fix(banner): include local HEAD in update-check cache key

[Kyzcreig]

The update-check cache key was {ts, rev, ver} only. For source installs, an in-place git pull/rebase moves HEAD without changing VERSION or HERMES_REVISION (both None outside nix builds), so a stale "commits behind" count survives the full 6h TTL after a manual update.

Symptom

After a successful manual git pull/rebase to an up-to-date checkout, hermes --version keeps printing e.g. Update available: 182 commits behind even though git rev-list --count HEAD..origin/main is 0 and hermes update --check reports up to date. The stale value is read straight from ~/.hermes/.update_check.

Cause

check_for_updates() only invalidates the cache when rev (HERMES_REVISION, nix-only) or ver (VERSION) changes. A manual git update changes neither, so the cached behind is reused until the 6h TTL expires. hermes update calls _invalidate_update_cache(), but a manual git pull does not.

Fix

Add the active checkout’s HEAD SHA to the cache key. Computed after the docker short-circuit so container images (no .git) never shell out to git. An in-place update now self-invalidates the cached count. hermes update’s explicit invalidation still works; this just additionally covers manual git updates.

Tests

• test_check_for_updates_uses_cache — cache hit now requires matching head; verifies only the cheap git rev-parse HEAD runs (no fetch/rev-list).
• test_check_for_updates_expired_cache — expects 3 git calls (rev-parse HEAD + fetch + rev-list).
• Full tests/hermes_cli/test_update_check.py passes (11).

[teknium1]

Thanks for addressing a remaining source-install cache-staleness path. Current main still returns a fresh cache using only ts, rev, and ver at hermes_cli/banner.py:339-344, before it resolves and checks the local repository at hermes_cli/banner.py:348-360.

Problems

• The updated tests do not directly exercise the reported HEAD-mismatch transition. tests/hermes_cli/test_update_check.py:19-97 covers matching-head cache reuse and expiry, but not a fresh cached old HEAD followed by a new live HEAD.

Suggested changes

• Add a regression test that makes git rev-parse HEAD differ from the cache, then verifies the cache is bypassed and rewritten with the new SHA.

Automated hermes-sweeper review.

[Kyzcreig]

Closing as superseded by #72013, which carries this fix/feature forward (fresh port with maintainer engagement). Consolidating our open PRs after an audit — the newer PR is the one to review. Thanks!