Hermes yesterday, October 29, 2026: kill Hermes and its helpers now go with it

Kill Hermes with kill -9 and whatever it had started used to keep running. Not anymore. 523 commits landed on main, and 60 of them are that one change, covering 14 families of child process, from language servers to the WhatsApp bridge. Here are the 10 that matter, and the first one has fine print.

1. Children die with Hermes, and an abandoned Bot Screen stops itself

Before: when Hermes was killed (kill -9, the OOM killer, a crash), the helpers it had started kept running: language servers, the llama-server router and its models, Browser Use daemons, code-cell subprocesses, foreground commands, the WhatsApp and Raft bridges, command speech providers. After: every Hermes process has one tiny supervisor (a shell script of about 0.5 MB) that notices the owner is gone, sends TERM to each registered process group and KILL 3 seconds later. In the PR’s kill -9 tests, the leftovers in the families that had any went from between 1 and 3 each to 0, and a CI check now fails any new detached spawn. Limits: Windows is unchanged; background jobs started by any gateway (CLI, TUI, Desktop, ACP, cron, messaging) still outlive it, and so do persist_on_release jobs and cron and Kanban workers, on purpose. The dashboard’s WhatsApp pairing bridge now dies on any dashboard exit, a clean one included, which cuts a QR scan in progress, and a gateway restarted after a crash starts a fresh WhatsApp bridge instead of re-adopting the old one. The Bot Screen (the virtual desktop) still outlives its gateway by design, but a screen nothing has touched for bot_desktop.idle_stop_minutes (30 by default, 0 keeps it up) now stops itself even with no gateway alive; a human takeover keeps it for up to four silent windows, 2 hours at the default.

Pull requests: Owner-death supervisor for every child, Bot Screen idle self-stop.

2. Gateway chats get one answer when they delegate

Before: with display.interim_assistant_messages off, a messaging chat that used delegate_task got two messages, a status reply saying the checks were running in parallel and, later, the real answer. After: the new delegation.gateway_mode, default auto, makes such a chat wait for its sub-agents inside the turn and send one completed answer. It applies to chats whose interim setting resolves to off (global value, per-platform override or the platform default, which covers Signal, SMS, email, WhatsApp Cloud and a few more); the API server, local and webhook sessions keep the background path, and gateway_mode: background restores the old behavior. Limits: a turn longer than 180 seconds still gets the periodic still-working notice (display.long_running_notifications turns it off per platform), a delegation tool deferred through tools.tool_search.defer stays on the background path, and /stop or a follow-up message stops the children.

Pull request: One answer for delegated turns.

3. Cron jobs can pin their own timezone

Before: cron jobs had no timezone setting of their own in the tool, the CLI or the dashboard, so a schedule read the profile’s clock. After: a job can carry its own timezone (cronjob create and edit, hermes cron create --timezone, the dashboard) and an optional grace_minutes from 0 to 1440, where 0 means a missed run is never caught up. The same change teaches the due check to read the job’s own clock, so a job pinned east of the profile’s zone is not skipped. Nothing to migrate: a job without the field keeps following the profile, and an older build that does not know the field ignores it and keeps it. Limit: the PR was tested on macOS only, not on Linux or Windows.

Pull request: Per-job timezone and grace_minutes.

4. Plugin installs hold to the commit you reviewed

Before: the Desktop and Webapp install dialog showed a commit, but Install cloned the branch tip at click time, so a repository or a catalog pin that moved in between put down code nobody had reviewed; the native Desktop installer accepted a desktop tree with symbolic links to files outside it and deleted the working plugin as soon as Force was set, before checking the new one; and a Webapp tab could not install a desktop-only plugin at all. After: Install is refused when the source moved since you looked, and the dialog sends you back to review the new commit; a backend too old to hold the commit asks for an explicit Install anyway; a desktop tree with a symbolic link, or over 64 MB, is refused; a refused forced reinstall keeps the working plugin; and a Webapp tab installs a desktop-only plugin on the host that serves it, at the reviewed commit. Heads-up, in review: three open pull requests close more gaps, among them a package named with two dots that could make a forced native Desktop install replace the Hermes home folder (a bug since August 18), Windows drive-style names that point outside the plugins folder, and a partial install that leaves the two halves at different commits.

Pull requests: Webapp installs and the reviewed commit, Symbolic links and forced reinstall, Home-folder replacement, in review, Windows names, in review, Mismatched halves, in review.

5. Fewer built-in skills, and Office files stop losing content

Before: a fresh install shipped 58 built-in skills, and the Word, Excel and PowerPoint helpers silently dropped content. After: 44 built-in skills, which trims about 260 tokens from the skills index in every system prompt: 15 optional skills that official sources now cover are deleted, 12 niche ones (notion, airtable, box, gif-search and others) become optional installs, and docx, powerpoint and xlsx merge into one microsoft-office skill; the default skill taps add the wandb, qdrant and pinecone vendor repos. The Office helpers now read nested tables and every header and footer in Word, shift whole-row and whole-column references in Excel, keep explicit slide titles on layouts with no title box, and pdf_fill_form.py --flatten really removes form interactivity. Limits: existing installs keep their old docx, powerpoint and xlsx copies next to the new skill, and optional skills that were removed stay installed where they already were.

Pull requests: Built-in skills trimmed, Office and PDF helpers.

6. Continuing sessions can adopt an updated SOUL.md and skills

Before: after you edited SOUL.md, skills or AGENTS.md and restarted the gateway, long conversations kept replaying the system prompt stored with them, so only /new picked up the change, at the cost of the conversation. After: hermes sessions refresh-prompts (every session in the profile, or --session with one id) makes each session rebuild its prompt once on its next turn, keeping its history, id and tool list. It costs one prompt-cache miss per session, and without the command nothing changes. Limits: managed workers are not covered, and an in-chat /refresh command does not exist yet.

Pull request: hermes sessions refresh-prompts.

7. Hermes inside tmux and Docker works out of the box

Before: typing text and Enter in one write (tmux send-keys with Enter, or process_manage submit on a pty running hermes) landed the Enter as a newline in the prompt, so nothing was submitted; a login profile that reset PATH made hermes: command not found inside the Docker image and in background terminal commands; and that image shipped neither tmux nor the Office and PDF libraries. After: text plus Enter in one write submits in the classic CLI and the --tui, hermes stays on PATH in normal and background terminal commands and in login shells, and the image ships tmux and the Word, Excel, PowerPoint and PDF libraries, with anything else landing in a side environment under HERMES_HOME that survives container restarts. Limits: a real multi-line paste still inserts newlines, and the PATH fix covers hosts whose profile resets PATH. In review: a follow-up for a second Enter or a terminal report arriving in the same read.

Pull requests: Text plus Enter in one write, PATH kept through login profiles, tmux and Office libraries in the image, Held-Enter follow-up, in review.

8. The private-URL setting now says what it covers

Before: the docs said security.allow_private_urls guarded the browser, but browser_exec on the local Chromium and on the hybrid sidecar (browser.auto_local_for_private_urls, on by default) still opened private hosts, loopback included, which matters on hosted installs. After: the docs list exactly what is refused (web tools, vision and media fetches, cloud and CDP browsers) and what still opens, and name auto_local_for_private_urls: false as the way to refuse the sidecar; behavior there is unchanged, a maintainer ruling. One code change came with it: raw browser_cdp now keeps the cloud-metadata block even with the private-URL guard off, including inside Runtime.evaluate and url parameters. Limits: private LAN addresses still pass through raw CDP, and the docs no longer claim redirects to private hosts are blocked in the browser, because no redirect check exists there.

Pull request: Docs, plus the CDP metadata floor.

9. Bedrock fails faster and keeps Claude after GPT

Before: a hung Bedrock call took about five times the configured request timeout to fail (a 3 second budget surfaced after about 20 seconds), and a session that switched from a reasoning GPT model to Claude failed every Claude turn over to GPT with an invalid redacted_thinking error, so only /new helped. After: the runtime client makes one attempt per call, and Hermes’ own retry and rate-limit backoff still apply; Claude on Bedrock no longer receives a GPT turn’s sealed reasoning, and an older session that still carries one has it stripped once and stays on Claude. Limit: turns saved before v0.22.0 carry no model stamp, so they replay as before and rely on that one-time strip.

Pull requests: One attempt per Bedrock call, No GPT reasoning sent to Claude.

10. 49 new plugins in the catalog: status bars, themes and a lot of hosted tools

49 new entries (47 community, one verified, one official), led by Desktop status-bar chips, themes and hosted work tools. Heads-up: several do real work on your machine, so read each entry’s disclosure first: nostr-vpn starts a persistent daemon and needs elevated networking privileges, hermes-github-mentions grants terminal and file tools to approved GitHub mentions, and netplane installs a Headscale server after approval. Catalog entries do not wait for a release: they reach installs through the published catalog.

• Desktop status bar: hermes-vitals-light, perf-hud, taskwatch, token-rate
• Dashboards and review: x-dashboard, hermes-pr-studio, catalogo-it, composio-connections
• Themes: glass-theme, hermes-themes-pack, minimalist-themes
• Sessions and skills: better-capabilities, cli-session-tabs, hermes-handoff, hermes-profile-switcher, session-relay, you-should-know
• Memory, guardrails and privacy: inspeximus, tripwire, eu-mode, chrome-tab-watchdog, uuid-ref
• Model and speech providers: aixy, cloudgpu-provider, coreweave, modular, obscurify-provider, opencode-free-acp, transcription-dashscope
• Messaging and notifications: onebot-platform, signal-notify, hermes-github-mentions, iris-chat
• Hosted work tools: found, runa, super-artifacts, dsers, levea-video-editor, comfyrizz, elevenlabs-music
• Infrastructure and networking: kubernetes, netplane, nostr-vpn, hashtree-git, smolmachines
• Health, finance and local tools: canadian-primary-care, hermes-finance, hermes-windows-tasks, zoth

Meanwhile, in the engine room

Dozens of fixes landed yesterday that most users never see, and process cleanup and the plugin installer took most of them.

• search_files returned an error or lost matches when one folder under the search root was unreadable, such as a root-owned lost+found on a data volume; it now returns every readable result with a warning naming the skipped paths (pull request)
• browser_vault could read the username on Camofox pages but refused every password fill; saved logins now fill there with the re-pinned Camofox plugin, and login fields inside open shadow roots are found too (pull request)
• A model answer closed with NO_REPLY or [SILENT] on its own line was delivered to the chat with the marker included; the gateway now drops the marker line from the final send and from streamed previews, and a bare marker still means silence (pull request)
• After a restart the WhatsApp bridge could crash on a port the old one still held and retry the same race forever; it now waits for the port, ends a straggler and fails with a named retryable error if the port never frees (pull request)

If you noticed none of this, it worked.

All on main, ships in the next release; the new catalog entries already reach installs through the published catalog (Desktop app changes reach the Microsoft Store app with the release and the .exe and .dmg app with its next bundled release). Latest stable: v0.22.5.

Watch the recap

The 56-second motion recap, made with Remotion, is on X.