fix(desktop): reject empty packaged app payloads

[yinkev]

Summary

• extend the Windows post-build integrity gate beyond the PE executable to the adjacent Electron app payload;
• reject a tiny/empty resources/app.asar, missing archive entry metadata, or missing unpacked runtime entry files before the update is stamped or launched;
• apply the same package-level validation to rollback backups so Hermes never restores another non-bootable tree;
• preserve the deliberate signAndEditExecutable: false configuration and its direct rcedit branding path.

Fixes #70825.

Root cause

A structurally valid Hermes.exe can still launch Electron's help screen when its packaged application is absent. The existing #71119 gate validates the PE header, architecture, and truncation, but it cannot detect the reporter's second failure shape: a 176-byte app.asar with no usable package entry point.

signAndEditExecutable is not the app archive builder and remains intentionally disabled to avoid electron-builder's winCodeSign extraction path. The missing invariant was package validation after the build.

Validation performed

The gate now requires:

• a nontrivial resources/app.asar;
• package.json and electron-main.mjs entry metadata in the ASAR header;
• non-empty app.asar.unpacked/dist/electron-main.mjs and dist/index.html, matching the committed asarUnpack: ["dist/**"] contract.

Verification

• regression was red on current main: a valid PE with a five-byte app archive was accepted;
• complete desktop integrity suite: 29 passed;
• Ruff, py_compile, Windows-footgun scan, and git diff --check: clean.

[teknium1]

Thanks for extending the existing Windows post-build gate rather than changing the deliberate signAndEditExecutable: false configuration. The premise remains present on current main: hermes_cli/main.py:6171 accepts any PE that passes _desktop_exe_integrity_error(), whose scope is limited to PE structure and architecture at hermes_cli/main.py:6099.

Suggested changes

• Please add branch-level regression coverage for the new payload checks. The added test covers the tiny-archive case, but the new implementation also rejects missing ASAR metadata and missing/empty app.asar.unpacked/dist runtime files. The repository packaging contract supports these checks: apps/desktop/package.json:9 sets dist/electron-main.mjs as the main entry and apps/desktop/package.json:211 unpacks dist/**.

The implementation otherwise fits the existing rollback gate: it validates both the newly built package and the backup before restoration. This is an automated hermes-sweeper review.

[GottZ]

This was generated by AI during triage.

Summary

Three PRs address or reference this issue complex across two related Windows failure modes. #69234 adds pack-time PE architecture validation for the corrupted or wrong-architecture executable reported in #69179; #70976 removes the deliberate Windows executable-editing configuration; #71523 extends the existing gate to validate the Electron application payload implicated by #70825's help-text symptom.

Related pull requests

• fix(desktop): validate Windows EXE PE architecture at pack time (#69179) #69234 [closed] best fix — (+119/-0) — best_fix for [Bug]: This app can't run on your computer (此应用无法在你的电脑上运行) #69179, but only a partial fix: apps/desktop/scripts/after-pack.mjs validates the built Hermes.exe PE structure and target architecture, without the recovery and known-good rollback required by the blocking [contributor:6 commits] review. Closed, and still relevant as the reference PE-validation change; the issue discussion records that the complete recovery path landed via fix(update): verify the rebuilt desktop executable before shipping it #71119 and fix(update): detect the OS-native machine for the Windows exe integrity gate #71218.
• fix(desktop): enable asar integrity in Windows build by removing signAndEditExecutable false (#69179) #70976 [closed] related — (+1/-2) — unrelated to the verified root causes: apps/desktop/package.json removes signAndEditExecutable:false but does not validate the executable payload or its ASAR entry point. Closed because the [contributor:7624 commits] maintainer decision documents this setting as deliberate for local rebuilds, with executable editing itself introducing corruption risk.
• fix(desktop): reject empty packaged app payloads #71523 best fix — (+80/-10) — best_fix for [Windows] Desktop app broken: electron-builder produces invalid Hermes.exe (shows Electron help text) #70825: hermes_cli/main.py adds app.asar size, entry-metadata, unpacked runtime-file, recovery, and rollback validation alongside the existing PE gate, with a focused empty-ASAR regression test. The maintainer-bot keep_open review rates salvageability high; retain the PR open and add branch-level tests for missing metadata and missing/empty unpacked runtime files.

Duplicates

No substantive duplicates: #69234 covers PE architecture, #70976 proposes a build-configuration change, and #71523 covers the packaged Electron payload and rollback gate.

Suggested consolidation

Keep #71523 open with a salvage path: preserve its payload and rollback checks, then add the branch-level regression coverage requested by the maintainer-bot keep_open review. Keep #69234 and #70976 closed rather than merging them: #69234 is superseded by the recovery implementation recorded in the #69179 discussion via #71119 and #71218, while #70976 conflicts with the documented deliberate local-rebuild configuration; no PR is merge-lane eligible here.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I70825(["issue #70825 (open)"])
    P71523["PR #71523 (open)"]
    P71523 -->|best fix| I70825
    class I70825 open
    class P71523 open
    class P71523 best
    class P71523 target
    click I70825 "https://github.com/NousResearch/hermes-agent/issues/70825"
    click P71523 "https://github.com/NousResearch/hermes-agent/pull/71523"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 3 pull requests and 2 issues in this complex. Each diff was read against this issue; Assessment working set: 14 kB of PR diffs, 14 kB of issue/PR text, 9 kB of discussion (6 comments), 4 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.