Hermes yesterday, October 30, 2026: cron jobs finally get a Stop button

Hermes yesterday: you could delete a cron job mid-run and it kept going anyway, paying for model calls toward a result Hermes then threw away. Now cron jobs have a Stop button. 91 commits landed on main, almost all of them fixes, and here are the 10 that matter.

1. Cron jobs get a Stop button, and each job picks what happens to missed runs

Before: a running cron job had no stop command, so you waited for its timeout or killed the process by hand, and deleting a job mid-run let it keep going, model and tool calls included, until it booked failed with its result discarded. After: hermes cron cancel, a Stop button on the job in Desktop, the dashboard API and the cronjob_manage cancel action stop a live run, which books cancelled with the reason, with no failure alert and no bump to the failure streak; deleting a job now stops its live run too. In the PR’s test, an agent run stopped inside a 75-second terminal command was cancelled in about 4 seconds, its command killed. Each job can also choose what happens to runs missed while the machine was off: --catch-up on or off in hermes cron create and edit, or Missed runs in the Desktop editor (use the default, run once when back, skip them); the global cron.catch_up_missed stays the default, and every skipped or collapsed slot now shows in run history as one missed row. Limits: pause still does not stop a live run, only cancel and remove do; a one-shot job missed by more than 120 seconds still skips unless it sets catch_up; and the external scheduler provider’s misfire backstop ignores the per-job setting.

Pull request: Stop a running cron job, per-job missed-run policy.

2. Desktop stops dropping healthy connections when you switch back to it

Before: every focus, wake or network-online event made Desktop probe its socket with a 5-second ping, and the backend answered that ping only after every control request queued ahead of it, so one slow request (a manual compression, resuming a large chat, a slow slash command, a slow remote host) turned the next alt-tab into connection lost and a full reconnect. By the opt-in telemetry quoted in the PR, about 2,000 of roughly 11,500 daily Desktop installs hit it, about 2.8 times a day each. After: the probe uses gateway.ping, which the backend’s socket reader answers at once, remote and Hermes Cloud backends included (an older backend without it counts as alive), and a heartbeat tick that itself ran late after a frozen window or a sleep sends one more probe instead of dropping a socket whose answer is still queued. A peer that never answers still drops. Limit: a stall that starts right after an already-late tick can still close a healthy socket.

Pull request: Healthy Desktop connections survive focus and wake.

3. A gateway caught in a boot loop now starts

Before: at startup, the gateway’s sweep that closes orphaned local sessions opened a database read inside another read. When the read pool is unavailable (no WAL journal, the network-filesystem fallback, or every read permit spent), reads go through one lock that cannot be taken twice, so the startup thread waited on itself forever: the control socket never answered, Desktop showed Gateway inaccessible or Gateway starting: deadline, the liveness watchdog exited, and the service manager restarted the gateway into the same wedge. It was seen on a live macOS gateway; the code path is the same on every platform. After: the sweep resolves its target before opening the read, so it takes exactly one read. The slower degraded read path itself is unchanged.

Pull request: Gateway boot-loop deadlock.

4. Docker: the CLI and Desktop share one sandbox again

Before: with the persistent Docker backend and docker_mount_cwd_to_workspace off (both defaults), since October 17 a Desktop session got its own per-folder container while the CLI kept the profile’s, so the two saw different /workspace and /root files in the same profile, and the Desktop file panel could preview a leftover copy instead of the live file. After: with mounting off, CLI, gateway and Desktop sessions of a profile share one sandbox, and the file panel reads and saves in it; with mounting on, nothing changes (one container per profile and folder). Heads-up: files written into the per-folder sandboxes in between (the _ws_ folders under the profile’s Docker sandbox directory) are not migrated; they are kept but no longer used, so copy anything you still need into the profile sandbox’s workspace or home folder.

Pull request: One Docker sandbox per profile with mounting off.

5. A local model server that is down stops looking like a sign-in problem

Before: with Hermes’s managed llama.cpp server as the main model, a server that was down (stopped when Desktop closed, still loading, or switched off) made the Webapp open the provider sign-in screen, and a message sent anyway got a card saying the AI service rejected your API key. After: the app stays open with a Local model unavailable notice, with Open Local models on Desktop and Choose another model in the Webapp; a failed turn reads Can’t reach your model server, with Switch provider, and Retry only while the server is still starting. The TUI, the dashboard and messaging replies name the local server too and point to both ways to start it, the desktop app or hermes model; Desktop backs off re-checking a server that stays down and clears the notice when it comes back. Failures of other kinds, like a missing credential, still open setup as before. Limit: the Desktop side was covered by unit tests, the live run was on the Webapp.

Pull request: Local model server down, not a key error.

6. Several clarify questions become one form

Before: on Desktop and the Webapp, when the agent asked several questions in one clarify call, you got one card at a time, and the next question appeared only after you answered the one before. After: every question shows at once in one form with one submit, and plain Enter sends the set only once every question is answered. Limits: a Desktop app paired with an older backend falls back to one card per question, an edited queued prompt still gets one card per question, and a reply typed into the composer still answers only one question of a set, a separate bug.

Pull request: Multi-question clarify as one form.

7. Attention alerts you can actually notice

Before: when a chat needed you (an approval, a question, a finished or failed turn), the Webapp only put a small mark in the tab title and asked for notification permission at the moment of the event, which browsers ignore, and clicking a notification did nothing; Desktop showed a toast that left no trace once the window was minimized. After: an unfocused Webapp tab alternates its title with the alert every second and gets an amber dot on its icon until you come back; browser notifications work once you click Allow under Settings, Notifications, Browser notifications (Hermes never asks on page load), and clicking one opens that chat; Desktop flashes the taskbar on Windows, bounces the dock on macOS and sets the urgency hint on Linux while unfocused. It reuses the existing notification toggles, so a kind that is off flashes nothing. Limit: browser notifications need HTTPS (Tailscale serve, for example); over plain HTTP on a LAN only the title flash works.

Pull request: Tab, taskbar and browser notifications.

8. Desktop error cards get one fix each

Before: the inline card on a failed Desktop turn used raw provider text as its headline, offered three or four equal buttons, and the same failure could show up as a card, a toast and a banner at once. After: each card is either blocking or degraded (degraded ones can be closed), carries a short title naming the provider or model, one main action and at most one second option (new ones include Continue for a reply cut off at the token limit and Setup guide for TLS and local-server failures), plus a View error details toggle with copy, logs and diagnostics. The chat on screen gets no duplicate toast, and out of credits lives in the composer banner. Two follow-ups the same day fixed what review found: Continue now really sends, and never picks up or erases your unsent draft; Open billing settings goes to the failing provider’s own billing page, or Settings, Billing for Nous; and a plain Retry appears only after a usage limit has actually reset.

Pull requests: Error card v2, Continue sends, billing card always shown, Draft kept, right billing page, Retry after reset.

9. hermes plugins doctor stops copying what it should not

Before: hermes plugins doctor run on a folder that merely contained a plugin (a home folder next to .hermes, a Downloads folder with an extracted plugin and large files) could copy the whole folder into its temporary Hermes home, and with TMPDIR inside the plugin, or a link in the plugin pointing at TMPDIR, it copied the plugin into its own temporary folder until the path got too long or, on a big plugin, the disk filled. After: a folder without its own manifest counts as a category only when every subfolder is a plugin, Doctor copies only the one plugin it validates, a category of several plugins is refused before anything is copied, and the self-copy cases stop with an error telling you to point TMPDIR outside the plugin. It is the same bug family as an earlier fix, after a run copied 461 GB from a home folder.

Pull requests: Folder that merely contains a plugin, Copy into its own temporary folder.

10. The Webapp on a slow link: big videos play, media stops re-downloading

Before: in the Webapp, chat videos over 100 MiB did not play, a clip was fetched again every time its row re-rendered, transcript images were downloaded in full on every remount, and after a reconnect the next send hid the subagent and background-task bar until the chat resumed. After: videos of any size stream one range at a time, SSH profiles included; a remounted clip reuses its stream URL; an unchanged image costs a 304 answer of about 173 bytes from the browser cache, while a rewritten file still shows its new version; and a reconnect keeps the open chat bound, so the bar stays. Limits: images from SSH profiles still re-read on remount, and on a slow link a remount still waits one round trip.

Pull requests: Reconnect, clip URLs, videos over 100 MiB, Image caching, SSH videos.

Meanwhile, in the engine room

Dozens of fixes landed yesterday that most users never see, and the cron Stop work and config loading took most of them.

• A Cloud agent using the remote config backend never booted: its first config read waited on a lock its own thread held while loading the sign-in module; loading the config and sign-in modules now reads no config, and the credential is resolved before the fetch lock (pull request)
• Discord’s /model picker overwrote a finished switch or cancel with Selection expired when its 120-second timeout fired; it now releases the picker as soon as it is answered and keeps the result (pull request)
• hermes config set on MoA preset fields such as fanout and reference_timeout saved working values and then warned that Hermes might not read them; preset fields are now recognized under any preset name, and typos still warn (pull request)
• In a gateway Group Chat, a member addressed directly that answered with a pass left the user with nothing; the member is now asked for an answer, a result or a blocker, and a pass that still comes back shows as a failed turn with an explanation (pull request)

If you noticed none of this, it worked.

All on main, ships in the next release (Desktop app changes reach the Microsoft Store app with the release and the .exe and .dmg app with its next bundled release). Latest stable: v0.22.5.

Watch the recap

The 56-second motion recap, made with Remotion, is on X.