v2026.4.13
📦 hermes-agentView on GitHub →
✨ 28 features🐛 12 fixes🔧 25 symbols
Summary
Hermes Agent v0.9.0 introduces mobile support via Termux/Android, iMessage and WeChat integrations, and Fast Mode for OpenAI/Anthropic. It also features background process monitoring, a local web dashboard, and enhanced security hardening across 16 platforms.
Migration Steps
- Users who previously configured context engines manually should now explore the `hermes plugins` system to integrate custom context engines.
- Users relying on specific proxy configurations should verify that their existing setups are compatible with the unified proxy support, especially if using SOCKS, DISCORD_PROXY, or system proxy settings.
✨ New Features
- Introduced a local web-based dashboard for managing Hermes Agent, allowing configuration, session monitoring, skill browsing, and gateway management without touching config files or the terminal.
- Added Fast Mode (`/fast`) for priority processing of OpenAI and Anthropic models, routing requests through priority queues for significantly lower latency on supported models (GPT-5.4, Codex, Claude).
- Integrated iMessage support via BlueBubbles, enabling Hermes to interact with Apple's messaging ecosystem with auto-webhook registration, a setup wizard, and crash resilience.
- Implemented native WeChat (Weixin) and WeCom callback mode support, covering the Chinese messaging ecosystem with features like streaming cursor, media uploads, markdown link handling, and atomic state persistence.
- Enabled native execution of Hermes on Android via Termux, including adapted install paths, TUI optimizations for mobile screens, voice backend support, and on-device `/image` command functionality.
- Introduced background process monitoring with `watch_patterns`, allowing users to set patterns to watch for in background process output and receive real-time notifications for matches (e.g., errors, specific events).
- Added first-class provider support for xAI (Grok) and Xiaomi MiMo, offering direct API access, model catalogs, and setup wizard integration.
- Made the context engine pluggable via `hermes plugins`, allowing users to swap in custom context engines for controlling agent perception each turn (filtering, summarization, domain-specific injection).
- Unified proxy support across all gateway platforms, including SOCKS proxy, `DISCORD_PROXY`, and system proxy auto-detection, improving usability behind corporate firewalls.
- Implemented comprehensive security hardening measures, including path traversal protection, shell injection neutralization, SSRF redirect guards, Twilio webhook signature validation, API server auth enforcement, git argument injection prevention, and approval button authorization.
- Introduced `hermes backup` and `hermes import` commands for full backup and restore of Hermes configuration, sessions, skills, and memory, facilitating migration and snapshot creation.
- Expanded platform support to 16 messaging platforms, including the addition of BlueBubbles (iMessage) and WeChat.
- Launched a new debugging toolkit with a `/debug` slash command for quick diagnostics across all platforms and `hermes debug share` to upload full debug reports to a pastebin for easy sharing.
- Added native xAI (Grok) provider with direct API access and model catalog.
- Integrated Xiaomi MiMo as a first-class provider with setup wizard, model catalog, and empty response recovery.
- Included Qwen OAuth provider with portal request support.
- Implemented structured API error classification for smarter failover decisions.
- Added rate limit header capture to be displayed in `/usage`.
- API server model name is now derived from the profile name.
- Custom providers are now included in `/model` listings and resolution.
- Added fallback provider activation on repeated empty responses with user-visible status.
- Preserved OpenRouter variant tags (`:free`, `:extended`, `:fast`) during model switching.
- Reduced credential exhaustion TTL from 24 hours to 1 hour.
- Hardened OAuth credential lifecycle, including stale pool keys, auth.json sync, and Codex CLI race fixes.
- Implemented empty response recovery for reasoning models (MiMo, Qwen, GLM).
- Updated MiniMax context lengths, thinking guard, and endpoint corrections.
- Added Z.AI endpoint auto-detect via probe and cache.
- Improved context compression with higher limits, tool tracking, degradation warnings, and token-budget tail protection.
🐛 Bug Fixes
- Fixed path traversal protection in checkpoint manager.
- Neutralized shell injection in sandbox writes.
- Implemented SSRF redirect guards in Slack image uploads.
- Fixed Twilio webhook signature validation (SMS RCE fix).
- Enforced API server authentication.
- Prevented git argument injection.
- Fixed crash resilience in iMessage integration.
- Fixed empty response recovery for reasoning models (MiMo, Qwen, GLM).
- Corrected MiniMax endpoint issues.
- Fixed Codex CLI race conditions in OAuth credential lifecycle hardening.
- Fixed stale pool keys in OAuth credential lifecycle hardening.
- Ensured auth.json sync in OAuth credential lifecycle hardening.
Affected Symbols
hermes pluginswatch_patternshermes backuphermes importhermes debug shareBlueBubblesiLink Bot APITermuxxAI (Grok) providerXiaomi MiMo providerQwen OAuth providerOpenAI Priority ProcessingAnthropic fast tierOpenRouterOAuth credential lifecycleCodex CLIMiniMaxZ.AIcheckpoint managersandbox writesSlack image uploadsTwilio webhookAPI servergit argument injectionapproval button authorization