fix: detect service-managed local gateways on Linux

[JaimeMarques]

Summary

• Recognize a service-managed Hermes Agent gateway on Linux when the default profile is served by a live multiplexer without gateway.pid, validating its home, state, PID, and /proc start-time fingerprint.
• Make the Local connection status require the default profile's own API listener to answer /health, while leaving named-profile status read-only (port resolution can mutate their configs).
• Refuse Stop/Restart and API-key changes through Hermes One when the default gateway is externally managed, instead of claiming success or desynchronizing credentials.

Scope

The new fallback is Linux/default-profile-only. Named profiles still need a dedicated Local API listener; existing behavior on macOS/Windows is unchanged. This does not restart or modify a running service.

Verification

• Test-first regression for the false Offline status, profile list/status bar, stale/reused PID, Stop refusal, API readiness and named-profile read-only status.
• LANG=C.UTF-8 LC_ALL=C.UTF-8 npm test: 2,316 passed (222 files).
• npm run lint, npm run typecheck, npm run build, lat check, git diff --check: pass.
• Live Linux probe against a running multiplex gateway: default true, named/unserved false; local default /health: HTTP 200.
• npm run audit:prod: passes with one pre-existing moderate fflate advisory (unrelated to this change).

[greptile-apps]

Confidence Score: 5/5

[High risk] Detects externally managed gateways and blocks mutations when owned by a service.

The PR appears safe to merge; no outstanding previous finding or actionable new regression was established.

Summary

The PR recognizes live service-managed Linux gateways for the default profile, checks that profile’s Local API readiness, and refuses desktop controls that would misrepresent or desynchronize an externally managed gateway. The follow-up changes use the configured default API port, recognize equivalent home paths, and guard the nested API-key configuration path.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Default Local profile] --> B{Gateway process live?}
  B -->|No| C[Offline]
  B -->|Yes| D{Configured API health responds?}
  D -->|Yes| E[Online]
  D -->|No| C
  A --> F{Externally managed?}
  F -->|Yes| G[Refuse Stop, Restart, and API-key changes]

Loading

_{Reviews (2) · Last reviewed commit: "fix: honor configured default gateway po..."}