From 66dbb656befb9d7b9d173222cbd7a25cd402feb3 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Sat, 12 Sep 2026 08:09:23 -0700
Subject: [PATCH] fix(skills): literal HOME replacement; `~/$VAR` still expands
 the variable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`re.sub` with the home path as a template string parsed backslashes as
escapes (re.error dropped the whole injected config block); use a callable.
The early `~/…` return also skipped `expandvars`, leaving `~/$LEAF` half
resolved. Prefix-substitute and fall through to normal expansion instead.
---
 agent/skill_utils.py            | 10 +++++-----
 tests/agent/test_skill_utils.py |  6 +++++-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/agent/skill_utils.py b/agent/skill_utils.py
index 930f0b5262..9a615e6a8a 100644
--- a/agent/skill_utils.py
+++ b/agent/skill_utils.py
@@ -715,11 +715,11 @@ def _expand_skill_config_path(value: str) -> str:
     """
     subprocess_home = get_subprocess_home()
     if subprocess_home:
-        if value == "~":
-            return subprocess_home
-        if value.startswith(("~/", "~\\")):
-            return os.path.join(subprocess_home, value[2:])
-        value = _HOME_VAR_RE.sub(subprocess_home, value)
+        if value == "~" or value.startswith(("~/", "~\\")):
+            value = subprocess_home + value[1:]
+        # Callable replacement: a literal template would parse backslashes in the home path
+        # as regex escapes.
+        value = _HOME_VAR_RE.sub(lambda _m: subprocess_home, value)
     return os.path.expanduser(os.path.expandvars(value))
 
 
diff --git a/tests/agent/test_skill_utils.py b/tests/agent/test_skill_utils.py
index 169979ae80..d2d469dbe2 100644
--- a/tests/agent/test_skill_utils.py
+++ b/tests/agent/test_skill_utils.py
@@ -152,7 +152,8 @@ def test_skill_config_home_vars_use_subprocess_home(tmp_path, monkeypatch):
     control process HOME; other variables keep normal expansion (#12260)."""
     from agent import skill_utils
 
-    hermes_home = tmp_path / "data"
+    # A backslash in the home path must not be read as a regex-replacement escape.
+    hermes_home = tmp_path / "da\\ta"
     subprocess_home = hermes_home / "home"
     subprocess_home.mkdir(parents=True)
     (hermes_home / "config.yaml").write_text("", encoding="utf-8")
@@ -160,6 +161,7 @@ def test_skill_config_home_vars_use_subprocess_home(tmp_path, monkeypatch):
     monkeypatch.setenv("HOME", str(hermes_home))
     monkeypatch.setenv("TERMINAL_HOME_MODE", "profile")
     monkeypatch.setenv("PROJECT_ROOT", "/proj")
+    monkeypatch.setenv("LEAF", "leaf")
     getattr(skill_utils, "_raw_config_cache_clear", lambda: None)()
 
     resolved = resolve_skill_config_values([
@@ -167,12 +169,14 @@ def test_skill_config_home_vars_use_subprocess_home(tmp_path, monkeypatch):
         {"key": "wiki.braced_home", "default": "${HOME}/notes"},
         {"key": "wiki.tilde", "default": "~/scratch"},
         {"key": "wiki.other_var", "default": "${PROJECT_ROOT}/cache"},
+        {"key": "wiki.tilde_var", "default": "~/$LEAF"},
     ])
 
     assert resolved["wiki.home_var"] == str(subprocess_home / "wiki")
     assert resolved["wiki.braced_home"] == str(subprocess_home / "notes")
     assert resolved["wiki.tilde"] == str(subprocess_home / "scratch")
     assert resolved["wiki.other_var"] == "/proj/cache"
+    assert resolved["wiki.tilde_var"] == str(subprocess_home / "leaf")
 
 
 def test_iter_skill_index_files_prunes_skill_support_dirs(tmp_path):