mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-06-08 08:11:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

fix: harden skill trust source matching (#31229)

Browse source 
Co-authored-by: gaia <gaia@gaia.local>
This commit is contained in:
Jorge Fuenmayor 2026-05-25 03:51:15 -05:00 • committed by GitHub
parent 2d422720b5
commit 93660643a6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 78 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

55
tests/hermes_cli/test_skills_hub.py
View file

@ -286,7 +286,6 @@ def test_do_install_scans_with_resolved_identifier(monkeypatch, tmp_path, hub_en
"trust_level": "trusted",
"metadata": {},
})()
q_path = tmp_path / "skills" / ".hub" / "quarantine" / "frontend-design"
q_path.mkdir(parents=True)
(q_path / "SKILL.md").write_text("# Frontend Design")
@ -318,6 +317,60 @@ def test_do_install_scans_with_resolved_identifier(monkeypatch, tmp_path, hub_en
assert scanned["source"] == canonical_identifier
def test_do_install_scans_official_bundles_with_source_provenance(
monkeypatch, tmp_path, hub_env
):
import tools.skills_guard as guard
import tools.skills_hub as hub
class _OfficialSource:
def inspect(self, identifier):
return type("Meta", (), {
"extra": {},
"identifier": "official/agent/prunus-gaia",
})()
def fetch(self, identifier):
return type("Bundle", (), {
"name": "prunus-gaia",
"files": {"SKILL.md": "# Prunus Gaia"},
"source": "official",
"identifier": "official/agent/prunus-gaia",
"trust_level": "builtin",
"metadata": {},
})()
q_path = tmp_path / "skills" / ".hub" / "quarantine" / "prunus-gaia"
q_path.mkdir(parents=True)
(q_path / "SKILL.md").write_text("# Prunus Gaia")
scanned = {}
def _scan_skill(skill_path, source="community"):
scanned["source"] = source
return guard.ScanResult(
skill_name="prunus-gaia",
source=source,
trust_level="builtin",
verdict="safe",
)
monkeypatch.setattr(hub, "ensure_hub_dirs", lambda: None)
monkeypatch.setattr(hub, "create_source_router", lambda auth: [_OfficialSource()])
monkeypatch.setattr(hub, "quarantine_bundle", lambda bundle: q_path)
monkeypatch.setattr(hub, "HubLockFile", lambda: type("Lock", (), {"get_installed": lambda self, name: None})())
monkeypatch.setattr(guard, "scan_skill", _scan_skill)
monkeypatch.setattr(guard, "format_scan_report", lambda result: "scan ok")
monkeypatch.setattr(guard, "should_allow_install", lambda result, force=False: (False, "stop after scan"))
sink = StringIO()
console = Console(file=sink, force_terminal=False, color_system=None)
do_install("official/agent/prunus-gaia", console=console, skip_confirm=True)
assert scanned["source"] == "official"
# ---------------------------------------------------------------------------
# UrlSource-specific install paths: --name override, interactive prompts,
# non-interactive error, existing-category scan.