fix(update): use selected Python for isolated icon generation

hermes_cli/source_build.py

@@ -28,10 +28,17 @@ def source_product_current(project_root: Path, product: str, out: Path) -> bool:
 
 def source_build_env(base_env: dict | None = None, *, explicit: bool = False) -> dict[str, str]:
     from pm import ensure
+    from pm.environments import project_python, running_from_selected_environment
+    from pm.paths import repo_root
     from hermes_constants import get_hermes_home
 
-    env = {**os.environ, **(base_env or {}), "CI": "1", "HERMES_PYTHON": sys.executable,
-           "PYTHON": sys.executable}
+    # The historical update runs on store Python with the selected environment
+    # activated in-process. Icon generation starts an isolated child, which needs
+    # the selected venv executable rather than the store interpreter.
+    root = repo_root()
+    python = str(project_python(root)) if running_from_selected_environment(root) else sys.executable
+    env = {**os.environ, **(base_env or {}), "CI": "1", "HERMES_PYTHON": python,
+           "PYTHON": python}
     env.pop("ESBUILD_BINARY_PATH", None)
     npmrc = get_hermes_home() / "npmrc"
     if npmrc.is_file():

tests/hermes_cli/test_source_build.py

@@ -36,6 +36,27 @@ def stamp_product(root, product, out):
                     str(root), product, str(out)], check=True)
 
 
+def test_source_build_uses_selected_python_for_isolated_icon_child(tmp_path, monkeypatch):
+    from hermes_cli.source_build import source_build_env
+    from pm import paths
+    from pm.environments import site_packages, venv_python
+
+    root = tmp_path / "source"
+    root.mkdir()
+    venv = root / "venv"
+    subprocess.run([sys.executable, "-m", "venv", "--without-pip", str(venv)], check=True)
+    selected = site_packages(venv)
+    (selected / "icon_dependency.py").write_text("ready = True\n", encoding="utf-8")
+    monkeypatch.setattr(paths, "repo_root", lambda: root)
+    monkeypatch.setattr(pm, "ensure", lambda name, **kwargs: Runner(name, kwargs["base_env"]))
+    monkeypatch.syspath_prepend(str(selected))
+
+    env = source_build_env()
+    assert env["HERMES_PYTHON"] == str(venv_python(venv))
+    subprocess.run([env["HERMES_PYTHON"], "-I", "-c",
+                    "import icon_dependency; assert icon_dependency.ready"], check=True)
+
+
 def test_automatic_build_preserves_pm_admission_intent(monkeypatch):
     from hermes_cli.source_build import source_build_env