fix(gateway): resolve sudo profile system installs

tests/hermes_cli/test_apply_profile_override.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 import os
 import sys
 from pathlib import Path
+from types import SimpleNamespace
 
 
 
@@ -124,6 +125,30 @@ class TestApplyProfileOverrideHermesHomeGuard:
         assert result is not None
         assert "coder" in result
 
+    def test_sudo_explicit_profile_resolves_invoking_users_profile(self, tmp_path, monkeypatch):
+        """sudo elias ... should resolve `-p elias` under SUDO_USER, not root."""
+        root_home = tmp_path / "root"
+        user_home = tmp_path / "home" / "hermes"
+        profile_dir = user_home / ".hermes" / "profiles" / "elias"
+        profile_dir.mkdir(parents=True, exist_ok=True)
+        (root_home / ".hermes").mkdir(parents=True, exist_ok=True)
+
+        monkeypatch.setattr(Path, "home", lambda: root_home)
+        monkeypatch.setenv("SUDO_USER", "hermes")
+        monkeypatch.delenv("HERMES_HOME", raising=False)
+        monkeypatch.setattr(os, "geteuid", lambda: 0, raising=False)
+        monkeypatch.setattr(sys, "argv", ["hermes", "-p", "elias", "gateway", "install", "--system"])
+
+        import pwd
+
+        monkeypatch.setattr(pwd, "getpwnam", lambda name: SimpleNamespace(pw_dir=str(user_home)))
+
+        from hermes_cli.main import _apply_profile_override
+        _apply_profile_override()
+
+        assert os.environ.get("HERMES_HOME") == str(profile_dir)
+        assert sys.argv == ["hermes", "gateway", "install", "--system"]
+
     def test_hermes_home_unset_default_profile_no_redirect(self, tmp_path, monkeypatch):
         """active_profile=default must not redirect HERMES_HOME."""
         hermes_root = tmp_path / ".hermes"

tests/hermes_cli/test_gateway_service.py

@@ -1980,6 +1980,16 @@ class TestProfileArg:
         result = gateway_cli._profile_arg(str(profile_dir))
         assert result == "--profile mybot"
 
+    def test_named_profile_under_target_user_root_returns_flag(self, tmp_path):
+        """System installs generated under sudo must compare against target user's root."""
+        target_root = tmp_path / "home" / "alice" / ".hermes"
+        profile_dir = target_root / "profiles" / "mybot"
+        profile_dir.mkdir(parents=True)
+
+        result = gateway_cli._profile_arg(str(profile_dir), default_root=target_root)
+
+        assert result == "--profile mybot"
+
     def test_hash_path_returns_empty(self, tmp_path, monkeypatch):
         """Arbitrary non-profile HERMES_HOME should return empty string."""
         custom_home = tmp_path / "custom" / "hermes"
@@ -2023,6 +2033,28 @@ class TestProfileArg:
         # on the manual launchd fallback path — see test_launchd_plist_includes_profile.)
         assert "--replace" not in unit
 
+    def test_systemd_unit_for_target_user_includes_named_profile(self, tmp_path, monkeypatch):
+        """sudo system install must keep the target user's named profile in ExecStart."""
+        root_home = tmp_path / "root"
+        target_home = tmp_path / "home" / "alice"
+        root_profile = root_home / ".hermes" / "profiles" / "mybot"
+        root_profile.mkdir(parents=True)
+
+        monkeypatch.setattr(Path, "home", lambda: root_home)
+        monkeypatch.setenv("HERMES_HOME", str(root_profile))
+        monkeypatch.setattr(gateway_cli, "get_hermes_home", lambda: root_profile)
+        monkeypatch.setattr(
+            gateway_cli,
+            "_system_service_identity",
+            lambda run_as_user=None: ("alice", "alice", str(target_home)),
+        )
+
+        unit = gateway_cli.generate_systemd_unit(system=True, run_as_user="alice")
+
+        assert "ExecStart=" in unit
+        assert "--profile mybot gateway run" in unit
+        assert f'HERMES_HOME={target_home / ".hermes" / "profiles" / "mybot"}' in unit
+
     def test_launchd_plist_includes_profile(self, tmp_path, monkeypatch):
         """generate_launchd_plist should include --profile in ProgramArguments for named profiles."""
         profile_dir = tmp_path / ".hermes" / "profiles" / "mybot"

tests/hermes_cli/test_profiles.py

@@ -760,13 +760,14 @@ class TestWrapperScript:
 
     def test_creates_sh_on_posix(self, profile_env, monkeypatch):
         monkeypatch.setattr("sys.platform", "darwin")
+        monkeypatch.setattr("hermes_cli.profiles.shutil.which", lambda name: "/opt/hermes/bin/hermes")
         from hermes_cli.profiles import create_wrapper_script
         wrapper = create_wrapper_script("mybot")
         assert wrapper is not None
         assert wrapper.name == "mybot"
         content = wrapper.read_text()
         assert content.startswith("#!/bin/sh")
-        assert "hermes -p mybot" in content
+        assert "exec /opt/hermes/bin/hermes -p mybot" in content
 
     def test_creates_bat_on_windows(self, profile_env, monkeypatch):
         monkeypatch.setattr("sys.platform", "win32")