+ jHjF(a0t$Rt^RIHt^RIt^RIt^RIt^RIHt^RI H t H t H t ] 'd ^RI HtHtRRltRR ltR R ltR R ltRRltRRltRRltRRlt]]]3tR]R&RRltRRltRRltR#)a%Boundaries the AUTOMATIC multiplex migration (``hermes update``) must not cross, and the opt-out. The multiplexer replaces a kernel-enforced boundary (separate UNIX users, separate service domains, separate HERMES_HOME trees) with in-process isolation. An operator may choose that with ``hermes gateway migrate --multiplex``; an unattended update hook must not choose it for them. ``build_migration_plan`` records the same findings as NOTICES so a dry run shows them; only :func:`maybe_auto_migrate_after_update` treats them as blockers (#109954). ) annotationsN)Path) TYPE_CHECKINGCallableOptional) MigrationPlanProfileGatewayc V^8dQhRRRR/#)pidintreturn Optional[int])formats"F/home/ubuntu/.hermes/hermes-agent/hermes_cli/gateway_migrate_guards.py __annotate__rs  # - c \P!\4;_uu_4\P!RV 24P uuRRR4# +'giM;i^RIHpT!4'gR#\P!\\\P4;_uu_4\P!RRRR\T4.RRR R ^R 7pTP^8XdNTPP4'd.\!TPP44uuRRR4#RRR4R# +'giR#;i) z[Owner uid of a live process: ``/proc`` where it exists, ``ps`` on macOS; None when unknown.z/proc/N)is_macospsz-ozuid=z-pTzutf-8F)capture_outputtextencodingchecktimeout) contextlibsuppressOSErrorosstatst_uidhermes_cli.gatewayr ValueError subprocessSubprocessErrorrunstr returncodestdoutstripr )r rresults& r_pid_uidr,s   W % %wwu~&-- & % % %+ ::   Wj*2L2L M MtVT3s8 DUY`dov&+Q8    !fmm&9&9&;&;v}}**,- N M M  N M s#A A! /AE "E E c V^8dQhRRRR/#)r r r r boolr)rs"rrr(s 1 1C 1D 1rc\\R4'd\P!4M^pV'd \V4MRpVRJ;'dW!8g#)uTrue when *pid* is owned by another Unix user than this non-root caller. Gateway process scans match argv host-wide, so without this a second account's gateway (users isolate credentials by UID) became a ``restart --all`` SIGTERM target and "unfolded profile" advice. Root keeps the host-wide view (``sudo … --system`` over a ``User=`` unit), as does Windows (no ``geteuid``); an unknown owner is not called foreign. geteuidN)hasattrrr0r,)r my_uidowners& rpid_is_other_usersr4(s?%R33RZZ\F#HSME   0 00rc V^8dQhRRRR/#)r unit_pathrr rr)rs"rrr5s    rc^RIHpV!V4pVf^#^RIp\P!\ 4;_uu_4VP V4PuuRRR4# +'giR#;i)z[uid a system unit runs as: its ``User=`` (root when absent); None when the name is unknown.)_read_systemd_user_from_unitN)r"r8pwdrrKeyErrorgetpwnampw_uid)r6r8userr9s& r_system_unit_uidr>5sO? ' 2D |   X & &||D!(( ' & & & s A!! A2 c(V^8dQhRRRRRRRR/#) r homerr rserviceszlist[tuple[str, bool]]r ztuple[Optional[int], Path]r)rs"rrrAs*4m?UZtrcJ^RIHpHp^RIHpVe \ V4MRpTpRpVF|wrV R8wdKV!V4;_uu_4V!V R7p RRR4V!X 4p V 'd Wp8Xd\ V 4P4pV 'gKiRpVeKq\V 4pK~ VfQV'gI\P!\4;_uu_4VP4PpRRR4Wg3#Wg3# +'giL;i +'giYg3#;i)u``(uid, runtime_home)`` of the gateway that serves ``home``. uid: the live process owner; else, for a system unit, its ``User=`` — and ONLY that: a system unit's principal is whatever systemd will run, so an unresolvable ``User=`` stays None rather than borrowing the profile directory's owner (a stopped unit pinned to an absent NSS user is not the account that owns the files). Without a system unit (user-scope systemd / launchd / detached), the profile directory owner is the account the gateway runs as. None means unknown. runtime_home: the HERMES_HOME an installed unit pins, which is where the gateway really runs; ``home`` otherwise. )_hermes_home_pinned_by_unitget_systemd_unit_path _home_envNFsystemdsystemT)r"rCrDhermes_cli.gateway_migraterFr,r expanduserr>rrrr r!) r@r rArCrDrFuid runtime_homehas_system_unitkindrIr6pinneds &&& rgateway_identityrQAsV4*-/#tCLO  9   t__-V)PQXQfQfQhPijMN O  % % 'F %%QQf6H6(bI 7  I.HSWS_S_ShShSh0 1M0NO-k&.A-BC  ~]>'3J2K7SZR[\F GHrc$V^8dQhRRRRRR/#rXr)rs"rrrs&VV=V>VmVrc\VPPpVfVPP'dR#VPf#VP'dRVP R2#Ve VPeVPV8XdR#RVP RVP RV R2#)NzThe default gateway runs a system unit whose User= cannot be resolved on this host: an unknown service principal is not folded into automatically.r[z{' runs a system unit whose User= cannot be resolved on this host: an unknown service principal is not folded automatically.z' runs as uid z' while the default gateway runs as uid z8: a UNIX privilege boundary is not folded automatically.)r_rLrNr])rYrS default_uids&& r_guard_unix_userris,,""Kt||;;;Q{{w666GLL>*LM Ngkk1W[[K5O ~^GKK=@gmS UVrc$V^8dQhRRRRRR/#rXr)rs"rrrs&UU=U>UmUrc VPR, P4pVP;'g VPP4pVP V4'dR#RVP RV RV RVP R2 #)profilesNr[z' runs with HERMES_HOME=z , outside z: the multiplexer would serve z instead of the live home.) default_homeresolverMr@is_relative_tor])rYrS profiles_rootrMs&& r_guard_home_treerqs&&3<<>M((88GLLAACL""=11 ~%=l^:VcUde++2<<.8R TUrzDtuple[Callable[[MigrationPlan, ProfileGateway], Optional[str]], ...]_AUTO_MIGRATION_GUARDSc V^8dQhRRRR/#)r rYrr z list[str]r)rs"rrrs ) )- )I )rc VPUUu.uF p\FpV!W4;pfKVNK K" ppp\\P V44#uuppi)uEvery boundary a standalone secondary sits behind; empty when the fleet is one user, one service domain, one profiles/ tree — the only shape ``hermes update`` may fold on its own.)standalone_secondariesrrlistdictfromkeys)rYrSguardfindingfindingss& rauto_migration_blockersr|sa 222G+ET+ +G + 2   h' (( s A Ac V^8dQhRRRR/#)r rmrr zOptional[Path]r)rs"rrrs  d ~ rc ^RIHp^RIHpV!V4;_uu_4RUu.uFq1P VR7NK ppRRR4XFp\ P !\4;_uu_4VP4'dA\PPV4\P8XdVuuRRR4u#RRR4K R#uupi +'giL;i +'giK;i)aThe default profile's systemd unit when the operator MASKED it (``systemctl mask`` links it to ``/dev/null``), else None. A masked survivor cannot be enabled at boot, and masking is a deliberate "never start this", so the update hook reads it as an opt-out instead of refusing (#139324).)gatewayrErHN)FT) hermes_clirrJrFrDrrr is_symlinkrpathrealpathdevnull)rmgwrFrIunitsunits& rmasked_default_unitrs)4 < GTU}V)))8}U !   ) )  RWW%5%5d%;rzz%I* ) )  V ! * ) )s(CCC-A C*C C' * C; c V^8dQhRRRR/#)r rmrr r.r)rs"rrrs ^ ^4 ^D ^rc^RIHp^RIHp^RIHpV!V4;_uu_4V!4P R4pRRR4\X\4'gR#V!VP R4RR 7'*# +'giLF;i) at``gateway.auto_multiplex_migration: false`` in the DEFAULT profile's EFFECTIVE config: the same ``load_config`` the rest of the CLI reads (``DEFAULT_CONFIG`` + config.yaml + the managed overlay), so an administrator's managed ``false`` wins over a user's ``true`` and a YAML string ``"false"`` is false, not truthy. Only the nested key counts, there is no top-level alias.)load_config_readonlyrE)is_truthy_valuerNFauto_multiplex_migrationT)r_) hermes_cli.configrrJrFutilsrget isinstancerw)rmrrFrgateway_sections& rauto_migration_opted_outrsf 74% < .044Y? ! ot , ,223MNX\] ]] ! s A88 B )__conditional_annotations____doc__ __future__rrrr$pathlibrtypingrrrrJrrr,r4r>rQrVrerirqrr__annotations__r|rr)rs@rrs# 44H  1 J\H,V"U`\ )  ^r