Hermes Desktop Can Fail to Bootstrap on Windows 11 When Smart App Control Blocks Embedded Python (#63796)
Bug Tracker — July 13, 2026. A reported Windows security-policy interaction can stop Hermes Desktop from starting and present a misleading dependency diagnosis instead of identifying that Application Control blocked the embedded runtime.
Issue Summary
Issue #63796 reports that, with Windows 11 Smart App Control enabled, embedded Python cannot import _ssl because Application Control blocks the relevant DLL. Desktop then reports missing FastAPI or uvicorn dependencies, enters a repair loop, and never starts. The reported root cause is a security-policy-blocked runtime, not absent packages; affected users experience total Desktop failure. A linked PR is #63810.
Observed Failure Path
| Step | Reported Behavior | User-Level Consequence |
|---|---|---|
| Desktop boot | Embedded Python attempts to import _ssl. | Normal startup depends on the runtime loading its SSL component. |
| Windows policy enforcement | Smart App Control blocks the DLL through Application Control. | Runtime initialization fails before the application can serve. |
| Diagnostic path | Desktop attributes failure to missing FastAPI/uvicorn. | User receives an inaccurate remediation direction. |
| Repair behavior | Application repeats repair attempts without resolving the policy block. | Desktop remains unusable and the loop obscures the actual cause. |
Operational Impact
Classification: P2. This page summarizes a publicly reported issue; scope and remediation status can change as the upstream project investigates and merges fixes. Teams should validate their own configuration and deployment before treating a workaround or update as complete.
Mitigation and Verification
- On Windows 11 devices using Smart App Control, test a clean Desktop bootstrap and collect authorized startup logs before attempting dependency repairs.
- Differentiate blocked binaries or DLLs from missing Python packages in diagnostics; surface the policy event and a clear remediation boundary.
- Verify the upstream fix path referenced by PR #63810 in an environment where Smart App Control is enabled.
- After any update, confirm both first launch and restart work without a repeated repair cycle.
Source Evidence
Primary issue: NousResearch/hermes-agent issue #63796 (linked PR #63810)
For a managed-agent comparison, the relevant question is whether platform-policy failures and message-routing gaps fail clearly, preserve recoverability, and remain observable to operators—not only whether the happy path works.