perf(cli): skip npm install during update when lockfile is unchanged (#17268)

[rodboev]

Summary

Every hermes update unconditionally runs npm ci twice (root-only, then workspace), even when the lockfile hasn't changed since the last successful install. On slow or firewalled networks this adds 30-60+ seconds of dead time for Python-only or docs-only commits.

The fix hashes package-lock.json with SHA-256 after each successful install and stores the digest in a per-checkout cache file under the hermes root (~/.hermes/.npm_lock_hash_<project_key>). On subsequent updates, _update_node_dependencies() compares the current lockfile hash against the stored digest and skips both npm ci calls when they match. The codebase already uses this pattern for the desktop build (_compute_desktop_content_hash / _desktop_build_needed) and the TUI install path (_tui_need_npm_install compares lockfile content).

The cache is keyed by PROJECT_ROOT so parallel worktrees don't collide, and validates that node_modules/ exists before skipping (a matching hash with missing node_modules forces a reinstall). All cache I/O is wrapped in try/except so a corrupt or inaccessible cache file never breaks the update path.

Changes

• hermes_cli/main.py: add _npm_lockfile_changed() and _record_npm_lockfile_hash() helpers using hashlib.sha256; guard _update_node_dependencies() with an early return when the lockfile matches the stored hash; record hash after successful install (~+35 lines)
• tests/hermes_cli/test_cmd_update.py: add 7 tests for the hash helpers, skip path, missing node_modules, and cache error handling (~+65 lines)

Validation

Scenario	Before	After
First update after install (no cache)	runs npm ci (2x)	runs npm ci (2x), records hash
Subsequent update, lockfile unchanged	runs npm ci (2x), ~30-60s	skips npm ci, logs "unchanged"
Subsequent update, lockfile changed	runs npm ci (2x)	runs npm ci (2x), updates hash
package-lock.json missing	runs npm install fallback	runs npm install fallback (unchanged)
node_modules/ deleted after cache written	skips npm ci (broken)	forces npm ci (node_modules check)
Cache file corrupt or inaccessible	N/A (no cache)	treated as cache miss, npm ci runs
Multiple worktrees	N/A (no cache)	each worktree has its own cache key

Test plan

• pytest tests/hermes_cli/test_cmd_update.py -v --timeout=0 — 32 passed
• Manual: run hermes update twice in a row, verify second run skips npm ci

Fixes #17268

[teknium1]

Thanks for addressing a real update-time cost. Current main still runs both Node dependency steps unconditionally (hermes_cli/main.py:8158, hermes_cli/main.py:8175).

Problems

• Lockfile-only cache key (8fb6d5e, hermes_cli/main.py): a package.json-only edit can retain the cached lockfile hash and skip the install. That bypasses the intentional npm ci → npm install recovery for out-of-sync WIP checkouts in current main (hermes_cli/main.py:4829-4858).
• Workspace coverage: the project declares apps/*, ui-tui, ui-tui/packages/*, and web workspaces (package.json:6-10), but none of their manifests participate in this cache key.

Suggested changes

• Digest the lockfile plus the root and workspace manifests, deriving workspace paths from the root workspaces configuration.
• Add manifest-only invalidation tests for root, literal workspace, globbed workspace, and a newly added glob match.
• perf(cli): skip npm install during hermes update when Node manifests are unchanged (#39397 salvage) #61580 contains the related manifest-aware salvage and records the same reviewed concern.

Automated hermes-sweeper review.

[rodboev]

Closing this in favor of #61580, which already carries the manifest-aware workspace digest follow-up on the same issue.

Keeping both branches open would split review across overlapping fixes.