Hermes Agent 0.22.5: check the account and subagent permissions

A published stable release, a separate desktop package schedule

GitHub records v0.22.5 as published on 23 October 2026 at 05:28 UTC; the release body still says 22 October. This is a stable release, not a prerelease. Nous Research says the full curated cycle notes will come with the future 0.23.0. That announcement does not make 0.23.0 available today.

The release directs CLI users to hermes update, Microsoft Store users to the Store, and Docker or Hermes Cloud users to a fresh image. It explicitly says the desktop app installed from an .exe or .dmg does not change in this release and will update with the next bundled release. Do not force a desktop package to match the repository tag.

Check the identity after signing in to Nous

The release announces a unified device-code sign-in flow for Nous. A free-tier guest hands over to the signed-in account, the result identifies who signed in, and connectors offer sign-in rather than opening a guest. Check the displayed identity and authorised application accounts before requesting a write.

Version 0.22.5 also adds gauges, limit cards and model-switch recovery for plans measured in usage windows. That does not establish an unlimited subscription or a new price. The Tool Gateway still distinguishes connector access from access to its other tools: successful sign-in does not prove every service is included in your plan.

• Distinguish a connector account from an installed plugin↗

An update refusal can protect session history

The updater stops offering a stable release it would subsequently refuse to install. The documentation explains that moving back to code older than the session runtime already used by a store can be refused before the checkout changes. Read the reason rather than bypassing the check by replacing files manually.

The release also fixes a Windows launcher left pointing at an old path after a Python repin, and recovery of paused gateways when a damaged Git checkout interrupts an update. On a source installation, inspect the receipt and which processes actually restarted. The documentation warns that newly installed code can coexist with a gateway still serving old code; a zero exit status alone is not validation of the whole installation.

• Retain sessions and choose the correct update channel↗

Select routes without opening every profile

Version 0.22.5 ships pluggable delegation backends. The official Advanced Delegation plugin requires at least this version and adds two choices alongside the default: named model routes or an allowlist of profiles. It lists Linux, macOS and Windows support. Versions 0.22.0 through 0.22.4 refuse to install or enable it.

Choosing a profile involves more than a model. The subagent uses that profile’s model, credentials, skills, SOUL.md and terminal policy. List only profiles whose access is appropriate for the task. For a model route, prefer an already configured provider: the plugin warns that putting api_key directly in a route stores the key in plaintext in config.yaml.

hermes delegation config prepares modes and routes. The current plugin documentation says /delegation saves a change for the next session. The --now option can apply it to the current chat by rebuilding its tools, at the cost of a prompt-cache break. Make that an explicit choice rather than an automatic switch during a long task.

• Profiles and control: what isolation does not promise↗

Find the features moved into plugins

Importing other agents, OpenClaw migration, hermes mcp serve and the Singularity backend move out of core into plugins. The release says setup offers the importer when it finds another agent. If a command is missing after migration, check the expected plugin in the correct profile before reinstalling Hermes entirely.

The catalog installs a reviewed, pinned commit; that review is not a security audit. Read each entry’s access requirements and minimum core version. Plugins can now ask users to pick an option through slash commands, but a consent button is not a substitute for restricted permissions.

Other changes and their limits

Desktop gains drag-to-pin in the sidebar and one-click plugin installation with trust-tier badges. The release also restores the active-bot indication in group chats, adds a clear message when a working folder has disappeared, and fixes long Claude DirectSDK responses being cut off by the stall timer. It lists Electron 44, Pillow 13 and other dependency security updates without providing a detailed CVE bulletin.

The webhook-mode MCP Events client remains experimental. The documentation makes clear that enabling events alone does not create a public receiving endpoint: this mode needs separate listener configuration. Each subscription requires approval. Poll and push modes, and subscriptions from secondary profiles under the multiprofile gateway, are not supported. Do not expose a listener solely to try a new feature.

These are release-note and documentation findings. SecuFocus has not installed 0.22.5 or tested sign-in or delegation for this article. After your update, start with a task containing no sensitive data and check the account, route and outcome before granting consequential writes again.