+ lHj2a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIH t ^RI H t H t H t ]P!]4t]P"!4tRsR]R&RRltR R ltR R ltR RltRRltRRltRRltRRlt]P:RRl4t]P:RRl4tRt ]PBR4t"R#)uLaunch-profile policy for a process that hosts several profile homes (``hermes serve`` / ``hermes dashboard`` pooling, ``?profile=``, hosted rooms; the multiplexed gateway's own worker). Two facts anchor this module: * ``agent.secret_scope.get_secret`` fails closed ONLY while ``set_multiplex_active(True)`` holds. A ``serve`` backend that hosts a second profile home never flipped it, so every unscoped read for a secondary profile silently returned the LAUNCH profile's ``os.environ`` value. The flip happens here, at the moment the process first learns it hosts another profile home. * Once multiplexing is active the launch profile is a profile too: its turns/RPCs must run under their own scope instead of ambient ``os.environ`` (a secondary context may have poisoned it, #107422). A scope rebuilt from ``/.env`` + ``config.yaml`` alone would drop the launch process's legitimate env-only policy — ``TERMINAL_ENV=ssh`` or a provider key injected by systemd / ``op run`` has no file to rebuild it from. The process env is trusted exactly once: frozen at activation, before any secondary code has run, never re-read afterwards. ) annotationsN)Path)DictIteratorOptionalzOptional[dict[str, str]] _snapshotcV^8dQhRR/#returndict[str, str])formats"F/home/ubuntu/.hermes/hermes-agent/tui_gateway/launch_profile_policy.py __annotate__r!s  N c\;_uu_4\f\\P4s\\4uuRRR4# +'giR#;i)uFreeze the process env as the launch profile's own; the first capture wins. Called at activation, immediately before the first secondary home is registered as served — the last moment ambient env is provably the launch profile's. N)_lockrdictosenvironr rrcapture_launch_envr!s0   RZZ(II s 0A  A cV^8dQhRR/#)r r Noner )rs"rrr.src6^RIHp\4V!R4R#)zThis process now hosts a profile home other than its launch home: freeze the launch env and make unscoped credential reads fail closed (``get_secret`` raises instead of borrowing).set_multiplex_activeTN)agent.secret_scoperrrs ractivate_multi_profile_hostingr.s8rcV^8dQhRR/#)r r setr )rs"rrr6src^RIHp^RIHpV!RRRR7UUu0uF5wr#VR8XgV!V4'gK\ V4P 4kK7 pppTP \ \PPR4;'g\P!4R, 4P 44V#uuppi)uFResolved homes this host could be asked to serve: the launch home plus every profile dir carrying a real servability marker. ``named_profile_has_identity`` accepts an EMPTY ``.env``, which is all a crashed ``hermes profile create`` leaves behind — counting it would flip a single-profile host fail-closed at its next boot. )#named_profile_has_servable_identity)profiles_to_serveT) multiplexinclude_standaloneinclude_parkeddefault HERMES_HOMEz.hermes) hermes_constantsr"hermes_cli.profilesr#rresolveaddrrgethome)r"r#namer.homess r_servable_profile_homesr16sE54EPTimC5D P5Djd !%H%N"T$Z   !5DE P IId2::>>-0KKDIIK)4KLTTVW L Ps CCcV^8dQhRR/#)r r boolr )rs"rrrGs+++rcP^RIHpV!4'dR#\4p\T4^8dR#\PR\T44\ 4^RI H pT!\T44R# \d&\P RRR7\ 4R#i;i)uActivate at HOST startup when this machine has more than one servable profile home. Activation used to be lazy and one-way — it fired the first time a *request* asked for a second home. Everything the host had already done by then (idle-reaper ticks, cron start, adapter connects, MCP discovery) ran under single-profile assumptions and is never re-scoped, and the launch profile's env had already been mutated by then, so ``capture_launch_env`` froze a polluted snapshot. One ``hermes serve`` / ``hermes gateway run`` per host means the process knows at boot whether it can be asked for a second home: decide there, once. Call it as the LAST boot step: the frozen snapshot is the only source for launch keys with no ``.env`` to rebuild from, so every credential the boot still injects must already be in ``os.environ``. ``gateway.multiplex_profiles: false`` is deliberately NOT consulted: it is retired as a topology opt-out, and a multi-home host that skipped activation because of a stale ``false`` would serve a second profile with the LAUNCH profile's credentials — the exact fail-open this guard exists to prevent. A genuinely single-profile host still never activates (byte-identical behaviour, ``os.environ`` precedence preserved). An unreadable profiles directory fails CLOSED: we cannot prove the host is single-profile, and the lazy backstop only fires once a request has already been answered. Returns True when this call activated hosting. is_multiplex_activeFzCould not enumerate this host's profile homes; activating multi-profile hosting fail-closed (unscoped credential reads will raise instead of borrowing the launch profile's)T)exc_infozFMulti-profile hosting activated at startup (%d servable profile homes))enable_profile_log_routing) rr6r1 Exceptionloggerwarningrleninfohermes_loggingr8sorted)r6r0r8s r&activate_multi_profile_hosting_eagerlyr@Gs,7') 5zA~ KKXZ]^cZde"$:ve}- !  #'  ) '( s A55,B%$B%cV^8dQhRR/#r r )rs"rrrusOO^Orcn^RIHpV!4'd \4#\\P 4#)zThe launch profile's env: frozen once multiplexing is active; the LIVE process env before (no secondary has run yet, so it is provably the launch profile's, and freezing it early would miss values the launch process still bridges at startup).r5)rr6rrrrr5s r _launch_envrCus'7#6#8#8  Nd2::>NNrcV^8dQhRR/#r r )rs"rrr}sXX^Xrc\4P4UUu/uF wrVPR4'gKWbK" upp#uuppi)zThe frozen launch ``TERMINAL_*`` overlay for a launch-profile turn's terminal scope. Production always captured at activation; a first capture here only happens when the multiplexer flag was set by another owner (the messaging gateway) or a harness. TERMINAL_)ritems startswith)kvs rlaunch_terminal_envrK}s; 01779 W9TQQ\\+=VDAD9 WW Ws AAc V^8dQhRRRR/#)r launch_home str | Pathr r r )rs"rrrsZNrc^RIHpHp\4P 4UUu/uFwr4V!V4'dKW4bK pppVP V!\ V444V#uuppi)uJThe launch profile's secret mapping: its ``.env`` + external sources over the launch env (systemd / ``op run`` injection survives the fail-closed flip; a secondary never sees it because its scope is built from its own files only). Bound for EVERY launch-profile body, multiplexing or not, so the body's credential source is decided once at entry: a request that entered while single-profile keeps resolving from this mapping after a concurrent first secondary flips ``get_secret`` to fail closed (``_MULTIPLEX_ACTIVE`` is read on every ``get_secret``, the scope decision was made at entry). PRECEDENCE, and it is not the process's: ``/.env`` (plus hydrated external sources) WINS over the env. For a key present in both, an unscoped read returned the ambient ``os.environ`` value before activation and returns the ``.env`` value after — so activation is not purely "stricter" for the launch tenant, it also changes which of the launch profile's own two values it sees. Env-only keys (systemd ``Environment=``, ``op run``, Compose) are unaffected: nothing in the files shadows them. )_is_global_envbuild_profile_secret_scope)rrPrQrCrGupdater)rMrPrQrIrJscopes& rlaunch_secret_scoperTsX N)m113 M3da>!;LTQT3E M LL+D,=>? L Ns A&A&c V^8dQhRRRR/#)r r.rNr r r )rs"rrrs 2 2Z 2N 2rcx^RIHpHpV!\V44'd \ V4#V!\V44#)aTHE secret mapping for a body owned by *home*: ``launch_secret_scope`` when *home* is this process's own (its env-only keys from docker ``-e`` / systemd ``Environment=`` / ``op run`` have no file to rebuild from), else the profile's own files (``build_profile_secret_scope``). Every per-home binding point (routed gateway turns, cron fires, kanban ticks) builds through here, so the launch profile keeps its env-only credentials when a single-profile gateway starts multiplexing in place.)_is_process_homerQ)rrWrQrrT)r.rWrQs& rowner_secret_scoperXs1PT ##"4(( %d4j 11rcV^8dQhRR/#)r r Iterator[None]r )rs"rrrs ' '^ 'rc#a"^RIHpHp^RIHpV!4oV!V3Rl4pRxV!V4R# T!T4i;i5i)alMark a standalone launch-profile body (a primary-adapter message) at ENTRY. Nothing is bound while single-profile, so its reads keep the process-env semantics they always had; if a second profile switches the gateway to fail-closed mid-body, an unscoped read resolves from ``launch_secret_scope`` (frozen env + ``.env``) instead of raising ``UnscopedSecretError``.)reset_launch_body_scopeset_launch_body_scopeget_process_hermes_homec<\S4#)N)rT)r.srlaunch_body..s *=d*CrN)rr\r]r)r_)r\r]r_tokenr.s @r launch_bodyrds; R8 " $D !"C DE' &&s"A4 A >Ac V^8dQhRRRR/#)r rMrNr rZr )rs"rrrs33j3^3rc#p"^RIHpHp^RIHpHp^RIHpHp\V4pR;p;rV!\V44pV!\V44p V!V\4R7p RxV e V!V 4V e V!V 4Ve V!V4R#R# T e T!T 4T e T!T 4Te T!T4ii;i5i)aBind the launch profile's own runtime scope for one body: HERMES_HOME override naming the launch home, ``launch_secret_scope``, and its terminal policy over the frozen launch ``TERMINAL_*`` overlay. For hosts whose launch-profile bodies are not RPC sessions (the standalone messaging gateway after a hosted room activated multiplexing, #112878). The home override is bound even though the launch home IS the process home: under multiplexing "override unset" is the fail-closed signal for an UNBOUND context (``serves_routed_profile``, plugin runtime bindings such as OMH's ``pre_tool_call`` gate, per-home slots keyed on the override), so a launch-profile turn without it was indistinguishable from no turn at all and every plugin hook it fired saw an unscoped process (#118538). Routed turns already bind theirs (``gateway/run.py::_profile_runtime_scope``); the launch profile is a tenant like any other.)reset_secret_scopeset_secret_scope)reset_hermes_home_overrideset_hermes_home_override)install_profile_terminal_scopereset_terminal_scopeN) env_overlay) rrgrhr)rirjtools.terminal_scoperkrlrstrrTrK) rMrgrhrirjrkrlr. home_token secret_tokenterminal_tokens & rlaunch_profile_runtime_scoperssHUY  D155J5 3-c$i8 '(;D(AB 7J]J_`  %  0  # | ,  ! &z 2 "  %  0  # | ,  ! &z 2 "s)B68B $(B6 'B33B6c~^RIHpV!4'g\P!4#^RIHp\ V!44#)uThe launch profile's own runtime scope once this process multiplexes; ``nullcontext`` before. The single seam for "no routed profile here": under the one-process-per-host ruling the launch profile is a tenant like any other, so a body that used to run with NO scope at all (ambient ``os.environ`` + the process home) must bind the launch profile explicitly — otherwise a secondary's context can have poisoned the ambient state, and a fail-closed ``get_secret`` raises on a perfectly legitimate launch-profile read. Before activation the process env IS the launch profile's, so binding nothing is still correct (and keeps single-profile hosts byte-identical — callers assert the returned object is literally a ``nullcontext``). r5r^)rr6 contextlib nullcontextr)r_rs)r6r_s r#launch_profile_scope_if_multiplexedrws17  %%''8 '(?(A BBrcv"\4;_uu_4R5xRRR4R# +'giR#;i5i)z``async with`` twin of :func:`launch_profile_scope_if_multiplexed` (no I/O of its own: the launch scope is rebuilt from already-hydrated sources, so there is nothing to move off-loop).N)rwr rr)async_launch_profile_scope_if_multiplexedrys! - . .  / . . .s9% 9 6 9)#__conditional_annotations____doc__ __future__rruloggingr threadingpathlibrtypingrrr getLogger__name__r:Lockrr__annotations__rrr1r@rCrKrTrXcontextmanagerrdrsrwasynccontextmanagerry)rzs@rrs"# ++   8 $&* #* "+\OX. 2  ' ' 33@C&  r