v2026.09.12

Verified against Hermes 0.21.2 (hermes-agent 284d220ba4), 1221 commits on from the previous stamp.

Fixed: Hermes 0.21.2 put session automation controls (goal / loop / heartbeat) into the same composer status stack as the stock Tasks widget. Task Dock's unanchored Tasks N/M scan could match prose inside those controls — a loop until clause, a goal criterion — hide them, and publish a dock built from that sentence. Task Dock now anchors its header match, skips the app's own status-stack widgets, and refuses to hide anything inside or containing one.

Also: pl-0.5 no longer exists in the app's compiled stylesheet (swapped for px-0.5, same geometry), and the docs still described the old per-profile desktop-plugin root.

curl -fsSL https://raw.githubusercontent.com/thomasbek3/hermes-bot-kit/v2026.09.12/install.sh | bash

v2026.09.07.2

Per-agent Orgo screen pinning in the orgo-computer plugin (config screen, env ORGO_SCREEN, or hermes orgo-computer set --screen) plus a hands hygiene rule in the computer-basics skill. See CHANGELOG.md.

v2026.09.07.1

Three-reviewer hardening round (Claude, Codex GPT-6 Astra, Grok 4.6). See CHANGELOG.md. Key: vendored noVNC now really loads and fails closed if tampered; RSA server-key pinning; HD token as an in-band auth frame; ownership-safe HD agent; digest-checked agent download; pinned Windows installers; theme-aware bubbles; every suite in CI.

curl -fsSL https://raw.githubusercontent.com/thomasbek3/hermes-bot-kit/v2026.09.07.1/install.sh | bash

v2026.09.07

Fix: the viewer now loads the vendored noVNC bundle from computer-viewer/vendor/, where the installer places it. v2026.09.06 installs silently fell through to the CDN because the plugin looked one folder up. Reinstall with the one-liner to pick it up:

curl -fsSL https://raw.githubusercontent.com/thomasbek3/hermes-bot-kit/v2026.09.07/install.sh | bash

v2026.09.06

First pinned release. Install one-liners now fetch from this tag and verify every file against MANIFEST.sha256 at this tag.

curl -fsSL https://raw.githubusercontent.com/thomasbek3/hermes-bot-kit/v2026.09.06/install.sh | bash

Verify from a checkout at this tag: shasum -a 256 -c MANIFEST.sha256.

Highlights (see CHANGELOG.md):

• Security fixes for issues #6, #7, #8, #9 (origin-bound API keys, Tailscale/loopback binds, sandboxed iframe, key out of argv).
• Pinned + verified installer with rollback, CI on ubuntu and macOS (#10).
• noVNC vendored and SHA-256-checked before load; CDN only as fallback (#5).
• Verified against Hermes Desktop v0.20.6 and a 2026-09-05 main build.