߲j;^dZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl m Z mZmZmZe rddlmZmZej(d Zd d ZGd d Zy)aSessionStore durable-row recovery: session-key generation, legacy Slack key migration, rebuilding a routing entry from state.db, and the SQLite side of routing transitions (promote/reopen/create/ peer). Mixin split out of ``gateway/session.py``; bound onto ``SessionStore`` via the MRO.) annotationsN)replace)datetime)Platform) TYPE_CHECKINGAnyDictOptional) SessionEntry SessionSourcezgateway.sessioncn|y tj|jS#t$rYywxYw)zA``source.to_dict()`` as JSON, or None when absent/unserializable.N)jsondumpsto_dict Exception)sources =/home/ubuntu/.hermes/hermes-agent/gateway/session_recovery.py _origin_jsonrs7 ~zz&..*++ s "( 44ceZdZdZdd dZed!dZed"dZ d#dZdd$dZ d%dZ d&d Z e d'd Z d(d Z d d  d)dZed d  d*dZdd d+dZd d  d,dZdZd d  d-dZd.dZddd/dZ d0 d1dZd2dZdd d3dZe d4dZd5dZy)6SessionRecoveryMixinzMSessionStore durable-row recovery and the SQLite side of routing transitions.Nct|jddsyddlm}||}| |jS||j r |j S ddlm}|xsdS#t$rYywxYw)zProfile namespace for session keys: None when multiplexing is off (legacy ``agent:main``), else the pinned identity's runtime profile, ``source.profile`` or the active profile.multiplex_profilesFNr) identity_ofget_active_profile_namedefault) getattrconfiggateway.session_identityrsession_key_profileprofilehermes_cli.profilesrr)selfrridentityrs r_resolve_profile_for_keyz-SessionRecoveryMixin._resolve_profile_for_key$sut{{$8%@8v&  // /  &..>> !  C*,9 9  sA!! A-,A-c|syt|jd}t|dks|ddk7ryddlm}||dxsdS) z?Extract the profile namespace encoded in a gateway session key.N:ragent)"profile_from_session_key_namespacemain)strsplitlengateway.sessionr*) session_keypartsr*s r_profile_from_session_keyz.SessionRecoveryMixin._profile_from_session_key6sOK &&s+ u:>U1X0F1%(2DfEEcD ddlm}|xsdS#t$rYywxYw)Nrrr)r"rrrs r_active_profile_namez)SessionRecoveryMixin._active_profile_nameAs*  C*,9 9  s  ct|jdxsd}|r||k(ry|j|}|yt|jddr|j|}|duxs||k(S||j k(S)uPrevent a gateway from reviving another profile's row. Single-profile: the row's namespace must match the ACTIVE profile. Multiplexed: it must match the requested key's namespace (the active profile is meaningless there). Keyless rows stay adoptable. Multiplexed: several profiles serve traffic at once, so the active profile is meaningless — the requested key carries the profile the turn was routed to, and the recovered row must sit in the same ``agent::`` namespace (#74285). Rows with no key namespace stay adoptable in both modes (legacy/keyless data owned by this store). r1TNrF)r-getr3rrr6)r#requested_session_key recovered recovered_keyrecovered_profilerequested_profiles r)_recovered_row_allowed_for_active_profilez>SessionRecoveryMixin._recovered_row_allowed_for_active_profileIsIMM-8>B?  1F F ::=I  $ 4;; 4e < $ > >?T U $,V0AEV0V V D$=$=$???r4c ddlm}|||n|t|jddt|jdd|j |S)zQSession key for *source* (profile from *source*; key from *key_source* if given).r)build_session_keygroup_sessions_per_userTthread_sessions_per_userF)rBrCr!)r0rArrr%)r#r key_sourcerAs r_generate_session_keyz*SessionRecoveryMixin._generate_session_key`sN5 $0Jf$+DKK9RTX$Y%,T[[:TV[%\11&9 ; ;r4c|jtjk7s |jsy|j |t |ddS)zPre-workspace Slack key for an explicitly scoped source. Deliberately Slack-only: an unscoped Slack session may be claimed by only one workspace (old key cannot tell teams).N)scope_idguild_id)platformrSLACKrGrEr)r#rs r_legacy_slack_session_keyz.SessionRecoveryMixin._legacy_slack_session_keyis: ??hnn ,FOO))&'&4Z^2_``r4c|sy|jdtj5|jdt}||vr dddy|j | dddy#1swYyxYw)z@Atomically reserve one ambiguous legacy Slack key for migration.F_legacy_slack_claim_lock_claimed_legacy_slack_keysNT)_lazy threadingLocksetadd)r# legacy_keyclaimeds r_claim_legacy_slack_keyz,SessionRecoveryMixin._claim_legacy_slack_keypsg ZZ2INN C jj!=sCGW$   KK #    sA$ A$$A-cn|jtjk7s|jdk(s |jsy t j |jdxsd}t|tsy|jd|jd|jk(S#ttf$rYywxYw)aReject recovered rows whose origin belongs to another workspace: a workspace-scoped Slack lookup adopts a row only if its origin_json names the same scope_id; rows without a parseable origin are rejected (an unattributable transcript is exactly the ambiguity).dmT origin_jsonr8FrGrH) rIrrJ chat_typerGrloadsr9 TypeError ValueError isinstancedict)r;rorigins r#_recovered_row_matches_source_scopez8SessionRecoveryMixin._recovered_row_matches_source_scope{s ??hnn ,0@0@D0HPVP_P_ ZZ m < BCF&$'zz*fjj&<=PP :&  s(B""B43B4cddlm}d d}||jdtjd}|jd}| |||n|} |jd} | $t |jdxsdxs|du} ddlm} ||t|d || ||j|j|jt | | | S) Nr)r cx tjt|S#ttt f$r|cYSwxYwN)r fromtimestampfloatr\r]OSError)valuers r_tszBSessionRecoveryMixin._create_entry_from_recovered_row.._tss7 --eEl;;z73  s  99 started_atlast_activity_at _has_messages message_counttransport_profile_ofid) r1 session_id created_at updated_atr` display_namerIrZreset_had_activitytransport_profile)rrreturnr) r0r r9rreboolrror- chat_namerIrZ) r#rowr1rnowr rirr last_activityrs had_activityros r _create_entry_from_recovered_rowz5SessionRecoveryMixin._create_entry_from_recovered_rows 1 .0F0Fq0IJ  23 7D7PS 3V` ww/   8 =A>[-W[B[LA#CI:!&v?O?O__0@0@#L1EYZ`Ea c cr4F)raise_on_lookup_errorc |j|j||jj||j|r |j nd|r |j nd|j|S)aQuery one durable gateway session row. Scoped Slack lookups disable SessionDB's platform/chat/user fallback: that tuple has no workspace id and could revive another team's session; the caller performs one explicit exact lookup of the old unscoped key instead.N)rr1user_idchat_idrZ thread_idr) _peer_row _db_for_keyrIrhrrrZr)r#r1rallow_peer_fallbackrs r_find_gateway_session_rowz.SessionRecoveryMixin._find_gateway_session_rowsd ~~   [ )&//2G2GU`NN&9FNNt*=f&&4&&>S U Ur4c |r t|ddnd}t|sy |d||d|S#t$r$}tj d|||rYd}~yd}~wwxYw)a``db.find_latest_gateway_session_for_peer`` guarded for a missing store, a SessionDB without the finder, and a failing lookup (debug-logged -> None unless *raise_on_lookup_error*). Extra keyword arguments (user_id/chat_id/chat_type/thread_id) pass through to the finder.$find_latest_gateway_session_for_peerNrr1z-Gateway session DB recovery failed for %s: %s)rcallablerloggerdebug)dbrr1rpeerfinderexcs rrzSessionRecoveryMixin._peer_rowsj OQCTJVZ I[IDI I  LLH+WZ [$  s * AAA) not_afterc|sy|j|}|y|j|}|r||fSt|jd}t |dk\r |ddk(r|dnd}|sy|j |||}t |tr|jdsy|jd }|-|+tjt|t|kDryt|d|fS) a Resolve a gateway session key to ``(session_id, db)`` for shutdown-flush recovery. The routing map (``peek_session_id``) is authoritative: it names the session the message was actually routed to at shutdown. When ``sessions.json`` was pruned, fall back to the durable row under the exact key (the peer finder keeps the reset fence: rows ended only by recoverable reasons match; explicit boundaries do not). A row started after the flush (``started_at > not_after``) cannot be the origin and is never adopted. Never mints a session; None means the caller must preserve the flush file. ``db`` is the store owning the key, so the append lands in the right profile partition. When that store cannot be resolved (``_db_for_key`` fails closed for a profile without a reachable home) the answer is None even if the routing map knows the id: appending to the ambient root store would split one session identity across two physical stores (#66887/#102157). Nr'rr)r(rrprj) rpeek_session_idr-r.r/rr^r_r9mathfloorrfint) r#r1rrrqr2rIrzrjs rresolve_session_id_for_keyz/SessionRecoveryMixin.resolve_session_id_for_keys    k * :))+6 r> !K &&s+"5zQ58w3F58DnnRknJ#t$CGGDMWW\*   Z%; 5Q[K\@]`cdm`n@n3t9~r!!r4c|j||||\}}|y|j||j|r)|j|j|||j|S)zERebuild a missing session-key mapping from a recoverable durable row.)r1rr{rNrt)_query_recoverable_row_reopen_session_rowrq_record_gateway_session_peerrt)r#r1rr{rentrymigrated_legacys r_recover_session_from_dbz-SessionRecoveryMixin._recover_session_from_dbs{"&!.>?   - -  +vEDVDV . X r4c|j|||\}}|+|r)|j|j|||j|S)aDB-only half of _recover_session_from_db (no lock needed): a SessionEntry or None; the caller assigns _entries[key] under lock. The row is NOT reopened here: the caller evaluates reset policy first (an agent_close/ws_orphan row may need promotion to a real reset).)r1rr{r)rrrqrt)r#r1rr{rrs r_query_recoverable_sessionz/SessionRecoveryMixin._query_recoverable_sessions["&! (entry or None, migrated_legacy). The legacy (pre-workspace) Slack key fallback lives here: exact-key lookup, claimed once per process; ``migrated_legacy`` tells the caller to rewrite the peer row to the scoped key.N)r1rrrF)NF)r:r;z\Gateway session DB recovery ignored %s for %s because the row belongs to a different profiler1)rzr1rr{) rKrrVrxr^r_rar?rwarningr9r~) r#r1rr{rrTr;rrs rrz+SessionRecoveryMixin._query_recoverable_row s 33F; 22#F VZHZ"739  ZD,H,H,T66&v5&;7=I#9oO)T*77 6J=="->D NN$%.]]=%A; P55{6s6Lo%%r4c |j|}t|dd}t|r |||n|j||d|}|j |r|j |dyy#t $r}||Yd}~yd}~wwxYw)alEnd *session_id* with *reason* via ``promote_to_session_reset`` (``end_session`` on old SessionDBs). Promote, not plain end: a row already ended with a recoverable accidental reason (agent_close / ws_orphan_reap) must be upgraded to the explicit boundary, or stale-route recovery resurrects it over the reset. ``log(exc)`` reports failures.promote_to_session_resetNz heartbeat:r8)rrr end_sessionget_metaset_metar) r#r1rqreasonlogrpromote heartbeat_keyrs r_promote_session_resetz+SessionRecoveryMixin._promote_session_reset(s !!+.Bb".>&JZJZ\ \  U" U1=1QAQAQ(0.K"3"S7KF7S  U  ` `,t, ` Lk[^__ ` \ LLH+WZ [ [ \s<1B66 D" C  C6C1+D"1C66 D"DD"c|j|}|syd}|j5|j|jj |}||jvr|t |j dd}|||jk(}n|jdk(}|rk|j|rZ|jj|}||_ ||_|j|_ |j|_||j|<ddd|:|j|j|j|||j yy#1swYFxYw)aOne-time migration of pre-workspace-scope Slack keys: MOVE (not copy) the legacy entry so a second workspace with identical Slack ids cannot attach to the same transcript. Adopt when the legacy origin names the same workspace; a scope-less DM is claimed once by the first workspace; a scope-less channel/group is refused (channel ids collide across workspaces).NrGrXr)rK_lock_ensure_loaded_locked_entriesr9rr`rGrZrVpopr1rI _save_entriesrrqrt)r#rr1rTmigrated legacy_entry origin_scopeadopts r_adopt_legacy_slack_entryz.SessionRecoveryMixin._adopt_legacy_slack_entryesA 33F;  +/ ZZ :  & & (==,,Z8L$--/L4L&|':':JM +(FOO;E",,4ET99*E#}}00z?SessionRecoveryMixin._finish_route_transition..sfnn_"K<r4)rcTtjdjd|S)NulFailed to create session row %s for %s%s: %s — deferring to the self-healing peer refresh on the next turnrq)rrr9)r create_kwargsrr1s rrz?SessionRecoveryMixin._finish_route_transition..s+fnnA!%%l3[&!Mr4N)rr_create_session_row)r#r1r end_reasonrr`rtrs `` ` `r_finish_route_transitionz-SessionRecoveryMixin._finish_route_transitionsp   K (^  ' '^Z< (    K (]  $ $]FLM % .; (r4cddlm}|||r |jnd||r |jnd|r |jnd|r |j nd|r |j nd||t||||rd|id Sdd S)zkwargs for ``SessionDB.create_session``. Identity (origin_json) and lineage (parent/_reset_from) land atomically in the INSERT so a crash right after cannot strand the row unroutable.rrnN _reset_from) rqrrr1rrZr profile_namervrYrtparent_session_id model_config)rrorrrZrr!r)rqr1r` source_valuertrros r_session_create_kwargsz+SessionRecoveryMixin._session_create_kwargss B$")/v~~T&)/v~~T-3))-3)).4FNN$!5f!='/(!2BS],=>  Z^  r4c |j|jdi||j|d|||y#t$r}||Yd}~yd}~wwxYw)zINSERT a session row and record its routing peer; ``log(exc)`` on failure. A failed create is a routing hazard (visible warning), but the row is self-healed with full identity by the next per-turn peer refresh.rqrNr)rcreate_sessionrr)r#r1db_create_kwargsr`rtrrs rrz(SessionRecoveryMixin._create_session_rowsb  8D  [ ) 8 8 L;K L  - - . VR^ . `  FF s9< AAArd)rOptional[SessionSource]rw Optional[str])r1rrwr)rwr-)r:r-r;Dict[str, Any]rwrx)rr rDrrwr-)rr rwr)rTrrwrx)r;rrr rwrx) rzrr1r-rr r{rrwr ) r1r-rr rrxrrxrwOptional[Dict[str, Any]]) rr-r1r-rrxrrrwr)r1r-rzOptional[float]rwzOptional[tuple[str, Any]]) r1r-rr r{rrrxrwzOptional[SessionEntry])rwz#tuple[Optional[SessionEntry], bool])r1r-rqr-rr-rwNone)r1r-rqr-rr-rwr)NFN)rqr-r1r-rrrtrrrxrvrrwr)rr r1r-rwr)r1r-rrrr-rrr`rrtrrr-rwr)rwr)rwr)__name__ __module__ __qualname____doc__r% staticmethodr3r6r?rErKrVrar~rrrrrrrrrrrrrrr4rrr!suW$FF@(+@8F@ @.;a Q!Q+8Q QQ c$c36c@McT\c c8', U! U+8 UOS U# U0H UV[":"AE'"'".='" "'"V',!+8?G#0F$ BG& ,&<([]^SX+/\\,/\9P\#\KO\)\59\>^B463@NQ/9P$.1;?2   . r4r)rwr)r __future__rloggingrrrP dataclassesrrgateway.configrtypingrrr r r0r r getLoggerrrrrr4rrsW^# #55;   , -\\r4