Hermes yesterday, November 4, 2026: images draw inline in the terminal

Your terminal stops showing image paths and starts showing the pictures. Attachments and tool screenshots now draw inline in the CLI and the TUI by default, with real pixels where the terminal can. Also: the dashboard stops taking writes from sibling pages, and Bedrock’s GPT-6.1 Terra stops compressing at 96K. 102 commits; here are the 10 that matter.

1. Images show up in the terminal, not just their paths

Before: an image you attached (/paste, /image, drag-and-drop) or one a tool produced or looked at (vision_analyze, image_generate, a browser screenshot) showed only as a file path in the classic CLI and the TUI. After: it is drawn inline under its line, on by default (display.inline_images: auto). kitty and Ghostty get real pixels in both; the classic CLI also gets real pixels in iTerm2, WezTerm and Konsole, and in VS Code when terminal.integrated.enableImages is on (a startup check of about 10 ms finds out, skipped over SSH and on Windows, and an occasional tip says how to turn it on). Everything else, including tmux, GNU screen and the TUI outside kitty and Ghostty, gets colored half-block characters. A failed tool call shows no picture, and previews refuse images past 40 megapixels before decoding them. Limits: tool images are not kept on resume, remote image URLs are not fetched, an iTerm2-style image is lost from the redrawn screen after a resize (scrollback keeps it), and over a slow SSH link the kitty transmit of up to about 350 KB per image is noticeable. display.inline_images: off brings back paths only.

Pull requests: CLI and TUI, VS Code full resolution.

2. The dashboard refuses writes from sibling pages

Before: the standalone dashboard’s sign-in cookies are SameSite=Lax, which browsers still send from a same-site sibling such as another localhost port or a sibling subdomain, so a page there could make changes with your signed-in session or sign you out. After: a cookie-authenticated write, sign-out included, is refused with a 403 when the browser itself marks it as coming from a same-site or cross-site page, a marking pages cannot fake. Limits: requests that carry no such marking keep the old rule, so a sibling page on a plain-HTTP host that is not loopback is still not covered, and a same-site page that wrote to the dashboard on purpose now gets the 403 too. The Webapp keeps its stricter own-origin check.

Pull request: Dashboard sibling-page writes.

3. Bedrock’s GPT-6.1 Terra gets its 1M window, and guessed windows say so

Before: GPT-6.1 Terra on Bedrock resolved to the 128K default, so Hermes compressed at 96K although the AWS card says 1,050,000 tokens; the gateway session line called that default detected, and the CLI showed the number with no source. After: GPT-6.1 Terra and GPT-5.4 get 1,050,000 and route like their siblings, 15 third-party models (Nova 2 Lite, Kimi K3, GLM 5.3, Qwen3 Coder and others) get their card windows, and an Anthropic, OpenAI or xAI model the Bedrock table does not list yet borrows its family window before the 128K default. Any window Hermes only defaulted to, on Bedrock or at the generic 256K, is now labelled fallback in the banner, the status bar, /usage, /model, /status, /context and the gateway session line. Limits: other vendors’ unlisted Bedrock models stay at 128K, now marked fallback, and some cards (Claude Haiku 5.5, MiniMax M2, Grok 4.7) stay under-sized until the main catalog moves first. The override is unchanged: model.context_length.

Pull request: Bedrock windows and the fallback label.

4. Slack threads stop flagging people who are allowed

Before: when Hermes read the earlier messages of a Slack channel thread, it checked each sender against the DM allowlist instead of the channel one, so with group_allow_from set to everyone, every human was tagged [unverified] under a header telling the agent not to act on their requests, while someone allowed only in DMs read as verified inside a channel. After: earlier senders are checked with the live message’s own chat type, channel or DM, so the tag marks exactly the people that message’s allowlist would refuse. Limits: Discord threads and relay-fronted Slack are unchanged.

Pull request: Slack thread-context tags.

5. Skill installs follow a repo’s current trust level

Before: a skill scanned before an upgrade kept the trust level recorded at scan time, so a repo newly added to the trusted list, like the Notion, Airtable and Shopify skill repos added the day before, stayed under the stricter community policy, and a repo removed from the list kept its looser trusted policy until the skill’s content changed. After: a cached scan is reused only when the source’s current trust level still matches; otherwise the skill is scanned again.

Pull request: Skill scan trust cache.

6. Desktop keeps listening and gets lighter when minimized

Before: voice detection ran on animation frames, which stop in a minimized window, so speaking to a minimized Desktop and pausing never submitted, and talking over a spoken reply did not interrupt it; every Desktop window also stayed fully awake whenever any conversation streamed. After: voice detection runs from the captured audio, so it keeps working minimized, and echo rejection still keeps Hermes’s own reply from becoming a new turn. Minimized windows and idle previews throttle their painting, while stream delivery, Stop and read-aloud keep working, and a restored window shows the latest state. Limits: no CPU or battery numbers were published.

Pull requests: Voice detection, Streaming work, Idle previews.

7. Desktop can steer a running turn from a fresh connection

Before: steering or redirecting a running turn through a newly opened control connection failed with Session execution identity unavailable, and the correction was never sent. After: the Desktop attaches to the session first, as it already did for interrupt, and then sends the steer or redirect. Limits: other mid-turn steering symptoms are still in review in a separate pull request.

Pull request: Steering from a fresh connection.

8. Bot Mode: ask several bots in one call

Before: message_agent took one teammate per call, an answer sent back as a direct message could wake the asking bot twice, and a teammate whose gateway restarted mid-turn read as a bare delivery failure, so the asker resent. After: one call reaches up to 8 comma-separated teammates and wakes the sender once with every outcome; expects_reply=false sends a notify-only message; the sender can cancel its own request; optional constraints and expecting reach the teammate as labelled Constraints and Reply needed lines; and every result leads with one sentence such as @gamma never answered, with the reason and whether resending is safe. A teammate that ends silent after writing its answer elsewhere has its last words relayed once. Limits: that relay is proven in unit tests only, not in a live run.

Pull request: Bot Mode fan-out.

9. The mobile app connects through a proxy on another machine

Before: with the Webapp behind a tunnel or reverse proxy on another machine on the network, the Android app signed in but its chat connection was refused every time, with nothing in the logs, because a connection without an Origin header was taken for a local Desktop and had to come from loopback. After: such a connection from a remote peer goes to the Webapp’s normal ticket check, the one a browser already reached; local Desktop grants still work only from loopback. Limits: a tunnel or proxy on the same machine as the gateway still takes the local Desktop path.

Pull request: Mobile app through a remote proxy.

10. 1 new plugin in the catalog

One new community entry, for people who live in the Rex terminal: rex makes CLI and TUI sessions started in a Rex pane learn which session and pane they run in and load Rex’s own agent skill, marks their status in the window title, opens follower panes for subagents and kanban workers, and on macOS notifies you when Hermes waits for an approval or an answer while its pane is out of view. It lists macOS only, needs Hermes v0.22.3 or newer and terminal.client_env_passthrough set to the four REX_ variables (its README gives the hermes config set line), and it calls the local rex CLI with no network calls of its own. Catalog entries do not wait for a release: they go live once the published catalog refreshes, which can take up to six hours.

• Terminal: rex

Meanwhile, in the engine room

Dozens of fixes landed yesterday that most users never see, and the new terminal images took most of them.

• Desktop session and zone tabs answer the keyboard again (arrows, Home and End, Enter or Space to open, Delete to close), sidebar actions appear on keyboard focus, and focus rings are visible again instead of suppressed (pull request)
• Starting Web Access in Desktop settings no longer shows Restart needed in a reopened pane or a second window while the gateway restarts, and a Start queued behind another one no longer restarts the gateway twice (pull request)
• Microsoft Store builds of each stable release waited after certification for someone to click Publish now; from the next release they go live by themselves once certified (pull request)
• A tool result nested too deeply for the JSON parser raised out of the TUI and gateway handlers and lost the whole tool-complete event; it now counts as a parse failure (pull request)

If you noticed none of this, it worked.

All on main, ships in the next release (Desktop app changes reach the Microsoft Store app with the release and the .exe and .dmg app with its next bundled release). Latest stable: v0.22.7.

Watch the recap

Watch the 56-second motion recap on X, made with Remotion.