Hermes Agent
Hermes drafts workspace trust and a project verifier
Hermes Agent has three fresh proposals for local project operation: a realpath-keyed workspace trust store that can only tighten approvals, a personal AGENTS.override.md context layer, and a hermes verify command that detects recipes, runs build/tests, polls readiness and tears the process down.
NousResearch/hermes-agent PR #80685 is the inspected primary source: “Port from superagent-ai/grok-cli: per-workspace trust store (untrusted → manual approvals, tighten-only).” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- NousResearch/hermes-agent PR #80685 was created 2026-08-07T01:00:58Z and was open at inspection; its title is “Port from superagent-ai/grok-cli: per-workspace trust store (untrusted → manual approvals, tighten-only).” - NousResearch/hermes-agent PR #80682 was created 2026-08-07T00:56:47Z and was open at inspection; its title is “feat: support AGENTS.override.md personal context override (port of pi#7681).” - NousResearch/hermes-agent PR #80686 was created 2026-08-07T01:01:29Z and was open at inspection; its title is “Port from superagent-ai/grok-cli: verify subsystem (run-recipe detection + environment manifest + hermes verify smoke runner).” - The repository reported 226598 stars, 29109 open issues, default branch main, and last push 2026-08-07T01:00:56Z. - The latest tagged-release baseline checked was v2026.8.3 published 2026-08-03T16:57:52Z.
What changed
NousResearch/hermes-agent PR #80685 reports: Ports grok-cli's per-workspace trust store to Hermes: workspaces get a persisted trusted/untrusted decision keyed by the realpath of their git root, and sessions in an untrusted workspace have their approval mode forced to manual — a tighten-only posture that can never weaken the configured mode. Source being ported: superagent-ai/grok-cli — src/utils/workspace-trust.ts Changes **hermes_cli/workspace_trust.py** (new): versioned JSON store at get_hermes_home()/workspace-trust.json — schema {version: 1, workspaces: {: {trusted, decidedAt}}}, written atomically with 0600 perms, tolerant loader that drops malformed entries and survives corrupt files (grok-cli parity). Keys are os.path.realpath of the workspace **root** (enclosing git repo root when inside one, else the directory — same _find_git_root pattern as agent/prompt_builder.py). Session-only decisions (remember=False) stay in-process and are never persisted. **tools/approval.py**: one-way _UNTRUSTED_WORKSPACE_LATCH + enforce_untrusted_workspace(). Once armed, _get_approval_mode() returns manual for the rest of the process regardless of configured mode. There is deliberately no clear API — it
NousResearch/hermes-agent PR #80682 reports: Summary AGENTS.override.md now overrides AGENTS.md as project context — keep a personal, typically-gitignored override next to committed project instructions without editing the tracked file. Port of earendil-works/pi#7681, adapted to Hermes' two context-loading paths. Changes agent/prompt_builder.py: _load_agents_md() checks AGENTS.override.md first (startup project context;.hermes.md still wins overall) agent/subdirectory_hints.py: AGENTS.override.md added at the top of _HINT_FILENAMES (progressive subdirectory discovery, first-match-wins per directory) website/docs/user-guide/features/context-files.md: priority table + override explanation Tests: 4 new prompt_builder cases + 1 subdirectory-hints case Validation | | Result | |---|---| | tests/agent/test_subdirectory_hints.py + test_prompt_builder.py | 85 passed | Infographic AGENTS.override.md priority
NousResearch/hermes-agent PR #80686 reports: Ports a scoped version of grok-cli's verify subsystem to Hermes: static run-recipe detection, a user-editable environment manifest, and a hermes verify CLI smoke runner that builds, tests, starts, and readiness-polls a project end-to-end. Following the AGENTS.md footprint ladder, this lands as a **CLI command** — zero model-tool footprint. Changes **agent/verify/recipes.py** — static detectors ported nearly 1:1 from grok's recipes.ts, mirroring its detection order and command choices: Node frameworks (Next.js, SvelteKit, Astro, Remix, CRA, Vite, generic) with lockfile-based package-manager selection (pnpm-lock.yaml → pnpm, bun.lock/bun.lockb → bun, yarn.lock → yarn, else npm), Python (manage.py/deps → Django, fastapi/uvicorn → FastAPI, flask → Flask, generic w/ uv/poetry/pipenv/pyproject awareness), Go (go.mod), Rust (Cargo.toml), Java (pom.xml → Maven, build.gradle(.kts) → Gradle w/ wrapper detection), Makefile target parsing, docker-compose. Produces a Recipe(name, kind, bootstrap[], build[], test[], start, port, readiness_path) dataclass with a tolerant from_dict normalizer (accepts grok-style keys too). Ports grok's --port/PORT=
Why it matters
Together these patches turn a checkout into an explicit trust and verification unit rather than assuming every directory deserves the same authority. The current trust prompt remains opt-in and is not yet wired across every interface. The operator test is whether authority, persisted state and the visible outcome still describe the same event after retries, restarts or delegation.
Current
The primary record was open when captured on 2026-08-07. The release baseline was v2026.8.3 published 2026-08-03T16:57:52Z. Repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/NousResearch/hermes-agent/pull/80685. Supporting records are https://github.com/NousResearch/hermes-agent/pull/80682 and https://github.com/NousResearch/hermes-agent/pull/80686. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Keep trust decisions tighten-only, review override files as executable context, and require saved verification recipes to remain operator-editable and bounded. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.