PR #18866: fix(cli): add timeout and progress output to npm install during update

• Repository: NousResearch/hermes-agent
• Author: shellybotmoyer
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/18866

Description (problem / solution / changelog)

Problem

hermes update appeared to hang indefinitely at "Updating Node.js dependencies..." because:

1. npm install ran with --silent flag, suppressing ALL output (including progress from postinstall scripts like npx Camofox-js fetch)
2. No timeout on subprocess.run() — if npm hangs, the update process hangs forever
3. No progress indication to the user that something is happening during long downloads

Fix

1. Added timeout=300 to _run_npm_install_deterministic() — prevents indefinite hangs. Both npm ci and npm install now have a 5-minute timeout per directory. TimeoutExpired exceptions are caught and converted to meaningful error messages instead of hanging.

2. Replaced --silent with --loglevel=warn — shows warnings and errors (useful for debugging) while still suppressing the noisy progress bars and audit messages. Users can now see if something goes wrong instead of staring at a blank screen.

3. Added progress message — prints "Installing {label}... (this may take a moment during postinstall scripts)" before each npm install so users know what's happening.

4. Updated both call sites — _update_node_dependencies() and _build_web_ui() both use the same function and both now pass timeout.

Fixes #18840

Changed files

• hermes_cli/main.py (modified, +37/-16)

PR #18869: fix(update): stream npm install output so postinstall progress is visible (#18840)

• Repository: NousResearch/hermes-agent
• Author: briandevans
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/18869

Description (problem / solution / changelog)

Summary

hermes update appeared to hang silently at → Updating Node.js dependencies... for users on fresh installs, because the repo-root npm install ran with both --silent AND captured stdout/stderr — so the long-running postinstall script @askjo/camofox-browser → npx camoufox-js fetch (downloads a Firefox-fork browser binary, can take many minutes) printed nothing.

Reporter (#18840) verified the issue with the npm debug log and the captured traceback inside _run_npm_install_deterministic():

info run @askjo/[email protected] postinstall node_modules/@askjo/camofox-browser npx camoufox-js fetch || true
info run [email protected] postinstall { code: 0, signal: null }
info run @askjo/[email protected] postinstall { code: null, signal: 'SIGINT' }

The bug

hermes_cli/main.py:_update_node_dependencies() ran:

result = _run_npm_install_deterministic(
    npm,
    path,
    extra_args=("--silent", "--no-fund", "--no-audit", "--progress=false"),
)

_run_npm_install_deterministic() defaults to capture_output=True. Combined with --silent, npm produces zero output until the install completes — even when it is sitting inside a multi-minute postinstall download. From the user's perspective, the process is frozen, and Ctrl-C can leave node_modules partially installed.

The fix

For the repo-root and ui-tui npm installs, drop --silent and pass capture_output=False so npm streams its info run … postinstall lines straight to the terminal as they happen. The _UpdateOutputStream wrapper installed earlier in cmd_update mirrors stdout/stderr to ~/.hermes/logs/update.log, so SSH-disconnect safety is preserved and nothing is lost from the log.

The web/ install path (build step) is intentionally untouched — it is short and does not run binary-fetching postinstalls, so the existing --silent keeps the update output tidy.

This is an output-visibility fix only — no install behavior changes, no flag like --ignore-scripts is introduced. Camofox still bootstraps automatically; users just see what it is doing.

Test plan

• Focused regression test: tests/hermes_cli/test_cmd_update.py::test_update_refreshes_repo_and_tui_node_dependencies updated to assert (a) --silent removed from repo-root + ui-tui flags and (b) those calls run with capture_output=False. Web install assertion preserved.
• Adjacent suite: tests/hermes_cli/test_cmd_update.py, tests/hermes_cli/test_web_ui_build.py, tests/hermes_cli/test_tui_npm_install.py — 25/25 pass on rebased origin/main (5d3be898a).
• Regression guard: with the production change reverted (hermes_cli/main.py only), the focused test fails with the expected flag mismatch; restoring the change makes it pass.

Related

• Fixes #18840

Changed files

• hermes_cli/main.py (modified, +9/-2)
• tests/hermes_cli/test_cmd_update.py (modified, +26/-4)