hermes - 💡(How to fix) Fix hermes update fails with 'No virtual environment found' when launcher venv is not active in shell

Environment: macOS, hermes installed via the install.sh flow that creates ~/.hermes/hermes-agent/venv/ and a launcher shim at ~/.local/bin/hermes. uv is the chosen packager.

Symptom: hermes update fails immediately from any shell that doesn't have VIRTUAL_ENV set, with:

error: No virtual environment found; run `uv venv` to create an environment, or pass `--system` to install into a non-virtual environment
✗ Update failed

Reproduced from a regular interactive zsh on the same machine where hermes is otherwise running fine (gateway up, status OK).

Root cause: The launcher shim at ~/.local/bin/hermes uses the venv's interpreter via shebang (#!/Users/jon/.hermes/hermes-agent/venv/bin/python) but does not export VIRTUAL_ENV or prepend the venv bin to PATH. So sys.prefix is correctly set inside the Python process, but a subprocess invoked from that process doesn't inherit the venv context.

In _cmd_update_pip at hermes_cli/main.py:8888-8907, the update path shells out:

uv = shutil.which("uv")
if uv:
    cmd = [uv, "pip", "install", "--upgrade", "hermes-agent"]
else:
    cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "hermes-agent"]

print(f"→ Running: {' '.join(cmd)}")
result = subprocess.run(cmd)

The subprocess.run(cmd) inherits the parent env, which doesn't include VIRTUAL_ENV. uv refuses to install without it, so the update aborts.

Workaround: VIRTUAL_ENV=~/.hermes/hermes-agent/venv PATH=~/.hermes/hermes-agent/venv/bin:$PATH hermes update succeeds.

Suggested fix: In _cmd_update_pip, propagate the launcher's venv to the subprocess via sys.prefix:

env = {**os.environ, "VIRTUAL_ENV": sys.prefix}
result = subprocess.run(cmd, env=env)

sys.prefix is automatically the venv root when the interpreter was launched via a venv shebang (the install.sh launcher pattern), so this single-line change covers the common case without breaking system-Python installs (where sys.prefix is the system prefix and uv accepts it via --system or the VIRTUAL_ENV shortcut won't apply anyway — same effective behavior as now).

Related: this is the same install pattern that the launchd plist regeneration assumes (see #28135 for the unrelated launchd KeepAlive bug), so the venv discovery story should be consistent across hermes update and hermes gateway.