߲johUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlmZddlmZddlmZddlmZmZddlmZmZmZmZmZmZm Z m!Z!m"Z"ddl#m$Z%m&Z'm(Z)m*Z+m,Z-dd l.m/Z/dd l0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mm?Z?m@Z@mAZAmBZBmCZCmDZDmEZEdd lFmGZGmHZHmIZIdd lJmKZKddlLmMZMmNZNddlOmPZPddlQmRZRddlSmTZTddlUmVZVddl.ZWddlXZYddlZm[Z[ddl\m]Z]m^Z^m_Z_m`Z`maZambZbmcZcmdZdmeZemfZfmgZgmhZhmiZiddljmkZkddllmmZmddlnmoZompZpmqZqmrZrddlsmtZtmuZumvZvddlwmxZxddlymzZzddl{m|Z|ddl}m~Z~ddlmZddlmZ ddlZej eZdZefd ed!ed"efd#Zd"efd$Zd"efd%ZGd&d'eZGd(d)eZd*ed"efd+Zed,d-hZe!d.Zed/z xZZd0Zd1\ZZd"efd2Zd3Zd4Ze ed5fed6<d7ed"dfd8Zd3d9d7ed:ed"dfd;ZdZd?eeeefd"eeeeffd@Ze jHdAZd=eeefd"efdBZd?eeeefd"eeeeffdCZdDZdEZdFZdGZ dd3dHdIedJed"efdKZeZeeedL<e j^ZdMZe jddNk(Zd"efdOZdPed"dQfdRZd7ed"ee eeffdSZGdTdUeKeMeeVePeRee~e|ezexekemeTZGdVdWZddXlmZddlZddlZddlZddlZdZdZidYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzid{d|d}d~ddddddddddddddddddddddddddddddddddddddddddd ZdZy#e$rdZY#wxYw)a-SQLite state store for Hermes Agent: session metadata, message history, model config, FTS5 search. WAL mode (concurrent readers + one writer); compression splits sessions via parent_session_id chains; sessions are source-tagged ('cli', 'telegram', ...). Batch-runner / RL trajectories live elsewhere. N)deque)contextmanager)Path)get_hermes_homemkdir_under_hermes_home) AnyCallableDictIteratorListOptionalTupleTypeVarcast)TITLE_SOURCE_DERIVEDTITLE_SOURCE_LLMTITLE_SOURCE_USER escape_likestat_db_file_identity)read_only_db_uri) _DELETED_WAL_GENERATION_MSG_DISK_IO_ERROR_MARKER_STATE_DB_CORRUPT_MSG_STATE_DB_GENERATION_KEY_STATE_DB_REPLACED_MSGDeletedWalGenerationError!SessionCompressionInProgressErrorStateDbCorruptErrorStateDbReplacedError_is_no_more_rowsclassify_persistence_erroris_malformed_db_erroris_malformed_schema_error)_STATE_DB_GUARD_BYPASS_ENV_in_test_context_is_production_state_db_real_platform_state_root_register_test_instance_set_last_init_errorget_last_init_error)_READ_POOL_MAX_proc_fd_targets_read_budget_for)SessionSessionsMixin)SessionFtsSetupMixinload_fts5_cjk_extension)SessionPortabilityMixin)SessionTelegramTopicsMixin)SessionProfileRepairMixin)SessionSchemaMixin)log_write_lock_holders) _connect_tracked_db_fd_is_truly_unlinked_prepare_connection_retirement_read_sqlite_application_id_stat_sqlite_sidecar_identity_watched_sqlite_sidecar_paths!has_invalid_sqlite_header_preopenis_zeroed_state_dbquarantine_cross_process_lockquarantine_invalid_state_dbRetiredGenerationCaptureErrorcapture_retired_wal_generationrefuse_deleted_wal_generation)SessionMessagesMixin)SessionRewindMixin)_WAL_INCOMPAT_MARKERS_on_disk_journal_modeapply_database_pragmasapply_wal_with_fallback)_claim_repair_attemptpreflight_db_writabilityrepair_state_db_schema)SessionTitlesMixin)SessionUsageMixin)SessionMaintenanceMixin)SessionGatewayMixin)SessionCompressionMixin)SessionSearchMixini Nkeyfallbackreturnc ddlm}|jdxsij|}||St|}|dk\r|S|S#t$r|cYSwxYw)za``sessions.`` from config.yaml (lazy import: circular at load), else *fallback*; 0 disables.r)load_config_readonlysessions)hermes_cli.configrVgetint Exception)rRrSrVvaluelimits 1/home/ubuntu/.hermes/hermes-agent/hermes_state.py_configured_transcript_limitr_Vse:%'++J7=2BB3G =OE  u00 s2A A A AActdS)Nmax_resume_messagesr_r^resolved_max_resume_messagesrec '(= >>rdctdS)Nmax_export_messagesrbrcrdr^resolved_max_export_messagesrigrfrdc2eZdZedfdededeffd ZxZS)SessionResumeTooLargeErrorzacross its lineage message_countr]scopec^||c|_|_||_t|d|d|dy)Nz+This session is too long to reload safely (z messages; limit z). Start a fresh chat and use `hermes sessions export` to keep a copy, or raise the limit with `hermes config set sessions.max_resume_messages 0`.)rlr]rmsuper__init__)selfrlr]rm __class__s r^rpz#SessionResumeTooLargeError.__init__lsG*7&DJ  9-HYZ_Y`aG G rd)__name__ __module__ __qualname___MAX_SAFE_MESSAGESrZstrrp __classcell__rrs@r^rkrkks+/APd     ),  JM   rdrkc0eZdZefdededeffd ZxZS)SessionExportTooLargeError session_idrlr]cb|||c|_|_|_t|d|d|d|y)Nz session 'z' has at least z1 active messages; safe in-memory export limit is )r|rlr]rorp)rqr|rlr]rrs r^rpz#SessionExportTooLargeError.__init__ysE:DmUZ7+TZ  |?=/B..3W 6 rd)rsrtrurvrwrZrprxrys@r^r{r{xs%I[ 3 s 3  rdr{holderctjd|xsd}|rt|jdnd}|dks|t j k(ryt  t j| Stjdk(ry t j|dy#t$rYywxYw#t$rYyttf$rYywxYw)a.True only when a ``pid=`` lock holder's local PID is provably gone. Reclaim on kernel proof only: unstructured/same-process holders (another thread's live lease) and any probe doubt keep the lease until TTL expiry (PID reuse must never steal a live lease; a wrongly-kept one self-heals).z(?:^|:)pid=(\d+)(?::|$)rFntT)researchrZgrouposgetpidpsutil pid_existsr[namekillProcessLookupErrorOSError OverflowError)r~matchpids r^(_compression_lock_holder_process_is_deadrs II0&,B ?E!&#ekk!n AC ax3"))+%  ((-- -  ww$ Q     ] #s*BB. B+*B+. C 9C  C autocustomTstate.dbN@)g?cBttk7rtStdz S)zDefault state DB path at CALL time: a re-pointed ``DEFAULT_DB_PATH`` wins, else ``get_hermes_home()`` is resolved fresh (a runtime HERMES_HOME redirect works regardless of import).r)DEFAULT_DB_PATH_IMPORT_DEFAULT_DB_PATHrrcrdr^_default_db_pathrs .1HH?loN_blNllrdFrc. _STATE_DB_GUARD_EXTRA_DENY_ROOTSdb_pathc ts-tjjts t sy t |jj}tfDcgc]}|| }}tD]9} |jt |jj;|D]'}t||std|d|dtdy#t$rYywxYwcc}w#t$rYwxYw)aLRaise before any connection/mkdir/pragma/byte probe when a pytest-context process (env OR ancestry) resolves a production DB. Env alone is not enough: a child spawned with a rebuilt environment loses ``PYTEST_*`` and ``HERMES_HOME`` together, which is precisely the state in which it writes to production (#82770). NzAlive-system guard: test attempted to open production state.db at z (under real Hermes root u). Tests must run against a temporary HERMES_HOME — pass an explicit tmp db_path or let the hermetic conftest redirect HERMES_HOME. If this test genuinely needs the live database, mark it with @pytest.mark.live_system_guard_bypass — or, for a spawned child process, export z=1 in its environment.)_STATE_DB_GUARD_BYPASSrenvironrYr$r%r expanduserresolver[r'rappendr& RuntimeError)rresolvedrrootsextraroots r^_ensure_test_isolationrs0J!KScSe=++-557346 H1!-Q HE H1  LLe//199; <   "8T 2'j(A$H) *D(DE# #     H   s/'C'*C62C66C;' C32C3; DD create_mainrc*tjdk(ry|}|rtjtjztjz}t tdr|tj z}t tdr|tjz} tj||d}tj|||j|jdz|j|jdzfD]n} tj|}tj |j"r9tj$|j"sYtj&|dpy#t$rYt$rYywxYw#t$rYwxYw)u4Create/tighten a writable state database and its sidecars to 0600. SQLite otherwise creates ``state.db``, ``-wal``, and ``-shm`` according to the process umask (commonly 0644 under 0022). Read-only SessionDB attachments never call this helper and remain observational. Existing files are tightened with ``chmod(2)`` on the path: opening the file and closing that descriptor would drop every POSIX ``fcntl`` lock the process holds on its inode — including the locks of an already-open SQLite connection to the same database. A lock-losing close in one process lets a sibling's connection take the shared-memory DMS exclusively at its own close, checkpoint, and unlink the sidecars while long-lived holders (gateway, desktop ``hermes serve``) keep using the deleted inodes. rN O_NOFOLLOW O_CLOEXECiz-walz-shm)rrO_WRONLYO_CREATO_EXCLhasattrrropencloseFileExistsErrorIsADirectoryError with_namelstatFileNotFoundErrorstatS_ISLNKst_modeS_ISREGchmod)rr main_pathflagsfdpathsts r^_secure_state_db_filesrsK ww$I bjj(2994 2| $ R]] "E 2{ # R\\ !E E51B HHRL ',,/0',,/0 $B << # ||BJJ'  u%      $!   s*E-?F- F8FF FF)z:Review the conversation above and update the skill libraryz;Review the conversation above and consider saving to memorymsgct|tr|jddvry|jd}t|txr#|j j t S)zPersisted harness prompt (older builds wrote the forked curator's turns into real sessions; replaying them hijacks the session).role>usersystemFcontent) isinstancedictrYrwlstrip startswith_REVIEW_HARNESS_PREFIXESrrs r^%_is_background_review_harness_messager$sT c4 CGGFO;M$Mggi G gs # ](8(C(CD\(]]rdmessagesc|s|Sg}d}d}|D]Q}t|r| }d}|r)d}t|tr|jddk(rd}?d}|j |S|S)zZDrop harness messages and the curator-mode assistant reply that immediately followed each.FTr assistant)rrrrYr)routskip_next_assistantprevious_was_harnessrs r^ _strip_background_review_harnessr-s  "C   0 5';": #'  "' #t$K)G',$$ 3  Jrdz^\[[A-Za-z_][A-Za-z0-9_.-]*\]$c t|tr%|jddk7s|jdsy|jd}t|txr,t t j |jS)zAssistant tool-call turn whose content is a bare ``[marker]`` (an older conversation_loop persisted a local template's marker as the final response).rr tool_callsFr)rrrYrwbool_STALE_TOOL_CALL_MARKER_RE fullmatchstriprs r^"_is_stale_tool_call_marker_messagerIsg c4 CGGFO{$B#''R^J_ggi G gs # c-G-Q-QRYR_R_Ra-b(ccrdcxd}tt|D] }d|d<|dz }|rtjd||S)zBlank stale ``[marker]`` assistant content (replaying it teaches the model to keep emitting it); tool_call/result pairing stays intact.rrrrzMCleared %d stale tool-call marker message(s) while restoring session (#78148))filterrloggerinfo)rrepairedrs r^_strip_stale_tool_call_markersrRsPH8(CIA  []e  Ordz/Sessions will not be saved until this is fixed.zC If the database lives on a network drive, move it to a local disk.zUthe session database could not be opened; it may be on a network or unsupported drivezbMove it to a local disk (`hermes {profile_arg}doctor` shows where it is), then start Hermes again.)detailsprefixrc ddlm}|}t s|dtd|dSddlm}| }|j |jd}}}t fdtDr2|jd k(rttjd |}}nt}|d |dtd ||} |rdd lm} | d| z } | S)uSUser-facing one-liner: ``: . [ network hint]``. The cause table lives in ``hermes_state_user_copy`` so CLI, gateway and TUI agree. Chat surfaces (gateway, TUI) get the one-liner; ``details=True`` (the CLI banner) appends a ``Details: `` line for the raw SQLite text. Network filesystems (NFS/SMB/FUSE/ZFS) cannot host SQLite's write-ahead log: when the raw cause carries one of those markers the message names the network-drive suspicion, because ``hermes doctor --fix`` cannot repair a mount — only moving the file can.r)profile_cli_selectorz. z Run `hermes z&doctor` to check the storage location.)describe_storage_failurerc3BK|]}|jvywN)lower).0mcauses r^ z0format_session_db_unavailable..s =!1  =sunknownz {profile_arg}:  )storage_failure_detailsz Details: )hermes_constantsrr*_SESSION_DB_CONSEQUENCEhermes_state_user_copyrglossactionanyrEr_NETWORK_DRIVE_GLOSS_NETWORK_DRIVE_ACTIONreplace_NETWORK_DRIVE_HINTr) rrr profile_argrfailurerrhinttextrrs @r^format_session_db_unavailablerhs6&(K  !E hb01{mL   @&u-G!--46E ='< == ==I %02G2O2OP_al2m6E&DXRwb!8 96(4& IDB +5e<=>> Krd_repair_attempted_pathsg^@win32c`ttddduxrttjdS)z`Whether this runtime can switch off SQLite's close-time checkpoint (Python 3.12+ ``setconfig``). SQLITE_DBCONFIG_NO_CKPT_ON_CLOSEN setconfig)getattrsqlite3r Connectionrcrdr^#_close_time_checkpoint_configurablers. G? Fd R 9**K8:rdr|zOptional[Path]c t|xsdj}|r|sytdz }|jdd||dz }|j dd 5}|D]R}|t |t r|n d t|i}|jtj|d t d zT ddd|S#1swY|SxYw)zAppend pending messages to HERMES_HOME/sessions/.jsonl (state.db was replaced under a live process). Returns the path, or None if nothing to write.rNrWT)parentsexist_okz.jsonlautf-8)encodingrF) ensure_asciidefault ) rwrrmkdirrrrwritejsondumps)r|rsid sessions_dirrhandlerrecords r^divert_session_transcript_jsonlr s jB  % % 'C h"$z1Ltd3 SE. (D 3 )YV YC *3 5Is3x;P TZZUCPSWWX YY K Y KsC'ACC c,tj|S)z5Compatibility delegate to the state-holder authority.)_state_holdersforeign_state_db_holders)rs r^_foreign_state_db_holdersr$s  2 27 ;;rdc NeZdZUdZdZeedfed<d\ZZ Z dZ d\Z Z dZd \ZZd Zd \ZZZd \ZZZd \ZZdZedeedeefdZedjdZedej@de!ee"ffdZ#edeejHddfdZ%deddfdZ&dkde'de(fdZ)djdZ*djdZ+d e,dejHfd!Z-dld"e(ddfd#Z.dejHfd$Z/djd%Z0djd&Z1deejHfd'Z2de(fd(Z3djd)Z4deejHfd*Z5e6de7ejHfd+Z8dmd,eddfd-Z9 dnd.e:ejHge;fd/ee,de;fd0Z< doddd1d2ed3e"d4e(d/ee,ddf d5Z=dodd6d2ed3e"d/ee,de>fd7Z?dod2ed3e"deej@fd8Z@dod2ed3e"deAej@fd9ZBd.e:ejHge;fde;fd:ZCdjd;ZDdjd<ZEde(fd=ZFde(fd>ZGdjd?ZHd@ede'fdAZIdjdBZJeKdCeLde(fdDZMdpdEeddFfdGZNdCeLddfdHZOde(fdIZPdjdJZQde(fdKZRdjdLZSdMe,d/e,de(fdNZTdeAee>effdOZUdeefdPZVdjdQZWdqdRZXde(fdSZYdTZZdjdUZ[dVZ\dWZ]dXZ^dYZ_e`ZaebZcedZeeadZecd[eed\iZfd]Zgd^Zhd_Zid`ZjdaedeefdbZkddcdaeddedeeejddfdfZmdgede>fdhZndEedeAeeeffdiZoy)r SessionDBzVSQLite-backed session storage with FTS5 search; many reader threads, one writer (WAL).)clicronkanbanacp api_serversubagenttool recovered._AUTO_PRUNE_STALE_OPEN_SOURCES)g4@rg?@)g{Gz?g333333?g@)g??2)i)r3i'iP)iPig>@ system_promptrTc|ytj|jdj}|j d||f|S)NrzAINSERT OR IGNORE INTO system_prompts (hash, prompt) VALUES (?, ?))hashlibsha256encode hexdigestexecute)connr5 prompt_hashs r^_store_system_promptzSessionDB._store_system_promptsL  nn]%9%9'%BCMMO  O - ( rdNc&|jdy)Nz|DELETE FROM system_prompts WHERE NOT EXISTS (SELECT 1 FROM sessions WHERE sessions.system_prompt_hash = system_prompts.hash))r;r<s r^#_delete_unreferenced_system_promptsz-SessionDB._delete_unreferenced_system_promptss  ^ rdrowcXt|}d|vr|jd}d|vr||d<|S)N_system_prompt_resolvedr5)rpop)rBdatars r^_session_row_dictzSessionDB._session_row_dicts9Cy $ ,xx 9:H$&(0_% rdr<cx|y |jy#t$rtjddYywxYw)zCClose a partially initialized connection without masking its error.Nz&Could not close a SessionDB connectionTexc_info)rr[rdebugr@s r^_close_connection_quietlyz#SessionDB._close_connection_quietlys= <  R JJL R LLADL Q Rs  99labelc |jy#t$r,}tjd||j|Yd}~yd}~wwxYw)zUClose *conn*; a failing close leaks a tracked fd: logged at WARNING, never swallowed.z%s close failed for %s: %sN)rr[rwarningr)rqr<rMexcs r^_close_conn_loggedzSessionDB._close_conn_loggeds= S JJL S NN7 c R R Ss A"AAFr read_onlyc|xs t|_t|j||_d|_d} t j d}|jjddd|jjd|j|_~tj|_t!j"t$|_t)|j|_|j*j,|_tj|_d|_d |_d \|_|_d|_d |_i|_dx|_ |_!d|_"tj|_#d|_$d|_%i|_&d \|_'|_(d|_)dx|_*x|_+|_,dx|_-x|_.|_/d|_0tc|_2tjftj|_4d|_5dx|_6|_7d|_8d|_9d} |r|jun)twsty|_$|j{|j}d } |s&|j`dc}|_0|j|y|j*j|t|y#t$rYNwxYw#~wxYw#t$r)}tt|jd|d}~wwxYw#|s&|j`dc}|_0|j|w|j*j|t|wxYw)Nrrrs?.:)maxsizeFg)Frr)FrTr)ErrrrR_creation_sitesys _getframe f_globalsrYf_codeco_namef_linenor[ threadingLock_lockqueue LifoQueuer+ _read_poolr- _read_budgetpermits _read_permits_read_conns_lock_read_conns_closed_read_open_failed_at _wal_active _write_count_db_file_identity_db_file_application_id_db_sidecar_identity _db_replaced_db_wal_generation_lost_retired_generation_capture_retired_capture_lock_retire_connection_connection_pinned_wal_lock_guard _db_corrupt_db_corrupt_reason_fts_usermerge_floor_applied _fts_enabled _fts_stale_trigram_available_fts_cjk_loaded_fts_cjk_available_fts_unavailable_warned_connr _token_queue Condition_token_queue_cond_token_writer_thread_token_writer_stop_token_writer_busy_token_atexit_hook_shared_registry_owned_open_read_onlyrr8 _open_writer_record_db_file_identityr)typersrLregisterr()rqrrRcallerinitialization_completerPr<s r^rpzSessionDB.__init__s(4"2"4 t||,"' ]]1%F##'' C896==;P;P:QQRSYSbSbRcd   ^^% BGYgAh-T\\:!..66 ) 0#(%(!.6+$+37,-$68!;@@D8;?(%.^^%5"CG"'%'4=1$1,1)HMMMDOd.EY^]]t69U #(7!*!4!4Y^^5E!F@D!rrO_handle_quarantine_if_invalid$_connect_and_init_with_lock_patiencer  DatabaseErrorr#rIerrorrLrrKrY_ensure_db_file_generationrk _lockguardholdrv)rq lock_acquiredrPs r^rzSessionDB._open_writerzs  3 34 ! C 8<<&&(,Mdll,[24<<@@M(_ LL66m6T==?@@22%2H99; '')   $.??4<<#@D 5@@$$ 8-S19Nt||9\ LL89<   * *4:: 6)$,,7;;JG  5 5 7 7 8s2AD:` (terminal `hermes` chat only).) rrr<rst_sizerr?rrr)r r)rqrzsizeqpathwherers r^rz'SessionDB._handle_quarantine_if_invalids ##%*KDLL*Y  LL%%'//E,DLLX-2/%)8e-eW4I%Q1161F$,,0GHj j  SS! =T\\0027XY]YeYe7f'', ,8g2= E s$C99 DDctt|jddd} tj|_t |d}|dk(xrt|dk(|_t|jt|d|jdt||_ |S#t$r|j|wxYw) zConnect + WAL/pragma/tokenizer setup for a writer connection (no schema init). Short timeout: jittered application-level retry handles contention, not SQLite's busy handler; isolation_level=None: explicit BEGIN IMMEDIATE.Fr1N)rrrrrwalzPRAGMA foreign_keys=ON)r6rwrr rrrHrFrkrrGr;r0r}rrL)rqr<modes r^_open_writer_connzSessionDB._open_writer_conns#  UY  &{{D *4*ED $u}U1Ft1LPU1UD  #4<< 0 "4* = LL1 2#:4#@D     * *4 0  s A?B%%Cct|jt|jd|j|_|j y)NTr)rBrrrr _init_schemarqs r^_connect_and_initzSessionDB._connect_and_inits< &dll3 t||>++-  rdc Htj|jz} |jy#tj $r}t |j}d|vrd|vr|j|jtj}||k\r!t|j|jtj|j|j}tj t#|t%||z dYd}~nd}~wwxYw)a/Open + init, waiting out a sibling's write lock with jittered patience: _init_schema's DDL runs on a 1s-timeout connection, so a sibling's VACUUM or checkpoint used to fail the ENTIRE open and callers disabled persistence for the whole run. Non-lock errors propagate immediately.NlockedbusyMbP?)r monotonic_WRITE_PATIENCE_Srr rrwrrLrr5rrandomuniform_WRITE_RETRY_SLOW_MIN_S_WRITE_RETRY_SLOW_MAX_Srminmax)rqdeadlinerPerrnowjitters r^rz.SessionDB._connect_and_init_with_lock_patience s>>#d&<&<< D&&(++ D#hnn&3&6+<..tzz:nn&(?*4<<9O9OP(D(DdFbFbc 3vs8c>5'ABCC D s5DC DDct|jr |jry|j5|j}|xrt j |z t k}|js|r dddy ddd|jj|s&tjdt|jyd} |jd}t|d|j r t#||S#1swYxYw#t$$r}||j'|d|jj)t+|t,j.s|j5t j |_dddn #1swYnxYwtjd|jd Yd}~yd}~wwxYw) aOpen a fresh read-only connection, or None when unavailable (callers return it to self._read_pool). WAL only: WAL readers never block on the writer, so reads skip self._lock; under DELETE journal mode (NFS fallback) readers hit SQLITE_BUSY storms, so the legacy locked path stays. Autocommit reads see everything committed so far (read-your-writes for flush-then-search).NzVread pool at capacity (%d) for %s; serving this read from the locked writer connectionr0rrrzpartially-opened read connz'read-only connection open failed for %sTrI)rkrRrhrjrr_READ_OPEN_RETRY_SECONDSrireacquirerrKr+rrrGr}r0rrQreleaserr Error)rq failed_at backing_offr<rPs r^_get_read_connzSessionDB._get_read_conn)s 4>>  " " 11I#_(89(DG_(_K&&+   +6    ((. LL+,:DLL  **3*7D "4* =##'- ?  $ ''.JK    % % 'c7==1&& =,0NN,<) = = = LLBDLL[_L ` s<>C2:6C>2C;> F7AF2E?6 F2?F )F22F7c |jj}|j |y#tj$rYywxYw)z^Close one idle pooled connection (a peer on the same file wants its permit); never a live one.FT)rd get_nowaitrbEmpty_close_read_connrqr<s r^_evict_one_idle_read_connz#SessionDB._evict_one_idle_read_connRsD ??--/D d#{{  s.AAc |j|d|jjy#|jjwxYw)zClose a pooled read connection and release its permit even when the close fails (withholding it would narrow the read path forever). Over-releasing the BoundedSemaphore raises ValueError.z read-connN)rQrerrs r^rzSessionDB._close_read_conn[s< (  # #D+ 6    % % 'D   % % 's /A c|jr |jry |jjS#tj $r|j cYSwxYw)zBorrow a read connection, opening on a miss; None when the read path is unavailable. A pool hit costs no permit (the connection already holds one).N)rkrRrdrrbrrrs r^_checkout_read_connzSessionDB._checkout_read_conncsP4>> )??--/ /{{ )&&( ( )s5#AAc#K|j}|Z |d}|j5|js |jj |d}ddd|s|j|y|j5|j|jdttj|jdddy#t j $rYwxYw#1swYxYw#d}|j5|js8 |jj |d}n#t j $rYnwxYwdddn #1swYnxYw|s|j|wwxYw#1swYyxYww)u&Yield a connection for read-only statements: a pooled read-only connection with NO lock under WAL; otherwise (non-WAL, open failure, ceiling reached) the writer connection under self._lock — deliberate degradation: slower beats EMFILE, which the supervisor cannot see.NFTreadcontext)rrhrird put_nowaitrbFullrrar_reopen_after_close_lockedrr r )rqr<returneds r^ _read_ctxzSessionDB._read_ctxmsk '')   0  **!22! OO66t<'+H ! ))$/  ZZ 7zz!///?w))4::6 6 7 7 %zz! ! !!!**!22! OO66t<'+H$zz! ! !!! ))$/  7 7sE;C.E; C"C (E;;AE/ E; CC"CC""C+'E;.E,= E  D)(E )D? <E >D? ?E  E, E E,,E;/E84E;rcF|jr&tjd|jd|d|jr>|j s2|j s"|jd|jd|d|jtjd|j| |j|_ |jr%t!j"|j|_y y #t$r!}tjd|d ||d }~wwxYw) aCReopen the writer after ``close()`` raced a live caller (a teardown owner set ``_conn = None`` while a worker still had a transcript flush to land). Loud (WARNING) and bounded (only after an explicit close()). Caller holds ``self._lock``. No _init_schema: no DDL races with siblings during teardown.zSessionDB for z/ was closed (read-only handle); cannot serve a z after close()zstate.db connection for zF is quarantined after structural corruption; refusing to reopen for a z after close(). uqstate.db connection for %s was closed while a %s was still in flight — reopening (teardown/worker race, #94736)z'state.db connection was closed while a u was still in flight (a session-teardown path called close() before this worker finished — #94736) and the automatic reopen failed: N)rRr ProgrammingErrorrrwrp_db_file_was_replaced_corrupt_error_halt_if_db_generation_changedrrOrrr[rrkrrrv)rqrrPs r^rz$SessionDB._reopen_after_close_lockeds4 >>** /"").:    T%6%6$:T:T:V%%*4<<.9CCJ)L""  ++- BCG<| vr|s|s|j+||rd}Yd}~t7|t,j@rd| vstC|s|jE|r2|j5|j dddn #1swYnxYw|jG|rYd}~|jI|r|jK|d}~wwxYw)uRun *fn(conn)* inside BEGIN IMMEDIATE with jittered lock retry; commit is handled here (callers must not commit). Returns *fn*'s result. BEGIN IMMEDIATE takes the WAL write lock up front so contention surfaces immediately; on locked/busy the Python lock is released, a jitter slept, and the WHOLE callback retried — *fn* must stay idempotent under retry.NFTrrzBEGIN IMMEDIATErrrrzQdatabase is locked (another Hermes process held the state.db write lock for over z.0fus — likely a long maintenance operation such as VACUUM, a large WAL checkpoint, or an older pre-update process; the database itself is healthy)znot a database)&rrr_raise_if_db_corruptra_raise_if_db_replacedrrr;commitrrollbackr[rl_CHECKPOINT_EVERY_N_WRITES_try_wal_checkpoint_FTS_MERGE_EVERY_N_WRITES_try_incremental_merge_ftsrr_COMPRESSION_BUSY_WAIT_S_sleep_before_write_retryr rr rwrrrr5rrrr"_is_fts_write_corruption_error_enter_fts_fail_open_is_structural_corruption_error_halt_db_corrupt) rqrrrcompression_deadlineioerr_begin_retried fn_startedresultrPerr_msgs r^_execute_writezSessionDB._execute_writes0  //J>>#j004$  % % 'JU ZZ..0zz)777HJJ&&'89 %) !#DJJ ))+ !!Q&!$$t'F'FF!K,,.$$t'E'EEJ335 )! JJ//1 )! !,5 (/+.t~~/?$B_B_/_ai+j(11($*G*G==. $C(T-K-KHV`-ac(..*c7#;#;<7*f.?99(JO$/t||ZH%66<>sC!ZZ9 668999005 ;;C@--c2]. s E? A E3.D;A6E?; E0E E0 E,)E0+E,,E00E33E<8E??AM!M!(M A MAM5AM<L ML M9#MM!)manyrsqlparamsr c>fd}|j||y)z8Run one INSERT/UPDATE/DELETE through ``_execute_write``.cHr |jn |jyr) executemanyr;)r<r rr s r^_doz!SessionDB._write_sql.._do's 7T  4<<f ErdrNr )rqr rr rrs ``` r^ _write_sqlzSessionDB._write_sql#s F CJ7rdrc8fd}|j||S)zRun one UPDATE/DELETE through ``_execute_write``; return rows changed (``SELECT changes()`` when the driver reports None / negative).c|jj}||dkr"|jdjd}|S)NrzSELECT changes())r;rowcountfetchone)r<rrr s r^rz&SessionDB._write_rowcount.._do.sG||C099H8a<<<(:;DDFqIOrdrr)rqr rrrs `` r^_write_rowcountzSessionDB._write_rowcount+s   ""3:">>rdc0|jfdS)z<``fetchone()`` of one read-only statement via ``_read_ctx``.cD|jjSr)r;rr<rr s r^z%SessionDB._read_one..7dll36O6X6X6Zrd_read_retrying_ioerrrqr rs ``r^ _read_onezSessionDB._read_one5(()Z[[rdc0|jfdS)z<``fetchall()`` of one read-only statement via ``_read_ctx``.cD|jjSr)r;fetchallrs r^rz%SessionDB._read_all..;rrdr r"s ``r^ _read_allzSessionDB._read_all9r$rdcXttdzD]&} |j5}||cdddcSy#1swYnxYw7#tj$rL}|tk\st t |jvrtjtYd}~d}~wwxYw)a"Run an idempotent SELECT through ``_read_ctx``, retrying a transient SQLITE_IOERR. A warm ``mode=ro`` pooled reader can hit the same millisecond-wide WAL transition window as a read-only OPEN (#100436) when its statement executes or steps: a sibling process's checkpoint / WAL reset / frame flush surfaces ``disk I/O error`` because a read-only connection cannot rewrite the -shm index (#100871, WSL2 ext4-on-vhdx, multi-process). The window closes on its own, so the statement is replayed on the SAME connection within the read-only IOERR budget -- never closed and reopened (close() cancels this process's POSIX locks for every sibling connection), never quarantined (busy is not broken). A persistent IOERR exhausts the budget and propagates.rN) rrrr rrrwrrrr)rqrrr<rPs r^r!zSessionDB._read_retrying_ioerr=s>TZZ/     G  jj((@C[B](*AJJ&&U159**,,D13hj3q6AKE!ZZ//0GHQQS 5?#jm0q1Qa<"5!9b1J>D1GJJ&&)?y'IJ/6,JJ&&'GH5  6}}7  :}} G LL@# F F GsT F+DF"F=F+FFFFF($F+(F++G>GGcpt|j|_t|j|_t |j}|r||_y|j<|j s/ |jd}|r|drt|d|_yyyyy#tj$rd}Y6wxYw)z?Snapshot inode plus the on-disk generation header when present.Nr,r) _stat_db_file_identityrrmr:ror9rnrr#r rrZ)rqdisk_idr4s r^rz"SessionDB._record_db_file_identityzs!7 !E$A$,,$O!-dll; +2D ( ZZ #D,H,H "!^^,CD jm/2:a=/A,,z -I #== "!  "s-BB54B5c|j}|t|j|k7ryt|jxsd}|syt |j}t |xr||k7S)zATrue when the path no longer names the file this instance opened.TrF)rmr7rrZrnr9r)rqrecorded recorded_appdisk_apps r^rzSessionDB._db_file_was_replacedse))  $:4<<$HH$T477<1= .t||<H9\!9::rdc6|jxsi}tj|j|r"t fd|j DS|j sytjjdrlt|j} ttjD]5\}}tj|}d|vs ||vs%t|||s5y t#|j}|r||_y#t $rYywxYw)a/True when the WAL/SHM generation this handle opened is gone. Recorded generation: pure stat (no /proc walk on healthy writes). Empty identity (WAL appeared after open, or cleared by a clean close()): probe /proc/self/fd for deleted sidecars and adopt the current ones once clean.c3XK|]!\}}tt|z|k7#ywr)r7r)rsuffixidentbases r^rz5SessionDB._wal_generation_was_lost..s/IVQV&tD6M':;uDs'*Flinuxz (deleted)T)rorfspathrritemsrkrYplatformrr;r,rr"canonical_sqlite_pathr7rr:)rqr:watchedtargetfd_path canonicalcurrent_identityrAs @r^_wal_generation_was_lostz"SessionDB._wal_generation_was_losts ,,2yy& ZbZhZhZj  << " "7 +3DLLAG '7 'D$OFG . D DV LI$.93G 5gwy?Q R# $9F (8D %   s* >  ' '4+H+H+J+/D (  / / 1 008 LL4 5+,GH H,K 1  DEI\\SV sC C>!C99C>triggerc:|j5|j|jcdddSt|jt |j xsi|}||_dddt jd|j||S#1swY-xYw)a6Durably capture the lost WAL generation this handle still holds open, once per handle. The quarantine keeps the retired frames from being checkpointed under wrong page numbers, but they live only in an unlinked inode that dies with this process's last descriptor, and the canonical DeletedWalGenerationError remediation is to stop the writers. Capturing at the first halt (or at close(), whichever sees the loss first) makes "preserve" outlive the process. Raises RetiredGenerationCaptureError; nothing is mutated on failure.N)sidecar_identityrQzCaptured the retired WAL generation of %s at %s to %s; read its manifest.json before deciding whether those frames belong on top of the file now at the path.)rsrrrArrrorrO)rqrQartifacts r^rPz%SessionDB._capture_retired_generations ' ' 8//;77 8 86 tD4M4M4SQS/T^eH08D ,  8  NOS||]dfn  8 8sB6BBc|jrtt|jrt t |j y)zHSticky-flag fast path (no log spam on every write), then the live probe.N)rprrrqrrrrs r^rzSessionDB._raise_if_db_replaceds8   &'=> >  ' '+,GH H ++-rdrPct|tjxr5t|t xr"|j | xrt |dk(S)zBare SQLITE_CORRUPT/NOTADB with no FTS provenance: canonical B-tree/schema/freelist damage, never repairable from the live write path.corrupt)rr rrrr!)clsrPs r^rz)SessionDB._is_structural_corruption_errorsV sG11 2 =s$788 =66s;; =+3/9<  rdrrcDt|td|jdS)zDBuild the quarantine error for this handle (message assembled once).z (cause: ))rrrx)rqrs r^rzSessionDB._corrupt_errors("fX.C-DIdNeNeMffg#hiirdc &d|_t||_|jtj d|j ||j |j}dD]'}t||dt||t||)||)z@Quarantine this handle and raise; never run in-file repair here.Tzstate.db %s reported structural corruption outside the FTS indexes (%s); quarantining this handle: no further writes, no automatic reopen, no explicit WAL checkpoint at close. Stop the gateway and run `hermes sessions recover --source %s --inspect-only`.)sqlite_errorcodesqlite_errornameN) rwrwrxrOrrrrr setattr)rqrPrattrs r^rzSessionDB._halt_db_corrupts"%c( ++-  TVZUaUacf LL  !!#< 7DsD$'3T73#56 7srdcttdd}|j}t|dd}||y ||dy#t$r%tj d|j dYywxYw)aBest-effort SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE (Python 3.12+): sqlite3's close() otherwise runs the internal last-connection checkpoint that wrote the incident's pages under wrong page numbers (see StateDbCorruptError and the generation-loss halts). <3.12 has no setconfig, so a lost-generation handle is retired unclosed instead (see close()): closing its last descriptor could both run that checkpoint and discard committed data present only in an unlinked WAL.r Nr FTzCould not disable SQLite's close-time checkpoint on the quarantined handle for %s; closing it may checkpoint retired frames over the newer generation.rI)r r rr[rrr)rqflagr<r s r^rOz(SessionDB._disable_close_time_checkpoint sw BDIzzD+t4 <9,   dD !  LLV t    s ;+A)(A)cN|js|j|d|_yy)aRetain the exact quarantined connection past GC and interpreter teardown (once per handle). Takes the connection as a parameter: callers are lock-held close paths, and the writer-conn thread-safety audit flags self._conn in functions outside `with self._lock`.TN)rurtrs r^_pin_connectionzSessionDB._pin_connection's( &&  # #D )&*D #'rdcd|_|j xr|jdu} |jd}tjd|j||r tjd|j|S#t$rD}|r|j |j tjd|j|d}~wwxYw)aCapture the retired generation; return whether the handle must be retired unclosed. Where SQLite's close-time checkpoint cannot be switched off (no setconfig, Python < 3.12), sqlite3_close would write the retired frames over the newer generation, so the exact connection is retired unclosed instead. A failed capture leaves the handle open for a retry -- but the pin is taken FIRST on such a runtime: every production caller reaches close() through hermes_state_registry.release_or_close, which swallows the error, so an interpreter exit before the retry must not be able to checkpoint the stale frames either.TNrzCould not capture the retired WAL generation of %s at close: %s. The handle stays open and close() retries the capture; those frames are NOT yet preserved.zSkipping the close-time WAL checkpoint for %s: this handle's WAL/SHM generation was deleted or replaced; the retired generation is captured at %s. Stop the other writers before reopening and inspect the capture before deciding its disposition.ztRetaining the quarantined connection for %s unclosed: this runtime cannot switch off SQLite's close-time checkpoint.) rqrOrtrPr@rcrrrrrO)rqretire_without_closerTrPs r^_settle_lost_generation_lockedz(SessionDB._settle_lost_generation_locked0s(,$#'#F#F#HHpTMdMdlpMp 77@H  ` LL(  NN=>Bll $#'- #$$TZZ0 LLWX\XdXdfi   sB C  ?CC c<|jr|jyr)rwrrs r^rzSessionDB._raise_if_db_corruptRs   %%' ' rdrc >tj}||k\ry|||z z |jk\}tj|r|j |j fn|j|jf}tjt|t||z dy)zSleep one jitter interval if the budget allows; True = retry, False = deadline passed. Small jitter for the first _WRITE_RETRY_SLOW_AFTER_S, then slow; never overshoots the deadline.FrT) rr_WRITE_RETRY_SLOW_AFTER_Srrrr_WRITE_RETRY_MIN_S_WRITE_RETRY_MAX_Srrr)rqrrrslowrs r^rz#SessionDB._sleep_before_write_retryVsnn (?h+,0N0NNLPT ) )4+G+G H))4+B+BC  3vs8c>59:;rdc,t|jS)zQForeign processes holding this DB or its WAL sidecars (see hermes_state_holders).)r$rrs r^r$z#SessionDB._foreign_state_db_holdersds(66rdcp|jrd|jdS|jry|jryy)uWhy this handle must not checkpoint or run in-file repair, or None. A corrupted image has torn B-trees; a replaced file or a deleted/replaced WAL generation would checkpoint under wrong page numbers into the main DB -- the shutdown-time cause of #105670. Precedence note: close() evaluates generation loss BEFORE calling this (and skips it entirely when lost — a lost generation settles through the capture path, not the quarantine advisory), while the halt path checks replaced first.zstructural corruption (rZza replaced state.db filez&a deleted WAL generation (split-brain)N)rwrxrprqrs r^_quarantine_reasonzSessionDB._quarantine_reasonhs>   ,T-D-D,EQG G   -  ' ';rdc|jy |j5|j dddy|jr*t j |j |j|jjdj}|r%|ddkDrtjd|d|ddddy#1swYyxYw#t$r }tjd|Yd}~yd}~wwxYw)aBest-effort PASSIVE WAL checkpoint; never raises. PASSIVE never blocks writers; TRUNCATE corrupted B-trees on 65K+ page databases under exclusive-lock I/O pressure. Previous TRUNCATE strategy caused B-tree corruption on large databases (65K+ pages) due to the exclusive-lock I/O pressure from checkpointing thousands of frames at once (issue #45383). Nr/rrz(WAL checkpoint: %d/%d pages checkpointedz#WAL checkpoint (PASSIVE) failed: %s) rorarrvrrrr;rrrKr[rO)rqr rPs r^rzSessionDB._try_wal_checkpointws  " " $ 0  G c::% c c''OODLL$2F2FG++,LMVVXfQi!mLL!KVTUYX^_`Xab c c c G NN@# F F Gs? CCCBC<CC CC C:C55C:c|S)u0``with SessionDB(path) as db:`` closes on exit; owners must release deterministically. Ownership of a SessionDB should be released explicitly. Historically an instance with a started token writer pinned ITSELF (bound-method writer target plus a strong ``atexit`` drain hook), so ``__del__`` never ran for exactly the instances that leaked descriptors (#88033). The writer now retires after an idle window and the atexit hook holds only a weak reference, so abandoned handles are eventually collectible — but "eventually, after the idle window and a GC cycle" is not a release policy. Call sites owning a handle are still expected to close it deterministically (see the ownership comments in ``run_agent.py`` and ``tui_gateway/methods_session.py``). rcrs r^ __enter__zSessionDB.__enter__s  rdc$|jyNF)r)rqexc_typerPtbs r^__exit__zSessionDB.__exit__s rdc|jrddlm}||y|j|jdc}|_|t j ||j5d|_ddd|jr |jr|j5|jr5|j xr5|jxs't|jxr|j!}|xr|j#}|rdn|j%}|-t&j)d|j*||j*n*|js|s |jj-dt3j|j4|r#|j7|jd|_ n,|jdc}|_ |j9|i|_ddd|j:j |y#1swYxYw#t.$r }t&j1d|Yd}~d}~wwxYw#1swY^xYw)uDrain queued token deltas, then a PASSIVE checkpoint on writable handles (NOT TRUNCATE: a full WAL reset races the gateway's live writer, tearing B-tree pages). A registry-shared instance RELEASES one refcount instead. Drains queued token deltas first (the background writer needs the connection). Read-only connections never request a checkpoint. See #45383. When this instance is shared (opened via ``hermes_state_registry.acquire``), ``close()`` RELEASES one refcount instead of tearing down the connection: the registry owns the lifecycle and only closes on the final release (#90837). This prevents one caller's close from tearing down the writer connection that other callers in the same process are still using — while still letting legacy ``close()`` call sites return their reference instead of leaking it. r)rNTzSkipping the close-time WAL checkpoint for %s: this handle observed %s. Take a snapshot of state.db, -wal and -shm before restarting, then run `hermes sessions recover --source %s --inspect-only`.r/z,WAL checkpoint (PASSIVE) at close failed: %s)rhermes_state_registryr_stop_token_writerratexit unregisterrhrirrarrRrqrrorLrfrorrOrr;r[rKrrvrcrLre)rqrhookgeneration_lostrequarantine_reasonrPr<s r^rzSessionDB.closes  & & 5 DM  !(,(?(?%d%     d #  " " +&*D # +,,. ,,. ZZ$ 3zz&*nn"4#00]T667[DH94I9H>>II c||jjd |jyy#t$rYywxYw)zuSafety net: close() if the caller forgot. Attribute access stays guarded: module teardown order is undefined.rN)__dict__rYrr[rs r^__del__zSessionDB.__del__s@ ==  W % 1   2  s / ;;) input_tokens output_tokenscache_read_tokenscache_write_tokensreasoning_tokensapi_call_count)estimated_cost_usdactual_cost_usd)model cost_status cost_sourcepricing_versionbilling_providerbilling_base_url billing_modesourcedrrrqzBot Chatzjson: reactionsa*id, role, content, tool_call_id, tool_calls, tool_name, effect_disposition, finish_reason, reasoning, reasoning_content, reasoning_details, codex_reasoning_items, codex_message_items, platform_message_id, observed, _compressed_summary, timestamp, active, api_content, display_kind, display_metadatarRc|j5|jjd|fj}ddddS|dS#1swYxYw)zRead state_meta[key] on self._lock (not _read_ctx): fts_rebuild_step reads progress before its write transaction and a WAL reader would not see it.r+Nr)rarr;r)rqrRrBs r^get_metazSessionDB.get_metas[ZZ f**$$%QTWSYZcceC f{t.A. f fs ,A  Arr\rc^d}||j|||fy|j|||fy)uUpsert state_meta[key]; with ``cursor`` the write is inline (the caller already holds a transaction — nesting BEGIN IMMEDIATE would deadlock).zgINSERT INTO state_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.valueN)r;r)rqrRr\rr s r^set_metazSessionDB.set_metas9 D    NN3e - OOC#u .rdworkspaces_rootct|jdsydjdk(ryfd}j|S)zRetag legacy kanban worker rows from ``cli`` to ``kanban`` by cwd under the board's workspaces root; gated once per root via state_meta. Returns rows retagged.z/\rzkanban_worker_source_retagged:1c|jdtdzf}|jxsd}jd||S)NzaUPDATE sessions SET source = 'kanban' WHERE source = 'cli' AND (cwd = ? OR cwd LIKE ? ESCAPE '\')z/%rrr)r; _escape_likerr)r<rretaggedgaterrqs r^rz3SessionDB.retag_kanban_worker_sessions.._do1sP\\Of-45F +!H MM$FM 3Ord)rwrstriprr )rqrrrrs` @@r^retag_kanban_worker_sessionsz&SessionDB.retag_kanban_worker_sessions(sX_%,,U3/x8 == # % ""3''rdc|sgS|jdt|dzf}|Dcgc] }|d|dfc}Scc}w)u``[(key, value), ...]`` for state_meta keys starting with the literal ``prefix`` (LIKE wildcards escaped) — e.g. ``loop:`` rows.z=SELECT key, value FROM state_meta WHERE key LIKE ? ESCAPE '\'%rr)r(r)rqrrowsrBs r^list_meta_prefixzSessionDB.list_meta_prefix=sQI~~ L|\bOcfiOiNk -11SQQ 111s<)rTNru)F)rr)rc)r)rTr&)prsrtru__doc__r/rrw__annotations__r_TRANSCRIPT_WRITE_PATIENCE_S_ACTIVITY_WRITE_PATIENCE_Srrjrkrirrrr_FTS_MERGE_MAX_PAGES_PER_INDEX_FTS_MERGE_COMMANDS_PER_PASS_IMPORT_MAX_SESSIONS _IMPORT_MAX_MESSAGES_PER_SESSION_IMPORT_MAX_TOTAL_MESSAGES_IMPORT_MAX_SESSION_BYTES_IMPORT_MAX_TOTAL_BYTES_TOKEN_WRITER_IDLE_SECONDS staticmethodr r>rAr rr rrGr rLrQrrrprrfloatrrrrrrrrrrr rrr rr rrZrr#r r(r!rrrrLrrPr classmethodrrrrrOrcrfrrr$rorrsrxrr_TOKEN_DELTA_SUM_FIELDS_TOKEN_DELTA_COST_FIELDS_TOKEN_DELTA_ROUTE_FIELDSMAX_TITLE_LENGTH_TITLE_SOURCE_DERIVEDr_TITLE_SOURCE_LLMr_TITLE_SOURCE_USERr_TITLE_SOURCE_RANKCANONICAL_BOT_CHAT_TITLE_CONTENT_JSON_PREFIXREACTIONS_METADATA_KEY_CONVERSATION_ROW_COLUMNSrCursorrrrrcrdr^r&r&sQ a 7"E#s(OSbO35O #-9** #7C44!#_k[=?[YlV:._offloadedSs( **4A$A&AA AAs '%')r rcallable)rqrrr_s @r^ __getattr__zAsyncSessionDB.__getattr__Os+txx&~K Brd)rr&rTN)rsrtrurrprwrrcrdr^rrHsGrdr)SetAUTO_VACUUM_MIN_FREELIST_RATIO)hermes_state_commonrActivityProvenance)zagent.session_activityrCompressionSessionBusyError)hermes_state_errorsrCompressionSessionClosedError)rrDEFERRED_INDEX_SQL)rrFTS_CJK_STALE_KEY)rrFTS_CJK_TABLE_SQL)hermes_state_ftsrFTS_CJK_TRIGGER_SQL)rrFTS_REBUILD_DEFERRAL_KEY)rrFTS_SQL)rr FTS_STALE_KEY)rrFTS_STORAGE_VERSION)rrFTS_TRIGRAM_SQL)rrLEGACY_FTS_SQL)rrLEGACY_FTS_TRIGRAM_SQL)rrMAX_FTS5_QUERY_CHARS)rrPERSISTENCE_ERROR_CAUSES)rr SCHEMA_SQL)rrSCHEMA_VERSION)rrSESSION_STATUS_COMPLETE)hermes_state_sessionsrSESSION_STATUS_EMPTY)rrSESSION_STATUS_ERROR)rrSESSION_STATUS_INTERRUPTED)rrSKILL_EXCERPT_JOINT)agent.skill_commandsrSKILL_SCAFFOLD_SQL_LIKE)rrSessionTurnLeaseLostError)rrWalUnsupportedError)hermes_state_walrapply_durability_barriers)hermes_state_repairrclassify_session_status)rrcollect_state_db_stats)hermes_state_dbfilercount_db_holders)rrdescribe_skill_invocation)rrfts5_cjk_so_path)rris_advisory_lock_contention)rr)ris_automatic_end_reason)ris_disk_full_error)ris_sqlite_wal_reset_vulnerable)ris_transient_sqlite_error)r#iter_deleted_sqlite_sidecar_holders)rzrelease_or_close)hermes_startup_watchdogreport_startup_progress)rresolve_journal_mode)rresolve_synchronous_level)zagent.memory_managersanitize_context)rsqlite_source_id)r workspace_key) rrrrrrrrrrrr ctj|}|tdtd|ddl}ddlm}|t|g|t|j|d|dS)Nzmodule z has no attribute r) warn_oncer) _PLUGIN_COMPAT_LAZYrYAttributeErrorrs importlibhermes_cli.plugin_compatr r  import_module)rrHrr s r^rrse $ $T *F ~wxl2DTHMNN2 h&v& 9**6!95vay AArd)z/Hermes can't open its session history right now)rrr|r7rloggingrrbrrr rrYr_rr0 collectionsr contextlibrpathlibrrrrtypingrr r r r r rrrrrrrrrrrrrr7hermes_state_holdersrrrrrrrrrrrr r!r"r#hermes_state_guardr$r%r&r'r(r)r*hermes_state_readpoolr+r,r-rr.rr/r0hermes_state_portabilityr1hermes_state_telegramr2hermes_state_profile_repairr3hermes_state_schemar4r"hermes_state_lockguardrhermes_state_lockownersr5rr6r7r8r9r:r;r<r=r>r?r@rArBhermes_state_messagesrChermes_state_rewindrDrrErFrGrHrrIrJrKhermes_state_titlesrLhermes_state_usagerMhermes_state_maintenancerNhermes_state_gatewayrOhermes_state_compressionrPhermes_state_searchrQr ImportError getLoggerrsrrvrwrZr_reri ValueErrorrkr{rr frozenset_BARE_BILLING_PROVIDERSrrrrrrrrrrrrrrrcompilerrrrrrrrsetrr`_repair_attempt_lock_REPAIR_LOCK_TIMEOUT_SECONDSrE _IS_WINDOWSrr r$r&rrerrnostructweakrefMAX_SAFE_EXPORT_MESSAGESMAX_SAFE_RESUME_MESSAGESr rrcrdr^r6s      %EVVV 2 UT6J<<A2-+:72hg20<4<2   8 $FZ L[nh D"" "" "N%(ES)%y~~' %llg% :T: BR&C?/@ !VA/B@C/D"#YE/F RG&\!U+iEUH!RD@?]/dBW2 FsM44M?>M?