Restore prebuilt Hermes with native in-app updates

[spencerbull]

Restore the prebuilt Hermes Desktop package at 2026.8.31-2, pinned to upstream commit 29112bef099274229cadff79cdff7bf7b99c4b77. Set its bootstrap branch to main: stamping the tag as the branch creates a tag-only checkout, leaving the in-app updater unable to resolve origin/main.

Ship the matching upstream installer and retain the tools needed for later native desktop rebuilds. The companion Quattro install change places the prebuilt app in the user's Hermes checkout so the upstream updater can rebuild and relaunch it in place.

Launch that native executable directly for both ordinary launches and Hermes URLs. Require a successful, bounded user-namespace probe and pass --disable-setuid-sandbox, avoiding the CLI's privileged sandbox-helper setup. Keep only the two-line upstream updater gate backport needed for the pinned release's first update. The package launcher preserves its Wayland/keyring defaults, environment options and explicit Electron arguments; CLI-only config.yaml launch settings are not read by this direct path.

Keep the package's desktop-entry ID so Hermes' generated native entry cannot shadow its URL handler. Explicit hermes desktop calls and Hermes-generated CLI launchers remain upstream-controlled.

🤖 Generated by GPT-6 in Codex/T3 Code. Reviewed by GPT-6 Codex at xhigh.

[spencerbull]

Reviewed at 9588b28 by Claude Fable 5.1 in T3 Code, with a second opinion from Codex at xhigh reasoning. The package builds, installs and starts on Omarchy. Two points below want a decision before this leaves draft, and one is a one-line hardening. Nothing was pushed.

What was checked. Built hermes-desktop 2026.8.31-3 with makepkg -s on a disposable Omarchy VM (4 cores, 3.7 GiB plus swap): npm ci and electron-builder completed, check() ran and passed, and the 129 MB package carries /opt/hermes-desktop/Hermes, a resources/install-stamp.json with commit 29112bef…, branch main, source ci, plus /usr/share/hermes-desktop/install.sh and runtime.patch. Installed it with pacman -U and ran /usr/bin/hermes-desktop inside the VM's Hyprland session: a client with class Hermes was mapped within 6 s, the zygotes were up, and the log had no sandbox error, with chrome-sandbox at 0755 root. Against an upstream clone at the pinned commit: the tarball checksum and tag-to-commit mapping, runtime.patch applying cleanly, hermes desktop --skip-build and HERMES_DESKTOP_IGNORE_EXISTING doing what the launcher expects, write-build-stamp.mjs honouring GITHUB_SHA/GITHUB_REF_NAME, install.sh accepting the flags omacom/omarchy#10613 passes, and hermes update autostashing local changes so the applied patch does not block updates. The four main.py helpers in the patch are what upstream main now carries in hermes_cli/main_desktop.py, and the posix.sh hunk is upstream 3a7f2234a, so the backport claim holds. Not exercised: the companion flow itself (bootstrap, patch, seeding, patched hermes desktop --skip-build, in-app update), which the body already defers to the maintainer's local test.

Findings.

1. Medium, hermes-desktop.sh:56. The argument path execs the native binary directly, so it skips what upstream cmd_gui derives from config.yaml: desktop.electron_flags, desktop.disable_gpu, desktop.ozone_platform_hint, and HERMES_DESKTOP_CWD. A cold launch from a hermes:// link on a machine with desktop.disable_gpu: true runs with the GPU path the user turned off. Codex found this. The launcher's comment names the constraint (the CLI takes neither Electron flags nor URLs), so the answer is a design choice rather than a patch.
2. Medium, design. hermes desktop registers ~/.local/share/applications/hermes.desktop (Name=Hermes, visible) unconditionally on every launch, so after the first menu launch there are two "Hermes" entries: the package's URL-capable one and upstream's, which bypasses the launcher's Wayland and keyring defaults. Master hid the package entry and let upstream's registration own the visible one; this PR keeps the package entry visible to protect the URL handler, as the body says. That is the maintainer's trade-off; flagged so it is made rather than inherited.
3. Low, hermes-desktop.sh. Nothing clears ELECTRON_RUN_AS_NODE, PYTHONPATH or PYTHONHOME, which the previous launcher did and its deleted test asserted. Inherited from an editor terminal, ELECTRON_RUN_AS_NODE=1 turns /opt/hermes-desktop/Hermes into a bare Node process that exits without a window. One unset before the execs restores it.
4. Low, PKGBUILD:131. The chrome-sandbox mode follows whether the build container can create user namespaces, not the user's machine. A userns-capable builder ships 0755, and the /opt fallback passes no --disable-setuid-sandbox, so a host that blocks unprivileged userns would abort on that path. Omarchy allows them and the launch above started with a 0755 helper, so this is a portability note and restored pre-Let Hermes Desktop update its native installation #325 behaviour. Codex raised it.

Codex agreed on 3 and 4, which were already in my notes, and its independence is not guaranteed since it can read this machine; finding 1 is its own. It did not flag 2.

Related. #302 is the earlier version-only bump to 2026.8.31, now superseded twice; #262 is the stale-version issue this closes once published; omacom/omarchy#10443 was the companion to #325 and now competes with #10613.

Waiting on the maintainer for 2 and the companion test, and on the author for 1 and 3.

— 🤖 Claude Fable 5.1 in T3 Code, posting on behalf of @spencerbull. Reviewed by Codex XHigh.