Issues

• [Bug]: kimi-coding static catalog carries 8 retired ids and omits k3-256k — and k3-256k's context_length resolves to the wrong 256,000

  area/compressioncomp/agentcomp/cliP2provider/kimitype/bug
  NousResearch/hermes-agent#138375 · Filter by author ltx15382710886-png opened on Oct 14, 2026

• 'Unknown toolsets: messaging, moa, rl' warning on every run from stale platform_toolsets.cli entries

  area/configcomp/cliduplicateP3sweeper:risk-compatibilitytype/bug
  NousResearch/hermes-agent#138374 · Filter by author RenegadeRocks opened on Oct 14, 2026

• execute_code session kernel: web_extract returns the previous call's page after one empty RPC reply

  P2tool/code-exectool/webtype/bug
  NousResearch/hermes-agent#138373 · Filter by author RenegadeRocks opened on Oct 14, 2026

• [Feature]: kanban context truncates each comment at 2,048 characters

  comp/cronP3type/feature
  NousResearch/hermes-agent#138372 · Filter by author martinukphd-art opened on Oct 14, 2026

• [Bug]: Idle /queue or /steer as a bare photo caption drops the photo and replies with usage

  comp/gatewayP2platform/telegramsweeper:risk-message-deliverytype/bug
  NousResearch/hermes-agent#138365 · Filter by author rodricksz4h5 opened on Oct 14, 2026

• [Security] gateway: weixin media redirects bypass SSRF/CDN allowlist; dynamic webhook subscriptions can self-grant script/cron/deliver

  comp/gatewayneeds-reproP2platform/webhooksweeper:risk-message-deliverysweeper:risk-security-boundarytype/security
  NousResearch/hermes-agent#138362 · Filter by author Ethan-Vex opened on Oct 14, 2026

• [Security] tts/stt command provider: placeholder escaping broken on Windows (cmd.exe injection) and resurrectable via adjacent backslash (sh injection, reproduced)

  P3platform/windowssweeper:risk-platform-windowstool/ttstype/security
  NousResearch/hermes-agent#138361 · Filter by author Ethan-Vex opened on Oct 14, 2026

• [Security] pm: lock.json sha256 not shape-validated -> path traversal to arbitrary rmtree (verified) + facts.json env injection + downloader loopback gate bypass

  area/install-updatecomp/clineeds-reproP2sweeper:risk-security-boundarytype/security
  NousResearch/hermes-agent#138359 · Filter by author Ethan-Vex opened on Oct 14, 2026
  2

• [Bug]: Telegram turn wedges before the agent starts: no timeout, no reply, later messages silently queued (80 min)

  area/sessionscomp/gatewayP1platform/telegramsweeper:risk-message-deliverysweeper:risk-session-statetype/bug
  NousResearch/hermes-agent#138358 · Filter by author wCELENw opened on Oct 14, 2026

• _carry_parent_timestamps is a no-op in both in-place compaction paths: the archive runs before its donor query, so carried copies drift to now_ts and one logical message renders twice

  area/compressionarea/sessionscomp/agentP2sweeper:risk-session-statetype/bug
  NousResearch/hermes-agent#138355 · Filter by author TheRedPandaz opened on Oct 14, 2026
  1

• Legacy dashboard spawn never registers shell hooks — declarative config.yaml hooks: silently inert for Desktop-hosted sessions (follow-up to the serve/cli fixes in #69825/#102681)

  area/configcomp/clicomp/dashboardcomp/desktopneeds-decisionP2sweeper:risk-compatibilitysweeper:risk-security-boundarytype/bug
  NousResearch/hermes-agent#138350 · Filter by author leevenstein opened on Oct 14, 2026

• Skills: fallback advice points to non-existent /skill <name>; skill-command cache ignores disk changes until restart

  comp/agentcomp/clicomp/tuiP3tool/skillstype/bug
  NousResearch/hermes-agent#138349 · Filter by author deadczarvc opened on Oct 14, 2026

• [Feature]: Bot Mode rooms — route unmentioned turns to a configured reader (opt-in, shipped default unchanged)

  comp/desktopP3type/feature
  NousResearch/hermes-agent#138347 · Filter by author YannLex opened on Oct 14, 2026

• [Feishu] Outbound @Name is plain text, so mention-gated bots can never be addressed — bot-to-bot group collaboration is deadlocked (3 open PRs since May)

  area/configcomp/pluginsP3platform/feishusweeper:risk-message-deliverytype/feature
  NousResearch/hermes-agent#138345 · Filter by author wyl1988 opened on Oct 14, 2026

• Gateway restart loop after unclean death + recycled pid strands cron; stale async-delegation delivery burns provider quota

  area/sessionscomp/croncomp/gatewayP0sweeper:risk-compatibilitysweeper:risk-message-deliverysweeper:risk-session-statetool/delegatetype/bug
  NousResearch/hermes-agent#138343 · Filter by author predatorheard-byte opened on Oct 14, 2026
  2

• [Bug]: delegate_task children sharing an Anthropic OAuth pool revoke each other's token on 401, then die at a refresh cap that never resets or rotates

  area/authcomp/agentP1provider/anthropicsweeper:risk-security-boundarytool/delegatetype/bug
  NousResearch/hermes-agent#138337 · Filter by author visa360-org opened on Oct 14, 2026

• [Bug]: CLI /history prints image turns as a Python list with the base64 data URL

  comp/cliP3type/bug
  NousResearch/hermes-agent#138330 · Filter by author rodricksz4h5 opened on Oct 14, 2026

• httpx2==2.12.0's 1 MiB per-SSE-event cap silently breaks MCP servers with a large tools/list (reported as "SSE stream ended without a response")

  comp/toolsP2tool/mcptype/bug
  NousResearch/hermes-agent#138329 · Filter by author nobody111333 opened on Oct 14, 2026

• auxiliary.title_generation: stage-2 model upgrade sends the MAIN model name to the aux provider (intermittent HTTP 400)

  comp/agentduplicateneeds-reproP3provider/noustype/bug
  NousResearch/hermes-agent#138326 · Filter by author QAQMMMMMAAAAA opened on Oct 14, 2026
  1

• Plugin deps are re-seeded from the previous generation's uv.lock and never advance - hindsight-embed stuck at 0.10.2, breaking the Hindsight daemon on Windows

  area/install-updatearea/memorycomp/pluginsP3platform/windowsPlugin Catalogpython:uvsweeper:risk-compatibilitysweeper:risk-platform-windowstool/memorytype/bug
  NousResearch/hermes-agent#138322 · Filter by author jam973 opened on Oct 14, 2026

• [Bug]: Dashboard browser login from loopback dead-ends with "Missing PKCE state cookie" when public_url is set

  area/authcomp/clicomp/dashboardP2sweeper:risk-security-boundarytype/bug
  NousResearch/hermes-agent#138321 · Filter by author xielevi opened on Oct 14, 2026
  1

• [Feature]: Purify resolveEditor() with an injected exists probe (last mixed-world seam)

  comp/tuiP3platform/windowssweeper:risk-platform-windowstype/refactor
  NousResearch/hermes-agent#138320 · Filter by author for13to1 opened on Oct 14, 2026

• [Bug]: memory patch answers "Patch is a no-op" when old_text matched through quote/dash/whitespace folding

  area/memoryP2tool/memorytype/bug
  NousResearch/hermes-agent#138317 · Filter by author rodricksz4h5 opened on Oct 14, 2026

• [Feature]: Desktop: surface cross-profile delegated work in the conversation’s task/status area

  area/profilescomp/desktopneeds-decisionP3tool/delegatetype/feature
  NousResearch/hermes-agent#138313 · Filter by author jeremyhiggs opened on Oct 14, 2026

• Bug: native MCP client's docker-command servers (mcp_servers) leak orphaned containers across process restarts

  P2tool/mcptype/bug
  NousResearch/hermes-agent#138312 · Filter by author Arvingrep opened on Oct 14, 2026