mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-06-13 09:01:54 +00:00
8eedb50bce
Hermes-Setup.exe is a small signed Rust+Tauri binary that drives
scripts/install.ps1 stage-by-stage with a native UI matching the
desktop's design language. Replaces the chicken-and-egg pattern of
shipping a 200MB Electron app whose first launch existed only to
run install.ps1.
The architecture:
Rust backend (src-tauri/):
bootstrap.rs orchestrator -- Tauri commands, stage iteration
install_script.rs resolve install.ps1 (dev checkout, cache, GitHub raw)
powershell.rs spawn powershell, line-stream stdout/stderr, parse JSON
events.rs BootstrapEvent types -- mirror bootstrap-runner.cjs
paths.rs HERMES_HOME resolution + tracing log setup
build.rs bakes BUILD_PIN_COMMIT / BUILD_PIN_BRANCH from
'git rev-parse HEAD' at compile time
React frontend (src/):
Tauri webview rendering 4 screens (welcome / progress / success /
failure), driven by nanostores subscribing to the Rust event stream.
Visual layer reuses the desktop's styles.css wholesale via @import
so the installer and desktop never drift visually.
Distribution:
targets = ['app', 'dmg', 'appimage'] -- no NSIS/MSI wrapper. The
raw target/release/Hermes-Setup.exe IS the artifact on Windows;
.dmg + .app on macOS; AppImage on Linux. One file, double-click,
no installer-installing-an-installer pattern.
Compile-time pinning:
build.rs reads 'git rev-parse HEAD' and emits
cargo:rustc-env=BUILD_PIN_COMMIT=<sha> + BUILD_PIN_BRANCH=<branch>.
bootstrap.rs's option_env!() picks these up so the binary fetches
install.ps1 from the exact SHA it was tested against. CI / release
builds can override via HERMES_BUILD_PIN_COMMIT env var.
Windows manifest:
hermes-setup.manifest declares level='asInvoker' so the
productName 'Hermes Setup' doesn't trip Windows's installer-
detection heuristic and refuse to launch without elevation.
Also declares PerMonitorV2 DPI + UTF-8 active code page + Common
Controls v6.
Limitations of this initial version:
* No code signing -- Windows SmartScreen will warn once on Hermes-Setup.exe
('More info -> Run anyway'). The downstream binaries it produces
(Hermes.exe in win-unpacked/, the hermes CLI) are locally-built and
therefore don't carry MOTW, so they launch without SmartScreen
intervention. Cert procurement tracked separately.
* macOS and Linux build paths defined but untested -- Windows-only V1.
75 lines
3.1 KiB
XML
75 lines
3.1 KiB
XML
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
|
<!--
|
|
Hermes Setup application manifest.
|
|
|
|
The TL;DR: tell Windows we are NOT an installer in the classic "needs
|
|
UAC elevation" sense, despite the product name. We provision into
|
|
%LOCALAPPDATA%\hermes which is user-scoped and never touch HKLM or
|
|
Program Files. install.ps1 runs as a child process and elevates
|
|
itself only if a future stage explicitly needs HKLM access.
|
|
|
|
Without this manifest, the "Hermes Setup" productName embedded in
|
|
the binary's resource trips Windows's installer-detection heuristic
|
|
(https://learn.microsoft.com/en-us/windows/security/identity-protection/
|
|
user-account-control/how-user-account-control-works#installer-detection)
|
|
and CreateProcess fails with ERROR_ELEVATION_REQUIRED (740) when the
|
|
user double-clicks. asInvoker disables that.
|
|
-->
|
|
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
|
|
<assemblyIdentity
|
|
version="0.0.1.0"
|
|
processorArchitecture="*"
|
|
name="NousResearch.Hermes.Setup"
|
|
type="win32"
|
|
/>
|
|
<description>Hermes Setup</description>
|
|
|
|
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
|
|
<security>
|
|
<requestedPrivileges>
|
|
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
|
|
</requestedPrivileges>
|
|
</security>
|
|
</trustInfo>
|
|
|
|
<!-- Tell Windows we know about all supported OSes (10 + 11) so it
|
|
doesn't shim us into Vista-compat mode. -->
|
|
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
|
|
<application>
|
|
<!-- Windows 10 / 11 -->
|
|
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
|
|
<!-- Windows 8.1 -->
|
|
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
|
|
<!-- Windows 8 -->
|
|
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
|
|
<!-- Windows 7 -->
|
|
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
|
|
<!-- Windows Vista -->
|
|
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
|
|
</application>
|
|
</compatibility>
|
|
|
|
<!-- Per-monitor v2 DPI awareness so the installer doesn't go blurry
|
|
on high-DPI displays when dragged between monitors. -->
|
|
<application xmlns="urn:schemas-microsoft-com:asm.v3">
|
|
<windowsSettings>
|
|
<dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2</dpiAwareness>
|
|
<activeCodePage xmlns="http://schemas.microsoft.com/SMI/2019/WindowsSettings">UTF-8</activeCodePage>
|
|
</windowsSettings>
|
|
</application>
|
|
|
|
<!-- Use the modern common controls (v6 themes). Without this, our
|
|
file picker / shell dialogs fall back to 1990s-era visuals. -->
|
|
<dependency>
|
|
<dependentAssembly>
|
|
<assemblyIdentity
|
|
type="win32"
|
|
name="Microsoft.Windows.Common-Controls"
|
|
version="6.0.0.0"
|
|
processorArchitecture="*"
|
|
publicKeyToken="6595b64144ccf1df"
|
|
language="*"
|
|
/>
|
|
</dependentAssembly>
|
|
</dependency>
|
|
</assembly>
|