Restart Hermes' gateway after updating Hermes

The gateway reads its sandbox rules and loads new dependencies only when it
starts, and hermes update restarts it only for new code. Restart it at the end
of the sandbox update step instead of before hermes update runs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

sandbox/setup.sh

@@ -68,15 +68,6 @@ EOF
       mkdir -p "$(dirname "$dropin")" && mv -f "$tmp" "$dropin" && chmod 644 "$dropin" \
         && systemctl --user daemon-reload || STATUS=1
     fi
-    # The gateway reads its sandbox rules only when it starts, so restart it
-    # when they or the drop-in change
-    stamp="$HOME/.local/state/coredesktop/hermes-gateway-sandbox"
-    rules="$(cat "$dropin" "$COREDESKTOP/sandbox/agent" "$COREDESKTOP"/sandbox/config/{base,hermes}.json \
-      "$HOME"/.config/coredesktop/sandbox/{base,hermes}.json 2> /dev/null | sha256sum)"
-    if [ "$rules" != "$(cat "$stamp" 2> /dev/null)" ]; then
-      systemctl --user try-restart hermes-gateway.service \
-        && mkdir -p "$(dirname "$stamp")" && echo "$rules" > "$stamp" || STATUS=1
-    fi
   else
     echo "Hermes' gateway isn't sandboxed yet: the sandbox (srt) isn't installed."
     STATUS=1

updates.d/72-sandbox.sh

@@ -12,5 +12,12 @@ run_update() {
     echo "Updating Hermes Agent..."
     "$HOME/.local/bin/hermes" update < /dev/null || status=1
   fi
+
+  # The gateway reads its sandbox rules and loads new dependencies only when it
+  # starts, and Hermes restarts it only for new code
+  if systemctl --user is-active --quiet hermes-gateway.service; then
+    echo "Restarting Hermes' gateway..."
+    systemctl --user restart hermes-gateway.service || status=1
+  fi
   return $status
 }