[Harness Watch] Add Hermes through the existing ACP path

Parent epic: #4627

Desired Behavior

Add Hermes as a built-in ACP provider, the same way OpenCode (#4827) and Pi (#4419) were — usable by OSS users in Canvas, and available as an evaluation harness.

The one constraint: it must not add weight to the published agent-server images.

How it works — same pattern as the npm providers

OpenCode and Pi are registry providers that are not in the default INSTALL_ACP_PROVIDERS. They are absent from the image, and npx installs them on first use and caches the result. Zero image weight, still fully usable.

Hermes is a Python project installed from git, so npx cannot do this. But the agent-server image already ships uvx (COPY --from=ghcr.io/astral-sh/uv:0.11.6 /uv /uvx /bin/), which is the direct equivalent — it runs a CLI from a pinned git ref without installing it permanently:

uvx --from git+https://github.com/NousResearch/hermes-agent@v2026.8.31 hermes acp

So Hermes gets the same treatment: a normal registry entry, left out of the preinstall list, launched on demand.

Which version to pin

Use a git tag. Tags are CalVer (v2026.8.31, v2026.8.27, …) and ship roughly weekly.

Avoid the alternatives: PyPI hermes-agent is not official (no project URLs or license metadata, last release 2026-07-20, and the repo has no publish workflow), and the curl | bash installer takes no version flag, so it cannot be pinned.

Hermes' ACP support is first-party: hermes_cli/subcommands/acp.py and an acp_adapter/ package in NousResearch/hermes-agent.

The SDK change needed

ACP_INSTALL_CATALOG only describes npm packages — an entry is a package name plus version, and it renders an npx command. A test also asserts set(ACP_INSTALL_CATALOG) == set(ACP_PROVIDERS), so every registry provider needs an entry.

Hermes needs a catalog entry that renders a uvx command instead. Small and self-contained, and it keeps the registry as the single source of truth rather than special-casing Hermes in the agent.

Two things to check while implementing

• Where uvx caches. npx is pointed at a cache under ~/.openhands so it survives container replacement. uvx needs the same (UV_CACHE_DIR), or every new container re-downloads.
• Cold-start time against the 90 s acp_startup_timeout. Installing a Python package from git can involve a build step, which is slower than a prebuilt npm package. Measure it; if it does not fit, say so rather than shipping something that intermittently times out.

Acceptance Criteria

SDK

• Catalog entry that renders a uvx --from git+…@<tag> command
• Registry entry. Determine each field against a running hermes acp rather than copying another provider: agent_name_patterns, data_dir_env_var (the variable that relocates all of its state — check whether one exists or whether only HOME does, as with gemini-cli and OpenCode), default_session_mode, the model-selection fields, and file_secrets if it authenticates from a file
• Keep it out of the default INSTALL_ACP_PROVIDERS, so image size is unchanged — assert this
• uvx cache lands under ~/.openhands; measure cold and warm start
• TypeScript mirror updated (check-acp-drift.py enforces this)

Canvas / Cloud

• Surfaced in Canvas for OSS users
• An explicit decision for Cloud/enterprise via #4841 — supported or deliberately not surfaced, never a silent default

benchmarks / evaluation

• benchmarks/utils/acp.py: _ACP_COMMANDS["acp-hermes"] and its _ACP_ENV_VARS entry
• benchmarks/utils/args_parser.py and the evaluation workflows: add acp-hermes to the agent-type choices
• Install the pinned Hermes in the eval image (eval preloads rather than installing on demand) and record the version
• Set the declared model and a per-attempt LiteLLM key with no interactive prompt
• Pass a five-instance smoke test: read, edit, test, telemetry that reconciles, and a second clean run

Read the ACP catalog and provider definitions first, then run check-acp-drift.py to understand the TypeScript mirror. Trace benchmarks/utils/acp.py, benchmarks/utils/args_parser.py, and the evaluation workflows, including the eval image setup. Done means the SDK, Canvas, and evaluation acceptance criteria pass, including cache behavior, startup timing, and the five-instance smoke test.