fix: restore hermes ownership after runtime sync

Author: bussyjd

internal/hermes/hermes.go

@@ -1063,7 +1063,8 @@ func generateValues(namespace, hostname, dashboardHostname, agentBaseURL, token,
 
 func syncRuntimeFiles(cfg *config.Config, id string, configData []byte, u *ui.UI) error {
 	targetDir := agentruntime.HomePath(cfg, agentruntime.Hermes, id)
-	ensureVolumeWritable(cfg, targetDir, u)
+	ensureVolumeWritableFn(cfg, targetDir, u)
+	defer fixRuntimeVolumeOwnershipFn(cfg, targetDir, u)
 	if err := os.MkdirAll(targetDir, 0o755); err != nil {
 		return fmt.Errorf("failed to create Hermes home %s: %w", targetDir, err)
 	}

internal/tunnel/status_test.go

@@ -37,6 +37,45 @@ func TestHumanTunnelMode(t *testing.T) {
 	}
 }
 
+func TestDefaultPersistentConnectorStatus(t *testing.T) {
+	cases := []struct {
+		name string
+		st   *tunnelState
+		want string
+	}{
+		{
+			name: "remote managed",
+			st: &tunnelState{
+				ExposureMode:   tunnelExposurePersistent,
+				ManagementMode: tunnelManagementRemote,
+				Hostname:       "stack.example.com",
+			},
+			want: "not_probed",
+		},
+		{
+			name: "local managed",
+			st: &tunnelState{
+				ExposureMode:   tunnelExposurePersistent,
+				ManagementMode: tunnelManagementLocal,
+				Hostname:       "stack.example.com",
+			},
+			want: "managed-locally",
+		},
+		{
+			name: "quick tunnel",
+			st:   &tunnelState{ExposureMode: tunnelExposureQuick},
+			want: "",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := defaultPersistentConnectorStatus(tc.st); got != tc.want {
+				t.Fatalf("defaultPersistentConnectorStatus() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
 func TestParseCloudflaredMetrics(t *testing.T) {
 	metrics := `# HELP cloudflared_tunnel_total_requests Amount of requests
 cloudflared_tunnel_total_requests 42

internal/tunnel/tunnel.go

@@ -212,7 +212,7 @@ func Status(cfg *config.Config, u *ui.UI, opts StatusOptions) error {
 		}
 	}
 	if result.ConnectorStatus == "" && st != nil && st.IsPersistent() {
-		result.ConnectorStatus = "managed-locally"
+		result.ConnectorStatus = defaultPersistentConnectorStatus(st)
 	}
 
 	// Public reachability probe: GET the public URL root and assert HTTP < 400.
@@ -270,6 +270,16 @@ func summarizeTunnelStatus(result tunnelStatusResult) string {
 	return "active"
 }
 
+func defaultPersistentConnectorStatus(st *tunnelState) string {
+	if st == nil || !st.IsPersistent() {
+		return ""
+	}
+	if st.Management() == tunnelManagementRemote {
+		return "not_probed"
+	}
+	return "managed-locally"
+}
+
 // InjectBaseURL sets AGENT_BASE_URL on the default Hermes deployment so that
 // monetize.py uses the tunnel URL in registration JSON.
 func InjectBaseURL(cfg *config.Config, tunnelURL string) error {