߲j\dZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z m Z mZmZmZ ddlZd(dZej(eZej.dk(ZehdZed d hZed d hZehd ZeddhZd)dZd*dZ d+dZ!d,dZ"d-dZ#d.dZ$dZ%dZ&dZ'd/dZ(d0dZ)d1dZ*d2dZ+d3dZ, d4dZ-d5dZ.d6d Z/d7d!Z0dd" d7d#Z1d$d%d8d&Z2 d9d'Z3y#e$rdZYwxYw):aProcess and descriptor authority for state.db structural maintenance. This module owns the proof that no foreign process still holds the active or an unlinked SQLite DB/WAL/SHM generation. ``hermes_state`` supplies only the SQLite connection factory needed by the final lock probe. ) annotationsN)Path)CallableListOptionalSequenceSetTuplecVt|jjdzS)z``file:`` URI for a ``mode=ro`` open. ``as_uri()`` percent-encodes ``?``/``#`` in the home path; a raw ``f"file:{path}?mode=ro"`` truncates there and opens the wrong (empty) database.z?mode=ro)rresolveas_uri)db_paths 9/home/ubuntu/.hermes/hermes-agent/hermes_state_holders.pyread_only_db_urirs% = " ) ) +j 88win32> hermes-acp hermes-agenthermes acp_adapterzhermes_cli.mainzhermes_cli/main.pyz run_agent.py>QWXz--check-hash-based-pycsz--jitc td|dd5}|j}dddsy|jddjd}|dd k(r|j |xsdS#1swYKxYw#t $rYywxYw) z8Read /proc//cmdline without losing argv boundaries./proc/z/cmdlinerbNzutf-8replace)openreaddecodesplitpopOSError)pidhandlerawargvs r_read_proc_argvr+*s  F3%x($ / 6++-C zz'9-33F; 8r> HHJ|t   s,A9A- A9>A9-A62A99 BBcbt|}|.t( tj|jxsd}|rWdj dj t jj|dg|ddjddnd}d|d|d S#t$rd}YqwxYw) zf``PID 123 (hermes gateway run)`` for operator-facing holder lists; /proc argv first, psutil elsewhere.N rPzcommand line unavailablezPID z ()) r+psutilProcesscmdline Exceptionjoinospathbasenamer$)r'r*whos rdescribe_holder_pidr:9s 3 D |* >>#&..08DDVZ#((388RWW--d1g6BabBCIIK LSb Q_yC #bQ  D s'B B.-B.ctjj|jj d}dD]:}|j |s|t |d}| xstd|DcSy)N.exe)pythonpypyc3JK|]}|jxs|dk(yw).N)isdigit).0chars r z0_looks_like_python_executable..Js"$VtT\\^%Bts{%B$Vs!#F)r6r7r8lower removesuffix startswithlenall)programnameprefixsuffixs r_looks_like_python_executablerNEst 77  G $ * * , 9 9& AD$W ??6 "#f+-(F:V$Vv$V!V VW rc8d}|t|kr ||}|dk(r|dz }|t|krd||fSdS|tvr|dz }C|jds|jdr|dz }k|jdr|dz }|jdr|dk7r||dd}d }d }|t|krZ||}||dzd}|d k(ry|d k(r"|rd |fS|dz }|t|krd ||fSdS|tvr| }n|dz }|t|krZ||rdndz }d|fSy)zCReturn the Python module or script selected by interpreter options.r.z--scriptNz--check-hash-based-pycs=z--jit=-rFcmmodule)rH"_PYTHON_LONG_OPTIONS_WITH_OPERANDSrG#_PYTHON_SHORT_OPTIONS_WITH_OPERANDS)r*indexargoptions option_index consumed_nextoptionattacheds r_python_execution_targetr_Ns} E #d) 5k $; QJE.3c$i.?Hd5k* IT I 4 4 QJE  >>4 59Q QJE  >>$  QJE  >># 3#:!"gGL!MW- .".s7  fA 3 3axL AAs%() r6r7r8rErF_HERMES_EXECUTABLESrNr_r_HERMES_PYTHON_MODULESany_HERMES_PYTHON_SCRIPTS)r*rJtargetkindvalueres @r_looks_like_hermesrmws ggtAw'--/<`` env-style assignment on the argv (``env HERMES_HOME=… hermes …``).z HERMES_HOME=N)reversedlistryrzrGrH)r*r}s r_argv_env_homersI$t*%/ eS !e&6&6~&F^,-. ./ rc ddlm}||}|Htjj t |j j |jfStjj|dk(r!tjj |dfS y#t$rtjd|dYywxYw) u!``(, )`` for the home holding the store, else ``(None, None)``. Derived with the canonical ``named_profile_home`` predicate, never a ``basename == "profiles"`` string test: an arbitrary ``/profiles//`` tree is not a Hermes install, and promoting ```` to "ours" swallows an unrelated instance living under it — the literal two-instance shape of #92401. The root store (``~/.hermes/state.db``) is its own root with no profile name, so ANY named-profile selection contradicts it. r)named_profile_homeNz.hermesz+Could not classify the install layout of %sT)exc_info)NN) hermes_constantsrr6r7rqrzparentrKr8r4loggerdebug) this_homer profile_homes r_store_install_layoutrs ^7))4  #77??3|':':'A'A#BC\EVEVV V 77  I &) 377??9-t3 3 4  ^ BIX\ ] ^sABAB!CCcd|yttjj|dtjz}|j |sy|t |djtjdd}t|xr&||rtjj|ndk7S)z\True when the token is under ``/profiles/`` for a name that is not ours.NFprofilesr.r) rvr6r7r5seprGrHr$boolrp)re install_root our_profilerLrKs r_names_other_profilers  \:> ?"&& HF   ( c&kl # ) )"&&! 4Q 7D : Z$K277#3#3K#@UYZZrct|txs t|}|rt|t|k(rdSdSt|t}|r| ||k(rdSdS||dk(rdSdSy)aZ``"ours"``/``"other"``/``None`` from the process's OWN profile/home selection. Under one process per host the shared binary path proves nothing about which home a process serves; its ``--hermes-home``/``HERMES_HOME=``/``--profile``/``-p`` selection does. Same token-exact parsers ``gateway/run.py::_argv_contradicts_home`` uses. oursotherNdefault)r _HOME_FLAGSrrv_PROFILE_FLAGS)r*rrr home_value profile_values r_argv_home_selectionrs{"$ 4Lt8LJ#J/:i3HHvUgU$T>:M  "*k96 Fw F&2} 7Qv_X__ rc<g}t|D]\}}t|ts|jdr|}nB|jdr/d|vr+|j ddd}|jdr|nd}nd}|p|j |t |f|S)zH``(argv index, normalized absolute path)`` for every path-bearing token.rbrRrxr.N) enumerateryrzrGr$appendrv)r*tokensrXr} path_tokenrls r_argv_path_tokensrs$&F!$ ; u%%    C J   c "se|KKQ'*E"'"2"23"7TJJ  ! MM5*Z"89 : ; Mrctjjtj|}tjj |}t |\}}||dz|dzfDchc]!}tjj |#c}tjj |}|rtjj |nd}t|} tfd| Dryt||||} | dk(ry|du} | dk(} | D]\} }t|||rd} ||k(s"|j|tjzry|(||k(s"|j|tjzri| d k(r| sqd |vs|jd rd} tjj|tvsd} | Scc}w) uReturn whether argv proves the process belongs to a DIFFERENT instance. ``state.db`` lives at the HERMES_HOME root, so an absolute-path token containing a ``/.hermes`` segment (or naming a ``state.db``/WAL/SHM under some other parent) identifies that token's own Hermes home. When at least one such token exists AND no token references this instance's state.db, its sidecars, or its home directory, the process provably works on a different generation and must not be counted as an uninspectable holder of ours (issue #92401: a second gateway under /home/demo/.hermes deferred this instance's stale-FTS rebuild forever despite lsof proving zero open handles). Ambiguous argv without absolute-path tokens returns False and keeps the fail-closed suspicion. Evidence is ranked, because one host now runs ONE process for every profile: 1. A token naming our state.db or a sidecar exactly — definitive, ours. 2. The process's own ``--hermes-home``/``HERMES_HOME=``/``--profile``/``-p`` selection — that is what decides which home a multiplexer serves. 3. Path tokens. A token under ``/profiles/`` is another profile's store even though it sits under our root; a token that names only the SHARED install root is NEUTRAL (it is the same binary for every profile, so it can neither prove nor disprove a hold); ``argv[0]`` locates the INSTALL, not the home, so it is not other-home evidence for a store whose home is not part of an install layout (a custom ``HERMES_HOME`` is served BY the binary under ``~/.hermes`` — dismissing on it admits maintenance under a live writer). -wal-shmNc3,K|] \}}|v ywrt)rB_residecarss rrDz-_argv_scoped_to_other_home..&s Cma: ! CsFrrTrz/.hermes)r6r7rqfspathdirnamerrprrhrrrGrrdr8_STATE_DB_NAMES)r*r db_path_strrrr candidatethis_home_norm root_norm path_tokens selectionargv0_locates_homeother_home_seenrXrers @r_argv_scoped_to_other_homers6''//"))G"45K ,I 5i @L+&{V';[6=QR  #HWW%%i0N2>  .DI#D)K C{ CC$T9lKPIF&T17*O(#z  L+ F"O   ':+@+@RTRXRXAX+Y  ) #z'<'|j| |fR |S#t$rP}|jtjtjfvr|jdd|d|fYd}~d}~wwxYw#t$rRt/| }|At1|r6t3||s*d j5|}|j| d |dd fY[wxYw#t$rz}|jtjtjfvrYd}~Wt/| }|0t1|r%t3||s|j| d|d|fYd}~d}~wwxYw#t$r}|jtjtjfvrYd}~|r|j| d|d|fn=t/| }|0t1|r%t3||s|j| d|d|fYd}~!#c* **V,C36B!'".G!!#W!5")>f(E(P%!"$'''"2. 7;F)"OOL9".#NNf4V}5g36'F 6\ ~233>**E<+@A 0G<tW$M#NN$'&@ C5$Q!" !!&#!99u{{(CC$,#NN!$(B6("SE&R S$33#7D $ 0$6t$<(B4(Q '(+(D+1("SE);%&!"!+!: B NN7  NNB"9# ?@ A A B* > 3  5cU;<== N>s>J=/ARL R&M7; R O=R;R RR RA3S"8*S"#S"= LALLAM40R3M44R7 O:,O5,R2=O5/R5O::R= R,R2R8ARRRR S(,SS" T"+,TT"excludecpddlm}|||Dcgc]}tj|fc}Scc}w)aReturn holders of ``db_path`` inside THIS process, other than *exclude*. :func:`foreign_state_db_holders` skips ``os.getpid()`` by design, so it answers a cross-PROCESS question only. Consumers that read "no holders" as "the store is quiet" (auto-VACUUM admission) need this arm too: a VACUUM plus its TRUNCATE checkpoint retires the generation a sibling SessionDB in this very process still holds. r)other_generations_for_pathr)hermes_state_registryrr6r)rrr descriptions rin_process_state_db_holdersrs<A6gwO   k"  s3z--force) force_hintc t|}|syddlm}ddlm}i}g}|D]x\}} |dks| j dr|j | .|j|tjt| jdjzd|d|d g} | t|Dcgc].}d t|d d jt||0c}z } |r| j d |dddd|} | dd| dgz } |r| j d|d| j d|dj| Scc}w)aOperator-facing refusal for structural maintenance (VACUUM, index rebuild, bulk delete) while another process holds ``db_path`` or a WAL sidecar; ``None`` when the store is provably quiet. Running ``hermes sessions optimize-storage`` underneath a fleet of live gateways put every agent into the retired-WAL refusal until all writers were stopped (#110054). Same fail-closed scan doctor and repair use: an incomplete scan refuses too, it never reads as an all-clear. Nr)profile_cli_selector)STORAGE_RECOVERY_DOCS_URL uninspectablerozRefusing `hermes sessions z`: another process is using r@z rz, z> cannot prove the database is quiet (holder scan incomplete: xr0zRewriting the database under a live writer is how every agent ends up refusing turns with the retired state.db-wal error. Nothing is lost.zStop them first (`hermes z>gateway stop`, quit the Desktop app, pause cron), then re-run.zOverride with z if you accept the risk.zRecovery guide:  )rrrhermes_state_errorsrrGr setdefaultrrrrFrKsortedr:r5) rcommandrrrrby_pidunknownr'rjlines profile_args rheld_store_refusalrs'w/G 5="$FG\ V !8v((9 NN6 "   c35 ) - -d63F3F|3T.U.Z.Z [ \ *'2NwiWX Y ZE [abh[i jTW&s+,Btyys 9L/M.NO jjE UV]^_V`aebeVfUgghij&(K  7 #K=0noE  ~j\1IJK LL#$=#>?@ 99U ks43Ec|t|ryd} ||d}|jd|jd|jd |$ |jd |jy y #t$rYwxYw#t$rYy wxYw#tj $rr}t |j}d |vxsd |vcYd}~|C |jdn#t$rYnwxYw |jS#t$rYSwxYwSd}~wtj$rHY|C |jdn#t$rYnwxYw |jy #t$rYy wxYwy wxYw#|C |jdn#t$rYnwxYw |jw#t$rYwwxYwwxYw) aReturn whether repair lacks proven exclusive ownership of ``db_path``. ANY foreign process holding the DB or a sidecar is a live holder (#103339): the lock probe below cannot see a DELETE-mode reader (SHARED only) and cannot run at all on a malformed file, and those are exactly the states repair/VACUUM/checkpoint get invoked in. The holder scan is the authority and fails closed on its own failures (unknown/uninspectable sentinels); the probe only adds a positive lock signal on top.TNg)timeoutzPRAGMA locking_mode=EXCLUSIVEzBEGIN IMMEDIATEROLLBACKzPRAGMA locking_mode=NORMALFlockedbusy) rexecuter4closesqlite3OperationalErrorrzrE DatabaseError)rconnect_repair_durableproberlowereds rlive_writer_holds_dbrs ( E&w< 56 '( j!    :;        # #8c(.."7"7f&77    :;             :;            :;       s=BA5#B5 BB BBE1&"DE1 E4C"" C.-C.2D DDE1)E4-D?? E  E E E,+E,0E11E44F;8F  F; FF;FF;F+*F;+ F74F;6F77F;)returnrz)r'rrzOptional[List[str]])r'rrrz)rJrzrr)r* Sequence[str]rzOptional[Tuple[str, str]])r*rrr)r7rzrrz)rlrzrrz)r*rr{rr Optional[str])r*rrr)rrzrz#Tuple[Optional[str], Optional[str]])rerzrrrrrr) r*rrrzrrrrrr)r*rrList[Tuple[int, str]])r*rrrrr)rrrr )rrrrzrrrr)rrrz!Callable[..., sqlite3.Connection]rr)4__doc__ __future__rrloggingr6rrpathlibrtypingrrrrr r r1 ImportErrorr getLogger__name__rrr frozensetrfrgrirWrVr+r:rNr_rmrrrrrrvrrrrrrrrrrrrrrrs#   AA 9   8 $llg%  HI"M3D#EF"$8.#IJ&/&@#%.(&"   &R,N ! $>5&,[ $'7DS`*(?DHX# $T]"J% %>% %a FsC77DD