+ jHj,Rt^RIHt^RIt^RIt^RIt^RIHt^RIt^RI t ^RI t ^RI t ^RI H t ^RIt!RR]4tRRltR R ltR R /R RlltRRltRRltRRltRRltRRltRRltRRltRRltR#)zBounded local-control discovery without diagnostic fallback or mutation (the one exception: an upgraded same-owner ``gateway.lock`` is narrowed to 0600, see :func:`_private_lock`).) annotationsN)Path)Literalc>a]tRt^tRRV3RllltRRltRtV;t#)DiscoveryErrorc$V^8dQhRRRRRR/#)reasonstrdetail str | Nonefix)formats"I/home/ubuntu/.hermes/hermes-agent/hermes_cli/gateway_runtime_discovery.py __annotate__DiscoveryError.__annotate__s&PPsPJPJPc <WVuVnVnVnV'dV'dV RV 2MTVn\ST`VP'dV RVP 24R#T4R#)z; z: N)r causer r super__init__)selfr r r __class__s&&&&rrDiscoveryError.__init__sZ-3C) TZ,2s3%(  t{{{F82dkk]3OOrc V^8dQhRRRR/#)rlimitintreturnr r)rs"rrrsCJrc TVPe\VP4V8:d VP#VP'dRMRpV\V4, RVP;'gRrTp\V4V8:dTMVRV\V4, V,pWR,#)z``detail`` within ``limit`` characters, never with a cut-off command: a repair command that does not fit is dropped with a notice, and an overlong description is cut visibly.Nz1; repair command omitted (path too long to print)u… [truncated])r lenr r)rrnoticeroommarkerrs&& rbounded_detailDiscoveryError.bounded_details ;; #dkk"2e";;; HLDVX#c&k13DdjjFVFVTVeUt+7Js6{8J1Kf1T~r)rr r r )NN)__name__ __module__ __qualname____firstlineno__rr%__static_attributes__ __classcell__)rs@rrrsPPrrc V^8dQhRRRR/#)rpathrrboolr)rs"rrr%s  t  rc\\R4'gR#R\P!VRR79# \dApTP\P \P 09dRp?R#Rp?R#Rp?ii;i)zA Linux POSIX access ACL is present, or its absence cannot be established. Python has no os.listxattr on macOS (whose chmod +a ACLs are separate); mode bits stay the policy there. listxattrFzsystem.posix_acl_access)follow_symlinksNT)hasattrosr1OSErrorerrnoENOTSUP EOPNOTSUPP)r.excs& r_may_have_access_aclr:%s` 2{ # #(BLLu,UUU  99(8(89 9s5 B/A;;Bc$V^8dQhRRRRRR/#)rnodeos.stat_resultr.rrr/r)rs"rrr2s&^^>^^$^rc\P!VP4pV^,'dR#V^,'gR#\V4'dR#^RIp^RIpVP VP4VPVP4reVP4Uu0uF+qwPVP8XgKVPkK- ppTPTP8H;'d\TP"TP$8H;'d;\'TP(4TP$08*;'dYP08*'*#uupi \\\ 3dR#i;i)ajThe profile home keeps the operator's mode (main's home policy: symlinked homes, HERMES_HOME_MODE 0701/0750). Only write by another user lets them swap the socket; read/search bits grant nothing against our 0600 socket, and group-write is harmless when the group is the owner's private group (the umask-002 user-private-group default). What we create stays 0700.TFN)statS_IMODEst_moder:grppwdgetpwuidst_uidgetgrgidst_gidgetpwallpw_gidgr_gidpw_uid ImportErrorKeyErrorr5gr_namepw_namesetgr_mem) r<r.moderBrCusergrouppprimary_memberss && rhome_mode_unsaferW2s, << %D e|| %<<D!!ll4;;/dkk1Je-0\\^X^xx5<rc VP4pR\PR\PR\P/pWA,!VP 4'g3\ RV R\P!VP 4 RV 24h\P!4pVPV8wd \ RV RVP RV R24h\P!VP 4pV'dF\W04'd5\ R V R VR R 2R \P!\V44 24hV'g)V^?,'d\!YVR8XdR4hR4hV#)socketfile directoryunsafe_control_pathz is , expected z is owned by uid z, expected uid z- (gateway user); chown it to the gateway userunsafe_control_permissions has mode 04oz, writable by another userz chmod go-w ii)lstatr?S_ISSOCKS_ISREGS_ISDIRrArfilemoder4getuidrEr@rWshlexquoter _open_mode)r.rZrXr< predicates expected_uidrRs&$$ r _private_noderoMsD ::> 99rc$V^8dQhRRRRRR/#)rrXrtimeoutfloatrrwr)rs"rrr|s!$=rc\V4p\P!\P\P4pVP V4VP \ V44\V4pVe&V\P!48wd \R4hV# \dTP4hi;i)aXConnected control socket for *home* whose listener runs as this user (caller closes it). The path is validated by lstat first, but connect() follows a symlink swapped in afterwards, so the listening process itself is authenticated. Platforms without a peer-credential API (neither SO_PEERCRED nor getpeereid) fall back to the path checks alone.unsafe_control_peer) _socket_pathr\AF_UNIX SOCK_STREAM settimeoutconnectr rr4rir BaseExceptionclose)rXrr.peerrs&& rconnect_privater|s  D ==);); c V^8dQhRRRR/#)rrXrrr)rs"rrrstrc\VRRR7VR, p\PPV4'd\VRR7V#VR, p\P\P ,\P ,p\P!\P!W#4R4;_uu_4p\P!VP44p\P!VP4'dRVP\P!48wg.\P !VP4^?,'d \#R4hVP%R 4pR R R 4\'X4R 8d \#R 4h\)VP+R 4P-44pVP/4'g \#R 4h^RIHpVP4R8wg%VP6P4RV!V4 28wd \#R 4h\VP6RR7\VRR7V# +'giL;i)r^T)rZrXz gateway.sockr\rZzgateway.sock.pathrbunsafe_control_pointeriNiinvalid_control_pointerzutf-8) _home_hashz control.sockz hermes-gw-)ror4r.lexistsO_RDONLY O_NOFOLLOW O_NONBLOCKfdopenopenfstatrr?rfrArErir@rreadr!rdecodestrip is_absolutegateway.control_socketrnameparent) rXdirectpointerflagsstreammetadatadatatargetrs & rrrs$[t4 N "F wwvf8, ((G KK"-- '"-- 7E 2777*D 1 1V88FMMO, X--..(//RYY[2P<< 0 01E99 !9: :{{4  2  4y4677 $++g&,,. /F     6771{{n$ (:(: :VZK[J\>](]677&--k2&x( M' 2 1sBII I" c$V^8dQhRRRRRR/#)rrXrrrrdictr)rs"rrrs!+++5+T+rc &\PR8Xd^RIHp\ V!VRV44#\ P !4V,pRp\W4;_uu_4pV\ P !4, pV^8:d\hVPV4VPV4\4pRV9dV\ P !4, pV^8:d\hVPV4VP\RR\V4, 44p V 'g \R4hVP!V 4\V4R8gK\R 4hR R R 4\ \#X44# +'giL$;i) zCUnlike diagnostic queries, retain timeout/access/protocol failures.nt)query_runtime_controls({"protocol":1,"verb":"identify","id":1}  iiincomplete_control_responseioversized_control_responseN)r4r!gateway.runtime_bootstrap_windowsr_identify_responsetime monotonicr TimeoutErrorrsendall bytearrayrecvminr!rextendbytes) rXrrdeadlinerequestclientbudgetr remainingchunks &$ rquery_identifyrs; ww$K!"7 >#IJ J~~')H:G  ' '6DNN,, Q; &!w{4 4>>#33IA~""   i (KKE6CI+= >?E$%BCC KK 4y6!$%ABB  ($ eDk **% ( 's C3F F F c V^8dQhRRRR/#)rrrrrr)rs"rrrsUtrc|\P!VPR^4^,4p\V\4'dgVP R4RJgRVP R4^8wg<VP R4^8wg&\VP R4\4'g \ R4hVR,#)rokTprotocolidresultinvalid_control_response)jsonloadssplit isinstancergetr)rresponses& rrrszz$**UA.q12H x & &(,,t* 2s(-AAA A*A*%A*)A*)__doc__ __future__rr6rr4pathlibrrjr\r?rtypingrr ValueErrorrr:rWrorlrrrrrrrrrrrszY#   Z& ^60J $&>+:)* r