fix(desktop): re-read live argv before gateway exemption in venv-blocker scan

[skyer-flyyy]

Summary

The Desktop update preflight (venv\Scripts\python.exe -m hermes_cli._scan_venv_blockers) still aborts with venv-blocked on gateway-enabled Windows installs even after the pausable-gateway exemption from #75881. The exemption classifies holders from a cmdline truncated to 120 characters by _detect_venv_python_processes(), while a gateway worker launched from the uv-managed runtime (.hermes-runtime\python\generation-<id>\cpython-3.11-windows-x86_64-none\python.exe) has a ~186-char cmdline — the trailing gateway run tokens fall past the cut, the matcher returns False, and the preflight dead-ends before the CLI updater's _pause_windows_gateways_for_update() ever runs. Every Desktop update aborts; the only workaround is stopping the gateway by hand.

Root cause

_scan_venv_blockers.py classifies every holder with _is_pausable_gateway(cmdline), where cmdline is the 120-char prefix captured at scan time. The CLI-side guard (update_cmd._leftover_pausable_gateway_pids) already compensates for this truncation by re-reading the live argv via psutil — the Desktop preflight never got that compensation, so the two views of the same process table drifted apart and the exemption silently stopped matching.

Verified live on Windows 10, Hermes v0.20.0 (HEAD 34c3f06f9, contains #75881), three always-on profile gateways (default / github-agent / teacher launched via scheduled startup scripts):

PID 7728 ...\cpython-3.11-windows-x86_64-none\pyth <- captured prefix, cut at 120 chars looks_like_gateway_command_line(full argv) = True looks_like_gateway_command_line(truncated) = False <- exemption defeated

Scan output before the fix: {"blocked": true, "pausable_gateways": 1} — the scan's own diagnostic contradicted its verdict, exactly the #78089 pattern.

Fix

In hermes_cli/_scan_venv_blockers.py, re-read the live argv via psutil before the gateway exemption runs, falling back to the captured cmdline when the process is gone or unreadable (same pattern as _leftover_pausable_gateway_pids, same try/except tolerance). Blocked-process reports now also show the full redacted cmdline instead of a truncated prefix, so users can actually see which process holds the install.

Design note: this keeps the capture layer (_detect_venv_python_processes) untouched and makes the preflight self-healing regardless of where truncation happens upstream — an alternative to #78094 / #78188, which move the truncation out of the capture layer entirely. Non-gateway holders (serve backends, operator REPLs, stray scripts) keep blocking exactly as before: _is_pausable_gateway still rejects them and the re-read only widens what is visible, never what blocks.

Verification

• New regression tests in tests/hermes_cli/test_scan_venv_blockers.py:
  • test_main_rereads_truncated_argv_before_gateway_exemption — a 120-char-truncated uv-side gateway worker is exempted when the live argv is readable
  • test_main_truncated_gateway_worker_without_live_argv_falls_back — pre-fix behavior is preserved when psutil cannot re-read (dead PID / access denied)
• scripts/run_tests.sh tests/hermes_cli/test_scan_venv_blockers.py (canonical CI-equivalent runner, clean env): 25/25 passed, 0 failed.
• End-to-end on the affected machine, same process snapshot: before the fix the scan reported the gateway worker as a blocker (pausable_gateways: 1); after the fix the worker is exempted (pausable_gateways: 2, only the Desktop serve backend remains — which releaseBackendLockForUpdate stops before the updater spawns anyway).

Related

• Fixes the same symptom as Windows: venv-blocker preflight still aborts desktop Update for .hermes-runtime gateways — cmdline truncated at 120 chars defeats the pausable-gateway exemption added by #75881 #78089 (alternative implementation to fix(update): stop truncating venv blocker cmdline before gateway exemption #78094 and fix(update): classify venv holders on the full cmdline, truncate only for display #78188, which relocate the truncation instead of re-reading the argv)
• Builds on fix(update): let Windows desktop updates pause gateway processes instead of aborting #75881 (pausable-gateway preflight exemption)
• Original gateway/update coordination chain: Windows: bootstrap-installer kills Gateway without respawning — Telegram bot silently stops responding #50090

[teknium1]

Thanks @skyer-flyyy. Same verdict as #78095: the root cause (the detector truncating cmdlines to 120 chars before the gateway exemption ran) was fixed on main in commit 0b33ee88e4 (2026-08-08) by returning the full cmdline and truncating only at display time — so the psutil live-argv re-read this PR adds no longer has a truncated capture to compensate for. Earliest submitter in the cluster was #77754 (@stormhierta). Closing as implemented-on-main; regression coverage for the long-managed-runtime-path case is on main in tests/hermes_cli/test_scan_venv_blockers.py.