Skip to content

fix: managed mode PID detection and cron permissions#9385

Open
lvnilesh wants to merge 1 commit into
NousResearch:mainfrom
lvnilesh:fix/managed-mode-permissions
Open

fix: managed mode PID detection and cron permissions#9385
lvnilesh wants to merge 1 commit into
NousResearch:mainfrom
lvnilesh:fix/managed-mode-permissions

Conversation

@lvnilesh

Copy link
Copy Markdown
Contributor

Summary

Fixes three issues when running hermes-agent under NixOS systemd managed mode (HERMES_MANAGED=true):

  • Dashboard shows "gateway not running": get_status() in web_server.py only checks gateway.pid, which the managed gateway never writes. Added fallback to gateway_state.json with /proc/{pid} validation so the dashboard correctly reflects gateway status under systemd.

  • Cron directories reset to 0700: _secure_dir() in cron/jobs.py hardcodes chmod 0700 on every startup, overriding the NixOS module's 2770 (setgid + group-accessible). Now respects HERMES_MANAGED env var and uses 2770 in managed mode.

  • Cron files reset to 0600: _secure_file() in cron/jobs.py similarly hardcodes 0600, breaking group-readable access needed by the service user. Now uses 0640 in managed mode.

Note on .env permissions: The .env file permissions (Fix 3 in #9383) are already handled correctly — save_env_value() returns early in managed mode, and _secure_file() in config.py already has a managed-mode guard. No additional changes needed there.

Fixes #9383

Files changed

  • hermes_cli/web_server.pyget_status(): fall back to read_runtime_status() when get_running_pid() returns None
  • cron/jobs.py_secure_dir() and _secure_file(): use group-accessible permissions when HERMES_MANAGED=true

Test plan

  • Verify get_status() returns gateway_running: true when gateway is running under systemd (no gateway.pid file, but gateway_state.json has "gateway_state": "running")
  • Verify cron directories retain 2770 permissions after ensure_dirs() runs in managed mode
  • Verify cron files retain 0640 permissions after _secure_file() runs in managed mode
  • Verify non-managed (standalone) mode still uses 0700/0600 as before

🤖 Generated with Claude Code

1. web_server.py: Fall back to gateway_state.json when gateway.pid is
   not written (managed gateway writes state JSON, not PID file), so
   the dashboard correctly shows gateway status under systemd.

2. cron/jobs.py: Respect HERMES_MANAGED env var in _secure_dir() and
   _secure_file() — use group-accessible 2770/0640 instead of
   owner-only 0700/0600, matching the NixOS module's activation script.

Fixes NousResearch#9383

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings April 14, 2026 04:28

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@houko houko left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good fix — 0o2770/0o640 permissions for managed mode and fallback PID detection from gateway_state.json are both important improvements. 👍

@alt-glitch alt-glitch added type/bug Something isn't working P2 Medium — degraded but workaround exists area/nix Nix flake, NixOS module, container packaging comp/cron Cron scheduler and job management comp/gateway Gateway runner, session dispatch, delivery labels Apr 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/nix Nix flake, NixOS module, container packaging comp/cron Cron scheduler and job management comp/gateway Gateway runner, session dispatch, delivery P2 Medium — degraded but workaround exists type/bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Managed mode: gateway hardcodes restrictive permissions, breaks dashboard for group members

4 participants