fix(nix): use electron.headers instead of hardcoded headers hash in desktop.nix

[alt-glitch]

Summary

Salvage of #61824 by @fkz (commit cherry-picked, authorship preserved). Prior art: #53202 by @ak2k contains the identical electron.headers change and predates #61824 — credit to both; #53202's separate CI-lane component is superseded by the trigger-only nix CI in #69463 (its offline-build guard scope is covered by scripts/nix-ci.sh build).

nix/desktop.nix pinned the Electron node-headers tarball via fetchurl with a hardcoded sha256. Because electron.version comes from nixpkgs, every nixpkgs Electron bump changes the URL and breaks .#desktop with a fixed-output hash mismatch (#61443). nixpkgs' electron already exposes the matching headers as electron.headers, so this deletes the fetchurl entirely and points npm rebuild node-pty --nodedir at it.

Verified today: bumping the flake's nixpkgs (2026-04-01 → 2026-07-19) moves Electron 41.0.2 → 41.9.1 and reproduces the hash mismatch on current main; with this change .#desktop builds green on both pins.

Closes #61443. Supersedes #61824 and the desktop.nix half of #53202.

Test plan

• nix build .#desktop on current flake.lock (Electron 41.0.2) — passes
• nix build .#desktop with nixpkgs 241313f4 (Electron 41.9.1) — passes (was: hash mismatch)

[github-actions]

૮ >ﻌ< ა ci review

_{running on a8be142}

looks good to me!

[GottZ]

This was generated by AI during triage.

Summary

Nine PRs reference or overlap this issue complex. #53202, #61824, and #69458 remove the independently pinned Electron-header fetch in favor of electron.headers; #61530, #72121, and merged #76295 only replace one fixed hash, while #37234, #38253, and #43961 change adjacent desktop packaging behavior without altering header acquisition.

Related pull requests

• fix(nix): expose passthru.npmLockfile on desktop derivation #37234 [closed] related — (+2/-0) — n/a: Adds passthru.npmLockfile to the final desktop derivation without changing the Electron-header fetch or hash; it remains relevant as an adjacent nix/desktop.nix change and was closed in favor of fix(node/nix): consolidate workspace lockfile + update all consumers #36171.
• feat(nix): desktop darwin app bundle #38253 related — (+218/-4) — n/a: Adds a Darwin .app bundle, resource-layout checks, and documentation without changing Electron-header acquisition. Consistent with its contributor keep_open review, keep it separate and salvage the bundle onto current nix/desktop.nix while retaining Darwin layout verification.
• Add Nix desktop launcher entry #43961 related — (+19/-1) — n/a: Adds a Linux desktop launcher and standard icon destinations but does not alter the stale header fetch. Consistent with the maintainer-bot keep_open verdict, preserve it as a separate desktop-integration change.
• fix(nix/desktop): electron.headers + offline nix-build guard (.#web/.#tui/.#desktop) #53202 best fix — (+83/-14) — n/a: Replaces the version-templated URL plus independent SHA with electron.headers and adds an offline .#web/.#tui/.#desktop build guard, addressing both the failure mechanism and regression coverage. Its recorded best-fix findings and maintainer-bot keep_open verdict support author action to rebase onto main or split out the CI guard that remains distinct from fix(nix): use electron.headers instead of hardcoded headers hash in desktop.nix #69458.
• fix(desktop): bump electron node-headers sha256 to match pinned electron.version #61530 [closed] fixes — (+4/-1) — n/a: Updates the fixed hash for Electron 41.9.1 but retains the version-dependent URL with an independent fixed SHA. Despite the earlier maintainer-bot keep_open verdict, it remains relevant as a closed stopgap whose author explicitly closed it in favor of fix(nix/desktop): electron.headers + offline nix-build guard (.#web/.#tui/.#desktop) #53202's durable fix.
• Refactor electron headers handling in desktop.nix #61824 duplicate — (+1/-13) — n/a: Removes the manual archive fetch and points node-gyp at electron.headers, eliminating the reported version/hash desynchronization. Its fix is duplicated by fix(nix): use electron.headers instead of hardcoded headers hash in desktop.nix #69458, which explicitly salvages Refactor electron headers handling in desktop.nix #61824 with preserved authorship, and by the desktop portion of earlier fix(nix/desktop): electron.headers + offline nix-build guard (.#web/.#tui/.#desktop) #53202.
• fix(nix): use electron.headers instead of hardcoded headers hash in desktop.nix #69458 best fix — (+3/-13) — n/a: Carries the focused electron.headers substitution salvaged from Refactor electron headers handling in desktop.nix #61824, removes the structural fixed-hash cause, and preserves attribution. Its recorded best-fix findings for both issues support keeping it open as the focused salvage rather than treating it as a disposable duplicate.
• fix(nix): update Electron headers sha256 hash to fix hermes-desktop nix build (#72095) #72121 [closed] best fix — (+1/-1) — n/a: Replaces the hash with the Electron 41.9.1 value but leaves the version-dependent URL and fixed-SHA coupling intact. Although it has a recorded best-fix finding for the immediate [Bug]: Wrong sha256 pin for Electron headers fetchurl breaks hermes-desktop build #72095 reproduction and a keep_open review, the same contributor review requires ${electron.headers} and warns about the locked 41.0.2 input; it remains closed after a later contributor reported unresolved conflicts.
• fix(nix): update electron headers sha #76295 [merged] partial — (+1/-1) — n/a: Merged reference implementation that updates one fixed Electron-header hash, resolving one concrete archive mismatch while retaining the structural version/hash coupling. It remains relevant because the durable open diffs can be compared against the stopgap now present on main.

Duplicates

#61824 and #69458 implement the same electron.headers repair, with #69458 explicitly salvaging #61824; that repair also overlaps the desktop portion of broader #53202. #61530 and #72121 are identical Electron-41.9.1 hash bumps, while merged #76295 uses the same one-version fixed-hash strategy with a different hash; #37234, #38253, and #43961 are adjacent changes, not duplicates of the header repair.

Suggested consolidation

Keep #69458 open with the concrete salvage path of retaining its focused, attributed electron.headers repair; this respects its recorded best-fix findings without issuing a merge recommendation. For #53202, whose recorded best-fix findings and keep_open verdict are supported by its distinct offline guard, request author action to rebase onto main or split out the still-applicable CI component; close #61824 as duplicate of the salvaged implementation in #69458, leave #61530 and #72121 closed as superseded one-version stopgaps, and keep #38253 and #43961 on their separately reviewed salvage paths.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I61443(["issue #61443 (open)"])
    I72095(["issue #72095 (open)"])
    subgraph Dup53202 ["PRs duplicating each other"]
        P53202["PR #53202 (open)"]
        P61824["PR #61824 (open)"]
        P69458["PR #69458 (open)"]
    end
    P69458 -->|best fix| I61443
    P69458 -->|best fix| I72095
    class I61443 open
    class I72095 open
    class P53202 open
    class P61824 open
    class P69458 open
    class P53202 best
    class P53202 best
    class P69458 best
    class P69458 best
    class P69458 target
    click I61443 "https://github.com/NousResearch/hermes-agent/issues/61443"
    click I72095 "https://github.com/NousResearch/hermes-agent/issues/72095"
    click P53202 "https://github.com/NousResearch/hermes-agent/pull/53202"
    click P61824 "https://github.com/NousResearch/hermes-agent/pull/61824"
    click P69458 "https://github.com/NousResearch/hermes-agent/pull/69458"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 9 pull requests and 2 issues in this complex. Each diff was read against this issue; Assessment working set: 31 kB of PR diffs, 28 kB of issue/PR text, 15 kB of discussion (21 comments), 18 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.

[alt-glitch]

Call-graph-assisted review — Nix-only change, so calldiff doesn't apply; reviewed via git diff, the surrounding build recipe, and the file's git history.

Replaces the hand-pinned electronHeaders = pkgs.fetchurl { … sha256 = "…"; } with nixpkgs' own ${electron.headers}, and drops the now-unnecessary mkdir/tar -xzf extraction step, wiring --nodedir="${electron.headers}" straight into the npm rebuild node-pty call. This is a genuinely good fix, not just a cleanup.

✅ Looks good

• Kills a recurring maintenance class. git log -- nix/desktop.nix shows a trail of fix(nix): update electron sha, fix(nix): fix electron headers sha, fix(nix): update electron headers sha — the hardcoded hash had to be manually re-pinned every time the nixpkgs electron version moved, and a stale hash breaks the desktop build outright. electron.headers is version-matched to the same electron derivation by construction, so the hash can never drift out of sync again. This is exactly the "fix the whole bug class, not the one instance" pattern.
• Removing the tar extraction to $TMPDIR/electron-headers also removes a build-time side effect and a hand-rolled temp dir; electron.headers is a store path node-gyp can read directly.
• --disturl="" and --offline are correctly retained, so no network access is reintroduced into the sandboxed build.

🟡 Duplication / abstraction

• Heads-up for whoever merges: this exact desktop.nix hunk also appears in chore(nix): update flake inputs (nixpkgs 2026-04 → 2026-07) #69465 (which is stacked on this PR's base). Land this one first so chore(nix): update flake inputs (nixpkgs 2026-04 → 2026-07) #69465's diff reduces to just the flake.lock bump and doesn't re-litigate the same change.

🔴 Issues

• None in the code. Before merge, confirm electron.headers is present for the electron version resolved by the current pinned nixpkgs (older nixpkgs electron derivations didn't always expose .headers). A nix build .#desktop under the ci(nix): restore nix CI as trigger-only workflow with local entrypoint #69463 ci/nix label is the right proof.