fix(update): stop truncating venv blocker cmdline before gateway exemption

[szzhoujiarui]

Summary

_detect_venv_python_processes() truncated every cmdline to 120 chars before storing it in the match tuple. The pausable-gateway exemption in _scan_venv_blockers then operated on that already-truncated string. For desktop-runtime gateways whose full cmdline exceeds 120 chars (e.g. 186 chars on the reporter's machine), the trailing gateway run tokens were cut off and looks_like_gateway_command_line() returned False — so the Desktop UI preflight aborted with "venv-blocked" before the CLI updater got to pause the gateway.

Root cause

_detect_venv_python_processes() at update_cmd.py:2914 stored cmdline_raw[:120] in the match tuple. _scan_venv_blockers.py:150 then applied _is_pausable_gateway() to that truncated string, defeating the exemption added by #75881.

Fix

Move the 120-char truncation from the match tuple to the display helper _format_venv_python_holders_message(), so:

• _scan_venv_blockers _is_pausable_gateway() sees the full cmdline — exemption works
• _leftover_pausable_gateway_pids() sees the full cmdline as fallback (it already re-reads via psutil, now consistent)
• Display message still shows a compact 120-char cmdline

Related

• Fixes Windows: venv-blocker preflight still aborts desktop Update for .hermes-runtime gateways — cmdline truncated at 120 chars defeats the pausable-gateway exemption added by #75881 #78089
• Builds on fix(update): let Windows desktop updates pause gateway processes instead of aborting #75881 (pausable-gateway exemption)
• Windows update blocked on gateway-enabled installs: three-layer chain (Electron → Rust bootstrapper → Python CLI) fails to coordinate gateway pause/resume #74386, Windows: desktop Update button can never succeed on gateway-enabled installs (venv-blocker preflight aborts on the always-running gateway) #74326, Desktop update blocked by external hermes gateway run process #74783 — original three-layer gateway/update coordination issues

[szzhoujiarui]

Follow-up pushed in 23e18d4:

• Keeps the detector command line complete through both the Desktop preflight and updater fallback, and removes the secondary psutil argv read.
• Preserves the existing 120-character diagnostic boundary when the scanner serializes its redacted JSON output.
• Adds regressions for a managed-runtime path where gateway run begins after character 120, plus the JSON output bound.

Local verification:

• scripts/run_tests.sh tests/hermes_cli/test_scan_venv_blockers.py tests/hermes_cli/test_update_venv_health.py tests/hermes_cli/test_update_concurrent_quarantine.py -q (42 passed)
• ruff check .
• python3 scripts/check-windows-footguns.py --all
• git diff --check

Related implementations for maintainer visibility: #78095, #78188, and #79195. This PR was opened first and now covers the same long-command-line regression with explicit output-boundary tests. #77772 addresses the complementary Electron-owned backend-child path, while this PR covers external gateway command lines seen by the venv blocker scan.

[szzhoujiarui]

Closing as implemented on current main by 0b33ee8. That commit preserves the full venv-holder command line for gateway classification, truncates only at display/JSON boundaries, and adds the managed-runtime long-path regression coverage that this PR targeted. Thanks for carrying the fix forward.