in-window, for the record)
auth.json(duplicating OAuth grant causes sibling revocation); windows terminal-popup PRs rolled back;prompt_caching.enabledtoggle backed out for re-evaluation (#51116, #51732, #53853, #56126 — @teknium1)👥 Contributors
381 people contributed to this release (via commits, co-author trailers, and salvaged PRs). Thank you, all of you.
Core
/learn, background review, security round, providers, the P0/P1 clean-sweep/journey, multi-terminal, composer refactor wave, pets, verification UX)Top community contributors
All contributors
@0xbyt4, @0xDevNinja, @0xsir0000, @1RB, @595650661, @aaronlab, @abchiaravalle, @adammatski1972, @AetherAgents,
@Afnath-max, @agt-user, @ahmadashfq, @AhmetArif0, @AIalliAI, @aieng-abdullah, @ailang323, @ailthrim, @aj-nt,
@alelpoan, @alloevil, @amathxbt, @ambition0802, @anderskev, @andressommerhoff, @angelos, @annguyenNous,
@Antimatter543, @arminanton, @arthurzhang, @asimons81, @austinpickett, @baolingao, @Bartok9, @basilalshukaili,
@BBCrypto-web, @bbopen, @Beandon13, @beardthelion, @benbarclay, @benbenlijie, @binhnt92, @bitcryptic-gw,
@Blaryxoff, @bogerman1, @bradhallett, @brett539, @briandevans, @buihongduc132, @bykim0119, @catapreta,
@chaithanyak42, @charleneleong-ai, @CharlieKerfoot, @chazmaniandinkle, @chrispersico, @Christopher-Schulze,
@chriswesley4, @claudlos, @clovericbot, @cmcejas, @codexGW, @Cossackx, @counterposition, @coygeek, @CRWuTJ,
@cyb0rgk1tty, @cyb3rwr3n, @cypctlinux, @cypres0099, @dalenguyen, @Danamove, @DanAsBjorn, @DataAdvisory,
@davidgut1982, @DavidMetcalfe, @davidvv, @de1tydev, @denisqq, @devorun, @devsart95, @DhivinX, @DiamondEyesFox,
@difujia, @Disaster-Terminator, @djimit, @djstunami, @dodo-reach, @donovan-yohan, @Dr1985, @DrZM007, @Dusk1e,
@egilewski, @ehz0ah, @Eji4h, @EloquentBrush0x, @Elshayib, @emozilla, @entropy-0x, @Erosika, @EtherAura,
@etherman-os, @ethernet8023, @f-trycua, @fayenix, @fesalfayed, @firefly, @flamiinngo, @flobo3, @francescomucio,
@franksong2702, @friendshipisover, @fsaad1984, @fyzanshaik, @GauravPatil2515, @gdeyoung, @georgex8001,
@GodsBoy, @graphanov, @Gromykoss, @gustavosmendes, @Gutslabs, @H2KFORGIVEN, @haileymarshall, @hakanpak,
@happy5318, @haran2001, @harjothkhara, @heathley, @hehehe0803, @helix4u, @herbalizer404, @HexLab98,
@HiddenPuppy, @Hinotoi-agent, @HODLCLONE, @houko, @huangsen365, @huangxudong663-sys, @huangxun375-stack,
@HwangJohn, @iaji, @iamlukethedev, @IamSanchoPanza, @IAvecilla, @Icather, @iizotov, @indigokarasu,
@infinitycrew39, @ipriyaaanshu, @isair, @islam666, @itenev, @itsflownium, @izumi0uu, @Jaaneek, @JabberELF,
@jackjin1997, @jackroofan, @janrenz, @jasnoorgill, @jasonQin6, @jcjc81, @jearnest11, @jeeves-assistant,
@Jeffgithub0029, @jeffrobodie-glitch, @JezzaHehn, @jimmyjohansson84, @jmmaloney4, @jnibarger01, @JoaoMarcos44,
@jplew, @Junass1, @justemu, @justin-cyhuang, @JustinOhms, @jvradahellys24-art, @Kailigithub, @kaishi00,
@kangsoo-bit, @kartik-mem0, @keiravoss94, [@kenyonxu](h
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.