fix(windows): unbreak install + update on Windows (3 issues) - #23394
Merged
Conversation
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR #21221 on May 7 and accidentally added back in the v0.13.0 release commit (498bfc7) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
Contributor
🔎 Lint report:
|
| Rule | Count |
|---|---|
unresolved-reference |
1 |
First entries
hermes_cli/tools_config.py:842: [unresolved-reference] unresolved-reference: Name `subprocess` used when not defined
✅ Fixed issues: none
Unchanged: 4250 pre-existing issues carried over.
Diagnostics are surfaced as warnings — this check never fails the build.
4 tasks
JinyuID
pushed a commit
to JinyuID/hermes-agent
that referenced
this pull request
May 11, 2026
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR NousResearch#21221 on May 7 and accidentally added back in the v0.13.0 release commit (6c84a68) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
dusterbloom
pushed a commit
to dusterbloom/hermes-agent
that referenced
this pull request
May 12, 2026
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR NousResearch#21221 on May 7 and accidentally added back in the v0.13.0 release commit (498bfc7) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
02356abc
pushed a commit
to 02356abc/hermes-agent
that referenced
this pull request
May 14, 2026
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR NousResearch#21221 on May 7 and accidentally added back in the v0.13.0 release commit (498bfc7) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
jsboige
pushed a commit
to jsboige/hermes-agent
that referenced
this pull request
May 14, 2026
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR NousResearch#21221 on May 7 and accidentally added back in the v0.13.0 release commit (e53cc80) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
AlexFoxD
pushed a commit
to AlexFoxD/hermes-agent
that referenced
this pull request
May 21, 2026
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR NousResearch#21221 on May 7 and accidentally added back in the v0.13.0 release commit (498bfc7) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
gweeteve
pushed a commit
to gweeteve/hermes-agent
that referenced
this pull request
Jun 2, 2026
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR NousResearch#21221 on May 7 and accidentally added back in the v0.13.0 release commit (498bfc7) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
Seven74AI
pushed a commit
to Seven74AI/hermes-agent
that referenced
this pull request
Jun 13, 2026
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR NousResearch#21221 on May 7 and accidentally added back in the v0.13.0 release commit (498bfc7) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
T02200059
pushed a commit
to T02200059/hermes-agent
that referenced
this pull request
Jun 18, 2026
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR NousResearch#21221 on May 7 and accidentally added back in the v0.13.0 release commit (e53cc80) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
Three issues hit during a fresh Windows install + first `hermes update`: 1. `pyproject.toml` re-introduced the invalid `exclude-newer = "7 days"` under [tool.uv]. uv requires an RFC 3339 / ISO date — relative-duration strings parse-fail. The line was removed in PR NousResearch#21221 on May 7 and accidentally added back in the v0.13.0 release commit (498bfc7) the same day. Every uv invocation throughout install logged a TOML parse error, confusing users into thinking the install was broken. Fix: remove the line (and the now-empty [tool.uv] section). 2. `hermes update` failed on Windows with `Access is denied. (os error 5)` when uv tried to overwrite `venv\\Scripts\\hermes.exe` — the running entry-point shim. Windows blocks REPLACE on a mapped/loaded executable but allows RENAME (kernel tracks the file by handle, not path; same trick Chrome/Firefox use for self-update). Pre-rename live shims to `hermes.exe.old.<unix-ms>` before each `uv pip install -e .`; uv writes a fresh shim at the original path; the .old files are swept on the next hermes invocation. Wraps every install attempt (primary, base-only fallback, and per-extra retries). Restores shims if uv fails before writing replacements. 3. Tools post-setup hooks (ddgs, piper-tts, kittentts, langfuse, tinker-atropos) shelled out to `[sys.executable, '-m', 'pip', ...]` and died with `No module named pip` on every fresh Windows install. install.ps1 creates the venv via `uv venv` which doesn't seed pip; install.ps1 bootstraps pip later, but only inside the platform-SDK verify block — by then the wizard's post-setup hooks have already run and failed. New `_pip_install` helper tries uv pip first (works in pip-less venvs), then python -m pip, then ensurepip-bootstrap-then-pip. All five post-setup sites now route through it. E2E: - uv pip compile pyproject.toml — no parse warning - quarantine + cleanup with simulated Windows scripts dir; rollback works when uv install fails before writing replacement shim - _pip_install in a real `uv venv`-created (pip-less) venv: bootstraps pip via ensurepip and completes the install Tests: tests/hermes_cli/ — 4135 pass, 8 pre-existing failures on main unrelated to this PR (kanban_boards, openclaw_migration, update_gateway_restart, web_server PluginAPIAuth).
This was referenced Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fresh Windows install + first `hermes update` had three blocker-class issues. This unblocks all three.
What broke
1. `pyproject.toml` had `exclude-newer = "7 days"` re-introduced. uv needs an RFC 3339 / ISO date; relative duration strings parse-fail. Was removed in #21221 on May 7, accidentally re-added in the v0.13.0 release commit `498bfc7bc1` the same day. Every uv invocation during install logged a TOML parse error.
2. `hermes update` deadlocked on Windows. `uv pip install -e .` tried to overwrite `venv\Scripts\hermes.exe` — the running shim — and failed with `Access is denied. (os error 5)`. Windows blocks REPLACE on a mapped exe but allows RENAME (Chrome/Firefox use this trick for self-update).
3. Post-setup hooks died with `No module named pip`. `uv venv` doesn't seed pip. `install.ps1` bootstraps pip later but only AFTER the wizard runs, so `_run_post_setup("ddgs")` (and piper, kittentts, langfuse, tinker) shelled out to `python -m pip` and crashed during the wizard.
Changes
Validation (E2E)
Test suite
`tests/hermes_cli/` — 4135 pass. 8 pre-existing failures on `origin/main` unrelated to this PR (verified by re-running on stashed-clean main): `test_kanban_boards`, `test_setup_openclaw_migration` (2), `test_update_gateway_restart` (3), `test_web_server::TestPluginAPIAuth`, `test_update_hangup_protection` (cross-test contamination, passes in isolation).
Why `exclude-newer` keeps coming back
The line was added in `dce2b0dfa`, removed by #21221's salvage merge `d8d57fb2f`, then re-added in the release commit `498bfc7bc1` 7 hours later. Likely root cause: hand-edit during the v0.13.0 version bump regenerated the file from an outdated working copy. Worth a release-script audit separately.