fix(gateway): refuse to write service definitions with a temp-dir HERMES_HOME

[teknium1]

Summary

Gateway service-definition writes (systemd unit / launchd plist) now refuse to bake a temp-dir HERMES_HOME into the installed service, closing the path where a test/E2E shell with HERMES_HOME=/tmp/... exported silently poisons the production gateway.

Root cause (live incident 2026-06-11): an E2E probe ran hermes gateway restart with HERMES_HOME=/tmp/hermes-e2e-41264 exported. The restart path's refresh_systemd_unit_if_needed() regenerated the unit from the current env and wrote Environment="HERMES_HOME=/tmp/hermes-e2e-41264" + matching WorkingDirectory into ~/.config/systemd/user/hermes-gateway.service. The next planned restart (post-update) brought the gateway back "active (running)" but pointed at the empty temp home — "No messaging platforms enabled", deaf to every platform for 7+ hours, self-perpetuating because the poisoned gateway's own on-boot unit refresh re-resolved the same bad env. The existing safety belt only sniffed pytest-shaped markers (/pytest-of-, /hermes_test), which manual E2E homes don't carry.

Changes

• hermes_cli/gateway.py: new _temp_home_in_service_definition() — extracts HERMES_HOME from a generated systemd unit (Environment= line) or launchd plist (<key>/<string> pair) and reports it when the path resolves under tempfile.gettempdir(), /tmp, /var/tmp, or the macOS /private variants (component-wise prefix match, no /tmpfs-data false positives).
• hermes_cli/gateway.py: _refuse_temp_home_service_write() wired into all five write sites — systemd refresh + install, launchd refresh + install + start self-heal — refusing the write with actionable guidance ("unset HERMES_HOME / run from a clean shell").
• tests/hermes_cli/test_gateway_service.py: 8 detector tests + a refresh-refusal test mirroring the incident unit; 2 existing launchd tests updated to patch generate_launchd_plist with non-temp synthetic content (their pytest-tmp HERMES_HOME now trips the guard by design).

Validation

	Result
tests/hermes_cli/test_gateway_service.py	159/159 pass
Live E2E (real imports, HERMES_HOME=/tmp/hermes-e2e-guardtest)	generated unit carries temp home → detector flags it → refresh_systemd_unit_if_needed() refuses, unit file untouched
Clean-home negative check	/home/teknium/.hermes unit passes, no false positive

Infographic

[github-actions]

🔎 Lint report: fix/tempdir-hermes-home-service-guard vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 10709 on HEAD, 10709 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5603 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[liuhao1024]

Code Review — Verification

Reviewed the diff (4 files, +231/-6). This is a well-scoped defense-in-depth guard that prevents test/E2E environments from poisoning production service definitions with a temp-directory HERMES_HOME.

What I verified:

1. Component-wise path matching — _temp_home_in_service_definition() uses resolved.parents for ancestor checking, correctly rejecting /tmpfs-data/.hermes (not under /tmp). The /private/tmp macOS alias is also covered.

2. All 6 write paths guarded — refresh_systemd_unit_if_needed, systemd_install, refresh_launchd_plist_if_needed, launchd_install, launchd_start (self-heal). No unprotected write path remains.

3. Both service definition formats — systemd Environment="HERMES_HOME=..." regex and launchd <key>HERMES_HOME</key><string>...</string> regex both tested.

4. Test coverage — 10 tests including positive (real home accepted), negative (temp home rejected), edge cases (macOS /private/tmp, /tmpfs-data prefix, missing HERMES_HOME), and the structural guard test for the manual E2E probe scenario.

5. No false positives — real home paths like /home/alice/.hermes and /Users/alice/.hermes correctly pass through.

Clean implementation. No findings.