Hermes yesterday, October 23, 2026: one browser path, and Camofox becomes a plugin

466 commits landed on main, and 115 of them came in one pull request that tears out the old browser stack. Browsing now runs only through browser_exec: agent-browser and the ten older browser_* tools are gone, and Camofox becomes a plugin that installs itself where it was in use. Also: MCP approvals that finally stick, a website blocklist one profile could switch off for every other, and 38 new plugins. Here are the 10 that matter.

1. The browser runs on browser_exec only, and Camofox is a plugin

Before: Hermes carried two browser stacks: agent-browser, which launched the bundled Chromium, and ten older built-in tools (browser_navigate, browser_click and the rest) that stayed mostly because Camofox, the anti-detection Firefox backend, implemented them. After: browser_exec is the only built-in browser, and a small Python launcher starts the bundled Chromium; no Chromium is left running after hermes chat -q exits, and two processes on one profile share one browser, stopped by the last one out. A default setup already sent only browser_exec, so its prompt does not change. Homes that set browser.backend: off, which kept the older tools, move to browser_exec with a one-time notice: to turn browsing off, disable the browser toolset. Camofox homes get the official camofox plugin installed automatically and their browser toolset becomes camofox, keeping the CAMOFOX_* and browser.camofox settings; if that install fails, browsing stays off until a retry succeeds. Config v52 drops browser.backend and moves the AGENT_BROWSER_* settings to browser.* keys with the values they resolved to. Also gone: /browser use, and browser-extension control with its /v1/browser-control API routes (integrators use browser.cdp_url or /browser connect). Not tested live yet: Windows, macOS, Termux and headed mode; password-manager fill through a Camofox tab is a follow-up.

Pull requests: browser_exec only, Camofox leaves core, camofox catalog entry.

2. MCP approvals now stick, and YOLO skips them

Before: on an MCP server marked trust: untrusted, every write-capable call asks first, and pressing Allow for this session or Always still allowed just that one call: the next one asked again. YOLO and approvals.mode: off did not skip this prompt either, though the docs say mode off disables all approval checks, so a cron job calling a paid untrusted tool was refused. After: Session and Always stick per server and tool (Always is saved in the profile’s command_allowlist; deleting the entry revokes it, though the chat that granted it keeps it until that chat ends), and prompts that can only cover one request offer just Allow Once or Deny. /yolo, --yolo, HERMES_YOLO_MODE and approvals.mode: off now skip the untrusted-server prompt. Still asked under YOLO: a call that would cross a declared spend limit (refused where nobody can answer, such as cron), MCP elicitation questions, payment-card fills and event subscriptions.

Pull requests: Session and Always stick, YOLO skips the trust prompt.

3. One profile can no longer switch off another’s website blocklist

Before: in a gateway serving several profiles, or any long-running process, once a profile with security.website_blocklist disabled made a browser or web request, the blocklist was skipped for every profile for the rest of the process, and turning the blocklist on in config.yaml waited for a restart. After: each check uses the calling profile’s own config.yaml, and a change applies once the 30-second policy cache expires.

Pull request: Website blocklist per profile.

4. Signing in to Nous keeps your free-tier apps (already in v0.22.5)

Before: the free tier, a sign-in-free Nous identity, can hold connected apps such as Gmail or Notion, and signing in saved the account over it, so the apps stayed behind and had to be connected again. After: right after the account is saved, Hermes asks the Nous Portal to move those apps into it, retries if the Portal is busy, and shows what moved, with a Reconnect button in the Desktop sign-in result when an app needs it. Every Nous sign-in (Desktop, /login, hermes auth upgrade) is now the plain device login, and opening the Desktop Connectors page no longer creates a free identity behind your back: it lists the public catalog until you connect an app, and people on their own model key who connect apps get a sign-in offer too. This shipped in v0.22.5. Fixes still on main: a token refresh in one profile no longer overwrites a free-tier identity that another profile keeps in the shared Nous store (which moved its apps into the account and signed a logged-out profile back in), and Desktop shows the result on the screen where you signed in and refreshes Connectors.

Pull requests: Free-tier apps move to the account, One device login, Desktop sign-in result, Connectors page and sign-in offer, Token refresh keeps the guest, Handoff trimmed, Result on the right screen.

5. Plugins that need a newer Hermes are refused before install

Before: a catalog entry’s requires_hermes was only displayed: hermes plugins install cloned a pin the catalog says needs a newer Hermes, update re-pinned onto it, and portable packages (plugin.json) had no version floor at all. After: install is refused before anything is cloned, naming the version needed and your own update command (Docker, Nix and Termux users see theirs), on the CLI, Desktop, the dashboard and automatic installs. hermes plugins update keeps the installed pin and lists the plugin as update available after updating Hermes. Search still shows such entries with a needs Hermes line; the Desktop and dashboard catalogs still show only the range.

Pull request: requires_hermes enforced.

6. New plugin dependencies: restart, not repair

Before: enabling a plugin with Python dependencies while a gateway or dashboard was running reported that nothing needed a restart, yet that process could not import them, and the warning sent you to hermes pm repair, which changed nothing. In the Docker image, every new dependency generation also copied about 1.5 GB of bundled binaries (Python, Chromium, ffmpeg, node, uv). After: enable says restart and names the process that needs it (hermes gateway restart, or reopen the desktop app or dashboard), and a generation’s workspace measured 61 MB instead of 1.5 GB. Generations built before keep their size until they are collected.

Pull request: Plugin dependencies.

7. Desktop chats can enter sign-in codes into the browser vault

Before: in Desktop chats, browser_vault answered that the session cannot ask the user, so an emailed sign-in code, a login to save or a password-manager unlock could not be entered at all. After: Desktop chats show those prompts as dialogs, the values travel only in your answer and are never logged, and closing or deleting a chat locks the password managers it unlocked instead of leaving them open until the 30-minute idle timeout. The classic CLI now answers them in its own panels instead of waiting out the timeout.

Pull request: Browser vault in Desktop chats.

8. /delegation applies from the next session, or now with –now

Before: in v0.22.5, /delegation <mode> switched subagent routing for one session but not the delegate_task fields, which are built when the session starts, so the model kept sending the old mode’s fields and those tasks were refused. After: /delegation <mode> saves the mode and the running chat keeps its own until /new; add --now to rebuild this session’s tools at its next turn, at the cost of one prompt-cache break. The session-only switch and --global are gone, and a resumed session routes on the backend its tools were built from. The advanced-delegation plugin was re-pinned to match, and its new pin needs v0.22.5. Limits: the classic CLI without a gateway applies a save at the next launch or with --now, and sessions in a managed worker process pick it up at /new or their next compaction.

Pull requests: Next session or –now, advanced-delegation re-pin.

9. Desktop plugins get doors instead of the raw bridge

Desktop plugins get app-owned doors for things they could only do through the raw desktop bridge. ctx.files reads and writes only inside the plugin’s own data folder and folders you pick in the app’s own picker, never the Hermes home, keys or .env, with a Revoke per folder under Capabilities > Plugins > Folder access. Scripts in the in-app preview Browser need a declared capability and your OK per site (Allow on this site), revocable under Page scripts. Plus a Kanban card badge slot, rows in the composer’s right-click menu with an add-to-dictionary verb, and cards that post into their own chat instead of whichever one is active. Limit: these bound what the doors reach; a plugin can still call the raw bridge, so they are not a sandbox for plugin code.

Pull requests: ctx.files, Preview page scripts, Kanban card badges, Composer right-click menu, Cards post into their own chat.

10. 38 new plugins in the catalog, led by the Camofox browser

38 new entries, led by the official camofox plugin from item 1, plus two Windows diagnostics tools, a Hebrew language pack and a Reka model provider. Heads-up: camofox snapshots mask values that look like secrets, but text typed into form fields shows up, passwords included; on a core that still bundles Camofox the plugin stays inert. Catalog entries do not wait for a release: they go live once the published catalog refreshes.

Browser and network:

• camofox
• hermes-vpn

Models, usage and tracing:

• reka-provider
• surp-hermes-x402-llm
• hermes-model-switcher
• ai-subscriptions
• token-lens
• traceverse_hermes_otel
• chat-length

Desktop and language:

• nord-theme
• office-3d
• preview-text-size
• profile-switcher
• youtube-dock
• hermes-lang-he

Developer tools:

• lightkeeper
• project-manager
• agentvault
• jwt-ref
• timestamp-ref
• hardlight-ui
• ux3-product-design-harness

Windows:

• hermes-windows-eventlog
• hermes-windows-ports

Voice and messaging:

• hermes-soniox
• telesec
• walkie-talkie

Life and learning:

• chorepilot
• homeassistant-statistics
• athletedata
• viajante
• ld-workbench

Marketing and sales:

• adkit
• hypd-ai-ads
• linkedcamp
• stacktree

Games and 3D:

• godot-studio
• remesher

Meanwhile, in the engine room

Dozens of fixes landed yesterday that most users never see, and most of them hardened the new browser launcher before it merged, so no Chromium is orphaned or stopped under another process.

• image_generate edits from a local file failed on FAL with file_download_error on the local backend, because the host path went to FAL as is; the file is now inlined through the guarded reader (which refuses .env and auth files) and shrunk to fit FAL’s 4.5 MB request limit, and tool catalog lines grew from 60 to 80 characters so agents see that image_generate edits with reference images instead of scripting FAL directly (pull request, pull request)
• Sessions on a named custom provider (a Portkey or OpenRouter-compatible entry under providers:) showed up as custom everywhere, and on resume two entries sharing one URL came back with the first entry’s key; the entry’s name now sticks while it still serves the session’s endpoint (pull request)
• Terminal backends that sandbox their commands can now declare that read_file, write_file, patch and search_files run through the sandbox; the bubblewrap plugin’s current pin does not use it yet, so its file tools still reach host paths unless HERMES_NATIVE_FILE_READ=0 (pull request)
• A first-time Quick Setup after importing from another agent replaced the imported model with Nous Portal; it now offers to keep it, and Keep is the default (pull request)

If you noticed none of this, it worked.

All on main, ships in the next release, except item 4’s sign-in rework, which already shipped in v0.22.5 (Desktop app changes reach the Microsoft Store app with a release and the .exe and .dmg app with its next bundled release). Latest stable: v0.22.5.

Watch the recap

The 56-second motion recap, made with Remotion, is on X.