fix(cli): scope web UI npm install to --workspace web

[luyao618]

Summary

Fixes #38358. hermes_cli/main.py::_build_web_ui() was invoking _run_npm_install_deterministic() without scoping it to the web workspace. On repos with additional workspaces (notably apps/desktop, which pulls in Electron via devDependencies), npm tries to resolve every workspace, fetches the ~200MB Electron binary, and the install step fails — surfacing as:

→ Building web UI...
⚠ Web UI npm install failed (hermes web will not be available)

during the CLI self-upgrade flow on Windows.

Root Cause

_build_web_ui() (around line 6929):

r1 = _run_npm_install_deterministic(
    npm,
    _workspace_root(web_dir),
    extra_args=("--silent",),
)

The peer call site _update_node_dependencies() step 2 already scopes the workspaced install with "--workspace", "web"; this path was inconsistent.

Fix

Add "--workspace", "web" to extra_args so npm only installs the web workspace deps, matching the pattern used elsewhere in the same module. One-line change.

Testing

pytest tests/ -k 'web_ui or build_web'
# 16 passed, 2 skipped

Risk

Minimal. The change tightens npm's workspace scope to the exact directory we are about to build, which is the documented intent. Single-workspace repos are unaffected because --workspace web is still valid when web is the only workspace.

[Hypnogamma]

🤖 This comment was generated by an AI agent (Hermes Agent) under authorization and direction from the human user below.
The human user encountered this bug, asked the AI to investigate the root cause and search existing issues — all steps followed the standard bug report protocol. No automated or unattended action was taken.

---

Hey @luyao618, thanks for this fix! I hit the exact same bug — hermes update stuck at "Building web UI..." for 74 minutes on macOS. Root cause analysis matches yours perfectly: _build_web_ui() runs npm ci at workspace root without --workspace web, pulling in apps/desktop (Electron ~200MB).

Two things blocking merge right now:

1. Merge conflict (mergeStateStatus: DIRTY) — branch needs a rebase against main
2. Failing test (test (1) — looks flaky, 3m timeout on a 1-line string change)

This fix would also help #38974 (another user stuck on macOS update with the same root cause). Happy to help re-test after rebase if needed.

[luyao618]

Closing in favor of #af8b917 fix(termux): scope frontend npm installs by @adybag14-cyber (merged June 5) — same fix in hermes_cli/main.py, broader scope (covers TUI + web UI npm install paths, not just web). Thanks for landing the fix!

[teknium1]

Fixed via #40543. You spotted and fixed the same _build_web_ui workspace-scoping bug first — credited. We went with #38810's implementation because it also covered the sibling sites (TUI launch install, tool-setup post-install, and doctor npm audits) and shipped tests. Both contributors credited. Thanks!

#40543