Hermes v2026.5.29 - 更新日志

# Hermes Agent v0.15.1 (v2026.5.29) **发布日期：** 2026年5月29日 **自 v0.15.0 以来的变更：** 28 次提交 · 21 个合并的 PR · 热修复版本 · 9 位贡献者 > **补丁版本。** 针对 v0.15.0 的当天热修复。重点修复：在回环模式（Docker、托管的 Hermes、全新安装）下，任何运行 v0.15.0 的用户都会遇到的仪表板无限重新加载循环。此外还附带了一些 v0.15.0 的其他后续修复——看板工作进程 SIGTERM、`/model` 选择器统一、`/yolo` 会话绕过、完整的 19,932 条 skills.sh 目录、`.md` 媒体投递恢复、网关探测降级安全性、Web URL 脱敏直通、看板工作进程对引用图像的视觉支持、事后观察默认值。Docker 用户获得一个显式的 `--insecure` 可选的 env 变量（不再推断绑定主机），MCP 服务器裸命令 PATH 解析，以及 arm64 PR 构建缓存修复。 --- ## ✨ 亮点 - **修复仪表板 401 重新加载循环**——在回环模式下，仪表板的身份探测（`/api/auth/me`）默认返回 401，但 v0.15.0 的过期令牌重新加载保护会将每次 401 视为轮换的会话令牌，并进行整页重新加载以获取新的令牌。每次成功的同级调用会清除一次性重新加载保护，因此页面会无限重新加载循环（Firefox：出现“Navigated to /sessions”风暴；Chrome：React 重新渲染风暴）。修复方案为 `fetchJSON` 添加了一个 `allowUnauthorized` 选项，仅跳过回环模式下的过期令牌重新加载——401 仍会抛出异常，因此 `AuthWidget` 会吞掉它，门控模式下的 `login_url` 重定向不受影响。关闭 [#34206](https://github.com/NousResearch/hermes-agent/issues/34206)、[#34202](https://github.com/NousResearch/hermes-agent/issues/34202)。([#30698](https://github.com/NousResearch/hermes-agent/pull/30698) — @austinpickett) - **Docker 仪表板的 `--insecure` 现在是一个显式的环境变量可选选项，不再从绑定主机推断**——以前，当仪表板绑定到非回环主机时，Docker 入口点会推断 `--insecure`。这混淆了“我想要 LAN 访问”与“我想要禁用同源保护”。修复方案将它们分开：绑定主机就是绑定主机，禁用仪表板的回环认证需要显式设置 `HERMES_DASHBOARD_INSECURE=1`。原本真正想要不安全绑定的现有设置现在必须设置该环境变量。([#34188](https://github.com/NousResearch/hermes-agent/pull/34188)、[#34204](https://github.com/NousResearch/hermes-agent/pull/34204) — @benbarclay) - **MCP 裸命令在 Docker 下的解析**——配置了裸命令（`npx`、`npm`、`node`）的 MCP 服务器现在会针对 `/usr/local/bin` 进行解析，以便它们能够在 Docker 镜像内部实际启动（这些二进制文件所在的位置）。v0.15.0 在容器的有效 PATH 不包含 Node 工具链位置时，会让这些命令静默失败。([#34186](https://github.com/NousResearch/hermes-agent/pull/34186) — @benbarclay) - **技能页面侧边栏/来源标签恢复**——新仪表板技能页面中的一个过时的 `useMemo` 依赖关系导致来源标签和类别侧边栏仅显示“全部”。已修复；两个界面现在都反映实时的目录状态。([#34194](https://github.com/NousResearch/hermes-agent/pull/34194)) - **看板工作进程可以再次被终止**——看板工作进程上的 `SIGTERM` 被中间进程吸收，导致工作进程继续运行。关闭 [#28181](https://github.com/NousResearch/hermes-agent/issues/28181)。([#34045](https://github.com/NousResearch/hermes-agent/pull/34045)) - **完整的 skills.sh 目录（858 → 19,932 条）**——技能中心页面之前只拉取了一个分页的局部目录。现在获取会遍历站点地图，因此所有 19,932 条 skills.sh 条目都会出现在选择器中，而不仅仅是前 858 条。([#34025](https://github.com/NousResearch/hermes-agent/pull/34025)) --- ## 🐛 错误修复 ### 仪表板/Web - **`/api/auth/me` 返回 401 不再触发回环模式下的重新加载循环**——([#30698](https://github.com/NousResearch/hermes-agent/pull/30698) — @austinpickett) - **技能页面来源标签 + 类别侧边栏恢复**——过时的 `useMemo` 依赖 ([#34194](https://github.com/NousResearch/hermes-agent/pull/34194)) ### Docker - **`--insecure` 现在通过环境变量显式可选，不再从绑定主机推断** ([#34188](https://github.com/NousResearch/hermes-agent/pull/34188) — @benbarclay) - **仪表板测试套件已修复**，以匹配不安全可选的修复 ([#34204](https://github.com/NousResearch/hermes-agent/pull/34204) — @benbarclay) - **arm64 PR 构建跳过 GHA 缓存**，以避免跨架构构建器上的缓存抖动 ([#33704](https://github.com/NousResearch/hermes-agent/pull/33704) — @BROCCOLO1D) ### MCP - **裸命令 `npx`/`npm`/`node` 针对 `/usr/local/bin` 解析**，以实现 Docker 兼容性 ([#34186](https://github.com/NousResearch/hermes-agent/pull/34186) — @benbarclay) ### 看板 - **工作进程 SIGTERM 实际终止进程** ([#34045](https://github.com/NousResearch/hermes-agent/pull/34045)) - **工作进程接收任务正文中引用的图像**，用于支持视觉的模型 ([#34210](https://github.com/NousResearch/hermes-agent/pull/34210)) ### 网关 - **`.md` 文件再次投递**——媒体投递验证现在默认仅使用拒绝列表，而不是过于狭窄的允许列表 ([#34022](https://github.com/NousResearch/hermes-agent/pull/34022)) - **探测降级安全性**——在上下文溢出且没有显式提供者上下文限制的情况下，代理不再基于未知上限降级到较小的模型（来自 [#33673](https://github.com/NousResearch/hermes-agent/pull/33673) 的挽救）([#33826](https://github.com/NousResearch/hermes-agent/pull/33826)) ### CLI - **`/yolo` 在会话中启用每会话绕过**，而不仅仅是切换环境变量（运行中的代理已经快照了该变量）([#33931](https://github.com/NousResearch/hermes-agent/pull/33931) — @kshitijk4poor) - **`/model` 和 `hermes model` 显示相同的列表**，并增加了选择器启动的磁盘缓存 ([#33867](https://github.com/NousResearch/hermes-agent/pull/33867)) ### 技能 - **通过站点地图获取完整的 skills.sh 目录**——858 → 19,932 条 ([#34025](https://github.com/NousResearch/hermes-agent/pull/34025)) ### 脱敏 - **Web URL 原样通过**——脱敏器之前吞掉了看起来像凭证形状的查询参数 ([#34029](https://github.com/NousResearch/hermes-agent/pull/34029)) --- ## ✨ 小功能 - **事后默认值收窄为仅观察**，用于 `recall_types`——工具路径也收窄了 ([#34079](https://github.com/NousResearch/hermes-agent/pull/34079) — @nicoloboschi，后续 [#34091](https://github.com/NousResearch/hermes-agent/pull/4df62d239e38bf8c212a595721c9c01e176f6c3a) — @kshitijk4poor) - **记忆提供者接收完成轮次的消息上下文**——来自 [#28065](https://github.com/NousResearch/hermes-agent/pull/28065) 的挽救 ([#34097](https://github.com/NousResearch/hermes-agent/pull/34097) — @kshitijk4poor，感谢 @devwdave) --- ## 📚 文档 - **文档中添加了 `--no-supervise` / `HERMES_GATEWAY_NO_SUPERVISE` 的说明**（来自 [#33583](https://github.com/NousResearch/hermes-agent/pull/33583) 的后续）([#33751](https://github.com/NousResearch/hermes-agent/pull/33751) — @r266-tech) --- ## 🛠️ 基础设施 - **Vercel 部署工作流接受 `workflow_dispatch`**，因此文档部署可以手动触发 ([#34081](https://github.com/NousResearch/hermes-agent/pull/34081)) - **`@nous-research/ui` 升级到 0.18.2**（Nix `npmDepsHash` 也相应更新）([#34193](https://github.com/NousResearch/hermes-agent/pull/34193) 后续 — @austinpickett) --- ## 👥 贡献者 ### 核心 - @teknium1 ### 社区 - @austinpickett —— 仪表板 401 重新加载循环修复（重点）、`@nous-research/ui` 升级、Nix `npmDepsHash` 更新 - @benbarclay —— Docker `--insecure` 可选、MCP 裸命令解析、仪表板测试修复 - @kshitijk4poor —— `/yolo` 会话绕过、完成轮次记忆上下文挽救、事后文档后续 - @nicoloboschi —— 事后 `recall_types` 观察默认值 - @BROCCOLO1D —— arm64 PR 构建缓存修复 - @r266-tech —— `--no-supervise` 参考文档 - @yangguangjin —— 探测降级安全性（来自 @yanghd 的 #33673 的挽救） - @devwdave —— 完成轮次记忆上下文（通过挽救致谢） - @andrewhosf —— 合著者 ### 问题报告者（401 循环） - @routesmith ([#34206](https://github.com/NousResearch/hermes-agent/issues/34206)) - @beeaton ([#34202](https://github.com/NousResearch/hermes-agent/issues/34202)) --- **完整更新日志：** [v2026.5.28...v2026.5.29](https://github.com/NousResearch/hermes-agent/compare/v2026.5.28...v2026.5.29)

# Hermes Agent v0.15.1 (v2026.5.29) **Release Date:** May 29, 2026 **Since v0.15.0:** 28 commits · 21 merged PRs · hotfix release · 9 contributors > **The Patch Release.** A same-day hotfix for v0.15.0. Headline fix: the dashboard infinite-reload loop that hit anyone running v0.15.0 in loopback mode (Docker, hosted Hermes, fresh installs). A handful of other v0.15.0 follow-ups go along for the ride — kanban worker SIGTERM, `/model` picker unification, `/yolo` session bypass, the full 19,932-entry skills.sh catalog, `.md` media delivery restoration, gateway probe-stepdown safety, web-URL redaction passthrough, kanban worker vision on referenced images, hindsight observation-default. Docker users get an explicit `--insecure` opt-in env var (no more bind-host inference), MCP server bare-command PATH resolution, and arm64 PR-build cache fixes. --- ## ✨ Highlights - **Dashboard 401 reload loop fixed** — In loopback mode the dashboard's identity probe (`/api/auth/me`) returns 401 by design, but v0.15.0's stale-token reload guard treated every 401 as a rotated session token and full-page-reloaded to pick up a fresh one. Every successful sibling call cleared the one-shot reload guard, so the page reload-looped forever (Firefox: "Navigated to /sessions" storm; Chrome: React re-render storm). Fix adds an `allowUnauthorized` opt-out to `fetchJSON` that skips only the loopback stale-token reload — 401 still throws so `AuthWidget` swallows it, gated-mode `login_url` redirects are unaffected. Closes [#34206](https://github.com/NousResearch/hermes-agent/issues/34206), [#34202](https://github.com/NousResearch/hermes-agent/issues/34202). ([#30698](https://github.com/NousResearch/hermes-agent/pull/30698) — @austinpickett) - **Docker dashboard `--insecure` is now an explicit env opt-in, never derived from bind host** — Previously the Docker entrypoint inferred `--insecure` when the dashboard bound to a non-loopback host. That conflated "I want LAN access" with "I want to disable the same-origin guard." The fix splits them: bind host is bind host, and disabling the dashboard's loopback auth requires an explicit `HERMES_DASHBOARD_INSECURE=1`. Existing setups that genuinely wanted insecure binding must now set the env var. ([#34188](https://github.com/NousResearch/hermes-agent/pull/34188), [#34204](https://github.com/NousResearch/hermes-agent/pull/34204) — @benbarclay) - **MCP bare command resolution under Docker** — MCP servers configured with bare commands (`npx`, `npm`, `node`) now resolve against `/usr/local/bin` so they actually launch inside the Docker image where those binaries live. v0.15.0 left these failing silently in containers when the agent's effective PATH didn't include the Node toolchain location. ([#34186](https://github.com/NousResearch/hermes-agent/pull/34186) — @benbarclay) - **Skills page sidebar / source pills restored** — A stale `useMemo` dependency in the new dashboard skills page collapsed the source pills and category sidebar to "All" only. Fixed; both surfaces now reflect the live catalog state. ([#34194](https://github.com/NousResearch/hermes-agent/pull/34194)) - **Kanban worker can be killed again** — `SIGTERM` on a kanban worker was being absorbed by an intermediate process and the worker stayed running. Closes [#28181](https://github.com/NousResearch/hermes-agent/issues/28181). ([#34045](https://github.com/NousResearch/hermes-agent/pull/34045)) - **Full skills.sh catalog (858 → 19,932 entries)** — The skills hub page was pulling a partial paginated catalog. The fetch now walks the sitemap, so all 19,932 skills.sh entries surface in the picker instead of just the first 858. ([#34025](https://github.com/NousResearch/hermes-agent/pull/34025)) --- ## 🐛 Bug Fixes ### Dashboard / Web - **`/api/auth/me` 401 no longer triggers reload loop** in loopback mode — ([#30698](https://github.com/NousResearch/hermes-agent/pull/30698) — @austinpickett) - **Skills page source pills + category sidebar restored** — stale `useMemo` dep ([#34194](https://github.com/NousResearch/hermes-agent/pull/34194)) ### Docker - **`--insecure` is now explicit opt-in via env var**, not derived from bind host ([#34188](https://github.com/NousResearch/hermes-agent/pull/34188) — @benbarclay) - **Dashboard test suite repaired** to match the insecure-opt-in fix ([#34204](https://github.com/NousResearch/hermes-agent/pull/34204) — @benbarclay) - **arm64 PR builds skip the GHA cache** to avoid cache-thrash on cross-arch builders ([#33704](https://github.com/NousResearch/hermes-agent/pull/33704) — @BROCCOLO1D) ### MCP - **Bare `npx`/`npm`/`node` resolve against `/usr/local/bin`** for Docker compatibility ([#34186](https://github.com/NousResearch/hermes-agent/pull/34186) — @benbarclay) ### Kanban - **Worker SIGTERM actually terminates the process** ([#34045](https://github.com/NousResearch/hermes-agent/pull/34045)) - **Workers receive images referenced in task bodies** for vision-capable models ([#34210](https://github.com/NousResearch/hermes-agent/pull/34210)) ### Gateway - **`.md` files deliver again** — media-delivery validation defaults to denylist-only instead of an overly-narrow allowlist ([#34022](https://github.com/NousResearch/hermes-agent/pull/34022)) - **Probe stepdown safety** — on a context-overflow without an explicit provider context limit, the agent no longer steps down to a smaller model based on an unknown ceiling (salvage of [#33673](https://github.com/NousResearch/hermes-agent/pull/33673)) ([#33826](https://github.com/NousResearch/hermes-agent/pull/33826)) ### CLI - **`/yolo` mid-session enables the per-session bypass** instead of just toggling the env var (which the running agent had already snapshotted) ([#33931](https://github.com/NousResearch/hermes-agent/pull/33931) — @kshitijk4poor) - **`/model` and `hermes model` show the same list**, plus disk cache for picker startup ([#33867](https://github.com/NousResearch/hermes-agent/pull/33867)) ### Skills - **Full skills.sh catalog via sitemap** — 858 → 19,932 entries ([#34025](https://github.com/NousResearch/hermes-agent/pull/34025)) ### Redaction - **Web URLs pass through unchanged** — the redactor was eating query parameters that looked credential-shaped ([#34029](https://github.com/NousResearch/hermes-agent/pull/34029)) --- ## ✨ Small Features - **Hindsight default narrowed to observation-only** for `recall_types` — tool path is also narrowed ([#34079](https://github.com/NousResearch/hermes-agent/pull/34079) — @nicoloboschi, follow-up [#34091](https://github.com/NousResearch/hermes-agent/pull/4df62d239e38bf8c212a595721c9c01e176f6c3a) — @kshitijk4poor) - **Memory providers receive completed-turn message context** — salvage of [#28065](https://github.com/NousResearch/hermes-agent/pull/28065) ([#34097](https://github.com/NousResearch/hermes-agent/pull/34097) — @kshitijk4poor, credit to @devwdave) --- ## 📚 Documentation - **`--no-supervise` / `HERMES_GATEWAY_NO_SUPERVISE` documented** in the reference docs (follow-up to [#33583](https://github.com/NousResearch/hermes-agent/pull/33583)) ([#33751](https://github.com/NousResearch/hermes-agent/pull/33751) — @r266-tech) --- ## 🛠️ Infrastructure - **Vercel deploy workflow accepts `workflow_dispatch`** so docs deploys can be manually triggered ([#34081](https://github.com/NousResearch/hermes-agent/pull/34081)) - **`@nous-research/ui` bumped to 0.18.2** (Nix `npmDepsHash` also updated to match) ([#34193](https://github.com/NousResearch/hermes-agent/pull/34193) follow-ups — @austinpickett) --- ## 👥 Contributors ### Core - @teknium1 ### Community - @austinpickett — dashboard 401 reload-loop fix (the headline), `@nous-research/ui` bump, Nix `npmDepsHash` updates - @benbarclay — Docker `--insecure` opt-in, MCP bare-command resolution, dashboard test repair - @kshitijk4poor — `/yolo` session bypass, completed-turn memory context salvage, hindsight follow-up docs - @nicoloboschi — hindsight `recall_types` observation default - @BROCCOLO1D — arm64 PR build cache fix - @r266-tech — `--no-supervise` reference docs - @yangguangjin — probe stepdown safety (salvage of @yanghd's #33673) - @devwdave — completed-turn memory context (credited via salvage) - @andrewhosf — co-author ### Issue Reporters (the 401 loop) - @routesmith ([#34206](https://github.com/NousResearch/hermes-agent/issues/34206)) - @beeaton ([#34202](https://github.com/NousResearch/hermes-agent/issues/34202)) --- **Full Changelog**: [v2026.5.28...v2026.5.29](https://github.com/NousResearch/hermes-agent/compare/v2026.5.28...v2026.5.29)