Hermes yesterday, October 26, 2026: GitHub Copilot moves out of core into a plugin

GitHub Copilot moved out of Hermes core and, like a good tenant, left a forwarding address. Profiles that use it get the new plugin installed on their own; only a sign-in borrowed from gh needs one command. Also: a new default model, a Stop that spares your background subagents and about a second off each start on git installs. 411 commits landed; here are the 10 that matter.

1. GitHub Copilot moves out of core into a plugin

Before: Copilot (copilot and copilot-acp) was built into Hermes, could sign in silently with your gh auth token, and on profiles that never used it a stray GH_TOKEN could still be exchanged with GitHub by status and picker refreshes. After: it lives in the github-copilot plugin from Hermes Labs (built by Nous Research, not supported), and core keeps only generic provider hooks. A profile that names Copilot anywhere (main, fallback, auxiliary, delegation, MoA or cron, or a base_url at a Copilot host) gets the plugin installed on hermes update, at start or on first use, with one notice; settings, model names and env tokens stay as they are. Other profiles have no Copilot unless they install it. Heads-up: the plugin never reads other tools’ logins, so a profile whose only sign-in came from gh or the Copilot CLI’s token files is told to run hermes auth add copilot. Limit: the move was tested against a stand-in of GitHub’s sign-in and Copilot API, not a real Copilot account.

Pull requests: Copilot moves to a plugin, The github-copilot plugin.

2. GLM-5.3 becomes the default for anyone who never picked a model

Before: with no model chosen, Hermes landed on z-ai/glm-5.2. After: it lands on z-ai/glm-5.3, its successor at about the same price on Nous Portal and OpenRouter, with the same 1M context. The choice travels in the published model catalog, which already carries it, so those installs move as their cached catalog refreshes; the built-in fallback for fresh and offline installs moves with the next release. A model you picked yourself is untouched. Known issue, still open: late in long, tool-heavy sessions, GLM-5.3 can send tool calls with arguments missing.

Links: Default moves to GLM-5.3, Known issue, open.

3. Stopping a turn no longer kills your background subagents

Before: Ctrl+C, Esc, the Stop button, an interrupting message or an ACP cancel also killed background subagents such as a running /review, and the Desktop’s Stop killed processes the terminal had started in the background. After: they end only the current turn. Background subagents keep working and report back, and the Desktop leaves those processes running (regenerate, restore and edit still end them). Unchanged: /stop still ends background work, and closing or resetting a session still ends its subagents.

Pull request: Stop spares background subagents.

4. A project folder can no longer slip its own code into Hermes helpers

Before: Hermes started several helper Python processes from the folder you launched it in, and Python puts that folder first on the import path, so a project holding a package named like one of Hermes’ own (hermes_cli, tui_gateway, agent, plugins) had its code run instead. That hit the TUI slash worker and command runner, the plugin-host profile read under plugins.isolation: host, setup’s agent import, profile uninstall, the gateway restart watcher, the plugin validator, the Google Meet bot and the Codex tools server. After: those keep the launch folder off the import path. Not covered yet: Kanban workers (a fix is in review) and the gateway’s /update and restart helpers, which need their own change; an existing Codex config picks up the fix the next time hermes codex-runtime migrate rewrites it.

Pull requests: Helpers fixed, Kanban workers, in review.

5. Hermes starts about a second faster

Before: on a git install (the usual ~/.hermes/hermes-agent), every hermes command ran git’s full version walk twice at startup, once for provider plugins’ User-Agent headers and once for the pending-restart check. When the hourly scratch-folder cleanup was due, it waited for that too: removing one 34 GB folder held a maintainer’s start for 13 s. After: the version is read only when a request needs it, so hermes sessions list went from 1.45 s to 0.44 s in the PR’s test. The cleanup runs in a detached process that finishes on its own (6.74 s to 0.35 s with a 600,000-file idle folder). And Hermes keeps git’s commit graph fresh after each hermes update and on hermes -w, so the version lookup itself dropped from 0.39 s to 0.05 s on a real install.

Pull requests: No git walk at startup, Scratch cleanup detached, Fresh commit graph.

6. Kanban stops filing its work as your memories, and its wakes survive restarts

Before: Kanban worker turns reached memory providers as yours, so they filed things like work kanban task t_... and the worker’s progress notes as facts about you. A Kanban wake, or a background or watch completion, that hit the gateway while it drained for a restart was lost, and one accepted just before the drain was dropped by it. After: worker turns carry the Kanban dispatcher as their author. A wake during a drain is refused so its sender retries after the restart, and one accepted before the drain still runs. Limit: memories filed by earlier runs are not rewritten.

Pull requests: Worker turns not filed as yours, Wakes during a drain retried, Wakes accepted before a drain run.

7. Desktop: Linux windows are solid again, and typing stays light in long chats

Before: on Linux, Desktop 0.22.5 opened every window slightly see-through (opacity 0.94, so whatever sat behind it tinted the app), and the setting that could undo it is hidden on Linux. Typing in a long session also got slower the more history was loaded. After: Linux windows open fully opaque, and a profile stuck at the faded value heals on its first launch; macOS is unchanged, and on Windows 10 and Windows 11 before 22H2 an untouched profile keeps the same light tint, which Settings there can turn off. In one measured run, each keystroke cost 9.6 ms of main-thread work instead of 33.9 ms in a 300-turn session with its whole history loaded.

Pull requests: Linux windows opaque again, Typing in long chats.

8. Compaction can write its summary ahead of time (opt-in)

Before: when a long session hit the compaction trigger, the turn stopped while the summary was written (an issue report cites a 184 s median pause). After: with compression.prepare_ahead: true (off by default), Hermes starts writing the next summary in the background once the session is within 12% of the trigger, so when compaction fires the summary is usually ready. Messages that arrive meanwhile stay word for word, and a rewind or changed history falls back to a normal summary. Limits: it saves time, not tokens; a summary that ends up unused still costs its tokens; and it helps most in sessions that live across turns (CLI, TUI, Desktop, messaging).

Pull request: Prepared compaction.

9. The browser Webapp gets a long round of fixes

Before: in the Webapp (off by default), files and media of a session running in Docker or over SSH were not looked up in that session’s own sandbox or workspace, a down SSH host gave no clear error and stalled file requests on other SSH profiles, and profiles the gateway does not serve were offered as reachable and then refused every request. After: previews, media and saves use the session’s own sandbox or SSH workspace, a down host gives a clear error, and unserved profiles show greyed out as Not served here. On a plain-HTTP network address, the bot screen and live voice now say they need HTTPS instead of showing raw errors, and hermes webapp and hermes webapp --status list what the browser holds back there (the bot screen, microphone and live voice, clipboard reads, the wake word, notifications) and how to keep it: HTTPS or an SSH tunnel. Sign-in got tighter too: on macOS and the BSDs, hermes webapp hands the one-use link to the browser through a page only you can read (a printed link, as with --no-open or over SSH, can still be read by other local users within its 60 s), and hermes webapp --sign-out now also signs out a browser that logged in with the password provider in the same second as a native app.

Pull requests: Docker and SSH files and media, Down SSH host stalls no one, Unserved profiles greyed out, What plain HTTP holds back, Private launch link, Sign-out with the password provider.

10. 2 new plugins in the catalog: sound effects and Copilot’s new home

2 new entries: ElevenLabs sound effects, an official plugin that turns a text description into a 0.5 to 30 s audio clip (optionally a seamless loop) and sends it in chat, and github-copilot, the plugin from item 1. Heads-up: every sound effect is a paid generation billed to your ElevenLabs account. Catalog entries do not wait for a release: both are already in the published catalog.

• Sound: elevenlabs-sound-effects
• Model providers: github-copilot

Meanwhile, in the engine room

Dozens of fixes landed yesterday that most users never see, and the browser Webapp took most of them: workspace files, host terminals, profiles and sign-in.

• On macOS, the gateway the Desktop starts lost access to model servers on your network (No route to host) once you quit and reopened the Desktop or it updated, because macOS Local Network Privacy stopped counting it under the app; it now runs as a one-off launchd job and keeps that access (its file-access prompts now name osascript) (pull request)
• On Discord with multiplexed profiles, a user on a profile’s allow_from list had guild-channel messages dropped and button clicks refused while DMs and threads worked; allow_from now covers guild channels, and an approval click in a thread gets the thread’s verdict (commit, commit)
• A messaging chat that sent /new or /resume while a Desktop or Webapp turn on its old conversation was still running could be handed back to that conversation when the turn finished, so its next message landed there; it now stays where the command put it (pull request)
• hermes sessions optimize-storage now shows progress in every phase and finished a 3.6 GB test store in 1 min 25 s instead of 24 min 39 s; hermes sessions failures and unanswered confirmations now exit 1 instead of 0, so scripts stop reading them as success (pull request, pull request)

If you noticed none of this, it worked.

All on main, ships in the next release; the new default model and the two catalog entries already reach installs through the published catalogs (Desktop app changes reach the Microsoft Store app with the release and the .exe and .dmg app with its next bundled release). Latest stable: v0.22.5.

Watch the recap

The 56-second motion recap, made with Remotion, is on X.