release aidev BREAKING SIG 3/5

Hermes Agent v0.5.0: /model slash command removed, Hugging Face provider, supply chain audit

The /model slash command is removed from both CLI and gateway in favour of the hermes model subcommand — an interactive workflow break. Also adds Hugging Face as a first-class provider, drops the compromised litellm dependency, and replaces the hardcoded 16K Anthropic output cap with per-model native limits.

PUBLISHED2026-03-28
OBSERVED2026-08-11
AGE4mo
SOURCES1
  • Breaking: /model slash command removed from CLI and gateway; use the hermes model subcommand instead
  • Hugging Face Inference API as a first-class provider: auth, setup wizard, curated agentic model picker mapped to OpenRouter analogues, live /models probe (skipped for providers with 8+ curated models)
  • Nous Portal expanded to 400+ models through a single provider endpoint
  • Anthropic output limits: per-model native caps (128K Opus 4.6, 64K Sonnet 4.6) replace a hardcoded 16K max_tokens, fixing truncated responses and thinking-budget exhaustion on the direct API; useless continuation retries now skipped when reasoning consumes all output tokens
  • Supply chain: compromised litellm dependency removed, dependency version ranges pinned, uv.lock regenerated with hashes, CI workflow scanning PRs for supply-chain attack patterns, CVE bumps
  • Telegram Private Chat Topics with per-topic skill binding for isolated project workflows
  • Native Modal SDK backend replaces the swe-rex dependency, eliminating tunnels
  • Plugin lifecycle hooks now fire: pre_llm_call, post_llm_call, on_session_start, on_session_end
  • GPT_TOOL_USE_GUIDANCE stops GPT models describing intended actions instead of calling tools; stale budget warnings stripped from history
  • Nix flake with uv2nix build and a NixOS module with persistent container mode
  • Provider fixes: custom provider no longer remapped to openrouter, Alibaba default endpoint corrected, MiniMax /v1→/anthropic auto-correction overridable, OAuth token refresh migrated to platform.claude.com
  • Retry, fallback, and compression lifecycle events now surface to the user
breakingdeprecationfeaturesecuritymodel-supportfix

COMMUNITY

No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.