fix false missing Hermes CLI detection after deployment

deploy.sh

@@ -40,6 +40,7 @@ GIT_PROXY="${HERMES_UI_GIT_PROXY:-http://127.0.0.1:7890}"
 
 HEALTH_URL="http://127.0.0.1:$PORT/health"
 AUTH_URL="http://127.0.0.1:$PORT/api/auth/status"
+CLI_URL="http://127.0.0.1:$PORT/api/hermes/cli-status?refresh=1"
 
 # --- Output helpers -------------------------------------------------------
 
@@ -390,6 +391,22 @@ if [ "$auth_code" != "200" ]; then
   die "Deploy finished but the second health check failed."
 fi
 
+# Probe from the running service so its user, PATH and HERMES_BIN are authoritative.
+step "Checking Hermes CLI in the service environment"
+if ! cli_status="$(curl -fsS --connect-timeout 5 --max-time 25 "$CLI_URL")"; then
+  die "Deploy finished but the Hermes CLI probe could not be reached. Check the service logs."
+fi
+if ! node -e '
+  const result = JSON.parse(process.argv[1]);
+  if (result.available !== true) {
+    console.error("Hermes CLI check failed: " + (result.reason || "unknown") + " (" + (result.bin || "hermes") + ")");
+    process.exit(1);
+  }
+' "$cli_status"; then
+  die "Deploy finished but Hermes CLI is not ready. Check HERMES_BIN and the service logs."
+fi
+ok "Hermes CLI is executable by the service"
+
 ok "health $HEALTH_URL -> 200"
 ok "auth   $AUTH_URL -> 200"
 ok "Deployed $(git rev-parse --short HEAD 2>/dev/null || echo 'unknown commit') on port $PORT"