From df8e2523faa36e0c138065e6648fa203a7b0bfff Mon Sep 17 00:00:00 2001
From: Gille <4317663+helix4u@users.noreply.github.com>
Date: Sun, 28 Jun 2026 17:02:05 -0500
Subject: [PATCH] fix(windows): verify launchers after primary install

---
 hermes_cli/main.py                            | 11 +++++---
 .../hermes_cli/test_verify_console_scripts.py | 28 +++++++++++++++++++
 2 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/hermes_cli/main.py b/hermes_cli/main.py
index d67c85718a6..511c435f131 100644
--- a/hermes_cli/main.py
+++ b/hermes_cli/main.py
@@ -7182,10 +7182,12 @@ def _hermes_exe_shims(scripts_dir: Path) -> list[Path]:
     """
     if not _is_windows():
         return []
-    return [
-        scripts_dir / "hermes.exe",
-        scripts_dir / "hermes-gateway.exe",
-    ]
+
+    names = set(_load_console_script_names()) or {"hermes", "hermes-agent", "hermes-acp"}
+    # The gateway shim is not a [project.scripts] entry point, but older
+    # update/install paths still rewrite and quarantine it.
+    names.add("hermes-gateway")
+    return [scripts_dir / f"{name}.exe" for name in sorted(names)]
 
 
 def _detect_concurrent_hermes_instances(
@@ -7629,6 +7631,7 @@ def _install_python_dependencies_with_optional_fallback(
 
     try:
         _install(["install", "-e", f".[{group}]"])
+        _verify_console_scripts_installed(install_cmd_prefix, env=env)
         return
     except subprocess.CalledProcessError:
         print(
diff --git a/tests/hermes_cli/test_verify_console_scripts.py b/tests/hermes_cli/test_verify_console_scripts.py
index a09b1915ecb..f0bd3078393 100644
--- a/tests/hermes_cli/test_verify_console_scripts.py
+++ b/tests/hermes_cli/test_verify_console_scripts.py
@@ -86,3 +86,31 @@ class TestVerifyConsoleScriptsInstalled:
 
         names = _load_console_script_names()
         assert names == ["hermes", "hermes-agent", "hermes-acp"]
+
+    def test_primary_install_success_still_verifies_scripts(self):
+        import hermes_cli.main as main_mod
+
+        with patch("hermes_cli.main._is_windows", return_value=False), \
+             patch("hermes_cli.main._run_quarantined_install") as mock_install, \
+             patch("hermes_cli.main._verify_console_scripts_installed") as mock_verify:
+            main_mod._install_python_dependencies_with_optional_fallback(
+                ["uv", "pip"], env={"VIRTUAL_ENV": "x"}
+            )
+
+        mock_install.assert_called_once_with(
+            ["uv", "pip", "install", "-e", ".[all]"],
+            env={"VIRTUAL_ENV": "x"},
+            scripts_dir=None,
+        )
+        mock_verify.assert_called_once_with(["uv", "pip"], env={"VIRTUAL_ENV": "x"})
+
+    def test_quarantine_shims_include_declared_console_scripts(
+        self, temp_pyproject, fake_scripts_dir
+    ):
+        import hermes_cli.main as main_mod
+
+        with patch("hermes_cli.main._is_windows", return_value=True):
+            names = {path.name for path in main_mod._hermes_exe_shims(fake_scripts_dir)}
+
+        assert {"hermes.exe", "hermes-agent.exe", "hermes-acp.exe"} <= names
+        assert "hermes-gateway.exe" in names