hermes - 💡(How to fix) Fix brew upgrade breaks certifi (cacert.pem missing in venv) - Feishu/Telegram/WeChat all fail

Problem

After brew upgrade hermes-agent, the gateway fails to send messages on all platforms (Feishu, Telegram, WeChat) due to a missing TLS CA certificate bundle.

Root Cause

The homebrew formula creates a venv with --system-site-packages, but the old formula revision (2026.5.16) had a broken certifi installation inside the venv. The cacert.pem file was either missing or a broken symlink.

The error from gateway.log:

OSError: Could not find a suitable TLS CA certificate bundle, invalid path:
/opt/homebrew/Cellar/hermes-agent/2026.5.16/libexec/lib/python3.14/site-packages/certifi/cacert.pem

This affects all platforms that use lark_oapi (Feishu), requests (Telegram), etc. for TLS connections.

Current Formula

depends_on "certifi" => :no_linkage
pypi_packages exclude_packages: %w[certifi cryptography pydantic]

The formula excludes certifi from PyPI installation AND marks it :no_linkage. The venv has include-system-site-packages = true, so system certifi should be importable. However, the system certifi's cacert.pem is a symlink:

cacert.pem ⇒ ../../../../../../../etc/ca-certificates/cert.pem

This symlink resolves to /opt/homebrew/etc/ca-certificates/cert.pem which exists on the current system, but may not exist on all installations.

Workaround

brew reinstall hermes-agent
hermes gateway start

The reinstall (2026.5.16_1) fixed the issue by properly excluding certifi from the venv, allowing fallback to the system certifi.

Suggested Fix

In the formula's install method, ensure certifi is properly available in the venv. Either:

1. Remove :no_linkage to let brew link certifi into the venv's site-packages
2. Add a post_install step that copies/symlinks the system CA bundle into the venv's certifi directory
3. Set REQUESTS_CA_BUNDLE or SSL_CERT_FILE in the formula's env wrapper

Environment

• macOS (Darwin 25.5.0, arm64)
• hermes-agent: 2026.5.16 → 2026.5.16_1
• Python: 3.14.5
• certifi (brew): 2026.4.22