NousResearch/hermes-agent · error · anyhow::Error

no install-script pin supplied — installer cannot resolve a

Error message

no install-script pin supplied — installer cannot resolve a script source

What it means

Raised while resolving the install-script source: neither pin.commit nor pin.branch was supplied, and no bundled fallback exists (the bundled-fallback path is explicitly not implemented). With no pin, the installer cannot decide which install-main.ps1 to fetch or cache, so it refuses rather than guessing a default ref.

Source

Thrown at apps/bootstrap-installer/src-tauri/src/install_script.rs:139

    }

    // 2. (Not implemented) bundled fallback.

    // 3. Network. Pin must be a real commit or a branch ref.
    //
    // Commit SHAs are immutable — permanent cache reuse is safe.
    // Branch/tag pins are moving refs: always try to refresh so "Retry install"
    // cannot keep reusing a poisoned install-main.ps1 forever (#67193).
    let (commit_or_ref, immutable) = match (&pin.commit, &pin.branch) {
        (Some(c), _) if is_valid_commit(c) => (c.clone(), true),
        (_, Some(b)) if !b.trim().is_empty() => (b.clone(), false),
        (Some(other), _) => {
            return Err(anyhow!(
                "install script pin commit `{other}` is not a valid git SHA"
            ));
        }
        _ => {
            return Err(anyhow!(
                "no install-script pin supplied — installer cannot resolve a script source"
            ));
        }
    };

    let cached = cached_path(kind, &commit_or_ref);
    match cache_plan(immutable, cached.exists()) {
        CachePlan::Reuse => {
            emit_log(&format!(
                "[bootstrap] using cached {} for {}",
                kind.filename(),
                truncate_ref(&commit_or_ref)
            ));
            // Immutable pins are cached forever, so a .ps1 cached by a
            // pre-BOM-fix installer would keep the #67193 encoding bug on
            // every retry. Upgrade it in place before handing it out.
            upgrade_cached_script(kind, &cached, emit_log);
            return Ok(ResolvedScript {

View on GitHub (pinned to c896c09c42)

Solutions

1. Export at least one pin before building: `BUILD_PIN_COMMIT=$(git rev-parse HEAD) cargo tauri build` (or BUILD_PIN_BRANCH=main).
2. If invoking the installer binary directly, pass the pin via its command-line arguments instead of env.
3. Add a build script assertion so unpinned builds fail at compile time with a clearer message.

Example fix

# before
npm run tauri build

# after
export BUILD_PIN_COMMIT=$(git rev-parse HEAD)
npm run tauri build

// build.rs — refuse to produce an unpinned installer.
fn main() {
    let commit = option_env!("BUILD_PIN_COMMIT");
    let branch = option_env!("BUILD_PIN_BRANCH");
    if commit.is_none() && branch.is_none() {
        panic!("No install-script pin: set BUILD_PIN_COMMIT=$(git rev-parse HEAD) or BUILD_PIN_BRANCH before building");
    }
    println!("cargo:rerun-if-env-changed=BUILD_PIN_COMMIT");
    println!("cargo:rerun-if-env-changed=BUILD_PIN_BRANCH");
}

When it happens

Trigger: Building/running the bootstrap installer without BUILD_PIN_COMMIT and without BUILD_PIN_BRANCH compiled in, and with no pin passed on the command line; both env vars empty at compile time in a dev build (`cargo run` instead of a release build that injects pins).

Common situations: A developer runs the Tauri installer via `cargo tauri dev` where the pin env vars are not exported; CI builds the installer matrix job that forgot to pass the pin arguments; option_env_string returns None because the variable name was misspelled.

Related errors

• install script pin commit `{other}` is not a valid git SHA
• gh pr create failed (is gh installed and authenticated?)
• Branch name is required.
• Hermes Desktop bridge is unavailable
• write bootstrap marker failed: {err:#}

AI-assisted analysis of NousResearch/hermes-agent@c896c09c42 (2026-08-14). Data as JSON: /api/errors/8c0df587a9969299. Report an issue: GitHub.