hermes - 💡(How to fix) Fix Reject tar links during curator rollback [1 pull requests]

Bug Description

agent/curator_backup.py::rollback() validates absolute paths and .. components before extracting skills.tar.gz, but the Python 3.11 fallback still calls tar.extractall() without an extraction filter.

A crafted local curator snapshot can include a symlink or hardlink member followed by a regular file beneath that link. The member names pass the current path check, while unfiltered extraction can write through the link outside ~/.hermes/skills.

This is a defense-in-depth fix for crafted, corrupted, or link-containing snapshots restored through the fallback extraction path.

Affected Component

• agent/curator_backup.py
• hermes curator rollback

Expected Behavior

Rollback should accept only regular files and directories whose resolved paths stay inside the skills directory. It should also reject snapshot entries for live excluded directories such as .hub and .curator_backups.

Actual Behavior

The fallback path rejects only absolute paths and .. components before calling unfiltered extractall() on interpreters without tar extraction filters.

Proposed Fix

Keep the rollback behavior unchanged for normal file/directory snapshots, but validate every tar member before extraction:

• normalize and reject unsafe member paths
• reject entries targeting .hub or .curator_backups
• reject symlinks, hardlinks, device files, FIFOs, and other non-file/non-directory members
• pass the validated member list into extraction

Validation

A focused regression test can simulate the Python 3.11-style fallback by forcing extractall(filter=...) to raise TypeError, then verifying that a symlink member is rejected before any file can be written through it.