mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
Teknium
b5a73d46a0
macOS Local Network Privacy attributes a process to its responsible app. The gateway that `hermes gateway ensure` (Desktop's launch path, CLI clients) and the update-time restart watcher start is a plain detached child, so it is attributed to whichever app started it. The gateway outlives that app by design; once the app quits, macOS holds every surviving descendant responsible for itself, and a bare venv Python is denied: every connect to a model server on another machine fails with `[Errno 65] No route to host`, even though Hermes is allowed in Local Network settings. Reported in Discord: Test and chat against a LAN Ollama broke on every Desktop quit/reopen and after in-app updates, and worked only with a gateway run from Terminal or the installed launchd service (which already runs through osascript, #71206). On macOS both spawn sites now start the gateway as a one-off launchd job through the same osascript JXA wrapper the installed service uses, so osascript (an exempt Apple platform binary) stays the responsible code for the gateway's whole life. Nothing is installed: the plist is loaded once and deleted, it never lives in ~/Library/LaunchAgents, has no KeepAlive and is labelled outside ai.hermes.* so no fleet scan or restart route mistakes it for a service; the gateway sees XPC_SERVICE_NAME=0 and still reads as unsupervised. When launchd refuses the job (no GUI session, e.g. over SSH) the old plain-child spawn runs instead.