mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
unsupportedpastels
c08c485305
The image's root s6 scandir (/run/service) is watched by the PID-1 s6-svscan, so every slot in it runs under a root s6-supervise that executes the slot's run/finish/log scripts as root. 02-reconcile-profiles chowned that directory to hermes so per-profile gateway slots could be registered at runtime, and 015-supervise-perms chowned the static services' supervise/ and event/ trees to hermes. Both handed the unprivileged hermes user control over what the root supervisor runs and writes. - Per-profile gateway slots move to /run/hermes-service, watched by a nested s6-svscan that runs as hermes (new s6-rc longrun profile-gateways). Gateways, their loggers and their supervisors now all run as hermes; the rendered run/log scripts already skip the privilege drop when non-root. - 02-reconcile-profiles creates that scandir hermes-owned (refusing a symlink) and no longer touches /run/service. - 015-supervise-perms keeps the static services' supervise/ trees root-owned and only grants group hermes read on status/lock and write on the control FIFO, leaving event/ as s6 creates it. - hermes doctor probes the static services in the root scandir via a new s6_service_up() helper; S6_DYNAMIC_SCANDIR now points at the gateway scandir and S6_STATIC_SCANDIR names the root one. - Docker integration tests, docs and the s6 skill follow the new gateway slot path.