Issue 2 - NousResearch/hermes-agent - install.ps1 line 2284 errors with "Cannot use -Ensure and -Stage simultaneously" on bare invocation

Repo: NousResearch/hermes-agent Severity: Major (script unrunnable from PowerShell 5.1 with default invocation) Reporter: [email protected] / @iannitram Affected: scripts/install.ps1 line 2284, verified on PowerShell 5.1 / Windows 11 Build 26200

Summary

install.ps1 line 2284 has the guard:

if ($Ensure -ne "") {
    if ($PSBoundParameters.ContainsKey("Stage")) {
        throw "Cannot use -Ensure and -Stage simultaneously"
    }
    ...
}

When invoked bare (iex (irm install.ps1) or powershell -File install.ps1), neither -Ensure nor -Stage is passed, so this branch should be dormant. In PowerShell 5.1, however, something about the parameter binding causes $Ensure -ne "" to evaluate $true despite the default [string]$Ensure = "" declaration. The inner $PSBoundParameters.ContainsKey("Stage") then returns $false, but the script still falls into an error path before reaching the install loop.

The user-visible symptom is the script exits immediately with Cannot use -Ensure and -Stage simultaneously even though no -Ensure or -Stage flag was passed.

Reproduction

# Windows 11 / PowerShell 5.1
powershell -ExecutionPolicy Bypass -Command "iex (irm https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.ps1)"

Observe: Cannot use -Ensure and -Stage simultaneously is thrown before any install work happens.

Workaround verified in production

Patching line 2284 from if ($Ensure -ne "") { to if ($false) { (i.e., short-circuit the guard) lets the script run to completion on a fresh Windows 11 machine. After the patch, a normal install produces a working venv at ~/AppData/Local/hermes/hermes-agent/venv/ and a working hermes CLI on PATH.

Suggested investigation

This may be a PS 5.1 vs 7.x param-binding difference (defaults from [string]$Var = "" in param() blocks behave slightly differently). A safer guard:

if ($PSBoundParameters.ContainsKey("Ensure") -and $PSBoundParameters.ContainsKey("Stage")) {
    throw "Cannot use -Ensure and -Stage simultaneously"
}

Equivalent intent (only throw if BOTH were actually passed) but immune to default-value binding quirks.

Why this matters

The PowerShell-side install.ps1 is the only working install path on Windows (see Issue 1 for why the Electron's bash-based runInstall doesn't work). Every Windows user hitting the project today has to derive this line-2284 patch themselves before any install can succeed.

Related

• Issue 1 (sibling): fathah/hermes-desktop runInstall() no Windows branch (this is the upstream reason users have to invoke install.ps1 manually in the first place)
• Issue 3 (sibling): fathah/hermes-desktop HERMES_PYTHON Linux-path-style problem (kicks in after a successful install.ps1 run)