+ Wj{$aRt0tRt^RIt^RIt^RIt^RIHt]!0Rm4t ]^k]!0Rm4t Rt RRlt RRlt ]!43RRlltRR R lltR R ltRR RlltRRltRtRtRRltRRltRRltR#)aListener boundary primitives shared by the dashboard app and the gateway's session listener: Host validation, the auth-gate decision and the native WebSocket ticket subprotocol. Import-light on purpose (no FastAPI): ``gateway.run_api`` serves the native session WebSocket without importing the dashboard app (about 690 routes, ~0.6 s), and must apply the same DNS-rebinding Host check and gate decision. ``hermes_cli.web_server`` and ``hermes_cli.web_server_chat`` re-export these names, so ``web_server.`` keeps working. N)Optionalc:V^8dQhR\\,/#return) frozensetstr)formats"RC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\web_server_boundary.py __annotate__r s F F3 Fc^RIHpV!4pV'd*\PP V4P MRpV'd\VP404#\4# \ dRpL;i;i)zReturn the exact hostname declared by ``dashboard.public_url``. One source of truth for OAuth redirects, Host and WS Origin validation. Malformed or unset values fail closed as an empty set. )resolve_public_urlN) hermes_cli.dashboard_auth.prefixrurllibparseurlparsehostname ValueErrorrlower)r public_urlrs r _dashboard_public_hostsrsj D#%JAK6<<((4==QU-59hnn&' (E)+E sA.+A.. A>=A>c0V^8dQhR\R\/#)r host_headerr)r)r s"r r r -sssr caT;'gRP4oS'dHRS9gA\;QJdV3RlR4F 'gK RM RM!V3RlR44'dR#SPR4'dlSPR4pVR 8XdR#S^VpR V9dR#SV^,R pV'd \P !R V4'gR#VP 4#SPR 4^8dR#R S9dESPR ^4wr$V'dVP4'gR#VP 4#SP 4#) zReturn a normalized hostname from a valid HTTP Host authority. Host headers are authorities, not full URLs. Reject ambiguous ports, malformed IPv6 brackets, and URL syntax so validation always fails closed. z://c3,<"TF qS9xK R#5iN).0cvalues& r (_host_header_hostname..4s)Q>Pu*>Psz "'<> /?#@TF[]:Nz:\d+) stripany startswithfindre fullmatchrcountrsplitisdigit)rclosersuffixportr!s& @r _host_header_hostnamer4-s   B % % 'E EUNcc)Q>P)Qccc)Q>P)Q&Q&Q  3 B;5> h uqyz" ",,w77~~ {{3! e|c1-t||~~~~ ;;=r c^V^8dQhR\R\R\\,R\/#)rr bound_hosttrusted_public_hostsrrrbool)r s"r r r Os4!!!!$C.! !r c\V4pV'gR#W29gVR9dR#VP4pV\9d V\9#W48H#)aPTrue if the Host header targets the interface we bound to. Accepts: - Exact bound host (with or without port suffix) - Loopback aliases when bound to loopback - Exact operator-declared public hosts (with or without port suffix) - Any host when bound to 0.0.0.0 (explicit opt-in to non-loopback, no protection possible at this layer) FT>::0.0.0.0)r4r_LOOPBACK_HOST_VALUES)rr6r7 host_onlybound_lcs&&& r _is_accepted_hostr@OsS&k2I (J:K,K!H((111   r c<V^8dQhR\R\R\/#)rhost allow_publicr)rr9)r s"r r r js!--c--$-r cV\9#)u$True iff the auth gate must be active: any non-loopback bind. RFC1918 / CGNAT / link-local are deliberately PUBLIC — a hostile LAN device is the threat model. ``allow_public`` (legacy ``--insecure``) is accepted for old launch scripts but IGNORED since the June 2026 hermes-0day campaign. r=)rBrCs&&r should_require_authrFjs , ,,r cFV^8dQhR\\,R\/#)rr7r)rrr9)r s"r r r ts"MM9S>MdMr cj\;QJdRV4F 'gK R# R#!RV44#)z[A non-loopback ``dashboard.public_url`` host engages the auth gate even on a loopback bind.c32"TF q\9xK R#5irrE)rhs& r r"+public_hosts_engage_gate..vsL7K!--7KsTF)r))r7s&r public_hosts_engage_gaterLts- 3L7KL33L3L3L7KL LLr ctV^8dQhR\R\\,R\\,R\/#)rrBssh_session_tokenssh_owner_noncer)rrr9)r s"r r r ys8 }c] r cV\9;'dg\PPR4R8H;'d=\ \PPR4;'g T;'gT4#)u True for a Desktop-owned loopback backend (#96490). A non-loopback ``dashboard.public_url`` would otherwise engage the ticket-only gate for the private loopback backends Desktop spawns, whose per-spawn session token the gate's WS path refuses — Desktop could not boot. The public dashboard is a separate non-loopback process that stays gated, so this never opens the public surface. Requires ALL of: loopback bind, ``HERMES_DESKTOP=1``, and an operator-minted credential (env token, SSH session token, or owner nonce). HERMES_DESKTOP1HERMES_DASHBOARD_SESSION_TOKEN)r=osenvirongetr9)rBrNrOs&&&r _desktop_loopback_auth_exemptrWysh %% k k JJNN+ , 3 k k  @AiiEViiZi jr cRV^8dQhR\R\\,R\/#)rrBr7rr8)r s"r r r s*WWWIcNWtWr cv\V4'd \V4#\V4;'g \V4#)zThe ``app.state.auth_required`` value ``web_server._configure_auth_gate(host, False, None, None)`` resolves for a listener with no SSH credentials (the gateway's session listener).)rWrFrL)rBr7s&&r listener_auth_requiredrZs4%T**"4(( t $ V V(@AU(VVr zhermes-gateway-v1zhermes-gateway-ticket.cFV^8dQhR\\\3,/#r)tupler)r s"r r r s 9 9uS#X 9r c\VPPRR4;'gR4pVPR4Uu.uF*q"P 4'gKVP 4NK, ppVUu.uF!q"P \ 4'gKVNK# ppV'gR#\V9g\V4^8wdR#V^,\\ 4RpV'dVR3#R#uupiuupi)zEReturn ``(ticket, reason)`` from an unambiguous gateway protocol set.zsec-websocket-protocolr,Nok)rnone)rinvalid) rheadersrVsplitr(r*"_GATEWAY_WS_TICKET_PROTOCOL_PREFIX_GATEWAY_WS_PROTOCOLlen)wsrawr! protocolsticket_protocolstickets& r #_gateway_ws_ticket_from_subprotocolrls bjjnn5r:@@b AC,/IIcNLN5kkmNIL$^$%(8(89[(\9^ 9,4D0E0J a %G!H!I JF#FD>88M^sC0C09C5C5c:V^8dQhR\\,/#rrr)r s"r r r sMM8C=Mr c|\VRR4'dR#\VRR4;'gRP4P4pV'dV\9dR#VP'dVPP MRpV'gRT;'gR 2#V\9dR#RT R T;'gR 2#) uRejection reason token for the WebSocket peer IP under listener *state* (``auth_required`` / ``bound_host``), or None when allowed. Loopback bind: only loopback peers (the legacy ``?token=`` is the only auth, LAN hosts must not get to guess it); an empty peer fails closed. Explicit non-loopback bind (``--insecure``) or gated mode: any peer — DNS-rebinding is blocked by :func:`ws_host_origin_reason`, and in gated mode ``ws.client.host`` is the X-Forwarded-For value anyway. auth_requiredFNr6rzmissing_or_empty_peer bound=?zpeer_not_loopback peer= bound=)getattrr(r_LOOPBACK_HOSTSclientrB)rgstater6 client_hosts&& r ws_client_reasonrxsuou--%r288b??AGGIJj7$&III"))..2K -j.?.?C-@AAo% $[M9J9Js8K LLr c:V^8dQhR\\,/#rrn)r s"r r r s r c2\VRR4pV'gR#\VR\44pVPPRR4p\ WBV4'gRT;'gR RV 2#VPPR R4pV'gR#\ P PV4pVeVPR 9dR#Ve/VP'd\ VPW#4'g R V RV 2#R# \dRpLbi;i) u``host_mismatch …`` / ``origin_mismatch …`` under listener *state*, or None when allowed. HTTP middleware does not run for WebSocket routes, so the DNS-rebinding Host check is repeated here; an Origin header, when present, must target the bound host. Non-web origins (packaged Electron: file://, null, app://) are trusted — the credential check is the real auth boundary there. r6Nr7rBrzhost_mismatch host=rqrroriginzorigin_mismatch origin=>httphttps) rsrrbrVr@rrrrschemenetloc)rgrvr6r7rr{parseds&& r ws_host_origin_reasonrs d3J "5*@)+N**..,K [6J K K$[%7%7C$8 |LL ZZ^^Hb )F &&v.fmm3DD ~V]]]2CFMMS]2t2t( |DD  sD DDc@V^8dQh/^\9d \;R&#)rr=)__conditional_annotations__r)r s"r r r s"POyO#r > localhost::1 127.0.0.1>r testclientrri)F)NN)r__doc__rTr, urllib.parsertypingrrr=rt _DESKTOP_ATTACHMENT_WS_MAX_BYTESrr4r@rFrLrWrZrerdrlrxrr )rs@r rs  $--N#OOKL$5  F J,5;!6-M ,W+%=" 9M.r