Guarantee the CLI rather than warning about it

The launcher only delegated to omarchy-install-hermes-cli and, when that was
absent, printed a warning to stderr -- which nothing sees under a graphical
launch -- and started the app anyway. The app then offered to install Hermes
itself, and that copy wins permanently: it checks ~/.hermes/hermes-agent
before it checks PATH, so installing the CLI afterwards changes nothing until
that directory is deleted.

So install it here when omarchy's script isn't around, with the same
interpreter pin and the same exported cooldown, and hand the app the real
executable by putting the mise install's bin directory on PATH instead of
leaving it to search. Its probe allows 15 seconds; resolving this way takes
0.2. mise and uv become dependencies, which is what makes the package
self-sufficient on a machine without Omarchy.

pkgbuilds/hermes-desktop/PKGBUILD

@@ -42,10 +42,12 @@ depends=(
   'libxkbcommon'
   'libxrandr'
   'mesa'
+  'mise'
   'nspr'
   'nss'
   'pango'
   'systemd-libs'
+  'uv'
   'xdg-utils'
 )
 
@@ -71,7 +73,7 @@ source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz
         'hermes-desktop.desktop'
         'hermes-desktop.png')
 sha256sums=('1e3d39d3638ec15fa9d31af262568a953e9272090deb1c50c44cd401175f5b80'
-            'bac4626a3bbde4c05cf6072c05f6c47d1804c99066e04ee5328cea707fae1a3f'
+            'e7c0e1fd343e9b013de4575fbefdd4f03b3b62fb5c2c2dd3c508f4a26b6608ea'
             '3ef685bfcf366776b025d26c37d32854d8d4aa2023b2bd07c8e08b001ef1e8c4'
             'd60d164e24fdcf6532133b8ea43c77a201e4b9e9dbc396187b58d51d8590ef52')
 

pkgbuilds/hermes-desktop/hermes-desktop.sh

@@ -2,22 +2,35 @@
 set -euo pipefail
 
 # The desktop app is only a shell: it runs `hermes serve` against a Hermes CLI
-# it does not ship. Finding none, it clones its own copy with the upstream
-# install script -- an unpinned checkout in ~/.hermes that no package manages.
+# it does not ship. Finding none it offers to install its own, which clones an
+# unpinned checkout into ~/.hermes/hermes-agent -- and that copy then wins
+# forever, because the app checks ~/.hermes before it checks PATH.
 #
-# command -v rather than omarchy-cmd-present: no other launcher in this repo
-# makes a package depend on omarchy, and this has to behave on a plain Arch box.
-# Run the installer even when hermes is already on PATH. A stub can be there
-# and cold, and `mise up` can leave one pointing at a Hermes built against the
-# wrong Python; repairing either costs minutes, and the app allows 15 seconds
-# before it gives up and bootstraps. Installing here is a no-op when healthy.
+# So guarantee the CLI here rather than relying on anything else having run.
+
+tool='pipx:hermes-agent[extras=all]'
+python='3.13'
+
+# Hermes declares Requires-Python <3.14; left to itself uv builds the venv
+# against Arch's 3.14 anyway and only fails later, inside a dependency. The
+# cooldown override is exported so the version resolved to run is the one just
+# installed. Both mirror omarchy-install-hermes-cli -- keep them in step.
+export UV_PYTHON="$python"
+export MISE_MINIMUM_RELEASE_AGE=0
+
 if command -v omarchy-install-hermes-cli >/dev/null 2>&1; then
   omarchy-install-hermes-cli --now
-elif ! command -v hermes >/dev/null 2>&1; then
-  echo "The Hermes CLI is not installed, so Hermes Desktop will install its" >&2
-  echo "own copy under ~/.hermes. Install the CLI first to avoid that." >&2
+elif ! [[ -d "$(mise where "$tool" 2>/dev/null)/hermes-agent/lib/python$python" ]]; then
+  echo "Installing the Hermes CLI (this takes a minute)..." >&2
+  mise use -g --quiet --force "$tool" || true
 fi
 
+# Hand the app the real executable rather than leaving it to search. Its PATH
+# probe allows 15 seconds, which nothing that still has installing to do can
+# meet.
+hermes_bin="$(mise where "$tool" 2>/dev/null)/bin"
+[[ -d $hermes_bin ]] && export PATH="$hermes_bin:$PATH"
+
 # Chromium's own Ozone detection falls back to XWayland often enough to matter,
 # and the result is a blurry window on every scaled display. Ask for Wayland
 # directly, unless the user has already picked a platform themselves.