mirror of
https://github.com/msitarzewski/agency-agents.git
synced 2026-10-12 05:35:01 +00:00
Michael SitarzewskiandClaude Opus 5.5
d801ff90ad
`rm -rf "$dest/"` follows a symlink and empties its target. basename ignores a trailing slash, so HERMES_PLUGIN_DIR=".../agency-agents-router/" passed every check, and a symlinked destination (our own --link install, or a user's folder) had its target's contents deleted. #903's ownership check didn't cover it: the check reads through the link and the rm still follows it. - Strip all trailing slashes from the destination before any check. - A symlinked destination is removed with `rm -f` (the link itself), never `rm -rf`. - test-install-hermes-destination.sh: two new cases (trailing slash on a symlink to a folder with a matching plugin.yaml; re-install over a --link install). Both fail before this commit and pass after. Found by a destructive-path matrix (25 scenarios, throwaway container, fake HOME with sentinel files): main fails 10 (deletes unrelated dirs, files and symlink targets at the plugin path); the series without this commit fails 2 (H8/H9); with it, 25/25. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>