Hermes and a ChatGPT subscription

Hermes can hand its OpenAI turns to the Codex CLI’s app-server instead of running its own tool loop. It is opt-in, off by default, and it exists for one reason people search for: running an agent against a ChatGPT subscription with no API key, using the same sign-in Codex uses. Here is what turns on when you enable it, what the model can then do, what stops working, and how to turn it off.

Why people enable it

• OpenAI agent turns on the subscription, with Codex’s own sign-in flow and no API key.
• Codex’s toolset and sandbox: a shell for terminal, read, write and search, structured patches for edits, a plan tracker, all inside seatbelt or landlock sandboxing.
• Native Codex plugins, Linear, GitHub, Gmail, Calendar, Canva and the rest, migrated automatically into the Hermes session.
• Hermes’ richer tools still come along through a callback: web search and extraction, browser automation, vision, image generation, skills and speech.

What enabling does

One slash command in a session verifies the Codex CLI is installed, persists the runtime choice to the config, migrates your MCP servers into Codex’s config, discovers and migrates installed Codex plugins, registers Hermes as an MCP server so Codex can call back for the tools it lacks, and sets the default permissions to workspace so writes inside the workspace do not prompt every time. It takes effect on the next session, so prompt caches stay valid. The same flag can be set by hand in the config file.

This is opt-in only. Default Hermes behavior is unchanged unless you flip the flag. Hermes never auto-routes you onto this runtime.

What keeps working, and what does not

• The self-improvement loop: memory nudges every ten prompts and skill nudges every ten tool iterations fire exactly as before, because Codex events are projected into Hermes’ message shape.
• Approvals: Codex asks before commands and patches, translated into Hermes’ standard dangerous-command prompt.
• Four Hermes tools that need the live agent context cannot be driven through a stateless callback; switch the runtime back to auto when you need them.

The trade-offs section is worth reading whole: a subscription has limits that an API key does not, auxiliary tasks spend subscription tokens too, and multi-profile setups need care with the shared Codex config. Hermes vs OpenClaw compares the two engines’ model handling alongside the rest.

Turning it off

The same command with off or auto restores the default runtime on the next session; the migrated plugins and MCP entries stay where they were written, and the memory files are untouched throughout, which how Hermes memory works explains.

On Diali

Diali runs Hermes on the default runtime, with managed credits or your own provider key from the vault: bring-your-own-key means API keys, not subscription sign-ins, and the docs’ own warning about subscription limits is the reason that is the right shape for an always-on assistant. Hosted Hermes on Diali is the hosted version; Hosted OpenClaw on Diali the other engine.

• Opt-in, one command, next session.
• Codex’s tools and plugins, plus Hermes’ through a callback.
• Subscription limits are the price of no API key.