hermes-agent/contributors/emails/menhguin@users.noreply.github.com at 76e416052c88feb87a4660f0a4e9c5aeec034ccf - mirrors/hermes-agent - Cosmolan Git

mirrors/hermes-agent

mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-28 18:19:28 +00:00

menhguin 59482ea800 fix(skills): never change a skill's source registry on update

`hermes skills update` could silently replace a same-named skill from a
DIFFERENT registry — deleting the user's files and rewriting the lockfile's
recorded provenance. Two defects on main:

- tools/skills_hub.py: check_for_skill_updates fell back to *all* sources
  (`... or sources`) when no adapter matched the recorded source, so any
  registry with a same-named skill could satisfy the fetch and be reported
  as an update — silently reassigning provenance. Now reports the entry as
  `unavailable` instead of cross-registry fallback.
- hermes_cli/skills_hub.py: do_update called do_install with a bare, slash-
  less identifier and no source constraint, letting _resolve_short_name fuzzy-
  match a same-named skill in another registry. do_install now takes an
  optional source_id pin that ABORTS (rather than falls back) when no adapter
  matches, and do_update forwards the lockfile's recorded source as that pin.

Includes regression tests reproducing the cross-registry hijack.

Salvaged from PR #72216 onto current main; re-attributed to the human
contributor.

Co-authored-by: menhguin <menhguin@users.noreply.github.com>

2026-07-26 19:29:56 -07:00

1 line

9 B

Text

Raw Blame History

menhguin