Hermes yesterday, October 12, 2026: the prompt went on a diet

The prompt went on a diet. Every request now carries about 2,000 fewer tokens, which local models feel most. And if you have no Nous account, Hermes now offers hosted connectors and sets up a free identity the first time you ask for an app. 247 commits hit main, here are the 10 that matter.

1. Every request carries about 2,000 fewer tokens

Before: the fixed part of the prompt had grown about 3,400 tokens since the August diet, mostly from features added straight into the always-loaded core, and local models pay for every one of them before answering. After: the five browser_vault tools become one tool loaded on demand through tool_search, the terminal tool’s description is almost half as long, and a redundant system prompt block is gone: about 2,100 fewer tokens on every request, on all nine measured surfaces. Trade-off: the first vault action in a session takes a few extra calls; in the PR’s tests, tasks without the vault used 26% fewer tokens and vault tasks 16% more, with the same accuracy. If you have no Nous account, item 2 adds the connectors tool back, about 1,000 tokens.

Pull request: prompt diet.

2. Hosted connectors without a Nous account

Before: without a Nous sign-in, the manage_connections tool was hidden on the CLI, TUI, messaging gateway and every Desktop build except the Store one, so hosted apps like Gmail or Slack were out of reach. After: it is offered to everyone, and the first time you ask for an app Hermes creates a free anonymous Nous identity for connectors only: it never becomes your model provider and skips the free tier’s browser check. Searching or calling tools never creates it. Worth knowing: on a shared messaging bot whose operator has no Nous account, any allowed chat user can connect an app to the bot’s single identity, which other users of that bot can then call. To opt out, set nous.guest: false.

Pull requests: guest identity on first use, connectors-only token.

3. Anthropic Console keys stop posing as Claude Code

Before: only sk-ant-api keys were treated as API keys. Console’s newer sk-ant-usr keys, plus service and admin keys, went out as OAuth with the Claude Code identity, which Anthropic bills to the subscription bucket: requests failed with “credit balance too low”, the key was benched for about an hour and the agent introduced itself as Claude Code. After: sk-ant-usr, sk-ant-svc and sk-ant-admin keys go out as x-api-key, including keys printed by a custom provider’s key_cmd on api.anthropic.com. Unknown sk-ant prefixes still default to OAuth, and admin keys now fail with an honest auth error, since the Messages API does not accept them.

Pull requests: key families, key_cmd keys.

4. patch stops mangling mid-line edits

Before: when patch found an edit by fuzzy matching and the match started partway through a line (an expression, not a whole statement), it re-indented every line of the replacement on top of its own indentation and still reported success. After: a mid-line match keeps the replacement’s indentation as sent. In the same batch, arguments a model escaped one time too many are corrected instead of rejected when the corrected text appears verbatim in the file, and an edit located by similarity says so in its result so the model checks the diff. Heads-up: an open issue shows that this correction can edit the wrong line when a file holds both the escaped and the plain text; two fixes are in review.

Pull requests: fix batch, fix in review, fix in review. Issue: wrong-line issue.

5. Stop always stops, so Desktop can delete any session

Before: Stop waited for the agent to finish building first. If the build failed, for example because the session’s local model or custom provider was removed, Stop returned an error and Desktop refused to delete the session; hermes sessions delete was the only way out. With turn isolation on, a dead compute host left the session busy forever, queuing every new prompt until a backend restart. After: Stop only needs the session record, so it works whatever state the agent is in, and a dead host’s stuck turn is cleared when nothing else still owns it. It is a backend fix, so an older Desktop gets it too; two other parts of the dead-host report (Windows host stability, steering a busy turn under isolation) are still open.

Pull request: Stop and delete.

6. Plugins install on package mirrors without upload dates

Before: plugin installs rechecked Hermes’s own dependencies against a release-age cutoff on your machine, which needs upload times. Mirrors that serve index pages without dates, like the Tsinghua, Aliyun and Tencent ones, failed every plugin with Python dependencies with “X has no publish time”, reported as a plugin conflict. After: Hermes checks that its dependencies are at least 3 days old once, when it locks them, and never on your machine. Two regressions from the change were fixed the same day: core-only installs and hermes update on those mirrors, and five catalog plugins that stopped installing (cognee, loreconvo, mnemosyne, omnivoice, radio-dm-gateway). Plugins that need a newer version of a package Hermes pins exactly still refuse to install, as before.

Pull requests: lock-time check, core-only installs, five plugins.

7. Home Assistant stops installing itself where nobody uses it

Before: the example config carried a Home Assistant toolset row, installers and hermes doctor seeded new configs from it, and Hermes read that row as use, so hermes update and agent starts installed the Home Assistant plugin into many configs that never touched it. A failed automatic install was retried on the first start of every hour, forever. After: that template row no longer counts as use (a HASS_TOKEN or an enabled platform still does), and failed automatic installs of plugins that left core back off from 1 hour, doubling up to a week; hermes update still always retries. Profiles that already received the plugin keep it: remove it yourself if you never used it.

Pull request: Home Assistant and backoff.

8. Heads-up: Langfuse tracing left core

Langfuse is no longer built in: it is now the official langfuse plugin in the catalog, with the same hooks, environment variables and capture modes. Profiles that had it enabled get the plugin installed and enabled on hermes update or the next agent or gateway start; Langfuse keys alone do not count, since the plugin was opt-in. With security.allow_lazy_installs: false, the start skips it and hermes update installs it. The old observability/langfuse name keeps working in config and in hermes plugins commands. Two small changes: /reload no longer clears a Langfuse variable you deleted from .env, and the dashboard Keys page lists those variables as custom keys.

Pull requests: migration, catalog entry.

9. Windows installs survive long user names

Before: the Windows installer cloned into a staging folder about 37 characters deeper than the final one, so with a user folder name of roughly 33 characters or more, the deepest docs file crossed Windows’ 260-character path limit and every attempt died with “Clone succeeded, but checkout failed”. After: the clone turns on Git’s long-path support before the first checkout, and rerunning the installer fixes an existing checkout. Installer git failures also show git’s own error, like a proxy or DNS problem, on Hermes-Setup’s failure screen. Hermes-Setup downloads the installer script from main on every run, so both already apply to new installs.

Pull requests: long paths, git errors.

10. 20 new plugins in the catalog

Desktop is the day’s theme again, with six new panes and widgets, from a yearly activity grid to a full Telegram client. Langfuse is the official plugin from item 8. Catalog entries do not wait for a release: they become installable once the published catalog refreshes.

• Desktop: hermes-activity, hermes-quest, nine-balance-widget, profile-picker, telegram-client, waypoint
• Coding agents and code review: devin, sem-weave
• Memory and context: cognition, tameru
• Models and observability: hermes-experientiallabs, langfuse
• Data: looot, hermes-tabular, jp-address
• Media and voice: acedatacloud-media, voicestudio
• Marketing and workflows: digital-marketing-pro, senler-io-user, deferred-questions

Meanwhile, in the engine room

Dozens of fixes landed yesterday that you will probably never see. Most of them went into the hosted connectors plumbing and the stable release pipeline, so you never have to meet those bugs.

• Kanban boards, kanban show and the dispatcher’s sweeps no longer crash on timestamps stored as text (pull request, pull request, pull request).
• Connector tool calls now hand the model the gateway’s real failure reason, like tool not allowed or vendor timeout, instead of a generic error (pull request).
• browser_exec stops hunting for an installed Chrome on Browser Use setups without an API key (pull request).
• The stable release pipeline stops downloading about 33 GB to recheck files its receipts already vouch for, after it tripped while publishing v0.21.7 (pull request).

If you noticed none of this, it worked.

All on main, ships in the next release. Latest stable: v0.21.7.

Watch the recap

The 26-second motion recap, made with Remotion, is on X and LinkedIn.