Hermes merged 60 PRs on August 30
The ones worth knowing:
• Credential vault lives in Settings, with agent deep link prefill
• Real profile browsing: Brave Origin detection, macOS signed in, headless (no focus steal), toggle under Capabilities to Tools to Browser
• Desktop MCP OAuth sign in works against remote backends
• /loop runs its first iteration immediately
• /plan is a built in command that survives platform menu caps
• Telegram: every command and skill searchable via
@botname inline picker
• CLI and TUI status show cache hit %, latency, and t/s with field toggles
• System prompt always rebuilds at compaction commit, so updates reach long lived sessions
• Skill activation drops repeated absolute paths (down 31% load on reference heavy skills)
• Copied session cookies are no longer world readable
• Unattended webhook/API sessions no longer stall 300s on dangerous command approval
• Lean compaction is one auxiliary request again (7 to 11 min digest stalls gone)
Here is the full list:
DESKTOP IMPROVEMENTS (13 PRs)
• feat(desktop): manage the credential vault from Settings, with agent deep link prefill
• fix(computer use): stop launching retired browser grant runtimes
• fix(tui): render nested todo subtasks via the parent field
• fix(desktop): remote bot replies no longer die at the 30s relay deadline (#
93911#, salvage #
93965#)
• feat(browser): Brave Origin no longer misdetected, real profile browsing + CDP connect (salvage #
41505#)
• fix(todo): Tasks panel stays live across merges, reconnects, and hidden tool progress (salvage #
97815#, #
97811#)
• fix(browser): real profile browsing on macOS no longer opens signed out or hangs (salvage #
96763#)
• feat(mcp oauth): Desktop MCP OAuth sign in now works against remote backends
• fix(cron): Desktop's advertised natural schedules now parse (#
51975#, salvage #
51598# #
52504#)
• feat(desktop): the real profile browsing toggle users couldn't find, Capabilities to Tools to Browser
• feat(tui): status rule shows cache hit %, latency, and t/s with shared field toggles (extends #
98250#)
• fix(browser): real profile browsing runs headless, no focus stealing window
• fix(todo): unversioned tool.start merges again after desktop resume (#
98304#, salvage #
98306#)
DEVELOPER TOOLS & PLUGINS (22 PRs)
• fix(providers): register Alibaba China + Token Plan providers, 'Unknown provider' despite catalog entry (#
73265#)
• fix(memory): keep Mem0 OSS OpenAI requests direct
• feat(loop): /loop runs its first iteration immediately (salvage #
97958#)
• fix(skills): skill_view directory file_path + skill_manage categorized name resolution
• fix(prompt): sync DEFAULT_SOUL_MD with the #
95681# identity rewrite
• docs: sync stale /background references with the /bg + /btw split
• fix(tools): restore setup_mcp's never hand edit instruction
• fix(delegation): subagents on an explicit base_url keep their provider's request_overrides (#
65035#, salvage #
65054#)
• feat(skills hub): impeccable joins the optional skills catalog, content pulled live from upstream
• feat(cli): status bar gains cache hit %, latency, t/s, and per field toggles (salvage #
92696#, #
39760#, #
97970#)
• hermes model shows curated lists for all six Alibaba tiers (salvage #
77848#)
• Background review lands skill patches again, read tools whitelisted, cache parity intact (#
61521#, #
39996#)
• docs(computer use): browser route and grant references match the shipped tool (salvage #
96156#)
• Qwen Cloud picker gains qwen3.8 max + 4 more missing models (salvage #
87808#)
• feat(delegation): delegation.request_overrides config key sends per child request settings on every resolution branch (salvage #
90953#)
• feat: /plan survives the platform command menu caps as a built in command (closes #
67264#, #
36821#, salvage #
67292#)
• Background review accepts profile configured extra tools via opt in whitelist (closes #
44672#, salvage #
82146#)
• fix(skills hub): skill installs survive dangling refs, sibling links, glob prose, and unpinned fetches (salvages #
66828# #
82236# #
90105# #
96336#)
• feat(compaction): system prompt always rebuilds at the commit boundary, updates finally reach long lived sessions
• fix: skill activation no longer repeats the absolute path on every supporting file line (down 31% load cost on reference heavy skills)
• refactor(skills): move merge reconciler to optional catalog as agent merge conflict arbiter
• refactor(skills): shipped set slim, 15 to optional, github 6 way merge, pdf absorbs OCR, channel gated teams pipeline (index down 26%)
SECURITY & SECRETS (4 PRs)
• Anthropic OAuth: shared credential refreshes stop burning single use tokens; dashboard PKCE removed (salvage #
87891#)
• fix(browser): copied session cookies are no longer world readable (#
96729#)
• fix(security): env vars with mid name API/KEY/TOKEN no longer flag as exfiltration (salvage #
63994#)
• fix(approval): unattended webhook/API sessions no longer stall 300s on dangerous command approval (#
37284#, salvage #
37317#)
INTEGRATIONS & CHAT (5 PRs)
• fix(telegram): recover exhausted request pool
• fix(runtime): provider switch, fallback, and recovery keep request settings in sync (#
75091#, salvage #
75139# #
60062#)
• fix(gateway): custom provider extra_body survives gateway turns and /model switches (#
54922#, salvage #
39429# #
52432# #
53765#)
• fix(telegram): pinned skill commands survive the menu cap (salvage #
82516#)
• feat(telegram): every command and skill is searchable via
@botname, inline picker bypasses the menu cap
STABILITY & FIXES (16 PRs)
• fix(cli): slow /handoff transfers no longer misreported as "gateway not running"
• 3x fmt(js): npm run fix auto fix
• fix(cron): 'every hour' and 'every day' schedules no longer error (salvage #
97783#)
• fix(cron): scheduled jobs no longer lose custom provider request settings (salvage #
56876#)
• fix(cron): bare '30m' schedules recur as documented; 'in 30m' is the one shot (salvage #
78928#)
• fix(cron): repeat='forever' no longer breaks job updates (completes the string repeat class)
• fix(compression): stale todo snapshots no longer accumulate or resurrect finished plans (salvage #
97604#, #
89910#)
• fix(compression): native Codex compaction no longer fires at the stale 200K default on 900K windows (#
88695#, salvage #
88722#)
• fix(compression): compacted native Codex sessions no longer false trigger 600s local compression mid turn (#
96995#, #
97602#, salvage #
97006#)
• fix(native compaction): image only user messages survive checkpoint pruning (salvage #
91557#, folds #
98345# test)
• fix(codex): compaction only turns no longer die after 3 continuation attempts (salvage #
98008#)
• fix(compaction): native capability survives same provider /model switches and gateway resume (salvage #
94036# + #
97292#)
• fix(compression): native compaction settings hot apply to open sessions (salvage #
96740#)
• fix(compression): lean compaction is one auxiliary request again, 7 to 11 min digest stalls eliminated (#
96603#)