fix(hermes): detect wrapped gateway argv

[jyaunches]

Summary

• Treat hermes.real gateway run as a live Hermes gateway process after the PR fix(hermes): enforce runtime env secret guard on direct hermes gateway (#4975) #4981 wrapper execs the relocated binary.
• Update the Hermes root-entrypoint smoke assertion to accept both wrapped and unwrapped argv shapes.
• Add a shell-fixture regression test for the hermes.real process shape.

Verification

• npm test -- --run test/hermes-start.test.ts
• bash -n agents/hermes/start.sh
• bash -n test/e2e/test-hermes-root-entrypoint-smoke.sh
• git diff --check origin/main...HEAD

Refs #4981

Summary by CodeRabbit

• Improvements
  • Extended Hermes gateway process detection to recognize additional invocation variants, improving health monitoring accuracy and cleanup operation reliability across deployment scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 13666b5c-5abe-41bb-9bab-43a6f01ff68a

📥 Commits

Reviewing files that changed from the base of the PR and between e1240df and 1ee96a9.

📒 Files selected for processing (3)

• agents/hermes/start.sh
• test/e2e/test-hermes-root-entrypoint-smoke.sh
• test/hermes-start.test.ts

---

📝 Walkthrough

Walkthrough

The PR extends Hermes gateway process detection to recognize hermes.real gateway run invocations alongside existing hermes gateway run patterns. The core detection logic is updated in the startup script, and test infrastructure is parameterized to validate the new detection variant with a new unit test case and updated smoke test assertions.

Changes

Gateway Detection Expansion

Layer / File(s)	Summary
Detection logic expansion agents/hermes/start.sh	The cmdline_is_hermes_gateway function's case pattern matching is extended to also match hermes.real gateway run commandlines, broadening the detection of active Hermes gateway processes.
Test infrastructure and validation test/hermes-start.test.ts, test/e2e/test-hermes-root-entrypoint-smoke.sh	The test harness options type adds an optional liveGatewayArgv field to parameterize mocked gateway process commands. The mocked cmdline now uses this field (defaulting to the prior hardcoded value). A new unit test case verifies cleanup preserves runtime state when the gateway's argv indicates it exec'd hermes.real. The smoke test's awk pattern is updated to recognize both gateway invocation variants.

Estimated Code Review Effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested Labels

bug-fix

Suggested Reviewers

• prekshivyas

Poem

A gateway in two forms now found,
hermes.real and classic sound,
Detection grows to match them all,
Tests dance where cleanup calls,
Runtime state stays safe and sound. 🐰

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and concisely describes the main change: detecting wrapped gateway argv (hermes.real) in addition to the standard hermes gateway invocation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-4981-hermes-real-detection

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

PR Review Advisor

Findings: 0 needs attention, 0 worth checking, 0 nice ideas

Consider writing more tests for

• **Runtime validation** — Hermes root-entrypoint runtime with wrapper execs `hermes.real gateway run` preserves gateway PID/lock and does not kill active socat forwarders.. The changed surface is sandbox lifecycle startup/cleanup logic. The shell-fixture unit regression is focused and appropriate, and a targeted runtime validation remains useful for this infrastructure path.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

[github-actions]

E2E Advisor Recommendation

Required E2E: hermes-root-entrypoint-smoke-e2e
Optional E2E: hermes-secret-boundary-e2e, hermes-e2e

Dispatch hint: hermes-root-entrypoint-smoke-e2e

Auto-dispatched E2E: hermes-root-entrypoint-smoke-e2e via nightly-e2e.yaml at 1ee96a9dd7989ae9e2b92d8f79cc7e92506b5a74 — nightly run

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• hermes-root-entrypoint-smoke-e2e (medium): Direct coverage for the changed Hermes root entrypoint/startup path. It builds/runs the Hermes production container, waits for health, verifies the gateway process under the gateway user, checks runtime layout repair, and exercises legacy stale PID/symlink migration behavior affected by live gateway detection.

Optional E2E

• hermes-secret-boundary-e2e (medium): Adjacent confidence for Hermes startup security boundaries because agents/hermes/start.sh is also responsible for locked config and secret-boundary enforcement, though the diff only changes process detection.
• hermes-e2e (high): Optional full Hermes assistant smoke to validate end-to-end Hermes onboarding/runtime still works after changing startup cleanup behavior.

New E2E recommendations

• None.

Dispatch hint

• Workflow: .github/workflows/nightly-e2e.yaml
• jobs input: hermes-root-entrypoint-smoke-e2e

[github-actions]

E2E Scenario Advisor Recommendation

Required scenario E2E: None
Optional scenario E2E: None

Workflow run

Full scenario advisor summary

E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required scenario E2E

• None. No Vitest scenario E2E is recommended. The PR changes Hermes entrypoint/runtime cleanup behavior and non-scenario tests, but the live-supported typed Vitest scenario set on the trusted checkout only wires cloud-openclaw scenarios; Hermes registry scenarios exist but are not live-supported. Legacy test/e2e coverage is outside the scenario advisor scope.

Optional scenario E2E

• None.

Relevant changed files

• None.

[github-actions]

Selective E2E Results — ✅ All requested jobs passed

Run: 27301749263
Target ref: 1ee96a9dd7989ae9e2b92d8f79cc7e92506b5a74
Workflow ref: main
Requested jobs: hermes-root-entrypoint-smoke-e2e
Summary: 1 passed, 0 failed, 0 skipped

Job	Result
hermes-root-entrypoint-smoke-e2e	✅ success