Hermes yesterday, October 14, 2026: one gateway now runs every chat

A heads-up for everyone who runs Hermes on their own machine. One merge, about 1,900 commits long, rewired how every chat runs: the CLI, TUI, Desktop, API, editors, bots and cron now all go through one gateway per profile. It is on main; the current stable, v0.22.2, does not have it. Here are the 10 that matter.

1. One gateway now owns every local chat

Before: the CLI, the TUI, the Desktop backend, the API server, editors over ACP and cron each ran their own agent on the same state.db, so two of them could write one conversation at once. After: each profile has one gateway that owns its sessions, and every local surface attaches to it. A chat is one conversation with one queue and one writer wherever you open it, and an approval or question answered in one window settles in all of them. Closing the terminal detaches instead of ending the turn, and quitting Desktop no longer stops the gateway, which also runs cron, bots and messaging. A turn cut off by a gateway crash is never replayed on its own: Discard in Desktop, /discard or hermes sessions discard clears it. Heads-up: --safe-mode now needs --model; hermes setup asks before installing the gateway service and hermes import no longer installs it; a gateway a client started by itself exits after 10 idle minutes when no client, messaging platform or cron job needs it; dashboard bulk delete and prune answer 409 while the gateway runs; a failed hermes cron run exits 1; the Desktop backend pool settings are gone; and hermes update refuses to move back to a release without the runtime once state.db depends on it. Still on their own agent: the browser dashboard and Desktop SSH mode. In review: a fix for model picks in a Desktop Bot Chat or via /model that can fail, or check the new provider’s key against the old endpoint. The runtime slipped into v0.22.1 by mistake; v0.22.2 takes it back out, so it ships with v0.23.0.

Pull requests: Unified gateway runtime, In review, model picks.

2. The terminal runs your own tools first

Before: Hermes put its own pinned node, npm, python, rg and other tools ahead of yours on the terminal’s PATH, so commands the agent ran used Hermes’s copies. On the Windows Store build, npx MCP servers, terminal npx and python -m venv failed with Access is denied. After: on every platform the terminal finds your own copy of each tool first and falls back to Hermes’s (node, npm, python, rg, git, gh, ffmpeg and the rest, whichever you have installed), and on the Store build npx MCP servers and python -m venv work. Hermes’s own work keeps its pinned tools: file search uses its own ripgrep, and a bare npx MCP command still runs on Hermes’s Node. Heads-up: a workflow that relied on Hermes’s Node version in the terminal now runs on yours. Not covered: execute_code, computer use, cron scripts and hermes bang build their environment without this, so on the Store build an npx they start still fails.

Pull request: The terminal runs your own tools first.

3. Skills keep a reload marker across compaction

Before: when compaction removed a loaded skill, only bodies over 5,000 characters left a marker telling the model to reload it. Smaller skills (about a quarter of the bundled ones) and skills loaded with /skill-name just disappeared, so the model carried on without its instructions and no hint they were gone. In lean mode the verbatim user block also quoted the first 4K of the skill body as your words and cut the request you typed after it. After: every skill leaving the window gets a reload marker and a line under Pruned Skills, whatever its size or how it was loaded (slash command, bundle, gateway auto-load); a /skill turn is quoted as you typed it; and a failed skill view is marked failed and never offered for reload.

Pull request: Skills keep a reload marker across compaction.

4. Five advisories off the MCP HTTP stack, npm audits back to zero

Before: every HTTP MCP connection ran on httpx2 2.7.0, which has five published advisories, and hermes doctor reported npm audit findings in the root, web, TUI and WhatsApp bridge trees, then told you to run hermes doctor --fix, which never touches them. After: httpx2 and httpcore2 move to 2.12.0, the first release that clears all five, and the build fails if a pin drops below it; the npm trees audit at 0, including a sharp bump in the WhatsApp bridge for a high-severity librsvg CVE; and doctor lists npm findings as manual, with the real fix: wait for an upstream lockfile update and, on Docker, pull a rebuilt image, because recreating the same image restores the same dependencies.

Pull requests: httpx2 2.12.0, npm audits, Doctor wording.

5. hermes update stops rolling back over a plugin’s pyproject

Before: a plugin whose pyproject.toml had no [project] table or no version made uv reject the generated workspace, and the whole hermes update rolled back. On Windows, real-time antivirus could lock uv’s optional bytecode-compile script after the packages were already installed and fail hermes pm repair and bootstrap. After: those plugins get the inert version 0.0.0 (unless they declare a dynamic version), so the update goes through, and a failed compile step is retried once without bytecode compile; any other uv failure still fails.

Pull requests: Version-less plugins, Bytecode compile retry.

6. New profiles keep your custom endpoint

Before: creating a profile from one whose model ran on a custom endpoint, selected as custom:<name>, a display name, a ${VAR} reference or a legacy custom_providers entry, copied only the model block, so the new profile’s first turn failed with Unknown provider. In Desktop and the TUI, a bare custom model with a base_url left the new profile with no model at all. After: new profiles get the launch profile’s endpoint entry from the CLI, the TUI and Desktop alike, with ${VAR} secrets kept as references, and the inherited endpoint wins over a same-named entry already in the new profile. Existing profiles are not repaired: recreate them or fix the provider entry by hand.

Pull requests: Named and legacy endpoints, ${VAR} names and URLs, Bare custom in Desktop and TUI.

7. Desktop updates say what is in them

Before: every stable-channel update and many main updates in Desktop said only In this update · Improvements and fixes. After: on stable the dialog shows up to five headlines from the release’s own notes with a Release notes link; on main it shows the five newest merged PR titles in the update, with a See all changes link to the compare view. When GitHub is unreachable it falls back to the commit list, and a custom branch or a rollback keeps the old view. Not tested live: the dialog through a remote SSH connection.

Pull request: Desktop updates say what is in them.

8. Long MCP calls get the deadline you set

Before: Hermes’s sequential tool executor stopped any call after 420 seconds, even when the MCP server had a longer timeout configured, and portable plugin packages had no way to declare one. After: a server’s explicit timeout holds through the whole call path, plugin.json can declare one per server, and a call that needs more than the shared batch budget runs as its own step so other tools keep their deadlines. Servers without an explicit timeout keep the generic deadlines. The test case: a Ghidra-based reverse-engineering server answered its first query at 580 seconds.

Pull request: Long MCP calls get the deadline you set.

9. Mistral stops rejecting replayed tool ids

Before: Mistral accepts only tool ids of exactly 9 letters and digits, while Hermes stores ids like call_ plus 12 hex characters, so replaying a conversation that held them on a Mistral model could fail with HTTP 400. After: on Mistral routes the ids sent on the wire are mapped to stable 9-character ones, with a call and its result mapped from the same key; stored history is unchanged and other providers are untouched. Mistral models on other hosts (NIM, LM Studio, Ollama Cloud, vLLM) are matched by model name. Not tested live against api.mistral.ai itself.

Pull request: Mistral stops rejecting replayed tool ids.

10. 13 new plugins in the catalog

Guardrails for coding agents are the day’s theme: a mixer with enforced dials on how much an agent may change, a ledger of every time Hermes stopped to wait for you, and a janitor for the background processes agents leave behind. Heads-up: agent-janitor is dry-run by default; once you switch it to enforce, its sweep kills every process re-parented to PID 1 for over a minute that is not exempt or on your whitelist, whoever started it. Catalog entries do not wait for a release: they go live once the published catalog refreshes.

• Guardrails and oversight: hermes-agent-mixer, wait-ledger, agent-janitor
• Models and providers: lightningai, lightningai-rate-limit, teamorouter
• Languages: hermes-lang-ko, hermes-lang-pt-br
• Desktop pages: hermes-aac, anatomy-museum
• Feeds, finance and web: author-feed, openinvest, showly

Meanwhile, in the engine room

Dozens of fixes landed yesterday that most users will never see, and nearly all of them rode in with the gateway merge, on how sessions queue, recover and settle.

• hermes update, hermes pm install and hermes debug share name a CDN firewall block (Cloudflare or Vercel) and say your install is fine, instead of a bare HTTP 403 (pull request).
• Nemotron 3.5 Super VL is known as a 1M-token model instead of falling back to 128K, so Hermes stops compressing it early, and curated models now lead the hermes model list (pull request, pull request).
• Docker plugin installs no longer rebuild python-olm from source (pull request).
• Stable releases publish the final vX.Y.Z Docker tag again (pull request).

If you noticed none of this, it worked.

All on main. Items 1, 3, 7 and 8 ship with v0.23.0; the rest are already in v0.22.2. Latest stable: v0.22.2.

Watch the recap

The 52-second motion recap, made with Remotion, is on X.