+ Wj7Rt^RIHt^RIHt^RIHt^RIHt^RI H t Rt ]R4t RR /R lt R tR ]!R R04R]!R04R]!R 04R]!R 04R]!R04R]!R 04/tRtRtRtRtRtRtRtRtRtR#)a:Same-user private bootstrap at the existing HTTP authentication boundary. This is not remote/exposure delegation. The daemon captures the actual socket peer before proxy middleware, and the private control channel is the credential issuer. A browser Origin (including an empty one) always disqualifies this path. ) annotations)contextmanager)Path) HTTPException) JSONResponsezx-hermes-gateway-ticketc#"\VPRR4pVfRxR#^RIHpHp\ VR,4pV!\ V44pRxV!V4R# T!T4i;i5i)a&Resolve the request's implicit selectors (omitted / '' / 'current') in the TICKET's home. ``_own_profile`` lets those selectors through unbound; the routes then resolve ``get_hermes_home()`` / ``_default_db_path()``, which is the launch home unless the task-local override says otherwise. A secondary-profile ticket must read and write its own profile, never the launch profile's dashboard state. The launch profile's own ticket binds its home override too, so it never inherits a foreign override that happens to be ambient in the request context. native_http_principalN)reset_hermes_home_overrideset_hermes_home_override profile_id)getattrstatehermes_constantsr r rstr)requestgrantr r hometokens& YC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\native_http.pynative_profile_scopers^ GMM#:D AE } U l# $D $SY /E* "5)"5)sA A+A A+ A((A+currentTc^RIHpVeX\V\4'dDV'd<VP 4'd$VP 4P 4R8XdR#\V\4'g \ R4hV!VP 44P4pT\T48wd \ R4hR# \d\ R4Rhi;i))_resolve_profile_dirNrprofile_scope_mismatch) hermes_cli.web_server_profilesr isinstancerstriplowerPermissionErrorresolverr)valuer rrtargets&&$ r _own_profiler#*sC }E3//G"'++--5;;=3F3F3HI3U eS ! !677B%ekkm4<<>j!!677" B67TABs $CCc"VPPPR4pVPR4'*pVPP R4Fp\ WAVR7K VPPRR4PR^4^,P4P4pV'd6VR8Xg/VPR 4'dbVPR 4'dKVP4GR jxL p\!V\"4'dRV9d\ VR,WR7VPR4'd-VPPR4'g \%R 4hVR 8XdVP&R8wd \%R 4hR #VPR4'dVP)R4p\+W P&4pRRRRRRRR/PV4p V 'dGVPP V 4p V 'g \%R 4hV Fp\ WARR7K R #VR8XdVP&R8XdR #VR9d \%R 4h\ VPR^4^,VRR7VP&R9d \%R 4hR #R #EL \\3dR pELi;i5i)//api/profiles//api/cron/jobsprofilerz content-type;zapplication/jsonz application/z+jsonNr /api/profilesGETsessionssessions/sidebarrecents_profile projects/treesessions/pull-requestsFactive)r&r'z /api/sessionsz/api/fs/downloadz/api/fs/read-data-url>r3import>PATCHDELETE)urlpathrstrip startswith query_paramsgetlistr#headersgetsplitrrendswithjson ValueError UnicodeErrorrdictrmethod removeprefixprofile_collection_route) rr r8rr! content_typebodysuffix collectionaggregate_selectorvaluess && r_check_profile_scoperN:sz ;;   " "3 'D//#PQQG%%--i8U89??&&~r:@@aHKQQSYY[L <+==  # #N 3 3 8M8Mg8V8V  'D dD ! !i4&7 i* F '((1E1E1I1I)1T1T677  >>U "!":; ; # ) * *""#34-dNNC  #57H Y(@)  #j/  ))112DEF%&>??U> 8 #%(?  / /!":; ; c1-a0*e L~~!44&&>??5) +(L) D sdCKK"K:K KKAK K;AKA)K,BKKKKKKr3r-POSTr4r1r.r2r/cVPR4PR4pW PR48XdR#VP4\P VR49dV#R#)zTThe collection suffix ``method path`` serves, or None when the path names a profile.r%r&N)r9rFupperPROFILE_COLLECTION_ROUTESr>)r8rErJs&& rrGrGxsU [[  * *+; `` names, or None for any other route.Nr%r&>r5r6)rEr7r8r9rF)rrJs& r_registry_targetrVsc~~00 [[   $ $S ) 6 67G HF !!((--Vsf} MrTcJ\V4pVPPR4Fp\WARR7K \W1RR7Vf \ R4h^RIHpHpV!V4pV!V4V8Xd0VPR8XdWv!V!448Xg \ R4hR#R#)ahA registry grant renames or deletes exactly the profile it was minted for (#140345). Never the gateway's launch home, which this live process is running in: deleting it or moving its directory pulls the runtime out from under itself. The default root's rename stays allowed, because it only sets a presentation ``display_name`` and never moves the directory. r(Fr)Nr)get_default_hermes_roothermes_home_keyr5) rVr;r<r#rrrXrYrE)rr launch_homer"r!rXrYlaunchs&&& r_check_registry_scoper\sg &F%%--i8U69U3677I [ )Fz"f, NNg %&OD[D]4^*^677+_-rTc^RIHpVPVRRR7pTR ,Y4R ,,8wd \R 4hT# \dwTPR8XdATP P PR4R8XdTPTRRR7pL\T4eTPTRR R7pLhi;i) r)_PURPOSE_CAPABILITIESN native-httpr purposerOr%r,native-profile-createnative-profile-registry capabilitiesrazinvalid native grant) gateway.runtime_bootstrapr^redeemrrEr7r8r9rV)storeticketrr^rs&&& r_redeem_http_ticketris?  Vm L ^ 5I6F GG455 L   >>V # (8(8(?(?(D(WLLDBYLZE g & 2LLDB[L\E  sAAC !CCc^RIHp\VRR4pVe VPMV!V4;'gR.^,pVe VP#R#)rall_authoritiessession_authoritiesN)gateway.session_authoritiesrlr r[r )runnerrlregistryr[s& r _launch_homerqsQ;v4d;H ( 4X__?6;R;\;\W[V\^_:`F & 26  < _native_store..s/]Q\AD=GGQ]]e6G6G%GGQ\s4"4Fserved_profilesretiringr r>::1 127.0.0.1)gateway.drain_controlrsrnrlr appr scoper>lenr=r7r8rzanyr profile_ids) connticketsrsrlro descriptor authoritiespeerr}rgs && @r _native_storers7; TXX^^%5t >6 7D G X5TTAw22~~g&'1 T22)&**..2JDHHMMZZ%-  JNN=$AAs]Q\]sss]Q\]]]~~/0LW5nLWqC)0J)FCKL<<[`[l[lKlCq||VQ\\BK5nn 5= 5ns G5G5-G5 G5cVPP\4pVPPP R4'd \ W4MRpVfR#Twr4^RIHpVPV^,RRR7pVR,\R048wgV!W6R,4fR#VPPR 4Fp\WvR,4K V# \dR#i;i) aZRedeem the ``native-http`` grant a Desktop plugin socket upgrade presents; None when refused. Same issuer, header, peer/Origin and served-profile rules as HTTP: a plugin socket is the live twin of the plugin REST call that already rides this grant on a local gateway. The upgrade's ``profile`` selectors must name the grant's home. Plugin sockets only: ``/api/ws`` and other core streams keep their own purpose-bound credentials. Called once per upgrade, by ``PluginApiWebSocketGate`` ahead of routing, so the grant's profile decides consent and scope before any route dependency or plugin code runs. /api/plugins/Nauthority_for_profile_idr_r`rdz http:ownerr r()r=r<HEADERr7r8r:rrnrrf frozensetr;r#r)rrgaterorgrrr!s& rredeem_native_wsrsll""6*G+/88==+C+CO+T+T= 'Z^D |MFD WQZD- P . !Y ~%> >+F,4GHP&&..y9E l 3 4: L s)AC%/4C%% C43C4cVPPPR4'gR#\VPRR4#)zThe grant :func:`redeem_native_ws` admitted for this plugin socket, or None (refused). Never redeems: the gate already did, once, and bound the grant's home and secret scope for the whole connection. rNr)r7r8r:r r )wss&rauthenticate_native_wsrs4 66;; ! !/ 2 2 2884d ;;rTc^"VPP\4pV'gR#^RIHp\ W4pVf\ RR/RR7#VwrE\WQ^,V4pV!WFR,4f \R4hTR ,R 8Xd\YR,\T44M(TR ,R 8wd\YR,4GRjxL Y`Pn R# \d\ RR/RR7u#i;iL6 \d\ RR /R R7u#i;i5i)zLReturn a rejection or stamp a one-request principal; absent header is inert.Nrdetail Unauthorizedi) status_coder zunserved native grantrarcrbri)r=r<rrnrrrrirr\rqrNr r)rrrrrorgrs& rauthenticate_native_httprs(oo%%f-G D  *D |X~6CHHMFI#E1:w? #F,,? @ H!"9: : IS  8 8 !'+> V@T U 9 !8 8&wl0CD D D+0MM'  IX~6CHHI E SX'?@cRRSslAD-/C+D-*D 0D-1#D D D D-+DD-DD- D D*'D-)D**D-N)__doc__ __future__r contextlibrpathlibrfastapirstarlette.responsesrrrr#rNrrSrGrVr\rirqrrrrrQrTrrs #%!, "**. 8t 8 0@p i((Ivh4GYw'Yw5Gi13EyRWQXGY[8,(=:8<rT