Add Hermes as a desktop app and a coding agent

Hermes joins Install > AI as a desktop app, sits beside it under Remove > AI,
and becomes a choice in the default-agent list. The CLI installs through
omarchy-install-hermes-cli rather than a bare `mise use`, so its interpreter
is pinned before mise builds it.

Rebased onto quattro. Ori claimed U+E909 in #7709 while this branch was open,
so the Hermes mark moves to U+E90A in the icon font, the menu entries, the
font README, and the charset the menu test pins. The glyph outline itself is
unchanged; it is spliced in beside Ori rather than over it.

Co-Authored-By: witcheer <witcheer.eth@gmail.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SySdB3RtCA8BNv6Am246BP

bin/omarchy-agent

@@ -86,6 +86,15 @@ codex)
   command=(codex --approve-for-me)
   [[ -n ${prompt:-} ]] && command+=(-- "$prompt")
   ;;
+hermes)
+  # Hermes has no "start interactive, seeded with this prompt" mode. --oneshot
+  # answers the prompt and exits, which is the closest it offers.
+  if [[ -n ${prompt:-} ]]; then
+    command=(hermes --yolo --oneshot "$prompt")
+  else
+    command=(hermes --yolo)
+  fi
+  ;;
 omp)
   command=(omp --auto-approve)
   [[ -n ${prompt:-} ]] && command+=(-- "$prompt")

bin/omarchy-default-agent

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # omarchy:summary=Set and launch the default coding agent
-# omarchy:args=[pi|omp|opencode|ori|claude|codex|grok|agy|copilot|crush]
+# omarchy:args=[pi|omp|opencode|ori|claude|codex|grok|agy|hermes|copilot|crush]
 # omarchy:examples=omarchy default agent | omarchy default agent codex | omarchy default agent claude
 
 installing=false
@@ -33,20 +33,36 @@ codex) agent="codex"; name="Codex" ;;
 crush) agent="crush"; name="Crush" ;;
 grok) agent="grok"; name="Grok"; agent_package="npm:@xai-official/grok" ;;
 agy | antigravity | antigravity-cli | gemini | gemini-cli) agent="agy"; name="Antigravity"; agent_package="antigravity-cli" ;;
+hermes) agent="hermes"; name="Hermes"; agent_installer="omarchy-install-hermes-cli" ;;
 copilot | github-copilot) agent="copilot"; name="GitHub Copilot" ;;
 *)
-  echo "Usage: omarchy-default-agent <pi|omp|opencode|ori|claude|codex|grok|agy|copilot|crush>"
+  echo "Usage: omarchy-default-agent <pi|omp|opencode|ori|claude|codex|grok|agy|hermes|copilot|crush>"
   exit 1
   ;;
 esac
 
 agent_package=${agent_package:-$agent}
 
-if [[ $installing == "false" ]] && ! mise where "$agent_package" &>/dev/null; then
+# Hermes reaches mise through its own installer rather than straight from
+# here: it needs its interpreter pinned, and a bare `mise use` has nowhere to
+# say so. See omarchy-install-hermes-cli.
+if [[ -n ${agent_installer:-} ]]; then
+  # Not omarchy-cmd-present: the stub is on PATH from first boot and says
+  # nothing about whether Hermes is installed behind it. Treating a cold stub
+  # as installed skips the floating terminal and runs the minute-long install
+  # inside the menu action instead.
+  agent_present() { "$agent_installer" --check; }
+  agent_install() { "$agent_installer" --now; }
+else
+  agent_present() { mise where "$agent_package" &>/dev/null; }
+  agent_install() { mise use -g "$agent_package"; }
+fi
+
+if [[ $installing == "false" ]] && ! agent_present; then
   exec omarchy-launch-floating-terminal-with-presentation omarchy-default-agent --install "$agent"
 fi
 
-if ! mise use -g "$agent_package"; then
+if ! agent_install; then
   if [[ $installing == "true" ]]; then
     echo "Could not install $name with mise" >&2
   else

bin/omarchy-install-ai-hermes

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# omarchy:summary=Install the Hermes desktop app
+# omarchy:requires-sudo=true
+
+set -e
+
+# No CLI is installed here on purpose. Hermes Desktop only runs against a
+# runtime built from its own commit, so it provisions one itself under
+# ~/.hermes on first launch, which takes a few minutes and shows its own
+# progress. Handing it the mise CLI instead fails: PyPI trails the tags, and
+# the version gap fails the app's readiness probe with a 401.
+echo "Installing Hermes Desktop..."
+omarchy-pkg-add hermes-desktop
+
+# If Hermes was already installed for the terminal, the app supersedes it: one
+# machine, one Hermes. This drops that copy so the terminal, the default agent
+# and the app all end up on the app's installation.
+omarchy-install-hermes-cli || true
+
+echo "Opening Hermes Desktop..."
+setsid uwsm-app -- /usr/bin/hermes-desktop >/dev/null 2>&1 &
+
+echo ""
+echo "Hermes Desktop has been installed."
+echo "Its first launch installs the Hermes runtime, which takes a few minutes."

bin/omarchy-install-hermes-cli

@@ -0,0 +1,136 @@
+#!/bin/bash
+
+# omarchy:summary=Install the Hermes CLI as a mise-backed wrapper in ~/.local/bin
+# omarchy:args=[--now]
+# omarchy:examples=omarchy install hermes cli | omarchy install hermes cli --now
+
+# Hermes pins every one of its dependencies exactly and declares
+# Requires-Python >=3.11,<3.14, so it can neither be built against Arch's
+# Python nor share the python-* packages. mise builds it a private environment
+# instead.
+#
+# It gets its own installer rather than a line in omarchy-mise-install because
+# of the interpreter pin. Given no compatible interpreter to hand, uv builds
+# the venv against the system Python in violation of Hermes' own bound,
+# reports success, and leaves the breakage to surface later inside a
+# dependency -- and omarchy-mise-install writes a fixed stub with nowhere to
+# say otherwise.
+#
+# There is only ever one Hermes on a machine. hermes-desktop cannot run against
+# this one -- it needs a runtime built from its own commit, and the version gap
+# fails its readiness probe -- so it installs its own under ~/.hermes and puts
+# that on PATH. When the package is present it therefore owns Hermes outright:
+# this installer stands aside and removes its own copy, so the terminal, the
+# default agent and the app are all the same installation.
+
+set -euo pipefail
+
+mode=${1:-}
+
+tool='pipx:hermes-agent[extras=all]'
+python='3.13'
+
+# The package, not the runtime directory: it is installed before the app has
+# ever run, and that is exactly when we must not start building a second copy.
+desktop_owns_hermes() {
+  omarchy-pkg-present hermes-desktop
+}
+
+# The venv appears at the python-deps stage, several stages before the one that
+# installs the command, so its presence says nothing about being usable. The
+# marker is written last, and the command is what the agent actually runs.
+desktop_hermes_ready() {
+  [[ -f $HOME/.hermes/hermes-agent/.hermes-bootstrap-complete ]] || return 1
+  [[ -x $HOME/.local/bin/hermes ]] || return 1
+
+  # An executable of that name proves nothing about whose it is; the app's own
+  # points into ~/.hermes, and anything else is not the install we are asking
+  # about.
+  grep -q "$HOME/.hermes" "$HOME/.local/bin/hermes"
+}
+
+# Whether Hermes is really installed, not merely whether the stub exists. A
+# stub on its own is cold: running it installs Hermes, which takes minutes.
+installed() {
+  [[ -d "$(mise where "$tool" 2>/dev/null)/hermes-agent/lib/python$python" ]]
+}
+
+# --check lets callers tell a cold stub from a working one before they commit
+# to a path that assumes Hermes is ready.
+if [[ $mode == "--check" ]]; then
+  if desktop_owns_hermes; then
+    if desktop_hermes_ready; then exit 0; else exit 1; fi
+  fi
+  if installed; then exit 0; else exit 1; fi
+fi
+
+# Hand Hermes over to the app rather than keeping a second copy beside it.
+if desktop_owns_hermes; then
+  # Not gated on that copy being healthy: `mise up` can rebuild it against the
+  # wrong interpreter and a half-finished install answers to neither test, and
+  # either way it is still a second Hermes. Removing nothing is harmless.
+  if mise where "$tool" >/dev/null 2>&1; then
+    echo "Hermes Desktop provides Hermes; removing the separate CLI install..." >&2
+  fi
+
+  mise rm -g "$tool" >/dev/null 2>&1 || true
+  mise uninstall --all "$tool" >/dev/null 2>&1 || true
+
+  # Our own stub has to go with it. Left in place it still answers `hermes`
+  # until the app's bootstrap overwrites it, and answering means building the
+  # second Hermes this whole arrangement exists to avoid.
+  if [[ -f $HOME/.local/bin/hermes ]] && grep -q omarchy-install-hermes-cli "$HOME/.local/bin/hermes"; then
+    rm -f "$HOME/.local/bin/hermes"
+  fi
+
+  if desktop_hermes_ready; then
+    exit 0
+  fi
+
+  echo "Hermes Desktop is installed but has not set Hermes up yet." >&2
+  echo "Launch Hermes Desktop once to finish installing it." >&2
+  exit 1
+fi
+
+mkdir -p "$HOME/.local/bin"
+rm -f "$HOME/.local/bin/hermes"
+
+cat >"$HOME/.local/bin/hermes" <<EOF
+#!/bin/bash
+
+# Written by omarchy-install-hermes-cli.
+
+export UV_PYTHON="$python"
+
+# Exported rather than set on the install line alone, so the version resolved
+# to run agrees with the one just installed. Hermes ships several times a week
+# and mise's cooldown would otherwise hold a new release back for days.
+export MISE_MINIMUM_RELEASE_AGE=0
+
+# mise up -- which omarchy update runs -- reinstalls without that pin, so this
+# asks which interpreter is actually there rather than whether anything is.
+if ! [[ -d "\$(mise where '$tool' 2>/dev/null)/hermes-agent/lib/python$python" ]]; then
+  echo "Installing Hermes on Python $python (this takes a minute)..." >&2
+
+  # mise's pipx backend shells out to uv, which a stock Omarchy does not have.
+  # It is fetched here rather than when this stub was written, so setting up a
+  # machine that never runs Hermes costs nothing.
+  if omarchy-cmd-missing uv && ! mise where uv >/dev/null 2>&1; then
+    mise use -g --quiet uv@latest || exit 1
+  fi
+
+  mise use -g --quiet --force '$tool' || exit 1
+fi
+
+exec mise x '$tool' -- hermes "\$@"
+EOF
+
+chmod +x "$HOME/.local/bin/hermes"
+
+# The desktop app resolves a hermes on PATH by running `hermes --version` with
+# a 15 second budget, then falls back to cloning its own copy when that times
+# out. A first-run mise install does not fit in 15 seconds, so anything that
+# hands Hermes to the GUI has to install it here rather than leave it stubbed.
+if [[ $mode == "--now" ]]; then
+  "$HOME/.local/bin/hermes" --version
+fi

bin/omarchy-remove-ai-hermes

@@ -0,0 +1,49 @@
+#!/bin/bash
+
+# omarchy:summary=Remove the Hermes desktop app along with the Hermes runtime it installed.
+# omarchy:requires-sudo=true
+
+set -e
+
+omarchy-pkg-drop hermes-desktop
+
+# The app installs a Hermes of its own under ~/.hermes -- the checkout and venv,
+# its own uv, its own node -- and puts its commands on PATH. None of it is any
+# use once the app is gone. Not ~/.config/Hermes, which holds the gateway
+# connections and their encrypted tokens, the active profile and the update
+# settings. Not the rest of ~/.hermes either:
+# the chats, memories and the skills Hermes wrote for itself are the user's,
+# they are small, and finding them still there after a reinstall is the better
+# surprise.
+rm -rf \
+  "$HOME/.hermes/hermes-agent" \
+  "$HOME/.hermes/bootstrap-cache" \
+  "$HOME/.hermes/bin" \
+  "$HOME/.hermes/node"
+
+# Only the wrappers pointing into ~/.hermes. The app writes these at its own
+# path stage, so a machine where it was installed but never launched still has
+# whatever was there before, and that is not ours to delete.
+for command in hermes hermes-agent hermes-acp; do
+  wrapper="$HOME/.local/bin/$command"
+
+  if [[ -f $wrapper ]] && grep -q "$HOME/.hermes" "$wrapper"; then
+    rm -f "$wrapper"
+  fi
+done
+
+# When Hermes brought its own Node it symlinked these next to its own commands,
+# and they point at what we just deleted. Only the links into ~/.hermes: a
+# system Node, or someone else's, lives somewhere else entirely.
+for command in node npm npx; do
+  link="$HOME/.local/bin/$command"
+
+  if [[ -L $link && $(readlink "$link") == "$HOME/.hermes"/* ]]; then
+    rm -f "$link"
+  fi
+done
+
+echo ""
+echo "Hermes Desktop has been removed."
+echo "Your chats, memories, and skills are still in ~/.hermes,"
+echo "and your connections and settings in ~/.config/Hermes."

bin/omarchy-remove-preinstalls

@@ -17,6 +17,10 @@ if gum confirm "Are you sure you want to remove all preinstalled web apps, TUI w
        ~/.local/bin/gh ~/.local/bin/opencode ~/.local/bin/playwright ~/.local/bin/playwright-cli ~/.local/bin/pi \
        ~/.local/bin/omp ~/.local/bin/ori ~/.local/bin/grok ~/.local/bin/crush ~/.local/bin/ghui ~/.local/bin/hunk
 
+  # Hermes Desktop owns this path once installed, and its own CLI is not a
+  # preinstall to sweep away.
+  omarchy-pkg-present hermes-desktop || rm -f ~/.local/bin/hermes
+
   omarchy-pkg-drop \
     aether \
     cliamp \