Hermes yesterday, October 21, 2026: empty terminal output fixed, and two stable releases

If your gateway or Desktop ran long enough to hold more than 1,024 open files, terminal commands could come back empty with exit code 0, their output thrown away without an error. That is fixed, and it already shipped: two stable releases went out yesterday, v0.22.3 and v0.22.4. Also: Google Workspace results now keep Nous requests on endpoints that do not train on them. 112 commits landed on main; here are the 10 that matter.

1. Terminal output survives a long-running gateway

Before: the terminal tool, background processes and the dashboard and Desktop terminal pane waited for output with select(), which fails once a file descriptor number reaches 1,024. A long-lived gateway or Desktop process gets there as it piles up open files, and each reader took that failure for a closed pipe: the command still exited 0, its output was dropped, and the agent got an empty result. After: all three readers wait through epoll on Linux and kqueue on macOS, which have no such ceiling; in a gateway holding 1,100 extra files, the output comes back. Covered by tests on Linux and macOS.

Pull request: Terminal output.

2. Google Workspace results stay on no-training Nous endpoints

Before: a result from a connected app went to Nous Portal like any other message, so any endpoint, including one that trains on data, could serve the next request. After: the Nous tool gateway marks results that must not be trained on (Google Workspace today; other connectors stay unrestricted), and while such a result is in context Hermes asks the Portal to route the request only to endpoints that do not train on it, plus zero retention when the result asks for it. Auxiliary Nous calls (Mixture of Agents, plugin LLM calls, MCP sampling) carry the same rule; resume and /branch keep it, and it lifts once compression or /new drops the result. If no endpoint qualifies, the turn stops with data_policy_denied, with no retry and no fallback, and says to switch model, /compress or /new; free-tier users are told every free model refuses. Other providers get nothing added, and the compression summarizer is out of scope for this rule. A refusal also no longer ends with a Limit resets at line, which read as if waiting would help.

Pull request: No-training routing.

3. Gateway restarts heal instead of looping or hanging Desktop

Before: a gateway started with --replace refused, correctly, to stop a process it could not prove was its own (a stale PID record, such as a PID recycled after a reboot), but recorded nothing, so a systemd unit with Restart=always restarted into the same refusal forever while /api/status showed a stale running heartbeat. On a machine with no installed gateway service, Desktop’s restart of a gateway running older code, the Models page Restart Hermes button and the updater’s recovery restart turned their own short-lived restart call into the new gateway, which was then killed at the 120 s or 90 s timeout; in Desktop it also held app quit open. And on homes whose socket path is too long for a Unix socket, a CLI cold start could fail with Gateway inaccessible: invalid_control_pointer while the gateway was still starting. After: the refusal records startup_failed with its reason before exiting, so the next attempt stops trusting the stale record and starts fresh. A new hermes gateway restart --detach starts the replacement in the background and returns; Desktop and the updater use it, and a person typing the command in a terminal still gets a foreground gateway. A detached restart of the default gateway (restart --all, the macOS launchctl fallback) no longer boots the sticky active profile instead, and the control pointer is now written whole or not at all.

Pull requests: Restart loop heals, restart –detach for Desktop and the updater, Control pointer written atomically.

4. Desktop drops the suggestion pills, and the approval chip tells the truth

Before: a strip above Desktop’s composer guessed at intent from draft keywords and tool results: Add Strava because a message said running, Use skill: github or Set up GitHub on any mention of GitHub, Schedule this on every morning, a Reconnect prompt after an MCP error. The status bar’s approval-mode chip also read Smart at every cold start even with approvals.mode: off, and a bot tile, a branch of another profile’s chat or an All-profiles resume could repaint it with that backend’s mode. After: the whole suggestion system is removed, not hidden; any suggestion surface that comes back will be a new, reviewed change. The chip syncs once the gateway connects, and only the active gateway sets it (covered by unit tests, not reproduced live). In v0.22.4 for the Microsoft Store app; the .exe and .dmg app gets it with its next bundled release.

Pull requests: Suggestion pills removed, Approval-mode chip.

5. MCP servers can put a price on their tools

New: an MCP server entry in config.yaml (tool_costs, spend_limit, cost_unit) or a portable plugin package can declare what each tool costs and a spend limit per chat. The approval prompt then names the cost and the chat’s running total, and a call that would take the chat past its limit asks first, even on a trust: full server; cron jobs, chat -q and a gateway with no one to approve refuse it without sending it. Only calls that reach the server count, the total follows a chat through compression and /branch, and each cron run gets its own. Limits: the total is an estimate from the declared costs, not the vendor’s bill, and it lives in memory, so a gateway restart resets it; on messaging platforms /new in the same chat keeps it. Servers that declare nothing behave as before. The new Meshy plugin below ships with costs on its 18 tools and a 200-credit limit per chat.

Pull request: MCP tool costs.

6. Shared metrics: share or no thanks, no third answer

Before: the first-run offer on Desktop, the browser dashboard and the terminal had a third answer (Keep on this computer, Collect locally only or Local only) that collected stats nobody read: no surface showed them, and data from before an opt-in is never sent. After: every surface offers Share with Nous or No thanks, each setting collection and sending together, and Desktop Settings > Privacy and hermes setup telemetry become one on/off choice. Profiles that already chose collect-only keep that answer and are not asked again; nothing is sent for them, the Desktop switch reads off and hermes tools says collecting locally.

Pull request: Shared metrics consent.

7. hermes update stops re-offering a search-index rebuild you already ran

Before: a store optimized with hermes sessions optimize-storage before an earlier index change was offered the full Reclaim ~60% rebuild again on every update, while hermes doctor stayed silent; an optimize interrupted before removing the old index was offered by update but not by doctor; a fresh store got an optimize-storage suggestion from doctor until its second open; and after a downgrade, a newer release’s index stamp was overwritten with the older version. After: update, doctor and the stamp share one answer. Such stores get one Search index update available notice without the size claim, and one run settles it; an interrupted optimize is offered by both; a fresh store is stamped on creation; and a newer release’s index and stamp are left alone. Not yet run against a real multi-GB state.db.

Pull request: Search-index notice.

8. hermes update on a damaged .git brings the gateways back

Before: when a checkout’s .git existed but git rejected it (an empty HEAD, a gitdir: file pointing nowhere), every hermes update failed with a generic Failed to fetch updates, and on Windows it left the paused gateways stopped with a promise that the next hermes command would restart them. None could, so bots stayed down until someone repaired the checkout by hand. After: the gateways resume, since they were serving that exact tree and nothing wrote to it, and the error says the checkout’s git data is damaged and prints the installer one-liner aimed at that checkout (--dir or -InstallDir for a custom folder). The diagnosis needs local git’s own error and a checkout that fails to resolve, so a remote’s refusal no longer sends a healthy install to reinstall. install.sh now also repairs a dangling .git file, as install.ps1 already did. The ZIP update fallback still refuses a damaged checkout, since it cannot see local edits without git.

Pull request: Damaged .git.

9. Installs survive a dead download host

Before: every pinned tool download (ffmpeg and Node.js among them) falls back to a hash-addressed copy on hermes-assets.nousresearch.com when its host is down, but only for some error codes, so a CDN’s origin-down answers (520 to 527) failed the install. Yesterday macOS ffmpeg’s only upstream answered 521 for about an hour: every macOS install and update run of the release suite died in setup, and an Apple Silicon user installing then would have failed too. After: any 5xx falls back to the mirror, and the sha256 check still guards every byte.

Pull request: Mirror fallback.

10. 7 new plugins in the catalog: Hermes moves features out of core

7 new entries, 5 official and 2 from Hermes Labs (built by Nous Research, not supported). Three are core features moving into plugins: agent-importers (hermes import-agent, now with Cursor besides Claude Code and Codex CLI), mcp-serve (Hermes as an MCP server, renamed hermes mcp-serve, with an opt-in --tools mode) and singularity (the Singularity/Apptainer terminal backend). Heads-up: on yesterday’s main, core still shipped all three. The removal of hermes mcp serve landed just after midnight UTC (the old spelling now prints the new one and the install line, so MCP clients that launch it need the plugin and the mcp-serve args), and the removals of import-agent and Singularity are still in review. bubblewrap is a new Linux terminal backend that runs each terminal and execute_code command in its own bwrap sandbox (file tools still run unconfined on the host), and meshy brings Meshy’s own MCP server for 3D generation with a Desktop gallery (needs v0.22.3 or later, a MESHY_API_KEY and Node.js 18+). From Hermes Labs: inbox (hermes inbox, one read-only view of failed cron jobs, stalled delegations and other work in flight) and workflow-record (hermes record: show a browser workflow once and /learn turns it into a skill that replays it). Catalog entries do not wait for a release: they go live once the published catalog refreshes.

• Leaving core: agent-importers, mcp-serve, singularity
• Sandbox: bubblewrap
• 3D: meshy
• Hermes Labs: inbox, workflow-record

Pull requests: hermes mcp serve leaves core (merged after midnight), import-agent leaves core, in review, Singularity leaves core, in review.

Meanwhile, in the engine room

Dozens of fixes landed yesterday that most users never see, and dependency security bumps took the biggest share, all of them after the two releases.

• certifi moves to 2026.10.19, which drops the emSign root certificates whose intermediate CA keys were compromised; CA trust stores now skip Hermes’s three-day quarantine on new package versions, so a revocation is not held back (pull request)
• MCP servers now see hermes-agent and its version in the handshake instead of the Python SDK’s default mcp 0.1.0, so their logs and policies can tell Hermes apart (pull request)
• A skill_manage write the agent refuses and retries (size cap, stale old_string, a guard) no longer shows as a red failure in the CLI, Desktop or answer-only mode; a batch whose rollback failed still does (pull request)
• Startup no longer fails with state.db-wal is read-only for this user when another connection closes and removes the WAL file at the same moment (pull request)

If you noticed none of this, it worked.

Items 1 to 7 and 9 already shipped yesterday in v0.22.3 and v0.22.4 (Desktop app changes reach the Microsoft Store app now and the .exe and .dmg app with its next bundled release); item 8, the certifi bump and the MCP handshake fix are on main and ship in the next release. Latest stable: v0.22.4.

Watch the recap

The 56-second motion recap, made with Remotion, is on X.