Update Hermes to v0.20.4 with dashboard authentication

[Ns2Kracy]

Summary

• Update Hermes Agent from v2026.6.5 (0.16.0) to v2026.8.18 (0.20.4).
• Replace the obsolete HERMES_DASHBOARD_INSECURE setting with the bundled Basic Auth provider.
• Set bootstrap dashboard credentials to zimaos / hermes.
• Expose the username and password as editable CasaOS/ZimaOS app environment fields.
• Add the default credentials and the instruction to change them to every existing localized installation tip.
• Refresh the localized release notes and upstream release links.

Why this is required

Hermes hardened dashboard access on non-loopback addresses. HERMES_DASHBOARD_INSECURE=1 no longer disables the authentication gate.

CasaOS/ZimaOS exposes the dashboard on 0.0.0.0:9119. Hermes v2026.8.18 refuses to bind that address unless an authentication provider is registered. With the old environment, the dashboard exits with messages such as:

HERMES_DASHBOARD_INSECURE no longer disables the auth gate.
Refusing to bind dashboard to 0.0.0.0 — no auth providers are registered.

Because the app uses restart: unless-stopped, the container can enter a restart loop.

Upstream behavior:
https://github.com/NousResearch/hermes-agent/blob/v2026.8.18/docker/s6-rc.d/dashboard/run

Release:
https://github.com/NousResearch/hermes-agent/releases/tag/v2026.8.18

Important upgrade limitation

The current CasaOS/ZimaOS app upgrade flow updates the container image but does not merge changed environment variables from the new store manifest into an existing installation.

An existing Hermes installation can therefore keep:

HERMES_DASHBOARD_INSECURE: 1

while missing:

HERMES_DASHBOARD_BASIC_AUTH_USERNAME: zimaos
HERMES_DASHBOARD_BASIC_AUTH_PASSWORD: hermes

After the image upgrades, the old variable is ignored and the new image has no authentication provider. The dashboard then refuses to start. The defaults added by this PR apply to new installations, reinstalls, and deployments where the environment is recreated from the updated manifest. They are not guaranteed to reach an existing installation through an image-only upgrade.

Existing users must update the app environment and recreate the container:

1. Remove HERMES_DASHBOARD_INSECURE.
2. Add HERMES_DASHBOARD_BASIC_AUTH_USERNAME and HERMES_DASHBOARD_BASIC_AUTH_PASSWORD.
3. Use zimaos / hermes for the bootstrap login, or set custom credentials.
4. Restart or recreate the app.
5. Change the public default password in the app settings before exposing the dashboard outside a trusted network.

Hermes reads these credentials at startup. After signing in, users can change the dashboard credentials in the Hermes WebUI.

Security note

zimaos / hermes is a public bootstrap credential. It keeps fresh installations deployable after the upstream authentication change, but it must not be treated as a secure long-term password.

This PR remains a draft because the image-only upgrade path still needs a migration or user-facing intervention for existing installations.

Validation

• CasaOS compose validator: 1 file checked, 0 failures, 0 errors, 0 warnings.
• docker compose -f Apps/Hermes/docker-compose.yml config -q: passed.
• Exact metadata and authentication assertions: passed.
• All 15 localized installation tips contain the bootstrap credentials and change instructions.
• git diff --check: passed.
• Docker image tag resolution for nousresearch/hermes-agent:v2026.8.18: passed.
• Full local startup probe remains pending because the Docker Hub image pull did not complete within the local execution timeout.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	zimaos-appstore-dev-docs	a4ebee1	Commit Preview URL Branch Preview URL	Aug 20 2026, 09:14 AM

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE