hermes - 💡(How to fix) Fix gateway: shutdown notices spam chats on reboot; duplicate LaunchAgent can cause --replace flap

Bug Description

Two related gateway/LaunchAgent failure modes surfaced after a macOS reboot/login cycle:

1. all configured Hermes bots sent a shutdown notice at once when macOS logged out/rebooted and launchd SIGTERM'd every Hermes LaunchAgent.
2. nox then repeated the shutdown notice indefinitely because two LaunchAgent plists were pointed at the same HERMES_HOME runtime, causing competing gateway processes to repeatedly --replace each other.

The message sent to Telegram was:

⚠️ Gateway shutting down — Your current task will be interrupted.

Why this matters

The first behavior is arguably "working as implemented," but it is user-hostile during normal reboot/logout: ~15 agents means ~15 chat messages for a routine host lifecycle event. This probably belongs in logs, or should be rate-limited/coalesced/suppressed when the shutdown is launchd/system initiated and no active user task is running.

The second behavior is a real flap loop: duplicate service definitions for the same runtime can create an endless chat-spam cycle because every --replace teardown broadcasts the same shutdown warning.

Observed Environment

• OS: macOS
• Gateway install style: per-bot LaunchAgents
• Platform observed: Telegram DM
• Reboot/logout time: around 03:10 AM PDT, Mon May 25
• Bots came back around 03:16
• last reboot, uptime, and system logs confirmed host reboot/logout.

Actual Behavior

all-bot burst

During macOS logout/reboot, launchd SIGTERM'd every Hermes gateway LaunchAgent. Each gateway cleanly broadcast:

⚠️ Gateway shutting down — Your current task will be interrupted.

With many agents configured, Robin received a burst of shutdown messages, one per bot.

nox repeating forever

Two LaunchAgent plists pointed at the same runtime:

~/Library/LaunchAgents/ai.hermes.gateway.plist      -> HERMES_HOME=.../hermes-runtime/nox
~/Library/LaunchAgents/ai.hermes.gateway.nox.plist  -> HERMES_HOME=.../hermes-runtime/nox

Both used --replace and KeepAlive { SuccessfulExit: false }.

After reboot, launchd loaded both fresh. They raced for the same gateway lock and repeatedly kicked each other off via --replace every ~5 seconds. Each replacement path emitted the shutdown warning to Telegram before teardown, so nox spammed the warning indefinitely.

Exit diagnostics showed PIDs cycling every few seconds with replace: true; after removing the duplicate legacy plist and kickstarting the suffixed nox LaunchAgent, the new PID stayed stable and no new exit-diag entries appeared.

Expected Behavior

• Routine host logout/reboot should not produce a noisy multi-agent chat burst unless there is an active user task/session that truly needs interruption notification.
• Gateway shutdown notices should be rate-limited/coalesced per platform/chat, especially during service-manager stop/restart events.
• --replace-initiated shutdowns should probably not send the same user-facing warning as an unexpected task interruption.
• Gateway install/startup should detect duplicate LaunchAgents/services pointing at the same HERMES_HOME and warn or refuse to install/start the duplicate.
• A flap loop should not be able to produce unbounded user-facing messages.

Reproduction Sketch

1. Configure two macOS LaunchAgent plists that both run Hermes gateway with the same HERMES_HOME.
2. Ensure both include --replace and launchd KeepAlive.
3. Reboot/log out and back in so launchd starts both from a clean state.
4. Observe the two gateway processes replacing each other repeatedly.
5. Observe repeated Telegram shutdown warnings from that bot.

For the all-bot burst:

1. Configure many per-bot Hermes gateway LaunchAgents.
2. Reboot/log out.
3. Observe one shutdown warning per bot.

Proposed Fix Options

• Suppress user-facing shutdown broadcast for normal service shutdown / SIGTERM unless there is an active in-flight task.
• Add rate limiting/deduplication for identical gateway lifecycle warnings per chat.
• Treat --replace shutdown as internal lifecycle management and log it instead of broadcasting it.
• During hermes gateway install, detect existing LaunchAgents/systemd services targeting the same HERMES_HOME and either update/remove the old one or fail with a clear warning.
• On gateway startup, detect another configured service with the same runtime where possible and log a high-signal diagnostic.

Workaround Applied Locally

Removed the legacy unsuffixed plist:

~/Library/LaunchAgents/ai.hermes.gateway.plist

Then kickstarted the expected per-bot service:

ai.hermes.gateway.nox

Afterward, the nox gateway PID stayed stable and the exit diagnostic log stopped receiving new entries.