Hermes Agent v0.21.0

Fork release automatically built on merge of #36 into main.

Hermes Agent version: v0.21.0
Upstream release: v2026.8.31

Tracks upstream base v2026.8.31. See docs/site/ for the fork's
image guide, versioning scheme, and how this fork stays current with
NousResearch/hermes-agent.

Docker

# Full supervised server image (dashboard + gateways):
docker pull ghcr.io/forgeguard-ai/hermes-agent:runtime-v0.21.0
# Lean CLI / distrobox image:
docker pull ghcr.io/forgeguard-ai/hermes-agent:cli-v0.21.0
# Rolling tag: runtime-latest

Important

Remote deployments need an auth provider as of v2026.7.1. Upstream's
June-2026 hardening means a gateway bound to a non-loopback address (the
container binds 0.0.0.0) now refuses to start unless an auth provider
is configured — HERMES_DASHBOARD_INSECURE / --insecure and static-token
mode no longer open a public dashboard. Set one of:

• Password: HERMES_DASHBOARD_BASIC_AUTH_USERNAME + HERMES_DASHBOARD_BASIC_AUTH_PASSWORD
• OAuth: HERMES_DASHBOARD_OAUTH_CLIENT_ID

If the desktop client can't reach an upgraded deployment, check the container
log for Refusing to bind dashboard to 0.0.0.0 — that means no provider is
set. The desktop connection dialog signs in against either provider.

Note

Upstream 0.20.x changes (first fork release on this base: v0.20.2).
Upstream retired the Homebrew and pip/PyPI install channels in 0.20.0 —
supported paths are the shell installer, Docker, and Nix. The toolchain
is pinned to Node 26 across upstream installers; the fork's images
and desktop installers already bundle it, so only source installs need
to act.

Desktop installers

Linux (.AppImage, .deb, .rpm), macOS (.dmg, .zip) and Windows
(-setup.exe installer, -portable.exe) installers are attached below. None
is signed with a paid certificate (no Apple Developer or Windows code-signing
credentials on this fork); the macOS build is ad-hoc signed, the Windows
builds are unsigned.

Linux: no extra step.

Windows: SmartScreen shows "Windows protected your PC" on first launch of
an unsigned binary — click More info → Run anyway. The -setup.exe installs
per-user (no administrator prompt); the -portable.exe runs from wherever it is
saved. x64 only.

macOS: because the app isn't notarized, Gatekeeper quarantines it on
download and shows "Hermes is damaged and can't be opened" — right-click →
Open does not clear this. After copying Hermes.app to /Applications, strip
the quarantine flag once:

xattr -cr /Applications/Hermes.app

Then open it normally. (Alternatively, download the .zip with
curl -L -o hermes.zip <asset-url> — a curl download never sets the
quarantine attribute, so no xattr step is needed.)

Hermes Agent v0.20.8

Fork release automatically built on merge of #33 into main.

Hermes Agent version: v0.20.8
Upstream release: v2026.8.16.2

Tracks upstream base v2026.8.16.2. See docs/site/ for the fork's
image guide, versioning scheme, and how this fork stays current with
NousResearch/hermes-agent.

Docker

# Full supervised server image (dashboard + gateways):
docker pull ghcr.io/forgeguard-ai/hermes-agent:runtime-v0.20.8
# Lean CLI / distrobox image:
docker pull ghcr.io/forgeguard-ai/hermes-agent:cli-v0.20.8
# Rolling tags: runtime-latest / cli-latest

Important

Remote deployments need an auth provider as of v2026.7.1. Upstream's
June-2026 hardening means a gateway bound to a non-loopback address (the
container binds 0.0.0.0) now refuses to start unless an auth provider
is configured — HERMES_DASHBOARD_INSECURE / --insecure and static-token
mode no longer open a public dashboard. Set one of:

• Password: HERMES_DASHBOARD_BASIC_AUTH_USERNAME + HERMES_DASHBOARD_BASIC_AUTH_PASSWORD
• OAuth: HERMES_DASHBOARD_OAUTH_CLIENT_ID

If the desktop client can't reach an upgraded deployment, check the container
log for Refusing to bind dashboard to 0.0.0.0 — that means no provider is
set. The desktop connection dialog signs in against either provider.

Note

Upstream 0.20.x changes (first fork release on this base: v0.20.2).
Upstream retired the Homebrew and pip/PyPI install channels in 0.20.0 —
supported paths are the shell installer, Docker, and Nix. The toolchain
is pinned to Node 26 across upstream installers; the fork's images
and desktop installers already bundle it, so only source installs need
to act.

Desktop installers

Linux (.AppImage, .deb, .rpm), macOS (.dmg, .zip) and Windows
(-setup.exe installer, -portable.exe) installers are attached below. None
is signed with a paid certificate (no Apple Developer or Windows code-signing
credentials on this fork); the macOS build is ad-hoc signed, the Windows
builds are unsigned.

Linux: no extra step.

Windows: SmartScreen shows "Windows protected your PC" on first launch of
an unsigned binary — click More info → Run anyway. The -setup.exe installs
per-user (no administrator prompt); the -portable.exe runs from wherever it is
saved. x64 only.

macOS: because the app isn't notarized, Gatekeeper quarantines it on
download and shows "Hermes is damaged and can't be opened" — right-click →
Open does not clear this. After copying Hermes.app to /Applications, strip
the quarantine flag once:

xattr -cr /Applications/Hermes.app

Then open it normally. (Alternatively, download the .zip with
curl -L -o hermes.zip <asset-url> — a curl download never sets the
quarantine attribute, so no xattr step is needed.)