fix(update): preserve activated extras and hermes-tools deps across managed runtime rebuilds (#72924)

[teknium1]

Closes #72924

Problem

The SQLite-repair managed-runtime rebuild (uv sync --extra all --locked in hermes_cli/managed_uv.py) replaces site-packages wholesale, and hermes update only re-detected "active lazy features" after the rebuild — by which point the anchor packages that prove a feature was active are already gone. Result: lazy-installed platform backends (Telegram, Matrix), voice deps, and hermes tools-installed packages (langfuse, ddgs, piper, faster-whisper, kittentts) silently vanished on update. Reproduced by users on macOS, Linux, and Windows across v0.18–v0.20.

Fix (salvaged from #73310, authorship preserved)

This is a cherry-pick salvage of @hxwvaa's #73310 (3 commits, authorship preserved), rebased onto current main across the #86687 update_cmd.py/main.py restructuring.

• Snapshot before rebuild: _cmd_update_impl captures _capture_active_lazy_features() + _capture_active_tool_dependencies() at the very top, while the old environment can still prove which optional backends were activated.
• Snapshot-driven restore: _refresh_active_lazy_features(..., features=snapshot) threads the pre-rebuild snapshot through; when a snapshot is supplied it uses lazy_deps.restore_features() instead of re-probing the (already wiped) environment. Wired into the git-pull repair path, the tail of _cmd_update_impl, and _update_via_zip.
• Hermes Tools deps: a static allowlist _RESTORABLE_PYTHON_TOOL_DEPENDENCIES in tools_config.py + _restore_active_tool_dependencies() in update_cmd.py restores hermes tools-installed Python packages (langfuse, ddgs, piper, faster-whisper, kittentts) into the rebuilt venv, probing the target interpreter first so already-present packages are skipped.
• Security gating respected: restoration goes through the guarded ensure(feature, prompt=False) path, so security.allow_lazy_installs: false yields a skipped: result and never invokes pip — an explicit opt-out leaves the feature absent, reported as skipped (review blocker Terminal tool #1, addressed).
• Langfuse warning: a one-time warning when the plugin is enabled but the SDK is missing, pointing users at hermes tools, instead of silent trace loss.

Scope note (honest)

The issue's "[dev] extras" framing maps onto Hermes' lazy-feature + hermes tools dependency system — that is what a managed rebuild can and does drop, and that is what this restores. Arbitrary user-pip-installed packages outside the lazy-feature/allowlist system are untouched (a rebuild from the lockfile cannot know about them).

Verification

• Full suites green: test_lazy_refresh_venv_repair.py, test_lazy_deps.py, test_langfuse_plugin.py, test_cmd_update.py, test_update_interrupted_recovery.py (190 passed, 1 skipped).
• Updater-level test test_cmd_update_captures_and_propagates_pre_rebuild_snapshot exercises snapshot capture/propagation through _cmd_update_impl (review blocker Support passing morph snapshot id #2, addressed).
• Sabotage run: reverting update_cmd.py/tools_config.py/lazy_deps.py to main makes the new tests fail (collection error — helpers absent); restoring the fix returns green.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on ffdf652 — chore: map hbasheer@student.42abudhabi.ae -> hxwvaa for cont}

⚠️ Warnings

OSV vulnerability scan · View job

5 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 3m8s vs 3m27s (-9.2%). 11 job(s) slower, 11 faster, 2 unchanged.

• Python tests / Run tests slice 12/12: -50.0s
• Python tests / Run tests slice 7/12: -33.0s
• Python tests / Run tests slice 3/12: +23.0s
• Python tests / Run tests slice 6/12: -17.0s
• OS-specific tests / macOS-only tests: +11.0s