Hermes Agent
Hermes narrows the owners of Desktop windows, journals and vaults
Hermes patches three process-boundary leaks: popout windows could attach to the primary profile, aggregate journal writes could block the renderer, and vault tokens could reach argv or inherited environments. The proposals bind each surface to a smaller owner and failure domain.
NousResearch/hermes-agent PR #82794 is the inspected primary source: “fix(desktop): route session windows to their owning profile.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- NousResearch/hermes-agent PR #82794 was created 2026-08-09T23:16:55Z and was open at inspection; its title is “fix(desktop): route session windows to their owning profile.” - NousResearch/hermes-agent PR #82832 was created 2026-08-10T00:40:24Z and was open at inspection; its title is “fix(desktop): bound inflight journal persistence (#63047).” - NousResearch/hermes-agent PR #82829 was created 2026-08-10T00:31:09Z and was open at inspection; its title is “fix(secrets): keep vault tokens out of CLI process surfaces (#77468).” - The repository reported 227938 stars, 30159 open issues, default branch main, and last push 2026-08-10T00:50:38Z. - The latest tagged-release baseline checked was v2026.8.3 published 2026-08-03T16:57:52Z.
What changed
NousResearch/hermes-agent PR #82794 reports: Summary Fix Desktop session popouts that open against the primary backend instead of the profile that owns the routed session. This fixes the blank subagent watch window reported in #82768 and the ordinary cross-profile popout variant tracked by #61286. Root cause A session popout URL carried the session ID and optional watch flag, but not the owning profile. Each auxiliary renderer therefore adopted the primary Desktop backend before route resume. When the target session existed only in another profile, the first lookup returned 404 and the watch window reset to an empty draft. Watch windows hide the composer and auxiliary empty state, so the body appeared blank even though the renderer and gateway were healthy. Two follow-up routing gaps could still lose ownership. The raw primary backend descriptor omitted its effective named profile, and a new child watch could resume before its first stored row existed. On a shared remote backend, that missing row left session.resume without the profile needed to select the owning database. Changes resolve the parent transcript profile once for both subagent
NousResearch/hermes-agent PR #82832 reports: Summary Replace synchronous aggregate v1 localStorage journal rewrites with bounded per-session snapshots. Migrate legacy state once, isolate quota/storage failures, retain recoverable matching and tool completion state, and avoid oversized writes blocking renderer streaming. Add focused journal regressions and a real Electron/CDP macOS-arm64 diagnostic harness with native hide/restore, renderer heartbeat, Settings, composer, and transcript checks. Scope This is the narrow journal hot-path fix for #63047. It deliberately excludes the broader diagnostics stack and does not include.circleci/config.yml; the harness can be run locally on macOS arm64 using the command documented in the source package scripts. Validation Baseline focused regression: 1 failure, 16 passing. Focused journal tests: 33 passing. Full desktop suite: 4,646 passing, 2 skipped. Desktop typecheck, ESLint, Prettier, Node syntax, and diff checks passed. macOS arm64 A/B harness: baseline and candidate each completed 3/3 measured runs without a hard reproduction; candidate remained responsive through native hide/restore and interactive-surface checks. The harness uses real Electron/CDP and Hermes UI/backend flow; only model inference is a local deterministic HTTP stream. Local macOS arm64 run Fixes #63047 Related #80872
NousResearch/hermes-agent PR #82829 reports: Summary Keep vault tokens out of argv, inherited child environments, stale dotenv precedence, and provider-controlled diagnostics. Use masked compatibility prompts, explicit provider environment allowlists, bounded dotenv traversal, and fail-closed ANSI/control redaction. Validate malformed token environment names before persistence or subprocess launch, with updated Bitwarden and 1Password guidance. Test plan Focused secret-source and CLI suites passed in a current-main merge replay. Ruff, Python compilation, diff checks, deterministic redaction fuzzing, and saturated private-use probes passed. The full repository suite remains outside this bounded change because the local environment lacks unrelated optional dependencies. Fixes #77468
Why it matters
Multi-profile software fails when a process-wide convenience silently outranks session ownership. Storage hot paths and secret launch paths are the same class of problem: ambient state crossing a narrower boundary. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-10. The tagged-release baseline was v2026.8.3 published 2026-08-03T16:57:52Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/NousResearch/hermes-agent/pull/82794. Supporting records are https://github.com/NousResearch/hermes-agent/pull/82832 and https://github.com/NousResearch/hermes-agent/pull/82829. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Key windows and journals by owning profile, isolate storage failures per session, and pass only explicitly allowed secret environment names to child processes. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.