fix: resolve _skills_dir() for symlinked HERMES_HOME install paths (#64953)

[webtecnica]

Prevents false 'Installation blocked' error when HERMES_HOME is a symlink. Resolves _skills_dir() before relative_to() so resolved and unresolved paths match.\n\nFixes #64953.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #49885 — this is the identical one-line _skills_dir().resolve() fix at the same single install_from_quarantine site as the earliest open canonical. The both-sites superset PRs (#64954, #53409, #53493) also fix the hermes_cli/skills_hub.py Installed: line; maintainer picks between the narrow and superset fixes.

[tonydwb]

Code Review Summary

Verdict: Approved

Looks Good

• Tiny fix: resolves _skills_dir() for symlinked HERMES_HOME install paths (#64953)
• 1 addition, 1 deletion — single-line fix, trivially correct

---

Reviewed by Hermes Agent

[teknium1]

Thanks for isolating the resolved/unresolved path mismatch.

Problems

• _resolve_lock_install_path() returns target.resolve() at tools/skills_hub.py:288-291, and the proposed lock-record change correctly aligns with that. However, the normal CLI success path still performs the same unresolved-root comparison at hermes_cli/skills_hub.py:730-731. After the lock entry succeeds, a symlinked HERMES_HOME can still raise while rendering Installed:.
• This PR changes only tools/skills_hub.py; add a regression test covering an actual symlinked HERMES_HOME and asserting the lock entry plus successful CLI completion.

Suggested changes

• Resolve the SKILLS_DIR root at hermes_cli/skills_hub.py:731 before relative_to().
• Add the symlinked-root regression and preserve an escaping-path assertion for the existing containment boundary.

Automated hermes-sweeper review.

[teknium1]

This fixes the lock entry, but the same resolved/unresolved comparison remains in the normal CLI success path at hermes_cli/skills_hub.py:731 (install_dir.relative_to(SKILLS_DIR)). Please resolve that root too; otherwise a symlinked HERMES_HOME can still raise after the lock entry is recorded.

[GottZ]

This was generated by AI during triage.

Summary

18 PRs address or reference this issue complex; seven modify the resolved-install-path versus unresolved-skills-root mismatch behind #53403/#64953, while the others cover destination symlinks, CLI compatibility, skill metadata, or slash-command documentation. #64954 is the recorded best existing fix for the symlink-root cause because its diff covers both lock recording and the CLI success display on the current code shape, whereas #65050 changes only lock recording.

Related pull requests

• fix(skills): replace symlink install destinations #21739 [closed] best fix — (+57/-2) — n/a: Replaces a final-destination symlink without touching its target, addressing hermes skills install crashes with OSError when install destination is a symlink #21735's rmtree crash rather than the symlinked-root relative_to failure; although closed, it remains relevant as the recorded best fix for that issue, whose crash path is implemented differently on main by 3b9b9a7.
• fix(skills): replace force-install symlink destinations #23251 [closed] fixes — (+55/-1) — n/a: Implements the same final-destination symlink replacement as fix(skills): replace symlink install destinations #21739; although closed, it remains relevant as an explicit duplicate of fix(skills): replace symlink install destinations #21739 and because the automated close verdict cites 3b9b9a7 as the main implementation.
• docs(cli): clarify hermes -z version boundary and one-shot timeout behavior #25501 [closed] partial — (+25/-1) — n/a: Documents the -z version boundary, chat -q fallback, and absent one-shot timeout option; despite its keep_open review, the diff uses an unqualified GNU timeout example, and the author closed it over that portability conflict.
• [codex] fix(skills): resolve installed path aliases under symlinked HERMES_HOME #35630 partial — (+55/-2) — n/a: Resolves both lock-recording and Installed: roots and adds a symlink-root regression, but its backend hunk uses obsolete SKILLS_DIR; despite its keep_open review, fix(skills): resolve the skills root before computing the lock install path #64954 supplies the current-main _skills_dir() form and both production changes.
• fix(skills): install_from_quarantine fails when HERMES_HOME is a symlink #49885 duplicate — (+87/-1) — n/a: Resolves the root only for lock recording and tests that backend path, leaving the matching CLI display failure and using the obsolete static root API; despite its keep_open review, its salvageable backend work is subsumed by fix(skills): resolve the skills root before computing the lock install path #64954.
• fix(skills): remove phantom slash commands from hermes-agent SKILL.md #50608 [closed] best fix — (+2/-3) — n/a: Removes the phantom /skill guidance and wrong /q quit alias; although closed and previously reviewed keep_open, it remains relevant as the earliest recorded fix credited in merged fix(skills): accuracy + concision pass over the hermes-agent hub references #70511, which superseded the moved documentation.
• docs: fix hermes-agent skill slash command references #50613 [closed] partial — (+30/-2) — n/a: Makes the same primary slash-command corrections as fix(skills): remove phantom slash commands from hermes-agent SKILL.md #50608 but leaves another /skill reference and adds a source-shape test; although closed after a keep_open review, its corrections landed through fix(skills): accuracy + concision pass over the hermes-agent hub references #70511 while the test was deliberately omitted.
• fix(skills): resolve paths before computing relative install path #53409 partial — (+33/-4) — n/a: Changes both symlink-sensitive production sites but uses obsolete SKILLS_DIR and bundles unrelated slash-command edits plus source-text tests; despite its keep_open review, fix(skills): resolve the skills root before computing the lock install path #64954 provides the focused current-main implementation and behavioral coverage.
• fix(skills): change here-now skill frontmatter name from dotted to hyphenated (#53382) #53447 best fix — (+24/-1) — n/a: Renames here.now to here-now and validates it through the production parser and name validator, making it the recorded best existing fix for here-now skill uses invalid frontmatter name 'here.now' #53382's validator aspect; its keep_open review should be preserved, while the separately observed lock/discovery mismatch remains in fix(skills): preserve official optional-skill frontmatter names #27471.
• fix(skills): handle symlinked skills install paths #53493 partial — (+60/-3) — n/a: Uses a shared helper at both lock-recording and CLI-display sites and adds backend symlink-root coverage, but the helper uses obsolete SKILLS_DIR and lacks CLI completion coverage; despite its keep_open review, fix(skills): resolve the skills root before computing the lock install path #64954 is the current-main superset.
• fix(skills): resolve symlinks before relative_to in skill install #53541 duplicate — (+1/-1) — n/a: Applies the older static-root form of the backend-only fix without a regression test or CLI-display repair; despite its keep_open review, the diff is subsumed by fix(skills): resolve the skills root before computing the lock install path #64954's two-site current-main change.
• docs: fix small skill and cli references #54444 best fix — (+8/-4) — n/a: Combines complete CLI compatibility guidance, the here-now rename, and all three slash-command corrections without changing install paths; its keep_open review found no blocker, and it remains the recorded best existing fix for Docs/compat: clarify hermes -z version boundary and timeout support for one-shot/chat CLI #25121.
• docs(cli): remove phantom slash commands #62933 [closed] fixes — (+2/-3) — n/a: Corrects all three phantom /skill and /q references; although closed, it remains relevant as an explicit duplicate of fix(skills): remove phantom slash commands from hermes-agent SKILL.md #50608 whose documentation outcome is now represented by merged fix(skills): accuracy + concision pass over the hermes-agent hub references #70511.
• fix(docs): remove phantom /skill and /q alias from hermes-agent SKILL.md #63451 [closed] fixes — (+134/-3) — n/a: Repeats the fix(skills): remove phantom slash commands from hermes-agent SKILL.md #50608 documentation correction with a large registry-oriented regression test; although closed, it remains relevant as voluntarily superseded duplicate work now represented by fix(skills): accuracy + concision pass over the hermes-agent hub references #70511.
• fix(skills): resolve the skills root before computing the lock install path #64954 best fix — (+98/-2) — n/a: The recorded best existing fix for Bug: skill install crashes with ValueError when SKILLS_DIR or install path contains a symlink #53403/[Bug]: skills install fails with false "Installation blocked" and orphans files when HERMES_HOME is a symlink #64953 resolves the current _skills_dir() root for lock recording, resolves the CLI display root, and tests successful lock creation plus continued escape rejection; consistent with its keep_open review, the rebased branch reports 13 passing path-safety cases.
• fix: resolve _skills_dir() for symlinked HERMES_HOME install paths (#64953) #65050 partial — (+1/-1) — n/a: Correctly applies _skills_dir().resolve() to lock recording but leaves the same unresolved-root comparison in the CLI Installed: path and adds no regression test; despite its keep_open review, fix(skills): resolve the skills root before computing the lock install path #64954 contains this hunk plus the required second site and coverage.
• fix(skills): accuracy + concision pass over the hermes-agent hub references #70511 [merged] best fix — (+280/-306) — n/a: Rebuilds the command references from the live registry, removes phantom /skill guidance, and assigns /q to /queue; although merged, it remains the reference implementation that supersedes the Docs: hermes-agent SKILL.md documents phantom slash commands (/skill, /q) #50605 documentation PRs.
• docs(skills): document /skill-name slash invocation in slash-commands.md #71295 related — (+11/-3) — n/a: Documents dynamically discovered / invocation and distinguishes it from built-in COMMAND_REGISTRY entries; consistent with its keep_open review, the shown diff now describes discovery as lazy, profile-aware, and inclusive of configured external directories.

Duplicates

For the symlink-root cause, #35630, #53409, #53493, and #64954 overlap at both production sites; #49885 and #53541 are older backend-only variants, and #65050 is the current-main backend-only subset of #64954. Separately, #23251 duplicates #21739; #50608, #50613, #62933, and #63451 substantially duplicate the correction delivered by #70511; #25501 overlaps the CLI-compatibility part of #54444, and #53447 overlaps its here-now part.

Suggested consolidation

Keep #64954 open with a salvage path as the canonical #53403/#64953 branch: preserve its current-main two-site changes and symlink/escape regressions, consistent with the maintainer-bot keep_open verdict and recorded best-fix findings. Close #65050 as a backend-only duplicate of #64954, and likewise close #35630, #49885, #53409, #53493, and #53541 as superseded variants because their visible diffs use obsolete path APIs, omit one affected call site, lack equivalent coverage, or bundle unrelated work; keep #53447, #54444, and #71295 open for their independent documented salvage paths.

Complex graph

flowchart TD
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I53403(["issue #53403 (open)"])
    I64953(["issue #64953 (open)"])
    subgraph Dup35630 ["PRs duplicating each other"]
        P35630["PR #35630 (open)"]
        P49885["PR #49885 (open)"]
        P53409["PR #53409 (open)"]
        P53493["PR #53493 (open)"]
        P53541["PR #53541 (open)"]
        P64954["PR #64954 (open)"]
        P65050["PR #65050 (open)"]
    end
    P65050 -.->|partial| I53403
    P65050 -.->|partial| I64953
    class I53403 open
    class I64953 open
    class P35630 open
    class P49885 open
    class P53409 open
    class P53493 open
    class P53541 open
    class P64954 open
    class P65050 open
    class P64954 best
    class P64954 best
    class P65050 target
    click I53403 "https://github.com/NousResearch/hermes-agent/issues/53403"
    click I64953 "https://github.com/NousResearch/hermes-agent/issues/64953"
    click P35630 "https://github.com/NousResearch/hermes-agent/pull/35630"
    click P49885 "https://github.com/NousResearch/hermes-agent/pull/49885"
    click P53409 "https://github.com/NousResearch/hermes-agent/pull/53409"
    click P53493 "https://github.com/NousResearch/hermes-agent/pull/53493"
    click P53541 "https://github.com/NousResearch/hermes-agent/pull/53541"
    click P64954 "https://github.com/NousResearch/hermes-agent/pull/64954"
    click P65050 "https://github.com/NousResearch/hermes-agent/pull/65050"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 18 pull requests and 7 issues in this complex. Each diff was read against this issue; Assessment working set: 97 kB of PR diffs, 49 kB of issue/PR text, 35 kB of discussion (51 comments), 36 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.