fix: resolve mcp-hermit cleanup path expansion issue #5953

sheikhlimon · 2025-12-02T20:33:13Z

Summary

Issue: mcp-hermit cleanup fails with "No such file or directory" error - this was already fixed recently by replacing tilde with ${HOME} variable

Solution: Add proper quoting to the cleanup marker path to prevent shell expansion issues and ensure robust path handling

The root cause was already addressed in a recent PR, but this adds additional safety with proper quoting around path variables.

Type of Change

AI Assistance

This PR was created or reviewed with AI assistance

Related Issues

Relates to #5944

sheikhlimon · 2025-12-02T20:49:22Z

@The-Best-Codes I just noticed the previous PR addressing this. But shouldn't quotes be the standard approach?

Edit: #5868 I guess this was a linux and ui problem since it's placed on ui/desktop /src/bin, not just fedora... the main issue was probably the ~, not the quotes. I don't have the whole picture but cleanup logic could be moved to /scripts/mcp-hermit-cleanup.sh for using broadly. Using consistent quotes for the whole script probably would be more robust.

taniandjerry · 2025-12-02T20:54:35Z

Let me tag @block/goose-core-maintainers as well!

The-Best-Codes · 2025-12-03T04:34:55Z

@sheikhlimon The issue was with ~ expansion inside quotes in various shells, to err on the side of caution PR #5868 removes quotes and uses the ${HOME} variable. I don't think adding the quotes back is a good idea, but I'd be happy to hear why if you think it is! 😀

sheikhlimon · 2025-12-03T06:39:02Z

Thanks for the clarification! Yes, using ${HOME} instead of ~ absolutely fixes the original issue. ~ does not expand inside quotes in POSIX shells, so switching to ${HOME} was the right call. 👍

My point about quotes was more about general shell safety rather than the tilde issue.
Even after fixing ~ -> ${HOME}, quoting variables is still considered best practice because:
Paths under $HOME can legally contain spaces (macOS is especially common).
Without quotes, something like:

cd ${HOME}/.config/goose/mcp-hermit

would turn into multiple arguments if the user’s home directory contains spaces.

Even if we expect users not to have unusual paths, quoting ensures consistent behavior across shells and environments.
So the corrected form:

cd "${HOME}/.config/goose/mcp-hermit"

is both tilde-safe and robust against those other issues.

I completely understand the fix in #5868, removing quotes was a fast way to eliminate the tilde-expansion bug. However, now that ${HOME} is being used everywhere, adding quotes back shouldn’t reintroduce the original problem and would make the script more defensive and portable overall. 😄

The-Best-Codes · 2025-12-03T14:26:20Z

@sheikhlimon Hmm, I'm still just not seeing the need for quotes. A home directory with spaces is pretty rare, and that's basically the only thing that would be user-controlled in this script. The rest of the commands involving paths are hard-coded and don't contain spaces.
If you want, though, I do see some opportunity for standardization and consistency improvements in the script. You could migrate all the commands involving a path to be wrapped in quotes (I don't think it will hurt anything at least), and maybe standardize all the environment variables to be ${VAR} instead of $VAR (for example, the CLEANUP_MARKER var could be updated to use that pattern). Let me know what you think!

sheikhlimon · 2025-12-03T19:57:48Z

Good point. The rest of the paths are hard-coded, but quoting is still recommended because ${HOME} itself is user-controlled and the entire expansion is subject to word splitting or globbing if it is unquoted. Even without spaces, characters like (, ), *, ?, or brackets in a home directory can change how the shell interprets commands like:

cd ${HOME}/...
mkdir -p ${HOME}/...
cp ${HOME}/...

These cases are uncommon, but quoting removes that class of issues completely and matches what the standard shell style guides recommend: always quote variable expansions unless you specifically want word splitting. This script never relies on splitting, so quoting makes it more consistent and predictable.

I am happy to update it for consistency by quoting all path-related expansions and using the ${VAR} form if that sounds good.

The-Best-Codes · 2025-12-03T20:09:02Z

Yeah that sounds good!

Signed-off-by: sheikhlimon <[email protected]>

The-Best-Codes

All looks good to me, I haven't tested it locally yet though

alexhancock

This LGTM

* 'main' of github.com:block/goose: (22 commits) OpenRouter & Xai streaming (#5873) fix: resolve mcp-hermit cleanup path expansion issue (#5953) feat: add goose PR reviewer workflow (#6124) perf: Avoid repeated MCP queries during streaming responses (#6138) Fix YAML serialization for recipes with special characters (#5796) Add more posthog analytics (privacy aware) (#6122) docs: add Sugar MCP server to extensions registry (#6077) Fix tokenState loading on new sessions (#6129) bump bedrock dep versions (#6090) Don't persist ephemeral extensions when resuming sessions (#5974) chore(deps): bump mdast-util-to-hast from 13.2.0 to 13.2.1 in /ui/desktop (#5939) chore(deps): bump node-forge from 1.3.1 to 1.3.2 in /documentation (#5898) Add Scorecard supply-chain security workflow (#5810) Don't show subagent tool when we're a subagent (#6125) Fix keyboard shortcut conflict for Focus Goose Window (#5809) feat(goose-cli): add feature to disable update (#5886) workflow: enable docs-update-recipe-ref (#6132) fix: filter tools in Ollama streaming when chat mode is enabled (#6118) feat(mcp): platform extension for "code mode" MCP tool calling (#6030) workflow: auto-update recipe-reference on release (#5988) ... # Conflicts: # ui/desktop/src/App.tsx # ui/desktop/src/api/sdk.gen.ts # ui/desktop/src/components/ChatInput.tsx # ui/desktop/src/components/recipes/RecipesView.tsx

…s-predefined-models * 'main' of github.com:block/goose: (81 commits) fix: display shell output as static text instead of spinner (#6041) fix : Custom providers with empty API keys show as configured in desktop (#6105) Add .agents/skills and ~/.config/agent/skills to skills discovery paths (#6139) fix: use instructions for system prompt and prompt for user message in subagents (#6121) Fix compaction loop for small models or large input (#5803) feat: Centralize theme management with ThemeContext (#6137) OpenRouter & Xai streaming (#5873) fix: resolve mcp-hermit cleanup path expansion issue (#5953) feat: add goose PR reviewer workflow (#6124) perf: Avoid repeated MCP queries during streaming responses (#6138) Fix YAML serialization for recipes with special characters (#5796) Add more posthog analytics (privacy aware) (#6122) docs: add Sugar MCP server to extensions registry (#6077) Fix tokenState loading on new sessions (#6129) bump bedrock dep versions (#6090) Don't persist ephemeral extensions when resuming sessions (#5974) chore(deps): bump mdast-util-to-hast from 13.2.0 to 13.2.1 in /ui/desktop (#5939) chore(deps): bump node-forge from 1.3.1 to 1.3.2 in /documentation (#5898) Add Scorecard supply-chain security workflow (#5810) Don't show subagent tool when we're a subagent (#6125) ... # Conflicts: # crates/goose/src/providers/formats/databricks.rs

* main: fix: we don't need to warn about tool count when in code mode (#6149) deps: upgrade agent-client-protocol to 0.9.0 (#6109) fix(providers): fix for gemini-cli on windows to work around cmd's multiline prompt limitations #5911 (#5966) More slash commands (#5858) fix: MCP UI not rendering due to CallToolResult structure change (#6143) fix: display shell output as static text instead of spinner (#6041) fix : Custom providers with empty API keys show as configured in desktop (#6105) Add .agents/skills and ~/.config/agent/skills to skills discovery paths (#6139) fix: use instructions for system prompt and prompt for user message in subagents (#6121) Fix compaction loop for small models or large input (#5803) feat: Centralize theme management with ThemeContext (#6137) OpenRouter & Xai streaming (#5873) fix: resolve mcp-hermit cleanup path expansion issue (#5953) feat: add goose PR reviewer workflow (#6124) perf: Avoid repeated MCP queries during streaming responses (#6138) Fix YAML serialization for recipes with special characters (#5796) Add more posthog analytics (privacy aware) (#6122) docs: add Sugar MCP server to extensions registry (#6077)

* origin/main: (57 commits) docs: create/edit recipe button (#6145) fix(google): Fix 400 Bad Request error with Gemini 3 thought signatures (#6035) fix: we don't need to warn about tool count when in code mode (#6149) deps: upgrade agent-client-protocol to 0.9.0 (#6109) fix(providers): fix for gemini-cli on windows to work around cmd's multiline prompt limitations #5911 (#5966) More slash commands (#5858) fix: MCP UI not rendering due to CallToolResult structure change (#6143) fix: display shell output as static text instead of spinner (#6041) fix : Custom providers with empty API keys show as configured in desktop (#6105) Add .agents/skills and ~/.config/agent/skills to skills discovery paths (#6139) fix: use instructions for system prompt and prompt for user message in subagents (#6121) Fix compaction loop for small models or large input (#5803) feat: Centralize theme management with ThemeContext (#6137) OpenRouter & Xai streaming (#5873) fix: resolve mcp-hermit cleanup path expansion issue (#5953) feat: add goose PR reviewer workflow (#6124) perf: Avoid repeated MCP queries during streaming responses (#6138) Fix YAML serialization for recipes with special characters (#5796) Add more posthog analytics (privacy aware) (#6122) docs: add Sugar MCP server to extensions registry (#6077) ...

…icing * 'main' of github.com:block/goose: (35 commits) docs: skills (#6062) fix: add conditional configuration for GOOSE_BIN_DIR in PATH (#5940) Update dependencies to help in Fedora packaging (#5835) fix: make goose reviewer less bad (#6154) docs: create/edit recipe button (#6145) fix(google): Fix 400 Bad Request error with Gemini 3 thought signatures (#6035) fix: we don't need to warn about tool count when in code mode (#6149) deps: upgrade agent-client-protocol to 0.9.0 (#6109) fix(providers): fix for gemini-cli on windows to work around cmd's multiline prompt limitations #5911 (#5966) More slash commands (#5858) fix: MCP UI not rendering due to CallToolResult structure change (#6143) fix: display shell output as static text instead of spinner (#6041) fix : Custom providers with empty API keys show as configured in desktop (#6105) Add .agents/skills and ~/.config/agent/skills to skills discovery paths (#6139) fix: use instructions for system prompt and prompt for user message in subagents (#6121) Fix compaction loop for small models or large input (#5803) feat: Centralize theme management with ThemeContext (#6137) OpenRouter & Xai streaming (#5873) fix: resolve mcp-hermit cleanup path expansion issue (#5953) feat: add goose PR reviewer workflow (#6124) ...

sheikhlimon marked this pull request as draft December 2, 2025 20:36

taniandjerry mentioned this pull request Dec 2, 2025

Failed to perform one time cleanup of mcp-hermit #5944

Open

sheikhlimon force-pushed the fix/mcp-hermit-cleanup-path-expansion branch from c41b117 to bea7639 Compare December 3, 2025 20:57

sheikhlimon marked this pull request as ready for review December 3, 2025 21:01

fix: resolve mcp-hermit cleanup path expansion issue

191097b

Signed-off-by: sheikhlimon <[email protected]>

sheikhlimon force-pushed the fix/mcp-hermit-cleanup-path-expansion branch from bea7639 to 191097b Compare December 3, 2025 21:17

The-Best-Codes reviewed Dec 4, 2025

View reviewed changes

alexhancock self-requested a review December 16, 2025 18:12

alexhancock approved these changes Dec 16, 2025

View reviewed changes

alexhancock merged commit 8a649dd into block:main Dec 16, 2025
17 checks passed

github-actions bot mentioned this pull request Dec 19, 2025

chore(release): release version 1.18.0 (minor) #6194

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: resolve mcp-hermit cleanup path expansion issue #5953

fix: resolve mcp-hermit cleanup path expansion issue #5953

Uh oh!

sheikhlimon commented Dec 2, 2025 •

edited

Loading

Uh oh!

sheikhlimon commented Dec 2, 2025 •

edited

Loading

Uh oh!

taniandjerry commented Dec 2, 2025

Uh oh!

The-Best-Codes commented Dec 3, 2025 •

edited

Loading

Uh oh!

sheikhlimon commented Dec 3, 2025

Uh oh!

The-Best-Codes commented Dec 3, 2025 •

edited

Loading

Uh oh!

sheikhlimon commented Dec 3, 2025

Uh oh!

The-Best-Codes commented Dec 3, 2025

Uh oh!

The-Best-Codes left a comment

Uh oh!

alexhancock left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fix: resolve mcp-hermit cleanup path expansion issue #5953

fix: resolve mcp-hermit cleanup path expansion issue #5953

Uh oh!

Conversation

sheikhlimon commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

AI Assistance

Related Issues

Uh oh!

sheikhlimon commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

taniandjerry commented Dec 2, 2025

Uh oh!

The-Best-Codes commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sheikhlimon commented Dec 3, 2025

Uh oh!

The-Best-Codes commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sheikhlimon commented Dec 3, 2025

Uh oh!

The-Best-Codes commented Dec 3, 2025

Uh oh!

The-Best-Codes left a comment

Choose a reason for hiding this comment

Uh oh!

alexhancock left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sheikhlimon commented Dec 2, 2025 •

edited

Loading

sheikhlimon commented Dec 2, 2025 •

edited

Loading

The-Best-Codes commented Dec 3, 2025 •

edited

Loading

The-Best-Codes commented Dec 3, 2025 •

edited

Loading