Background
PR #2385 documents support for custom Hermes profiles through HERMES_HOME and makes project-plugin activation resolve that profile. However, the other global Hermes configuration adapters still target the default ~/.hermes tree.
Details
With HERMES_HOME set, global generation and import for MCP, hooks, permissions, skills, commands, and subagents can write to or read from the default profile instead of the active Hermes profile. In particular, permission allow/deny rules may not reach the profile used by Hermes, leaving intended protections inactive while modifying a different profile. The activation helper already resolves HERMES_HOME, which makes the inconsistency visible.
Solution / Next Steps
Introduce a shared Hermes configuration-root resolver and apply it consistently to every global Hermes adapter and shared-config writer/importer. Add global generate/import end-to-end coverage using a custom HERMES_HOME, including permissions deny rules and representative MCP/hooks configuration. Keep project-scoped paths unchanged and synchronize the compatibility documentation with the final behavior.
Found during review of #2385.
Background
PR #2385 documents support for custom Hermes profiles through
HERMES_HOMEand makes project-plugin activation resolve that profile. However, the other global Hermes configuration adapters still target the default~/.hermestree.Details
With
HERMES_HOMEset, global generation and import for MCP, hooks, permissions, skills, commands, and subagents can write to or read from the default profile instead of the active Hermes profile. In particular, permission allow/deny rules may not reach the profile used by Hermes, leaving intended protections inactive while modifying a different profile. The activation helper already resolvesHERMES_HOME, which makes the inconsistency visible.Solution / Next Steps
Introduce a shared Hermes configuration-root resolver and apply it consistently to every global Hermes adapter and shared-config writer/importer. Add global generate/import end-to-end coverage using a custom
HERMES_HOME, including permissions deny rules and representative MCP/hooks configuration. Keep project-scoped paths unchanged and synchronize the compatibility documentation with the final behavior.Found during review of #2385.