fix(cli): skip npm lifecycle scripts during agent-browser post-setup

hermes_cli/tools_config.py

@@ -848,7 +848,12 @@ def _run_post_setup(post_setup_key: str):
                 # --workspaces=false restricts the install to the repo root
                 # only, avoiding the apps/* glob which would pull in
                 # apps/desktop (Electron + node-pty) unnecessarily. See #38772.
-                [npm_bin, "install", "--silent", "--workspaces=false"],
+                # --ignore-scripts prevents agent-browser's postinstall from
+                # replacing the global npm symlink with a path into
+                # node_modules/ — that local path disappears on the next
+                # hermes update, leaving a dangling symlink.  See #48521.
+                [npm_bin, "install", "--silent", "--workspaces=false",
+                 "--ignore-scripts"],
                 capture_output=True, text=True, cwd=str(PROJECT_ROOT)
             )
             if result.returncode == 0:

tests/hermes_cli/test_tools_config.py

@@ -1542,3 +1542,35 @@ def test_real_configurable_changes_still_reported_in_diff():
     assert ((new_enabled2 - current) & universe) == {"vision"}
 
 
+
+
+def test_agent_browser_post_setup_passes_ignore_scripts(monkeypatch, tmp_path):
+    """_run_post_setup('agent_browser') must use --ignore-scripts to prevent
+    agent-browser's postinstall from replacing the global npm symlink with a
+    local node_modules/ path that vanishes on the next hermes update.  #48521"""
+    from pathlib import Path
+    from hermes_cli import tools_config
+
+    # Make node_modules/agent-browser appear missing so the install path runs
+    fake_project = tmp_path / "hermes-agent"
+    monkeypatch.setattr(tools_config, "PROJECT_ROOT", fake_project)
+
+    calls = []
+
+    def fake_run(cmd, **kw):
+        calls.append(cmd)
+        return type("R", (), {"returncode": 0, "stdout": "", "stderr": ""})()
+
+    monkeypatch.setattr("shutil.which", lambda name: "/usr/bin/npm" if name == "npm" else None)
+    monkeypatch.setattr("subprocess.run", fake_run)
+
+    _run_post_setup("agent_browser")
+
+    assert len(calls) == 1
+    cmd = calls[0]
+    assert "--ignore-scripts" in cmd, (
+        f"--ignore-scripts must be passed to npm install to prevent "
+        f"agent-browser postinstall from overwriting global symlinks; "
+        f"got: {cmd}"
+    )
+    assert "--workspaces=false" in cmd