+ jHjG Rt^RIt^RIt^RIt^RIt^RIt^RIHtHt^RI H t ^Kt ^Nt RRlt RtRt]!] R,R ,4t]!] R ,R ,4tR t]!] R,R ,4t]!] R,R,4tRtRtRt^R/R ]/R?R@llt3]3R ]RA]RB]/RCRDlllt4RERF/RGRHllt5R#)LzBShared gateway restart constants and supervisor detection helpers.N)CallableMapping)DEFAULT_CONFIGc0V^8dQhR\R\/#) returncodereturn)int)formats"4/home/ubuntu/.hermes/hermes-agent/gateway/restart.py __annotate__r s  # # c V\8Xd^#V#)uTranslate gateway EX_CONFIG so launchd can park the job. systemd uses ``RestartPreventExitStatus=78``; s6 maps 78→125. launchd cannot gate on a specific status, and unconditional ``KeepAlive=true`` respawns 78 forever (#89477). The generated plist uses ``KeepAlive.SuccessfulExit=false``; mapping 78→0 is a deliberate stop. Exit 75 (please restart) and other failures pass through so KeepAlive still relaunches them. Negative ``wait()`` codes (signals) are left to the caller. )GATEWAY_FATAL_CONFIG_EXIT_CODE)rs&r !map_fatal_config_exit_for_launchdrs33 r "HERMES_GATEWAY_EXTERNAL_SUPERVISORHERMES_LAUNCHD_LABELagentrestart_drain_timeoutgatewaysignal_interrupt_grace_timeoutg@restart_after_turn_timeoutcron_drain_timeoutg$@g>@gN@g@z ^\s*exit timeout\s*=\s*(\d+)\s*$c>V^8dQhR\R\R,/#)r print_outputrNobjectfloat)r s"r r r Ts!!V! !r c\P\T;'gR44pVfR#\VP ^44#)z=Extract ``exit timeout = N`` from ``launchctl print`` output.N)_LAUNCHD_EXIT_TIMEOUT_REsearchstrrgroup)rmatchs& r parse_launchd_exit_timeoutr%Ts: $ + +C 0B0B,C DE } Q  r cnV^8dQhR\\\3,R,R\R,/#renvironNrrr")r s"r r r \s,wsCx0473:r cVf\PMTpR\3FQp\VP VR4;'gR4P 4pVP R4'gKOVu# R#)ulThe ``ai.hermes.*`` launchd job label in *environ*, or ``None`` (no darwin gate). launchd stamps ``XPC_SERVICE_NAME`` only on the job process it spawns. The generated plist runs the stderr-timestamp wrapper there, so the gateway grandchild reads ``XPC_SERVICE_NAME=0`` and finds its label only in the wrapper's re-export, ``HERMES_LAUNCHD_LABEL``. Both go through the same ``ai.hermes`` predicate: app-coalition labels (``application.…``, exported into IDE integrated terminals) are not our job. ONE seam for every reader of launchd identity (drain cap, restart route, control-socket supervisor declaration). NXPC_SERVICE_NAMErz ai.hermes)osr(LAUNCHD_LABEL_ENVr"getstrip startswith)r(envvarlabels& r launchd_job_labelr4\sd "**WC"$56CGGC$**+113   K ( (L7 r platformczV^8dQhR\\\3,R,R\R\R,/#)rr(Nr5rr))r s"r r r ns7 & &738#4t#; &QT &hknrhr &r c*VR8wdR#\V4#)utReturn this process's ``ai.hermes.*`` launchd job label, or ``None`` off darwin. ``launchctl print`` reports ``exit timeout = 1`` for app-coalition labels — treating those as a budget would cap the drain to 0 for a gateway Ctrl+C'd in an IDE terminal, hence the predicate in :func:`launchd_job_label`. ``platform`` is data so the mapping logic is testable on any host. darwinN)r4)r(r5s&$r launchd_service_labelr9ns8 W %%r r(uidrunc V^8dQhR\R,R\\\3,R,R\R,R\R\P \,3,R\R\ R,/#) rr3Nr(r:r;.r5r)r"rr r subprocessCompletedProcessr)r s"r r r {su%3%3 :%3S#X  %%3 t %3 #z22377 8 %3  %3 T\%3r c nT;'g \WR7pV'gR#Vf\\RR4pVfR#V!4pV^8XdRMRV 2pV!RRV RV 2.R R R R ^R 7pTP^8wdR#\TP4# \\P \ 3dR#i;i) uLive ``ExitTimeOut`` (seconds) launchd enforces for this gateway's job. Returns ``None`` — meaning "no launchd budget applies" — when the process is not launchd-owned (non-darwin, or no ``ai.hermes`` job label — see :func:`launchd_job_label`), ``launchctl`` is missing or fails, or the print output carries no ``exit timeout`` line. Callers must treat ``None`` as fail-open: the configured drain stands unchanged. )r5Ngetuidsystemzgui/ launchctlprint/Tzutf-8replace)capture_outputtextencodingerrorstimeout) r9getattrr,OSErrorr=SubprocessError ValueErrorrr%stdout)r3r(r:r;r5r@domainprocs&$$$$ r read_launchd_exit_timeout_srR{s  F F*7FE  {Xt, >hXcU|F  'fXQug#6 7   ! %dkk 22 Z// <sB B43B4cleanup_reserve_scVV^8dQhR\R\R,R\R\/#)r drain_timeoutlaunchd_exit_timeout_sNrSrr)r s"r r r s:FFF!DLF F  Fr c \V4p\V4pVR8:dV#\V\V\V4, R44#)u>Clamp a SIGTERM-driven stop drain to what launchd will actually allow. ``launchd_exit_timeout_s`` is the live ``exit timeout`` for this job (see :func:`read_launchd_exit_timeout_s`); ``None`` means no launchd budget applies and the configured drain is returned untouched. Otherwise the drain may use at most ``exit_timeout - cleanup_reserve_s`` so the post-drain teardown (interrupt agents, disconnect adapters, checkpoint and close SQLite) still completes before launchd escalates to SIGKILL. Never *extends* the drain — an operator who configured a short one keeps it. )_secondsminmax)rUrVrSdrainbudgets&&$ r resolve_launchd_capped_drainr_sD$ ] #E , -F } uc&8,=#>>D EEr c0V^8dQhR\R\/#)rrunnerrr)r s"r r r s a a aE ar c|\VR\4p\VRR4'gV#\V\VRR44#)uDrain budget for the stop in progress on ``runner``. Signal-driven stops under launchd are timed by launchd's live ``ExitTimeOut`` (``runner._launchd_exit_timeout_s``, set at boot); everything else — in-band SIGUSR1 restart after the turn, ``--replace`` takeover, tests — keeps the configured drain. Duck-typed and getattr-guarded on purpose: shutdown-path tests drive ``_stop_impl`` from bare doubles that are not ``GatewayRunner`` instances. _restart_drain_timeout_stop_requested_by_signalF_launchd_exit_timeout_sN)rK%DEFAULT_GATEWAY_RESTART_DRAIN_TIMEOUTr_)rar]s& r effective_stop_drain_timeoutrgsA F46[ \E 66 > > 'wv?XZ^/_ ``r c<V^8dQhR\R\R\/#)rrawatchdog_delayrr)r s"r r r s!&%Er c|\V4p\VRR4'gV#\V\VRR4\R7#)u#Thread-watchdog leash for the stop in progress on ``runner``. ``watchdog_delay`` is the supervisor-agnostic leash (effective drain + grace). Under launchd a signal-driven stop is SIGKILLed at the live ``ExitTimeOut`` — with a 60s budget the default leash (50 + 60 = 110s) can never fire, so the forensic stack dump and ``os._exit`` the watchdog exists for are lost. Clamp the leash to ``ExitTimeOut - LAUNCHD_WATCHDOG_DUMP_MARGIN_S`` so the dump lands before SIGKILL. Same duck-typing / fail-open rules as :func:`effective_stop_drain_timeout`. rdFreN)rS)rZrKr_LAUNCHD_WATCHDOG_DUMP_MARGIN_S)rarileashs&& r effective_stop_watchdog_delayrmsB ^ $E 66 > > ' wv8$?Sq r c>V^8dQhR\R,R\/#)r error_codeNr)r"bool)r s"r r r s" N N3: N$ Nr cT;'gRP4P4p\V4;'dVR8H;'gVPR4#)aTrue when an adapter's fatal error is a single-writer ownership conflict. Adapters emit ``{scope}_lock`` with ``retryable=True`` so a *mid-run* reconnect can recover; at startup a live foreign holder is a configuration conflict (two gateways cannot poll one token), not a transient blip. Matches by error CODE only, never text. ``BasePlatformAdapter._acquire_platform_lock`` emits ``{scope}_lock`` with ``retryable=True`` on purpose: a *mid-run* reconnect must be able to recover once the live holder exits or a stale record is cleared (#54167). This matches by error CODE only (the ``{scope}_lock`` / ``lock_conflict`` families every adapter emits for scoped-lock and identity conflicts), never by message text. r lock_conflict_lock)r/lowerrpendswith)rocodes& r is_global_startup_conflictrwsK   " # # % + + -D : M M4?2LLdmmG6LMr c`V^8dQhR\\\3,R,R\/#r'rr"rp)r s"r r r s,aa738+CDJJLRRTX__ aar c`V^8dQhR\\\3,R,R\/#r'ry)r s"r r r s( 2 2'#s(*;d*B 2d 2r cvVf\PMTpVPR4'dR#\V4#)u;Return whether this gateway was launched by a generated service/launcher rather than a shell. Superset of :func:`is_gateway_supervisor_process` that also honours ``HERMES_SUPERVISED_CHILD``, the marker every generated launcher exports (systemd unit, launchd plist, s6 run script, Windows Scheduled Task — see ``hermes_cli.main._apply_profile_override``). This is the identity the self-targeting guards key on: a kill or lifecycle command issued from inside such a gateway takes down the process hosting the caller with nobody at a terminal to bring it back (#113667). HERMES_SUPERVISED_CHILDT)r,r(r.r)r(r1s& r is_supervised_gateway_launchrs1 "**WC ww()) ( 11r c$V^8dQhR\/#)rr)rp)r s"r r r sQQdQr c\PPR4;'g \PPR4#)zIn a container (Docker/Podman) the detached setsid restart path dies with the cgroup, so exit-75 service restart is the only viable path. Own function so tests can mock it.z /.dockerenvz/run/.containerenv)r,pathexistsr r is_container_restart_contextrs- 77>>- ( P PBGGNN;O,PPr rYc<V^8dQhR\R\R\/#)rvaluefallbackrr)r s"r r r s!Feer c`\\V4R4# \\3dTu#i;i)z9Non-negative float, or ``fallback`` on non-numeric input.rY)r\r TypeErrorrN)rrs&&r rZrZs15<%% z "s --finiteFcHV^8dQhR\R\R\R\/#)rrawdefaultrr)rrrp)r s"r r r s/ O OV Oe O OY^ Or cVe-\V\4'dVP4'gV#\V4pT'd\ P!T4'gT#\RT4# \\ 3dTu#i;i)zParse a timeout where ``0`` is a deliberate disable (must NOT fall through to ``default``), unlike None / blank / non-numeric (/ non-finite) input.rY) isinstancer"r/rrrNmathisfiniter\)rrrrs&&$ r _parse_timeout_keeping_zeror sp {z#s++CIIKKc T]]5%9%97Ns3N z "s A11BBc0V^8dQhR\R\/#rrrr)r s"r r r ,s[[V[[r c6\T;'gR\4#)zWParse a configured drain timeout; falsy (incl. ``0``) falls back to the shared default.N)rrfrs&r parse_restart_drain_timeoutr,s &s{{d4Y ZZr c0V^8dQhR\R\/#rr)r s"r r r 1sXX&XUXr c"\V\4#)zSParse the after-turn wait cap for in-band restart (``0`` = legacy immediate drain).)r*DEFAULT_GATEWAY_RESTART_AFTER_TURN_TIMEOUTrs&r parse_restart_after_turn_timeoutr1s &s,V WWr c0V^8dQhR\R\/#rr)r s"r r r 6sPP&PUPr c"\V\4#)u8Parse the cron/api_server drain floor (``0`` = opt out; both interrupted on the chat budget). ``0`` is a deliberate opt-out — cron and api_server (/v1) work is then interrupted on the same budget as chat work, the pre-#82161 behaviour — and must not fall through to the default, unlike empty/missing input. )r"DEFAULT_GATEWAY_CRON_DRAIN_TIMEOUTrs&r parse_cron_drain_timeoutr6s 's,N OOr c0V^8dQhR\R\/#rr)r s"r r r ?siifiir c&\V\RR7#)z9Parse the unexpected-signal post-interrupt grace timeout.T)r)r.DEFAULT_GATEWAY_SIGNAL_INTERRUPT_GRACE_TIMEOUTrs&r $parse_signal_interrupt_grace_timeoutr?s &s,Zcg hhr elapsedc `V^8dQhR\R\R\R\R\R\/#)rrUrrirrSrrW)r s"r r r Ds>+++.3+HM+X]++ +r c\V4p\V4pVR8:dV#\V4\V4, \V\4, p\V\Wg44#)aUSeconds the stop drain may wait on in-flight cron and api_server (/v1) work. Clamped to what this process can honour: the watchdog hard-exits at ``watchdog_delay``, so waiting past that leash minus ``cleanup_reserve_s`` swaps a cleanly-interrupted job for a SIGKILL that leaves it wedged. Never less than ``drain_timeout`` (only extends). rY)rZCRON_DRAIN_CLEANUP_RESERVE_Sr\r[)rUrrirrSr]floorceilings&&$$$ r resolve_cron_drain_budgetrDsY ] #E ' (E | ~&')::XFWYu=vvG uc%) **r headroom_sfloor_sc `V^8dQhR\R\R\R\R\R\/#)rrUrrSrrr)rr )r s"r r r VsHWWW.3WWINWW Wr c \V4p\V4pVR8dV\V4,MRp\\\V4\WW4\V4,44#)aeSeconds systemd ``TimeoutStopSec`` must cover: the stop path may first wait ``cron_drain_timeout`` + ``cleanup_reserve_s`` for cron and api_server work, so sizing from the chat drain alone lets systemd SIGKILL an in-budget drain. A zero cron timeout is an opt-out. ``restart_drain_timeout`` is only the chat-turn interrupt budget (default 0). See #94759. rY)rZr r\)rUrrSrrr]cron cron_budgets&&$$$ r resolve_systemd_timeout_stop_secrVsW ] #E & 'D:>*4(#455#K s8G$c%&=@T&TU VVr headroomg.@c TV^8dQhR\R\R\R\R\/#)rrUafter_turn_timeoutrrrrW)r s"r r r gs; C C C.3 CIN C]b C  Cr c\;QJdRW34F 'dK RM RM!RW344'g\P#\V4\ W4,\V4,#)uxSeconds a CLI waits for the gateway PID to exit after SIGUSR1: the in-band after-turn deferral, then the longest supervisor stop envelope — the one systemd's ``TimeoutStopSec`` is sized from (cron drain + cleanup reserve, supervisor headroom, floor; #94759) — then observer ``headroom``. A non-finite drain means "wait indefinitely", not a crash in the integer envelope. c3`"TF$p\P!\V44xK& R#5iN)rrrZ).0rs& r 3resolve_restart_exit_wait_budget..qs"_;^%t}}Xe_--;^s,.FT)allrinfrZr)rUrrrs&&&$r resolve_restart_exit_wait_budgetrgse 3_M;^_333_M;^_ _ _xx & '*J=*m mpxzBqC CCr r>1onyestrue)rY)6__doc__rr,rer=syscollections.abcrrhermes_cli.configr!GATEWAY_SERVICE_RESTART_EXIT_CODErrr~r-rrfr,DEFAULT_GATEWAY_POST_INTERRUPT_GRACE_TIMEOUTrrrSYSTEMD_STOP_HEADROOM_SSYSTEMD_TIMEOUT_STOP_SEC_FLOOR LAUNCHD_GUI_EXIT_TIMEOUT_CLAMP_SLAUNCHD_STOP_CLEANUP_RESERVE_Srkcompile MULTILINEr r%r4r5r9r;rRr_rgrmrrwrrrrZrrrrrrrrrr r rsH  -,%'!"$ "#G+(-nW.EF].^(_%16~i7PQq7r1s./2,.3>'3JKg3h-i* &+>'+BCW+X%Y" $!%$& !%"%::&I2<<X!$ &WZWcWc & &%3)-%3 %3 > %3 LL %3%3PF > F2 a & % N a" 2Q  Ou O[ X Pi +`c+;+&7YW;WQhW4WW" Cei C Cr