Critical: hermes update on Windows destroys local commits + kills active chat + blocks when desktop is open

[fena888-gif]

TL;DR

hermes update on Windows has four critical bugs:

1. Refuses to run when the Desktop app is open (asks user to "close the desktop manually", but slash_worker outlives Hermes.exe for several seconds — user can't tell when it's safe).
2. Tree-kills the active chat session — the user's tui_gateway.slash_worker is a grandchild of Hermes.exe and gets swept up in taskkill /IM Hermes.exe /T /F. Chat disappears mid-stream. Claude Code never does this.
3. Silently destroys local un-pushed commits — does git reset --hard origin/main with no prompt, no warning. Commits survive only in the reflog (30-90 days, then gone).
4. Doesn't reliably restart the Desktop after update — atexit-registered relaunch doesn't fire on all Windows exit paths. ~1/3 updates leaves the user with no desktop.

Reproduction

git clone <https://github.com/NousResearch/hermes-agent>
cd hermes-agent
hermes desktop                                       # launches Hermes.exe
# open a chat, start streaming
# in another shell:
hermes update
# → 5-10s desktop black-out, chat gone, any un-pushed commits vanished

Root cause

apps/desktop/release/win-unpacked/Hermes.exe is an unpacked dev build (not an NSIS installer). Its python.exe -m hermes_cli.main serve backend holds .pyd files in the venv mandatory-locked while running. hermes update either (a) refuses to run because of this lock, (b) kills the desktop to release it, or (c) silently rewrites the user's local git history in the process.

apps/desktop/electron/main.ts:2390-2480 already has the right self-restart machinery (releaseBackendLockForUpdate) for the desktop's own in-app update — it's just not exposed to the hermes update CLI.

Proposed fix

1. hermes update should detect Desktop-owned venv-holders (via HERMES_DESKTOP=1 env + parent-chain), and tree-kill only the main + backend — exclude tui_gateway.slash_worker by cmdline match so the chat survives.
2. Smart-skip the heavy rebuilds when only Python source changed: git diff --name-only FETCH_HEAD..HEAD → if only hermes_cli/, hermes_constants/, docs changed → skip pip install, npm install, vite build, electron-builder. Pure source updates become "git pull + bytecode cache clear + desktop reload" — no .pyd locks taken, no desktop black-out.
3. Pre-flight check in hermes update: if git log --oneline origin/main..HEAD is non-empty, refuse with "push or stash first". Add --force-divergent-update for the rare override case.
4. Belt-and-suspenders relaunch: a finally block in the cmd_update wrapper (in addition to atexit) so the Desktop re-launches on every exit path.

A working implementation of all four is in our local fork at:

b795d7fc8  fix(update): auto-close + relaunch Desktop around hermes update on Windows
332c2f8c4  fix(update): precise-PID kill — keep chat / renderer alive
b007b9b43  test(update): cover self-restart helpers
a374e6596  feat(update): smart-skip — only rebuild what actually changed
efdd3dbe0  fix(update): chat survival + reliable relaunch + smart-skip fetch awareness

The patch file is attached (hermes-self-restart-desktop.patch, applies cleanly to main at 0.18.2 / commit 7b5ba2054). We can submit as a PR if reviewers are interested.

Why this matters

Hermes Desktop is positioned as the user-friendly, end-user surface for the project. The current update experience is bad enough that a user who tries it once will never try it again — they'll pin a version, go back to the CLI, or switch to Claude Code (which "just works" through its own update cycle).

The fixes are small (1-3 days of work), well-understood, and don't require an architecture change. They need to be in the next release.

[fena888-gif]

Patch uploaded
Full 5-commit patch (applies to main @ 0.18.2 / commit 7b5ba20):

dpaste: hermes-self-restart-desktop.patch (89 KB, raw diff against b795d7fc8^)

5 commits in the patch:

b795d7fc8 fix(update): auto-close + relaunch Desktop around hermes update on Windows
332c2f8c4 fix(update): precise-PID kill — keep chat / renderer alive across self-restart
b007b9b43 test(update): cover self-restart helpers
a374e6596 feat(update): smart-skip — only rebuild what actually changed
efdd3dbe0 fix(update): chat survival + reliable relaunch + smart-skip fetch awareness
The patch applies with git am from a clean checkout at 7b5ba20. We have a working local install with these commits applied and all 52 pytest cases passing in the update test bundle. Happy to submit as a PR if reviewers are interested — just need push access to a fork.

[GottZ]

This was generated by AI during triage.

Summary

No pull requests currently address or reference #63577. The issue reports four related Windows updater failures—Desktop lock handling, active-chat termination, destructive resetting of unpushed commits, and unreliable Desktop relaunch—while #63578 is an identical duplicate report.

Suggested consolidation

Keep #63577 as the canonical issue and close #63578 as a duplicate, consistent with the contributor's documented triage. The discussion includes a proposed five-commit patch, but no PR exists to verify or merge; request that the patch be submitted as a pull request covering all four reported failure modes.

Cross-PR triage: Reviewed 0 pull requests and 2 issues in this complex. Assessment working set: 0 kB of PR diffs, 8 kB of issue/PR text, 1 kB of discussion (2 comments), 0 verify verdicts. verdicts are based on issue/PR descriptions and structural graph facts — diffs were not available at assessment time. Part of an automated triage batch.