Hermes Rewind: A Reversible Undo for Agent Sessions
What /undo [N] does, how it stays reversible, and why a rewind that destroys turns is one you cannot trust.
Disclaimer: I am an actuary. ASA not yet achieved; all requirements are met and the designation is expected in June or July depending on application timing. The thoughts and analyses here are my own explorations, not professional advice. Draw your own conclusions.
I built a rewind primitive for Hermes Agent. It shipped as PR #21910 and folded into /undo [N] on main. The command backs the session up N turns, restores the dropped message into the composer for editing, and re-prompts from the rewound state. Default is one turn; /undo 3 walks back three.
![Six-panel infographic for the Hermes /undo [N] rewind feature: back up N turns, soft-delete on disk, editable prefill, memory-aware cache invalidation, CLI and TUI parity, and verification. Styled as a Neo-Tokyo classified document.](/images/hermes-undo-rewind.webp)
The mechanism
Back up N turns. The transcript pointer moves from T to T-N. Out-of-range counts clamp to the oldest turn rather than erroring.
Soft-delete on disk. Rewound messages are not destroyed. The messages table flips active=1 to active=0. The rows persist for audit and drop out of re-prompts and search. Nothing is lost; it is hidden.
Editable prefill. The backed-up message lands in the composer as restored prefill. You edit it and resubmit. It never auto-sends. A 312-character message restored from turn T-3 sits in the box waiting for the correction you actually wanted to make.
Memory-aware. Rewind fires on_session_switch(rewound=true), which invalidates the per-turn caches that would otherwise carry stale state forward: vector DB, embedding cache, RAG cache, summary store, tool result cache, session state cache. The rewound state is consistent across memory, not just the transcript.
CLI and TUI parity. Same primitive across both surfaces. /undo 3 in the terminal and /undo 3 in the TUI rewind three turns from T-0 to T-3, restore the prefill, and behave identically.
Verified. 243 targeted tests green. End-to-end coverage on disk-plus-memory sync. A rewind_count audit counter records every rewind.
Why soft-delete
The design goal was reversibility without data loss. A rewind that destroys the discarded turns is a rewind you cannot trust. Soft-delete plus the audit counter means every walk-back is recorded and every dropped message is recoverable. The edit-and-resubmit flow means the rewind exists to fix the prompt, not to pretend the prompt never happened.
teknium1 merged the primitives into /undo [N] with authorship preserved.