+ iHj/a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t H t H t H t ^RIHt^RIHt^RIHt^RIHt]P,!]4tR%tR&t]P6!R]P84tR R ltR R ltR Rlt RRlt!RRlt"RRlt#RRlt$RRlt%RR/RRllt&Rt'R't(R])R&Rt*R R!lt+R"]'/R#R$llt,R#)(uReplay-history sanitization shared by EVERY resume surface (messaging gateway, TUI/WebUI gateway). A turn that died mid-tool-loop (restart command, stale timeout, interrupt before the result was written) persists a dangling ``assistant(tool_calls)`` or interrupted ``assistant→tool`` tail; on resume the model re-issues the unanswered call → endless "thinking"/reboot loop. These pure helpers strip those tails.) annotationsN)AnyDictListOptional)make_tool_result_messagetool_may_have_side_effect)drop_stale_api_content) coerce_epochz2^\[(?:command|execution) interrupted\b[^\n]*\]\s*$c V^8dQhRRRR/#contentrreturnbool)formats"9/home/ubuntu/.hermes/hermes-agent/agent/replay_cleanup.py __annotate__r(s????c\V\4'gR#TpVP4PR4'do\P !V4p\T\4'dTPR4R9dR#TPR4p\T\4'gR#VP4PR^4R,p\PV4RJ# \ dR#i;i) uVTrue only when the result has the executor's interrupt SHAPE: the marker is the last line of the output (JSON envelope with a non-zero exit code, or a bare text result). A marker quoted inside successful output — a grep hit, a doc example — is ordinary data; this runs on every live request, so a false positive rewrites real tool output.F{ exit_codeNoutput )N) isinstancestrlstrip startswithjsonloads ValueErrordictgetrstriprsplit_INTERRUPT_MARKER_LINEmatch)rrenvelope last_lines& ris_interrupted_tool_resultr-(s gs # # F~~""3'' zz'*H(D))X\\+-F)-Sh'&#&& &&tQ/3I ! ' ' 2$ >>  sC,, C;:C;c V^8dQhRRRR/#rcallzdict[str, Any]rrr)rs"rrr>s??^??rc|\VPR4;'g/PR4;'gR4#)functionnamerr&r0s&r _call_namer7>s1 $**//7==2 >>rc V^8dQhRRRR/#r/r)rs"rrrBs<<>&_any_side_effecting..GsMut(D)9::us!#TF)any)r>s&r_any_side_effectingrGFs+ 3MuM33M3M3MuM MMrc$V^8dQhRRRRRR/#)rr3rnoticestuplerr)rs"rrrJs!35rcP\V4'd RV^,3#RV^,3#)zN(effect_disposition, content) for an interrupted/dangling call named ``name``.unknownnoner)r3rIs&&r_orphan_recoveryrNJs+ &&'!*$$ 71: rc V^8dQhRRRR/#r agent_historyr?rr)rs"rrrQs$$0D$I]$rcV'gV#.p^\V4r2W#8Ed'W,pVPR4R8XEdRV9EdV^,pWS8d(W,PR4R8Xd V^, pK-W^,Vp\;QJdRV4F 'gK RM RM !RV44'EdVPR4;'g.p\V4'dVUu/uFp\ V4\ V4bK p pVP V4VFp \V PRR 44'dQT P\V PR 4;'gR 4R 4p \V \4wr/V CR V RV /Cp VP V 4K M'\PR W%^, \V44TpEKVPR4R8Xd8\VPRR 44'd\PR 4MVP V4V^, pEK-V#uupi)uStrip interrupted assistant→tool blocks anywhere in history (a queued user message may follow one). Read-only blocks are dropped; blocks with a side-effecting call are KEPT with the interrupted results rewritten as orphan-recovery notices, since the effect may have happened.role assistant tool_callstoolc3X"TF p\VPRR44xK" R#5i)rr4N)r-r&)rCms& rrD/strip_interrupted_tool_tails..`s$Z\-aeeIr.BCC\s(*TFrr4 tool_call_ideffect_dispositionu`Stripping interrupted read-only assistant→tool replay block (indices %d–%d, tool_results=%d)zr0 call_names tool_resultr3 dispositionrs& rstrip_interrupted_tool_tailsrjQs $&G c- q % 776?k )lc.AAA%M,008FBQ(Qq1LsZ\ZsssZ\ZZZ -33&u--OT!Uut(4.*T2B"BuJ!UNN3''3 5kooiQS6TUU#->>#koon6U6[6[Y[2\^`#aD3CDJ^3_0K*p[*p:NP[]fho*pK{3 (4LL"D!"E3|+<> 776?f $)CCGGIWYDZ)[)[ LLW X NN3  Q N%"Vs3Ic V^8dQhRRRR/#rPr)rs"rrrxs1EJ^rc BV'gV#VR ,p\V\4'd.VPR4R8XdVPR4'gV#VPR4;'g.p\V4'dy\ V4pVFPp\ V4;'gRp\ V\4wrgVP\WW\V4VR74KR \PR4V#\PR\V44VRR #) u_Strip a trailing ``assistant(tool_calls)`` with NO answers — a call that killed the gateway itself (``docker restart``) left zero ``tool`` rows, invisible to ``strip_interrupted_tool_tails``. A partially answered block still resumes. Read-only tails are dropped; side-effecting ones get UNKNOWN-effect results. On resume the model sees an unanswered tool call at the tail and naturally re-issues it — which restarts the gateway again, producing the infinite reboot loop in #49201. ``strip_interrupted_tool_tails`` does not catch this because there is no tool result to inspect for an interrupt marker. rSrTrUrL)r[zQRecovered dangling side-effecting tool call(s) as UNKNOWN instead of erasing themzOStripping dangling unanswered read-only assistant(tool_calls) tail (%d call(s))Nr)rr%r&rGlistr7rN_DANGLING_NOTICESr]rr<r_warningr`r\)rQlastrU recoveredr0r3rirs& rstrip_dangling_tool_call_tailrrxs   D tT " "txx'7;'F488T`KaKa,'--2J:&&' Dd#00yD#3D:K#L K   5dXd^hst u jk LLbdghrdst " rc V^8dQhRRRR/#rPr)rs"rrrs VV+?VDXVrc>V'gV#\\V44#)zqBoth strippers in canonical order (interrupted blocks, then dangling tail); same list object when nothing strips.)rrrj)rQs&rsanitize_replay_historyrus  ()Em)T UUrnowc$V^8dQhRRRRRR/#)rrQr?rvzOptional[float]rr)rs"rrrs)AA'A1@AArcV'gV#Vf\P!4p\V4p\V4p\W!R7#)amApply every destructive replay transform in the shared, fixed order. Resume surfaces and the send path must serialize the same history bytes, or a resumed request diverges in the middle of the cached prefix. The input is never modified. ``now`` is the expiry clock; the send path passes the turn's admission time so every request in one turn sees the same bytes. )rv)timerjrr#strip_stale_dangerous_confirmations)rQrvras&$ rcanonicalize_replay_historyr{s<  {iik*=9G+G4G .w @@rgN@rJ _DANGEROUS_CONFIRMATION_PATTERNSz[A high-risk confirmation previously given here has EXPIRED and must not be acted on. Ask the user to re-confirm explicitly before performing any destructive action.]c V^8dQhRRRR/#r r)rs"rrrsSSsStSrca\V\4'gR#VP4P4o\;QJd#V3Rl\ 4F 'gK R# R#!V3Rl\ 44#)zITrue if user-message text contains a known dangerous confirmation phrase.Fc3,<"TF qS9xK R#5irBr)rCpatternlowereds& rrD,is_dangerous_confirmation..sR1Qg'!1QsT)rrstriplowerrFr|)rrs&@ris_dangerous_confirmationrsR gs # #mmo##%G 3R1QR33R3R3R1QR RRrexpiry_secondsc(V^8dQhRRRRRRRR/#)rrQr?rvfloatrrr)rs"rrrs2(('( ( (  (rc V'gV#.pVEF0p\V\4'd(VPR4R8XdVPR4MRpVe"\VPRR44'gVP V4K{\ VRR7pVf\ PMW, p^Tu;8:dV8:dMMVP V4K\PR YrVPR4;'gRR ,4\V4p\VR&\V4VP V4EK3 V#) u"Redact IN PLACE dangerous-confirmation text older than ``expiry_seconds`` in user messages: a confirmation surviving a restart reads as a fresh re-confirmation minutes later. Untimestamped messages (legacy transcripts, test scaffolding) are left untouched. See #59607. On the next inbound message — possibly a casual "are you there?" from the user minutes later — the LLM sees the stale confirmation and may interpret the new turn as a fresh re-confirmation, re-executing the destructive action. This is the failure mode reported in #59607. rSuser timestampNrr4zmessage timestamp)fieldzYRedacting stale dangerous-confirmation text in user message (age=%.1fs, expiry=%.1fs): %r:NPN) rr%r&rr]r mathinfr_r`_EXPIRED_CONFIRMATION_SENTINELr ) rQrvrrardtsts_fageredacteds &$$ rrzrzs  $&G%/T%:%:swwvRX?XSWW[ !^b :6swwy"7MNN NN3  B&9:,dhhCJ  %~ % NN3   g #'')"4":":C!@ 9<x(x +, Nr)z{[Orphan recovery: interrupted side-effecting tool may have executed; its effect is UNKNOWN. Inspect state before retrying.]z?[Orphan recovery: interrupted read-only tool did not complete.])z[Orphan recovery: this tool may have executed before Hermes stopped; its effect is UNKNOWN. Inspect current state before retrying.]zJ[Orphan recovery: this read-only tool did not complete and had no effect.]) zconfirm forced restartzconfirm forced rebootzconfirm shutdownzconfirm rebootzconfirm power offzyes, delete everythingz confirm wipezconfirm factory resetu確認強制重開機u確認強制重開u 確認重啟)-__conditional_annotations____doc__ __future__rr"loggingrrerytypingrrrragent.tool_dispatch_helpersr agent.tool_result_classificationr agent.turn_contextr hermes_cli.timefmtr getLogger__name__r_r^rncompile IGNORECASEr)r-r7r<rGrNrjrrrur{&_DANGEROUS_CONFIRMATION_EXPIRY_SECONDSr|__annotations__rrrz)rs@rrsk #  ,,@F5+   8 $$Y[][h[hi?,?<N$N6VACGA2*.&+ %*S(C ((r