fix(hermes): restore dashboard runtime permissions

agents/hermes/start.sh

@@ -1608,13 +1608,13 @@ wait_for_hermes_gateway_internal() {
 
 restore_hermes_config_permissions_after_dashboard_start() {
   [ "$(id -u)" -eq 0 ] || return 0
-  # Hermes dashboard startup may tighten HERMES_HOME to 0700 because it runs as
-  # the sandbox owner. The gateway process runs as the separate gateway user and
-  # reads config via sandbox-group membership, so restore NemoClaw's shared
-  # mutable-root mode after the dashboard has performed its startup checks.
+  # Hermes dashboard startup may tighten HERMES_HOME and its runtime directories
+  # to 0700 because it runs as the sandbox owner. The gateway process runs as the
+  # separate gateway user and relies on sandbox-group membership, so restore the
+  # complete bounded writable layout after the dashboard startup checks.
   local attempts=0
   while [ "$attempts" -lt 5 ]; do
-    ensure_hermes_config_root_mode || return 1
+    repair_hermes_startup_layout || return 1
     attempts=$((attempts + 1))
     sleep 1
   done

test/hermes-dashboard-permission-restore.test.ts

@@ -0,0 +1,45 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { extractShellFunction } from "./support/hermes-shell-harness";
+
+const START_SCRIPT = path.join(import.meta.dirname, "..", "agents", "hermes", "start.sh");
+
+describe("Hermes post-Dashboard permission restore", () => {
+  it("reasserts the complete writable layout throughout the bounded startup window", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-hermes-dashboard-repair-"));
+    const scriptPath = path.join(tmpDir, "run.sh");
+    const src = fs.readFileSync(START_SCRIPT, "utf-8");
+    fs.writeFileSync(
+      scriptPath,
+      [
+        "#!/usr/bin/env bash",
+        "set -euo pipefail",
+        extractShellFunction(src, "restore_hermes_config_permissions_after_dashboard_start"),
+        'id() { [ "${1:-}" = "-u" ] && printf "0\\n"; }',
+        'repair_hermes_startup_layout() { printf "repair-layout\\n"; }',
+        "sleep() { :; }",
+        "restore_hermes_config_permissions_after_dashboard_start",
+      ].join("\n"),
+      { mode: 0o700 },
+    );
+
+    try {
+      const result = spawnSync("bash", [scriptPath], {
+        encoding: "utf-8",
+        timeout: 5000,
+        env: process.env,
+      });
+      expect(result.status).toBe(0);
+      expect(result.stdout.trim().split("\n")).toEqual(Array(5).fill("repair-layout"));
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});