feat(cli): warn on unsupported pip installs + fix stale update-check cache (#34491) - #34846
Merged
Conversation
…orkaround The execute_code sandbox-child env scrub (1083977, #27303) deliberately dropped the broad HERMES_ prefix passthrough, keeping only an operational 4-var allowlist (HERMES_HOME/PROFILE/CONFIG/ENV). A script that relied on a non-secret HERMES_* var (HERMES_BASE_URL, HERMES_KANBAN_DB, HERMES_*_WEBHOOK, or a plugin-defined one) now sees it unset in the child. Document the behavior change and the two recovery routes (terminal.env_passthrough in config.yaml, or required_environment_variables in skill frontmatter), plus the debug log line that surfaces the drop for diagnosis.
…cache after pip upgrade Banner now shows a yellow warning when detect_install_method() == 'pip': 'pip install hermes-agent' isn't the supported install path (it exists on PyPI for internal/CI reasons), so updates and issue support don't behave correctly. Reuses existing install-method detection; warn, never block. Also fixes #34491: check_for_updates() keyed its 6h cache only on ts+rev. On the pip path (no HERMES_REVISION), rev is always None, so a 'pip install --upgrade' changed VERSION but left the cache valid — the stale 'N commits behind' count survived the upgrade. Cache now also keys on the installed VERSION and invalidates on mismatch.
Contributor
🔎 Lint report:
|
alt-glitch
added
type/feature
KKT-OPT
pushed a commit
to KKT-OPT/hermes-agent
that referenced
this pull request
May 31, 2026
…cache (NousResearch#34491) (NousResearch#34846) * docs(code-execution): document HERMES_* env narrowing + passthrough workaround The execute_code sandbox-child env scrub (1083977, NousResearch#27303) deliberately dropped the broad HERMES_ prefix passthrough, keeping only an operational 4-var allowlist (HERMES_HOME/PROFILE/CONFIG/ENV). A script that relied on a non-secret HERMES_* var (HERMES_BASE_URL, HERMES_KANBAN_DB, HERMES_*_WEBHOOK, or a plugin-defined one) now sees it unset in the child. Document the behavior change and the two recovery routes (terminal.env_passthrough in config.yaml, or required_environment_variables in skill frontmatter), plus the debug log line that surfaces the drop for diagnosis. * feat(cli): warn on unsupported pip installs + fix stale update-check cache after pip upgrade Banner now shows a yellow warning when detect_install_method() == 'pip': 'pip install hermes-agent' isn't the supported install path (it exists on PyPI for internal/CI reasons), so updates and issue support don't behave correctly. Reuses existing install-method detection; warn, never block. Also fixes NousResearch#34491: check_for_updates() keyed its 6h cache only on ts+rev. On the pip path (no HERMES_REVISION), rev is always None, so a 'pip install --upgrade' changed VERSION but left the cache valid — the stale 'N commits behind' count survived the upgrade. Cache now also keys on the installed VERSION and invalidates on mismatch.
1 task
alt-glitch
pushed a commit
that referenced
this pull request
Jun 14, 2026
…cache (#34491) (#34846) * docs(code-execution): document HERMES_* env narrowing + passthrough workaround The execute_code sandbox-child env scrub (2333dad, #27303) deliberately dropped the broad HERMES_ prefix passthrough, keeping only an operational 4-var allowlist (HERMES_HOME/PROFILE/CONFIG/ENV). A script that relied on a non-secret HERMES_* var (HERMES_BASE_URL, HERMES_KANBAN_DB, HERMES_*_WEBHOOK, or a plugin-defined one) now sees it unset in the child. Document the behavior change and the two recovery routes (terminal.env_passthrough in config.yaml, or required_environment_variables in skill frontmatter), plus the debug log line that surfaces the drop for diagnosis. * feat(cli): warn on unsupported pip installs + fix stale update-check cache after pip upgrade Banner now shows a yellow warning when detect_install_method() == 'pip': 'pip install hermes-agent' isn't the supported install path (it exists on PyPI for internal/CI reasons), so updates and issue support don't behave correctly. Reuses existing install-method detection; warn, never block. Also fixes #34491: check_for_updates() keyed its 6h cache only on ts+rev. On the pip path (no HERMES_REVISION), rev is always None, so a 'pip install --upgrade' changed VERSION but left the cache valid — the stale 'N commits behind' count survived the upgrade. Cache now also keys on the installed VERSION and invalidates on mismatch.
T02200059
pushed a commit
to T02200059/hermes-agent
that referenced
this pull request
Jun 18, 2026
…cache (NousResearch#34491) (NousResearch#34846) * docs(code-execution): document HERMES_* env narrowing + passthrough workaround The execute_code sandbox-child env scrub (49f3f14, NousResearch#27303) deliberately dropped the broad HERMES_ prefix passthrough, keeping only an operational 4-var allowlist (HERMES_HOME/PROFILE/CONFIG/ENV). A script that relied on a non-secret HERMES_* var (HERMES_BASE_URL, HERMES_KANBAN_DB, HERMES_*_WEBHOOK, or a plugin-defined one) now sees it unset in the child. Document the behavior change and the two recovery routes (terminal.env_passthrough in config.yaml, or required_environment_variables in skill frontmatter), plus the debug log line that surfaces the drop for diagnosis. * feat(cli): warn on unsupported pip installs + fix stale update-check cache after pip upgrade Banner now shows a yellow warning when detect_install_method() == 'pip': 'pip install hermes-agent' isn't the supported install path (it exists on PyPI for internal/CI reasons), so updates and issue support don't behave correctly. Reuses existing install-method detection; warn, never block. Also fixes NousResearch#34491: check_for_updates() keyed its 6h cache only on ts+rev. On the pip path (no HERMES_REVISION), rev is always None, so a 'pip install --upgrade' changed VERSION but left the cache valid — the stale 'N commits behind' count survived the upgrade. Cache now also keys on the installed VERSION and invalidates on mismatch.
waefrebeorn
pushed a commit
to waefrebeorn/slermes
that referenced
this pull request
Jul 2, 2026
…cache (NousResearch#34491) (NousResearch#34846) * docs(code-execution): document HERMES_* env narrowing + passthrough workaround The execute_code sandbox-child env scrub (d76310c, NousResearch#27303) deliberately dropped the broad HERMES_ prefix passthrough, keeping only an operational 4-var allowlist (HERMES_HOME/PROFILE/CONFIG/ENV). A script that relied on a non-secret HERMES_* var (HERMES_BASE_URL, HERMES_KANBAN_DB, HERMES_*_WEBHOOK, or a plugin-defined one) now sees it unset in the child. Document the behavior change and the two recovery routes (terminal.env_passthrough in config.yaml, or required_environment_variables in skill frontmatter), plus the debug log line that surfaces the drop for diagnosis. * feat(cli): warn on unsupported pip installs + fix stale update-check cache after pip upgrade Banner now shows a yellow warning when detect_install_method() == 'pip': 'pip install hermes-agent' isn't the supported install path (it exists on PyPI for internal/CI reasons), so updates and issue support don't behave correctly. Reuses existing install-method detection; warn, never block. Also fixes NousResearch#34491: check_for_updates() keyed its 6h cache only on ts+rev. On the pip path (no HERMES_REVISION), rev is always None, so a 'pip install --upgrade' changed VERSION but left the cache valid — the stale 'N commits behind' count survived the upgrade. Cache now also keys on the installed VERSION and invalidates on mismatch.
santhreal
pushed a commit
to santhreal/hermes-agent
that referenced
this pull request
Jul 13, 2026
…cache (NousResearch#34491) (NousResearch#34846) * docs(code-execution): document HERMES_* env narrowing + passthrough workaround The execute_code sandbox-child env scrub (695298e, NousResearch#27303) deliberately dropped the broad HERMES_ prefix passthrough, keeping only an operational 4-var allowlist (HERMES_HOME/PROFILE/CONFIG/ENV). A script that relied on a non-secret HERMES_* var (HERMES_BASE_URL, HERMES_KANBAN_DB, HERMES_*_WEBHOOK, or a plugin-defined one) now sees it unset in the child. Document the behavior change and the two recovery routes (terminal.env_passthrough in config.yaml, or required_environment_variables in skill frontmatter), plus the debug log line that surfaces the drop for diagnosis. * feat(cli): warn on unsupported pip installs + fix stale update-check cache after pip upgrade Banner now shows a yellow warning when detect_install_method() == 'pip': 'pip install hermes-agent' isn't the supported install path (it exists on PyPI for internal/CI reasons), so updates and issue support don't behave correctly. Reuses existing install-method detection; warn, never block. Also fixes NousResearch#34491: check_for_updates() keyed its 6h cache only on ts+rev. On the pip path (no HERMES_REVISION), rev is always None, so a 'pip install --upgrade' changed VERSION but left the cache valid — the stale 'N commits behind' count survived the upgrade. Cache now also keys on the installed VERSION and invalidates on mismatch.
donbowman
pushed a commit
to donbowman/hermes-agent
that referenced
this pull request
Jul 13, 2026
…cache (NousResearch#34491) (NousResearch#34846) * docs(code-execution): document HERMES_* env narrowing + passthrough workaround The execute_code sandbox-child env scrub (1083977, NousResearch#27303) deliberately dropped the broad HERMES_ prefix passthrough, keeping only an operational 4-var allowlist (HERMES_HOME/PROFILE/CONFIG/ENV). A script that relied on a non-secret HERMES_* var (HERMES_BASE_URL, HERMES_KANBAN_DB, HERMES_*_WEBHOOK, or a plugin-defined one) now sees it unset in the child. Document the behavior change and the two recovery routes (terminal.env_passthrough in config.yaml, or required_environment_variables in skill frontmatter), plus the debug log line that surfaces the drop for diagnosis. * feat(cli): warn on unsupported pip installs + fix stale update-check cache after pip upgrade Banner now shows a yellow warning when detect_install_method() == 'pip': 'pip install hermes-agent' isn't the supported install path (it exists on PyPI for internal/CI reasons), so updates and issue support don't behave correctly. Reuses existing install-method detection; warn, never block. Also fixes NousResearch#34491: check_for_updates() keyed its 6h cache only on ts+rev. On the pip path (no HERMES_REVISION), rev is always None, so a 'pip install --upgrade' changed VERSION but left the cache valid — the stale 'N commits behind' count survived the upgrade. Cache now also keys on the installed VERSION and invalidates on mismatch.
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
…cache (NousResearch#34491) (NousResearch#34846) * docs(code-execution): document HERMES_* env narrowing + passthrough workaround The execute_code sandbox-child env scrub (1083977, NousResearch#27303) deliberately dropped the broad HERMES_ prefix passthrough, keeping only an operational 4-var allowlist (HERMES_HOME/PROFILE/CONFIG/ENV). A script that relied on a non-secret HERMES_* var (HERMES_BASE_URL, HERMES_KANBAN_DB, HERMES_*_WEBHOOK, or a plugin-defined one) now sees it unset in the child. Document the behavior change and the two recovery routes (terminal.env_passthrough in config.yaml, or required_environment_variables in skill frontmatter), plus the debug log line that surfaces the drop for diagnosis. * feat(cli): warn on unsupported pip installs + fix stale update-check cache after pip upgrade Banner now shows a yellow warning when detect_install_method() == 'pip': 'pip install hermes-agent' isn't the supported install path (it exists on PyPI for internal/CI reasons), so updates and issue support don't behave correctly. Reuses existing install-method detection; warn, never block. Also fixes NousResearch#34491: check_for_updates() keyed its 6h cache only on ts+rev. On the pip path (no HERMES_REVISION), rev is always None, so a 'pip install --upgrade' changed VERSION but left the cache valid — the stale 'N commits behind' count survived the upgrade. Cache now also keys on the installed VERSION and invalidates on mismatch.
leewenjie
pushed a commit
to leewenjie/hermes-agent
that referenced
this pull request
Aug 7, 2026
…cache (NousResearch#34491) (NousResearch#34846) * docs(code-execution): document HERMES_* env narrowing + passthrough workaround The execute_code sandbox-child env scrub (1083977, NousResearch#27303) deliberately dropped the broad HERMES_ prefix passthrough, keeping only an operational 4-var allowlist (HERMES_HOME/PROFILE/CONFIG/ENV). A script that relied on a non-secret HERMES_* var (HERMES_BASE_URL, HERMES_KANBAN_DB, HERMES_*_WEBHOOK, or a plugin-defined one) now sees it unset in the child. Document the behavior change and the two recovery routes (terminal.env_passthrough in config.yaml, or required_environment_variables in skill frontmatter), plus the debug log line that surfaces the drop for diagnosis. * feat(cli): warn on unsupported pip installs + fix stale update-check cache after pip upgrade Banner now shows a yellow warning when detect_install_method() == 'pip': 'pip install hermes-agent' isn't the supported install path (it exists on PyPI for internal/CI reasons), so updates and issue support don't behave correctly. Reuses existing install-method detection; warn, never block. Also fixes NousResearch#34491: check_for_updates() keyed its 6h cache only on ts+rev. On the pip path (no HERMES_REVISION), rev is always None, so a 'pip install --upgrade' changed VERSION but left the cache valid — the stale 'N commits behind' count survived the upgrade. Cache now also keys on the installed VERSION and invalidates on mismatch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pip-installed Hermes now warns users it's unsupported, and
check_for_updates()no longer reports a stale "behind" count after a pip upgrade.Changes
hermes_cli/banner.py: startup banner shows a yellow warning whendetect_install_method() == "pip"— "⚠ pip install not officially supported — exists for reasons other than user install; expect instability and an inability to support issues". Reuses the existing (already-tested) install-method detection. Warns, never blocks. Wrapped in try/except so it can never break the banner.hermes_cli/banner.py:check_for_updates()cache now keys on the installedVERSIONin addition tots+rev, and invalidates on mismatch. Fixes check_for_updates() cache not invalidated after pip upgrade, showing stale "1 commit behind" #34491.ver.Root cause (#34491)
On the pip-install path there's no
HERMES_REVISION, so the cache'srevfield is alwaysNone. The 6h TTL +rev == Nonecheck both passed after apip install --upgrade, so the stale "N commits behind" count survived the upgrade for up to 6 hours even thoughVERSION(whatcheck_via_pypi()compares) had changed. AddingVERSIONto the cache key forces a recheck.Note on pip support
This makes the unsupported status visible to users without removing the PyPI presence (which the supply-chain pinning story and
check_via_pypistill rely on). The supported install path remains the curl installer.Validation
verwithin TTLverwithin TTLtests/hermes_cli/test_update_check.py+test_pip_install_detection.pyInfographic