fix(lazy_deps): only treat primary spec as activation trigger

[Ahmett101]

Summary

tools/lazy_deps.py::active_features() dispatched on any(_is_present(s) for s in specs). Several messaging backends (platform.matrix, platform.slack, platform.discord, platform.teams, homeassistant, sms) share a CVE-floor pin aiohttp==3.14.1 as a secondary entry — aiohttp ships as a transitive of common core deps (edge-tts, firecrawl-py, discord.py), so on a stock Windows install every one of those backends flipped to active without the user opting in. hermes update then proceeded to install their full stacks — including mautrix[encryption] whose python-olm build shells out to make (not present on stock Windows), surfacing as a perpetual refresh failure.

Switch active_features() to primary-spec dispatch: only the first spec — the feature's distinctive SDK (mautrix[encryption], discord.py[voice], slack-bolt, anthropic, boto3, mistralai, …) — drives activation. Subsequent entries are supporting pins for the actual pip install refresher and remain in LAZY_DEPS so refresh still picks them up when the primary is correctly activated.

Changes

• tools/lazy_deps.py — active_features() rewritten to check specs[0] only. Docstring explains the supporting-pins/primary distinction with reference to lazy_deps: shared aiohttp pin marks never-enabled backends active; matrix refresh then fails on Windows (python-olm needs make) #58458.
• tests/tools/test_lazy_deps.py — two regression tests:
  • test_supporting_pin_does_not_activate_feature — a simulated aiohttp-only install must NOT register platform.matrix / platform.slack / platform.discord / platform.teams / homeassistant / sms as active.
  • test_primary_spec_alone_activates — installing mautrix alone IS enough to register platform.matrix.

How to Test

venv/bin/python -m pytest tests/tools/test_lazy_deps.py -q
# 63/63 passed

Pinned by stash: with tools/lazy_deps.py reverted, the two new regression tests fail exactly the way the issue report described — platform.matrix (and the other aiohttp-pinned features) appear in active_features() even though the user never opted in.

Checklist

• Tests pass — 63/63
• Follows Conventional Commits
• Cross-platform impact — pure Python (tools/lazy_deps.py); the bug manifests on Windows but the fix doesn't touch platform-specific code
• profile-safe paths used (no path code modified)
• .env not used for non-credential settings (no config surface touched)

Risk & Impact

Low. The semantic change is strictly more conservative: a feature that was previously activated by its supporting pins stays inactive until its primary SDK is genuinely present. Side-effects:

• Existing users who followed the workaround (uv pip install mautrix==0.21.0 aiosqlite==0.22.1 …) still keep platform.matrix active — primary is satisfied, so refresh continues to bump pins.
• Users who installed aiohttp only as a transitive now stop paying the Discord/Slack/Matrix/etc. refresh on every hermes update. If they ever do opt in later (e.g. hermes setup enables Matrix), mautrix becomes satisfied and refresh resumes normally.
• The install_all_in_one path and individual ensure() calls are unaffected — they still install all listed specs from LAZY_DEPS, not just specs[0].

Type: Bug fix
Closes: #58458

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54178 — both rewrite active_features() in tools/lazy_deps.py to key on the primary/signature (specs[0]) package only, replacing the any-spec _is_present check, fixing the same shared-transitive-dep (aiohttp) false-activation that made hermes update try to build mautrix[encryption]/python-olm on Windows. #54178 is the earlier OPEN PR (2026-06-28), so it's canonical. Also implements the underlying issues #58458 / #44404.