github.com/cashapp/hermit

fix: re-validate archive paths after applying strip (#575)

Archive path computation validated the entry path before applying
`strip`, then joined the remainder to the destination without
re-checking, so the result could fall outside the destination directory.
This applies to all multi-file extractors (tar, zip, 7z, rpm) via the
shared path helper.

Re-validates the path after `strip`, and tightens `sanitizeExtractPath`
to require a path separator after the destination so a sibling sharing
its name as a prefix is not accepted.

Adds regression tests.

Co-authored-by: Amp <amp@ampcode.com>

fix(zsh): stop ../-path completion stalling and double chpwd registra…

…tion (#574)

Two zsh shell-hook issues that compound on machines where Hermit hooks
are evaluated more than once (e.g. a corporate-managed /etc/zshrc plus a
per-user ~/.zshrc install).

1. ../-path tab completion paused ~1s. zsh's _cd completer canonicalises
a `../` prefix by running `cd` in a $(...) subshell, which fires
chpwd_functions -> change_hermit_env and pays for a full Hermit env
switch (validate + source activate-hermit) that is then discarded. Guard
change_hermit_env with `${compstate+_}`, which zsh sets only while its
completion system is running and which is inherited into the _cd
subshell. Interactive `cd`, `(cd ... && cmd)` and `$(cd ... && cmd)` all
leave compstate unset and are unaffected.

2. change_hermit_env was registered twice in chpwd_functions, doubling
the
cost of every real cd. The hook block is evaluated once per startup file
that sources it (system-wide + per-user), and the old
`chpwd_functions+=(change_hermit_env)` is not idempotent. Register via
add-zsh-hook instead, which checks membership before appending. Note a
plain `typeset -gU chpwd_functions` does not help: += bypasses the
unique
flag in zsh 5.9.

fix: deadlock between Task.Size and redrawProgress under parallel ins…

…tall (#564)

## Summary

#558 parallelised `hermit install`, which lets many goroutines drive
per-package download progress concurrently. `cache/http.go` calls
`task.Size(total)` followed by `task.Add(n)` for each chunk received;
with a single active task the cycle below could never close, but with
many it closes in two hops.

Lock orderings:

```
Task.Size: task.lock -> ui.lock (via UI.swapSize)
UI.redrawProgress: ui.lock -> task_i.lock (via liveOperations / op.status)
```

Goroutine A inside `task_A.Size` holds `task_A.lock` waiting on
`ui.lock`. Goroutine B, having just returned from its own `task.Add`'s
critical section, enters `redrawProgress` holding `ui.lock` and iterates
operations waiting on `task_A.lock`. Deadlock is silent because the UI
itself is blocked, so no progress output is produced before the job is
killed — matches the wild symptom of `hermit install` stalling with zero
output after `v0.52.0` on CI jobs that install many packages at once.

## Fix

Release `task.lock` in `Task.Size` before calling `UI.swapSize`. The
`oldSize → newSize` delta passed to `swapSize` is additive and
commutative, so doing the swap outside the task's critical section loses
nothing.

## Test

`ui/task_test.go::TestConcurrentTaskSizeAndAddNoDeadlock` fans out
goroutines each interleaving `Size`/`Add` on their own task (mirroring
`cache/http.go`'s download loop).

- Pre-fix: hangs for the test's 10s self-deadline and fails with an
annotated goroutine dump showing the expected `ui.lock` ↔ `task.lock`
cycle.
- Post-fix: completes in ~0s.

Passes `go test -race ./ui/` and existing `go test ./app/`.

---------

Co-authored-by: Josh Friend <jfriend@block.xyz>

feat: parrallellize hermit install downloads (#558)

Download package archives concurrently during install using errgroup,
with concurrency defaulting to `runtime.NumCPU()`. A new `-j` flag
allows overriding the parallelism level.

Only the download phase is parallelised. Extraction and linking remain
serial because unpack triggers may execute binaries from dependency
packages.

Both install paths benefit:
- **No-args** (re-install existing): parallel download, then serial
CacheAndUnpack.
- **With packages**: parallel download, then serial install/link loop.

A new `State.Download` method is added to expose download-only
functionality, separate from `CacheAndUnpack`.

Co-authored-by: Amp <amp@ampcode.com>

Guard zsh prompt prefix updates (#555)

## Summary
- only capture `_HERMIT_OLD_PS1` and prepend the Hermit prompt once in
`update_hermit_ps1`
- avoid re-prepending the Hermit prompt on later precmd runs once the
original prompt has been recorded

## Testing
- `go test ./...`

Co-authored-by: Amp <amp@ampcode.com>

fix: sync sources on ListInstalled resolution failure (#552)

Co-authored-by: Amp <amp@ampcode.com>

fix: move download outside global lock in CacheAndUnpack (#551)

## Summary

- Move the network download step outside the global file lock in
`CacheAndUnpack()` so slow downloads no longer block other hermit
processes
- Only the fast local extract + link operations remain under the lock,
preventing "timed out acquiring lock" errors in CI
- Consistent with `CacheAndDigest()` which already downloads outside any
lock

This is safe because cache paths are content-addressed (SHA256-based)
and the cache layer uses temp files + atomic `os.Rename` (see
`cache/http.go` `downloadHTTP()`).

per
[ADR-0098](https://docs.google.com/document/d/1CxeLv3gArVytK8pJLw-MMA3t6j4OqE65rK1Kbs6RcrM/edit)
and the [Workspace
Contract](https://docs.google.com/document/d/18Susz4iTeWoINhchvIFmSen_fHU657hAurvNlZFliuY/edit).

## Test plan

- [x] \`go build ./...\` compiles successfully
- [x] \`go test ./state/... ./cache/...\` passes
- [ ] Verify in CI that parallel hermit installs no longer produce lock
timeout errors

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

What's Changed

• Quote activation exports and paths for space-containing roots by @robmaceachern in #545

New Contributors

• @robmaceachern made their first contribution in #545

Full Changelog: v0.49.3...v0.49.4

What's Changed

• cache: do not print spurious '%s' format verb by @marco-m in #544
• fix: prevent Git argument injection RCE by @wsutina in #542

New Contributors

• @marco-m made their first contribution in #544

Full Changelog: v0.49.2...v0.49.3