hermes - โœ…(Solved) Fix [Bug]: Nix CI broken on main โ€” npmDepsHash is out of date (blocks all PRs) [4 pull requests, 1 comments, 2 participants]

Official PRs (โ€ฆ)
ON THIS PAGE

Recommended Tools

ร—6

Utilities matched from this issueโ€™s tags and category โ€” try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful ยท Quick feedback

Loadingโ€ฆ
GitHub stats
NousResearch/hermes-agent#15272โ€ขFetched 2026-04-25 06:23:20
View on GitHub
Comments
1
Participants
2
Timeline
11
Reactions
1
Author
Participants
Timeline (top)
cross-referenced ร—6labeled ร—3commented ร—1subscribed ร—1

Error Message

hermes-web> ERROR: npmDepsHash is out of date hermes-web> 1. Use lib.fakeHash as the npmDepsHash value hermes-web> 2. Build the derivation and wait for it to fail with a hash mismatch hermes-web> 3. Copy the 'got: sha256-' value back into the npmDepsHash field error: Cannot build '/nix/store/โ€ฆ-hermes-web-0.0.0.drv'.

Root Cause

  • #15214 (docs-only, mine) โ€” hit this same failure at run 24897307721. Not caused by my diff.
  • I've also filed #15260 to clear the separate docs-site-checks failure on main (ascii-guard warnings in architecture.md + gateway-internals.md), which was hitting the same set of PRs.

Fix Action

Fixed

PR fix notes

PR #15293: chore(nix): probe hermes-web npm hash

Description (problem / solution / changelog)

Temporary draft PR to trigger CI and capture the updated hermes-web npm deps hash for issue #15272. This will be superseded by a clean final PR with the real hash.

Changed files

  • nix/web.nix (modified, +1/-1)

PR #15295: fix(nix): refresh hermes-web npm lockfile hash

Description (problem / solution / changelog)

Summary\n- refresh the stale npm deps hash for \n- unblock the shared Nix failure tracked in #15272\n\n## Verification\n- extracted the updated hash from the repository's workflow report for probe PR #15293\n- final verification is pending on this PR's CI

Changed files

  • nix/web.nix (modified, +1/-1)

PR #15260: fix(docs): add โ”ด junctions to two outer-box bottom borders to satisfy ascii-guard

Description (problem / solution / changelog)

What does this PR do?

Fixes 6 pre-existing ascii-guard 2.3.0 warnings that currently block the `docs-site-checks` CI on every PR touching `website/**`.

  • `website/docs/developer-guide/architecture.md` โ€” 3 warnings on the bottom border of the outer AIAgent box (line 38)
  • `website/docs/developer-guide/gateway-internals.md` โ€” 3 warnings on the bottom border of the outer GatewayRunner box (line 49)

Both diagrams have a two-row nested-box pattern where the first inner-box row's bottom uses `โ”ฌ` to connect downward to a second inner-box row. ascii-guard's `validate_box()` routine looks for `โ”ฌ`/`โ”ผ` characters anywhere in the outer box's content lines (not just in its top border) via `get_column_positions()` and concludes those are table-column boundaries belonging to the outer box. It then expects a matching `โ”ด` in the outer box's bottom border โ€” and warns when it finds `โ”€` instead. That interpretation is wrong for this geometry (the `โ”ฌ` is a purely internal inner-box-to-inner-box connection), but the linter rule is what it is, and the fix is trivial: add `โ”ด` at the three flagged columns of each outer bottom border.

After the fix, the `โ”ด` reads visually as "the column space continues past this box," which matches the arrows already sitting below each outer box. No readability regression.

Related Issue

No existing issue โ€” noticed while filing #15214 (docs cookbook). Verified the warnings are pre-existing on `main` (`architecture.md` last touched in #11373, `gateway-internals.md` much older).

Fixes #

Type of Change

  • ๐Ÿ› Bug fix (non-breaking change that fixes an issue) โ€” unblocks `docs-site-checks` CI
  • โœจ New feature
  • ๐Ÿ”’ Security fix
  • ๐Ÿ“ Documentation update
  • โœ… Tests
  • โ™ป๏ธ Refactor
  • ๐ŸŽฏ New skill

Changes Made

  • `website/docs/developer-guide/architecture.md` line 38: positions 11, 29, 47 (1-indexed) on the outer bottom border changed from `โ”€` to `โ”ด`. Those positions line up with the `โ”ฌ` junctions on line 30 that connect the "Prompt Builder / Provider Resolution / Tool Dispatch" row to the "Compression / 3 API Modes / Tool Registry" row below.
  • `website/docs/developer-guide/gateway-internals.md` line 49: positions 9, 23, 37 (1-indexed) on the outer bottom border changed from `โ”€` to `โ”ด`. Those positions line up with the `โ”ฌ` junctions on line 35 that connect the "Telegram / Discord / Slack Adapter" row to the `_handle_message()` merge below.

Diff: 2 files changed, 2 insertions(+), 2 deletions(-) โ€” every changed character is a single Unicode swap.

How to Test

Validated locally against ascii-guard 2.3.0 (same version the CI workflow installs via `python -m pip install ascii-guard==2.3.0`).

Before (on clean `upstream/main`): ``` $ ascii-guard lint website/docs/developer-guide/architecture.md Checking .../architecture.md... Found 10 ASCII box(es) โš  Line 39, Col 12: Bottom border missing junction point at column 11 (expected โ”ด, got 'โ”€') โš  Line 39, Col 30: Bottom border missing junction point at column 29 (expected โ”ด, got 'โ”€') โš  Line 39, Col 48: Bottom border missing junction point at column 47 (expected โ”ด, got 'โ”€')

$ ascii-guard lint website/docs/developer-guide/gateway-internals.md Checking .../gateway-internals.md... Found 4 ASCII box(es) โš  Line 50, Col 10: Bottom border missing junction point at column 9 (expected โ”ด, got 'โ”€') โš  Line 50, Col 24: Bottom border missing junction point at column 23 (expected โ”ด, got 'โ”€') โš  Line 50, Col 38: Bottom border missing junction point at column 37 (expected โ”ด, got 'โ”€') ```

After (on this branch): ``` $ ascii-guard lint website/docs/developer-guide/architecture.md Checking .../architecture.md... Found 10 ASCII box(es) โœ“ No issues found โœ“ Errors: 0

$ ascii-guard lint website/docs/developer-guide/gateway-internals.md Checking .../gateway-internals.md... Found 4 ASCII box(es) โœ“ No issues found โœ“ Errors: 0 ```

No other files changed. Other pre-existing ascii-guard findings on committed-but-regenerated-in-CI skill-docs (`skills/bundled/research/research-research-paper-writing.md`, `skills/bundled/mlops/mlops-models-segment-anything.md`) are out of scope for this PR โ€” CI runs `generate-skill-docs.py` before the lint step, which overwrites those files with clean output, so they don't actually fail CI.

Checklist

Code

  • I've read the Contributing Guide
  • My commit messages follow Conventional Commits (`fix(docs): โ€ฆ`)
  • I searched for existing PRs โ€” nothing duplicative
  • My PR contains only changes related to this fix (2 `โ”€` โ†’ `โ”ด` swaps on 2 lines)
  • I've run `pytest tests/ -q` โ€” N/A for a docs-only change to 2 markdown files; the Python test suite does not exercise these files
  • I've added tests โ€” N/A, existing CI `docs-site-checks` workflow is the regression guard
  • I've tested on my platform: macOS 15 / darwin-arm64, ascii-guard 2.3.0

Documentation & Housekeeping

  • Documentation (README, `docs/`, docstrings) โ€” this PR IS a docs fix
  • `cli-config.yaml.example` โ€” N/A
  • `CONTRIBUTING.md` or `AGENTS.md` โ€” N/A
  • Cross-platform impact considered โ€” ASCII art renders identically on all platforms
  • Tool descriptions/schemas โ€” N/A

For New Skills

N/A.

Screenshots / Logs

The 3 `โ”ด` characters on `architecture.md` line 38 now align with the `โ”ฌ` connectors on line 30 (same columns: 11, 29, 47). Same pattern for `gateway-internals.md`.

Unblocks #15214 (and every other open PR touching `website/**`) from the same CI failure.

Changed files

  • website/docs/developer-guide/architecture.md (modified, +1/-1)
  • website/docs/developer-guide/gateway-internals.md (modified, +1/-1)

PR #15420: fix(nix): refresh tui + web npmDepsHash to unblock CI on every PR (#15244, #15272, #15314)

Description (problem / solution / changelog)

What does this PR do?

The `Nix Lockfile Check` on `main` has been failing across every open PR for several days because two pinned `fetchNpmDeps` hashes drifted out of sync with the actual `package-lock.json` contents in `ui-tui/` and `web/`.

The CI run prints the correct hash on each failure, so this is a one-character-precision drive-by โ€” both new hashes are exactly what every recent `Nix Lockfile Check` run is reporting (e.g. run 24916813199 from a few minutes ago):

FileOld โ†’ New
`nix/tui.nix``RU4qSHgJPMyfRSEJDzkG4+MReDZDc6QbTD2wisa5QE0=` โ†’ `/lL0IXurF4WlyFYVVwDI0Btcx0uChHdmKQ8ZW3NQf5E=`
`nix/web.nix``TS/vrCHbdvXkPcAPxImKzAd2pdDCrKlgYZkXBMQ+TEg=` โ†’ `4Z8KQ69QhO83X6zff+5urWBv6MME686MhTTMdwSl65o=`

The drift was caused by recent dependency-touching commits in:

  • `ui-tui/`: PTY WebSocket bridge (`f49afd31`), package.json updates across the chat-unification series (`c61547c0`), `fix(tui): warn on bare null sections in config.yaml` (`bfa60234`)
  • `web/`: docs embedding (`0fdbfad2`), sidebar layout (`e5d2815b`), dashboard extension points (`f593c367`)

None of those PRs ran the `nix flake update` follow-up, so the cached hashes never got refreshed.

Related Issues

  • Closes #15244 (`nix ubuntu check failing on main again`)
  • Closes #15272 (`nix CI broken on main โ€” npmDepsHash out of date`)
  • Closes #15314 (`hermes-tui npmDepsHash is out of date`)

Type of Change

  • ๐Ÿ› Bug fix (CI infrastructure)
  • No tests required โ€” pure config update; the existing `Nix Lockfile Check` workflow IS the regression guard for this kind of drift

Test plan

  • Both new hashes are taken verbatim from `Nix Lockfile Check` failure output: the CI computes the correct hash from the actual `package-lock.json` and prints "To correct the hash mismatch for npm-deps, use ..."
  • No production code touched โ€” only the two pinned hashes
  • Once merged: every open PR's `Nix Lockfile Check` lane goes from FAILURE to SUCCESS on its next CI run

Why a separate PR (vs piggybacking on another fix)

This fix unblocks ~30 open PRs at once, including all of mine. Keeping it isolated makes the merge low-risk (1 line per file), explicit in git history, and easy to cherry-pick onto release branches if needed.

Out of scope

  • Automating the hash refresh on every `package-lock.json` change (would need a CI job to compute and commit the hash). `#13136` proposed this with `automatic lockfile fixing to keep main building with nix` but was reverted in `688c9f5b`. Restoring that automation is a bigger conversation; this PR is a narrow unblock for today.

Changed files

  • nix/tui.nix (modified, +1/-1)
  • nix/web.nix (modified, +1/-1)

Code Example

hermes-web> ERROR: npmDepsHash is out of date
hermes-web> 1. Use `lib.fakeHash` as the npmDepsHash value
hermes-web> 2. Build the derivation and wait for it to fail with a hash mismatch
hermes-web> 3. Copy the 'got: sha256-' value back into the npmDepsHash field
error: Cannot build '/nix/store/โ€ฆ-hermes-web-0.0.0.drv'.

---

hermes-web> ERROR: npmDepsHash is out of date
hermes-web> 1. Use `lib.fakeHash` as the npmDepsHash value
hermes-web> 2. Build the derivation and wait for it to fail with a hash mismatch
hermes-web> 3. Copy the 'got: sha256-' value back into the npmDepsHash field
error: Cannot build '/nix/store/7fxbxlay0nhrgwcf7szpcmw34h84n026-hermes-web-0.0.0.drv'.
       Reason: builder failed with exit code 1.
       > ERROR: npmDepsHash is out of date
##[error]Process completed with exit code 1.
RAW_BUFFERClick to expand / collapse

Bug Description

The Nix workflow (.github/workflows/nix.yml) fails on every PR and every bare-main run with:

hermes-web> ERROR: npmDepsHash is out of date
hermes-web> 1. Use `lib.fakeHash` as the npmDepsHash value
hermes-web> 2. Build the derivation and wait for it to fail with a hash mismatch
hermes-web> 3. Copy the 'got: sha256-' value back into the npmDepsHash field
error: Cannot build '/nix/store/โ€ฆ-hermes-web-0.0.0.drv'.

Something changed the contents that hermes-web hashes (typically website/package-lock.json or a dependency pinned by it) without a corresponding bump to npmDepsHash in flake.nix / the hermes-web derivation.

Every open PR touching any file that triggers the Nix workflow is now blocked by this failure, regardless of what the PR changes.

Steps to Reproduce

Reproduced on bare main with no PR context:

  1. Open any Nix workflow run on main after 2026-04-24 14:26 UTC. Example: run 24895726733 at 14:48 UTC (no PR attached) โ€” fails with the npmDepsHash error.
  2. Compare to run 24894677767 at 14:26 UTC โ€” passes on the same branch.
  3. The regression landed in a commit merged between those two timestamps.

Expected Behavior

Nix CI passes on main and on PRs whose diffs don't touch website/package-lock.json or anything under the hermes-web Nix derivation.

Actual Behavior

Every main run since 14:48 UTC on 2026-04-24 fails. Every PR that triggers the Nix workflow inherits the failure. Full log tail:

hermes-web> ERROR: npmDepsHash is out of date
hermes-web> 1. Use `lib.fakeHash` as the npmDepsHash value
hermes-web> 2. Build the derivation and wait for it to fail with a hash mismatch
hermes-web> 3. Copy the 'got: sha256-' value back into the npmDepsHash field
error: Cannot build '/nix/store/7fxbxlay0nhrgwcf7szpcmw34h84n026-hermes-web-0.0.0.drv'.
       Reason: builder failed with exit code 1.
       > ERROR: npmDepsHash is out of date
##[error]Process completed with exit code 1.

Appears on both nix (ubuntu-latest) and nix (macos-latest) jobs.

Affected Component

  • Setup / Installation (Nix flake build)

Messaging Platform (if gateway-related)

N/A (CI only).

Environment

  • GitHub-hosted ubuntu-latest and macos-latest runners
  • magic-nix-cache + FlakeHub upload (orthogonal; also failing but that's a different issue)
  • hermes-web derivation โ€” ERROR: npmDepsHash is out of date

Debug Report Links

N/A โ€” this is a CI-side issue, not a local hermes invocation. hermes debug share isn't applicable.

Suggested Remediation

Regenerate npmDepsHash for the hermes-web derivation:

  1. Replace the current npmDepsHash value with lib.fakeHash (or set "").
  2. Run nix build .#hermes-web โ€” it fails with a hash mismatch showing got: sha256-....
  3. Copy the got: value back into npmDepsHash.
  4. Commit the updated hash alongside the package-lock.json change that triggered the drift.

I don't have a nix toolchain on hand to produce the fix myself. Happy to validate a PR once filed.

Impact / Urgency

Every open PR on the repo that touches files covered by the Nix workflow's paths: trigger is blocked. Observed at time of filing on #15214 (my docs cookbook), which has no nix-relevant changes but inherits the failure. Many older open PRs are likely in the same state.

Related PRs

  • #15214 (docs-only, mine) โ€” hit this same failure at run 24897307721. Not caused by my diff.
  • I've also filed #15260 to clear the separate docs-site-checks failure on main (ascii-guard warnings in architecture.md + gateway-internals.md), which was hitting the same set of PRs.

extent analysis

TL;DR

Update the npmDepsHash value in the hermes-web derivation by regenerating it using the suggested remediation steps.

Guidance

  • Replace the current npmDepsHash value with lib.fakeHash to trigger a rebuild and obtain the correct hash.
  • Run nix build .#hermes-web to reproduce the hash mismatch error and obtain the correct got: sha256- value.
  • Copy the got: value back into the npmDepsHash field and commit the updated hash.
  • Validate the fix by re-running the Nix workflow and verifying that the npmDepsHash error is resolved.

Example

No code snippet is provided as the issue is related to a specific Nix configuration and derivation.

Notes

The suggested remediation steps are provided in the issue description and should be followed to update the npmDepsHash value. The issue is specific to the hermes-web derivation and affects all open PRs that trigger the Nix workflow.

Recommendation

Apply the suggested remediation steps to update the npmDepsHash value, as it is the most direct way to resolve the issue and unblock the affected PRs.

Vote matrix ยท Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loadingโ€ฆ

Still need to ship something?

ร—6

Another batch ranked right after the header list โ€” different links, same matching logic.

Back to top recommendations

TRENDING

hermes - โœ…(Solved) Fix [Bug]: Nix CI broken on main โ€” npmDepsHash is out of date (blocks all PRs) [4 pull requests, 1 comments, 2 participants]