+ jHj&Rt^RIHt^RIt^RIt^RIt^RIHt^RIH t RRlt RRlt R R lt R R lt RR RlltRRltRRltRRltRRltRRltRRltRRltR#)aWho may write a gateway service definition (systemd unit, launchd plist). A service definition pins the ``HERMES_HOME`` its gateway runs with. Service names are derived from the home (bare / profile name / path hash), and two homes can still resolve to the same name: a custom root's ``/profiles/`` takes the same ``hermes-gateway-`` unit as ``~/.hermes/profiles/``. Every gateway boot refreshes "its" unit, so a scratch or E2E gateway started from such a home rewrote the real install's unit to point at the scratch directory, and the real gateway failed on its next restart. The rule: a definition that pins a home is written only by a process acting for that home. Uninstall already refused a unit pinning another home (``_systemd_unit_belongs_to_current_home``); the writers now refuse the same way. ``hermes gateway install --force-unit-path`` is the explicit repoint. ) annotationsN)Path) ExpatErrorc V^8dQhRRRR/#)definition_pathrreturn str | None)formats"E/home/ubuntu/.hermes/hermes-agent/hermes_cli/gateway_service_owner.py __annotate__r s ; ; ;* ;cVPR8XdVPR4;_uu_4p\P!V4pRRR4\X\4'dTPR4MRp\T\4'dTPR4MRpTe$\T4P4;'gR#R#^RI H pVPV4# +'giL;i \\ \ 3dR#i;i)zZ``HERMES_HOME`` pinned by the systemd unit or launchd plist at *definition_path*, or None.z.plistrbNEnvironmentVariables HERMES_HOMEgateway)suffixopenplistlibloadOSError ValueErrorr isinstancedictgetstrstrip hermes_clir_hermes_home_pinned_by_unit)rfhdataenvvaluegws& r pinned_homer's)  %%d++r}}R(,3=T42H2Hdhh-.d*4S$*?*? &T/4/@E   "**dJdJ( ) )/ ::,+Z0  s.C0CC0 C- (C0-C00D  D c V^8dQhRRRR/#)rrawz str | Pathrz Path | Noner )r s"r r r &s*rc\V4P4P4# \\\ 3dR#i;iN)r expanduserresolver RuntimeErrorr)r)s&r _resolver/&s<Cy##%--// \: .s&)AAc$V^8dQhRRRRRR/#)r unit_pathrsystemboolrr )r s"r r r -s!;;T;4;D;rcJ^RIHpV'gVP4#\PP RR4P 4'gUVP4'd \V4MRpV'd\V4P4#VP4#VPV4pV'gVP4#VPVR7^,p\TPT44# \dTP4u#i;i)aThe ``HERMES_HOME`` this process acts for when it writes the systemd unit at *unit_path*. User scope: its own home. System scope: an explicit ``HERMES_HOME`` remapped to the unit's ``User=`` account the way ``generate_systemd_unit`` pins it; with none (``sudo`` strips it, HOME=/root), the unit's own pinned home, which is the only thing naming the install being operated on. Pure: it never adopts the unit's home into ``os.environ``, so a check on this value compares caller and unit. rrN) run_as_user)r rget_hermes_homeosenvironrrexistsr'rr,_read_systemd_user_from_unit_system_service_identityr_hermes_home_for_target_user)r1r2r&pinneduserhome_dirs&& r service_home_for_unitrA-s) !!## ::>>- , 2 2 4 4+4+;+;+=+=Y'4,2tF|&&(L8J8J8LL * *9 5D !!##$..4.@C //9 :: $!!##$sDD"!D"c(V^8dQhRRRRRRRR/#)rrrhomeactionrrr3r )r s"r r r Fs)D#RVrc VP4'gR#\V4pVe\V4\V48XdR#\RV RV RV RV R2 4\R4\R4R #) zFalse (with guidance printed) when the existing definition pins a ``HERMES_HOME`` other than *home*. A missing definition, or one that pins no home (hand-written, pre-pinning), belongs to nobody else. Tu✗ Refusing to  z: it runs HERMES_HOME=#, but this process has HERMES_HOME=.zU That file is another install's gateway. Use that install, or pass --force-unit-pathzL to `hermes gateway install` if you really mean to repoint it at this home.F)r:r'r/print)rrCrDr)s&&& r definition_belongs_to_homerJFs{  ! ! # # o &C {hsmx~5 VHAo%66LSER..2V1 67 ab XY rc ,V^8dQhRRRRRRRRR R/#) rr1rr2r3rDrr6r rr )r s"r r r Ws1 ? ?d ?D ?# ?T^ ?jn ?rc^RIHp\W4pV'd:V'd2\VP VP V4^,44p\WV4# \ dLi;i)z``definition_belongs_to_home`` for the systemd unit at *unit_path*, judged against the home this process would pin there (``run_as_user``'s for an explicit ``--system --run-as-user`` install).r)r rrArr=r<rrJ)r1r2rDr6r&rCs&&&& r unit_belongs_to_callerrMWse)  3D + 778S8ST_8`ab8cdeD &iv >>   s0A A-,A-c V^8dQhRRRR/#)rr2r3rr r )r s"r r r esdzrcj^RIHpVPVPVR74pV'gR#\ V4P 4P 4pVP4P 4pY48XdR#^RI H pYE!4P 48XdR#T# \dR#i;i)u``HERMES_HOME`` of the unit at this scope when it belongs to ANOTHER install, else None. A throwaway ``HOME`` used to resolve the bare ``hermes-gateway`` name (its ``.hermes`` looked native) and reach the account's real unit — user scope through the account-anchored unit dir, system scope because system units are global. Naming now follows the account home, but two homes can still share a name (a custom root's ``profiles/``, a pre-pinning unit), so every systemd verb asks this. ``_sync_hermes_home_from_systemd_unit`` would adopt the unit's home and ``stop``/``restart`` would take the live gateway down, so it must be evaluated BEFORE that sync. Foreign means: the unit pins a home, it differs from this process's home, and this process's home is not the account's own default root. The last clause keeps the ``sudo`` remap (#108674): root's default home operating a unit that pins the invoking user's home is the operator, not a stranger. r)r2N)account_default_hermes_home) r rr!get_systemd_unit_pathrr,r-r7rhermes_constantsrP)r2r& unit_homeunitminerPs& r foreign_systemd_unit_homerVes)..r/G/Gv/G/VWI I))+335!!#++- |< *,4466  sAB## B21B2c$V^8dQhRRRRRR/#)rrDrr2r3rNoner )r s"r r r s!   T d rc ^RIHp\V4pVfR#VPRV RVP 4 RVP V4 RV RVP 4 R2 4\P!^4R#) z^Exit non-zero instead of operating another install's unit (see ``foreign_systemd_unit_home``).rNz Refusing to rFz: that z unit runs HERMES_HOME=rGzQ. It belongs to another Hermes install. Run this from that install's HERMES_HOME.) r rrV print_errorget_service_name_service_scope_labelr7sysexit)rDr2r&rSs&& r refuse_foreign_systemd_unitr_s()&1INN vha 3 3 56gb>U>UV\>]=^_ k!DREWEWEYDZ[Z [ HHQKrc V^8dQhRRRR/#)rverbrrrXr )r s"r r r sstrc^RIHp\VP4VP 4V4'g\ P !^4R#R#)zThe launchd half of ``refuse_foreign_systemd_unit``: exit 1 rather than start/stop/restart/remove a LaunchAgent pinning another HERMES_HOME. (Windows task names derive from LOCALAPPDATA, not HOME.)rN)r rrJget_launchd_plist_pathr7r]r^)rar&s& r refuse_foreign_launchd_plistrds:) %b&?&?&A2CUCUCWY] ^ ^   _rc V^8dQhRRRR/#r definitionrrz list[str]r )r s"r r r src^RIpVPRV4pW!PRWPR7, pW!PRV4, pV#)zEvery HERMES_HOME a gateway service definition sets: systemd ``Environment=``, launchd ``EnvironmentVariables``, the Windows ``gateway.cmd`` ``set`` line and the ``gateway.vbs`` env item.NzHERMES_HOME=([^"\r\n]+)z/HERMES_HOME\s*(.*?)flagsz)Item\("HERMES_HOME"\)\s*=\s*"([^"\r\n]+)")refindallDOTALL)rgrkhomess& r service_definition_homesrosM JJ1: >E ZZJJ^g^gZ hhE ZZDj QQE Lrc V^8dQhRRRR/#rfr )r s"r r r s&&S&Y&rc^RIpVPRWPR7p\\P V44#)zThe scripts a definition starts, by their quoted absolute paths. The Windows Startup-folder fallback and a Scheduled Task's action name no home: they start the home's ``gateway.vbs``, which does.Nz3"((?:[A-Za-z]:[\\/]|\\\\|/)[^"\r\n]*\.(?:vbs|cmd))"ri)rkrl IGNORECASElistrfromkeys)rgrkfounds& r service_definition_launchersrvs4 JJMzananJ oE  e$ %%rc V^8dQhRRRR/#)rrgrrr r )r s"r r r s rca^RIp\V4p\VP44P 4\R4\R4\R4\R40pVFp\VP 4P R44P 4o\;QJdT3RlT4F 'gK RM R M!T3RlT44'gK|TP 4u# R# \ \3dKi;i) zTemp-dir HERMES_HOME baked into a systemd unit / launchd plist, or None. A temp home means a test/E2E harness generated it; installing it leaves the gateway "running" but deaf to every platform.Nz/tmpz/var/tmpz /private/tmpz/private/var/tmp"c3\<"TF!pSV8H;'gVSP9xK# R#5ir+)parents).0rootresolveds& r 2temp_home_in_service_definition..s,S x4;;48+;+;#;; s,,TF) tempfileror gettempdirr-rrrany)rgr candidates temp_rootsr)r~s& @r temp_home_in_service_definitionrs)*5J X "#++- V d:&^(VJ CIIK--c23;;=H 3S S333S S S S99;    $   s'6C55D  D c$V^8dQhRRRRRR/#)rrgrkindrr3r )r s"r r r s!  s # $ rcb\V4pVfR#\RV RV R24\R4R#)zLRefuse (with guidance) when a service definition carries a temp HERMES_HOME.Fu"✗ Refusing to write the gateway z1: HERMES_HOME resolves to a temporary directory (z).zq This usually means a test/E2E environment exported HERMES_HOME. Unset it (or run from a clean shell) and retry.T)rrI)rgr temp_homes&& r refuse_temp_home_service_writersC/ ;I .tf4efoeppr st  : rr+)__doc__ __future__rr8rr]pathlibrxml.parsers.expatrr'r/rArJrMrVr_rdrorvrrr rr rsZ #  ( ;;2" ?> && r