fix(cli): restore visible git fetch progress and defer autostash until update confirmed (#3523) - #62962

Fixes #3523

Symptom

Regression from #3492 introduced two user-visible issues in hermes update:

1. Silent git fetch — git fetch ran with capture_output=True, swallowing git's progress output (object enumeration, remote branch listing). Users saw only the literal string "→ Fetching updates..." with no indication anything was happening.

2. Autostash on every run — git stash push ran BEFORE we knew whether there was an update to apply. On an up-to-date tree with local changes, every hermes update call would:

   • Create a stash named hermes-update-autostash-<timestamp>
   • Trigger an interactive restore prompt ("Restore local changes now? [Y/n]")
   • Restore the stash
   • Exit cleanly

   …for nothing. Clutters the stash list, breaks --yes cron updates, and prompts in non-interactive contexts.

Repro

# On up-to-date main with one local uncommitted change
echo "# local note" >> README.md
hermes update

Expected: update completes silently (or with progress), no stash prompt.
Actual: "⚠ Local changes were stashed before updating." → "Restore local changes now? [Y/n]" prompt → stash restored.

Root Cause

# BEFORE — hermes_cli/main.py:9620 (and 9654)
if current_branch != branch:
    auto_stash_ref = _stash_local_changes_if_needed(git_cmd, PROJECT_ROOT)  # ← unconditional
    checkout_result = ...
else:
    auto_stash_ref = _stash_local_changes_if_needed(git_cmd, PROJECT_ROOT)  # ← unconditional

# THEN we check for updates...
result = subprocess.run(git_cmd + ["rev-list", f"HEAD..origin/{branch}", "--count"], ...)
commit_count = int(result.stdout.strip())
if commit_count == 0:
    # ... restore the stash we never should have created

# BEFORE — hermes_cli/main.py:9574
fetch_result = subprocess.run(
    git_cmd + ["fetch", "origin", branch],
    cwd=PROJECT_ROOT,
    capture_output=True,  # ← swallows git progress
    text=True,
)

Fix

1. Visible fetch progress

Switch the user-facing fetch to capture_output=False. On failure, re-run with capture_output=True so we can still pattern-match stderr for network/auth errors (the existing Could not resolve host, Authentication failed, etc. logic is preserved).

2. Deferred stash

Move _stash_local_changes_if_needed to AFTER the rev-list count check. If commit_count == 0, we exit cleanly without ever creating a stash. The race condition where someone else pulls between our check and our stash is still handled correctly by the post-stash commit_count == 0 block.

3. Removed redundant rev-list re-run

The original code ran rev-list twice (once before the stash, once after). Since git stash doesn't move HEAD, the second call was redundant. Removed.

Tests Added

Three new tests in tests/hermes_cli/test_cmd_update.py:

• test_3523_no_stash_when_up_to_date_with_local_changes — asserts git stash push is NOT called when up to date, even with dirty tree
• test_3523_fetch_stderr_visible_on_success — asserts user-facing fetch has capture_output=False
• test_3523_stash_still_happens_when_update_available — asserts stash still happens when update IS available (regression guard for the deferred-stash fix)

All 30 tests pass (27 existing + 3 new).

Checklist

• Reproduces on current main
• Points to exact line where bug manifests
• Fixes the whole bug class (sibling call paths included) — both fetch output suppression AND autostash are fixed
• E2E validation — all 30 tests in test_cmd_update.py pass
• Behavior contracts (invariant: no stash when count==0) over snapshots
• Cache-, alternation-, and invariant-safe — no changes to the conversation loop or system prompt
• Prompt caching preserved — capture_output doesn't affect what gets cached
• No new HERMES_* env vars
• No outbound telemetry added