From f5fef53cfc38bf8563370e41dce518b55309119c Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 03:35:17 +0000
Subject: [PATCH 1/2] Update dependency NousResearch/hermes-agent to v2026.7.30

---
 images/hermes/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/images/hermes/Dockerfile b/images/hermes/Dockerfile
index 37843c5..e937d71 100644
--- a/images/hermes/Dockerfile
+++ b/images/hermes/Dockerfile
@@ -11,7 +11,7 @@ FROM ${BASE_IMAGE}
 # Pin to a calendar-versioned Hermes Agent tag. Bump deliberately; releases
 # are roughly weekly. Override with --build-arg HERMES_VERSION=... for dev.
 # renovate: datasource=github-tags depName=NousResearch/hermes-agent
-ARG HERMES_VERSION=v2026.7.7
+ARG HERMES_VERSION=v2026.7.30
 
 LABEL org.opencontainers.image.source="https://github.com/NousResearch/hermes-agent" \
       org.opencontainers.image.description="Hermes Agent guest image for Brood Box" \

From 96cf510f816b894abfcef4b2d39dd9634867b202 Mon Sep 17 00:00:00 2001
From: Juan Antonio Osorio <ozz@stacklok.com>
Date: Sat, 1 Aug 2026 13:42:41 +0300
Subject: [PATCH 2/2] Fix hermes image: use editable install for v2026.7.30+

Upstream v2026.7.30 added a setup.py guard that raises RuntimeError for
non-editable wheel/sdist builds, breaking our pip install that built a
wheel then deleted the source. Switch to an editable install (-e) which
uses build_editable instead of bdist_wheel, bypassing the guard. The
source tree must now stay in the image since the editable link points
back to it.
---
 images/hermes/Dockerfile | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/images/hermes/Dockerfile b/images/hermes/Dockerfile
index e937d71..1f8d330 100644
--- a/images/hermes/Dockerfile
+++ b/images/hermes/Dockerfile
@@ -17,15 +17,19 @@ LABEL org.opencontainers.image.source="https://github.com/NousResearch/hermes-ag
       org.opencontainers.image.description="Hermes Agent guest image for Brood Box" \
       org.opencontainers.image.licenses="Apache-2.0"
 
-# Clone a pinned tag (deterministic, no curl|bash), build an isolated venv
-# with the minimal feature set — core CLI + MCP client (for the brood-box
-# vmcp sandbox-tools endpoint) + ACP (Agent Client Protocol for editors).
-# Heavy optional extras (messaging, slack, matrix, voice, rl, bedrock,
-# mistral, ...) are intentionally excluded here; a future hermes-voice /
-# hermes-messaging variant can layer them on.
+# Clone a pinned tag (deterministic, no curl|bash) and install into an
+# isolated venv with the minimal feature set — core CLI + MCP client (for
+# the brood-box vmcp sandbox-tools endpoint) + ACP (Agent Client Protocol
+# for editors). Heavy optional extras (messaging, slack, matrix, voice,
+# rl, bedrock, mistral, ...) are intentionally excluded here; a future
+# hermes-voice / hermes-messaging variant can layer them on.
 #
-# The source tree is deleted after `pip install` — installed package code
-# lives in the venv's site-packages, so the clone is dead weight.
+# As of v2026.7.30, upstream added a setup.py guard that raises
+# RuntimeError for non-editable wheel/sdist builds (they distribute via
+# shell installer, Docker, or Nix only). An editable install (-e) uses
+# build_editable, which does NOT call bdist_wheel, so the guard does not
+# fire. The trade-off is that the source tree must stay in the image —
+# an editable install links back to it — so it is no longer deleted.
 #
 # Known drift: Hermes's ~100 transitive PyPI wheels are not hash-locked.
 # Two rebuilds of the same HERMES_VERSION can produce byte-different
@@ -34,6 +38,5 @@ LABEL org.opencontainers.image.source="https://github.com/NousResearch/hermes-ag
 RUN git clone --depth 1 --branch "${HERMES_VERSION}" \
         https://github.com/NousResearch/hermes-agent.git /opt/hermes/src && \
     python3 -m venv /opt/hermes/venv && \
-    /opt/hermes/venv/bin/pip install --no-cache-dir "/opt/hermes/src[mcp,acp]" && \
-    ln -s /opt/hermes/venv/bin/hermes /usr/local/bin/hermes && \
-    rm -rf /opt/hermes/src
+    /opt/hermes/venv/bin/pip install --no-cache-dir -e "/opt/hermes/src[mcp,acp]" && \
+    ln -s /opt/hermes/venv/bin/hermes /usr/local/bin/hermes