Hermes yesterday, November 3, 2026: approvals catch hidden credential uploads and v0.22.7 ships

Hermes yesterday: approve one risky step in a command, and a credential upload riding in the same line could run with no prompt of its own. That is fixed, and v0.22.7 shipped late in the day with it and 201 more of the day’s 286 commits. Still only on main: replies that waited minutes behind a media cleanup, and remote Desktop chats that would not start. Here are the 10 that matter.

1. Approving one risky rule no longer waves a credential upload through (already in v0.22.7)

Before: the approval gate asked only about the first rule a command matched. A curl -F upload of your .env piped into bash matched both pipe remote content to shell and upload a secret or credential file, but only the first was asked about, so once pipe-to-shell was approved for the session, or allowlisted for cron, the .env upload ran with no prompt of its own. After: the three content rules (a credential upload, a credential file piped into curl or wget, invisible Unicode) always need their own consent, combined into one prompt, and cron deny mode blocks the command until each one is allowed. Two related fixes: awk -F and cut -d with a secret-named delimiter are no longer reported as credential uploads (a hard block in cron), while a command word like $CURL still counts as curl, and zero-width variation selectors that do not follow an emoji are flagged again, with keycap emoji still allowed. Limits: hermes approvals test still reports only the first rule, and answering always on a content rule still covers later uploads of other files to other hosts.

Pull requests: Content rules get their own consent, Upload flags owned by curl or wget, Variation selectors.

2. A failed profile force install no longer deletes the folder it was replacing (already in v0.22.7)

Before: hermes profile install --force and distribution updates deleted each directory they replaced first and only then copied the new one in, so a copy that failed part-way, for example on a Windows file lock in a large skills folder, left the profile without that directory. After: the new copy is staged in a .hermes-dist folder next to it and swapped in by rename; if the copy or the swap fails, the old directory is put back, and a leftover that cannot be cleaned up is never picked up as a second copy of a skill. Replacing a single file works as before.

Pull request: Profile force install.

3. Gateway replies stop waiting on media cleanup

Before: when a turn that used photos or files finished, the gateway first checked whether any transcript still named those files, a scan of the whole messages table, and only then sent the reply; on a large state.db that could take minutes. After: the reply goes out first and the cleanup runs afterwards, on one collector per profile that takes one turn at a time, so a burst of media turns no longer starts parallel full scans. Limits: the scan itself costs the same; it just no longer holds up the reply.

Pull request: Replies before media cleanup.

4. hermes update stops failing on the same old Matrix extra every time (already in v0.22.7)

Before: moving an old install onto the package manager re-installed the optional features the old venv had, and when one of them no longer built on the machine (Matrix’s python-olm needs CMake and a C++ compiler), the update failed, and every later hermes update tried again and failed the same way. There was no way to drop it either: hermes pm install --without accepted only chromium and cua-driver. After: an update leaves out a carried extra that no longer builds, finishes, and prints the command to add it back; hermes pm install --without matrix drops it for good, and hermes pm install --extra matrix brings it back (an extra you ask for still fails loudly). Builds also break less in the first place: the package manager sets a CMake policy floor of 3.5 so python-olm builds under CMake 4 (a value you set yourself wins), and on Linux machines with only gcc and g++ (stock Ubuntu, Debian, WSL) native packages build with those instead of failing on a missing clang++, with an install hint when there is no compiler at all.

Pull requests: –without drops a carried extra, Leave out an extra that no longer builds, CMake 4 policy floor, gcc and g++ builds.

5. Plugins stop getting switched off by pins they never install (already in v0.22.7)

Before: a plugin’s test-only pins, such as a dev extra asking for an older httpx, were solved together with Hermes’s own pins, so one disagreement failed the whole dependency lock and hermes update switched the plugin off; the same happened when a selected plugin extra named hermes-agent itself. A plugin whose pyproject.toml only configures tools like Ruff had its plugin.yaml dependencies silently skipped. After: dev and test extras and dependency groups stay out of the lock, an extra that names hermes-agent is bound to the running checkout, and a tooling-only pyproject.toml falls back to plugin.yaml. A plugin whose own requirement on hermes-agent excludes the running version is no longer installed silently: it sits out and comes back on its own once Hermes reaches a version it accepts.

Pull requests: Dev extras and dependency groups, Extras that name hermes-agent, Tooling-only pyproject.

6. Remote Desktop chats start again on public connections

Before: a Hermes Desktop that signed in to a remote gateway with a public ticket kept using the old protocol even when the gateway advertised the newer session-authority one, so every new chat failed with Session unavailable / invalid_params, while the Webapp at the same address worked because it dials differently. After: the Desktop waits for the gateway’s ready message and picks the newer protocol only when the gateway says so, so older gateways keep the old one, and on those chats images, /undo, /retry and messages sent while a turn runs go through the gateway’s own handling. No server, auth or ticket changes.

Pull request: Remote Desktop protocol negotiation.

7. Desktop updates: Macs install them again, a failed one shows why, and Intel Macs are out

Before: on the Mac app, an update downloaded, restarted and then never installed, because the update bundle carried about 25,800 read-only Python bytecode files and the macOS updater gives up on any read-only file, then relaunches the old version. When a backend update failed, the error box said only Backend update failed. After (already in v0.22.7): the bundle ships those files writable, and the macOS release step now refuses any update ZIP with a read-only entry. The update error box shows the last 300 lines of the updater’s output with a Copy button, and Send diagnostics, after a consent step, uploads the same redacted bundle as hermes debug share --nous and puts the private link in the box. Heads-up: installed Macs need no change, but the fix reaches them only with the next bundled release, and the PR traced this in the updater’s source without running it on a Mac. Also on main: the Intel macOS build jobs are gone, so Intel Macs on the Desktop app get no further app updates (the stable feed was already Apple Silicon only); the CLI on Intel Macs is untouched.

Pull requests: Writable bytecode on Mac, Release refuses read-only ZIPs, Failed update box, Intel macOS jobs removed.

8. Seven optional skills step aside for official sources

Before: Hermes shipped optional skills for Notion, Airtable, Shopify, DuckDuckGo search, SearXNG search, Honcho and MPP payments. After (on main): those seven are removed. Notion and Airtable have official MCPs in the MCP catalog, and the Notion, Airtable and Shopify skill repos now show up in hermes skills browse as trusted sources; web_search has built-in ddgs and searxng backends; the Honcho catalog plugin owns the hermes honcho commands; and the pay catalog plugins cover MPP. Heads-up: nothing is pruned, so a copy you already installed stays.

Pull request: Optional skills removed.

9. Group Chats get schedules, a lead, a chat-like look and cross-machine rooms again (already in v0.22.7)

Before: a cron job could not post into a Bot Mode Group Chat, every member took a turn on a message that named nobody, a room showed only Working: and a name, and New Group Chat hid bots on other machines. After: deliver: room:<room_id>@<profile> posts a job’s output into a room, tagged Scheduled, and wakes only the bots it names; rooms get a purpose and shared notes every member reads at the top of its turn; an opt-in lead picks who takes a message that names nobody, shown as a one-line handoff you can correct; rooms look like the normal chat, with each bot’s live tool and elapsed time; and a room can again mix bots from this computer and another one, carried by this Desktop while it stays open. Existing rooms keep everyone answering.

Pull requests: Cron posts, purpose and notes, Lead routing, Chat-like rooms and live state, Cross-machine rooms.

10. The Windows installer stops getting stuck on a half-installed Git (already in v0.22.7)

Before: on Windows, a file held for a moment, usually by antivirus, while the installer moved the freshly unpacked Git into place left a half-copied Git that could not download over https, and every retry reused it, ending in INSTALL DIDN'T FINISH. After: the installer spots a Git without its https helper and replaces it, and the move is a single rename that lands the whole tree or nothing, retrying through short locks; a lock that never clears fails with a message naming the folder.

Pull request: Windows installer Git.

Meanwhile, in the engine room

Dozens of fixes landed yesterday that most users never see, and the Desktop app took most of them.

• Desktop and the Webapp drew a finished tool call twice when its event arrived again, so five background subagents showed ten delegate cards; a repeat now leaves the transcript alone, and a new turn that reuses an old call id gets its own row (pull request)
• Opening a subagent’s conversation right after it was spawned could fail with not_found, because its session row was written only at its first turn; the row is now reserved before its id is shown (pull request)
• The dashboard built its config schema on the same event loop as the chat and terminal sockets, freezing them for about a second with a large plugin folder (3.6 seconds on the reporter’s machine); it now runs on a worker thread (pull request)
• On a host without libopus, such as the Hermes Cloud image, every Discord connect and reconnect ran a blocking library search on the gateway’s event loop; it now runs once per process, off the loop (pull request)

If you noticed none of this, it worked.

Items 1, 2, 4, 5, 9 and 10, the Mac update and error box fixes in item 7, and three of the four engine room fixes already shipped yesterday in v0.22.7; items 3, 6 and 8, the Intel change and the tool card fix are on main and ship in the next release (Desktop app changes reach the Microsoft Store app with a release and the .exe and .dmg app with its next bundled release). Latest stable: v0.22.7.

Watch the recap

The 56-second motion recap, made with Remotion, is on X.