need ability to bypass hermit based uvx and npx shims for airgapped scenarios

[harkamals]

Describe the bug
When using custom extensions, with bundled: false, goose is still using npx shipped with package, it should respect cmd path supplied instead.

A clear and concise description of what the bug is.

To Reproduce

1. Open Goose
2. Open config.yaml and edit
   bundled: false
   cmd: path/to/my/npx
3. Switch to Goose / extensions / enable extension /
   3a. it fails to download hermit from internet and fails (because corporate restrictions)
   3b. it resets cmd: npx (which points to Goose supplied npx, and does not work for corporate environments)

Expected behavior

1. Since, it is bundled: false, it should use the cmd value as is
2. It must not reset cmd: npx (goose supplied)

Please provide following information:

• OS & Arch: Mac 15.5
• Interface: UI
• Version: v1.0.2 and v1.0.3
• Extensions enabled: Computer Controller, Memory
• Provider & Model: Claude Sonnet 3.7

[michaelneale]

I don't think that other one is related?

[michaelneale]

looking at how can detect this and not use the shims in those cases... or allow override

[harkamals]

looking at how can detect this and not use the shims in those cases... or allow override

Suggestion @michaelneale , bundled: false, should mean it is a custom extension, and should be respected.

[michaelneale]

unfortunately bundled doesn't mean that right now, but have a few solutions.

What you can already do is a work around:

call it anything other than npx or uvx, eg I copied uvx as /tmp/ovx and it would honour it.

[michaelneale]

Closing as workaround: rename uvx and npx as a different name, and refer to them to avoid the hermit automation.

Also inbound fix #4063

[harkamals]

yes, thanks. the workaround is helpful, i did a sym-link to npx.

next issue is that, it does not move envs{ value:secret} values to env keys, the secret materials are lying in config.yaml with this workaround.

whereas original npx would move the envs{} to secret store, and removes plain text values.

[michaelneale]

@harkamals I'm not sure I follow why that would be different with secrets - there is nothing in the npx shim which moved secrets?