packaging/homebrew formula still points to 0.6.0 and contains placeholder sha256

[WadydX]

Bug Description

The checked-in Homebrew formula under packaging/homebrew/ appears stale and non-installable as-is.

It points to the old hermes_agent-0.6.0.tar.gz release asset and still contains the placeholder SHA256 value <replace-with-release-asset-sha256>, while the current package version in the repo is 0.12.0.

Inspected against main commit af6f9bc2a12682b06fb3632acf5a9cbf01e74a85.

Steps to Reproduce

Static packaging path:

1. Open packaging/homebrew/hermes-agent.rb from current main.
2. Compare the formula source URL and SHA against the current package version.
3. Try to use/audit the formula as checked in.

Expected Behavior

The repo-provided Homebrew formula should either:

• point at the current release asset with a real SHA256; or
• be clearly marked as a template/example that is not expected to install without release-time substitution.

Actual Behavior

The formula points at an old release asset and contains a placeholder SHA256 value.

Evidence

• packaging/homebrew/hermes-agent.rb:8
  • url "https://github.com/NousResearch/hermes-agent/releases/download/v2026.3.30/hermes_agent-0.6.0.tar.gz"
• packaging/homebrew/hermes-agent.rb:9
  • sha256 "<replace-with-release-asset-sha256>"
• pyproject.toml:7
  • current project version is 0.12.0.
• hermes_cli/__init__.py:17-18
  • current CLI version is 0.12.0, release date 2026.4.30.

Affected Component

Setup / Installation / Packaging

Environment

Static analysis of current main; no local environment-specific behavior required.

Prior Art Checked

I searched existing issues and PRs for:

• replace-with-release-asset-sha256
• hermes_agent-0.6.0.tar.gz
• Homebrew 0.12.0 0.6.0
• broader Homebrew/brew packaging terms

I found older Homebrew packaging work, including the original Homebrew formula request and packaging PRs, but no exact current issue for the stale formula URL plus placeholder SHA.

Root Cause Analysis

The Homebrew formula was likely added as release packaging scaffolding and then not updated with the current release asset/version and computed SHA256.

Proposed Fix

Either:

1. update packaging/homebrew/hermes-agent.rb to the current release artifact and SHA256 during release, or
2. rename/comment the file clearly as a template and document the release-time substitution step so users do not treat it as a working formula.

[WadydX]

Quick recheck on current main (64145a199): this is still reproducible.

packaging/homebrew/hermes-agent.rb still points to:

• hermes_agent-0.6.0.tar.gz
• sha256 "<replace-with-release-asset-sha256>"

So the formula remains stale/non-installable as committed.

[WadydX]

Opened fix PR: #23766

It updates the Homebrew formula URL/version/SHA to a current installable source and removes the placeholder SHA.

[GottZ]

This was generated by AI during triage.

Summary

Fourteen PRs address or reference this packaging complex. For #19690 specifically, #19853 replaces the stale URL and placeholder checksum but omits the required formula version, while closed #23766 updates URL, SHA256, and version together; the remaining PRs cover related wheel-subpackage, Homebrew asset, desktop, or WhatsApp packaging failures rather than the reported formula metadata defect.

Related pull requests

• fix(homebrew): replace stale formula source and checksum for Hermes #19853 partial — (+4/-4) — partial fix: Replaces the broken 0.6.0 release URL and placeholder SHA256 with a verified v2026.4.30 archive, but omits the matching version "0.12.0". Despite the keep_open review on fix(homebrew): replace stale formula source and checksum for Hermes #19853, its diff remains incomplete because the formula test and documented release flow require URL, version, and SHA to move together.
• fix(homebrew): update in-repo formula URL/version/SHA and remove placeholder (#19690) #23766 [closed] best fix — (+5/-4) — best complete fix: Replaces the stale URL and placeholder SHA256 with a verified v2026.5.7 archive and adds the matching version "0.13.0", directly covering every element of packaging/homebrew formula still points to 0.6.0 and contains placeholder sha256 #19690. Although closed as a duplicate of fix(homebrew): replace stale formula source and checksum for Hermes #19853, it remains relevant because its diff contains the version field missing from fix(homebrew): replace stale formula source and checksum for Hermes #19853.
• fix(packaging): include hermes_cli subpackages in wheel (#27664) #27726 [closed] unverified — (+19/-1) — related wheel fix, not a direct packaging/homebrew formula still points to 0.6.0 and contains placeholder sha256 #19690 fix: Adds hermes_cli.* and a regression test to prevent proxy subpackages from being omitted from wheels. It was closed as superseded by broader fix(packaging): add missing package wildcards, manifest grafts, and update homebrew formula #27728, and its test also depended on setuptools absent from that CI environment.
• fix(packaging): add missing package wildcards, manifest grafts, and update homebrew formula #27728 [closed] partial — (+46/-6) — broad partial packaging fix: Includes a Homebrew archive/checksum refresh alongside TUI assets, manifest grafts, and package wildcards, but does not set the formula version and later became stale against artifact, Python, and support-policy constraints. Despite the keep_open review on fix(packaging): add missing package wildcards, manifest grafts, and update homebrew formula #27728, its own author closed it as superseded by fix(packaging): update Homebrew formula for v2026.6.5 #45978, and the diff is not a clean replacement for the focused packaging/homebrew formula still points to 0.6.0 and contains placeholder sha256 #19690 fix.
• fix(packaging): add hermes_cli.* to setuptools include so proxy subpa… #28060 [closed] unverified — (+98/-100) — related wheel fix with unrelated lockfile churn: Adds the same hermes_cli.* wildcard needed for proxy subpackages, but does not repair the stale Homebrew formula and carries a large dependency lock refresh. It was closed as a duplicate of fix(packaging): add missing package wildcards, manifest grafts, and update homebrew formula #27728.
• fix(packaging): include hermes_cli subpackages in wheel (#27938) #28231 [closed] unverified — (+1/-1) — related wheel fix: Adds only hermes_cli.*, resolving omitted proxy subpackages but not the URL/version/SHA defect in packaging/homebrew formula still points to 0.6.0 and contains placeholder sha256 #19690. It was closed as a strict duplicate of fix(packaging): add missing package wildcards, manifest grafts, and update homebrew formula #27728.
• fix(packaging): add hermes_cli.* to setuptools include so proxy subpackage ships in wheel #28820 [closed] unverified — (+1/-1) — related wheel fix: Repeats the one-line hermes_cli.* package-discovery change and does not touch the Homebrew formula. It was closed as another duplicate of fix(packaging): add missing package wildcards, manifest grafts, and update homebrew formula #27728.
• fix(wheel): include hermes_cli subpackages in wheel build #34505 [closed] unverified — (+1/-1) — related wheel fix: Adds hermes_cli.* so dashboard_auth and proxy ship in wheels, addressing a later manifestation of the package-glob defect rather than packaging/homebrew formula still points to 0.6.0 and contains placeholder sha256 #19690. It was closed as a duplicate of fix(packaging): add missing package wildcards, manifest grafts, and update homebrew formula #27728.
• fix(packaging): include hermes_cli subpackages in wheel build #34717 [closed] unverified — (+1/-1) — related wheel fix: Makes the identical hermes_cli.* change for dashboard and proxy imports but leaves the stale Homebrew metadata untouched. It was closed as a duplicate of fix(packaging): add missing package wildcards, manifest grafts, and update homebrew formula #27728.
• fix(packaging): ship hermes_cli subpackages in wheel #34811 [merged] unverified — (+50/-1) — merged reference implementation for the wheel issue: Adds hermes_cli.* plus a general regression test covering all on-disk subpackages, resolving the proxy/dashboard branch of this packaging complex on main. It remains relevant as the merged canonical replacement for fix(packaging): include hermes_cli subpackages in wheel (#27664) #27726, fix(packaging): add hermes_cli.* to setuptools include so proxy subpa… #28060, fix(packaging): include hermes_cli subpackages in wheel (#27938) #28231, fix(packaging): add hermes_cli.* to setuptools include so proxy subpackage ships in wheel #28820, fix(wheel): include hermes_cli subpackages in wheel build #34505, and fix(packaging): include hermes_cli subpackages in wheel build #34717, but it does not fix packaging/homebrew formula still points to 0.6.0 and contains placeholder sha256 #19690.
• fix(packaging): update Homebrew formula for v2026.6.5 #45978 partial — (+12/-7) — unsafe/stale Homebrew partial fix: Updates formula metadata, Python, and TUI handling, but references a release asset that does not exist and installs ui-tui from an sdist that does not contain it. Despite the keep_open review on fix(packaging): update Homebrew formula for v2026.6.5 #45978, that review assigns no salvageability and documents current unsupported-Homebrew policy, so this diff should not replace fix(homebrew): update in-repo formula URL/version/SHA and remove placeholder (#19690) #23766.
• fix(cli): detect hermes root in package installations (Brew, pip) #61076 unverified — (+211/-1) — unrelated incomplete desktop packaging fix: Adds repository-root discovery for Brew/pip installs, but searching cannot recover the unshipped Electron source and the tests duplicate rather than invoke production code. Despite the keep_open review on fix(cli): detect hermes root in package installations (Brew, pip) #61076, the diff does not solve its own packaged-artifact prerequisite and has no bearing on packaging/homebrew formula still points to 0.6.0 and contains placeholder sha256 #19690.
• fix: resolve desktop GUI source via HERMES_DESKTOP_SOURCE env var for managed installs (#61056) #61085 [closed] unverified — (+41/-17) — related managed-desktop partial fix: Adds HERMES_DESKTOP_SOURCE, packages apps/desktop, and adjusts doctor output, but omits the required apps/shared workspace dependency and regression coverage. Although its keep_open review called it salvageable, it was later closed as stale and remains separate from the formula URL/version/SHA correction.
• fix(whatsapp): add whatsapp-bridge to Homebrew package (#63782) #63987 unverified — (+6/-0) — related WhatsApp packaging partial fix: Installs the bridge at the runtime-resolved site-packages path, but the Homebrew sdist does not contain the source directory being copied. Despite the keep_open review on fix(whatsapp): add whatsapp-bridge to Homebrew package (#63782) #63987, the required MANIFEST inclusion and artifact assertion are absent, and this is independent of packaging/homebrew formula still points to 0.6.0 and contains placeholder sha256 #19690.

Duplicates

#19853 and #23766 substantially overlap on the #19690 Homebrew URL/SHA refresh, with #23766 additionally supplying the required version. #27726, #28060, #28231, #28820, #34505, and #34717 repeat the hermes_cli.* wheel-discovery fix that was ultimately merged with stronger regression coverage in #34811; #27728 also contained that change plus broader packaging work. #61076 and #61085 are alternative incomplete approaches to the desktop packaged-layout problem.

Suggested consolidation

Merge #23766 as the focused #19690 fix, preferably by transplanting its exact URL/SHA/version hunk onto current main if reopening the closed PR is undesirable. Close #19853 as superseded because, despite its keep_open review, its diff omits the required formula version; do not substitute #27728 or #45978 because their broader Homebrew changes are stale or invalid, and treat the wheel, desktop, and WhatsApp PRs as separate packaging issues, with #34811 already serving as the merged wheel reference implementation.

Complex graph

flowchart TD
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I19690(["issue #19690 (open)"])
    I27664(["issue #27664 (closed)"])
    I27938(["issue #27938 (closed)"])
    I34346(["issue #34346 (closed)"])
    I34701(["issue #34701 (closed)"])
    I61056(["issue #61056 (open)"])
    I63782(["issue #63782 (open)"])
    P27728["PR #27728 (closed)"]
    P45978["PR #45978 (open)"]
    P61076["PR #61076 (open)"]
    P61085["PR #61085 (closed)"]
    P63987["PR #63987 (open)"]
    subgraph Dup19853 ["PRs duplicating each other"]
        P19853["PR #19853 (open)"]
        P23766["PR #23766 (closed)"]
    end
    subgraph Dup27726 ["PRs duplicating each other"]
        P27726["PR #27726 (closed)"]
        P28060["PR #28060 (closed)"]
        P28231["PR #28231 (closed)"]
        P28820["PR #28820 (closed)"]
        P34505["PR #34505 (closed)"]
        P34717["PR #34717 (closed)"]
        P34811["PR #34811 (merged)"]
    end
    P19853 -.->|partial| I19690
    P23766 -->|best fix| I19690
    P27726 -.->|unverified| I19690
    P27728 -.->|partial| I19690
    P28060 -.->|unverified| I19690
    P28231 -.->|unverified| I19690
    P28820 -.->|unverified| I19690
    P34505 -.->|unverified| I19690
    P34717 -.->|unverified| I19690
    P34811 -.->|unverified| I19690
    P45978 -.->|partial| I19690
    P61076 -.->|unverified| I19690
    P61085 -.->|unverified| I19690
    P63987 -.->|unverified| I19690
    P27726 -->|fixes| I27664
    P34717 -->|fixes| I27664
    P34811 -->|best fix| I27664
    P28060 -->|fixes| I27938
    P28231 -->|fixes| I27938
    P28820 -->|fixes| I27938
    P34811 -->|best fix| I27938
    P34505 -->|fixes| I34346
    P34811 -->|best fix| I34346
    P34717 -->|fixes| I34701
    P34811 -->|best fix| I34701
    P61085 -.->|partial| I61056
    P63987 -.->|partial| I63782
    class I19690 open
    class I27664 closed
    class I27938 closed
    class I34346 closed
    class I34701 closed
    class I61056 open
    class I63782 open
    class I19690 target
    class P19853 open
    class P23766 closed
    class P27726 closed
    class P27728 closed
    class P28060 closed
    class P28231 closed
    class P28820 closed
    class P34505 closed
    class P34717 closed
    class P34811 merged
    class P45978 open
    class P61076 open
    class P61085 closed
    class P63987 open
    class P23766 best
    class P34811 best
    class P34811 best
    class P34811 best
    class P34811 best
    click I19690 "https://github.com/NousResearch/hermes-agent/issues/19690"
    click I27664 "https://github.com/NousResearch/hermes-agent/issues/27664"
    click I27938 "https://github.com/NousResearch/hermes-agent/issues/27938"
    click I34346 "https://github.com/NousResearch/hermes-agent/issues/34346"
    click I34701 "https://github.com/NousResearch/hermes-agent/issues/34701"
    click I61056 "https://github.com/NousResearch/hermes-agent/issues/61056"
    click I63782 "https://github.com/NousResearch/hermes-agent/issues/63782"
    click P19853 "https://github.com/NousResearch/hermes-agent/pull/19853"
    click P23766 "https://github.com/NousResearch/hermes-agent/pull/23766"
    click P27726 "https://github.com/NousResearch/hermes-agent/pull/27726"
    click P27728 "https://github.com/NousResearch/hermes-agent/pull/27728"
    click P28060 "https://github.com/NousResearch/hermes-agent/pull/28060"
    click P28231 "https://github.com/NousResearch/hermes-agent/pull/28231"
    click P28820 "https://github.com/NousResearch/hermes-agent/pull/28820"
    click P34505 "https://github.com/NousResearch/hermes-agent/pull/34505"
    click P34717 "https://github.com/NousResearch/hermes-agent/pull/34717"
    click P34811 "https://github.com/NousResearch/hermes-agent/pull/34811"
    click P45978 "https://github.com/NousResearch/hermes-agent/pull/45978"
    click P61076 "https://github.com/NousResearch/hermes-agent/pull/61076"
    click P61085 "https://github.com/NousResearch/hermes-agent/pull/61085"
    click P63987 "https://github.com/NousResearch/hermes-agent/pull/63987"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed or no verify verdict yet (state tag in the node label).

Cross-PR triage: Reviewed 14 pull requests and 7 issues in this complex. Each diff was read against this issue; Assessment working set: 98 kB of PR diffs, 37 kB of issue/PR text, 27 kB of discussion (48 comments), 32 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.