920facdc4c
'Refreshing cua-driver (Computer Use)...' could hang for minutes on Windows: when the driver's native check-update verb returned an indeterminate result (old driver without the verb, offline, GitHub rate-limited, or the probe timing out), install_cua_driver(upgrade=True) fell through to the full upstream installer — a silent, output-captured run with a 660s ceiling, plus install.ps1's 600s concurrency-lock wait on Windows on top. Every 'hermes update' paid that cost. Two changes: - install_cua_driver() grows require_confirmed_update: with it set, an indeterminate check keeps the installed version and returns fast, printing the force path (hermes computer-use install --upgrade). 'hermes update' passes it; the explicit --upgrade CLI keeps the old fall-through so a force refresh still works when the check can't answer. - cua_driver_update_check() default timeout is now 25s on Windows (8s unchanged on POSIX): first-spawn of the exe under Defender / SmartScreen routinely exceeds 8s, and a false timeout is exactly the indeterminate result that used to trigger the multi-minute reinstall.