GitHub Release: NousResearch/hermes-agent v0.22.1 (15.10.2026)

Release Date: October 14, 2026

This is a patch release, with a handful of fixes for the Windows Store, plugin updates, and more.

✨ Features

• Agent): add nemotron super 3.5 default parameters (c59d2994) — @elisam0


• Cli): add curated model list at the top in the model picker list (e6835fd3) — @elisam0


• Plugin-catalog): add hermes-lang-ko — Korean Desktop language pack (e5f49b6a) — @dandacompany


• Plugin-catalog: add hermes-lang-pt-br (Brazilian Portuguese language pack) (0169e80c) — @StudioCodeAI


• Plugin-catalog: add teamorouter (TeamoRouter model providers) (ef223406) — @2867297362mjb-sketch


• Plugin-catalog): add author-feed (5f6d6836) — @TakeshiTGAL


• Plugin-catalog): bump aux-ledger to 1.4.0 (6048066e) — @olric3015


• Plugin-catalog): add the wait-ledger catalog card (77cb58e5) — @olric3015


• Plugin-catalog): add wait-ledger (97e65322) — @olric3015


• Community plugin: lightningai + lightningai-rate-limit (07515466) — @dinosauria123


• Catalog: add Hermes AAC 0.1.0 at reviewed exact source pin (7c9adda8) — @TREE-Ind


• Plugin-catalog): add openinvest (b6e86101) — @longsizhuo


• Catalog: add hermes-agent-mixer (v0.2.0 @ 04c4e13) (2e7e3859) — @Sahil-SS9


• Plugins): move Kumiho Memory to memory catalog shelf (46f95e08) — @kaveone


• Add canonical group attachment controls (4673f17c)


• Consume event-bound hosted files through canonical admissions (e87bd098)


• Connect Desktop groups to canonical driver controls (3c2c9d47)


• Transport hosted producers through authenticated owner sockets (51189b05)


• Retain hosted room work evidence across authority changes (0af2c714)


• Route hosted room workers through session authority (bd22e0f9)


• Wire canonical hosted group controls (fa2179bb)


• Gateway): resolve --resume <title> and -c <title> [--create-if-missing] in the authority (11a83ad4)


• Retain terminal identity tombstones during history retirement (ba435291)


• Route native CLI and ACP actions through prepared controls (27b0f7f2)


• Publish real prepared compression in the mutation receipt transaction (b6540276)


• Prepare and atomically publish local model changes (7e7fa7c6)


• Commit independent local branch policy and route atomically (f98eaec1)


• Project managed tool progress without private arguments or results (61ccd894)


• Bridge managed worker approvals clarification and stop (a0b5118f)


• Launch admission-owned tool workers from the ordinary daemon (510e32be)


• Enforce safe defaults at bare agent construction (1eeac867)


• Suppress rules skills and memory readers in private safe workers (25cda66a)


• Bypass plugin providers and hook execution in safe workers (33921e6f)


• Bind immutable private worker config before runtime imports (4cc3f420)


• Expose verified canonical ACP editor MCP attachment (1bda56a1)


• Rebind exact editor MCP credentials on canonical ACP resume (5bfa2f2c)


• Borrow editor MCP configurations with frozen session manifests (394f00f6)


• Isolate execution-owned MCP registry overlays (96e4d296)


• Commit local reset targets with runtime mutation receipts (821137c3)


• Expose profile-scoped Bot relay mailbox RPCs on the authority (792aa35a)


• Migrate queued Bot mailbox identities without replaying claims (af49e2fc)


• Send local Bot DMs to the discovered canonical authority (47ba694e)


• Admit identified Bot Chat relay deliveries through session authority (998df8cc)


• Reserve exact owner-started admission worker claims (fbdfd46d)


• Expose authenticated owner mutation snapshots (d6331c48)


• Freeze ACP tool policy and bind execution-owned edit consent (e2f5cfc6)


• Reserve hosted API identities through the authority (6b278ca4)


• Admit API runs before acknowledging execution (f2d9cea3)


• Run bound API turns on the shared cached agent (dea4f0c5)


• Restore server-bound API session identities (76532ae1)


• Retain claim-fenced structured admission results (262e0ebf)


• Compose worker compression lifecycle and delegation persistence (6c57ad37)


• Publish committed worker completions through authenticated owner bridge (d94ccc2d)


• Fence delegation receipts with shared worker sequence and epoch (be85ca24)


• Route registered worker delegation writes through durable outbox (1ee6545f)


• Add execution-bound delegation ledger operations (8128e88f)


• Persist worker titles activity and route sidecars with receipts (235e4f12)


• Add assignment-fenced worker constructor and finalization handlers (b7de5a8e)


• Atomically compact and advance worker transcript assignments (c2e77eba)


• Preserve worker history and cache lineage identities (e63e1101)


• Add receipted worker compression guards and leases (d51afe4c)


• Route REST imports and deletion through mutation receipts (2cdd103d)


• Route REST sidebar edits through the shared authority (eb329d21)


• Coordinate shared mutations and publish committed revisions (eb42a002)


• Reuse transactional rewind with generation and receipt fences (6777ffa4)


• Import session histories atomically with retry receipts (b9194595)


• Fence destructive deletion without erasing runtime obligations (e5249c9a)


• Commit sidebar edits with canonical mutation receipts (0b1b8e0f)


• Project execution-owned approvals to ACP viewers (97a24c10)


• Attach ACP transport to canonical session execution (8dd92a30)


• Persist assigned worker prompt context and usage anchors (c6540cb9)


• Admit local automation through owner durable FIFO (1642b339)


• Queue due gateway heartbeat ticks through canonical admission (ab44af2c)


• Admit trusted gateway completions to the durable session FIFO (7cd1b000)


• Fence worker terminal receipt after sequenced durable writes (21a48aea)


• Authenticate live worker persistence and explicit restart adoption (9d7d7e2a)


• Receipt worker main and auxiliary usage in canonical transactions (9d896c49)


• Atomically receipt structured worker transcripts and turn leases (2abe47de)


• Dispatch bound local slash commands through gateway handlers (b0377e92)


• Share authenticated canonical slash discovery with legacy catalogs (fcf50e03)


• Authenticate native HTTP through private daemon grants (75764b2a)


• Commit local creation policy and restore cold authority routes (aa2624ba)


• Attach Desktop local launches to canonical gateway (9c40ddcf)


• Bind Ink sessions and controls to canonical authority envelopes (a2d9e258)


• Attach Ink local transport through canonical gateway bootstrap (08f628f9)


• Route normal classic and one-shot launch through the gateway (35510459)


• Add transport-only classic gateway client and option validation (6ed03be9)


• Apply local launch policy through real gateway turns (080c5da6)


• Define frozen local session launch policy (81ed9712)


• Route revision-checked session metadata through gateway (17ddbe44)


• Expose scoped local session metadata and document compatibility (52c354ff)


• Create gateway-owned local sessions through authenticated controls (42967cdd)


• Recheck native Discord membership before durable admission and claim (cc0cd5c9)


• Boot authenticated session authority in ordinary gateway (c3bf62eb)


• Share live clarification controls across attached viewers (9c474378)


• Stream canonical gateway execution events to shared observers (40d9b4c7)


• Reauthorize multiplex native connector provenance (244bff73)


• Share generation-fenced approvals across gateway viewers (5e2afdae)


• Retain native media and context before durable admission (ef447482)


• Replay authority events from atomic subscription watermarks (d24dc3fa)


• Recover committed native text without replaying unknown turns (78646003)


• Execute attached websocket turns on the messaging live agent (47fbfd4c)


• Add revision-fenced runtime rename and archive receipts (5878e565)


• Fence typed worker persistence with atomic replay receipts (7cc69d29)


• Import drained legacy admissions atomically with unknown recovery (124dfa7c)


• Centralize durable session admissions in canonical storage (0695b12b)


• Keep declined gateway wizard starts unmanaged (7500930d)


• Require explicit consent for gateway service setup (16d6b7da)


• Restrict runtime bootstrap peers and bound native pipe I/O (d3ccac14)


• Compose the existing API into the gateway event loop (bac47874)


• Distinguish unavailable gateway owners from absent runtimes (e903841c)

🔧 Improvements

• Profiles): build the seed routing view once; expand enabled too (311155fa) — @kshitijk4poor


• Update nemotron super 3.5 name (3224993a) — @elisam0


• Hermes_cli): update nemotron 3.5 name (108ae4e7) — @elisam0


• Catalog: re-pin showly to the build without the upstream self-update check (6462f64a) — @slchris


• Catalog: update Model Router to v0.4.3 native preferences (6a097ee9) — @metamindedu


• Keep native MCP revision scoped to frozen tool settings (53d17f1c)


• Cron bot-chat delivery has no local CLI fallback lane (5d87060e)


• Retire bot execution discovery from viewer notification pollers (c8ae25cd)


• Make default ACP construction authority-only (c423a431)


• Remove obsolete updater sidecar deletion path (58895653)


• Remove retired local serve launch imports (5702f9df)


• Extract ordinary gateway bootstrap lifecycle (3c0f1e01)


• Freeze shared session authority interface contract (1af74c27)


• Extract TUI session registry and agent factory seams (a38ca908)


• Separate gateway agent acquisition from native progress (0f3a4fb2)


• Extract gateway turn preparation and persistence phases (6e8de80a)


• Move gateway service wizard into setup sibling (f0b35a98)


• Extract gateway setup service orchestration (02d0307c)


• Remove extracted runner initialization bodies (4b1379fb)


• Extract gateway bootstrap and writable initialization phases (0c287340)


• Extract standalone web application lifespan (f38f2444)

🐛 Bug Fixes

• Compression): fallback summaries, multiline setup notes and parallel loads keep skill markers right (297552a9)


• Compression): a slash-skill body's example paths stay out of the anchor index (d6020828)


• Compression): small and slash-invoked skills keep their reload marker across compaction (71e815de)


• Desktop): update notes keep full text, re-read merged PRs per check, respect custom branches (f2a93db9)


• Mcp): preserve server deadlines through outer tool execution (f30020ed)


• Plugins): honor portable per-server call deadlines (fcc170b7)


• Agent): rewrite split tool ids before Mistral sees them (b33ed359) — @xxxigm


• Profiles): align model seed with provider resolution (5fee8d77) — @helix4u


• Profiles): inherit canonical and legacy custom endpoints (2d3e75aa) — @helix4u


• Drop the VPN/proxy advice from the CDN-block message (300228d2)


• Catalog): re-pin Agent Mixer after maintainer review (4297a692) — @Sahil-SS9


• Pin Activity v0.2.1 public credential routes (3dac1f07) — @hassan-kamel


• Plugin-catalog): update switchbot-control to d0e6f77 (c4bf61b1) — @TakeshiTGAL


• Doctor): clarify Docker npm audit remediation (e21caa27) — @KoNit-K


• Deps): bump the WhatsApp bridge lock past its npm-audit findings (231cb757) — @ethernet8023


• Tui): retain native legacy history in canonical session picker (2171365a) — @unsupportedpastels


• Tui): the banner shows main's 8-character session label for a canonical id (2c979900)


• Gateway): a local process completion persists as a process_complete card (ff770cb7)


• Runtime): persist diagnostic automation category through replay (bdac7911) — David Dudok de Wit


• Gateway): retire bot receipt tasks with authority (d50b2eda) — @Lokee86


• Gateway): persist operator provenance for native recovery (c51049aa) — @Lokee86


• Cli): preserve blocking controls in finite output (954638ed) — @Lokee86


• Gateway): isolate malformed bot receipt schemas (4be62f9c) — @Lokee86


• Acp): clean up deferred cancellation lifetime (89dac620) — @Lokee86


• Gateway): close remaining unified-runtime review gaps (83cdc63a) — @Lokee86


• Gateway): isolate bot receipts and keep headless cron no-spawn (cdf36315) — @Lokee86


• Gateway): recover mixed local queues and retire failed hot serves (f4fd982b) — @Lokee86


• Gateway): terminate replay gaps and retain ACP cancels (37662b16) — @Lokee86


• Gateway): route local ticket bootstrap through control owner (996d9beb) — @Lokee86


• Desktop): a transcript reconcile skips a runtime mid-switch to another session (09aafcea)


• Gateway/stream): a failed overflow head send no longer spins the event loop (f0d9bd2f)


• Gateway): profile on our own home is stripped only for the closed session verbs (2c5b0af5)


• Gateway): gateway ensure starts on a systemd host whose user bus is unreachable (82db702f)


• Desktop): a session routed onto a new socket re-attaches before it submits (307dac20)


• Desktop): a registry-connection hover prewarms that connection's gateway (main #89756 port) (#89756)


• Bot-relay): a relayed dm targets only live profiles (#99392 on the authority door) (#99392)


• Gateway_chat): one-shot refuses an unknown-blocked session; stream-json always closes with a result (08b6ebd0)


• Tui_gateway): projects RPCs answer from the scan cache when a profile's state.db was never initialized (372ec7fc)


• Cron): Bot Chat delivery creates the missing Bot Chat instead of failing the run (364a0e22)


• Seed-copy compensation discards the row without the retirement fence (44212c5a)


• Gateway): exact mutation retries repair the runtime projection (X11, reported by @Xipong) (c1ee9286)


• Desktop): preserve accepted input and clarify persistent-work Quit (f8e234ed) — @dokterdok


• Desktop): drop pool-limit notification wiring main added after the pool subsystem was removed (c3632fcc)


• Runtime): owner scope is multiplex-only; foreign LOCAL sources fail closed; primary = launch home (a37550b9)


• Type session creation identity with merged onboarding options (0948ffc9)


• Preserve main lifecycle and discovery behavior after extraction (b186879a)


• Preserve webhook delivery profile and snapshot scoped home (8fe3d198)


• Retain per-admission bot and API authors (61f75a77)


• Recover mixed-clock sessions and compose runtime test listeners (9e747d7f)


• Preserve hosted image admission and execution across owners (2672b820)


• Gateway): restore hosted image attachments natively (bdfe8a50)


• Desktop): preserve profile target during reconnect (ddf8bec7)


• Restore durable hosted group sends before enabling input (d3162155)


• Translate canonical hosted group controls in all desktop locales (29e27af5)


• Desktop): journal canonical group sends before admission (3d1cb4e0)


• Integrate hosted attachment admission hooks (c094d91e)


• Transfer hosted input bytes through task-scoped owner attestation (519e1101)


• Bind hosted owner transport to exact destination home (9035ef9a)


• Minimize retained webhook destinations and preserve legacy receipts (c6456808)


• Capture peer ACK evidence and trim unused file catalog helpers (c86dd71b)


• Publish hosted file shares with cursor-fenced retries (49e27d8b)


• Run hosted rooms through independently owned profile daemons (53a260ac)


• Fence hosted discard and prevent unknown retry generations (3cde0092)


• Explicitly discard exact hosted unknown executions (864c34f3)


• Preserve hosted room ownership during service shutdown (bfa8022d)


• Durably recover webhook destinations (d207fd64)


• Recover native admissions after ordinary adapter startup (70659676)


• Carry finite execution policy through canonical admission (9edd28e6)


• Join finite gateway chat delegations in the admitted turn (5977ef75)


• Resolve managed Node in native ticket probes (ee9030bd)


• Preserve manual compression settings and session identity (9fa0b6aa)


• Prevent duplicate cron alerts after durable delivery handoff (47e3bb25)


• Preserve cron delivery silence and incident acknowledgements (0c7f676e)


• Bound canonical cron owner store acquisition (61759b57)


• Restore canonical desktop image thumbnails safely (4d5db820)


• Restore prepared desktop image drafts after restart (5034ee3a)


• Route lost prompt discard to its session owner (566872a8)


• Preserve newer replies across delayed redirect receipts (ac30b57a)


• Retry transient desktop busy policy reads (82098e63)


• Keep desktop streams intact when corrections are refused (3c886973)


• Connect recovery and owner projection routes (cfa5c152)


• Discover private gateway sockets across native temp roots (de66df14)


• Expose owner-scoped ancillary session reads (61ace21a)


• Stage canonical remote images in the authorized owner cache (baaa4464)


• Project native config and model inventory from canonical owner (1064971e)


• Preserve Kanban board discovery and unknown owner attempts (90e2b2eb)


• Reconcile canonical cron receipts into durable delivery (c1172b1a)


• Preserve admitted images and async usage in managed workers (4abbb3f9)


• Share static-token session ownership across HTTP and WebSocket (56e344e5)


• Connect canonical cutover repairs across owner and clients (c8f8d9ae)


• Restore scoped canonical busy and correction controls (daa01697)


• Isolate authenticated gateway owners by provider and issuer (6b8a6d4c)


• Bootstrap Windows desktop tickets through validated Python pipes (f8ba25a9)


• Submit Desktop images through canonical admissions (c93382c0)


• Preserve desktop busy correction intent on rejection (b3cca0f3)


• Keep canonical RPC refusals out of Desktop resume recovery (9ba2582b)


• Keep unbound Ink drafts instead of claiming memory-only admission (07588b5e)


• Honor non-idempotent canonical busy control acknowledgements (01e4829c)


• Stage clipboard images on the Ink client host (179a8473)


• Scope Ink config hydration and prompt model mutations (798c3926)


• Retain disconnected Ink input and canonical control receipts (1a5bae9b)


• Stage and retain canonical Ink image submissions (33622c04)


• Route Ink session controls through canonical authority (bf0b25a9)


• Preserve Kanban execution PID and durable worker outcomes (d4fd07d2)


• Route claimed Kanban tasks through trusted owner admission (5aeba055)


• Admit agent cron runs through the canonical owner (cdbe8c35)


• Forward A2A profile tasks through session authority (4e3a6bdb)


• Project ACP cancellation and failed admissions accurately (03c0efc8)


• Preserve API content identity history and terminal outcomes (f48d0956)


• Fence legacy history claims and follow Bot reset targets (f88f8615)


• Adopt legacy local history through trusted session owner (cb748e7a)


• Record physical admission assignment before later compression (7b9dc454)


• Classify managed worker errors and verify compression restart (4bbbb90f)


• Preserve worker compression admission identity (588c609c)


• Refresh worker row identities after compression (e19f05ff)


• Preserve managed transcript lineage and settle after worker finish (ec0ebf80)


• Cli): keep Termux startup hints out of gateway policy (31dc5078)


• Service suffix follows main profile-root rule; drop in-process cli.main tests (0ea5a879)


• Canonical delivery feeds attachment results to record_delivery; log failed turns (19ca1e85)


• Managed worker outbox directory is a portable spelling of the execution id (4a08032d)


• Owner verifies managed worker identity through interpreter trampolines (e8fbefb2)


• Refuse /v1/runs on a natively owned session with a bounded 409 (809fec15)


• Commit execution results with terminal settlement (43348a03)


• Replay canonical relay envelopes until terminal reply acknowledgement (8dfd7add)


• Keep bot relay discovery and outbox in sender profile (437e3d85)


• Isolate desktop bot relay sender and target profile routes (4f75b6aa)


• Recover bot mailbox receipts and migrate queued inputs at owner startup (76a60441)


• Recover bot replies from exact committed admission results (a5ea5b21)


• Retain identified desktop bot deliveries until settlement (e1734e7d)


• Pause managed admission followers when the owned worker is lost (e6077ecc)


• Prevent scoped secret rehydration in bypass workers (1ff3d877)


• Preserve hosted API source during peer persistence (06a9516c)


• Return explicit unknown execution on API crash retries (f26c5c43)


• Recover committed API queue when its adapter reconnects (8ef9fbe8)


• Resolve API prompts through canonical pending controls (f35358a6)


• Preserve pre-editor credential identity and native control coverage (8e3b3a0c)


• Defer editor MCP schema changes until a new session (be748101)


• Bind imported history control in its receipt transaction (f40dc17b)


• Prevent import from reusing retired runtime identities (0a55e373)


• Retire local physical lineage and cache affinity on deletion (a1d47945)


• Authorize cold history mutations without execution rebinding (529fb127)


• Retire native session routes with deletion receipts (10b155bf)


• Retire the legacy Bot mailbox producer and inference drain (ee09dad4)


• Retain immutable Bot relay reply receipts on exact retry (391517b7)


• Refuse Bot delivery instead of starting a competing runtime (03f5d843)


• Migrate worker rotation automation inside owner publication (6fce9f77)


• Bind registered worker ledger before agent discovery (56586998)


• Release original worker turn lease after rotation (ce8b1171)


• Preserve REST mutation success response shape (c1882a69)


• Require exclusive maintenance for legacy bulk session writes (7323773c)


• Fence persisted bot visibility without activating profiles (7fab399a)


• Retain dashboard mutation identity across uncertain replies (20dd6813)


• Prepare desktop session edits from owner snapshots (c01a625c)


• Preserve import validation with real authority fixtures (83b87b01)


• Reject coerced session mutation counters and flags (927ca964)


• Anchor V4A editor approval paths to session cwd (490453f7)


• List canonical ACP sessions under their frozen workspace (3c79ac4e)


• Resolve ACP edit previews against execution cwd (85ce5418)


• Project canonical editor diffs and frozen cwd to ACP (45aee742)


• Release ACP transport without client MCP discovery (92d97ba8)


• Steer API runs through the current authority claim (a69efa90)


• Fence API run cancellation to its durable admission (f67f19fb)


• Replay durable API results across HTTP delivery modes (cbcad6fb)


• Retain recoverable worker title conflicts as durable outcomes (b7d14c75)


• Preserve worker compression pre-publication flush annotations (dbe08962)


• Retain worker compression cleanup authority after rotation (36d5b639)


• Accept real worker compression handoff markers (e98a036a)


• Preserve live delegate tasks during parent deletion (b0f792ac)


• Fence ACP controls and expose the read-only catalog (d304b025)


• Keep ACP session catalog read-only (b117521c)


• Bind API storage to its selected runtime authority (c812ec71)


• Preserve webhook duplicate responses with real route admission fixtures (253f9b5e)


• Fence webhook finalization by admitted session and generation (ca2211f0)


• Durably admit authenticated Graph notifications before acknowledgement (e8e17493)


• Retain relay deliveries until canonical admission commits (e75bc52f)


• Acknowledge webhooks only after durable native admission (9d9e4789)


• Restore worker compressor guards before agent construction (84ccae21)


• Refuse unregistered child and cron persistence in compute workers (2ee0725c)


• Keep registered compute imports out of owner delegation recovery (7eecdcf2)


• Retain distinct repeated watch notices in local consumers (0c42619c)


• Refund legacy notification claims refused by admission (d5b332ed)


• Give watch events stable owner-bound automation identities (135730d1)


• Validate gateway launch options before first-run config checks (bec94623)


• Restore first-run guidance before gateway admission (351b8eb4)


• Retain partial-update diagnostics at canonical CLI launch (a6376f0e)


• Preserve runtime authority across updater snapshot restores (8a8a1372)


• Refuse unowned automation without spending sibling retry budgets (d6635ffe)


• Retain completion batch siblings across durable handoff retries (0307a33f)


• Keep named launch keys and endpoints separate from profile defaults (219ed58f)


• Redact and recover credential-bearing terminal projections (478d9b73)


• Resolve configured local routes from frozen provider policy (e02cc03a)


• Retain startup consent on top-level one-shot launches (ecb0afa6)


• Enforce startup cost and data consent before gateway admission (4dcf234d)


• Retry local creation without binding replacement credentials (12899b65)


• Recover frozen local config credentials from their profile source (f1da7833)


• Keep configured credentials out of frozen policy receipts (2f6fb46b)


• Keep explicit local launch keys in authority memory only (32d512fb)


• Freeze local CLI reasoning and execution launch options (d0954a9e)


• Preflight canonical epoch before restoring profile snapshot files (610a97ea)


• Retain explicit verified deletion after read-only export migration (23456236)


• Recover fresh and historical session row layouts by identity (9c681b2d)


• Explain safe transcript salvage when canonical restore is refused (c559236f)


• Preserve structured Unicode through worker payload and receipt encoding (f56e660e)


• Pause workers on outbox I/O failure and preserve local lease waits (23b54921)


• Freeze retry journals and retain exclusive worker outbox ownership (a8c163af)


• Attenuate worker reconnect tickets to execution operations (e7cd5f93)


• Install relay trust only after provenance verification (90f107f2)


• Keep relay reader live during canonical busy delivery (4485fb73)


• Admit relay inputs with verified connector provenance (8fe258cc)


• Keep retained process lineage lookup read-only (bf9cf5c2)


• Retain corruption restore for non-runtime SQLite stores (ad354c28)


• Preflight all restore destinations and preserve import warning parity (f1b4f6e3)


• Preserve runtime epoch floors across older backup restores (7fd8082e)


• Fence canonical recovery output and report excluded runtime state (43f62e7a)


• Exclude restore and import with canonical runtime ownership (4dce8f7e)


• Keep dashboard session browsing read-only (af4599c1)


• Preserve loop liveness witnesses for long gateway homes (ae92d198)


• Retain newer composer scope across delayed queue acknowledgements (4b39a5fd)


• Keep native steer fallback on canonical queue admission (35255f5c)


• Admit native busy slash kickoffs through canonical submit (6bef46ea)


• Reconcile queue input IDs with canonical admission identities (a877aa6e)


• Preserve active turn ownership during canonical queue admission (a131bf4a)


• Route native composer Queue through existing admission submit (4ce95d5f)


• Authenticate native desktop file downloads per attempt (28741ef8)


• Scope stable execution identity to canonical local sources (c3aa2e5c)


• Reject foreign local receipts inside lineage publication (1ffba2ac)


• Retain local admission ownership across transcript rotation (42ee0d34)


• Publish shared queue changes to attached viewers (fb02973f)


• Retain public queued input identity in shared snapshots (37332c17)


• Expose profile-bound setup readiness on canonical sessions (971c3c95)


• Normalize canonical prompts before named desktop listeners (9a2a30a6)


• Fence canonical desktop RPC metadata edits with revision receipts (ce3037dc)


• Bind desktop create retries to the explicit draft intent (c69bb4db)


• Retain desktop update and profile gates before canonical ensure (a7821f63)


• Adapt desktop native sessions to canonical identities and controls (d1546a54)


• Authenticate native desktop HTTP with fresh private tickets (dd8b9f38)


• Preserve native HTTP profile selectors across JSON contracts (eaad737e)


• Retain source-free authority control projections (3546eb41)


• Preflight durable local policy before claiming queued work (d98dd743)


• Publish canonical Ink readiness only after discovery (653889ef)


• Hydrate canonical Ink history independently of live events (971ff7f3)


• Carry native ticket through WebSocket subprotocol negotiation (7fe8c72c)


• Correlate canonical Ink receipts with prepared input identities (3dfb7d50)


• Scope one-shot output to its admitted turn and retain direct query aliases (17155e73)


• Preserve gateway toolset policy and reject resume source overrides (6feaafcc)


• Reject fresh session registration while gateway drains (a67637cc)


• Separate clarification permission from execution control (66bc2861)


• Stamp authenticated legacy clients before shared session admission (4be08ae5)


• Preserve scoped bootstrap grants in shared session connections (b699e0e9)


• Keep forged local profiles out of messaging authorization fallback (d379d6cc)


• Retain queued inputs when shutdown crosses authorization awaits (733dde1c)


• Reload transport role policy after Discord membership awaits (43ae9e9a)


• Retain native trust fields for validation when freezing ingress (53aadf44)


• Fence native authorization yields against identity and FIFO changes (6ef8b38d)


• Report malformed installed plists without leaking parser failures (1b55d964)


• Resolve installed names from the requested profile root (258049b3)


• Reject unbound launch wrappers and nonregular service definitions (1dd6268b)


• Preserve task XML encoding and document service binding refusals (7b904f95)


• Bind loaded launchd jobs and scheduled task XML before start (1ce0d11e)


• Verify effective systemd profile and account before ensure starts (efadac8d)


• Stop bootstrap background workers after listener failure (6716636f)


• Withdraw gateway readiness when the session listener exits (57ec2718)


• Keep readiness and cleanup fenced across runtime shutdown (82ff0592)


• Retain browser authentication and withdraw native ingress on drain (5da456be)


• Export sessions without mutating canonical storage (ae82c1a2)


• Keep native segment sentinels out of canonical text deltas (caae4af5)


• Keep launcher YOLO out of shared gateway policy (628d702c)


• Align profile reservations with bootstrap permissions (87ba34fd)


• Reject FIFO gateway metadata without blocking discovery (5b0f0276)


• Bind fresh ordinary admissions while preserving exact legacy retries (e5f39ada)


• Preserve ordinary native retry fingerprints through callback migration (6083e9ed)


• Refuse unrouted profile claims in native callback snapshots (99c923bc)


• Preserve authority ownership through scoped adapter callbacks (42ce26af)


• Retain trusted ordinary native callback provenance (1d4dab77)


• Omit retired approvals from gateway attach snapshots (e7ee1d67)


• Deny controls after gateway execution settlement (a064afdd)


• Reject approval publication from retired gateway workers (295bc0f5)


• Retain legacy session writers during reader migration (82dfb85d)


• Keep session lists and statistics read-only (1a1ad945)


• Resolve terminal breadcrumbs without opening a session writer (73238088)


• Share read-only insights reporting with interactive CLI (9cd5d6dd)


• Generate CLI insights without initializing session storage (680937a6)


• Keep resume lookup and TUI exit metadata read-only (617be2da)


• Keep status session inspection read-only (ca77b197)


• Bind shared authority when starting gateway API (11958d46)


• Refuse redirected native media publication (e924cf98)


• Preserve legacy native text admission retries (ca226b68)


• Rotate authority replay epoch on concurrent eviction (a9de35d2)


• Isolate authority execution from slow observers (aab36dc6)


• Keep authority subscriptions stable across repeated resume (8c889765)


• Admit busy messaging text into the canonical durable FIFO (eae6194b)


• Preserve surrogate request identity while sanitizing worker text (bb90f4b8)


• Replay committed worker receipts after terminal settlement (203b3f4f)


• Retain transcript closure guard for worker appends (71f835b6)


• Revoke workers when resolving unknown admissions (d7089f75)


• Align runtime mutation receipts with canonical wire contract (e6b1dc06)


• Fence ancestor revisions when runtime titles transfer (62aef795)


• Fence worker persistence when its admission settles (e3bfe640)


• Transfer admitted claims atomically during worker adoption (341aed41)


• Preserve legacy execution generations through admission import (c45d2e5c)


• Restore Ink pending inputs after cold durable resume (34fb13a1)


• Preserve Ink slash attachments and reconcile stale images (dbc7ffa8)


• Reconcile Ink replay receipts with current execution (8a589010)


• Settle desktop receipts on recovered runtime and tidy composed probes (1ad31afa)


• Retire desktop Stop for newer owner executions and fence old output (926d097d)


• Settle terminal desktop admission receipts without stopping live turns (d89a90e1)


• Fence same-call desktop legacy admission retries (41b017f1)


• Never resend ambiguous Ink legacy admissions (5681c7d4)


• Emit structured CLI parse failures only once (1d4d2b2d)


• Bound gateway probes and structure ensure parser errors (ad1099d6)


• Discover the gateway private fallback socket directory (c804d40b)


• Retain runtime locks while scheduler threads survive cleanup (954d5e99)


• Retain gateway ownership through exit-state persistence (d465ad0d)


• Reserve all gateway profiles before writable initialization (c941b0e6)


• Keep standalone session search read-only (0e7c0588)

📚 Documentation

• Agent): use the released model name Nemotron 3.5 Super VL (79651b71) — @j-nolan


• Env): add NVIDIA NIM to .env example (3dd96101) — @elisam0


• Providers): use a non-cloud example key for local NIM (da463310) — @rroverin


• Rollback section the downgrade refusals link to; regenerate the command-parity table (97ec76fa)


• Gateway): describe the messaging pause notice and /reset escape (6cdf7815)


• Explain ambiguous legacy A2A recovery boundary (22a8154f)


• Cli): classic chat resolves --resume <title> and -c <title> --create-if-missing at the gateway; bare -c stays refused (c6c4161c)


• Gateway): document prompt.submit attachments and the ACP media path (e3d60eed)


• Desktop): gateway-owned queue and the Discard control for a turn lost during restart (101be7d7)


• Explicit /model rewrites the system prompt Model line once (single cache-prefix miss) (ef813b35)


• /new rebinds only the invoking view of a shared session (6be1de8d)


• API runs and X-Hermes-Session-Id cannot bind a session owned by another surface (409 permission_denied) (789caca2)


• Dashboard session delete fences, tombstones, and offline-only bulk maintenance (46c50515)


• Explain canonical editor MCP ownership and cold reattachment (fcc978bd)


• Distinguish canonical Bot admission from retired UI ownership (2d22a7cd)


• Record worker lifecycle hooks proofs and remaining integration gates (3dae322e)


• Record isolated worker inference proof and remaining migration gates (b762d80c)


• Distinguish admission recovery from producer replay proof (bc3bcaff)


• Delimit verified worker substrate coverage and rollout blockers (f22754e8)


• Inventory exact worker persistence consumers before substrate (0e30eb6a)


• Define stable local lineage and paused fork recovery (757f19f4)


• Define native HTTP trust and primary-profile scope (a8a6b02c)


• Document local crash recovery contract and replay limits (375fce55)


• Describe settled Ink recovery and native lifecycle probes (2dc2e740)


• Define Desktop gateway ownership and private ticket boundary (f0ff6c57)


• Distinguish native policy proof from remaining classic CLI parity (256cab2b)


• Publish supported local creation policy and recovery boundary (0400a5ef)


• Explain gateway ensure readiness and service consent (a272e8df)

🧪 Tests

• Relay): the OpenAI-stream e2e no longer self-deadlocks when the stream is buffered (6e84ce66)


• Gateway): the authority stream probe waits for the idle session.info (56b9691c)


• Gateway): align SSE prepare cleanup with retained streams (c0230ca5) — @Lokee86


• Desktop-core): capture the Electron PID before quit for the orphan census message (2cf48e0c)


• Gateway): the unserve runner stub carries the reservation our release step shrinks (5fdb477b)


• Cold-profile archive/unarchive through one multiplexing gateway is an acceptance case (dfbb9142)


• Seed-compensation fake uses discard_unadmitted_session; hosted auth probe waits are load-tolerant (cc1eab12)


• Gateway): managed-worker first-inference wait tolerates a saturated 40-worker runner (57c95771)


• Tui): slash-attachment composer assertions wait for the journaled clear (d5950d72)


• Patch origin API probe in banner ancestry fixtures (cdf4eda7)


• Migrate authored bot fixtures to canonical transport (37d7834e)


• Verify webhook receipt observation and composed HTTP startup (a5a0da66)


• Exercise authenticated hosted room Stop and approval (7a6b2961)


• Use system Python for the stdlib-only ticket bridge (3394ef4c)


• Preserve Kanban policy and cron cleanup owner invariants (e1b6f10b)


• Align Kanban scope fixtures with owner worker client (ea2342d4)


• Observe relay completion and cron guard at owner seams (625bb379)


• Drain durable cron failure deliveries before asserting sends (9b753d3b)


• Migrate cron guards and context fixtures through owner execution (7080a488)


• Restore cron owner configuration and session invariants (c08349cf)


• Exercise cron provider and workdir paths through owner (9fde59d3)


• Migrate cron lifecycle invariants to canonical owner execution (e4a2d476)


• Retain queued input identity after session list loading (2671381d)


• Exercise native Electron gateway HTTP and WebSocket tickets (45c6c8de)


• Verify busy acknowledgements and document Ink recovery limits (59a90b4d)


• Cover canonical Ink image composer and startup handoff (65635634)


• Verify native legacy resume and compression cutover (90052b33)


• Prove admission-backed automatic compression retry (3ec0ea59)


• Gate the Discord role probe on the real distribution, not the conftest mock (19feada0)


• Acp): live editor image prompt reaches the loopback model as an image_url part (993a63f0)


• Native suite finds the managed worker by owner ancestry, not bare ppid (venv trampoline) (9e335738)


• Trampoline reap check waits for the owner's bounded close instead of racing the terminal commit (cc2cdbe2)


• Desktop): move the token download-transport invariant beside the extracted function (ff662b6b)


• Exercise safe identity suppression through real prompt assembly (cccb516c)


• Verify reserved admission claims through worker handlers (107af6fc)


• Isolate and reap owned Kanban systemd scopes (3776709d)


• Prove rotated worker survives owner kill and adoption (8459b140)


• Prove fresh ACP handoff and cold canonical restoration (56f62381)


• Verify per-admission API usage on the ordinary daemon (35d9eb2f)


• Prove shared API FIFO on the ordinary daemon (e721121f)


• Prove registered worker terminal execution without canonical SQLite opens (e31b96bc)


• Exercise worker lifecycle and stale callbacks through ordinary owner (5038cf75)


• Verify worker rotation claim and lost-ack replay over daemon (17cf264f)


• Verify native ACP approval and wrong-profile refusal (d157534a)


• Verify local automation stays nonhuman and cache stable (ef071dd3)


• Prove local completion recovery after owner kill (9afff7e9)


• Follow canonical CLI launch in startup guard fixtures (34b9aad1)


• State): keep FTS migration fixtures on historical versions (21baec51)


• Document recovery limits and verify consented gateway launches (ddc1b0a1)


• Refuse unauthenticated credential launch over ordinary daemon websocket (9b0d7861)


• Deny credential-bearing creation to restricted principals (2d2fdff9)


• Verify frozen CLI iteration limits through actual tool rounds (cc37de8b)


• Prove concurrent CLI launch wire and restart credential isolation (84e86a87)


• Own canonical daemon in completed-process CLI integration (6c8f0fd8)


• Keep simulated HEAD updates off the live runtime fleet (7b8fdfa8)


• Seed owner database for dashboard parameter validation (2af3bfd4)


• Initialize owner store for dashboard refresh success (a1811942)


• Isolate service ordering fixture home (3b42e697)


• Seed gateway status through real read-only storage (6af1ac81)


• Exercise CLI exports against real read-only session storage (96782704)


• Prove pending worker usage survives real owner outage and adoption (58bcc3ec)


• Verify live relay replacement and websocket revocation fences (89567476)


• Reject relay trust installation from an invalid seal (80d677d2)


• Reproduce relay busy ingress blocking outbound acknowledgements (73bf2c66)


• Reproduce authenticated relay native admission rejection (0bbe3740)


• Preserve destination lock identity after offline import (ef1fe3de)


• Verify separate-output recovery against active daemon source (cc96119b)


• Expose epoch reuse and service revival after refused import (dbb1e531)


• Reproduce live restore deleting active authority admissions (3a0111ee)


• Align search fixture with owner-initialized session stores (e2a853ba)


• Cover encoded socket limits with direct control paths (34407c9e)


• Reproduce missing loop witnesses in long-home daemons (36649795)


• Configure a restorable model for token session creation (bcf39bfb)


• Verify ordinary daemon replay and release fixture stores (e8f57b7f)


• Supply real session stores to gateway authority fixtures (e3d23087)


• Verify ordinary daemon slash actor isolation and handler scope (3cdf25cb)


• Verify native download boundaries and document transport scope (c8620011)


• Prove local rotation and reset across cold daemon restarts (af3f2dfe)


• Compare discovery on real legacy serve and canonical daemon sockets (5d1d1ee0)


• Reproduce missing canonical command discovery over ordinary daemon WS (659632c3)


• Scope private Unix ticket fixture to supported native hosts (ca3e4b64)


• Keep native protocol fixtures within their runtime type boundary (da98497c)


• Verify canonical receipts retire the native private-file journal (5bd5a8d6)


• Verify native HTTP selectors against real sibling profiles (f6ef1ea4)


• Prove cold local recovery through separate authenticated daemons (041d9ee7)


• Exercise native Stop through the Python Ink launcher (c75e0cdd)


• Verify native Ink Stop acknowledgement and fresh follow-up (d0ad8324)


• Exercise fresh Ink launch through the real Python launcher (8b727f4a)


• Verify actual native clarification answer on model wire (cc4ad0d1)


• Require native Ink reconnect to render settled history (eecaba42)


• Initialize replay fixture with explicit runtime admission state (014b3ea4)


• Retain native reconnect output for intermittent Ink failure (f454485d)


• Verify native CLI cwd execution against the policy-enabled daemon (db2bdf31)


• Prove native gateway approvals survive CLI detach and invalid choice (a0c361ae)


• Prove concurrent local policy isolation on provider wire (15052599)


• Verify metadata retries through ordinary gateway sockets (0d5d548f)


• Execute fresh sessions through ordinary gateway startup (ae19a6e0)


• Prove fresh local clarify survives complete viewer detachment (1044867b)


• Preserve Discord direct pairing and scoped DM grants (144c86c7)


• Retain startup exit contracts with real authority stores (a126b4cc)


• Verify excluded observer prefix against canonical replay (cacd4d22)


• Retain live gateway bootstrap readiness probe (29167522)


• Exercise shared approvals through production API startup (118b34ac)


• Verify native runtime ownership and execution-time secret refresh (234f1278)


• Exercise approval rendering through initialized turn runners (76efc227)


• Verify CLI readers alongside an active SQLite writer (ee23996c)


• Retain real CLI reader A/B harness (bcc03ee8)


• Preserve insights cleanup coverage with absent-store fast path (eae783bc)


• Exercise shared turns through production API startup (0cfe5a2f)


• Retain authority backpressure execution receipt (47ce83d6)


• Retain real-process read-only search A/B probe (551ccfca)


• Require complete shared gateway acceptance receipt coverage (d853d145)


• Retain gateway source invariants across sibling extractions (e1df5d12)


• Follow production methods across gateway turn extraction (04cef1e9)


• Reap truncation fixture worker before restoring bindings (d6d8af93)


• Trace borrowed SQLite readers in search projection invariant (fa572cbe)


• Verify runtime schema upgrades and genuine SQLite full rollback (1769e803)


• Reproduce Ink receipt-only retry busy latch (1c144c98)


• Reproduce desktop receipt stop and legacy timeout races (02e0ab74)


• Verify gateway service consent across import and setup (4ecf5975)


• Make unreserved profile snapshots explicit in multiplex fixtures (a72ed0a5)

🏗️ Infrastructure

• Release): admit stable releases from release/* branches, not just main (9686d55c) — @ethernet8023


• Plugins): pin birkin-mnemosyne to core 0.7.1 (e216cd74) — @ashmoonori-afk


• Catalog): review disclosure for huddo (85d27a51)


• Map contributor email for StudioCodeAI (c708b34f)


• Plugin-catalog): update Telegram Client to 1.3.1 (27aaade9) — @guberm


• Plugin-catalog): bump Gmail to v1.0.20 (c6ac0565) — @guberm


• Kiwi): bump pin to [email protected], plugin v1.2.2 (a08f5894) — @harrylabsj


• Lightningai-rate-limit to v1.1.0 (wall-clock aligned window) (e28d64e8) — @dinosauria123


• Map contributor email for TREE-Ind (71f78b3f)


• Catalog): review disclosure for hermes-aac (0567d017)


• Catalog): review disclosure for openinvest (c179b286)


• Map contributor email for Sahil-SS9 (d8b5bd8a)


• Catalog): review disclosure for hermes-agent-mixer (a98cc310)


• Update Activity catalog to v0.2.0 (908c525d) — @hassan-kamel


• Catalog): showly reviewed disclosure + requires_hermes >=0.21.6 (2ee820e7)


• Catalog): review disclosure for nexus (1a5f5c7b)


• Catalog): review disclosure for kumiho-memory (63da5f7b)


• Catalog): review disclosure for model-router (92790c6d)


• Catalog): review disclosures for anatomy-museum, agent-janitor (560b2507)


• Js): lint after the main merges: drop the unused watchdog import, order a test import, stub gw on the steer ctx (1b78a417)


• Retrigger CI (zero-job dispatch failure, auto-heal) (d056a624)


• Give area detection its sparse checkout and retry budget (8824ac96)


• Retrigger CI (zero-job dispatch failure, auto-heal) (2cbeac1f)


• Retrigger after 0-job workflow startup failure (254432b2)


• Retrigger (dispatch window) (1e398140)


• Retrigger (dispatch window) (40b17a25)


• Retrigger (dispatch window) (5e198b8b)


• Retrigger after 0-job workflow startup failure (f6dd9025)


• Retrigger after 0-job workflow startup failure (911b559e)


• Retrigger after 0-job workflow startup failure (4ff21ecd)


• Retrigger after 0-job workflow startup failure (c37453e7)


• Retrigger after 0-job workflow startup failure (cb296788)


• Retrigger after 0-job workflow startup failure (346615f3)


• Retrigger after 0-job workflow startup failure (1e4edefa)


• Retrigger after 0-job workflow startup failure (f3d4105f)


• Retrigger after 0-job workflow startup failure (73d9e413)


• Retrigger after 0-job workflow startup failure (c7fcc65c)


• Retrigger after 0-job workflow startup failure (4892e1d4)


• Retrigger after 0-job workflow startup failure (2cb84f43)


• Retrigger after lost push event (0 runs on 19ca1e8) (c86b415d)


• Trim native HTTP helper imports (25fd73b6)

📦 Other Changes

• Repin hermes-insight to afb08fb (1.0.2) (51e663da) — @BrokeSkill


• Plugin-catalog: bump huddo to 0.9.0 (eeacc00a) — @hellohanchen


• Plugin-catalog: re-pin hermes-lang-pt-br to 7548ff1 (pack verifier + CI) (82fbd41f) — @StudioCodeAI


• Plugin-catalog: re-pin hermes-lang-pt-br to 69efb2f (credits/timeline README) (2c20d9a3) — @StudioCodeAI


• Catalog: bump speechify to 0.1.1 (3a5b9e84) — @Lokeshm24


• Catalog: re-pin qdrant-memory to 0.2.1 (e14adc06) (720552bb) — @cnkang


• Catalog: repin Hermes AAC 0.1.1 SDK-only reduced features (473e2847) — @TREE-Ind


• Plugin-catalog: openinvest re-pin to 106e5ba (bounded backend deps, 0.41.6) (6cc9a434) — @longsizhuo


• Plugin-catalog: openinvest re-pin to 3a0c816 (review fixes, backend 0.41.4) (00c311c8) — @longsizhuo


• Plugin-catalog: openinvest re-pin to 3e1a9d7 (review fixes) (cb223633) — @longsizhuo


• Plugin-catalog: bump plan-mode to 0.4.4 (2a5617f8) — @100yenadmin


• Plugin-catalog: bump plan-mode to 0.4.3 (6fafdd4f) — @100yenadmin


• Catalog: pin the Showly community plugin (5da3156c) — @slchris


• Catalog(nexus): repin the sha to 4392e6d — /embed and /mcp demand a per-installation key (64425a06) — @Neboy72


• Plugin-catalog: bump account-pool to 4.0.2 (e5d2cebe) — @roqianjas


• Plugin-catalog: bump alans-way and alans-way-computer to 0.21.5 (a8d61e30) — @capthvnsen


• Plugin-catalog: nvidia-app + nvidia-broadcast pin -> 729e25c (first-run setup when the app side is not ready) (f18948e4) — @alt-glitch


• Catalog: agent-janitor (from #137875) (#137875) — @ZidoCode


• Catalog: anatomy-museum (from #138166) (#138166) — @danrudy33


• Catalog: secure-env-ingress (from #132272) (#132272) — @web3blind


• Style: align canonical group controls with Desktop lint rules (c8d8900d)


• Style: normalize verified queue admission imports and spacing (d3ad7a90)

👥 Contributors

Thank you to everyone who contributed to this release!

• @Lokee86 (11 commits)


• @dokterdok (6 commits)


• @elisam0 (5 commits)


• @longsizhuo (4 commits)


• @100yenadmin (3 commits)


• @StudioCodeAI (3 commits)


• @olric3015 (3 commits)


• @ethernet8023 (2 commits)


• @helix4u (2 commits)


• @guberm (2 commits)


• @TakeshiTGAL (2 commits)


• @dinosauria123 (2 commits)


• @TREE-Ind (2 commits)


• @Sahil-SS9 (2 commits)


• @hassan-kamel (2 commits)


• @slchris (2 commits)


• David Dudok de Wit (2 commits)


• @xxxigm (1 commit)


• @kshitijk4poor (1 commit)


• @j-nolan (1 commit)


• @rroverin (1 commit)


• @BrokeSkill (1 commit)


• @dandacompany (1 commit)


• @ashmoonori-afk (1 commit)


• @hellohanchen (1 commit)


• @2867297362mjb-sketch (1 commit)


• @Lokeshm24 (1 commit)


• @harrylabsj (1 commit)


• @cnkang (1 commit)


• @Neboy72 (1 commit)


• @kaveone (1 commit)


• @roqianjas (1 commit)


• @capthvnsen (1 commit)


• @alt-glitch (1 commit)


• @metamindedu (1 commit)


• @ZidoCode (1 commit)


• @danrudy33 (1 commit)


• @web3blind (1 commit)


• @KoNit-K (1 commit)


• @unsupportedpastels (1 commit)


• @abundantbeing (1 commit)


• @utkubakir (1 commit)

Full Changelog: v0.22.0...rc.5-v0.22.1