Hermes Agent July 2026: MoA Cost Tracking, Security Hardening, and Gateway Reliability

Hermes Agent · Monthly highlights · 2026-07-01 → 2026-07-31 This is a highlights report based on 200 representative commits from a total of 3,975 commits during this period. It does not claim exhaustive coverage.

Who Should Care

• Anyone running Claude on non-OpenRouter proxies — the max_tokens fallback is now model-gated, not URL-gated.
• MoA users — advisor token usage and cost are finally tracked; full-turn tracing is now opt-in.
• Gateway operators — streaming silence markers no longer leak into chat; stale /restart loops are guarded; Telegram thread IDs are normalized correctly.
• Security-conscious deployments — debug uploads require explicit consent; approval prompts redact secrets; unverified senders are tagged in Slack threads.
• Desktop app users — dropped folders attach as @folder refs instead of failing.

🔐 Security & Access Control

Secrets redacted from approval prompts

Approval prompts shown to users (and forwarded to Discord/Slack) now redact credentials such as Authorization: Bearer sk-... and database connection strings. The raw command still executes after approval; allowlisting is unaffected.

Commit: 4a7a6fd — fix(approval): redact secrets in user-facing approval prompts

Slack thread injection mitigation

Unverified senders in Slack threads are now tagged with an [unverified] prefix when their replies are fetched for context. This mitigates indirect prompt injection via shared channels.

Commit: 0198713 — fix(security): reuse auth chain when tagging unverified senders in Slack threads

Debug upload consent gate

hermes debug share now requires an interactive [y/N] confirmation before uploading. The --yes flag skips it; non-TTY contexts refuse outright (exit 1).

Commit: 54f32af — fix(security): require explicit consent before uploading debug logs

Cron-deny Tirith coverage

The cron-deny path now also runs Tirith content-level checks (homograph URLs, pipe-to-interpreter, terminal injection), and honours the tirith_fail_open setting.

Commits: 56d4bfe, c50f517

GNU long-flag abbreviation bypass fixed

chown --recurs and git push --forc can no longer evade the approval gate. Switched to prefix matching for these entries.

Commit: 0f66995

🧮 Mixture-of-Agents (MoA)

Advisor token usage and cost tracking

MoA now accounts for every reference model's token usage and cost. Session totals, state.db, and /insights reflect the full fan-out spend, priced per-advisor at the correct model rate.

Commit: 3bdb23d — fix(moa): count reference (advisor) fan-out token usage + cost

Opt-in full-turn trace persistence

When moa.save_traces is enabled, every MoA turn appends a JSON line to a trace file capturing each advisor's exact input/output/cost and the aggregator's full input with guidance block. Off by default; no overhead when disabled.

Commit: 2e8748e — feat(moa): opt-in full-turn trace persistence to JSONL

Provider identity cleanup

_slot_runtime no longer maintains a fragile hand-listed whitelist of providers that must keep their identity. The single chokepoint _resolve_task_provider_model now decides identity preservation, eliminating the drift that caused Anthropic OAuth and Bedrock MoA slots to fail.

Commit: a653bb0 — refactor(moa): unify slot provider-identity on the single call_llm chokepoint

🚪 Gateway & Platform Adapters

Streaming silence markers suppressed

NO_REPLY and [SILENT] control markers no longer leak into chat on the streaming delivery path. The stream consumer now defers edits while the buffer is a partial marker, and retracts any preview on stream end.

Commit: 5f7deeba — fix(gateway): suppress NO_REPLY/[SILENT] markers on the streaming path

Stale /restart loop guard

When .restart_last_processed.json goes missing, a 60-second post-boot window prevents the same /restart command from restarting the gateway repeatedly.

Commit: cdd5539 — fix(gateway): guard stale /restart redelivery when dedup marker is missing

Telegram thread ID normalization

Group gating and event routing now use a shared helper to normalize thread IDs, preventing forum reply anchors from being misidentified as topics.

Commit: cc1e4c3 — fix(telegram): normalize thread id in group gating via shared helper

Discord auto-thread failure — no silent fallback

When auto_thread is enabled and thread creation fails, the gateway now posts a visible notice instead of silently replying inline.

Commit: 50a7dce — fix(discord): auto-thread failure must not silently fall back to inline reply

Telegram buffered delivery cleanup on disconnect

Cancels pending text/photo/media-group flushes on disconnect, preventing stale deliveries into a torn-down session.

Commit: 8ad15ff

Feishu channel prompts wired in

Per-channel role prompts now work in the Feishu adapter, matching Discord/Slack behaviour.

Commit: 36bfe3a

Relay adapter D-Q2.5c cleanup

Platform-specific "guild" terminology removed from the relay adapter's wire format (guild_id → scope_id). Deploy-order-safe with the connector.

Commit: 729bbb7

Matrix E2EE for text-only sends

Text-only Matrix messages now route through the mautrix adapter, encrypting them in E2EE rooms.

Commit: a537baa

🖥 CLI & TUI

MCP reload no longer freezes input

The 30-second join on MCP reload is removed, preventing the CLI from freezing input consumption while waiting for an MCP server.

Commit: 972aa33 — fix(cli): prevent process_loop freeze from MCP reload join and voice flag leak

Background review thread no longer silences other threads

stdout/stderr silencing is now scoped to the review thread, preventing concurrent threads (e.g., a Telegram long-poll) from writing to devnull during the review window.

Commit: b526767 — fix(bg-review): scope stdout/stderr silencing to the worker thread

Interrupt queue drained after finished turns

Input typed while the agent is running is now drained into pending input after a natural turn end, preventing the "hung" CLI where subsequent Enter presses go nowhere.

Commit: c1a0c0a — fix(cli): re-land interrupt_queue drain so finished turns flush stray input

Exec quick command sanitisation

The process environment is sanitised and output is redacted when running type: exec quick commands, preventing credential leakage.

Commit: c8e5f99

Debug upload enhancements

• --nous flag for uploading to Nous-internal S3 (private, 14-day TTL, OAuth-gated viewer)
• Support for /debug [nous|local] in the TUI slash command
• Dead confirm_upload() step removed (stateless NAS contract)

Commits: 51eeb70, 98d550e, 89653db

🎨 Desktop App

Dropped folders attach as @folder refs

Dragging a folder from Explorer/Finder no longer fails with "file not found on gateway". Directories are detected via webkitGetAsEntry() and routed to the folder ref path.

Commit: a488fcf — fix(desktop): detect dropped folders so they attach as @folder refs

TUI busy-flag race fixed

Under busy_input_mode: queue, sending two messages back-to-back no longer hangs the session. The busy flag is now set synchronously before the detect_drop RPC round-trip.

Commit: e71f9ad

🧠 Compressor

Turn-pair preservation during compaction

Prevents orphaned user messages after compaction by ensuring compaction boundaries never split a user → assistant → tool_results turn-pair. Fixes re-execution of already-completed tasks.

Commit: fc2fac7 — fix(compressor): prevent orphan user turn after compaction via turn-pair preservation

🧪 Testing & Quality

• Credential pool: regression tests for Anthropic env auth-type classification & OAuth token prefix matching (508156f, 18966b6)
• Slack: native Block Kit table blocks with column alignment, limits, and monospace fallback (7c7b489, b080b93)
• Approval: dedicated TestApprovalPromptRedaction and Tirith fail-open regression tests
• MoA slot-survives-resolution: reconciled with Anthropic name-preserve behaviour

📝 Documentation

• Slack Block Kit: docstrings updated to reflect native table blocks (88c9dfe)
• Prompt caching toggle: reverted pending re-evaluation (8d78be5)

🏷 Misc

• AUTHOR_MAP entries added for PR #17082 salvage, #54609, #54912, and #22523 salvage

This issue covers highlights from 200 commit summaries out of 3,975 total commits in July 2026. For the full changelog, visit the Hermes Agent repository.