fix(desktop): build hermes-desktop with corrected Electron 43.6.0 headers hash
Upstream hermes-agent v2026.8.31 pins sha256-f8bSb… for the artifacts.electronjs.org v43.6.0 headers tarball. The CDN swapped that artifact, breaking every desktop build with a fixed-output derivation hash mismatch (specified f8bSb… vs got xDgc5…). Local copy of upstream nix/desktop.nix with: - verified hash for electron 43.6.0 (nix store prefetch-file) - per-version hash map with a loud throw for unknown versions - icon/desktop-entry paths resolved against the flake input checkout Remove once upstream ships the corrected hash and the hermes-agent input is bumped past that release.
This commit is contained in:
m3tam3re
@@ -0,0 +1,244 @@
|
||||
# hermes-desktop.nix — local copy of hermes-agent's nix/desktop.nix
|
||||
#
|
||||
# WORKAROUND for an upstream build failure (hermes-agent v2026.8.31):
|
||||
#
|
||||
# Upstream pins sha256-f8bSbLRmtbP93CJAvEBs+sHWDZ1xP2bcpLhC1EnOmZU=
|
||||
# for https://artifacts.electronjs.org/headers/dist/v43.6.0/node-v43.6.0-headers.tar.gz
|
||||
# The Electron CDN swapped that artifact, so the pinned hash no longer
|
||||
# matches what the server serves today (verified 2026-09-12 via
|
||||
# `nix store prefetch-file`). Upstream has fixed this class of breakage
|
||||
# repeatedly ("fix electron headers sha" commits); main is not fixed yet.
|
||||
#
|
||||
# Differences from upstream nix/desktop.nix:
|
||||
# 1. electron headers sha256 per electron version, with a clear throw
|
||||
# for unknown versions (upstream hardcodes one hash).
|
||||
# 2. icon.png / linux_desktop_entry.py resolve against `hermesSrc`
|
||||
# (the flake input checkout) instead of relative repo paths.
|
||||
#
|
||||
# REMOVE THIS FILE and the hermesDesktopFixed let-binding in default.nix
|
||||
# once upstream ships the corrected hash and the hermes-agent input is
|
||||
# bumped past that release.
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
stdenv,
|
||||
makeWrapper,
|
||||
hermesNpmLib,
|
||||
electron,
|
||||
hermesAgent,
|
||||
python3,
|
||||
# Checkout of the hermes-agent flake input (outPath), used for files
|
||||
# that upstream references with relative paths inside its own repo.
|
||||
hermesSrc,
|
||||
# Environment to bake into the launcher. A GUI launcher reads none of the
|
||||
# shell profile, so a variable that an interactive shell exports does not
|
||||
# reach an app that the desktop menu starts. The Home Manager module passes
|
||||
# HERMES_HOME and HERMES_MANAGED here, which gives the app the same state
|
||||
# directory as the services.
|
||||
extraEnv ? {},
|
||||
# Shell lines to run before the app starts. A secret belongs here and never
|
||||
# in extraEnv: makeWrapper writes a --set value into the Nix store, which
|
||||
# all users can read. A --run line reads the value from a runtime path at
|
||||
# each start instead.
|
||||
extraRun ? [],
|
||||
...
|
||||
}: let
|
||||
# Each flag goes on its own continued line, and the leading backslash is
|
||||
# inside the generated string. An empty attribute set then adds no text
|
||||
# at all, and cannot leave a backslash above a blank line. That fault ends the
|
||||
# makeWrapper command early, and the next flag runs as a shell command.
|
||||
extraEnvFlags = lib.concatMapStrings (
|
||||
name: " \\\n --set ${name} ${lib.escapeShellArg (toString extraEnv.${name})}"
|
||||
) (lib.attrNames extraEnv);
|
||||
|
||||
extraRunFlags = lib.concatMapStrings (line: " \\\n --run ${lib.escapeShellArg line}") extraRun;
|
||||
|
||||
# Electron's CDN has re-uploaded header artifacts for the same version
|
||||
# before, which silently changes their hash. Keep one verified hash per
|
||||
# electron version and fail loudly (instead of with a cryptic FOD
|
||||
# mismatch) whenever a bump needs a new one.
|
||||
electronHeaderHashes = {
|
||||
"43.6.0" = "sha256-xDgc5PpkcLpWHnlqVcjBD3SxJKtkUoSGLnJaSSrxJtI=";
|
||||
};
|
||||
|
||||
electronHeaders = pkgs.fetchurl {
|
||||
url = "https://artifacts.electronjs.org/headers/dist/v${electron.version}/node-v${electron.version}-headers.tar.gz";
|
||||
sha256 =
|
||||
electronHeaderHashes.${
|
||||
electron.version
|
||||
}
|
||||
or (throw ''
|
||||
hermes-desktop workaround: no verified Electron headers hash for version ${electron.version}.
|
||||
Run: nix store prefetch-file https://artifacts.electronjs.org/headers/dist/v${electron.version}/node-v${electron.version}-headers.tar.gz
|
||||
and add it to electronHeaderHashes in profiles/contexts/desktop/hermes-desktop.nix (m3ta-home).
|
||||
'');
|
||||
};
|
||||
|
||||
# node-pty ships no Electron-tagged prebuild we can trust to match this
|
||||
# exact nixpkgs electron version, so it's always compiled from source
|
||||
# against Electron's own headers (not whatever Node ran `npm`).
|
||||
targetPlatform =
|
||||
if stdenv.hostPlatform.isDarwin
|
||||
then "darwin"
|
||||
else if stdenv.hostPlatform.isLinux
|
||||
then "linux"
|
||||
else throw "hermes-desktop: unsupported host platform for node-pty staging";
|
||||
|
||||
targetArch =
|
||||
if stdenv.hostPlatform.isAarch64
|
||||
then "arm64"
|
||||
else if stdenv.hostPlatform.isx86_64
|
||||
then "x64"
|
||||
else throw "hermes-desktop: unsupported host arch for node-pty staging";
|
||||
|
||||
# Build the renderer (dist/ + electron/ + package.json).
|
||||
renderer = hermesNpmLib.buildNpmPackage {
|
||||
dirs = [
|
||||
"apps/desktop"
|
||||
"apps/shared"
|
||||
];
|
||||
pname = "hermes-desktop-renderer";
|
||||
|
||||
doCheck = true;
|
||||
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
|
||||
mkdir -p apps/desktop/build
|
||||
|
||||
patchShebangs .
|
||||
|
||||
pushd apps/desktop
|
||||
# typecheck :3
|
||||
npm exec -- tsc -b
|
||||
|
||||
# build the renderer bundle
|
||||
# vite's emptyOutDir wipes dist/ on every run
|
||||
# so it has to be first
|
||||
npm exec -- vite build
|
||||
|
||||
# build the electron bundle
|
||||
node scripts/bundle-electron-main.mjs
|
||||
|
||||
# Compile node-pty against Electron's actual ABI (the nixpkgs
|
||||
# `electron` we ship). Headers come from a pinned fetchurl input
|
||||
# since the sandbox has no network here, so node-gyp's
|
||||
# normal --disturl download path can't run.
|
||||
mkdir -p "$TMPDIR/electron-headers"
|
||||
tar -xzf ${electronHeaders} -C "$TMPDIR/electron-headers" --strip-components=1
|
||||
|
||||
${lib.getExe hermesNpmLib.node-gyp} rebuild \
|
||||
--directory=../../node_modules/node-pty \
|
||||
--build-from-source \
|
||||
--runtime=electron \
|
||||
--target=${electron.version} \
|
||||
--nodedir="$TMPDIR/electron-headers" \
|
||||
--disturl="" \
|
||||
--offline
|
||||
|
||||
# Target platform/arch come from stdenv.hostPlatform, not the
|
||||
# build host's own process.platform/arch.
|
||||
node scripts/stage-native-deps.mjs ${targetPlatform} ${targetArch}
|
||||
popd
|
||||
|
||||
runHook postBuild
|
||||
'';
|
||||
|
||||
checkPhase = ''
|
||||
runHook preCheck
|
||||
|
||||
pushd apps/desktop
|
||||
|
||||
npm run postbuild
|
||||
|
||||
# validate staged node-pty native binary is present.
|
||||
STAGED_PTY_NODE="./dist/node_modules/node-pty/build/Release/pty.node"
|
||||
|
||||
if [ ! -f "$STAGED_PTY_NODE" ]; then
|
||||
echo "FATAL: Missing staged node-pty native binary at $STAGED_PTY_NODE"
|
||||
echo "node-pty must be compiled natively"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
popd
|
||||
|
||||
runHook postCheck
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p $out
|
||||
# vite writes to apps/desktop/dist/ (we cd'd there in buildPhase).
|
||||
# stage-native-deps.mjs stages node-pty into dist/node_modules/node-pty,
|
||||
# so copying dist/ wholesale carries the native dep along with the
|
||||
# esbuild bundle that require()s it. apps/desktop/build was created
|
||||
# before the cd.
|
||||
cp -rn apps/desktop/dist $out/
|
||||
|
||||
echo '{"schemaVersion":1,"commit":"nix-dummy-commit","branch":"nix","dirty":false,"source":"nix"}' > $out/install-stamp.json
|
||||
|
||||
cp -n apps/desktop/package.json $out/
|
||||
runHook postInstall
|
||||
'';
|
||||
};
|
||||
in
|
||||
# Electron wrapper: nixpkgs' electron binary pointed at the renderer dir.
|
||||
stdenv.mkDerivation {
|
||||
pname = "hermes-desktop";
|
||||
inherit (renderer) version;
|
||||
|
||||
dontUnpack = true;
|
||||
dontBuild = true;
|
||||
|
||||
nativeBuildInputs = [
|
||||
makeWrapper
|
||||
python3
|
||||
];
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
mkdir -p $out/share/hermes-desktop $out/bin
|
||||
cp -r ${renderer}/* $out/share/hermes-desktop/
|
||||
|
||||
# Standard nixpkgs pattern for electron-builder apps: patch process.resourcesPath
|
||||
# to point to the app's directory. In Nix, unpackaged electron defaults this
|
||||
# to the electron distribution's resources path, breaking extraResources lookups.
|
||||
substituteInPlace $out/share/hermes-desktop/dist/electron-main.mjs \
|
||||
--replace-fail "process.resourcesPath" "'$out/share/hermes-desktop'"
|
||||
|
||||
# Wrap the nixpkgs electron binary to launch our app. Set
|
||||
# HERMES_DESKTOP_HERMES to the absolute path of the nix-built `hermes`
|
||||
# binary so the desktop's resolver step 4 ("existing Hermes CLI on
|
||||
# PATH") uses our fully wrapped binary — venv with all deps,
|
||||
# bundled skills/plugins, runtime PATH (ripgrep/git/ffmpeg/etc).
|
||||
# No reimplementation of the agent resolver in the wrapper.
|
||||
makeWrapper ${lib.getExe electron} $out/bin/hermes-desktop \
|
||||
--add-flags "$out/share/hermes-desktop" \
|
||||
--set HERMES_DESKTOP_HERMES "${lib.getExe hermesAgent}" \
|
||||
--set ELECTRON_IS_DEV 0${extraEnvFlags}${extraRunFlags}
|
||||
|
||||
# XDG launcher entry
|
||||
mkdir -p $out/share/applications $out/share/icons/hicolor/1024x1024/apps
|
||||
install -m 0644 ${hermesSrc}/apps/desktop/assets/icon.png \
|
||||
$out/share/icons/hicolor/1024x1024/apps/hermes.png
|
||||
export PYTHONPATH=$(mktemp -d)
|
||||
cp ${hermesSrc}/hermes_cli/linux_desktop_entry.py "$PYTHONPATH/linux_desktop_entry.py"
|
||||
export DESKTOP_EXEC="$out/bin/hermes-desktop"
|
||||
export DESKTOP_ICON="$out/share/icons/hicolor/1024x1024/apps/hermes.png"
|
||||
python3 -c 'import os; from linux_desktop_entry import render_desktop_entry; print(render_desktop_entry(os.environ["DESKTOP_EXEC"], os.environ["DESKTOP_ICON"]))' > $out/share/applications/hermes.desktop
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
passthru = {
|
||||
inherit (renderer.passthru) packageJsonPath;
|
||||
};
|
||||
|
||||
meta = with lib; {
|
||||
description = "Native Electron desktop shell for Hermes Agent";
|
||||
homepage = "https://github.com/NousResearch/hermes-agent";
|
||||
license = licenses.mit;
|
||||
platforms = platforms.unix;
|
||||
mainProgram = "hermes-desktop";
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user