lazy_deps: shared aiohttp pin marks never-enabled backends active; matrix refresh then fails on Windows (python-olm needs make)

[cfkleins]

Environment

• hermes-agent 0.18.0, checkout at 7203898
• Windows 11 Home (10.0.26200), Python 3.11.15, uv 0.11.26

Symptom

Every hermes update run ends the lazy-backend refresh with:

→ Refreshing 19 active lazy backend(s)...
  ⚠ platform.matrix failed to refresh: pip install failed: ...setuptools\dist.py", line 810, in _finalize_setup_keywords

The user has never enabled the Matrix platform. None of its real packages (mautrix, aiosqlite, asyncpg, aiohttp-socks) were installed.

Root cause (two bugs compounding)

1. active_features() false-positives on shared pinned deps (tools/lazy_deps.py):

def active_features() -> list[str]:
    ...
    if any(_is_present(s) for s in specs):
        active.append(feature)

A feature counts as "active" if any one of its declared packages is installed. platform.matrix, platform.slack, platform.discord, homeassistant, sms, and teams all declare the CVE-floor pin aiohttp==3.14.1. But aiohttp is an unconditional dependency of packages present in a typical install (edge-tts, firecrawl-py, discord.py), so all of those backends read as "active" for users who never enabled them — and hermes update proceeds to install their full stacks. On this machine that silently pulled in complete Discord and Slack stacks over successive updates.

2. mautrix[encryption] cannot build on Windows. The extra pulls python-olm==3.2.16, whose cffi build script compiles libolm by shelling out to make:

File "olm_build.py", line 51, in <module>
    subprocess.run(["make", "static"], cwd="libolm", check=True)
FileNotFoundError: [WinError 2] The system cannot find the file specified

So the falsely-activated matrix backend fails its refresh on every update, forever (the updater's "rerun hermes update once the upstream issue is resolved" hint never resolves).

Suggested fix

Make activity detection use a package that identifies the feature, e.g. treat the first-listed spec as primary:

if _is_present(specs[0]):
    active.append(feature)

Every LAZY_DEPS entry already lists its distinctive SDK first (mautrix[...], slack-bolt, discord.py[voice], ...), with shared floor pins like aiohttp appended after. Alternatively, exclude specs that appear in more than one feature (or in the core dependency closure) from the presence check.

Separately, platform.matrix on Windows might want a sys_platform != 'win32' guard or a documented libolm prerequisite, since python-olm ships no Windows wheels.

Workaround

Installing the matrix pins without the extra satisfies the refresh check (extras are ignored by _is_satisfied), silencing the failure until the pin moves:

uv pip install mautrix==0.21.0 aiosqlite==0.22.1 asyncpg==0.31.0 aiohttp-socks==0.11.0

[Ahmett101]

I'm working on this. Branch will be at: https://github.com/Ahmett101/hermes-agent/tree/fix/58458-active-features-primary-spec-dispatch

[Ahmett101]

PR submitted: #58488 — switches active_features() to primary-spec dispatch so shared supporting pins like the CVE-floor aiohttp don't false-activate neighboring backends.

[Ahmett101]

Superseded by #54178 (spiky02plateau, opened 2026-06-28) — same fix (specs[0] signature dispatch) plus a specs and empty-tuple guard plus a release.py credit. Closing my #58488 to avoid duplicate work; glad spiky02 got there first.

[NorethSea]

I can still reproduce this on macOS after updating to hermes-agent==0.18.2.

Environment:

• macOS 26.5.2, arm64
• hermes-agent 0.18.2
• Python 3.11.15
• pip 24.0
• checkout: 92a2f97d4
• tag description: v2026.7.7.2-10-g92a2f97d41

Update output:

→ Updating Python dependencies...
Using Python 3.11.15 environment at: venv
Resolved 95 packages in 428ms
      Built hermes-agent @ file:///Users/chenying/.hermes/hermes-agent
Prepared 1 package in 1.28s
Uninstalled 1 package in 0.87ms
Installed 1 package in 2ms
 - hermes-agent==0.18.1 (from file:///Users/chenying/.hermes/hermes-agent)
 + hermes-agent==0.18.2 (from file:///Users/chenying/.hermes/hermes-agent)

→ Refreshing 14 active lazy backend(s)...
  ✓ 13 already current
  ⚠ platform.matrix failed to refresh: pip install failed: .../pip-build-env-p3see2j1/overlay/lib/python3.11/site-packages/setuptools/dist.py", line 790, in finalize_options
          ep(self)
...
  Backends keep their previously-installed version; rerun
  `hermes update` once the upstream issue is resolved.

Local package state:

aiohttp==3.14.1 is installed
mautrix is not installed
python-olm is not installed
aiohttp is required by discord.py and edge-tts

The local tools/lazy_deps.py still has:

if any(_is_present(s) for s in specs):
    active.append(feature)

So this appears to be the same false-positive active backend detection described here, but reproduced on macOS as well. The proposed fix in #54178 should likely address this case too.