fix(release): stage the desktop package.json bump so it lands in the release commit (#68783)

[PRATHAMESH75]

What

The desktop app's apps/desktop/package.json version was stuck at 0.17.0 through the v0.18.x and v0.19.0 releases, so built Hermes.app bundles reported a stale CFBundleShortVersionString even when the source was current.

Fixes #68783.

Root cause

update_version_files() already rewrites apps/desktop/package.json in lockstep with pyproject.toml. But the release commit staged a hardcoded subset:

add_files = [str(VERSION_FILE), str(PYPROJECT_FILE)]
if ACP_REGISTRY_MANIFEST.exists():
    add_files.append(str(ACP_REGISTRY_MANIFEST))

apps/desktop/package.json was written to the working tree but never added to that list, and the commit isn't -a, so the bump was silently dropped from every release commit. __init__.py, pyproject.toml, and the ACP manifest stayed in lockstep; the desktop version drifted.

Fix

Rather than append one more path (which drifts again the next time a file is added to the bump), make the write set and the stage set derive from a single source:

• update_version_files() now returns the exact list of files it wrote (VERSION_FILE, PYPROJECT_FILE, apps/desktop/package.json when present, and the ACP manifest when present).
• main() stages exactly that returned list, so a newly-bumped file can't be left out of the release commit again.
• Promoted the desktop path to a module constant DESKTOP_PACKAGE_JSON alongside the other version-file constants.
• One-time correction: bumped the currently-stale apps/desktop/package.json to 0.19.0 to match hermes_cli.__version__, so the symptom is resolved now (not only on the next release).

Tests

tests/scripts/test_release_acp_registry.py:

• New: update_version_files() bumps and returns the desktop package.json path (the write-without-return is exactly how it got dropped).
• New: absent desktop app (older release branches) — no raise, path not returned.
• Hardened the shared test loader to re-pin DESKTOP_PACKAGE_JSON to the temp tree; without this the module-level constant (resolved against the real REPO_ROOT at import) would have let the existing end-to-end test scribble on the real repo file.

Full suite: 5 passed. Preflight (windows-footguns, ruff, affected tests) green vs upstream/main.

[PRATHAMESH75]

Rebased onto current upstream/main and reshaped to fit the release-script refactor that landed since this PR opened:

• Upstream now writes apps/desktop/package.json via a local desktop_pkg var (the DESKTOP_PACKAGE_JSON module constant this PR added is gone), and the ACP-registry/pip-wheel machinery was ripped out (rip out brew + pip/PyPI wheel support #68217), which also deleted tests/scripts/test_release_acp_registry.py.
• The underlying bug is unchanged and still present on upstream/main: update_version_files() writes the desktop bump but main() only stages VERSION_FILE + PYPROJECT_FILE, so the desktop package.json bump is silently dropped from the release commit.
• Fix is the same shape: update_version_files() now returns the exact set of files it wrote and main() stages that set. The stale apps/desktop/package.json (still 0.17.0 upstream) is corrected to 0.19.0 to match hermes_cli.__version__.
• Coverage moved to a new focused file tests/scripts/test_release_version_files.py (the old ACP test file no longer exists). ruff clean; test_contributor_map.py still green.

[teknium1]

Thanks for tracing this to the release commit staging boundary. The defect remains on current main: scripts/release.py:2198-2207 rewrites the desktop package.json, while scripts/release.py:2543-2548 stages only VERSION_FILE and PYPROJECT_FILE. Current source also confirms the resulting drift: apps/desktop/package.json:5 is 0.17.0, while hermes_cli/__init__.py:17 and pyproject.toml:5 are 0.19.0.

The proposed write-set/ stage-set contract directly covers that path, and tests/scripts/test_release_version_files.py exercises both present and absent desktop-package cases. The scoped current-main history shows no intervening change to this release logic, so this should be a mechanical salvage.

Automated hermes-sweeper review.

[GottZ]

This was generated by AI during triage.

Summary

One PR directly addresses issue #68783. #68796 corrects the desktop version from 0.17.0 to 0.19.0 and fixes the release-process cause by staging the exact set of version files written by update_version_files().

Related pull requests

• fix(release): stage the desktop package.json bump so it lands in the release commit (#68783) #68796 best fix — (+92/-6) — n/a (recorded best fix): The diff makes update_version_files() return every file it writes, stages that returned set, and adds focused tests for both present and absent desktop package files. It also corrects apps/desktop/package.json to 0.19.0; this supports the keep_open review, which confirms the staging defect remains on current main and rates the change highly salvageable.

Suggested consolidation

Keep #68796 open with a salvage path, consistent with the automated keep_open verdict: preserve its write-set/stage-set contract, desktop version correction, and focused regression tests. There are no competing PRs in this complex to close as duplicates.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I68783(["issue #68783 (open)"])
    P68796["PR #68796 (open)"]
    P68796 -->|best fix| I68783
    class I68783 open
    class P68796 open
    class P68796 best
    class P68796 target
    click I68783 "https://github.com/NousResearch/hermes-agent/issues/68783"
    click P68796 "https://github.com/NousResearch/hermes-agent/pull/68796"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 1 pull request and 1 issue in this complex. Each diff was read against this issue; Assessment working set: 6 kB of PR diffs, 4 kB of issue/PR text, 2 kB of discussion (3 comments), 2 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.