fix(desktop): pass InstallRoot to post-update verify instead of cwd

[KeErBo]

Summary

The Windows Desktop update hand-off (scripts/desktop-update/windows.ps1) runs its post-update verification as:

$verifyCode = "import hermes_cli.main; from pathlib import Path; from hermes_cli.desktop_update_verify import verify_windows_desktop_update; verify_windows_desktop_update(Path.cwd())"
$verify = Invoke-HermesStep $pythonExe @("-c", $verifyCode) "verify"

But the hand-off is spawned with cwd: HERMES_HOME (see apps/desktop/electron/main.ts), which is one level above the checkout root HERMES_HOME/hermes-agent that verify_windows_desktop_update expects.

verify_windows_desktop_update resolves apps/desktop/release under the path it is given, so Path.cwd() points at HERMES_HOME/apps/desktop/... — which does not exist. The verify then raises:

RuntimeError: The updated Desktop executable is missing

…and the hand-off exits with code 8, even though hermes update itself succeeded and the desktop app was rebuilt and packaged correctly.

Root cause

The verify step relies on the process working directory instead of the explicit -InstallRoot argument the script already receives. The hand-off's cwd is HERMES_HOME, not the checkout root.

Fix

Pass $InstallRoot explicitly as sys.argv[1]:

$verifyCode = "import sys, hermes_cli.main; from pathlib import Path; from hermes_cli.desktop_update_verify import verify_windows_desktop_update; verify_windows_desktop_update(Path(sys.argv[1]))"
$verify = Invoke-HermesStep $pythonExe @("-c", $verifyCode, $InstallRoot) "verify"

Test plan

• Added a source-level regression test (test_verify_step_passes_install_root_not_cwd) guarding that the verify step never falls back to Path.cwd() and always forwards $InstallRoot.
• pytest tests/test_desktop_update_windows_python_handoff.py — 5 passed.
• Manually reproduced the failure with Path.cwd() (exit 1) and confirmed the fix resolves the checkout root correctly (exit 0).

[alt-glitch]

This was generated by AI during triage.

Duplicate of #105454 -- same mechanism (pass the explicit $InstallRoot to verify_windows_desktop_update instead of Path.cwd()), which also appears in #105682. Alternative fixes for the same #105145 failure: #105168 (pins the working directory) and #105599. Five open PRs now target this one-line cause; maintainers should pick one.

[teknium1]

Resolved on main by #106175 (c32e0ac), salvaging @fangliquanflq’s earlier #105168 with authorship preserved. The handoff now sets the native process cwd to InstallRoot before launching update/verification children, retaining all integrity checks. Native Windows regression coverage exercises the production call: neutralizing it reproduces the wrong cwd; restoring it passes all 15 related tests. Receipt: https://github.com/NousResearch/hermes-agent/actions/runs/34293439570. Thanks @KeErBo for the fix and investigation. Closing this superseded proposal to consolidate the resolved cwd bug.