From edbd7f151cda991ba4e46f8a5921070e95cdb540 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Mon, 28 Sep 2026 01:37:18 -0700
Subject: [PATCH] chore: mark the root-only geteuid read in
 profiles_service_cleanup as a known non-Windows path

remove_system_systemd_unit() is reached only from the Linux arm of
profiles._cleanup_gateway_service; the Windows footgun lint cannot see
the caller's platform branch.
---
 hermes_cli/profiles_service_cleanup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hermes_cli/profiles_service_cleanup.py b/hermes_cli/profiles_service_cleanup.py
index a3a2119f00..ce7c3fd9b8 100644
--- a/hermes_cli/profiles_service_cleanup.py
+++ b/hermes_cli/profiles_service_cleanup.py
@@ -22,7 +22,7 @@ def remove_system_systemd_unit() -> bool:
     unit = gateway._SYSTEM_UNIT_DIR / f"{svc_name}.service"
     if not unit.exists():
         return False
-    if os.geteuid() != 0:
+    if os.geteuid() != 0:  # windows-footgun: ok — called only from the Linux arm of profiles._cleanup_gateway_service
         print(f"⚠ System service {svc_name} remains at {unit}; it will restart the removed profile at boot.")
         print(f"  Remove it with: sudo systemctl disable --now {svc_name} && sudo rm {unit} && sudo systemctl daemon-reload")
         return False