Make native Hermes setup retryable without a late sudo step

Stage the initial clone before publishing its ownership marker and build the desktop through the same native CLI used by updates. Keep a concurrent checkout intact and reset pkgrel for the version change.

Co-Authored-By: Claude Opus 5 (default) <noreply@anthropic.com>

pkgbuilds/hermes-desktop/PKGBUILD

@@ -2,7 +2,7 @@
 
 pkgname=hermes-desktop
 pkgver=2026.8.31
-pkgrel=2
+pkgrel=1
 pkgdesc='Installer and launcher for the self-updating Hermes desktop'
 arch=('x86_64')
 url='https://github.com/NousResearch/hermes-agent'
@@ -30,7 +30,7 @@ source=("install-${_commit}.sh::https://raw.githubusercontent.com/NousResearch/h
         'hermes-desktop.png')
 sha256sums=('5854b15670b51a8daae8f59ddfa917062de9f74be261eb73b4b8d719710f8968'
             '821556e6336796450ab852d375117b48a4887e71d255794fd6318d99982a5ab6'
-            '5113ba692fe00b0f4806f799ce16b85a44bb2bd901ca17577ba64c887b1fb33d'
+            'b4c282ead8a5d1a631f702474ea36eb7362ab1f0f87ad2e71f60a8698de07035'
             'c37d4cfa4801eccbd769fddaebb2115d54faa49a5b7bc0f305f563e3cefd9bd8'
             'd60d164e24fdcf6532133b8ea43c77a201e4b9e9dbc396187b58d51d8590ef52')
 

pkgbuilds/hermes-desktop/hermes-desktop.sh

@@ -66,7 +66,7 @@ restore_launchers() {
 }
 
 stage() {
-  bash "$installer" --dir "$root" --branch main --non-interactive --stage "$1"
+  bash "$installer" --dir "${2:-$root}" --branch main --non-interactive --stage "$1"
 }
 
 install_desktop() {
@@ -170,20 +170,29 @@ PY
     env -u PYTHONPATH -u PYTHONHOME "${cli[@]}" update --yes --branch main
   elif [[ ! -e $root ]]; then
     stage prerequisites
-    stage repository
-    printf '/.omarchy-hermes-desktop\n' >>"$root/.git/info/exclude"
-    printf 'pending\n' >"$marker"
+    # Publish only a complete clone with its ownership marker. An interrupted
+    # clone stays aside for inspection and cannot block the next installation.
+    local repository_dir
+    repository_dir=$(mktemp -d "$HERMES_HOME/.omarchy-hermes-repository.XXXXXX")
+    echo "Preparing the Hermes checkout in $repository_dir"
+    stage repository "$repository_dir/hermes-agent"
+    printf '/.omarchy-hermes-desktop\n' >>"$repository_dir/hermes-agent/.git/info/exclude"
+    printf 'pending\n' >"$repository_dir/hermes-agent/.omarchy-hermes-desktop"
+    mv -T --no-clobber "$repository_dir/hermes-agent" "$root"
+    [[ ! -e $repository_dir/hermes-agent ]] || die "Keeping the checkout that appeared at $root during installation."
+    rmdir "$repository_dir"
   fi
 
   if [[ $mise_predecessor == true ]]; then
     printf '%s\n' 'pipx:hermes-agent[extras=all]' >"$root/.git/omarchy-mise-predecessor"
   fi
 
-  if [[ $legacy == true ]]; then
-    env -u PYTHONPATH -u PYTHONHOME "${cli[@]}" desktop --build-only
-  else
-    for command in venv python-deps node-deps config desktop; do stage "$command"; done
+  if [[ $legacy == false ]]; then
+    for command in venv python-deps node-deps config; do stage "$command"; done
   fi
+  # The native builder also handles updates and supports the namespace
+  # sandbox. The shell installer's desktop stage still requires a sudo chown.
+  env -u PYTHONPATH -u PYTHONHOME "${cli[@]}" desktop --build-only
 
   # Build first: a failed download leaves the old terminal CLI usable.
   stage complete