Skip to content

Dashboard console skills commands no longer act on the wrong profile (#65828) - #89387

Merged
teknium1 merged 1 commit into
mainfrom
fix/skills-sync-calltime-dir
Aug 18, 2026
Merged

Dashboard console skills commands no longer act on the wrong profile (#65828)#89387
teknium1 merged 1 commit into
mainfrom
fix/skills-sync-calltime-dir

Conversation

@teknium1

Copy link
Copy Markdown
Contributor

Summary

Dashboard console skills commands (skills reset/diff/list-modified/opt-in/opt-out/repair-official) now act on the requested profile — tools/skills_sync.py resolved its skills root from an import-time snapshot, so a long-lived dashboard/TUI process ran every later console skills op (including reset_bundled_skill's delete) against whichever profile was live at import (#65828).

Root cause: third module in the same lineage as skills_tool (f8723c4) and skill_manager_tool (c6a3d41) — HERMES_HOME/SKILLS_DIR/MANIFEST_FILE frozen at import; _profile_scope()'s set_hermes_home_override() could not reach them. The #48200 rmtree strict-child guard was anchored on the wrong root.

Changes

  • tools/skills_sync.py: call-time accessors _hermes_home() / _skills_dir() / _manifest_file() — honor an explicitly patched module global (tests, retargeting), otherwise re-resolve from the live profile-scoped get_hermes_home(). All 37 call sites migrated; module constants kept for compat.
  • hermes_cli/web_server.py: _profile_scope() docstring notes skills_sync needs no module retargeting now.
  • tests/tools/test_skills_sync.py: 3 regression tests (override followed at call time, explicit patch still wins, rmtree guard anchors on the overridden profile's root).

Validation

Before After
Console skills op under _profile_scope(other) resolves import-time profile resolves scoped profile
reset_bundled_skill rmtree guard root import-time home overridden profile's skills root
Sabotage run (old binding restored) all 3 new tests FAIL, correct failure shape
tests/tools/test_skills_sync* + test_skills_hub 105/105 pass

ruff clean; existing tests that patch tools.skills_sync.SKILLS_DIR/MANIFEST_FILE unchanged and green.

Fixes #65828

Infographic

Skills sync wrong-profile fix

@github-actions

github-actions Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

૮ >ﻌ< ა ci review

running on 68da7bb — fix: dashboard console skills commands no longer act on the


Still running 1 job: CI timing report

⚠️ Warnings

OSV vulnerability scan · View job

7 known vulnerabilities found in pinned dependencies.

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

@alt-glitch alt-glitch added type/bug Something isn't working comp/cli CLI entry point, hermes_cli/, setup wizard comp/dashboard Web dashboard / control panel UI (dashboard/, landing) tool/skills Skills system (list, view, manage) area/profiles Multi-profile isolation, HERMES_HOME scoping P2 Medium — degraded but workaround exists sweeper:risk-session-state Sweeper risk: may lose/corrupt/mis-associate session or context state labels Aug 18, 2026
@alt-glitch

Copy link
Copy Markdown
Collaborator

This was generated by AI during triage.

Related: #65828, #66094, and #56523. This core-team PR implements the call-time profile-resolution repair across skills_sync operations; the earlier PRs remain useful lineage and review context.

…file (#65828)

tools/skills_sync.py bound HERMES_HOME / SKILLS_DIR / MANIFEST_FILE at
import time — the third module in the same lineage as skills_tool
(f8723c4) and skill_manager_tool (c6a3d41). In a long-lived
dashboard/TUI process, console skills commands (reset, diff,
list-modified, opt-in/out, repair-official) dispatched in-process under
_profile_scope's set_hermes_home_override(), but skills_sync's frozen
constants kept resolving against whichever profile was live at import.
Sharpest edge: reset_bundled_skill()'s #48200 rmtree strict-child guard
was computed against the WRONG skills root.

Fix: same call-time accessor pattern as the two prior fixes —
_hermes_home()/_skills_dir()/_manifest_file() honor an explicitly
patched module global (tests, retargeting) and otherwise re-resolve
from the live profile-scoped get_hermes_home() on every call. All 37
call sites migrated; module constants kept for compat.

Also documents in _profile_scope() that skills_sync needs no module
retargeting since the contextvar override now reaches it.

Regression tests (sabotage-verified: all 3 fail on the old binding):
- accessors follow set_hermes_home_override at call time
- explicit module patch still wins over the override
- rmtree guard anchors on the overridden profile's skills root

Fixes #65828
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/profiles Multi-profile isolation, HERMES_HOME scoping comp/cli CLI entry point, hermes_cli/, setup wizard comp/dashboard Web dashboard / control panel UI (dashboard/, landing) P2 Medium — degraded but workaround exists sweeper:risk-session-state Sweeper risk: may lose/corrupt/mis-associate session or context state tool/skills Skills system (list, view, manage) type/bug Something isn't working

Projects

None yet

2 participants