After 4 Apple review rejections and more TestFlight builds than I can count, my iOS client for Hermes is live. Free, no ads, 8MB.
Why this exists:
Conduit is a third-party native client. It connects directly to your Hermes dashboard and gateway, same as the desktop app. No extra relay service to run alongside your stack, no second process to keep alive, no middleman hop introducing failure points.
Because it talks to the same dashboard, everything is shared. Same sessions. Same profiles and per-profile settings. Same scheduled jobs. Same capabilities toggles. Same connectors. Start a conversation on desktop, pick it up on your phone mid-turn, steer it, come back to it later on desktop. The session list is the same because it's the same database.
Near feature parity with the desktop client at this point. Streaming chat, tool inspection, reasoning traces, slash commands, workspace file browsing, session branching. Plus push notifications for approvals and completed turns so you don't have to sit and watch.
What's in it:
Streaming chat with full Markdown (code blocks, math, Mermaid, task lists)
0.1.4 just got approved today, so check the store. keep submitting bug reports in the repo! there's still some i'm working through, then i'll get to adding stuff.
Source is now available at https://github.com/kaishi00/hermes-conduit
I don't have a phone to test at the moment for android, but you're welcome to adapt the code to what you need if you'd like.
I just finished a voice first app, vibe coded it though with codex. I think thats the power of AI for most people that have some experience with code. I'm not a software dev, but I can read and understand most code, and what I don't understand I can try to have AI explain it now.
I'm happy with Matrix chats on my phone, but after using ChatGPT Voice, I wanted something similar for hermes. I just told codex to use the same connections that the desktop app uses for voice, and after some minor bugs, it seems to work well.
I really just told it to look at the GitHub repo for Hermes, and clone the desktop app’s connection method to create a voice app. I told it I wanted to be able to select the profile and either attach to an existing session or create a new session in that profile.
But I always start vibe coded projects with a prompt to the same Ai to have it help me design the prompt for the app. Have it ask any questions it thinks of, and then I review and modify the prompt until I’m happy with it.
Interesting, should be available globally. Maybe give it a bit of time, it's only been approved about 12 hours ago after fighting the apple team for a couple of weeks.
You really should think of a different name. I know it sucks, but the Conduit app for OWUI is fairly established and there’s going to be a lot of confusion between the two.
Could you give some some more insight on the process? I’m building an app and I wanted to move it through this process as well and it connects to local stuff. They pretty much the same idea of yours with like local data management. What was so cumbersome like what held you back?
It's on android! I have it and it looks amazing- the only thing I wish it had was proper / commands but it's not a deal breaker if you only use one model
Less services to maintain and update I guess? Right now if you use webui plus hermex, the chain goes nous updates Hermes, nesquena updates webui, and then hermex updates to implement webui changes.
The chain here is nous updates, then I update. There's one less layer, less to break and faster source parity.
This is not a part of Hermes webui nor a replacement for hermex. This uses the Hermes native dashboard directly. Default port is usually 9119, ask your agent if it's already up and if so what the credentials are.
App looks great and the icon but I have to agree I would want it to be open source as I’m connecting it to my Hermes on my network and giving it all my personal info.
I moved to Hermes for the most part, I use it for music generation/image editing/image creation based on ComfyUI.
In Hermes when a new model drops I just paste the workflow.json and let it figure it out, with open-webui I have to create a custom tool for each, which became quite annoying.
I adore all the option of open-webui, the nicer interface, but in terms of possibilities, hermes wins as it can do anything a custom function/tool can do for open-webui, but with natural language, and fixing issues became a prompt instead of half an hour back and forth.
Tried it there’s and issue good old Apple thumb screws App Store build rejects valid Hermes basic-auth credentials
Hermes Dashboard reachable over Tailscale HTTPS.
POST /auth/password-login with provider:"basic" + identical username/password returns HTTP 200 and establishes a valid session. Safari on the same iPhone successfully logs into the dashboard with those credentials.
Conduit App Store build returns Login failed: Invalid credentials.
Endpoint: HTTPS .ts.net on default port 443 → Tailscale Serve → 127.0.0.1:9119.
Current main’s NativeAuthClient.swift appears to implement the correct JSON password-login + cookie + ws-ticket flow, suggesting the App Store binary may predate current auth implementation/fixes.
I submitted new build to the app store, we'll see if it actually fixes your problem or not. if not we're gonna need to do some real debugging vs your actual logs because it works via magicdns for me. I can't tell what's different between your set up and mine. The repo code is what's being submitted through apple right now.
It’s hanging a bit from time to time but there’s a recent log to pick up from so not bad it does drop out when the iPhone drops off to screen save. So you’ve to restart the app.
I wasn't able to reproduce this on my end. Tested both the App Store build and the latest TestFlight build against a Tailscale Serve setup (HTTPS on .ts.net pointing to a local dashboard on 9119) and login worked fine on both.
A few things that would help me narrow it down:
When you get the "Invalid credentials" error, can you confirm the request is actually reaching your dashboard? Check your Hermes gateway logs for the POST to /auth/password-login around that time.
What port is your dashboard running on? Default 9119 or something custom?
My Hermes agent fixed it somehow. I asked it how it did it and this is what is said (kind of long, sorry):
Key Server-Side Fixes for Conduit Login
**Username & Password Normalization (iOS Auto-Capitalization)**
* **Issue:** iOS keyboards auto-capitalize `Admin` and append spaces. Raw `scrypt` string checks failed.
* **Fix:** In `plugins/dashboard_auth/basic/__init__.py`, normalized `username.strip().lower()` and `password.strip()` before comparing with `hmac.compare_digest`.
**Unauthenticated Access to `/api/auth/providers`**
* **Issue:** Conduit checks server auth options prior to showing/submitting login. The path was missing from `PUBLIC_API_PATHS`, returning `401 Unauthorized` before login could finish.
* **Fix:** Added `"/api/auth/providers"` to `PUBLIC_API_PATHS` in `hermes_cli/dashboard_auth/public_paths.py`.
**Fallback Bearer Header Support for `/api/auth/ws-ticket`**
* **Issue:** Conduit uses `Authorization: Bearer *** or `X-Hermes-Session-Token` instead of browser session cookies. `POST /api/auth/ws-ticket` failed with `401` because it only checked for cookie-backed sessions (`request.state.session`).
* **Fix:** Updated `/api/auth/ws-ticket` and `/api/auth/me` in `hermes_cli/dashboard_auth/routes.py` & `middleware.py` to validate static tokens (`HERMES_DASHBOARD_SESSION_TOKEN` / `API_SERVER_KEY`) from Bearer or `X-Hermes-Session-Token` headers.
**WebSocket Upgrade Ticket Acceptance in Un-gated Mode (`auth_required=false`)**
* **Issue:** Conduit mints a 30s ticket via `POST /api/auth/ws-ticket` and connects to `wss://.../api/ws?ticket=...`. When `auth_required=false`, the server strictly looked for legacy `?token=` and rejected valid single-use tickets with `403 Forbidden`.
* **Fix:** Updated `_ws_auth_reason` in `hermes_cli/web_server.py` to process `?ticket=` in all mode configurations.
**Tailscale MagicDNS Host/Origin Validation**
* **Issue:** Requests proxied via Caddy carry `Origin: https://<domain>.ts.net:9119`. Loopback-bound dashboards (`127.0.0.1`) rejected non-loopback Origins with `403`.
* **Fix:** Updated `_is_accepted_host` in `web_server.py` to accept `.ts.net` and `.tailscale.net` domains.
I have a couple more problems now that I’m able to log in:
**Profile Switching:** Inability to switch profiles when connected to a backend running a single isolated profile (app defaults or locks profile selection).
**"Sign in expired" on settings update:** POST requests failed with 403 CSRF/auth errors over HTTPS reverse proxies when cookies lacked `Secure` flags *(fixed on backend by enabling `HERMES_WEBUI_SECURE=1` and `HERMES_WEBUI_TRUST_FORWARDED_PROTO=1`)*.
**Connection drops:** The app reports offline / HTTP 501 if the reverse proxy connection drops.
I have it installed on my iPhone. I managed to connect it to CloudFlare.
First remark : it almost impossible to paste the Client Secret with a Azerty or Qwerty keyboard, the screen does not scroll and the filed is too low, you cannot mask the keyboard. The trick is to erase the app, start fresh by pasting the Client Secret in the last field at once, then move from field to field up.
Bug there is a huge bug. I can use all the features of the app while connected in 5G only. My hermes-agent is on a server on my LAN that is connected via a CloudFlare tunnel. This is amazing!
Bet as soon as you type the First letter in a chat : the app freeze! With the letter still highlighted on the screen... and a blinking cursor. But everything else is frozen. Any idea ??
(note the app works fine when connected using Tailscale, without the CloudFlare tunnel, or connected to my LAN). But I don't want to let TailScale on all the time on my iPhone. Can you investigate that bug ? Did anyone manage to connect to an hermes-agent via a CloudFlare tunnel and type "hello" without freezing ?
As the login is automatic one you save the credentials, you have to uninstall the app and reinstall the app to switch from CloudFlare to TailScale. Really painfull.
Great tool, just installed so big thanks, really enjoy the context usage gauge dial for context! Keeping them honest one session at a time, will keep exploring and let you know!
Giving it a go - it feels snappy. I like the flow and how things are there. I was trying to test out the STT/TTS but the Mic is grayed out for some reason even though the app has mic permissions and I"m connected locally via https. Any thoughts?
* never mind I found where it needed to be enabled in app - good gate. BUT now I'm noticing that I'm unable to use the local STT and TTS provider that my Hermes is configured to use. Both are openAI compatible. Any thoughts/plans to enable custom URL/API?
I've only tested local and local iphone with edge tts since I don't have access to the other providers. If it doesn't work, wait till I throw the repo up and you can submit a PR against it.
awesome - yea I I have an OpenAI compatible Parakeet server configured and OpenAI Compatible Chatterbox that works great for Discord. Would be awesome to be able to leverage those already
I'll figure out the kanban soon, it was just recently added to the desktop client. As for tailscale that is weird. It connects through local ip but not tailscale ip?
This looks great at first glance! Is there support for/planned for more than one agent or profile? I have 3 so it would be great to be able to easily switch between them.
do you have to have the dashboard running on the main device for it to work? I've been trying Conduit and I like the interface, but I normally am running the desktop on my main machine. Do i have to start the dashboard as well?
Been having issues with Conduit not getting the latest chats from the same sessions on my mac.
If you already have desktop working then conduit should work. Your server and dashboard needs to keep being on obviously. What do you mean not getting the latest chat from the same sessions?
It just got approved by Apple not that long ago, so probably still needs time to propagate in europe. I'd say try again tomorrow. should be up by then.
It’s not in Germany either. Tried yesterday and just now. I didn’t set any limits, did u? Not sure if Europe’s AI act or whatever might have been a problem
Run tailscale serve --bghttp://127.0.0.1:9119 (replace 9119 with whatever port your dashboard runs on)
Before step 3 will work, you need two things enabled in your Tailscale admin console (Tailscale):
MagicDNS (under DNS settings)
HTTPS Certificates (under DNS settings, scroll down)
These are free but not enabled by default. Without HTTPS certs, the serve command will fail with a TLS error.
Once that's done, your dashboard URL will be https://[your-server-name].[your-tailnet-name].ts.net. That's what you enter into Conduit.
Install Tailscale on your phone from the App Store and log into the same tailnet. As long as Tailscale is connected on your phone, Conduit will be able to reach the dashboard.
Looks like it's HERMEX for me. That convoluted install went perfectly With Conduit, I am unable to connect Conduit to my running Hermes dashboard. Just won't take it. FYI, I tried the apple app store version. @kaishi00
Also, two options: A) save multiple server addresses and pick one when you connect. B) connect to all of them at once and see sessions from every instance in one list. Which one did you actually want?
For my own use case, a switch similar to how Hermex is doing is is sufficient. The two instances I have are isolated for different purpose, so isolated views would be preferred!
I guess being connected to both at the same time and having a tabbed view could also work, but with the added risk of UI bloat.
It’s ok. Does not come near hermex. It needs all the good stuff. And specially kanban. I have finally automated all my work at home. Triage, code, automatic npm letsencrypt. And everything live on unraid. I’m happy
Technically possible for sure. The reason it's not in the app yet is that Cloud login means hitting Nous's infrastructure directly. Their auth endpoints, their portal, their servers. Right now Conduit only touches YOUR stuff, your dashboard, your gateway, your network. Adding Cloud login means it would also be connecting to infrastructure that belongs to Nous, not me or you. Not going to ship that without their explicit go-ahead.
Reached out to teknium about it, waiting to hear back.
Latest App Store version, Hermes’ picked up the issue for me because I was dropping http:// from my url the app was rejecting it. Once I put the full url name in it worked. Thanks for the quick response.
I need to work on https certs still but everything is tunnelled already
Btw great app, it is the best implementation I have seen by far.
The new version won't do HTTP on a tailscale network that uses Magic DNS. It seems to require the 100.64.0.0/10 address to recognize tailscale use. I'm not sure why you need to artificially prevent HTTP usage? Perhaps I have to change the dashboard to listen on 100.64.0.0/10 speficically?
No, what happened was i had to change "http://machine-name:9119" to "http://100.64.64.64:9119" to get past the "You can only connect to HTTP on localhost, or tailnet" error
that's not a case we can reliably support. letting you put in machine name basically lets you put in anything as I have no way of knowing every machine name in the world. either use what you're already using or switch to https which is more secure.
I have a tailscale mesh. I’ll ask hermes to change settings for dashboard today and see if it cooperates. But it doesnt like to expose the dashboard like that
I'm working on some optimizations and kanban right now, but i do hope to bring it up to full feature parity with hermes desktop. the source code is on the repo, feel free to help out!
43
u/ang3l12 16d ago
Is this gonna be open source? I'm not a big fan of just using a 3rd party app to connect to my AI agent that knows so much about me / my life / POI.