feat: bake Herdr v0.7.4 install into Codespace bootstrap

[iamzycao-png]

Summary

Add docker/scripts/fm-install-herdr.sh (the pinned, SHA-256-verified Herdr installer from hermes-webtop) and wire it into post-create-cmd.sh so Herdr is installed at on every fresh Codespace build.

Changes

1. New file: — standalone installer matching the upstream webtop script (96 lines, executable). Pins Herdr v0.7.4 (protocol 16) with official release asset + SHA-256.

2. Modified:
   ***** Installing/Setup Hermes Agent Services .... *****

Get:1 https://packages.microsoft.com/repos/microsoft-ubuntu-noble-prod noble InRelease [3600 B]
Get:2 https://packages.microsoft.com/repos/microsoft-ubuntu-noble-prod noble/main all Packages [643 B]
Get:3 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]
Get:4 https://packages.microsoft.com/repos/microsoft-ubuntu-noble-prod noble/main amd64 Packages [403 kB]
Get:5 https://pkgs.tailscale.com/stable/ubuntu noble InRelease
Get:6 http://archive.ubuntu.com/ubuntu noble InRelease [256 kB]
Get:7 http://security.ubuntu.com/ubuntu noble-security/universe amd64 Packages [1525 kB]
Get:8 http://security.ubuntu.com/ubuntu noble-security/multiverse amd64 Packages [50.0 kB]
Get:9 http://security.ubuntu.com/ubuntu noble-security/restricted amd64 Packages [1721 kB]
Get:10 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages [1193 kB]
Get:11 https://pkgs.tailscale.com/stable/ubuntu noble/main amd64 Packages [15.6 kB]
Get:12 https://pkgs.tailscale.com/stable/ubuntu noble/main all Packages [354 B]
Get:13 http://archive.ubuntu.com/ubuntu noble-updates InRelease [126 kB]
Get:14 http://archive.ubuntu.com/ubuntu noble-backports InRelease [126 kB]
Get:15 http://archive.ubuntu.com/ubuntu noble/multiverse amd64 Packages [331 kB]
Get:16 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages [1808 kB]
Get:17 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages [19.3 MB]
Get:18 http://archive.ubuntu.com/ubuntu noble/restricted amd64 Packages [117 kB]
Get:19 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 Packages [2146 kB]
Get:20 http://archive.ubuntu.com/ubuntu noble-updates/multiverse amd64 Packages [55.8 kB]
Get:21 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages [1522 kB]
Get:22 http://archive.ubuntu.com/ubuntu noble-updates/restricted amd64 Packages [1838 kB]
Get:23 http://archive.ubuntu.com/ubuntu noble-backports/main amd64 Packages [48.9 kB]
Get:24 http://archive.ubuntu.com/ubuntu noble-backports/universe amd64 Packages [35.9 kB]
Get:25 http://archive.ubuntu.com/ubuntu noble-backports/multiverse amd64 Packages [671 B]
Fetched 32.8 MB in 3s (11.8 MB/s)
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
zsh is already the newest version (5.9-6ubuntu2).
ripgrep is already the newest version (14.1.0-1).
0 upgraded, 0 newly installed, 0 to remove and 145 not upgraded.
�[1m�[31mWARNING:�(B�[m systemd is not running
�[1m�[31mWARNING:�(B�[m Unable to detect NVIDIA/AMD GPU. Install lspci or lshw to automatically detect and install GPU dependencies.
[post-create-cmd.sh] Checking ollama...
[post-create-cmd.sh] ollama is already running, skipping

�[0;35m�[1m
┌─────────────────────────────────────────────────────────┐
│ ⚕ Hermes Agent Installer │
├─────────────────────────────────────────────────────────┤
│ An open source AI agent by Nous Research. │
└─────────────────────────────────────────────────────────┘
�[0m
�[0;32m✓�[0m Detected: linux (ubuntu)
�[0;32m✓�[0m Managed uv found (uv 0.12.5 (x86_64-unknown-linux-gnu))
�[0;36m→�[0m Checking Python 3.11...
�[0;32m✓�[0m Python found: Python 3.11.16
�[0;36m→�[0m Checking Git...
�[0;32m✓�[0m Git 2.53.0 found
�[0;36m→�[0m Checking Node.js (for browser tools)...
�[0;32m✓�[0m Node.js v24.14.0 found
�[0;36m→�[0m Checking internet connectivity for package install and web tools...
�[0;32m✓�[0m Internet connectivity looks good
�[0;36m→�[0m Checking ripgrep (fast file search)...
�[0;32m✓�[0m ripgrep 14.1.0 found
�[0;36m→�[0m Checking ffmpeg (TTS voice messages)...
�[0;36m→�[0m Installing ffmpeg...
Reading package lists...
Building dependency tree...
Reading state information...
�[0;33m⚠�[0m ffmpeg not installed (TTS voice messages will be limited)
�[0;36m→�[0m To install ffmpeg manually:
�[0;36m→�[0m sudo apt install ffmpeg
�[0;36m→�[0m Installing to /home/codespace/.hermes/hermes-agent...
�[0;36m→�[0m Existing installation found, updating...
Your branch and 'origin/main' have diverged,
and have 1 and 1 different commits each, respectively.
(use "git pull" if you want to integrate the remote branch with yours)
�[0;33m⚠�[0m Fast-forward not possible; resetting managed install to origin/main...
HEAD is now at 1fe8683 fix(state): split forensic-backup identity from repair-epoch fingerprint; publish backup bundle atomically
�[0;32m✓�[0m Repository ready
�[0;36m→�[0m Creating virtual environment with Python 3.11...
�[0;36m→�[0m Virtual environment already exists, recreating...
�[0;32m✓�[0m Virtual environment ready (Python 3.11)
�[0;36m→�[0m Installing dependencies...
�[0;36m→�[0m Trying tier: hash-verified (uv.lock) ...
�[0;36m→�[0m (this resolves + downloads the curated [all] set — first run on a
�[0;36m→�[0m fresh venv can take 1-5 minutes; uv prints progress below)
�[0;33m⚠�[0m uv.lock sync failed (see uv output above), falling back to PyPI resolve...
�[0;36m→�[0m Trying tier: all ...
�[0;33m⚠�[0m Tier 'all' failed. Top of pip output:
�[0;36m→�[0m Trying tier: all minus known-broken (none) ...
�[0;33m⚠�[0m Tier 'all minus known-broken (none)' failed. Top of pip output:
�[0;36m→�[0m Trying tier: core only (no extras) ...
�[0;33m⚠�[0m Tier 'core only (no extras)' failed. Top of pip output:
[post-create-cmd.sh] Hermes installer failed. — adds Herdr install block after mnemon install:

• Version constant:
• Downloads from releases (with to follow the repo rename redirect to )
• Verifies SHA-256 () before install
• Installs to via
• Post-install gate: exact version match + {"client":{"version":"0.7.4","channel":"stable","protocol":16,"binary":"/home/codespace/.local/bin/herdr","session":null},"server":{"status":"running","running":true,"version":"0.7.4","protocol":16,"capabilities":{"live_handoff":true,"detached_server_daemon":true},"compatible":true,"socket":"/home/codespace/.config/herdr/herdr.sock","session":null,"restart_needed":false},"update":{"restart_needed":false}} protocol >= 16

Verification (done locally)

• SHA-256 matches pinned value exactly ✓
• herdr 0.7.4 → 0.7.4 ✓
• {"client":{"version":"0.7.4","channel":"stable","protocol":16,"binary":"/home/codespace/.local/bin/herdr","session":null},"server":{"status":"running","running":true,"version":"0.7.4","protocol":16,"capabilities":{"live_handoff":true,"detached_server_daemon":true},"compatible":true,"socket":"/home/codespace/.config/herdr/herdr.sock","session":null,"restart_needed":false},"update":{"restart_needed":false}} → (meets floor) ✓
• Script syntax valid () ✓

Notes

• The upstream repo now 301-redirects to . handles this transparently; the SHA-256 pin is unchanged because the asset bytes are identical. We keep the hardcoded repo name to stay byte-identical to the source script — can be updated in a follow-up if desired.
• Installs to (requires sudo, available in Codespace) consistent with mnemon/omniroute/modelrelay pattern.
• This PR is content-only (scripts + devcontainer) → triggers lint-check CI only, no full-build.

[greptile-apps]

Greptile Summary

The PR adds a pinned, checksum-verified Herdr v0.7.4 installation and protocol compatibility gate to Codespace bootstrap.

• Downloads and verifies the Herdr release binary before installing it in /usr/local/bin.
• Requires the installed version to match v0.7.4 and the client protocol to be at least 16.
• The bootstrap remains limited to x86_64 environments because its release asset is hard-coded.

Confidence Score: 4/5

The PR is not yet safe to merge because fresh arm64 environments still receive an incompatible x86_64 Herdr binary and abort bootstrap.

The previously reported architecture issue remains in the current code: asset selection is unconditionally herdr-linux-x86_64, and the mandatory post-install execution reaches that incompatible binary on arm64.

Files Needing Attention: .devcontainer/post-create-cmd.sh

Important Files Changed

Filename	Overview
.devcontainer/post-create-cmd.sh	Adds a verified Herdr installation and compatibility gate, but still selects an x86_64-only binary and therefore fails during arm64 bootstrap.

_{Reviews (2): Last reviewed commit: "feat: bake Herdr v0.7.4 install into Cod..." | Re-trigger Greptile}