fix(update): use npm ci to stop rewriting package-lock on every update#16295
Merged
Conversation
`npm install --silent` (used by `_build_web_ui` and `_update_node_dependencies`) silently rewrites package-lock.json on npm ≥ 10 (strips "peer": true etc.), leaving the working tree dirty after every `hermes update`. The next update then detects the dirty lockfile and stashes it — producing a trail of hermes-update-autostash entries for web/package-lock.json, ui-tui/package-lock.json, and root package-lock.json. Switch to `npm ci` (strict, lockfile-preserving) via a new `_run_npm_install_deterministic` helper that falls back to `npm install` when the lockfile is missing or out of sync (WIP forks). Verified locally: all three lockfiles stay byte-identical after the real _build_web_ui / _update_node_dependencies run twice back-to-back. Fallback path tested with a deliberately out-of-sync lockfile and a no-lockfile case.
1cbc9ae to
ec6b29f
Compare
Contributor
🚨 CRITICAL Supply Chain Risk DetectedThis PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging. 🚨 CRITICAL: Install-hook file added or modifiedThese files can execute code during package installation or interpreter startup. Files: Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting. |
5 tasks
ulasbilgen
pushed a commit
to ulasbilgen/hermes-adhd-agent
that referenced
this pull request
May 1, 2026
NousResearch#16295) `npm install --silent` (used by `_build_web_ui` and `_update_node_dependencies`) silently rewrites package-lock.json on npm ≥ 10 (strips "peer": true etc.), leaving the working tree dirty after every `hermes update`. The next update then detects the dirty lockfile and stashes it — producing a trail of hermes-update-autostash entries for web/package-lock.json, ui-tui/package-lock.json, and root package-lock.json. Switch to `npm ci` (strict, lockfile-preserving) via a new `_run_npm_install_deterministic` helper that falls back to `npm install` when the lockfile is missing or out of sync (WIP forks). Verified locally: all three lockfiles stay byte-identical after the real _build_web_ui / _update_node_dependencies run twice back-to-back. Fallback path tested with a deliberately out-of-sync lockfile and a no-lockfile case.
donald131
pushed a commit
to donald131/hermes-agent
that referenced
this pull request
May 2, 2026
NousResearch#16295) `npm install --silent` (used by `_build_web_ui` and `_update_node_dependencies`) silently rewrites package-lock.json on npm ≥ 10 (strips "peer": true etc.), leaving the working tree dirty after every `hermes update`. The next update then detects the dirty lockfile and stashes it — producing a trail of hermes-update-autostash entries for web/package-lock.json, ui-tui/package-lock.json, and root package-lock.json. Switch to `npm ci` (strict, lockfile-preserving) via a new `_run_npm_install_deterministic` helper that falls back to `npm install` when the lockfile is missing or out of sync (WIP forks). Verified locally: all three lockfiles stay byte-identical after the real _build_web_ui / _update_node_dependencies run twice back-to-back. Fallback path tested with a deliberately out-of-sync lockfile and a no-lockfile case.
This was referenced May 2, 2026
02356abc
pushed a commit
to 02356abc/hermes-agent
that referenced
this pull request
May 14, 2026
NousResearch#16295) `npm install --silent` (used by `_build_web_ui` and `_update_node_dependencies`) silently rewrites package-lock.json on npm ≥ 10 (strips "peer": true etc.), leaving the working tree dirty after every `hermes update`. The next update then detects the dirty lockfile and stashes it — producing a trail of hermes-update-autostash entries for web/package-lock.json, ui-tui/package-lock.json, and root package-lock.json. Switch to `npm ci` (strict, lockfile-preserving) via a new `_run_npm_install_deterministic` helper that falls back to `npm install` when the lockfile is missing or out of sync (WIP forks). Verified locally: all three lockfiles stay byte-identical after the real _build_web_ui / _update_node_dependencies run twice back-to-back. Fallback path tested with a deliberately out-of-sync lockfile and a no-lockfile case.
dannyJ848
pushed a commit
to dannyJ848/hermes-agent
that referenced
this pull request
May 17, 2026
NousResearch#16295) `npm install --silent` (used by `_build_web_ui` and `_update_node_dependencies`) silently rewrites package-lock.json on npm ≥ 10 (strips "peer": true etc.), leaving the working tree dirty after every `hermes update`. The next update then detects the dirty lockfile and stashes it — producing a trail of hermes-update-autostash entries for web/package-lock.json, ui-tui/package-lock.json, and root package-lock.json. Switch to `npm ci` (strict, lockfile-preserving) via a new `_run_npm_install_deterministic` helper that falls back to `npm install` when the lockfile is missing or out of sync (WIP forks). Verified locally: all three lockfiles stay byte-identical after the real _build_web_ui / _update_node_dependencies run twice back-to-back. Fallback path tested with a deliberately out-of-sync lockfile and a no-lockfile case.
gweeteve
pushed a commit
to gweeteve/hermes-agent
that referenced
this pull request
Jun 2, 2026
NousResearch#16295) `npm install --silent` (used by `_build_web_ui` and `_update_node_dependencies`) silently rewrites package-lock.json on npm ≥ 10 (strips "peer": true etc.), leaving the working tree dirty after every `hermes update`. The next update then detects the dirty lockfile and stashes it — producing a trail of hermes-update-autostash entries for web/package-lock.json, ui-tui/package-lock.json, and root package-lock.json. Switch to `npm ci` (strict, lockfile-preserving) via a new `_run_npm_install_deterministic` helper that falls back to `npm install` when the lockfile is missing or out of sync (WIP forks). Verified locally: all three lockfiles stay byte-identical after the real _build_web_ui / _update_node_dependencies run twice back-to-back. Fallback path tested with a deliberately out-of-sync lockfile and a no-lockfile case.
Egavasyug
pushed a commit
to Egavasyug/hermes-agent
that referenced
this pull request
Jun 10, 2026
NousResearch#16295) `npm install --silent` (used by `_build_web_ui` and `_update_node_dependencies`) silently rewrites package-lock.json on npm ≥ 10 (strips "peer": true etc.), leaving the working tree dirty after every `hermes update`. The next update then detects the dirty lockfile and stashes it — producing a trail of hermes-update-autostash entries for web/package-lock.json, ui-tui/package-lock.json, and root package-lock.json. Switch to `npm ci` (strict, lockfile-preserving) via a new `_run_npm_install_deterministic` helper that falls back to `npm install` when the lockfile is missing or out of sync (WIP forks). Verified locally: all three lockfiles stay byte-identical after the real _build_web_ui / _update_node_dependencies run twice back-to-back. Fallback path tested with a deliberately out-of-sync lockfile and a no-lockfile case.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every
hermes updateleaves the web/ui-tui/rootpackage-lock.jsondirty, so the next update stashes it — producing a growing trail ofhermes-update-autostash-*entries.Root cause
_build_web_uiand_update_node_dependenciesrunnpm install --silent. On npm ≥ 10 that silently rewritespackage-lock.json(strips"peer": truemetadata etc.) whenever the committed lockfile was produced by a different npm version. On Teknium's machine right nowgit stash listhas 3hermes-update-autostashentries all carrying justweb/package-lock.json.Changes
hermes_cli/main.py: new_run_npm_install_deterministic(npm, cwd, extra_args=...)helper — triesnpm ci(strict, lockfile-preserving) when a lockfile exists, falls back tonpm installifnpm cifails (out-of-sync WIP checkouts, very old npm)._build_web_ui,_update_node_dependencies) now go through the helper. WhatsApp bridge install (user setup, not update) left alone.Validation
npm cifails →npm installsucceeds, deps installednpm ci,npm installruns, lockfile createdpy_compile clean.