fix: make macOS desktop self-update swap+relaunch fail-fast and recoverable - #38410
Closed
OmarB97 wants to merge 1 commit into
Closed
fix: make macOS desktop self-update swap+relaunch fail-fast and recoverable#38410OmarB97 wants to merge 1 commit into
OmarB97 wants to merge 1 commit into
Conversation
alt-glitch
added
type/bug
OmarB97
force-pushed
the
desktop-mac-swap-fix
branch
from
June 3, 2026 19:53
9cf5343 to
3c454d2
Compare
1 task
Contributor
Author
|
Closing: this branch's only commit is a strict subset of #38446 (codesign re-seal minus the chmod), which was just rebased onto current main and carries it all. The main.cjs swap-fail-fast + hermes_state.py busy_timeout changes this PR's description promises are not on the branch (apparently lost in an old force-push) — that work is tracked separately for recovery. |
OmarB97
pushed a commit
to OmarB97/hermes-agent
that referenced
this pull request
Jul 11, 2026
…erable The macOS in-app updater's detached swap script ran with plain 'set -u' and a success-gated ditto: when ditto or the destination move failed, the script fell through silently -- the app had already quit, the old bundle stayed (or was left moved aside), and 'open "$DST"' either relaunched the stale build or nothing at all. This matches the reported "Update now does not actually update" behavior. Make the swap fail-fast and recoverable: - set -euo pipefail so unexpected failures stop the script instead of compounding. - Detect ditto and destination-replace failures explicitly; on either, fall back to opening the freshly rebuilt bundle directly so the user is never left with a dead quit. - Clean up the .hermes-update-old copy via an EXIT trap so it is removed on every exit path. Recovered from the pre-force-push head of desktop-mac-swap-fix (NousResearch#38410, which lost this work to a force-push and was closed). The sqlite busy_timeout half of that PR is intentionally not revived: the BEGIN IMMEDIATE + jitter-retry redesign (NousResearch#3385) deliberately keeps the connection busy handler short, and a 5s busy_timeout would override that design. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The macOS in-app updater can quit
Hermes.appand never reinstall/reopen, which matches the reported issue where "Update now" does not actually update.What changed
apps/desktop/electron/main.cjs: tightened the macOS bundle swap+relaunch sequence sodittoand destination replace failures are detected immediately, cleanup runs reliably, and the updater falls back to opening the rebuilt bundle directly instead of leaving the user with a dead quit.hermes_state.py: setPRAGMA busy_timeout = 5000forstate.dbso concurrentstate.dbwriters no longer hit immediatedatabase is lockedfailures.How to review
Review
applyUpdatesPosixInAppinapps/desktop/electron/main.cjsand the SQLite initialization block nearPRAGMA foreign_keys=ONinhermes_state.py.Evidence
Failure mode: in-app macOS update quits, no relaunch succeeds, retry does not install. With the patch, a swap failure opens the rebuilt
.appdirectly; a successful swap continues to replace/Applications/Hermes.appas before.Verification
release/mac-arm64/Hermes.appfallback.state.db unavailable: database is lockedunder load.Risks & gaps
/Applications/Hermes.appswap fails; that may not match the user’s preferred installed copy location, but it avoids a no-app state. Shields online behavior from component changes?Shielding against downstream update regressions means the fix should be validated on macOS with concurrent Hermes processes (gateway, dashboard, TUI), plus a forced swap failure to exercise the fallback path before wide rollout. No full automated reproducer is included here.