v2026.4.3

✨ New Features

• Pluggable Memory Provider Interface: Memory is now an extensible plugin system, allowing third-party memory backends to be implemented and registered. Built-in memory remains the default.
• Same-Provider Credential Pools: Configure multiple API keys for the same provider with automatic rotation based on load and 401 failures. This can be set up via the setup wizard or `credential_pool` config.
• Camofox Anti-Detection Browser Backend: A new local browser backend using Camoufox for stealth browsing, featuring persistent sessions, VNC URL discovery, configurable SSRF bypass, and auto-installation via `hermes tools`.
• Inline Diff Previews: File write and patch operations now display inline diffs in the tool activity feed for visual confirmation before agent actions.
• API Server Session Continuity & Tool Streaming: The API server now streams tool progress events in real-time and supports `X-Hermes-Session-Id` headers for persistent sessions across requests, with sessions persisting to the shared SessionDB.
• ACP: Client-Provided MCP Servers: Editor integrations (VS Code, Zed, JetBrains) can now register their own MCP servers, which Hermes will recognize as additional agent tools.
• Gateway Hardening: Significant stability improvements across race conditions, photo media delivery, flood control, stuck sessions, approval routing, and compression death spirals, leading to a more reliable gateway in production.
• Security: Secret Exfiltration Blocking: Browser URLs and LLM responses are scanned for secret patterns to block exfiltration attempts. Credential directory protections are expanded, and `execute_code` sandbox output is redacted.
• Per-turn primary runtime restoration: After using a fallback provider, the agent automatically restores the primary provider on the next turn with transport recovery.
• `developer` role for GPT-5 and Codex models: Utilizes OpenAI's recommended system message role for newer models.
• Google model operational guidance: Provides provider-specific prompting guidance for Gemini and Gemma models.
• Anthropic long-context tier 429 handling: Automatically reduces context to 200k when hitting tier limits for Anthropic models.
• URL-based auth for third-party Anthropic endpoints.
• Bearer auth for MiniMax Anthropic endpoints.
• Fireworks context length detection.
• Standard DashScope international endpoint for Alibaba provider.
• Custom providers context_length honored in hygiene compression.
• Non-sk-ant keys treated as regular API keys, not OAuth tokens.
• Claude-sonnet-4.6 added to OpenRouter and Nous model lists.
• Qwen 3.6 Plus Preview added to model lists.
• MiniMax M2.7 added to hermes model picker and OpenCode.
• Auto-detect models from server probe in custom endpoint setup.
• Config.yaml single source of truth for endpoint URLs, eliminating env var vs config.yaml conflicts.
• Setup wizard no longer overwrites custom endpoint config.
• Unified setup wizard provider selection with `hermes model` for a single code path.
• Rate-limit pairing rejection messages to prevent spam.
• Preserve Anthropic thinking block signatures across tool-use turns.
• Classify think-only empty responses before retrying to prevent infinite retry loops.
• Prevent compression death spiral from API disconnects.