Bug Description

Nix / nix (ubuntu-latest) is currently red on main due to a stale npmDepsHash for hermes-web.

This appears to be the same failure class as #12965, but recurring on current main.

Steps to Reproduce

1. Checkout main at commit 62c14d5513469e27474fc9535fcdd4afa016646f.
2. Run the Nix flake check path used by CI (Nix workflow, ubuntu).

Expected Behavior

nix (ubuntu-latest) should pass on main.

Actual Behavior

CI fails in Check flake with:

ERROR: npmDepsHash is out of date
The package-lock.json in src is not the same as the in /nix/store/...-npm-deps.

Environment

• CI: GitHub Actions, ubuntu-latest
• Workflow: Nix

Evidence

• Failing main Nix run: https://github.com/NousResearch/hermes-agent/actions/runs/24896072991
• Failing job: https://github.com/NousResearch/hermes-agent/actions/runs/24896072991/job/72901107362
• Same class previously reported in Nix build broken: web/package-lock.json updated without regenerating npmDepsHash #12965

Notes

I attempted to reopen #12965 directly, but reporter permissions do not allow ReopenIssue from my account, so filing this recurrence as a fresh bug report.

Proposed Fix

Regenerate npmDepsHash for hermes-web and update the pinned hash in Nix files, then add/keep a guard to catch lockfile/hash drift early in CI.