߲jApdZddlZddlZddlZddlZddlZddlmZmZddl m Z dZ dZ de de fd Zd Zee d d Zee d dZdZee d dZee d dZdZdZdZdZdZdZej8dej:ZdededzfdZ dKdee!e!fdzde!dzfdZ" dKddejFdde!dzdee!e!fdzde dzded dedzf d!Z$ed"d#ed$edzd%edefd&Z%d'edefd(Z&d'ed)edefd*Z'hd+Z(d,e!dzde)fd-Z*dKdee!e!fdzde)fd.Z+dKdee!e!fdzde)fd/Z,de)fd0Z-dLd2ed3edefd4Z.d5d6d7ed8ed9e)defd:Z/d7edefd;Z0d7edefd<Z1d7edefd=Z2d7edefd>Z3d1ed?d#eded)ed@ed%edef dAZ4efeeedBd#eded%edCedDede f dEZ5dFdGd#edHedIedefdJZ6y)MzBShared gateway restart constants and supervisor detection helpers.N)CallableMapping)DEFAULT_CONFIGKN returncodereturnc|tk(ry|S)uTranslate gateway EX_CONFIG so launchd can park the job. systemd uses ``RestartPreventExitStatus=78``; s6 maps 78→125. launchd cannot gate on a specific status, and unconditional ``KeepAlive=true`` respawns 78 forever (#89477). The generated plist uses ``KeepAlive.SuccessfulExit=false``; mapping 78→0 is a deliberate stop. Exit 75 (please restart) and other failures pass through so KeepAlive still relaunches them. Negative ``wait()`` codes (signals) are left to the caller. r)GATEWAY_FATAL_CONFIG_EXIT_CODE)rs 4/home/ubuntu/.hermes/hermes-agent/gateway/restart.py!map_fatal_config_exit_for_launchdr s33 "HERMES_GATEWAY_EXTERNAL_SUPERVISORagentrestart_drain_timeoutgatewaysignal_interrupt_grace_timeoutg@restart_after_turn_timeoutcron_drain_timeoutg$@g>@gN@<g@z ^\s*exit timeout\s*=\s*(\d+)\s*$ print_outputctjt|xsd}|yt|j dS)z=Extract ``exit timeout = N`` from ``launchctl print`` output.N)_LAUNCHD_EXIT_TIMEOUT_REsearchstrfloatgroup)rmatchs r parse_launchd_exit_timeoutr!Os7 $ + +C 0B,C DE } Q  renvironctjdk7ry|tjn|}t |j ddxsdj }|jdsy|S)uReturn this process's ``ai.hermes.*`` launchd job label, or ``None``. Only labels of the gateway's own jobs count (same predicate as :mod:`gateway.control_socket`). App-coalition labels (``application.…``, exported into IDE integrated terminals) also populate ``XPC_SERVICE_NAME``, and ``launchctl print`` reports ``exit timeout = 1`` for them — treating those as a budget would cap the drain to 0 for a gateway Ctrl+C'd in such a terminal. darwinNXPC_SERVICE_NAMErz ai.hermes)sysplatformosr"rgetstrip startswith)r"envlabels r launchd_service_labelr.Ws\ ||x"**WC *B/52 6 < < >E   K ( Lr)r"uidrunr-r/r0).z subprocess.CompletedProcess[str]c8|xs t|}|sy|ttdd}|y|}|dk(rdnd|} |dd|d|gd d d d d }|jdk7ryt|jS#ttj t f$rYywxYw)uLive ``ExitTimeOut`` (seconds) launchd enforces for this gateway's job. Returns ``None`` — meaning "no launchd budget applies" — when the process is not launchd-owned (non-darwin, or no ``ai.hermes`` ``XPC_SERVICE_NAME``), ``launchctl`` is missing or fails, or the print output carries no ``exit timeout`` line. Callers must treat ``None`` as fail-open: the configured drain stands unchanged. Ngetuidrsystemzgui/ launchctlprint/Tzutf-8replace)capture_outputtextencodingerrorstimeout) r.getattrr(OSError subprocessSubprocessError ValueErrorrr!stdout)r-r"r/r0r2domainprocs r read_launchd_exit_timeout_srFjs  3*73E  {Xt, >hXcU|F  'fXQug#6 7   ! %dkk 22 Z// <sA88BBcleanup_reserve_s drain_timeoutlaunchd_exit_timeout_srHc t|}t|}|dkr|St|t|t|z dS)ubClamp a SIGTERM-driven stop drain to what launchd will actually allow. ``launchd_exit_timeout_s`` is the live ``exit timeout`` for this job (see :func:`read_launchd_exit_timeout_s`); ``None`` means no launchd budget applies and the configured drain is returned untouched. Otherwise the drain may use at most ``exit_timeout - cleanup_reserve_s`` so the post-drain teardown (interrupt agents, disconnect adapters, checkpoint and close SQLite) still completes before launchd escalates to SIGKILL. Never *extends* the drain — an operator who configured a short one keeps it. )_secondsminmax)rIrJrHdrainbudgets r resolve_launchd_capped_drainrRsD$ ] #E , -F } uc&8,=#>>D EErrunnercpt|dt}t|dds|St|t|ddS)uDrain budget for the stop in progress on ``runner``. Signal-driven stops under launchd are timed by launchd's live ``ExitTimeOut`` (``runner._launchd_exit_timeout_s``, set at boot); everything else — in-band SIGUSR1 restart after the turn, ``--replace`` takeover, tests — keeps the configured drain. Duck-typed and getattr-guarded on purpose: shutdown-path tests drive ``_stop_impl`` from bare doubles that are not ``GatewayRunner`` instances. _restart_drain_timeout_stop_requested_by_signalF_launchd_exit_timeout_sN)r>%DEFAULT_GATEWAY_RESTART_DRAIN_TIMEOUTrR)rSrPs r effective_stop_drain_timeoutrYs> F46[ \E 66 > 'wv?XZ^/_ ``rwatchdog_delaycpt|}t|dds|St|t|ddtS)uCThread-watchdog leash for the stop in progress on ``runner``. ``watchdog_delay`` is the supervisor-agnostic leash (effective drain + grace). Under launchd a signal-driven stop is SIGKILLed at the live ``ExitTimeOut`` — with a 60s budget the default leash (50 + 60 = 110s) can never fire, so the forensic stack dump and ``os._exit`` the watchdog exists for are lost. Clamp the leash to ``ExitTimeOut - LAUNCHD_WATCHDOG_DUMP_MARGIN_S`` so the dump lands before SIGKILL. Same duck-typing / fail-open rules as :func:`effective_stop_drain_timeout`. rVFrWNrG)rMr>rRLAUNCHD_WATCHDOG_DUMP_MARGIN_S)rSrZleashs r effective_stop_watchdog_delayr^s? ^ $E 66 > ' wv8$?Sq r>1onyestrue error_codec|xsdjj}t|xr|dk(xs|jdS)aTrue when an adapter's fatal error is a single-writer ownership conflict. Adapters emit ``{scope}_lock`` with ``retryable=True`` so a *mid-run* reconnect can recover; at startup a live foreign holder is a configuration conflict (two gateways cannot poll one token), not a transient blip. Matches by error CODE only, never text. ``BasePlatformAdapter._acquire_platform_lock`` emits ``{scope}_lock`` with ``retryable=True`` on purpose: a *mid-run* reconnect must be able to recover once the live holder exits or a stale record is cleared (#54167). This matches by error CODE only (the ``{scope}_lock`` / ``lock_conflict`` families every adapter emits for scoped-lock and identity conflicts), never by message text. r lock_conflict_lock)r*lowerboolendswith)rccodes r is_global_startup_conflictrksB  " # # % + + -D : M4?2LdmmG6LMrcD|tjn|}|jdd}t|jdxs_|jdxsL|xr|dk7xsAt |jt dj jtvS)a7Return whether this gateway process is owned by a supervisor that RESTARTS it. Selects the exit-75 restart route, so only markers of a manager with a restart policy count: systemd ``INVOCATION_ID``, launchd ``XPC_SERVICE_NAME``, the s6 sentinel, or the explicit ``--external-supervisor`` opt-in. The generalized ``HERMES_SUPERVISED_CHILD`` launcher marker is deliberately NOT read here: the Windows Scheduled-Task launcher sets it without a restart policy (#113670), and routing its ``/restart`` through exit 75 would leave the gateway dead. r%r INVOCATION_IDHERMES_S6_SUPERVISED_CHILD0) r(r"r)rhrEXTERNAL_GATEWAY_SUPERVISOR_ENVr*rg_TRUTHY)r"r, xpc_services r is_gateway_supervisor_processrss "**WC'',b1K (`CGG4P,Q`VaVxfquxfx`sww>CDJJLRRTX__ aarcd|tjn|}|jdryt|S)uSReturn whether this gateway was launched by a generated service/launcher rather than a shell. Superset of :func:`is_gateway_supervisor_process` that also honours ``HERMES_SUPERVISED_CHILD``, the marker every generated launcher exports (systemd unit, launchd plist, s6 run script, Windows Scheduled Task — see ``hermes_cli.main._apply_profile_override``). This is the identity the self-targeting guards key on: a kill or lifecycle command issued from inside such a gateway takes down the process hosting the caller with nobody at a terminal to bring it back (#113667). HERMES_SUPERVISED_CHILDT)r(r"r)rs)r"r,s r is_supervised_gateway_launchrvs. "**WC ww() ( 11rctjjdxstjjdS)zIn a container (Docker/Podman) the detached setsid restart path dies with the cgroup, so exit-75 service restart is the only viable path. Own function so tests can mock it.z /.dockerenvz/run/.containerenv)r(pathexistsrr is_container_restart_contextr{s* 77>>- ( PBGGNN;O,PPrrLvaluefallbackc\ tt|dS#ttf$r|cYSwxYw)z9Non-negative float, or ``fallback`` on non-numeric input.rL)rOr TypeErrorrB)r|r}s r rMrMs15<%% z "s ++Ffiniterawdefaultrc| t|tr|js|S t|}|rt j|s|Std|S#tt f$r|cYSwxYw)zParse a timeout where ``0`` is a deliberate disable (must NOT fall through to ``default``), unlike None / blank / non-numeric (/ non-finite) input.rL) isinstancerr*rrrBmathisfiniterO)rrrr|s r _parse_timeout_keeping_zeror sh {z#s+CIIKc T]]5%97Ns3N z "s AA*)A*c*t|xsdtS)zWParse a configured drain timeout; falsy (incl. ``0``) falls back to the shared default.N)rrXrs r parse_restart_drain_timeoutrs &s{d4Y ZZrc"t|tS)zSParse the after-turn wait cap for in-band restart (``0`` = legacy immediate drain).)r*DEFAULT_GATEWAY_RESTART_AFTER_TURN_TIMEOUTrs r parse_restart_after_turn_timeoutrs &s,V WWrc"t|tS)u)Parse the cron-only drain floor (``0`` = opt out; cron interrupted on the chat budget). ``0`` is a deliberate opt-out — cron work is then interrupted on the same budget as chat work, the pre-#82161 behaviour — and must not fall through to the default, unlike empty/missing input. )r"DEFAULT_GATEWAY_CRON_DRAIN_TIMEOUTrs r parse_cron_drain_timeoutr"s 's,N OOrc&t|tdS)z9Parse the unexpected-signal post-interrupt grace timeout.Tr)r.DEFAULT_GATEWAY_SIGNAL_INTERRUPT_GRACE_TIMEOUTrs r $parse_signal_interrupt_grace_timeoutr+s &s,Zcg hhr)elapsedrHrct|}t|}|dkr|St|t|z t|tz }t|t||S)aPSeconds the stop drain may wait on in-flight cron work. Clamped to what this process can honour: the watchdog hard-exits at ``watchdog_delay``, so waiting past that leash minus ``cleanup_reserve_s`` swaps a cleanly-interrupted job for a SIGKILL that leaves it wedged. Never less than ``drain_timeout`` (only extends). rL)rMCRON_DRAIN_CLEANUP_RESERVE_SrOrN)rIrrZrrHrPfloorceilings r resolve_cron_drain_budgetr0s[ ] #E ' (E | ~&')::XFWYu=vvG uc%) **r)rH headroom_sfloor_srrc t|}t|}|dkDr|t|znd}ttt|t||t|zS)afSeconds systemd ``TimeoutStopSec`` must cover: the stop path may first wait ``cron_drain_timeout`` + ``cleanup_reserve_s`` for cron work, so sizing from the chat drain alone lets systemd SIGKILL an in-budget drain. A zero cron timeout is an opt-out. ``restart_drain_timeout`` is only the chat-turn interrupt budget (default 0). See #94759. rL)rMintrO)rIrrHrrrPcron cron_budgets r resolve_systemd_timeout_stop_secrBsY ] #E & 'D:>*4(#455#K s8G$c%&=@T&TU VVrg.@)headroomafter_turn_timeoutrcHt|t|zt|zS)uSeconds a CLI should wait for the gateway PID to exit after SIGUSR1: in-band restart may defer ``stop()`` until turns finish, then spend ``drain_timeout`` inside it — cover both.)rM)rIrrs r resolve_restart_exit_wait_budgetrSs$ M "X.@%A AHXDV VVr)N)rL)7__doc__rr(rer@r&collections.abcrrhermes_cli.configr!GATEWAY_SERVICE_RESTART_EXIT_CODEr rr rprrXr,DEFAULT_GATEWAY_POST_INTERRUPT_GRACE_TIMEOUTrrrSYSTEMD_STOP_HEADROOM_SSYSTEMD_TIMEOUT_STOP_SEC_FLOOR LAUNCHD_GUI_EXIT_TIMEOUT_CLAMP_SLAUNCHD_STOP_CLEANUP_RESERVE_Sr\compile MULTILINErobjectr!rr.r0rFrRrYr^rqrhrkrsrvr{rMrrrrrrrrrzrr rsH  -,%'!"$ # # "#G(-nW.EF].^(_%16~i7PQq7r1s./2,.3>'3JKg3h-i* &+>'+BCW+X%Y" $!%$& !%"%%2::&I2<<X!V! !738#4t#;sTz($3)-=G^^ $3 :$3S#X  %$3 t $3 9 : $3  T\ $3V > FF!DLF F  F2 a aE a &%E& % N3: N$ N a738+