What does this PR do?

Adds two quality-of-life buttons to the Hermes Agent web dashboard's Status page — Restart Gateway and Update Hermes — so operators can run hermes gateway restart and hermes update without dropping into a terminal. Each click spawns the corresponding CLI command as a detached subprocess (stdin closed, stdout/stderr streamed to a per-action log file under ~/.hermes/logs/), and the UI opens a live log panel that polls the backend every ~1.5 s, showing the real command output with a running/finished/failed status pill. This gives visible confirmation that the action is actually happening — not just a fire-and-forget toast.

The approach reuses the existing CLI commands (hermes gateway restart, hermes update) rather than re-implementing restart/update logic in the web server, keeping a single source of truth and inheriting every edge case those commands already handle (systemd/launchd, autostash, fork detection, etc.).

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

Backend — hermes_cli/web_server.py

• Added POST /api/gateway/restart — spawns hermes gateway restart detached, logs to ~/.hermes/logs/gateway-restart.log.
• Added POST /api/hermes/update — spawns hermes update detached, logs to ~/.hermes/logs/hermes-update.log.
• Added GET /api/actions/{name}/status?lines=N — tails the action log and reports {running, exit_code, pid, lines} by calling Popen.poll() on the tracked process handle.
• New helpers _spawn_hermes_action() and _tail_lines(); module-level _ACTION_PROCS dict keyed by short action name.
• All three endpoints sit behind the existing session-token middleware (no new public paths).

Frontend — web/src/

• lib/api.ts — added api.restartGateway(), api.updateHermes(), api.getActionStatus() and the ActionResponse / ActionStatusResponse types.
• pages/StatusPage.tsx — new "Actions" card between the top status tiles and the Platforms card:
  • Two buttons (RotateCw for restart, Download for update) that disable while any action is in flight.
  • Live log panel with auto-scrolling <pre> tail, running/finished/failed status pill, and a dismiss (X) button.
  • Polling loop (1.5 s) that stops on running: false and fires a success/error toast with the exit code.
• i18n/types.ts, i18n/en.ts, i18n/zh.ts — added actions, actionFailed, actionFinished, restartGateway, restartingGateway, updateHermes, updatingHermes, startedInBackground, waitingForOutput keys (EN + ZH).

How to Test

1. Build and start the dashboard from a fresh checkout of this branch:

   cd hermes-agent/web && npm install && npm run build
   cd .. && hermes dashboard  # or: hermes web

2. Open the dashboard in a browser and navigate to the Status tab. Confirm the new Actions card appears above Connected Platforms.
3. Click Restart Gateway:
   • A log panel should open with a spinning loader and the title "Restart Gateway".
   • Within a couple seconds, lines should appear (=== gateway-restart started … ===, then ✓ Stopped gateway… / Starting gateway…).
   • The "Gateway" tile at the top should briefly flip to Starting / Stopped and then back to Running as the restart completes.
   • The status pill should flip to green Finished with exit_code: 0; a success toast appears.
4. Click Update Hermes (on a dirty tree to exercise the autostash path, or a clean tree for the happy path):
   • Log panel shows ⚕ Updating Hermes Agent… → Fetching updates… → Pulling updates… matching the terminal output of hermes update.
   • On success: green Finished badge + success toast. On non-zero exit: red badge showing the exit code + error toast.
5. Verify ~/.hermes/logs/gateway-restart.log and ~/.hermes/logs/hermes-update.log contain the same output for post-hoc inspection.
6. Verify the endpoints are auth-gated:

   curl -i -X POST http://127.0.0.1:9119/api/gateway/restart
   # expect: 401 Unauthorized (session-token middleware)

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Ubuntu on WSL2 (linux 6.6.87.2-microsoft-standard-WSL2)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Example ~/.hermes/logs/hermes-update.log output (visible live in the dashboard):

=== hermes-update started 2026-04-21 08:40:02 ===
⚕ Updating Hermes Agent...

→ Fetching updates...
→ Local changes detected — stashing before update...
Saved working directory and index state On main: hermes-update-autostash-20260421-124823
→ Found 241 new commit(s)
→ Pulling updates...