Problem

During every hermes update, the updater executes npm ci unconditionally:

• → Updating Python dependencies...
• → Updating Node.js dependencies...

In practice, the Node.js step is the primary bottleneck. Even when a pull only contains Python logic or documentation, npm ci still triggers a registry check and metadata resolution. On slower or unstable networks (especially behind certain firewalls), this step can take 30–60+ seconds or even stall, despite the dependency tree being identical to the local state.

Proposed Solution

Implement a simple caching mechanism for the Node.js dependency state:

1. Hash the Lockfile: Generate a hash of package-lock.json (or the relevant manifest) after a successful install.
2. Store the Hash: Save this hash locally (e.g., in .hermes/update_cache).
3. Pre-update Check: On subsequent updates, compare the current lockfile hash with the stored one.
   • Match: Skip npm ci and proceed to the next step.
   • Mismatch/Missing: Run npm ci and update the stored hash.

Impact

• Performance: Significant speed boost for the common case (code-only updates).
• Reliability: Reduces update failures caused by transient network issues during the npm registry handshake.
• User Experience: Removes the "stalling" feel during frequent updates for users on metered or slow connections.