From 38277a6a95484ab307ba9f8cbb62b534907d59ef Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@nousresearch.com>
Date: Sat, 11 Apr 2026 17:59:48 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20address=20review=20=E2=80=94=20reuse=20s?=
 =?UTF-8?q?udo=20var,=20add=20chown=20-h=20on=20symlink=20update?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- hermes_cli/main.py: reuse the existing `sudo` variable instead of
  redundant `shutil.which("sudo")` call that could return None
- nix/nixosModules.nix: add missing `chown -h` when updating an
  existing symlink target so ownership stays consistent with the
  fresh-create and backup-replace branches
---
 hermes_cli/main.py   | 2 +-
 nix/nixosModules.nix | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hermes_cli/main.py b/hermes_cli/main.py
index 7229bea467..bf83065f91 100644
--- a/hermes_cli/main.py
+++ b/hermes_cli/main.py
@@ -612,7 +612,7 @@ def _exec_in_container(container_info: dict, cli_args: list):
         if val:
             env_flags.extend(["-e", f"{var}={val}"])
 
-    cmd_prefix = [shutil.which("sudo"), "-n", runtime] if needs_sudo else [runtime]
+    cmd_prefix = [sudo, "-n", runtime] if needs_sudo else [runtime]
     exec_cmd = (
         cmd_prefix + ["exec"]
         + tty_flags
diff --git a/nix/nixosModules.nix b/nix/nixosModules.nix
index 8bc592fafe..918c52c149 100644
--- a/nix/nixosModules.nix
+++ b/nix/nixosModules.nix
@@ -684,6 +684,7 @@ HERMES_CONTAINER_MODE_EOF
                   current_target=$(readlink "${symlinkPath}")
                   if [ "$current_target" != "${target}" ]; then
                     ln -sfn "${target}" "${symlinkPath}"
+                    chown -h ${user}:${cfg.group} "${symlinkPath}"
                   fi
                 elif [ -d "${symlinkPath}" ]; then
                   # Existing real directory — backup and replace