Hermes yesterday, October 10, 2026: official source installs now follow stable releases

If you run Hermes from an official git checkout, hermes update stops chasing every commit on main and follows stable releases by default. Already ahead of the release? Nothing moves you back. 225 commits hit main, here are the 10 that matter, starting with that one.

1. Source installs default to stable releases

Before: hermes update and the Desktop update button on an official git checkout pulled main commit by commit. After: they move between published vX.Y.Z releases. A checkout already newer than the latest release stays put until a newer release ships, including shallow or offline clones. Forks and mirrors stay on main. To keep every commit: hermes update --set-channel main, which is also the safe choice if you work on a branch inside your Hermes checkout until this fix lands. Desktop gets a stable or every-commit selector in Settings, About, Updates, and the updates dialog now names your channel. The stable lookup also uses your GitHub token and reports a rate limit as a rate limit, not as no release found.

Pull requests: stable by default, no rollback when ahead, Desktop selector, channel in updates dialog, token and rate limit.

2. A refused compression no longer eats your transcript

Before: a context engine that edited the conversation in place and then got refused or crashed could leave the edited list behind, in the worst case an empty transcript. After: every refused or failed compression restores the original transcript, and memory is committed only after all checks pass. Each attempt also logs why it ran and what it changed.

Pull request: compression rollback.

3. Skills installed mid-session reach the model

Before: a skill installed during a conversation (hub install, another terminal, curator) stayed invisible to the model until a compaction or a new session. After: the next turn carries a one-time note with the new skill, on CLI, TUI, Desktop and gateway, without rebuilding the prompt, so the prompt cache stays warm.

Pull request: skills mid-session.

4. Plugins can use your ChatGPT/Codex login without managing the token

Before: plugins that needed your Codex subscription read and refreshed ~/.codex/auth.json on their own. Codex refresh tokens are single-use, so that race could revoke your whole token family. After: core makes the request for the plugin, using Hermes’s locked refresh. Plugins must declare requires_auth: [openai-codex], which shows at install and in hermes plugins show. Plugins still run inside the Hermes process, so install only the ones you trust.

Pull request: Codex requests via core.

5. Community skills’ inline shell stays off in more cases

Before: inline shell snippets in community skills could still run when viewed if the skill was nested inside a bundle, viewed from another profile via external_dirs, or the hub lock file was unreadable. After: all three stay off, and an unreadable lock fails closed.

Pull request: community skills inline shell.

6. Desktop updates on macOS stop looping

Before: a Desktop update that relaunched itself refused the lock its own hand-off had just taken, failed with “Another Hermes update is already running” and retried forever. After: it adopts its own claim. Installs already stuck need one hermes update from the terminal; the button works after that.

Pull request: macOS Desktop update loop.

7. Thinking models keep their reasoning between tool calls

Before: on Ollama Cloud, reasoning was stripped from tool-call turns sent back to the model, so models like kimi-k3 and glm-5.3 lost their own chain of thought mid-loop. After: Ollama Cloud and local :cloud models echo it back; purely local Ollama models are unchanged. The same echo now applies to the stealth/missingno model on Nous Portal.

Pull requests: Ollama Cloud, Nous Portal.

8. A // comment no longer reads as rm -rf /

Before: the skill safety scanner treated a trailing JS comment as a delete rooted at /, so rm -rf node_modules dist // clean was flagged critical and blocked a real skill. After: a bare // after the first operand is skipped, while rm -rf build // /etc is still caught.

Pull request: // comment false positive.

9. hermes update and hermes doctor stop stalling on checkpoints

Before: the checkpoint footprint notice ran Git once per project, which took minutes on large stores. After: it only measures folder size and counts projects; on a 25-project test store, 18.5 s became 0.6 s with identical text.

Pull request: checkpoint notice speed.

10. 27 catalog additions

26 new plugins, plus holographic back under a new maintainer. Memory is the day’s theme, with six options, including memory-shield, which blocks the agent from deleting what it knows about you and limits who can change it. Heads-up: Holographic memory is announced as leaving core on October 15; on main today it is still built in, and the catalog entry is the new maintainer’s version, dormant while core bundles it. Catalog entries do not wait for a release: they become installable once the published catalog refreshes.

• Memory: holographic, hwiki, memoria, memory-shield, penny, qdrant-memory
• Models and routing: liquid-inference-provider, lowrouter, model-router, hermes-adaptive-effort, hermes-vision-inline
• Desktop: token-cost-meter, session-flow, claude-code-theme, hermes-taskbar-badge, iowap
• Tools: beam, doc-markdown, jet-browser, monid
• Chat surfaces: salesforce-chatter, radio-dm-gateway
• Voice and language: speechify, hermes-lang-it
• Japan: jp-edinet, jp-kokkai, jp-subsidies

Meanwhile, in the engine room

Dozens of fixes landed yesterday that you will probably never see. Most of them went into compression and Relay plumbing, so you never have to meet those bugs.

• Compression and Relay telemetry now record why each attempt ran and what it actually did (pull request).
• A stuck Relay pipeline no longer holds every compaction for 10 seconds (pull request).
• hermes migrate relay now writes opentelemetry.enabled = false, so new Relay configs no longer ship prompts and responses over OpenTelemetry on their own when an endpoint is set. Configs migrated earlier are not rewritten: add that setting or OTEL_SDK_DISABLED=true yourself (pull request).
• The skills index stopped listing about 1,900 skills that could never install (pull request).

If you noticed none of this, it worked.

All on main, ships in the next release. Latest stable: v0.21.6.

Watch the recap

The 26-second motion recap, made with Remotion, is on X and LinkedIn.