fix(nix): refresh web/ npm-deps hash to unblock main builds by OutThisLife · Pull Request #17174 · NousResearch/hermes-agent

OutThisLife · 2026-04-28T23:21:24Z

Closes / supersedes #17133 (hash-refresh only). This PR includes that fix plus the fix-lockfiles hardening that resolves the related nix-lockfile-check false-failures on every PR.

Summary

Two related fixes in one PR:

1. Refresh `web/` npm-deps hash

web/package-lock.json was updated by the design-system refactor (merged via #17007 + follow-ups: spinner / select / badges / buttons) without bumping nix/web.nix::npmDeps.hash. Result: every nix (ubuntu-latest) build on main and every open PR has been failing since 2026-04-28T18:46.

Drop in the new hash that the actual Check flake failure already calculated for us:

specified: sha256-AahWmJ9gDQ9pMPa1FYwUjYdO2mOi6JM9Mst27E0vp68=
got:       sha256-+B2+Fe4djPzHHcUXRx+m0cuyaopAhW0PcHsMgYfV5VE=

Verified locally with nix build .#web.npmDeps — clean.

2. Harden `fix-lockfiles` against magic-cache throttling

While verifying #1, the auxiliary nix-lockfile-check job kept failing with:

GitHub API error: GitHub Actions Cache throttled Magic Nix Cache. Not trying to use it again on this run.
…
error: some outputs of '/nix/store/...-npm-deps.drv' are not valid, so checking is not possible

The fix-lockfiles script in nix/lib.nix then bailed with build failed with no hash mismatch and exit 1 — even though the actual nix (ubuntu-latest) build passed both web AND tui in the same workflow.

The script now recognizes throttling / cache-disabled signatures (HTTP 418, "substituter … disabled", "outputs … not valid") and skips the entry with a warning instead of failing the lint. Real stale hashes still surface in the primary .#$ATTR build, so we don't lose coverage.

Test plan

Local: nix build .#web.npmDeps succeeds with new hash.
CI: nix (ubuntu-latest) + nix (macos-latest) both green on previous push.
CI: nix-lockfile-check no longer false-failing on cache-throttled runs.

Refs

Originating drift: fix: replace all buttons for design system buttons #17007 (austin/fix/more-design-system) + follow-up commits that touched web/package-lock.json.
Auto-fix CI added in ci(nix): auto-fix stale npm hashes on push to main #16285 was supposed to catch the original drift; appears not to have run on those merges. Worth a separate look but outside this PR's scope.
Closes fix(nix): refresh hermes-web npm-deps hash #17133.

`web/package-lock.json` was updated by the design-system refactor (merged via #17007 + follow-ups: spinner / select / badges / buttons) without bumping `nix/web.nix::npmDeps.hash`, breaking nix builds on every PR + main since 2026-04-28T18:46. Hash sourced from the actual `Check flake` failure output: specified: sha256-AahWmJ9gDQ9pMPa1FYwUjYdO2mOi6JM9Mst27E0vp68= got: sha256-+B2+Fe4djPzHHcUXRx+m0cuyaopAhW0PcHsMgYfV5VE= Standalone single-file fix so it can land fast and clear nix on every other open PR.

alt-glitch · 2026-04-28T23:33:17Z

Likely overlaps with #17133 — both refresh the stale npmDepsHash in nix/web.nix. One should be closed in favor of the other.

…iles Round 1 of #17174 hit `nix-lockfile-check` failure. Root cause was NOT a stale hash — the primary `nix (ubuntu-latest)` and `nix (macos-latest)` builds passed. GitHub's Magic Nix Cache returned HTTP 418 (rate-limited / throttled) mid-run, so the rebuild bailed with `some outputs of '/nix/store/...-npm-deps.drv' are not valid, so checking is not possible` — no `got:` line for the script to extract. The script then incorrectly treated this as 'build failed with no hash mismatch' and exited 1, breaking the lint on every PR whenever the cache is throttled. Now we recognize the throttling/cache-disabled signature and skip that entry with a warning. A real stale hash still surfaces in the primary `.#$ATTR` build (separate CI job), so we don't lose coverage.

OutThisLife · 2026-04-28T23:46:35Z

Note: closes/supersedes #17133 (which had only the hash refresh). This PR adds the fix-lockfiles hardening so the auxiliary nix-lockfile-check job stops false-failing when GitHub's Magic Nix Cache rate-limits mid-run.

…iles Round 1 of NousResearch#17174 hit `nix-lockfile-check` failure. Root cause was NOT a stale hash — the primary `nix (ubuntu-latest)` and `nix (macos-latest)` builds passed. GitHub's Magic Nix Cache returned HTTP 418 (rate-limited / throttled) mid-run, so the rebuild bailed with `some outputs of '/nix/store/...-npm-deps.drv' are not valid, so checking is not possible` — no `got:` line for the script to extract. The script then incorrectly treated this as 'build failed with no hash mismatch' and exited 1, breaking the lint on every PR whenever the cache is throttled. Now we recognize the throttling/cache-disabled signature and skip that entry with a warning. A real stale hash still surfaces in the primary `.#$ATTR` build (separate CI job), so we don't lose coverage.