From 475b1d804ec010e4fd8ea12c8a665cfe39afdba7 Mon Sep 17 00:00:00 2001 From: David Young Date: Tue, 27 Oct 2026 10:01:37 -0600 Subject: [PATCH] Restart Hermes' gateway after updating Hermes The gateway reads its sandbox rules and loads new dependencies only when it starts, and hermes update restarts it only for new code. Restart it at the end of the sandbox update step instead of before hermes update runs. Co-Authored-By: Claude Opus 5.5 --- sandbox/setup.sh | 9 --------- updates.d/72-sandbox.sh | 7 +++++++ 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/sandbox/setup.sh b/sandbox/setup.sh index 2509fba..0225f9c 100644 --- a/sandbox/setup.sh +++ b/sandbox/setup.sh @@ -68,15 +68,6 @@ EOF mkdir -p "$(dirname "$dropin")" && mv -f "$tmp" "$dropin" && chmod 644 "$dropin" \ && systemctl --user daemon-reload || STATUS=1 fi - # The gateway reads its sandbox rules only when it starts, so restart it - # when they or the drop-in change - stamp="$HOME/.local/state/coredesktop/hermes-gateway-sandbox" - rules="$(cat "$dropin" "$COREDESKTOP/sandbox/agent" "$COREDESKTOP"/sandbox/config/{base,hermes}.json \ - "$HOME"/.config/coredesktop/sandbox/{base,hermes}.json 2> /dev/null | sha256sum)" - if [ "$rules" != "$(cat "$stamp" 2> /dev/null)" ]; then - systemctl --user try-restart hermes-gateway.service \ - && mkdir -p "$(dirname "$stamp")" && echo "$rules" > "$stamp" || STATUS=1 - fi else echo "Hermes' gateway isn't sandboxed yet: the sandbox (srt) isn't installed." STATUS=1 diff --git a/updates.d/72-sandbox.sh b/updates.d/72-sandbox.sh index 13b9700..ceda183 100644 --- a/updates.d/72-sandbox.sh +++ b/updates.d/72-sandbox.sh @@ -12,5 +12,12 @@ run_update() { echo "Updating Hermes Agent..." "$HOME/.local/bin/hermes" update < /dev/null || status=1 fi + + # The gateway reads its sandbox rules and loads new dependencies only when it + # starts, and Hermes restarts it only for new code + if systemctl --user is-active --quiet hermes-gateway.service; then + echo "Restarting Hermes' gateway..." + systemctl --user restart hermes-gateway.service || status=1 + fi return $status }