Changelog — August 21, 2026

Start with the deletions you get to make. Four beta headers stop being required in one window: files-api-2025-04-14, skills-2025-10-02, ce-user-management-2026-07-13, and the computer use tool's beta header. In every case, requests that keep sending the header continue to work unchanged — so nothing breaks on the day you do nothing. But two of these change the response you get when you drop the header, and that is the part to read before you delete anything.

The Files API's GA response format is different from its beta one. Requests to /v1/files sent without the beta header get the GA shape: file expiration (set expires_in_seconds on upload; file objects report expires_at) and page/next_page pagination plus an ids[] filter on list. Requests that still send the header keep the previous format. That is a clean migration path, but it means removing the header is a behavior change, not a no-op — if you parse the list response, parse it again before you strip the header. And note the new default worth thinking about: files can now expire, which is a storage-hygiene feature and also a way to lose a file you assumed was permanent.

Agent Skills going GA is the item with the widest blast radius for readers of this site. Skills and the Skills API at /v1/skills no longer need skills-2025-10-02 — including Messages API requests that load Skills through the container parameter. Skills stopped being a preview feature you hedge about and became a supported part of the platform. If you have been holding a Skills-based architecture at arm's length because it sat behind a beta flag, that objection is gone. Our OpenClaw and Claude Cowork skills guides both need this reflected.

The computer use tool's GA is a rewrite, not a promotion. It is now the computer_toolset_20260801 toolset, with batch actions (several actions in one turn), zoom enabled by default, and per-member configuration through configs. Earlier beta versions remain available, and Anthropic is explicit that upgrading an existing integration changes the request shape and tool handling — there is a dedicated migration note from computer_20251124. Batch actions are the interesting half: an agent that can click, type and screenshot in one turn pays for far fewer round trips than one that must return to the model between each.

The genuinely new capability is the browser use tool (browser_toolset_20260801). It is a client toolset — your application hosts the browser — and it works inside a browser viewport rather than a whole desktop. The distinction that matters: it reads the page itself (accessibility tree, elements, forms, tabs) instead of inferring structure from pixels, and adds element references, form input, tab management, download reporting and opt-in file upload on top of screenshot-and-click. Anyone who has built browser automation on screenshots alone knows the failure mode this removes — a click computed from a stale screenshot lands on whatever moved into that coordinate. Both toolsets are available on Claude Fable 5, Claude Mythos 5, Claude Opus 5, Claude Sonnet 5 and Claude Opus 4.8.

Three Managed Agents changes, one of which is a security control. You can now restrict which sites a Managed Agents agent's web_search and web_fetch tools can reach, via allowed_domains or blocked_domains on the tool's entry in the agent_toolset_20260401 configs array; web_fetch also takes max_content_tokens and web_search takes user_location. An allowlist on what an autonomous agent may fetch is the single most useful lever against prompt injection delivered through fetched content, and it is worth turning on even if you cannot enumerate every domain — a blocklist of known-hostile or known-irrelevant hosts still shrinks the surface. Existing requests that pass only name, enabled and permission_policy continue to work. Separately, sessions in a self-hosted sandbox can now attach memory stores, which the Python, TypeScript and Go SDK workers download into the sandbox at each store's mount_path and sync back. And the Console session viewer was redesigned with a timeline minimap, a transcript grouped by model request, and an Inspector panel covering session cost, raw events, per-tool statistics, mounted resources and per-thread activity.

No new models, no pricing changes, no deprecations in this window. Our cost calculator figures are unaffected. The most recent pricing movement remains Sonnet 5's introductory $2/$10 becoming permanent on August 10.

Release notes → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/skills-guide/, /claude-cowork/skills-database/, /openclaw/skills-guide/, /security/

The fix with the broadest reach is a memory leak. v2.1.238 fixes unbounded memory growth in long interactive sessions: subagent tool results are now released once they leave the recent display window. Read the mechanism, because it tells you who was affected. Results from subagents were being retained for display and never freed, so the cost scaled with how many subagents you ran, not with how much context was live. A long session that fans out repeatedly — the exact pattern this site recommends for parallel work — was the worst case. If you have had a multi-hour session get progressively sluggish and eventually need restarting, this is the likely reason, and it is now fixed rather than worked around.

The security-shaped change is headersHelper, and it arrived with its guardrails attached. Plugin marketplaces gain headersHelper on a url marketplace or a catalog entry: a command that mints HTTP headers — a short-lived token, say — for catalog and same-origin archive fetches. That is a genuinely useful feature for anyone hosting an authenticated internal marketplace, and it is also, plainly, a config file that can make your machine run a command. Three constraints ship with it, and all three are the right ones. First, a catalog entry's headersHelper runs only when you install or update that plugin, after its command is shown, and claude plugin install/update ask [y/N] (or take -y) — so the command is disclosed before it runs, not after. Second, MCP headersHelper in a project .mcp.json, and inline MCP servers in project or --add-dir agent files, now require that folder's trust dialog to have been accepted, including under claude -p. Cloning a repository is no longer enough to get a command executed on your behalf. Third — and this is the subtle one — headersHelper from a project .mcp.json, a plugin, or an agent file runs without inherited credential environment variables, while user, managed and claude.ai-scope helpers run from the Claude config dir. A helper whose job is to mint a credential does not get handed your existing ones. That is the correct default and an unusually thoughtful one; if you build anything that shells out to a user-supplied command, it is the pattern to copy.

The macOS sandbox got a real hardening fix in v2.1.236. Wildcard read-deny rules — **/.env and the like — now take precedence inside allowed read regions, cover matched directories' contents, and cannot be bypassed by renaming the denied file. Each of those three clauses was a hole. A deny rule that lost to an overlapping allow rule was advisory at best; a deny rule that stopped at a directory boundary missed everything inside it; and a deny rule you could defeat by mv .env env.bak was not a control at all. If you rely on read-deny rules to keep secrets out of a session on macOS, audit what those rules actually blocked before v2.1.236 — the answer may be less than you assumed.

Two new settings worth knowing. ANTHROPIC_DEFAULT_MODEL sets the model new sessions start on, while a /model pick still overrides it and persists across restarts — the distinction from ANTHROPIC_MODEL, which wins unconditionally, is the whole point. Use it when you want a house default that a person can still override for the session in front of them. And keybindingFlavor set to "readline" makes Ctrl+W delete back to the previous whitespace, as in Bash; the "classic" default is unchanged. Small, but if your fingers come from a shell, that key has been deleting the wrong amount of text for a long time.

Cross-session messaging stops failing silently. Two fixes with the same shape: sending to a session that refuses inbound messages (crossSessionInbound: "refuse") now reports "refused" to the sender instead of a silent success, and a session whose inbox drops your messages — rate limit or full queue — now tells your session instead of the messages vanishing. Both were the worst kind of distributed-systems bug: the send returned successfully and the message was never delivered, so the sending agent proceeded on a false belief. v2.1.236 also adds notify_when_idle to cross-session SendMessage: ask another session on this machine to send one notice when it next goes idle — opt-in, one-shot, no polling, on macOS and Linux. That is the primitive you want instead of a sleep loop.

v2.1.237 is two lines and one of them is money. Prompt caching is fixed for sessions using an LLM gateway or custom base URL. If you route Claude Code through a gateway — most enterprise deployments do — you were paying uncached input prices on every turn, with nothing in the interface saying so. Check your spend against the date you upgrade. The other line is a built-in "Concise" output style: Claude leads with results and skips preamble and narration while doing the work just as thoroughly, selectable under Output style in /config. Relatedly, v2.1.238 fixes custom, project and plugin output styles drifting back to the default voice mid-session — if you wrote a style and concluded it did not stick, it was not you.

Two changes that will surprise someone. Ctrl+L and Cmd+K in fullscreen now always just repaint — the double-press /clear shortcut was removed (and 1-row nvim terminals no longer trigger automatic /clear loops, which is why). If you had built the double-press into muscle memory, it is gone; use /clear. And claude mcp list and claude mcp get now show disabled servers as ⊘ Disabled instead of connecting to them for a health check — faster, and it stops a disabled server's backend being started merely by listing.

Remote Control got nine fixes, which tells you where the load is. Sessions whose process crashed stayed unavailable until claude remote-control was restarted (now reusable on next message); messages sent from web or Desktop mid-turn disappeared from the transcript after the turn finished; model picks made on a phone did not update the model shown in the terminal; a brief network hiccup during sign-in renewal disconnected the session with "login expired" (it now retries); a failed reconnect was reported on sign-out; per-task Stop from the tasks panel did nothing on CLI-hosted sessions; remote sessions exited when a client sent a message without a valid role; and claude remote-control sessions were inheriting session-scoped environment variables from the launching shell. Brief HTTP 403 refusals from a network edge, VPN or proxy are now tolerated for up to 3 minutes, with the refusing party named when a block persists. Separately, ListAgents/SendMessage stop reporting "Remote Control is not connected" in server-mode and Desktop/IDE-hosted sessions, and stop exposing the pre-warmed idle worker — it now appears only once a task claims it.

Everything else, briefly. MCP stdio servers were receiving a server/discover request before initialize, forcing lazy servers to start their backend on every session open — a real startup cost for anyone running heavy MCP servers. Also fixed across the three releases: leftover /tmp/claude-*-cwd files when a Bash command is killed or times out; a proxy's connection refusal reported as a generic network error instead of naming the proxy; CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true not holding when an account is near but not over its usage limit; worktree-isolation Bash refusals telling you to remove a redirect the command never had; held Backspace ignored on terminals sending Ctrl+H over slow SSH/mosh; permission-prompt diffs clipping lines with emoji or tabs; a suspended session leaving the terminal in bracketed-paste mode with the cursor hidden; the /model and /effort cache-miss warning firing when the cache had already expired; the fullscreen renderer failing permanently after one failed start instead of falling back; the /model picker rendering taller than the terminal; unhandled promise rejections when a subprocess fails to start (a 2.1.234 regression, notably powershell.exe on WSL with interop disabled); the managed-settings approval prompt capturing a first keypress as approval without appearing; clipboard copy, background sessions and local MCP logs breaking after a switched-into directory was removed; and runaway session recaps, now capped at 400 characters. Startup is faster on macOS, and the auto-update check runs about 10 seconds after launch instead of competing with startup for CPU. The bundled claude-api skill was updated for the Managed Agents August 19 release covered above.

No reverts across these three releases. We check every release for rollbacks of claims we have published, because v2.1.233 reverted two permission changes we had reported as shipped. Nothing in v2.1.236 through v2.1.238 walks back anything we have told you. The narrower replacements for the reverted Cygwin-symlink and input-redirection permission checks have still not appeared — eight days on, neither is in effect.

Full changelog → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/skills-guide/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

1.3.0 is now the current stable release, and its notes finally explain what the last two tags were. We covered rc.1 shipping with nothing but install instructions and rc.2 arriving with two fixes. The stable promotion carries the complete RC1 scope, and it is substantial — this is not a patch release wearing a minor version number.

Read the Removed section first. Five things are gone: the standalone missions page, the routines surface, admin analytics placeholders, project mission placeholders, and IronLoop network settings. Four of those are WebUI surfaces, so anyone with a bookmark, a runbook screenshot or a written procedure that names them needs to update it. IronLoop network settings being retired is the one to check against a real configuration before you upgrade. This is the second consecutive IronClaw minor with breaking removals — 1.2.0 removed slack_allowed_channels and telegram_allowed_channels — which is worth internalizing as a property of the platform right now: the 1.x line is removing things, not just adding them. Read the Removed section of every IronClaw release before upgrading.

Telegram linked devices is the feature that needs a privacy read, and the notes give you an unusually honest one. You can pair a personal Telegram account with the bot channel so the agent can read your conversations and act as you. The upstream notes then state the boundaries directly: reads are live against Telegram's own servers — there is no local mirror, retention policy, or search index of the account — but message content a run actually reads is retained in that run's transcript like any other tool result. That last clause is the one to sit with. "We don't store your Telegram" and "your Telegram messages end up in agent transcripts" are both true simultaneously, and the second is where your actual exposure lives. Before enabling this, know where your run transcripts go, who can read them, and how long they persist — because that is now also the answer for your personal Telegram history.

Structured automations replace free-form scheduled prompts with a validated contract. A scheduled trigger now carries a prompt spec, execution policy and required skills, checked by a fail-closed preflight at creation rather than being a prompt string that gets discovered to be wrong at 3am. Unattended runs get their own protocol, and a deterministic no-result sentinel lets a run with nothing to report finish silently instead of delivering filler. Anyone who has run a daily agent job knows why that sentinel exists: a scheduled agent asked to report will invent something to report, and a channel full of manufactured non-updates trains you to ignore the one real one. Validating at creation instead of execution is the same instinct applied earlier.

Per-user model preferences arrive with an admin bound. Each user picks their own model from WebUI settings, the CLI or chat commands, and the choice follows them through channel turns and inbound replay. Admins constrain what is selectable with a tenant-scoped model selection policy. The policy half is what makes this deployable in a shared install — per-user choice without a bound is per-user spend without a bound.

The rest of the Added list. Document editing: structural edits to .docx, .xlsx and .pptx, plus PDF rendering from HTML. The full Slack messaging vocabulary — eight more operations (edit message, delete message, add reaction, remove reaction, open DM, get message, resolve user, list members) completing the core surface. Ranked memory recall, which ranks by relevance instead of requiring every term of the question to appear in the saved fact, so a differently worded question still finds it and — the good part — broken memory is visibly different from empty memory; memory-save guidance ships with an always-on MEMORY.md prompt lane. Opt-in parallel tool batches in the agent loop. Explicit Anthropic cache_control prompt-cache breakpoints on both transports. And a shared WebUI search field with per-field help text on admin extension configuration forms.

Two changes are about cost rather than capability. Substantially fewer database writes per turn: capability invocation state persists at gate and terminal edges only, while runtime milestone events, thread index touches, message lookup indexes, trigger and outbound state, and process heartbeats all coalesce or fold into existing rows. On a self-hosted install with a busy database that is a direct throughput win. And the public documentation site now deploys from a docs-live branch that stable releases move, so published docs describe the released binary rather than unreleased main. Docs that ran ahead of the shipped build is a failure mode we have flagged on other platforms; it is good to see it fixed structurally rather than by discipline.

The Fixed list is mostly about not losing work. Context-window eviction now compacts instead of discarding — the accepted task and any steering survive. Lease expiry recovers safe runs instead of failing them. An unavailable capability call is repaired instead of aborting the run, and repeated-call detection is advisory rather than fatal. Model-bound secrets are redacted without rejecting the turn — the previous behavior threw away the whole turn to avoid leaking, which is safe and also expensive. Telegram sticker and voice attachments no longer brick the channel, and the 2FA gate on migrated data centers is recognized and says where the login code arrives. Extension cards and install results report what actually happened; bundled MCP state refreshes after auth; hosted MCP OAuth supports origin-scoped servers. WebUI: SSE reconnect storms are bounded and a failed tool call reads as a subtle badge instead of a loud summary. And a dense storage fix — the resource governor keeps retrying through a full libSQL writer attempt instead of surfacing contention as failure, with the delta journal given its own bounded write lane, congestion distinguished from storage damage so a contended write replays rather than invalidating the authority, and stale reservations swept rather than leaking as permanent Active holds.

What this means for you. 1.3.0 is stable and is what our guides should now target. Our version data has been bumped from 1.2.0, and the 1.3.0-rc.2 prerelease fields retire automatically. If you are still on 1.2, note that rc.2 fixed an upgrade path from 1.2 that crash-looped at startup — that fix is in this release, so upgrading from 1.2 is the supported move rather than the risky one it was four days ago.

Releases → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/, /ironclaw/vs-openclaw/

The best-shaped bug in this window is a warning that existed and could never print. nemoclaw <sandbox> destroy --yes terminated a live SSH session without printing any notice. The cause is worth reading in full because it is a mistake anyone can make: confirmSandboxDestroy() probed for active sessions and then returned early on --yes/--force, so the probe result was discarded and the warning branch was unreachable. The operator saw a silent destroy; the connected terminal died with a broken pipe. The fix draws the right line: --yes and --force waive the confirmation prompt only — the active-session warning now prints on the pre-confirmed path too, and it lists the detected PIDs (#9858). That is the general principle: a flag that suppresses a question should not suppress the information the question was based on. Notably, the upstream PR flags that confirmSandboxRebuildIfNeeded() has the same shape and was left out of scope — so the identical bug likely still exists on the rebuild path.

Experimental Google Chat support handles the service-account key the way you would want. Hermes can now pull events from a configured Google Cloud Pub/Sub subscription and send replies through the Google Chat API. The part that matters: OpenShell keeps the service-account private key outside the sandbox and replaces the in-sandbox credential placeholder at the approved request boundary. A Google service-account key is a long-lived, broadly-scoped credential; keeping it out of the sandbox filesystem entirely and substituting it only at the moment of an approved request means a compromised sandbox does not walk away with it. It is the same instinct as Claude Code's headersHelper not inheriting credential env vars, landing on a different platform in the same window.

A diagnostic that finally names the commands you need. A failed in-sandbox openclaw command reported a queued gateway scope upgrade but never named the commands that clear it — so you had to already know openclaw devices list and openclaw devices approve. NemoClaw now checks for a pending device request after such a failure and appends a review stanza to stderr (#9853). The restraint in the implementation is the interesting part: the hint never names a request id, because NemoClaw cannot establish that a pending request belongs to the failed command or to an acceptable scope — so it points at devices list and leaves the approve line at a literal <requestId> placeholder. A convenience feature that declined to guess which approval you meant. The probe is best-effort and never changes the command's output or exit code.

Local inference took the bulk of the work across both versions. Managed vLLM now validates a running server against the requested serving profile, model, reasoning mode and configured ports before reuse, and can resume an interrupted installation without losing the selected provider state; the managed catalog owns the vLLM profiles, adds Linux AMD64 Muse and Lightning options, refreshes llama.cpp image pins, and removes the retired DeepSeek V4 Pro menu entry. Ollama validation proves the requested model through the sandbox endpoint, runs Portable instances under Podman, bounds WSL host discovery, avoids installing a Linux systemd override for a Windows-host Ollama during resume, and — worth stating plainly — the Ollama installer now validates downloads before execution. Connect-time recovery reads the auth proxy's structured bind-refusal status and renders guidance for the persisted backend, with a versioned mode-0600 descriptor distinguishing Ollama from a compatible endpoint on the same port (#9868). And Google Gemini onboarding now offers and defaults to gemini-3.6-flash, with manual model entry retained.

Fail-closed behavior in three more places. Policy changes now preserve the authoritative OpenShell exit status and leave rejected or unconfirmed mutations out of NemoClaw state. The Hermes tool gateway broker refuses a healthy listener unless the recorded live process is the NemoClaw broker — a health check that verifies identity, not just that something answered on the port. Shields commands can recover expired timer state (#9866), and full uninstall stops verified NemoClaw-owned Bedrock Runtime adapters before removing their lifecycle evidence — order matters there, since removing the evidence first would strand a running adapter with nothing recording that it exists.

Also in the window. Interactive connect releases the lifecycle lock before it waits for the shell, so other commands can use the same sandbox during the session. An explicit sandbox start tolerates a bounded initial OpenShell Error phase while the sandbox returns to Ready. Hermes onboarding probes the API port recorded for the sandbox. Portable onboarding uses 10.87.0.0/24 for its sandbox network and preserves credential-redacted image-pull diagnostics. Sandbox lifecycle work covers creating the Portable network before host aliases, keeping the host-gateway subnet separate, preserving Docker authority across terminal sessions, and recreating a gateway when its Docker network is missing. Managed MCP add operations republish the credential-free provider revision after delayed credential absence and require a fresh projected revision before commit. Managed Hermes images include and validate the frozen agent-client-protocol package required by the existing hermes-acp entry point — but the release notes are explicit that this does not add an Agent Client Protocol session workflow, which is the kind of clarification that prevents a false headline.

Version note: the dated changelog in the NemoClaw repo now heads at v0.0.113 (docs/changelog/2026-08-20.mdx), up from v0.0.111 — two versions in two days. We have bumped our tracked version accordingly. NemoClaw ships from a commit feed with no version tags, so this number comes from the repo's own dated changelog files rather than a release tag, and we check it every run.

Commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /troubleshooting/

The Agent Manager PR panel rework is the headline, and one detail in it is a real workflow change. Resolved threads now collapse into one-line rows in a Resolved group instead of being dimmed, each thread shows its replies, and every card gets prominent Send to agent, Resolve, Copy, Open file and Open on GitHub actions. A single button sends all unresolved comments to the agent. The detail that matters: comments arrive as structured review comments instead of pasted text. Pasting a review into a prompt loses which file and line each comment attached to, which is exactly the context the agent needs to act on it; passing structure instead of prose is the difference between "here are some opinions" and "here are located, actionable items." PR comment diffs also render with the Pierre-backed diff viewer and syntax highlighting.

The permission-prompt fix belongs in a UX post-mortem somewhere. When a permission prompt contained a large diff or a long command, the Allow and Deny buttons were pushed out of view. The prompt now scrolls its own content and shrinks with the available chat height. Consider what that produced in practice: the riskier the action — a bigger diff, a longer command — the more likely the approval controls were unreachable, which pressures a user toward whatever path is reachable. This is the same family of defect Claude Code has been working through for three releases: an approval surface that cannot render what it is asking about.

Two more changes worth flagging. The separate trust action was removed from Agent Manager multi-project repositories — added projects are now immediately available, with VS Code workspace trust still protecting setup and run scripts. Removing a trust gate is normally a hardening regression, so note where the guarantee moved: script execution is still gated, only the redundant per-project acknowledgement is gone. And the default speech-to-text model is now NVIDIA Parakeet TDT 0.6B v3, with dynamic model discovery and offline fallback retained.

Three things were removed. The experimental agent requirements check and its configuration flag, the experimental task-aware tool-output pruning feature and its related settings and indicators, and the floating scroll-to-top button in the PR sidebar. If you had tool-output pruning enabled as a context-cost measure, it is gone and its settings with it — plan for higher context usage on long tool-heavy sessions until an alternative appears.

The rest is Agent Manager reliability and editor polish. Project accordions no longer sit on a loading indicator until clicked, with skeleton placeholders while projects load. @terminal captures the focused Agent Manager terminal — including embedded Run and Setup terminals — rather than an unrelated active VS Code terminal. Switching from Ask to Code keeps the selected agent and reminds the model that Ask-mode restrictions no longer apply. Diff totals and new worktrees use the remote's current default branch when local Git metadata still points at a retired trunk. Terminals and nested Kilo sessions survive configuration reloads and location idle eviction while still being cleaned up on explicit close, worktree deletion and server shutdown. Also: MCP and generic tool blocks get a default open/collapsed setting; delegated subagent sessions open in inspector tabs; installed agents are removed from every writable configuration source with removal failures reported; JWT share tokens are accepted when importing a session from a share URL; incremental assistant text streaming is restored; token throughput shows by default with a setting to hide it; the model provider shows next to every model in the selector; and typing extra text after /memory show, or selecting a slash command with text before the cursor, no longer wipes your input.

Releases → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/, /kilocode/vs-claude-code/

Hermes tagged v0.20.5, and for the fourth consecutive release the curated notes are deferred. The tag rolls up roughly 323 merged PRs — about 746 commits across ~1,250 files (+111,500 / −20,701) — since v0.20.4 on August 18. The release entry names the areas rather than the changes: Bot Mode group-room threads, foldable conversation summaries, blob-face avatars, PDF and file attachments with drag & drop; the keyless web tier (a five-vendor free rotation with ring failover, giving web search on fresh installs with zero keys); a CLI polish wave (fuzzy /model picker, Ctrl+P command palette, richer /status); execution-discipline and runtime stall guards from the Composio eval findings; hermes update receipts and fleet --plan verification; hermes worktree list/prune; an opencode-free zero-auth provider; multi-question clarify; desktop performance work; and cron jobs gaining persistent memory and per-job reasoning effort.

Two of those are worth acting on even without notes. The keyless web tier means a fresh Hermes install has working web search with no API keys configured — which changes the first-run experience our setup guide describes, and changes what "zero-cost Hermes" means in our free models guide. And cron jobs gaining persistent memory and per-job reasoning effort is a direct upgrade to the pattern our tasks guide teaches: a scheduled job that remembers previous runs is a different tool from one that starts blank every time.

The standing caveat stands. Full curated release notes for everything from v0.20.0 onward are promised with v0.21.0, and Nous states that nothing in this window is skipped. That is now seven days of tagged releases documented only by area. We are not going to write specifics we cannot verify from a diff, so we will cover the substance when v0.21.0 lands. Meanwhile, treat these tags as what they say they are: stable rollups for downstream consumers — Docker images, hosted deployments, fresh installs — and upgrade with hermes update if you want the accumulated work, understanding you are doing so without a changelog.

Releases → Affects: /hermes/, /hermes/setup/, /hermes/tasks/, /hermes/free-models/

The Prompt Caching dashboard is the useful one, and it is useful for a specific reason. It tracks cache hit rate over time, cache reads per write, and the breakdown of cache-read, cache-write and uncached tokens, filterable by model and service tier. Prompt caching is the largest single lever on agent running costs and also the hardest to verify — you restructure a prompt to be cache-friendly and then have no direct way to confirm it worked, because the savings show up as a slightly smaller bill weeks later. Cache reads per write is the metric to watch: it tells you how many times each cached prefix actually got reused, which is the thing your prompt structure controls. If you have been guessing at whether your caching strategy works, stop guessing. (Claude Code users got the mirror-image reminder this week: v2.1.237 fixed prompt caching being broken entirely for gateway-routed sessions — a failure nobody would have caught without exactly this kind of visibility.)

The other item is narrower. Transparent backgrounds are available in preview for image generation: set background to transparent and use png or webp output. jpeg does not support transparency, which is a format constraint rather than a limitation of the feature.

Still no pricing for Ultrafast mode. The August 13 Ultrafast tier for GPT-5.6 Sol — up to 14× faster than Standard, limited preview — remains announced without published rates, a week on. Our cost calculator cannot model a tier with no price, and we will not estimate one.

Changelog → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/