[Bug]: Hermes Studio auto-update misses pip dependencies in embedded Python runtime (2nd occurrence)

[zhengzhangerp-oss]

Summary

Hermes Studio auto-updates leave the new embedded Python runtime missing pip dependencies, causing silent failures. This is the second occurrence of the same class of bug (v9: missing .py source file, v10: missing pip package).

Environment

Item	Value
OS	Windows 10 Pro
Hermes Studio	0.6.29
Embedded runtime	0.18.2 (auto-upgraded from 0.17.0)
hermes-agent CLI	0.18.0
Affected provider	minimax-cn (transport: anthropic_messages)
Unaffected provider	deepseek (transport: openai_chat)

Root Cause

Hermes Studio's desktop runtime (~/.hermes-web-ui/desktop-runtime/hermes/{version}/win-x64/python/) is an independent Python environment, completely isolated from the CLI venv. When Studio performs a major version upgrade, the new runtime directory is created but pip dependencies are NOT synced.

This is the second occurrence (v9: missing source file, v10: missing pip package). Both share the same root cause.

Proposed Fix

1. Short-term: Add a dependency integrity check on Studio startup, auto-triggering pip install when packages are missing
2. Long-term: Add a pip sync step to the Studio version upgrade process

Workaround

$RT = "$env:USERPROFILE\.hermes-web-ui\desktop-runtime\hermes\{version}\win-x64\python\python.exe"
& $RT -m pip install anthropic==0.87.0
Remove-Item -Recurse -Force "$env:USERPROFILE\.hermes-web-ui\desktop-runtime\hermes\{version}\win-x64\python\Lib\site-packages\anthropic\__pycache__"
# Restart Hermes Studio

---

CVE note: pyproject.toml and lazy_deps.py pin anthropic==0.87.0 due to CVE-2026-34450 and CVE-2026-34452.

[teknium1]

This is an automated hermes-sweeper review. The reported missing Anthropic dependency path is already handled on current main.

• agent/agent_init.py:773 routes anthropic_messages providers, including the reported MiniMax-compatible transport, through the Anthropic adapter.
• agent/anthropic_adapter.py:42-43 invokes ensure("provider.anthropic", prompt=False) before importing the SDK.
• tools/lazy_deps.py:95-100 pins that feature to anthropic==0.87.0; tools/lazy_deps.py:739-840 installs missing dependencies into the active venv and verifies the result.
• apps/desktop/electron/main.ts:2396-2416 also blocks Windows update handoff when a locked venv could leave dependency synchronization partially applied.

Current GitHub main is f8b6d381e2f8e8b2cf84ac0e9e628ea062a173e3; the commits after the inspected snapshot do not alter these paths.