Hermes yesterday, November 1, 2026: approval prompts stop hiding characters

Hermes yesterday: an approval prompt could show you a delete of one folder while the command that ran removed another, whose name carried an invisible character, or keep a ; touch PWNED off screen behind 60 invisible line breaks. Now every hidden character shows up before you approve. 119 commits landed on main, and here are the 10 that matter.

1. Approval prompts show the hidden characters in a command

Before: approval prompts only redacted secrets, so a command could carry characters that render as nothing (zero-width and bidi characters, variation selectors, the Unicode tag block, raw terminal escapes, a bare carriage return) or hundreds of spaces and invisible line breaks that pushed its real tail off screen or past the 200-character chat preview. In the PR’s live run the prompt showed a delete of a decoy folder while the command removed a different one with a zero-width character in its name, and a ; touch PWNED after 60 invisible line separators never reached the screen. The Ink TUI panel showed 10 lines and claimed the rest was above, so an 11th line was never shown. After: on every approval surface (CLI, messaging cards, TUI, Desktop, the API, plugin transports, MCP and vault consent prompts) those characters become visible escapes, padding collapses to a marker with a count, and the TUI pages a long command with v and says which lines are on screen. Clarify questions get a gentler pass that keeps emoji and scripts such as Persian intact. Display only: the command that runs is unchanged, byte for byte. Limits: padding made of visible characters is not collapsed (Show full command and the TUI pager cover it), the messaging buttons and the Desktop and API consent prompts were covered by tests rather than live runs, and a related change that flags stray variation selectors as dangerous is still in review.

Pull requests: Approval and clarify display, In review, flag stray variation selectors.

2. A Desktop plugin install can no longer replace your Hermes folder

Before: a git install from the Desktop app used the folder name the repository gave (the manifest name or a subfolder’s last segment) without checking it, so a forced install of a package named two dots removed and replaced the Hermes home on every OS, a name with a slash nested a folder, and on Windows a colon or a device name reached somewhere else entirely. The bug came with one-click plugin installs in August and is in v0.22.5. After: separators, a colon, a leading or trailing dot, control characters, names over 128 characters and Windows device names with any extension are refused before anything in desktop-plugins is touched, and a removal matches a folder by its exact name instead of deleting a neighbour with a similar one. This is the native installer check yesterday’s digest said was coming. Also: Windows junctions now count as links in the plugin installer and the Webapp host’s reconcile, closing the gap yesterday’s plugin fixes left open. Heads-up: on Linux and macOS, names Windows cannot use (a device name such as aux, a colon, a trailing dot) now fail here too, so a plugin already installed under such a name can no longer be updated through this path. Not tested on a Windows machine.

Pull requests: Native installer folder names, Windows junctions as links.

3. hermes update stops stashing folders it never touches, and asks first

Before: on a git checkout with any local change, hermes update ran a stash that included every untracked file, so a stray folder in the checkout was copied into git objects, deleted from disk and written back on restore. In the PR, a 55 GB leftover worktree copy made that step take minutes, and answering no to the restore question left the whole folder parked in git stash. After: only untracked files at paths the update would write are stashed; the rest stay on disk. An interactive terminal now asks Keep these changes after updating? before anything is stashed: yes stashes and restores with no second question, no deletes your tracked edits and the colliding files right away, with no stash left behind, and a run with nothing to pull asks nothing. Heads-up: no now means deleted, not parked. Gateway /update, --yes and the Desktop updater keep their old prompts and only get the narrower stash, and forks keep the old stash-everything behaviour. Not run live on Windows or through the Desktop updater.

Pull request: hermes update stash.

4. hermes update stops copying your default secrets into other profiles

Before: every hermes update gave any named profile without a .env a verbatim copy of the default profile’s .env, bot tokens included. On a multiplexed gateway the duplicate token was refused, so that profile’s Telegram or Discord showed as fatal and Desktop said Backend telegram down while the real bot was connected, and deleting the copied token left that warning up until a restart. After: the backfill writes only the empty placeholder that profile create uses, a profile rescan drops status verdicts about credentials that are gone, and the Desktop status bar names the profile when another profile’s messaging is down instead of showing a bare platform. Heads-up: profiles that already got a copied .env are not rewritten, so check your named profiles for the default’s keys and remove them yourself.

Pull requests: No copied .env, stale verdicts dropped, Status bar names the profile.

5. Lock a skill and the agent can no longer change it

Before: you could pin a skill, which only blocks deletion, so the agent could still rewrite a skill you wanted kept as written. After: hermes curator lock <skill> (or Lock in Desktop under Capabilities, Skills) makes the lock hold against the agent from every origin, normal turns, cron, subagents, background review and the curator: skill_manage refuses every edit, write_file and patch refuse any path inside the skill, the terminal refuses commands that write into it before approvals and even under --yolo, the agent cannot run hermes curator unlock, and the curator never archives it. Reading it, loading it and running its own scripts still work, and your own edits are never gated. Limits: it is a policy check, not a sandbox. A script that writes into the skill through its own logic, or execute_code, is not inspected, and the terminal check runs on the local backend only.

Pull request: Skill lock.

6. Background memory review stops saving guesses about you

Before: the review that runs after a conversation had no rule for what counts as a fact, so a one-off make that one shorter became a permanent User prefers concise responses, and a passing mention of a kid’s science fair became a profile entry (3 of 3 runs with a weak model in the PR). After: the review is told to save only what a user message or tool result supports, never to infer traits or preferences from topic or tone, and to leave out a one-off request unless you marked it general or stated a like or dislike (stop putting emojis in everything still sticks). Stated facts and environment facts found while debugging are still saved. It costs about 113 prompt tokens per memory review. It is a prompt rule, so it narrows guesses rather than ruling them out, and entries already saved stay.

Pull request: Grounded memory review.

7. Background jobs that finish during a busy turn come back as one turn

Before: while the agent worked on a turn, every background process that finished was queued as its own follow-up turn, so ten finished jobs meant ten back-to-back turns, each re-reading the whole context to answer one result. After: a completion folds into one still waiting at the end of the queue, so they arrive as one turn listing every result (the CLI shows N Background Processes Finished), and anything you queued in between keeps its place. It covers local CLI, TUI and Desktop sessions and messaging chats. In the PR’s live run three jobs came back as one turn instead of two.

Pull request: Background completions as one turn.

8. /model reset takes a session back to your default model

Before: a /model pick in a session survived gateway restarts and resumes and hid every later change to the configured default, the only way back was /new, which also dropped the conversation, and typing /model reset switched to a model literally named reset. After: /model reset clears the pick and returns to the configured default (on messaging, a channel override first, then config.yaml), keeps the history and says so when there is nothing to reset, in the classic CLI, the Ink TUI, Desktop and the messaging gateway. It refuses any extra flag, and a model whose id is reset stays reachable with its vendor prefix. Limits: a messaging chat viewed through Desktop or the TUI was covered by tests, not a live run, and a dashboard compute-host session can still bring back an older pick when its worker respawns, a gap that predates this.

Pull request: /model reset.

9. Plugins can block a turn before any model sees it

Before: a data-loss-prevention or policy plugin that wanted to stop a prompt had to patch core. After: a pre_llm_call hook (a Python plugin or a shell hook) can return a block action with a message: no model call is made, that message is the reply, and the prompt stays on the host, with no session title, no memory prefetch or sync and no background review. The stored row holds only a placeholder, so later turns, compaction, session_search and memory providers never read the blocked text, while your transcript still shows what you typed and /retry and /undo use it. Limit: a hook that raises or times out is skipped and the turn goes ahead, so the block is only as reliable as the plugin.

Pull request: pre_llm_call block.

10. 1 new plugin in the catalog

One new entry, a community plugin that gives Hermes a computer: Sai by Simular takes tasks that need a screen (web apps behind a login, admin consoles, desktop software, forms with no import), does them on a cloud computer Simular hosts and reports back in text. It needs Node.js 22.12 or newer, npm, a Sai API key and Hermes v0.21.6 or newer. Heads-up: every task, its results and the key go to Simular and spend your Sai credit or free computer time, the agent can upload local files up to 25 MB, run code on the cloud computer and approve Sai’s own permission requests without a Hermes prompt, and a live link lets whoever holds it control that computer until it expires. Catalog entries do not wait for a release: they go live once the published catalog refreshes, which can take up to six hours.

• Computer use: simular-sai

Meanwhile, in the engine room

Dozens of fixes landed yesterday that most users never see, and the Desktop app took most of them.

• Telegram video notes, the round circles, matched no handler and were silently dropped; they now reach the agent as a video, without speech-to-text for now (pull request)
• Approval cards on Telegram, Feishu and Teams were replaced with only the decision after a tap, so a shared chat lost what was approved; they now keep the command and why it was flagged, and a timed-out card keeps the reason too (pull request)
• A Kanban plugin hooked on a task entering a dependency wait read stale state and stalled the whole board on its caller’s own write lock; the hook now fires after the commit (pull request)
• Desktop never asked for installed language packs at boot, so a pack language such as Korean stayed in English, and its picker offered eight languages it had no strings for; both are fixed (pull request)

If you noticed none of this, it worked.

All on main, ships in the next release (Desktop app changes reach the Microsoft Store app with the release and the .exe and .dmg app with its next bundled release). Latest stable: v0.22.5.

Watch the recap

The 56-second motion recap, made with Remotion, is on X.