fix(install): scope npm installs/audits to avoid pulling in apps/desktop

[zakame]

Summary

Fixes #38772.

The root package.json workspaces: ["apps/*", ...] glob unconditionally pulls apps/desktop (Electron + node-pty@1.1.0, ~200 MB, requires make/g++ to build from source) into every unscoped npm command run from the repo root. This patch adds explicit workspace scoping to every internal npm install / npm audit call in the codebase, and adds convenience scripts to package.json so developers don't have to remember the right flags.

Changes

hermes_cli/main.py — _build_web_ui

• Add --workspace web to the npm ci / npm install call inside _build_web_ui(), so only the web workspace deps are resolved when building the dashboard frontend. Previously the call ran against the workspace root without scoping, triggering full apps/* resolution on every web rebuild.
• Update all manual-recovery hints to use the scoped form npm install --workspace web && npm run build -w web so users following the hint don't accidentally trigger a desktop rebuild.

hermes_cli/main.py — TUI launch path

• Add --workspace ui-tui to the inline npm install that runs when launching hermes tui with missing deps. Previously this ran unscoped from PROJECT_ROOT, resolving apps/* including desktop.

hermes_cli/tools_config.py

• Add --workspaces=false to the npm install --silent calls that install root-level browser tool deps (agent-browser, Camofox). Root deps live in the root package.json and don't need any workspace to be resolved.

hermes_cli/doctor.py — run_doctor npm audit block

• Replace the single unscoped npm audit --json at PROJECT_ROOT with three scoped invocations: --workspaces=false for root deps, --workspace web for the web workspace, and --workspace ui-tui for the TUI workspace.
• Update the remediation hint in each warning to use the matching scoped npm audit fix command, so users aren't directed to run an unscoped fix that would rebuild node-pty.
• Fix check_dir tautology: npm_dir if audit_extra else npm_dir always evaluated to npm_dir; corrected to PROJECT_ROOT if audit_extra else npm_dir so workspace-scoped audits check the workspace root's node_modules.

package.json

Add convenience npm scripts for the most common scoped operations:

Script	What it does
npm run install:root	npm install --workspaces=false
npm run install:web	npm install --workspace web
npm run install:tui	npm install --workspace ui-tui
npm run install:desktop	npm install --workspace apps/desktop
npm run audit:root	npm audit --workspaces=false
npm run audit:web	npm audit --workspace web
npm run audit:tui	npm audit --workspace ui-tui
npm run audit:fix:root	npm audit fix --workspaces=false
npm run audit:fix:web	npm audit fix --workspace web
npm run audit:fix:tui	npm audit fix --workspace ui-tui

tests/hermes_cli/test_cmd_update.py

• Update the stale assertion for the _build_web_ui npm ci call to expect --workspace web.

tests/hermes_cli/test_tui_npm_install.py

• Add test_tui_launch_install_uses_workspace_scope to assert that the TUI launch npm install carries --workspace ui-tui.

tests/hermes_cli/test_web_ui_build.py

• Add test_npm_install_uses_workspace_web_scope to assert that _build_web_ui passes --workspace web adjacently in the npm install invocation, directly covering the most critical call site.

What this does NOT change

• The workspaces array in package.json itself — apps/desktop stays in the workspace graph so the single shared lockfile and hoisted node_modules/ continue to work for desktop developers.
• The _update_node_dependencies() function already correctly used --workspaces=false + --workspace ui-tui --workspace web (the fix from _build_web_ui() npm install missing --workspace web flag breaks "hermes update" on multi-workspace repos #38358); this PR only fixes the remaining unscoped call sites.

Test Plan

• hermes dashboard still builds the dashboard (_build_web_ui path)
• hermes --tui does not pull desktop deps on first launch
• hermes update does not pull desktop deps (_update_node_dependencies unchanged)
• hermes doctor reports separate audit results for root / web / ui-tui workspaces
• npm run audit:fix:web can be run on a minimal Linux box without make/g++

[teknium1]

Merged via #40543 — your four commits were cherry-picked onto current main with your authorship preserved per-commit (rebase merge). Resolved one conflict against the newer Termux install-context branch so both the Termux and non-Termux paths stay workspace-scoped. Added you to scripts/release.py AUTHOR_MAP so the attribution check passes. Thanks for the thorough fix across web build, TUI launch, tool setup, and doctor audits!

#40543

[zakame]

@teknium1 thanks for the update and glad to help! 👍