+ jHj3 aER%Et0tRt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RIHt^RIHtHt^RIHt^RIHt^RIHtHtH t H!t!H"t"H#t#H$t$^RI%H&t&^R I'H(t(^R I)H*t*H+t+H,t,H-t-H.t.H/t/H0t0H1t1H2t2H3t3^R I4H5t5H6t6H7t7^R I8H9t9^R I:H;t;^RIt>H?t?H@t@HAtA^RIBHCtC^RIDHEtEHFtF^RIGHHtHHItI^RIJHKtK^RILHMtM^tNRtORtPRtQRtRRtS^tTER&tURtVER'tW] P!R4tYRtZ] P!R] P!],4 R] P!]+4 R] P!]*4 R2] P] P,4t^ER(t_Rt`R taR!tbR"R#ltcR$R%ltdR&R'lteR(R)ltfR*R+ltgR,R-/R.R/llthR0R1/R2R3lltiER)R4R5lltjR6R7ltk] P!RPR8],]+]*]2]3]1]0].]/]-3 44] P4tmR9R:ltn]o!0ER*m4tpR;R<ltq] P!R=] P4tr] P!R>] P4ts] P!R?] P4ttER+tu] P!R@RP]u4,R,] P4tvER,tw] P!R@RP]w4,R,] P4txER-ty] P!R@RP]y4,R,] P4tzRARBlt{RCRDlt|ER)RER/RFRGlllt}ER)RHRIllt~RJRKlt]o!0ER.m4tRLRMltRNROltRPRQltRRRSltRTRURVRURWR1/RXRYllt]tRZ3]sR[3]rR\3]xR]3]zR^3]vR_33tR`RaltRbRcltRdReltER/t] P!RfRP]]uRg,,ER0,4,R,] P4tRhRiltRjRkltRlRmltRnRoltRptRqRrltRsRU/RtRulltRvRwltRxR1RERRyR/RzR{lltR|R}ltER1tRtR~tRRltRRltRRltRRltRRltRRltRRltRRltRRRR/RRlltER2RRU/RRllltRRU/RRlltER3t]^kER4RRlltRtRtRtRRltRRltER)RRlltRRltER)RRlltRRltRRltRRRR1/RRlltRRltRRltRRlt0ER5mt^RIHtRtRtRRltRRltER6t] P!R] P4t^RIHtER7RRlltRRltRRltRRltRRltRRltRRltR] EPR&]EPEP^]!]!]4EPEP44^RIHtHtHt]!4t^RIHt]R, t]!]]!]4EP4EP^,R, R7RRltRRltRRlt^RIHtHtHt!RR]4t!RR]4tRRltRRltRRltRRltRRltRRltRRltER2RRlltRRlt]ER)RRU/RRlll4t]RRl4tRRltRRltRRlt] P!R4tRR0t^RIHt]!]R,R,4] EPER&ERERRERERERERERERERER ER ER ER ER ERERERERER/ tERERERER/tERERERERERER/tERERltERER ltER!ER"ltER#ER$ltER%ER&ltER'ER(lt]ER), Et/Et]^kE]EP4'd]!E]4Et]!E]4^ER.IEHEtE]EPER//4Et E] !E] E] 4'd&E] EPER04'd E]!RUER17^ER3IGEHEtE]!4^ER5IGEHEtE]!4R] EPER7&^ER8EIEHEtEHEt^ER9EIEHEtEHEtEHEtEHEtEHEtEHEt^ER:EIEHEtEHEtEHEtEHEtEHEtEH Et ^ER;EI!EH"Et"^EREI)EH*Et*^ER?EI+EH,Et,^ER@EI-EH.Et.^ERAEI/EH0Et0^ERBEI1EH2Et2^ERCEI3EH4Et4^ERDEI5EH6Et6EH7Et7^EREEI8EH9Et9EH:Et:^ERFEI;EHEt>^ERHEI?EH@Et@EHAEtA^ERIEIBEHCEtC^ERJEIDEHEEtE^ERKEIFEHGEtG^ERLEIHEHIEtI^ERMEIJEHKEtK^ERNEILEHMEtM^EROEINEHOEtO^ERPEIPEHQEtQEHREtREHSEtS^ERQEITEHUEtUEHVEtV^ERREIWEHXEtXEHYEtYEHZEtZEH[Et[] EP!E]4Et]ER)ERSERTllEt^ERUEt_ERVERWlEt`E]a!4EtbER8Etc]^kERXERYlEtdERZER[lEte] EP!RUER\7!ER]ER^44EtgER9ER_ER`llEthER)ERaERbllEtiERcERdlEtjEReERflEtkERgERhlEtlERiERjlEtmERkERllEtnERmERnlEtoERoERplEtpERqERrlEtqERsERtlEtrERuRU/ERvERwllEtsERxERylEttERzER{lEtuER|ER}lEtvER~EtwEREtxEREtyEREtzEREt{EREt|EREt}EREt~EREtEREtERR/ERERllEtER:EtERERlEtERR/ERERllEtERRERR/ERERllEt]o!E]wEP 4E]xEP 4E]yEP 4E]~EP 4E]{EP 4E]EP 4E]EP 404EtERERlEtERERlEtERERlEtERERlEtERERlEtERERlEtERERlEtER)ERERllEt^EREIEHEtER)ERERllEtERRERR/ERERllEtERRERR/ERERllEtERERlEt] P!ER4EtERERlEtER;ERERllEtER)ERERllEtERERlEtERERlEt^REIEtEREs]^kER^/ERERllEtERERlEtERERlEtERERlEtERERlEtEREtERERlEtERERlEtERERlEtE]a!4EtERER/EtERERlEtERERlEtERERlEtE]EP\ER/Et]^kERERlEt^EREIEHEt!ERERE]*E],E].E]0E]2E]4E]6E]9E]E]@E]CE]EE]GE]IE]KE]E]ME]O4EtERER/ERERllEtERERlEtERERlEtERERlEtERERlEtERERlEtERERlEtERERlEtERERlEtER)ERERllEtERERlEtERERlEtERERlEtER)ERERllEtER?ERERllEtER@ERERllEtERERlEtEREtEREtERAERERllEtERBERERllEtERERlEtERERlEtERERlEtERERlEtER ER lEtER ER lEtER EtER4ERERllEtERERlEtERERlEtERERlEtERERlEtERERlEt^EREIEHEtEHEtEHEtEHEtER4ERERllEtERCERERllEtERER lEtER!EtER"ER#lEtE]ER$8Xd E]!4R#R# ]dt]P R8wdhRtAELRtAii;i ]d\EtE]!ER*E]!E]4EP ER+E] 2]EPER,7E]!ER-]EPER,7REtEAELREtEAii;i ]d-Et E]!ER2E] 2]EPER,7REt EA ELREt EA ii;i ]d-Et E]!ER4E] 2]EPER,7REt EA ELREt EA ii;i ]d-Et E]!ER6E] 2]EPER,7REt EA ELREt EA ii;i(DzGateway runner - entry point for messaging platform integrations. Provides ``start_gateway()`` (start all configured adapters) and ``GatewayRunner`` (lifecycle). Run via ``python -m gateway.run`` or ``python cli.py --gateway``.Nhermes_bootstrap) OrderedDict)Context copy_contextPath)datetime)CallableDictOptionalAnyListTuplecast)safe_schedule_threadsafet) COMPACTION_DONE_STATUSCOMPACTION_HEARTBEAT_STATUSCOMPACTION_STATUS1COMPRESSION_RETRY_CONTEXT_REDUCED_STATUS_TEMPLATE*COMPRESSION_RETRY_MESSAGES_STATUS_TEMPLATE(COMPRESSION_RETRY_TOKENS_STATUS_TEMPLATE+COMPRESSION_RETRY_TOO_LARGE_STATUS_TEMPLATEIDLE_COMPACTION_STATUS_TEMPLATE#PRE_API_COMPRESSION_STATUS_TEMPLATE%PREFLIGHT_COMPRESSION_STATUS_TEMPLATE)MERGED_DURABLE_ROWSRETIRED_DURABLE_ROWSUNNAMED_DURABLE_ROWS)"INTERRUPT_WAITING_FOR_MODEL_PREFIX)request_hard_interrupt)ABSORBED_MESSAGE_UIDS MESSAGE_UIDcopy_identity_fieldsis_compaction_scaffoldingscaffolding_replay_fieldscompression_made_progress)ActivityProvenanceAwakeIdleMeter)_is_ssh_remote_tilde_cwdcfg_get)pre_agent_fallback_notice_UnboundedThreadExecutorg @>@gf@gF@@g.@z'(?)\s+\d[\d,]*\s+messages,\s+retrying|compressed\s+~[\d,]+\s+(?:→|->)\s+~[\d,]+\s+tokens,\s+retrying|context\s+reduced\s+to\s+[\d,]+\s+tokens\s+\(was\s+[\d,]+\),\s+retrying|session\s+compressed\s+\d+\s+times|rate\s+limited\.\s+waiting\s+\d|retrying\s+in\s+\d|max\s+retries\s+\(\d+\).*(?:trying\s+fallback|exhausted|invalid\s+responses)|stream\s+(?:drop|drop\s+mid\s+tool-call).+retry\s+\d|stale\s+connections\s+from\s+a\s+previous\s+provider\s+issue|)gN@c6\VRR4p\VRV4#)zXThe raw SessionDB behind ``gateway._session_db`` (unwrapping the async facade), or None. _session_dbN_db)getattr)gateway session_dbs& 0/home/ubuntu/.hermes/hermes-agent/gateway/run.py_gateway_session_db_innerr<ts-6J :uj 11c<V^8dQhR\R\R\/#) session_keybase_cooldown_secondsreturnstrfloat)formats"r; __annotate__rGzs(#R#R#RTY#R^c#Rr=c^RrCVPV4Pp\ \ V4RR4p\V4'd(\^\V!V444pVeW4n M)Ve&V;P^, un VPp\\V\\44^, ,p\W',\4# \d!p\P RT4Rp?LRp?ii;i \dJp\P RT4Te&T;P^, un TPpRp?LRp?ii;i)uBump the hygiene failure streak and return the escalated cooldown (x1/x3/x9 over base, clamped). Hygiene's per-run ``AIAgent`` is fresh, so the streak lives in SQLite keyed by rotation-stable session_key. It exists because the in-agent equivalent is unreachable from here: ``ContextCompressor.record_timeout_failure`` escalates on an absolute 60 -> 300 -> 900s ladder driven by the in-memory ``_consecutive_timeout_failures`` counter, which ``bind_session_state`` zeroes. Session hygiene constructs a FRESH ``AIAgent`` per run and re-binds state every time, so from the gateway that streak is structurally always 0 and only the flat ``hygiene_failure_cooldown_seconds`` could ever be recorded — a session whose summary model always times out retried on that same fixed interval forever (#79624). The streak is mirrored to SQLite by rotation-stable ``session_key`` so it outlives both the per-run agent and gateway restarts; ``PersistentState`` keeps the hot in-process view. Nz(hygiene failure streak update failed: %s increment_hygiene_failure_streakz)hygiene failure streak persist failed: %s)_session_state persistent Exceptionloggerdebugr8r<callablemaxinthygiene_failure_streak$_HYGIENE_COOLDOWN_LADDER_MULTIPLIERSminlen_HYGIENE_COOLDOWN_MAX_SECONDS)r9r@rAstreakstateexc increment multipliers&&& r;_hygiene_cooldown_for_failurer\zs1tEF&&{3>>1':<^`deI  6C + 678F /5,   $$)$--5 FC<=>BDJ $13P QQ% F ?EEF 6 LLDc J ,,1,55  6s/C%D D#C>>D E?EEc(V^8dQhR\RR/#r?r@rBNrD)rFs"r;rGrGsTTTTr=crVPV4pVe^VPn\ \T4RR4p\T4'd T!T4R#R# \d!p\P RT4Rp?LZRp?ii;i \d"p\P RT4Rp?R#Rp?ii;i)zClear the hygiene failure streak after a compression that reduced context. Peeks, never get-or-creates: a no-op 0 write must not create a never-evicted ``_sessions`` row.Nz'hygiene failure streak reset failed: %sreset_hygiene_failure_streakz2hygiene failure streak persistent reset failed: %s) _peek_session_staterKrRrLrMrNr8r<rO)r9r@rXrYresets&& r;_reset_hygiene_failure_streakrdsE++K8  67E   3 -g68VX\ ]E T +  E >DDE  T LLMs S S Ts/&AB  B'BB B6B11B6cxV^8dQhR\R\R\R\R\R\R\R\/#) r?abortedrotatedin_place msg_count new_count approx_tokens new_tokensrB)boolrQ)rFs"r;rGrGsVVVV#V/3V@CVPSVV$'V,0Vr=cNV'gV'g V'gR#\W4WV4#)uKTrue when a hygiene run actually recovered the session (extracted to be unit testable). Requires no abort, a real rewrite (the no-op path reuses pre-compression counts) and material shrink per :func:`compression_made_progress` (a bare ``<`` misses row-count wins and counts estimate noise). * the compressor did not abort (no summary produced at all); * the transcript was actually rewritten — either rotated into a new session or compacted in place. The degenerate "did not rotate or compact in place" path (#21301) reuses the pre-compression counts, so relying on the numbers alone would read a no-op as success; * the request materially shrank, per the canonical :func:`compression_made_progress` (#39548) — a row-count drop counts even when the summary keeps the token estimate flat, and a sub-5% token wobble does not count at all. Fr')rfrgrhrirjrkrls$$$$$$$r;hygiene_compaction_recoveredrosw( $Y= UUr=c TV^8dQhR\R\R\R\R\/#)r?total_exhaustedelapsed idle_timeoutprogress_observedrB)rmrErD)rFs"r;rGrGs;DDD',D > > +.> >A> LP> > ).> JO> \_> r=caaaa"\T;'gR4P4pVR9dRpVR8wdRV 2#\W4oSe S\JdR#\ SRR4fR#\ SRR4p \ V R ^4p \ P !4PR\4PVVVV3R l4p \ VR R4p \V 4'd V !V S4\ P!\ P!V 4\\V4R 4R 7GRjxL \ T R ^4pY8d\)Y4R#R#L& \d1T^8d\!TSTR4\"P%RST4R#\&d'p \"P%RST 4RT 2uRp ? #Rp ? ii;i5i)uSession hygiene for ``codex_app_server`` sessions. The real context is the server-side thread; the local transcript is a never-replayed mirror, so rewriting it shrinks nothing and evicting the live agent starts the next turn on an EMPTY thread. So: compact the LIVE agent via ``thread/compact/start``, keep it cached, never build a detached compressor. ``native``/``off`` skip without local fallback. Returns ``compacted``, ``skipped:`` or ``failed:``. See #73503. * Evicting the cached live agent afterwards destroys the only real context: the next turn spawns an EMPTY thread and the model starts blank while Hermes still mirrors a full history (abrupt amnesia — the user-facing damage documented on #73503). nativehermesz skipped:mode=Nzskipped:no-cached-agent_codex_sessionzskipped:no-live-threadcontext_compressorcompression_countcD<SPSRSS;'gRRR7#)defaultr2)rktask_idtrigger)_compress_context)agentrkrrsr;.run_codex_hygiene_compaction..s-''=ZdZqZqhq|M'Nr=_track_deferred_agent_worker?timeoutz,codex app-server thread compaction timed outzwSession hygiene: codex app-server thread compaction for session %s timed out after %.1fs; continuing without compactionzfailed:timeoutzMSession hygiene: codex app-server thread compaction for session %s failed: %szfailed: compactedzfailed:no-boundary>offrr)rDlowerr_AGENT_PENDING_SENTINELr8asyncioget_running_looprun_in_executorrrunrOwait_forshieldrPrE TimeoutError_record_hygiene_cooldownrMwarningrLrd)r9r@rrrrkrrmode compressor count_before worker_future track_workerrY count_afterrs&&f$dd$$ @r;run_codex_hygiene_compactionrs y$$H % + + -D .. xtf%% %g ;E }!88(u&-5' 4d;J:':A>L,,.>> ln   NOM7$BDIL ]E*w~~m F Ff6FFr=cVV^8dQhR\R\R\\,RR/#)r?rcooldown_secondserrorrBN)rDrEr )rFs"r;rGrG+s6III05I>FsmIW[Ir=c\\V4RR4pVfR#V!V\P!4V,V4R# \d"p\P RT4Rp?R#Rp?ii;i)aPersist a session-hygiene compression-failure cooldown to the state DB (survives restarts). ``error`` must be forwarded: the recorder writes compression_failure_error UNCONDITIONALLY (NULL clobber). Uses the same ``compression_failure_cooldown_until`` column and ``record_compression_failure_cooldown`` method that the in-conversation compression path (``agent/context_compressor.py``) already uses, so the cooldown survives gateway restarts (#74136). #record_compression_failure_cooldownNz+session hygiene cooldown persist failed: %s)r8r<timerLrMrN)r9rrrrecorderrYs&&&& r;rr+se09;`bfgHITYY[+;;UC I BCHHIs$A A0A++A0c0V^8dQhR\R\/#)r?templaterBr_)rFs"r;rGrG>s====r=c`\P!RV4pRPRV44#)zCompile a compression status template constant into a regex source. Literal text is escaped verbatim (wording drift can't diverge from the matcher); ``{field}`` -> numeric.z \{[^{}]*\}z[\d,]+c3N"TFp\P!V4xK R#5iN)reescape).0parts& r; ,_status_template_to_regex..Css) HH]H -E >>1onyestrue)_load_gateway_configrdictr~rDstriprrL)configcompression_cfgs r;-_gateway_compression_progress_notices_enabledrXs %'7A&$7O7O&**]3UY ot , ,**+=uEFLLNTTV[** * -     sBB BBc0V^8dQhR\R\/#r?platformrBr rm)rFs"r;rGrGmsLLsLtLr=c&\V4\9#)zBTrue only for programmatic/local surfaces that must keep raw text.)_gateway_platform_value_GATEWAY_RAW_TEXT_PLATFORMSrs&r; _gateway_surface_passes_raw_textrms "8 ,0K KKr=z(cybersecurity\s+risk|security\s+policy|safety\s+policy|policy\s+violation|violat(?:e|es|ed|ion)|blocked\s+(?:because|by|under)|request\s+(?:was\s+)?(?:blocked|rejected)|disallowed|moderation)zd(provider\s+authentication\s+failed|incorrect\s+api\s+key|invalid\s+api\s+key|(?))+2299LCl#/$&JJNN=$A#CI#Caq'$q'#CI\\bMbLccJUD %$,,.M}%++-    %-? ##%% (7 7ECexc_info) r~r=hasattrrFreprrLrMrr5r6 __traceback__default_exception_handler)r?r@rYrE task_names&& r;_gateway_loop_exception_handlerrN s ++k "C 6s;;{{8$;; F(;   '/6tZ/H/HDMMOdSWj   GIfIfVf I  tCy#?P?P.Q  S ""7+  ' J  's-C&&C?>C?c0V^8dQhR\R\/#r?textrBr_)rFs"r;rGrG9s##c#c#r=c^RIHpV!V4#)zSecret redaction before text can leave the gateway for a chat platform: the shared egress scrub (``force=True`` holds even when ``security.redact_secrets`` is off; fails closed). See #23810.)redact_for_egress) agent.redactrS)rQrSs& r;#_redact_gateway_user_facing_secretsrU9s/ T ""r=c>V^8dQhR\R,R\/#)r?cmdNrBr_)rFs"r;rGrGAs = =#* = =r=cH^RIHpT!\T;'gR4RR7#)aRedact credentials from a command before it goes into an approval prompt. The gateway approval prompt is built from the raw command string, so a credential-shaped value would otherwise be echoed verbatim to the chat platform (#48456). Uses ``redact_sensitive_text(force=True)`` so the prompt honors redaction even when ``security.redact_secrets`` is off. Module-level so the wiring is unit-testable (the call site is a deeply nested gateway closure that cannot be driven directly). )redact_sensitive_textrTforce)rTrYrD)rWrYs& r;_redact_approval_commandr\As3 SYYBt <>$  .59O.O$T* aUVW`Ua a6 3 44r=z^\s*(\W*\s*)?(:NNc0V^8dQhR\R\/#rPrd)rFs"r;rGrGs ? ?S ?T ?r=cV'gR#\V4P4p\V4R8gVPR4^8dR#\ \ P V44#)zTrue when text is a provider failure envelope, not normal content. Must be short (envelopes are 1-3 lines) AND start with the marker, so prose citing a status code misses.Fi )rDrrUcountrm _GATEWAY_PROVIDER_ERROR_SHAPE_REr)rQbodys& r;"_looks_like_gateway_provider_errorrsO  t9?? D 4y3$**T*Q. 077= >>r=c<V^8dQhR\R\R\/#)r?rrQrBr)rFs"r;rGrGs!""s"#"#"r=c|V'd\V4'dV#^RIHpV!\V44p\ V4pV^8dVRVP 4p\V4P 4P\4'dR#\\V44p\V4'd \V4#V#)zSanitize final gateway replies for chat surfaces: concise, secret-redacted provider failure categories instead of raw HTTP bodies, request IDs, leaked credentials, or policy text.)_sanitize_surrogatesNr) ragent.message_sanitizationrrD_terminal_sentinel_startrstripr startswithr rUrr)rrQr _eos_startredacteds&& r; _sanitize_gateway_final_responsers 3H== @ D *D*$/JQKZ '') 4y##$FGG23t9=H)(33,X66 Or=c ^V^8dQhR\R\R\R\\,/#)r?r event_typemessagerB)r rDr )rFs"r;rGrGs/csSU]^aUbr=cd\T;'gR4P4pV'gR#\V4'dV#\V4p\P V4'd.\ 4'd\P V4'gR#\V4'd \V4#V#)zFilter/sanitize agent status callbacks before platform delivery. Local/CLI keep the raw diagnostic stream; messaging surfaces drop transient aux/compression noise.rN) rDrrrU_TELEGRAM_NOISY_STATUS_RErr_COMPRESSION_PROGRESS_STATUS_RErr)rrrrQs&&& r;_prepare_gateway_status_messagers w}}"  # # %D '11 .t 4D ''--577<[ "".rQr)rDr8r)notices&r;render_notice_liners) wvvr*00b 1 7 7 99r=c"\VRR4p\V4'dV!WW4R7GRjxL #VPWVR7GRjxL #LL5i)zRoute a status through adapter.send_or_update_status when supported (edits the previous bubble for the same status_key instead of appending); otherwise fall back to plain send. See #30045. send_or_update_statusN)r)r8rOsend)adapterchat_id status_keycontentrsenders&&&&& r;_send_or_update_status_cororsP W5t 4 0D$$((;"7"7 =txx?PQV  @ FGT *  NN+WVWd-K-^-^_ S    * * /5s#D E+E4E5EEreply_in_threadc jV^8dQhR\R\R\R\R\\,/#)r?rsource_thread_idevent_message_idrrB)r rmr rD)rFs"r;rGrG1s8%(buzzslack mattermost)rDr8r)rrrr platform_keys&&&$ r;_resolve_progress_thread_idr1swx(;AArBHHJL   0S9I5JcRbNc5c(8s#$BdB#$$66;K#$$ r=cHV^8dQhR\R\R\R\/#)r? user_configrsettingrB)rrDrm)rFs"r;rGrGGs0 F F FC FRU FZ^ Fr=c0\V\4'dVPR4MRp\V\4'gR#VPR4p\V\4'gR#VPV4p\V\4;'dW%9#)zFReturn True when display.platforms. explicitly sets setting.displayNF platformsrrr~)rrrrr platform_cfgs&&& r;_has_platform_display_overriderGsr,6{D,I,Ikooi(tG gt $ $ K(I i & &==.L lD ) E Eg.EEr=rrequire_platform_override_forcV^8dQhR\R\R\R\R\R\\,R,R\/#) r?rrrrrrNrB)rrDrmr r)rFs"r;rGrGSsL%(36DH9rrrr) rrrgateway.display_configrrrmrDrr) rrrrrrcurrent_platformc platform_onlyrrs &&&$$$ r;_resolve_gateway_display_boolrSs/x/G/G<H:W:`:`[^[`:`b:`A,Q/:`Mb).{'RR> #Kw PE% %{{}""$(BBB }G} ;csCc<V^8dQhR\R\R\/#)r?rQrrB)rDr )rFs"r;rGrGms! < < .__annotate__us&@@ @#@r=cn<S!VP^44pV'dRV 2#VP^4#)/)group)r sanitizedrs& r;_replace/_telegramize_command_mentions.._replaceus0+EKKN; "+9+?Q?r=)r8hermes_cli.commands_platformsr_TELEGRAM_COMMAND_MENTION_REsub)rQrplatform_valuerrs&& @r;_telegramize_command_mentionsrms@Xw9N# E@@ ( + +H ;;r=g4@cFV^8dQhR\R\\,/#)r?rrB)r r rE)rFs"r;rGrGsSXe_r=cLVfR#\V\4'dVP4#\V\4'dR#\V\\ 34'd.\ V4R8d\ V4R, #\ V4#\V\ 4'd9VP4pV'gR#\ V4pVR8d VR, #T#R# \dMi;i\P!T4P4# \dR#i;i)zBest-effort conversion of stored gateway timestamps to epoch seconds. Missing/unparseable -> None, so legacy transcripts keep auto-continuing instead of being dropped.Nld( g@@) rr timestamprmrQrErDr ValueError fromisoformat)rrQnumerics& r;_coerce_gateway_timestamprs }%""  %%#u&&(-e ~(EuU|f$W5QV<W%{{} DkG'.'?7V# LW L      ))$/99; ;  s*?CC C,+C,0#D D#"D#c$V^8dQhR\/#rrE)rFs"r;rGrGs,,,r=c^RIHpV!4#)zAuto-continue freshness window in seconds (non-positive disables the gate). Thin wrapper over ``gateway.session`` kept so ``gateway.run`` imports/test patches keep working.auto_continue_freshness_window)gateway.session_lifecyclerrs r;_auto_continue_freshness_windowrsI ) ++r=c$V^8dQhR\/#rr)rFs"r;rGrGskkUkr=c"\R\4#)zMax seconds ``_finish_startup_restore`` holds the inbound gate for boot auto-resume; <=0 disables. Duplicate-agent safety does NOT depend on it: ``_schedule_resume_pending_sessions`` claims SYNCHRONOUSLY. $HERMES_STARTUP_RESTORE_DRAIN_TIMEOUT) _float_env+_STARTUP_RESTORE_DRAIN_TIMEOUT_SECS_DEFAULTrr=r;#_startup_restore_drain_timeout_secsrs <>i jjr=c$V^8dQhR\/#rr)rFs"r;rGrGs]]e]r=c"\R\4#)zMax seconds the boot warm-up (``_warm_turn_prerequisites``) may hold the inbound gate shut. On timeout the gate opens and the warm-up finishes in the background. Non-positive disables it.HERMES_STARTUP_WARMUP_TIMEOUT)r$_STARTUP_WARMUP_TIMEOUT_SECS_DEFAULTrr=r;_startup_warmup_timeout_secsr s 57[ \\r=c$V^8dQhR\/#rrQ)rFs"r;rGrGs&&3&r=cj^RIp^RIpRp^RIHp^RIHp\ V!V!4R44pTPVRR7p^RIHpV!4PR 4p\V\4'dVPR R4'd^R IHpV!4\!4p\P#R VP$VP&VP(4\+V4# \d\PRRR7Li;i \d\PR RR7LWi;i)uSynchronously initialize first-turn prerequisites (executor thread); returns the schema count. Covers the lazy init seen in skeleton turns: ``run_agent`` import graph, tool schemas (+ ``check_fn`` TTL cache), the local Python toolchain probe (#106064), and the default route's context-window metadata (#105986) — a catalog HTTP probe that must not sit between the first inbound turn and its inference request. Context files remain lazy because they need the active turn's agent.Nload_config_readonly)_get_platform_toolsclizAplatform toolset resolution failed; warming the full tool surfaceTrG)enabled_toolsets quiet_moderenvironment_probe)get_environment_probe_linez*Model context warmed: %s -> %d tokens (%s)z(model-context warm-up failed (non-fatal)) run_agent model_toolshermes_cli.configrhermes_cli.tools_configrsortedrLrMrNget_tool_definitionsr~rrtools.env_prober_resolve_gateway_model_contextinfomodelcontext_lengthcontext_sourcerU) rrrrr tool_defs agent_cfgrctxs r;_warm_turn_machinery_syncr$s i:?!"56J6Le"TU00BR_c0dI6$&**73I i & &)--8KT*R*R ?"$P-. @#))SM_M_adasast y>' i Xcg hi" P ?$ OPs$#C%AD %"D  D  "D21D2chV^8dQhR\R\\\\3,,/#)r?rrB)r r rrD)rFs"r;rGrGs'#(5c?";r=c\V\4'dl\V4^8Xd\\;QJdRV4F 'dK RM RM !RV44'd"\ \\ \ 3,V4#R#)z*info* as a (thread_id, initial_name) pair, or None if it isn't one. The pair crosses the relay connector boundary, so its shape is the connector's word, not ours.c3B"TFp\V\4xK R#5ir)rrD)rxs& r;r"_as_thread_info..s9[VZQR*Q:L:LVZsFTN)rrrUallrrD)rs&r;_as_thread_infor+sU$3t9>cc9[VZ9[ccc9[VZ9[6[6[E#s(OT** r=c<V^8dQhR\R\R\/#)r?namerrBrC)rFs"r;rGrGs!S5Ur=c\PPV4pVeVR8Xd \V4#\V4# \\ 3d\T4u#i;i)zcRead an env var as float; unset/empty/malformed fall back to ``default`` (never crash the gateway).r)rrr~rE TypeErrorr)r-rraws&& r;rrsV **.. C {cRiW~Sz z "W~s AA! A!c LV^8dQhR\R\R\R\RR/#)r?rdesc provenance debug_labelrBN)r rDr))rFs"r;rGrGs411 11'91HK1PT1r=c~VPWR7R# \d\PTRR7R#i;i)zJBest-effort activity provenance stamp for hygiene compression transitions.)r3TrGN)_touch_activityrLrMrN)rr2r3r4s&&&&r;%_stamp_hygiene_compression_provenancer7s71 d: 1 [4 01s "<<now window_secsctV^8dQhR\R\\,R\\,R\/#)r?rr8r9rB)r r rErm)rFs"r;rGrGs4 ) )  )  )=Ee_ )X\ )r=cVe \V4M\\4pV^8:dR#\V4pVfR#Vf\P!4MTpWT, V8*#)zfTrue when an interruption marker is fresh enough to auto-continue (unknown timestamps count as fresh).T)rE%_AUTO_CONTINUE_FRESHNESS_SECS_DEFAULTrr)rr8r9rrcurrents&$$ r;_is_fresh_gateway_interruptionr>sW$/#:U; Fk@lF {)%0I [diikcG  & ((r= interactivec^V^8dQhR\\,R\R\R\/#r?rorr?rBr rDrm)rFs"r;rGrGs0(1(1 SM(1$'(1>B(1NQ(1r=cVR8XdRM VR8XdRMRpV'dRpRpMV'dRpRpMR pR pR V R V R V R2V'd RV 2,#R,#)uBuild the resume-pending recovery system note for an interrupted turn (empty ``message`` = auto-resume). Interactive platforms report the restore and ask what next; non-interactive ones finish the work. On non-interactive event platforms (webhook, API server — adapters with ``interactive_resume = False``) nobody can answer; the resumed turn must instead complete the interrupted work, or the task is silently abandoned behind a "restored" acknowledgement that goes nowhere (#57056). restart_timeoutza gateway restartshutdown_timeoutza gateway shutdownza gateway interruptionzTAddress the user's NEW message below FIRST and focus on what the user is asking now.u\Do NOT re-execute old tool calls — skip any unfinished work from the conversation history.zfReport to the user that the session was restored successfully and ask what they would like to do next.zNo user is present on this non-interactive platform, so do NOT emit a 'session restored' acknowledgement or ask questions. Review the conversation history and CONTINUE the interrupted task to completion.uDo NOT re-run tool calls whose results already appear in the history — resume from the first step that has no recorded result.z3[System note: The previous turn was interrupted by u; the gateway is now back online. Any restart/shutdown command in the history has already run — do NOT re-execute or verify it.  ] rr)rorr? reason_phraseresume_guidance tail_guidances&&$ r;build_resume_recovery_noterLs &)::%+/A%A !G_ b  k   D  k   ;   `  > /33B2C1]OST V 'T'   01 -/  01r=c V^8dQhR\\,R\\,R\R\\\3,/#rA)r rDrmr)rFs"r;rGrG:s@-- SM-$,SM-CG-SXY\^aYaSb-r=c\Y;'gRVR7p\V\4'dVP4'dTMTpW43#)uReturn the recovery message and the user text to persist. Empty original: persist the note (a "" user row trips the pre-call sanitizer). Real text: persist clean. Resume turns replace the startup event's text with a recovery note before entering the agent. When the original message is empty (the synthesized auto-resume turn), persist the note too — persisting the empty string left a blank user row in state.db that the pre-call sanitizer re-healed on every later call forever (#86580). When the user sent REAL text while the resume was pending, keep persisting their clean words: the transcript stays scaffold-free (the model still receives the wrapped note), and a non-empty row never trips the sanitizer. r)r?)rLrrDr)rorr?recovery_messagepersist_messages&&$ r;_prepare_resume_pending_messagerQ:s?2&--RU`a!+GS!9!9gmmoogScO  ,,r=c V^8dQhR\R\R\\\3,R\R\\\3,/#)r?rolermsgpreserve_timestamprB)rDr rrm)rFs"r;rGrG`sD11 11"&sCx.1FJ1 #s(^1r=cRVRV/pVPR4pVR 9d8\V\4'd"V'dWPR48XdWTR&VR8XdA\F6pWb9dK VPV4pVR8XdVf MV'gK2WtV&K8 V'd$VPR4'd VR,VR&VP \ V44\ \\3Uu/uFqV9gK WV,bK upV4VPR4'dRVR&\\\3F&p VPV 4'gKW),WI&K( V#uupi) aBuild a replay entry for a non-tool-calling message, preserving ``_ASSISTANT_REPLAY_FIELDS``. ``preserve_timestamp``: only user rows need it (stale-dangerous-confirmation stripper). Falsy fields are dropped EXCEPT ``reasoning_content``: DeepSeek/Kimi treat "" as a sentinel; dropping it can 400. Empty values: most fields are dropped when falsy (matching the original PR #2974 behaviour) since an empty list/string for those carries no information. The exception is ``reasoning_content``: DeepSeek/Kimi thinking-mode replay treats an empty string as a meaningful sentinel that ``_copy_reasoning_content_for_api`` upgrades to a single space. Dropping it here would make the gateway send no ``reasoning_content`` at all on the next turn, which can cause HTTP 400 from strict thinking providers. rSr api_content assistantreasoning_contentr _db_persistedT)userrX) r~rrD_ASSISTANT_REPLAY_FIELDSupdater&r$r#r"rrr) rSrrTrUr_sidecar_rkey_rvalkeystamps &&&& r;_build_replay_entryrc`sM$T9g>Eww}%H %% x % %  wwy) )'m {-EGGENE"'+>">  %L .cggk22 -k LL*3/0KAV3Wf3WCbe[e-#3x-3Wfhmn ww!%o&';=QR 775>>:ELS Lgs 5E0 E0zobserved Telegram group contextz>[Observed Telegram group context - context only, not requests]zh[Current addressed message - answer only this unless it explicitly asks you to use the observed context]cFV^8dQhR\\,R\/#)r?channel_promptrBrB)rFs"r;rGrGs"__(3-_D_r=c:\T;'d \V94#)zReturn True for Telegram group turns that may include observed chatter. Observed rows must not replay as ordinary user turns, or a weak wake word makes old chatter look like work. )rm(_TELEGRAM_OBSERVED_CONTEXT_PROMPT_MARKER)res&r;%_uses_telegram_observed_group_contextrhs ]]#K~#] ^^r=cFV^8dQhR\R\\,/#)r?r0rBr rrD)rFs"r;rGrGs"JJSJSXJr=cVf \4#\V\4'dKVUu0uF=p\V4P 4'gK$\V4P 4kK? up#\V4P R4Uu0uF*qP 4'gKVP 4kK, up#uupiuupi)zDNormalize a config list or comma-separated scalar into a string set.,)rrrrDrr)r0rs& r;_csv_or_list_to_setrms {u #t.1GcdSY__5F!D !cGG%(X^^C%8 I%8TJJLLDJJL%8 IIH Is!B>B> C'CcRV^8dQhR\R\R\\,/#)r?rrrBrj)rFs"r;rGrGs($$$c$UXY\U]$r=cbRpVe2\\VRR4RR4;'g/PR4p\VR/4P\P4pVf%Ve!Vf\VR/4PR4pVf^RIHpV!R4;'gRp\ V4#)aZReturn Slack channels that the generic gateway must never dispatch. Duplicates the adapter's drop as a fail-safe so bypasses can't reach auth, pairing or sessions. ``adapter`` is the source's routed adapter: under multiplex ``config`` is the DEFAULT profile's GatewayConfig, so a secondary Slack bot's list lives only in its adapter's ``extra``.Nrextraignored_channelsr)platform_gate_envSLACK_IGNORED_CHANNELS)r8r~PlatformSLACKgateway.platforms._sharedrrrm)rrr0r_platform_gate_envs&& r;+_slack_ignored_channels_from_gateway_configrxs Cww$7$GMM2RRSef6;377GL {|/GOlGR0445GH { V !9:BBd s ##r=c0V^8dQhR\R\/#)r?rrBr)rFs"r;rGrGs<user.rXrW)rr~rDrm)rSrrTs&&&r;_has_replayable_sidecarrsZ  ) )K ) ) sww}-s 3 ) ) ' ( r=reinject_timestampsc V^8dQhR\\\\3,,R\\,R\ R\ \\\\3,,\\,3,/#)r?rrerrB)rrrDr r rmr)rFs"r;rGrGs^I+I+ $sCx. !I+6>smI+I+(-d4S>.BHSM.Q(RI+r=c,^RIHp^RIHpHpV!4p.p.p\ V4p T;'g.EFp V P R4p V 'dV R9dK&V P R4p V 'dV P R4'dqV R8XdjV 'dbV'd0\V \4'dV!WP R4VR7p VP\V 4P44KR V 9gR V 9gV R 8XdAV P4U Uu/uFwrV R9gKWbK pp pVPV4EKV 'g\WV 4'gEK8V P R4pV R8XdH\V \4'd'V!WR7wpp\V4pVV8wd Tp VeTpV 'gEK\WWR8HR 7pV'dV R8Xd\V \4'dy\V 4'ghV!V VVR7pVP R4pVV 8wd@V'd8VV8Xg1VP!VR,4'gVP#RR 4VVR&V P R4'd7V P RR4pRV RVR, 2VR&VP#RR 4VPV4EK \%V4pRP'V4P4;'gR pVV3#uupp i)zConvert stored gateway transcript rows into agent replay messages. Observed context stays out of ``conversation_history`` so consecutive-user repair can't merge it in.) get_timezone)"render_user_content_with_timestamp strip_leading_message_timestampsrSrobservedr[r)tz tool_calls tool_call_idtoolN)rUrWrHmirror mirror_sourcezanother sessionz[Delivered from z] r>system session_meta>rr) hermes_timergateway.message_timestampsrrrhr~rrDrsritemsr_strip_auto_continue_noisercr%rpopcanonicalize_replay_historyr)rrer _get_msg_tz_render_msg_ts _strip_msg_ts_msg_tz agent_historyobserved_group_contextseparate_observed_contextrTrSrkr  clean_msgreplay_timestamprembedded_timestamp clean_bodyrrenderedsidecar mirror_srcobserved_contexts&$$ r;_build_gateway_agent_historyrs 8 mG*,M(* En U}}"}wwvt99 '')$ $)<)<T[ Z%=%=(''+2F7S " ) )#g,*<*<*> ?  3 .C"746>*-))+\+$!B[9[+I\   + /sCC"ww{3 v~gs++/O+P+PIImT2#+i wwx   WW_6GH %5j\E)DTCU#Vi  -.   'aj0 >Myy!78>>@HHD * **S]s  L/Lc V^8dQhR\\\\3,,R\R\\\\3,,/#)r?persisted_history live_historyrB)rrrDr )rFs"r;rGrG3s?DcN+;>CGSRUXCWr=c a\V\4'dm\V4\V48dT^RIHo\ ;QJdV3RlV4F 'gK RM RM!V3RlV44pV'd \V4#V#)aPrefer the cached live transcript only when it is longer AND has a real, non-ephemeral unpersisted row. Guards FTS write-corruption amnesia (stale reload while the cached agent holds unpersisted rows). Length alone is not enough: a longer all-durable list can be an expected replay-filtering delta. Guards the FTS write-corruption case (#50502): when message writes fail silently through corrupt FTS triggers, the next turn reloads a stale/empty ``conversation_history`` from disk even though the same cached ``AIAgent`` still holds unpersisted real rows in ``_session_messages``. Replacing those rows with the shorter persisted copy causes immediate same-session amnesia. Length alone does not trigger retention. )_is_ephemeral_scaffoldingc3<"TFHp\V\4;'d,VPR4'*;'dS!V4'*xKJ R#5i)rZNr)rrrs& r;r/_select_cached_agent_history..CsR"TFR7 w % 7 7gkk/.J*J 7 7-g66 7FRsAAATF)rrrUagent.session_persistencerany)rrhas_unpersisted_rowrs&& @r;_select_cached_agent_historyr3so,%%#l*;cBS>T*TG!c"TFR"Tccc"TFR"TT  % % r=cRV^8dQhR\R\\,R\/#)r?rrrB)r r rD)rFs"r;rGrGKs)PXY\P]ber=cV'gV#\ RV R\ R2p\V\4'dV V 2#\V\4'dVUu.uF&p\V\ 4'd \ V4MTNK( ppVFNp\V\ 4'gKVP R4R8XgK3V VP RR4 2VR&Vu# RRRVP4/.V,#V#uupi)zDPrepend observed Telegram context to the API-only current user turn.rrHr5rQr)_OBSERVED_GROUP_CONTEXT_HEADER!_CURRENT_ADDRESSED_MESSAGE_HEADERrrDrrr~r)rrrlrwrappeds&& r;+_wrap_current_message_with_observed_contextrKs ./r2B1C4HiGjjl mF'3'##'4  NUVgdD$!7!74:TAgVD$%%$((6*:f*D"($((62*>)?@V 9:WDD NWs,C4c~V^8dQhR\\\\\3,,,R\/#)r?rrB)r rrrDr )rFs"r;rGrG`s,d38n1E(F3r=cV'gR#\V4FWp\V\4'gKVPR4pV'dVR9dK=VPR4pVeVu#R# R#)uReturn the ``timestamp`` of the last usable (non-metadata) transcript row, if any. ``None`` when the last usable row has no timestamp — callers treat that as "fresh" (legacy rows).NrSr>rr)reversedrrr~)rrTrStss& r;_last_transcript_timestampr`sd  #t$$ wwvt99  WW[ ! >I! r=)rz [System note: Your previous turnzystem note: A new messagec0V^8dQhR\R\/#r?rrBr)rFs"r;rGrGsFFSFTFr=ch\V\4;'dVP\\34#)zdReturn True if this user-message content is a gateway-injected auto-continue note (never replay it).)rrDr_AUTO_CONTINUE_NOTE_PREFIX_AUTO_CONTINUE_FALLBACK_PREFIX)rs&r;_is_auto_continue_noisers5 gs # F F(:(: #%CD)FFr=c0V^8dQhR\R\/#rr )rFs"r;rGrGs    r=c\V4'gV#\V4p\V4'd6VPR4pV^8dR#W^,RP4pKFV#)zdStrip leading persisted auto-continue notes from user text; the trailing real question is preserved.rGrN)rrDfindlstrip)rrQends& r;rrsX "7 + + w"9+479+!#9+27S 42H9+r=cT;'g \4pV'd\V4V8dWRMTp\V4p.pRpVEFpVPR4R9dK\ VPR4;'gVPR4;'gR4pVPV4\ 9dKu\ VPR4;'gR4p VPV4p V R8XdR V 9d\ P!V 4p \V \4'dV PR 4'ds\Fhp V PV 4p \V \4'gK,\PR V 24'gKLW9gKTVPR V 24M EKqR V 9dEK{\PV 4FWpVP!^4P#4P%R 4p V 'gK;W9gKCVPR V 24KY R V 9gEKR pEK WV3# \dRp EL@i;i)aCollect real media tags from current-turn producer-tool results only. Producer allowlist: docs/logs/search results contain example MEDIA: strings that must never become attachments. If mid-run compression shrank the list below the history length the slice is untrustworthy, so scan every message (dedup via history_media_paths). 1. Producer-tool allowlist: only tools that intentionally emit deliverable artifacts (TTS) are eligible. (Fixes the original report behind #16721.) 2. Current-turn isolation: only messages produced this turn are scanned, so a tool result from an earlier turn (still present in the full message list) cannot leak onto a later text-only reply (#34608). When that happens the slice boundary is no longer trustworthy, so fall back to scanning every message and rely on ``history_media_paths`` for dedup, preserving the compression-safe behaviour of #160. The producer-tool allowlist still applies on the fallback path. NFrSrcall_idrrimage_generateMEDIA:r",}[[audio_as_voice]]T)rfunction)rrU_tool_name_by_call_idr~rD_AUTO_APPEND_MEDIA_TOOL_NAMESjsonloadsrLrr_JSON_MEDIA_TOOL_PATH_FIELDS_TOOL_MEDIA_RE fullmatchrsfinditerrrr)rrr new_messagesr media_tagshas_voice_directiverTrr tool_namepayloadfieldrrs&&& r;_collect_auto_append_media_tagsrs".66%#h->*I_-OW1>J 776?"6 6 cggn-II1CIIrJ  # #G ,4Q Q cggi(..B/(,,W5 ( (XW-D **W-'4((W[[-C-C9E";;u-D"4-- . 8 86$ I I $ ?"))F4&/: :  7 " #,,W5E;;q>'')007Dt7!!F4&/26 7 *"& =@  **)  s=I IIchV^8dQhR\\\\3,,R\/#)r?rrB)rrrDr r)rFs"r;rGrGs'((T#s(^0D((r=ca \4o \V4pRV 3RllpVEFMpVPR4pVR 9dK\VPRR4;'gR4pRV9d V!V4KTVR8XdK]\VPR4;'gVPR 4;'gR4pVPV4R 8XgK\P !V4p\V\4'gKVPR 4'gK\FIpVPV4p \V \4'gK,V 'gK6S PV 4EKK EKP S # \ dR pLi;i)zDedup set of media paths already delivered (JSON-payload and assistant-message shapes alike). Missing the JSON-payload shape caused #46627; missing the assistant-message shape caused repeated delivery when the model echoed a previous MEDIA tag. c(V^8dQhR\RR/#)r?rrBNr_)rFs"r;rG2_collect_history_media_paths..__annotate__s>>s>t>r=c2<\PV4FLpVP^4P4P R4pV'gK;SP V4KN \ P!V4wr4SPRV44R#)rrc3*"TF wrVxK R#5irr)rr _is_voices& r;rN_collect_history_media_paths.._add_text_media_paths..s=odTsN) rrrrrrBasePlatformAdapter extract_mediar])rrr media_files_pathss& r;_add_text_media_paths;_collect_history_media_paths.._add_text_media_pathsso#,,W5E;;q>'')007Dt $6 -::7C  ===r=rSrXrrrrrrNr)rXrr) rrr~rDrrrLrrrr) rrrrTrSrcidrrjprs & @r;_collect_history_media_pathsrsE E0?>>wwv 8 8 cggi,223 w  !' *  ;  #''.)EESWWY-?EE2F  # #C (,< < **W-'4((W[[-C-C9E U+B!"c**rr "  :#, L  sE66 FFc0V^8dQhR\R\/#r? platform_namerBr_)rFs"r;rGrGs[[[[r=cT^RIHpV!V4;'gVP4 R2#)z]Home-target env var: the plugin's ``cron_deliver_env_var``, then ``_HOME_CHANNEL``.)_resolve_home_env_var _HOME_CHANNEL)cron.scheduler_deliveryrupper)rrs& r;_home_target_env_varr s+>  / Z Zm6I6I6K5LM3ZZr=c0V^8dQhR\R\/#rr_)rFs"r;rGrGs>>>>r=c\V4 R2#)zDReturn the optional thread/topic env var for a platform home target. _THREAD_ID)r )rs&r;_home_thread_env_varrs"=1 2* ==r=c$V^8dQhR\/#rr)rFs"r;rGrGs<Rs 45K')H8n}4  6A6H6H6J6J%k2PRCGGG$ "IW[A\A\9==#=ggbfgg ryy)@A BB  C s#B99 C C )asynccontextmanagercontextmanagerr}c]tRtRtRtRtR#)MultiplexConfigErroriizInvalid profile multiplexer config: the operator must fix config.yaml, so it propagates to the startup guard instead of being treated as retryable adapter-connect noise.rNr6 __module__ __qualname____firstlineno____doc____static_attributes__rr=r;rBrBisRr=rBc]tRtRtRtRtR#)HygieneTurnHoldExceededinzHygiene-compression turn-hold budget elapsed mid-stream. Availability boundary, not a failure: must NOT take the idle-timeout path (AGENT_COMPRESSION_TIMEOUT, "no output", failure cooldown).rNrCrr=r;rJrJnsgr=rJchV^8dQhR\R\\\\3,,/#r?rrBobjectrrrDr)rFs"r;rGrGss(33V3U395E0F3r=cj\VRR4pVe \V4#^RIHp\V!RR74#)a The profile set this multiplexer SERVES: the process reservation once boot took it (grown and shrunk by the hot-serve reconcile, which diffs it against what exists under ``profiles/`` via ``profiles_to_serve``), else the live directory read for pre-reservation callers._runtime_profile_homesN)profiles_to_serveT) multiplex)r8rhermes_cli.profilesrQ)rreservedrQs& r;_multiplex_profile_homesrUss7v7>HH~5 !D1 22r=chV^8dQhR\R\\\\3,,/#rLrM)rFs"r;rGrG~s(VU395E0Fr=ca^RIHpHp\V4pV!4;'gRo\;QJdV3RlV4F 'gK RM RM!V3RlV44'dV#VSV!S43.,# \ dTu#i;i)a{Profile homes the in-process ticker visits: the served set PLUS the process-active profile: ``profiles_to_serve`` lists default + every live named profile, but a ``--profile `` gateway's own profile may sit outside ``profiles/`` (custom HERMES_HOME). One host process ticks all of them regardless of ``gateway.multiplex_profiles``. Adapter startup already skips ``active``.)get_active_profile_nameget_profile_dirrc32<"TF wrVS8HxK R#5irr)rr-_homeactives& r;r+_cron_tick_profile_homes..s 3Ukd46>UsTF)rSrXrYrUrrL)rrXrYhomesr\s& @r;_cron_tick_profile_homesr_~sz M $V ,E $ & 3 3)F s 3U 3sss 3U 333 !89:::  s)A;; B  B c<V^8dQhR\R\R\/#)r?r-r+rB)rDrrm)rFs"r;rGrGs&__S___r=cFa^RIHoHpV!\V4RV3RlR7pTP;'d9TPRJ;'d#TP\P!48g'*# \d"p\ P RY4Rp?R#Rp?ii;i)ugTick ``home`` this cycle unless ANOTHER gateway process owns it. Same stand-down the serve/Desktop ticker applies (``hermes_cli/web_server.py``): a host that has not finished converging onto the one host gateway (``hermes gateway migrate --multiplex``) may still run profile B's own gateway, and without this both it and this process race B's ``cron/.tick.lock``. The lock stops a simultaneous double-run but not the race: when this process wins, B's delivery leaves through ``SharedRouteAdapters``/fail-closed instead of B's live adapters. The liveness answer is compared against our OWN pid, never used bare: this process holds the launch home's ``gateway.pid`` and publishes every served profile in ``served_profiles``, so a bare ``_check_gateway_running`` reports "running" for every home we serve — standing us down from all of them and stopping cron host-wide. )get_running_pidresolve_gateway_livenessFc<S!VRR7#)F) cleanup_staler)rrbs&r;r$_cron_profile_gate..s ?4u#Mr=) profile_dir use_cache pid_probez6Cron profile gate probe failed for %s (ticking it): %sNT) gateway.statusrbrcrrLrMrNrunningpidrgetpid)r-r+rclivenessrYrbs&& @r;_cron_profile_gaterosI+T eMO   ]]X\\%=]](,,RTR[R[R]B] ^^  MtYsA44 B ?BB c0V^8dQhR\R\/#rL)rNrm)rFs"r;rGrGs&Tr=c\VRR4'gR#^RIHpT!\V4UUu.uFwr#VNK upp4#uuppi \d\ P RRR7R#i;i)uRoute agent.log/errors.log/gateway.log records to their owning profile (inert single-profile). ``setup_logging(mode="gateway")`` binds file handlers to the launch home, so under multiplexing every secondary profile's records would land in the default profile's logs. Swap the static handlers for the profile routers from #99440 — the same primitive the Desktop cron ticker uses — once the served-profile set is known. Inert for single-profile gateways (``enable_profile_log_routing`` is a no-op below two homes). multiplex_profilesF)enable_profile_log_routingz(could not enable per-profile log routingTrG)r8hermes_loggingrsrUrLrMrN)rrs_namer+s& r;_enable_multiplex_log_routingrvsj 6/ 7 7=)C[\bCc*dCcKE4Cc*dee*d  ?$ Os!A A AA"A.-A.c0V^8dQhR\R\/#r?runnerrBrNr)rFs"r;rGrGs&Tr=cR .p\VRR4pVeO\VRR4'd<\V4F,wr4VeV'dVR8XdKVPW434K. V# \d\P RRR7T#i;i) a``(profile_name, home)`` pairs whose ``state.db`` the watcher must poll; ``(None, None)`` = root poll, always first. ``/handoff`` writes into the store of the profile the CLI ran under; an unscoped watcher polls only the ROOT store, so a secondary profile's handoff would never be seen (CLI times out). A raising resolver degrades to the root poll rather than silently disabling the watcher.NrrrFrz5Could not resolve multiplex homes for handoff watcherTrGNN)r8rUrsrLrMrN)ryscopesrr-r+s& r;_handoff_watch_scopesr~s !>F]40  '&2F"N"N6v> .s.Cs!s1vvsr)r8rOrLrMrNrrUr)ryreclaimidss& r;_reclaim_stalersgfmT:<\^bcG G   dff   s8TYY.Cs.C%C E f  3d Cs=,B, BBBB,:B,B"B)%B,(B))B,c0V^8dQhR\R\/#)r?rrBr_)rFs"r;rGrGs,,,c,r=c^RIHpT!RT4# \d$\PP RT4u#i;i)zScope-aware TERMINAL_CWD read for footer/context surfaces. Only an import failure falls back: an active refusal scope must raise, not use the launch cwd.) terminal_env TERMINAL_CWD)tools.terminal_scoper ImportErrorrrr~)r_ts_envs& r;_terminal_scope_cwdrs?7@ >7 ++ 7zz~~ng667s +??c0V^8dQhR\R\/#)r? profile_homerBrr)rFs"r;rGrGs / /T /d /r=c^RIHpHp^RIHp^RIHpV!\V44pV!\V44V!\V44V!V4# T!T4i;i)z?Hydrate and load one profile's secrets under its home override.set_hermes_home_overridereset_hermes_home_override)hydrate_profile_secret_sourcesowner_secret_scope) hermes_constantsrrhermes_cli.env_loaderr!tui_gateway.launch_profile_policyrrDr)rrrrr home_tokens& r;_load_profile_secret_scopersKUDD)#l*;OP  R 5d<6H I I J  # | ,  ! &z 2 " J I  # | ,  ! &z 2 "s:C/CACB>C"C/> C CC,,C/c$V^8dQhR\/#)r?rr)rFs"r;rGrG/sTr=c"\P!\\V44GRjxL p\ \V4V4;_uu_4R5xRRR4R#L1 +'giR#;i5i)zEEnter a profile scope without loading secret files on the event loop.N)r to_threadrrr)rrs& r;_async_profile_runtime_scoper.sN%%&@$|BTUUG \ 2G < <  = <V < < identical to ``load_gateway_config()``. See #64674. The probe load above only decides whether this process is a multiplexer. The primary config is the scoped reload: multiplex must already be active (a scope miss must not fall through to the launching profile's ``os.environ``) and the home must be the default root, not ``get_hermes_home()`` — a named launcher's home is not the owner of the primary adapter map. log_multiplex_decisionresolve_multiplex_modeset_multiplex_activeTz9could not set multiplex-active before primary config loadrG)get_default_hermes_rootNzAmultiplex default-scope config reload failed; using unscoped load)!hermes_cli.gateway_multiplex_moderrload_gateway_configrrr&rrLrMrNrrrr)rrr5rrr+scopeds r;load_gateway_config_for_runnerr6s a  C1#67  ! ! ! a;T"<&( #DJ / /(*F0 !$ 6 6F M a P[_ `a  0 /  Xcg h sSB B=C#/ C:C#"B:9B:= C  C  C C# C##$D  D c(V^8dQhR\RR/#)r?rrBNr)rFs"r;rGrG_sjjfjjr=c "^RIHp^RIHp\P !4pV!4;_uu_4\ VRR4'g9VPR\4PV4GRjxL RRR4R#\V4FXwrE\\V44;_uu_4VPR\4PV4GRjxL RRR4KZ RRR4R#LL +'giK{;i \d\PRTRR7Ki;i +'giR#;i5i) uYRun startup MCP discovery for every profile this gateway serves: ``discover_mcp_tools`` reads ``mcp_servers`` from ``get_hermes_home()``'s config, so an unscoped call only connects the launch profile's servers (single-profile gateways keep the unscoped call). Under multiplex, run it once per served profile inside that profile's ``_profile_runtime_scope`` and carry the scope into the executor thread with ``copy_context()`` (the same shape as ``_run_in_executor_with_context``). See #95518. No gateway run can complete a browser OAuth flow (nobody watches its stdout; on Windows its DEVNULL stdin even passes ``isatty``), so discovery runs with interactive OAuth suppressed — the same gate the CLI's background discovery uses. An expired token then parks the server with an actionable ``hermes mcp login`` warning instead of opening an authorize tab. )suppress_interactive_oauth)discover_mcp_toolsrrFNz*MCP tool discovery failed for profile '%s'TrG)tools.mcp_oauthrtools.mcp_tool_discoveryrrrr8rrrrUrrrLrMr)rrrr? profile_namers& r;_discover_gateway_mcp_toolsr_s;;  # # %D # % %v3U;;&&t\^-?-?AST T T  & %+C6*J &L j+D,>??..t\^5G5GI[\\\@?+K & % T ]@?? jK\dhi j & % %s1E.s4b''R(..00.+):(?P/[^:]+?)(?::(?P[^:]+))?$z/outputz/outputs)DEFAULT_CONFIGrgateway_turn_lease_timeoutHERMES_TURN_LEASE_TIMEOUTgateway_timeoutHERMES_AGENT_TIMEOUTgateway_timeout_warningHERMES_AGENT_TIMEOUT_WARNINGgateway_notify_intervalHERMES_AGENT_NOTIFY_INTERVALsession_stall_timeoutHERMES_SESSION_STALL_TIMEOUTrestart_drain_timeoutHERMES_RESTART_DRAIN_TIMEOUTcron_drain_timeoutHERMES_CRON_DRAIN_TIMEOUTgateway_auto_continue_freshnessHERMES_AUTO_CONTINUE_FRESHNESS%gateway_startup_restore_drain_timeoutrgateway_startup_warmup_timeoutrcjk_ftsHERMES_CJK_FTSsearch_slow_msHERMES_SEARCH_SLOW_MSbusy_input_modeHERMES_GATEWAY_BUSY_INPUT_MODEbusy_text_modeHERMES_GATEWAY_BUSY_TEXT_MODEbusy_ack_enabledHERMES_GATEWAY_BUSY_ACK_ENABLEDcVV^8dQhR\R\\\3,RR/#)r?sectionmappingrBN)r rrD)rFs"r;rGrGs)< "None" would map to the unlimited sentinel rather than "absent = default".r9Nr:)rrrDrr)r"r0s& r;r1r1s[ i & &+Y*F K C .1#h *+ BJJ . JJ. / /r=c(V^8dQhR\RR/#)r? _terminal_cfgrBNr&)rFs"r;rGrGs2a2a$2a42ar=cj\VPR4;'g*\PPR4;'gR4P 4P 4p/RRbRRbRRbRR bR R bR R bRRbRRbRRbRRbRRbRRbRRbRRbRRbR R!bR"R#b/R$R%bR&R'bR(R)bR*R+bR,R-bR.R/bR0R1bR2R3bR4R5bR6R7bR8R9bR:R;bRR?bR@RAbRBRCbCpVP 4Fwr4W09dK W,pVR8Xdg\V4RE9dK.\V\4'd?\WP 44'g \PPV4p\V\\34'd\P!V4M \V4\PV&K RD#)Fz]Bridge nested ``terminal.*`` config to TERMINAL_* env vars (config.yaml overrides .env here).backend TERMINAL_ENVr degraded_modeTERMINAL_DEGRADED_MODEcwdrrTERMINAL_TIMEOUT home_modeTERMINAL_HOME_MODElifetime_secondsTERMINAL_LIFETIME_SECONDS docker_imageTERMINAL_DOCKER_IMAGEdocker_forward_envTERMINAL_DOCKER_FORWARD_ENV modal_imageTERMINAL_MODAL_IMAGE daytona_imageTERMINAL_DAYTONA_IMAGEvercel_runtimeTERMINAL_VERCEL_RUNTIME vercel_imageTERMINAL_VERCEL_IMAGEssh_hostTERMINAL_SSH_HOSTssh_userTERMINAL_SSH_USERssh_portTERMINAL_SSH_PORTssh_keyTERMINAL_SSH_KEY container_cpuTERMINAL_CONTAINER_CPUcontainer_memoryTERMINAL_CONTAINER_MEMORYcontainer_diskTERMINAL_CONTAINER_DISKcontainer_persistentTERMINAL_CONTAINER_PERSISTENTdocker_volumesTERMINAL_DOCKER_VOLUMES docker_envTERMINAL_DOCKER_ENVdocker_extra_argsTERMINAL_DOCKER_EXTRA_ARGSdocker_shm_sizeTERMINAL_DOCKER_SHM_SIZEdocker_mount_cwd_to_workspace&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACEdocker_networkTERMINAL_DOCKER_NETWORKdocker_run_as_host_user TERMINAL_DOCKER_RUN_AS_HOST_USERdocker_snap_compatTERMINAL_DOCKER_SNAP_COMPATdocker_persist_across_processes(TERMINAL_DOCKER_PERSIST_ACROSS_PROCESSESdocker_shared_container_key$TERMINAL_DOCKER_SHARED_CONTAINER_KEYdocker_orphan_reaperTERMINAL_DOCKER_ORPHAN_REAPER sandbox_dirTERMINAL_SANDBOX_DIRpersistent_shellTERMINAL_PERSISTENT_SHELLN>.r auto)rDr~rrrrrrr+r expanduserrrrdumps)r_terminal_backend_terminal_env_map_cfg_key_env_var_vals& r;_bridge_terminal_config_to_envrOs)$LL ~(FLL"NNSegV[V[V]!9>!91!9 ~!9 % !9 ) !9 7 !9 /!9 ;!9 -!9 1!9 3!9 /!9 '!9 '!9 '!9 %!!9" 1#!9$ 7%!9& 3'!9(  ?)!9* 3+!9, +-!9. 9/!90 51!92 ()Q3!94 35!96 "#E7!98 ;9!9: *+U;!9< &'M=!9>  ??!9@ -A!9B 7C!9D0557  ( & u 4y00$$$-EFWYcYcYe-f-fww))$/3=dT4L3Q3Qtzz$/WZ[_W` 88r=c(V^8dQhR\RR/#)r?_auxiliary_cfgrBNr&)rFs"r;rGrGsEEDETEr=c\RR0p^RIHpV!4FpVPVR,4K VFpVP V/4p\ V\ 4'gK-VP4p\VP RR44P4pV'dVR8wdV\PRV R 2&R FQwr\VP VR44P4p V 'gK8V \PRV R V 2&KS K R # \dLi;i) z^Bridge auxiliary model/endpoint overrides (vision, approval, plugins); compression reads yaml.visionapproval)get_plugin_auxiliary_tasksraproviderrrG AUXILIARY_ _PROVIDERrN))rMODEL)base_urlBASE_URL)rAPI_KEY) hermes_cli.pluginsrUrrLr~rrr rDrrr) rQ_aux_bridged_keysrU_entry _task_key _task_cfg_upper_prov_field_suffix_values & r;_bridge_auxiliary_config_to_envrgs !:. A02F  ! !&- 03' "&&y"5 )T** "IMM*b1288: Uf_9>BJJF895 6eOFvr2399;Fv>D Zxq :; f'    s,D D+*D+c(V^8dQhR\RR/#)r?_cfgrBNr&)rFs"r;rGrGs*r*r*r*rr=crVP4F`wr\V\\\\ 34'gK-V\ P9gKD\V4\ PV&Kb VPR/4pV'd"\V\4'd \V4VPR/4pV'd"\V\4'd \V4VPR/4p\V4\V\4\VPR/4\4VPR/4p\V\ 4\V\4'd@RV9d9R\ P9d$\VR,4\ PR&VPRR 4pV'd8\V\4'd"VP#4\ PR &VPR /4p\V\4'dEVPR 4e2\VR ,4P%4\ PR&VPR/4p \V \4'd^RIHp V !V4V PR4p V e\V 4\ PR&RV 9d\\ PPRR 4P#4'g&\V R,4\ PR&R #R #R #R #)zGExport config.yaml settings to the env vars os.getenv() consumers read.terminal auxiliaryrr/rbusy_steer_ack_enabled%HERMES_GATEWAY_BUSY_STEER_ACK_ENABLEDtimezonerHERMES_TIMEZONEsecurityredact_secretsNHERMES_REDACT_SECRETSr9)apply_media_policy_envtrust_recent_files_seconds!HERMES_MEDIA_TRUST_RECENT_SECONDSplatform_connect_timeout'HERMES_GATEWAY_PLATFORM_CONNECT_TIMEOUT)rrrDrQrErmrrr~rrOrgr1r2_AGENT_ENV_BRIDGEr3_DISPLAY_ENV_BRIDGErrgateway.media_policyrt) ri_keyrNrrQ _agent_cfg _display_cfg_tz_cfg _security_cfg _gateway_cfgrt_trust_recent_secondss & r;_bridge_config_to_envrsTjjl  dS#ud3 4 4RZZ9O"4yBJJt #HHZ,MM488&}5XXk2.N*^T::'7 '2&JZ(:'89488J35IJ88Ir*L<)<=<&&+C|+S7rzzI>A,OgBh>i :;hhz2&G:gs++(/  $%HHZ,M-&&=+<+<=M+N+Z.1-@P2Q.R.X.X.Z *+88Ir*L,%%?t$ , 0 01M N ,>ABW>XBJJ: ; &, 6 'PRTU[[]]DG UoHpDqBJJ@ A^ 7&r=c0V^8dQhR\R\/#)r?r4rBr)rFs"r;rGrGEs 3 3T 3d 3r=cD^RIHpV!4pVeV#^RIHpV!V4#)a$Effective USER config (no defaults) for the presence-sensitive env bridge: only keys the user or the managed layer wrote get bridged, else all of DEFAULT_CONFIG would be exported. A bypass worker bridges its frozen explicit snapshot instead: the profile file is exactly what it must not read.)worker_config_snapshotload_user_config_effective)agent.safe_worker_policyrhermes_cli.config_effectiver)r4rsnapshotrs& r;r0r0Es)@%'HF %k 22r=r.u. Warning: config.yaml → env bridge failed: : filezz Gateway will fall back to .env values, which may not match your current config.yaml. Run `hermes doctor` to investigate.)apply_ipv4_preferencenetwork force_ipv4rZz/ Warning: IPv4 preference application failed: )print_config_warningsz% Warning: config validation failed: )warn_deprecated_cwd_env_varsz% Warning: deprecation check failed: HERMES_QUIET)CWD_PLACEHOLDERS resolve_placeholder_terminal_cwd)ChannelOverridertrr_getenvr)AsyncSessionStore SessionStore SessionSourceSessionContextbuild_session_key"profile_from_session_key_namespace)DeliveryRouter)SessionTurnLeaseRegistry) SessionStatelegacy_dict_propertylegacy_lease_token_property)GatewayAuthorizationMixin)GatewayKanbanWatchersMixin)GatewaySlashCommandsMixin)GatewayVoiceMixin)GatewayAdapterLifecycleMixin)GatewayTopicThreadsMixin)GatewayTurnMixin"is_context_overflow_failure_result)GatewayShutdownMixin_resolve_gateway_exit_verdict)GatewayBusySessionMixin)GatewayConfigLoadersMixin)GatewayStartupMixin_own_policy_envs)GatewaySessionWatchersMixin)GatewayNotificationsMixin)GatewayInboundMixin)GatewayGoalsMixin)GatewayAgentCacheMixin)GatewayProfileReconcileMixin)GatewayPluginRewireMixin)r_reply_anchor_for_eventr) MessageEvent MessageType)"DEFAULT_GATEWAY_CRON_DRAIN_TIMEOUT*DEFAULT_GATEWAY_RESTART_AFTER_TURN_TIMEOUT%DEFAULT_GATEWAY_RESTART_DRAIN_TIMEOUT.DEFAULT_GATEWAY_SIGNAL_INTERRUPT_GRACE_TIMEOUTclV^8dQhR\.\3,R\\,R\/#)r?fn debug_msgrB)r r r rD)rFs"r;rGrGs.Xb#g&8C=Cr=c~V!4# \d)pT'd\PY4Rp?R#Rp?ii;i)z[Call ``fn``; return None on any Exception (debug-logged via ``debug_msg`` ``%s`` if given).NrLrMrN)rrrYs&& r; _best_effortrs0t   LL (s <7<g@c:V^8dQhR\\,/#rr rD)rFs"r;rGrGs(3-r=c\\4;_uu_4^RIHpV!4RRR4\ VR/4P 4EFbwr#\ VRR4'gK\ V4pV'gK0VwrVp\ VRR4;'g/p\VPR4;'gV'd \VR4MR4P4P4p \VPR 4;'gV'd \VR4MR4P4P4p V R 8wd V R 8wdEK\R R 4P4R9p V 'g(V'd#\VR 4P4R9dEKTVP R 2u# R# +'giEL;i)zFReturn a startup-abort reason when open policy lacks allow-all opt-in.)discover_pluginsNrrFrp dm_policypairing group_policyopenGATEWAY_ALLOW_ALL_USERSrz&: open policy without allow-all opt-in>rrr) r}rLr]rr8rrrDr~rrrr) rrrropen_envdm_env group_env allow_all_envrprrgateway_allow_alls & r;"_own_policy_open_startup_violationrst )  7 &-V["%E%K%K%M! 599 #H- +3(=$7==2 +.QQ:@GFI6iRRWRWRYZ_Z_Za  IIn % d d9')Y*GZc %'%%'   <6#9 #$=rBHHJNbb '-"<"B"B"DH\"\ ..!!GHH'&N( /   s F22 G c$V^8dQhR\/#rr&)rFs"r;rGrGs"L"Lt"Lr=c H^RIHpHpHpV!4pVP R4;'gRP 4pVP R4;'gRP 4pV!\ 44wrgTeq/\T4CRTR,R\YTTP R4;'gTP R4;'gRTP R4;'gR4/C#TP R 4p \T \4'dUT P4U U u/uF7wr\T \4'gK\T \4'gK5YbK9 up p M/p /\T4CR T /C# \dp\T!T44ThRp?ii;iuup p i) aPResolve provider credentials for gateway-created AIAgent instances. ``resolve_runtime_provider()`` may fall back to env vars; behavioral config is config.yaml only. An ``AuthError`` from the primary walks the configured fallback chain through the shared ``resolve_runtime_with_fallback`` (the gateway keeps no resolver loop of its own).)resolve_runtime_with_fallbackformat_runtime_provider_error_get_model_configrrrVNr_fallback_noticer capabilities)hermes_cli.runtime_providerrrrr~rrrL RuntimeError_runtime_agent_kwargsr-rrrrDrm) rrr _model_cfg_primary_model_primary_providerruntimefallback_entryrYrrr s r;_resolve_runtime_agent_kwargsrs YY #$J nnY/552<<>N# 399r@@BH"?@T@V"W!?'0?'>';R"$=%KK +ZZ~/A/A*/MZZQZ"&&w/<<9%>? ? ;;~.L lD ) )',,.].$!*Q2DTUW[I\.]/1 L#G, Knl KK% H8=>CGH ^s*%E9%FFF9 FFFc0V^8dQhR\R\/#)r?rrBr&)rFs"r;rGrG! s ? ?4 ?D ?r=c^RVPR4RVPR4RVPR4RVPR4RVPR4RVPR4R\VPR4;'g.4RVPR4R VPR 4/ #) zAIAgent constructor kwargs shared by every runtime-provider resolution. ``request_overrides`` passes through as resolved so the provider's request body reaches each turn.rrZrVrequested_providerapi_moderaargscredential_poolrequest_overrides)r~r)rs&r;rr! s 7;;y)GKK +GKK +gkk*>?GKK +7;;y)W[[(..B/7;;'89W[[)<= ? ?r=)frozenc0a]tRtRtoRtV3RltRtVtR#)_GatewayModelContexti0 z.__annotate__L s<<$._read_configL s$% HHWb) i & &(}}Y7QQ9==;Q mm$45G"i44,/L)5-6]]:-F-N-N$ N (-6]]:-F-N-N$ N ( < I>tD  54 <#xx(:;  ._read_runtimea s UYYz**yy,88HZ(Hii *G /1;;z*66h;;z*66h++i(r=c$V^8dQhR\/#rr)rFs"r;rGrp slllr=c4<^RIHpV!SSSSSS4'*#))should_clear_context_pin)hermes_cli.route_identityr)rrZrrr rVresolved_models r;_pin_still_applies:_resolve_gateway_model_context.._pin_still_appliesp s+F+ n.A8M`bjll lr=c:V^8dQhR\\,/#r)r rQ)rFs"r;rGrv sXX#Xr=c&<^RIHpV!SSSR7#)r)"get_custom_provider_context_length)rrZr)rr)rrZrrs r; _custom_ctx3_resolve_gateway_model_context.._custom_ctxv sH1 8FVX Xr=r)rZrrrVrrrdetected)rrVrZrr ) agent.model_metadatarrrr_resolve_gateway_modelrrDrr)rrrrrrr rrrr fell_throughr rrZrrrr rrVrs&f @@@@@@@@@r;rr; s]ii6646NOSSSHSxS'P1Q1Q $$)9h ,[ 9 A AT-RB3hnn")+N#>ii*+BCDWD]D]D_`dhh"7"Ch(49* x~~2B% FFr=cRV^8dQhR\R\\,R\/#)r?rV target_modelrB)rDr r)rFs"r;rGrG s,AAAHUXMAeiAr=c 2^RIHpHpT!Y;'gRR7p/\ T4CR\ TPR4;'g/4R\ TPR4;'g/4/C# \dp\ T!T44ThRp?ii;i)aQResolve runtime credentials for a specific provider (e.g. from channel override). ``target_model`` is the model the override will actually send: the ladder's model-keyed rungs (Zen/Go relay + api_mode) must see it rather than config's ``default``, or a Go-only override resolves an api_mode/base_url the sent model cannot use (#112600).)resolve_runtime_providerrN) requestedr"rr)rr$rrLrrrr~)rVr"r$rrrYs&& r;*_resolve_runtime_agent_kwargs_for_providerr& s dH*XL`L`\`a A  ( AT'++.A"B"H"HbIW[[8>>B? AA H8=>CGHs A4A44 B?BBchV^8dQhR\\,R\\,R\/#)r?baser=rB)r r)rFs"r;rGrG s* 1 1 1(4. 1UY 1r=c^RIHp\T;'g/4p\T;'g/4pV'gV#V'gV#V!W44#)z@Merge request_overrides dicts, deep-merging nested dictionaries.) _deep_merge)rr*r)r(r=r* base_dict override_dicts&& r;_deep_merge_request_overridesr- sB-TZZR IR(M   y 00r=c:V^8dQhR\\,/#)r?rVr)rFs"r;rGrG sHSMr=c V'd \V4P4'gR#\\V4P44PR4# \d\ P RTRR7R#i;i)zJReturn the live credential pool for a provider id (e.g. ``custom:hyper``).Nrz1Failed to resolve credential pool for provider=%sTrG)rDrr&r~rLrMrN)rVs&r;_credential_pool_for_providerr0 si 3x=..009#h-:M:M:OPTTUfgg  H(]a bs0A#BBc0V^8dQhR\R\/#r?indexrB)rQrD)rFs"r;rGrG sBBsBsBr=cd\VRR4;'g.pV\V48d W!,#R#)zRPer-attachment MIME at *index*; "" when the adapter set only a message-level type. media_typesNr)r8rU)eventr3r5s&& r;_event_media_type_atr7 s2%5;;K!&[)9!9; ArAr=cHV^8dQhR\R\R\R\/#)r?r3 mime_prefixfallback_typesrB)rQrD frozensetrm)rFs"r;rGrG s/BBsBBiB\`Br=cj\W4pV'dVPV4#\VRR4V9#)zPer-attachment MIME first, message-level type only when unknown (else a document uploaded alongside an image is base64'd as vision and the provider 400s). message_typeN)r7rr8)r6r3r9r:mtypes&&&& r;_event_media_kind_isr? s6 ! .E  ,, 5.$ /> AAr=c0V^8dQhR\R\/#r2rQrm)rFs"r;rGrG XXXXr=cL\WR\\P044#)zimage/)r?r;rPHOTOr6r3s&&r;_event_media_is_imagerF  h ;CTCTBU8V WWr=c0V^8dQhR\R\/#r2rA)rFs"r;rGrG skkkkr=c j\WR\\P\P044#)audio/)r?r;rVOICEAUDIOrEs&&r;_event_media_is_audiorM s( h ;CTCTVaVgVgBh8i jjr=c0V^8dQhR\R\/#r2rA)rFs"r;rGrG shhChDhr=c\VRR4pV\P\P09dR#V\P8H;'g\ W4P R4#)zFTrue when an audio attachment should enter the automatic STT pipeline.r=NFrJ)r8rrLDOCUMENTrKr7r)r6r3r=s&& r;_event_media_is_stt_inputrQ sW5.$7L ));+?+?@@ ;,, , g g0DU0R0]0]^f0ggr=c0V^8dQhR\R\/#r2rA)rFs"r;rGrG rBr=cL\WR\\P044#)zvideo/)r?r;rVIDEOrEs&&r;_event_media_is_videorU rGr=c$V^8dQhR\/#rr_)rFs"r;rGrG ssr=c.p\VRR4;'g.p\V4Fwr4\W4'dVPRV R24K-\ W4'dVPRV R24KU\ W4'dVPRV R24K}VPRV R24K RP V4#) zText placeholder for media-only events (later replaced by vision enrichment). Queued media is dequeued via .text only, so a caption-less event would otherwise be lost. media_urlsNz[User sent an image: rGz[User sent audio: z[User sent a video: z[User sent a file: r)r8 enumeraterFrsrMrUr)r6rrXrurls& r;_build_media_placeholderr[ s E d399rJJ'  * * LL0Q7 8 "5 , , LL-cU!4 5 "5 , , LL/uA6 7 LL.se15 6( 99U r=content_inlinedc TV^8dQhR\R\R\R\R\/#)r? display_name agent_pathr>r\rBrd)rFs"r;rGrG s4777#&7/27HL7X[7r=cVPR4'dV'd RV RV R2#VPR4'd RV RV R2#RV RV R2#) zContext note prepended to a user turn when they attach a document. ``content_inlined=False`` = cached without content, so tell the agent to read it. Binary docs must say *extract* the text; "ask the user" made it punt.ztext/z![The user sent a text document: 'zC'. Its content has been included below. The file is also saved at: rGz'. It is saved at: z. Its content is not inlined here. Read the cached file yourself before answering when the user's request involves its contents.]z[The user sent a document: 'u . Its text is not inlined here (it's a binary format such as PDF or DOCX). To read it, extract the document's text yourself — for example with the terminal tool or the ocr-and-documents skill — before answering, instead of asking the user to paste the contents.])r)r^r_r>r\s&&&$r;_build_document_context_notera s    _/ ~>**4Q 8 9   / ~=PQ[P\]> ? @ '|n4G |T5 67r=c0V^8dQhR\R\/#)r?rrBr)rFs"r;rGrG s##e##r=c\^\V44p\VR4wr#\V^<4wrEV'd V RVR RVR 2#V RVR 2#)rr{02d)rProunddivmod)rtotalhoursremminutessecss& r;_format_durationrm s^ 5> "Et$JE3OMG '#aSz22YaSz ""r=cFV^8dQhR\R\\,/#r?rrBrDr )rFs"r;rGrG s!!c!hsm!r=c ja"\PPS4^,P4pVR8Xd2RV3Rllp\ \ P !V4GRjxL 4#VR9d2RV3Rllp\ \ P !V4GRjxL 4#\ P!RRR R R R R S\ PP\ PPR7 GRjxL p\ P!VP4RR7GRjxL wrVVP^8Xd1\ \VP4P!444#R#EL \dELi;iL \dLi;iLLt \dR#i;i5i)zSBest-effort duration probe. Returns formatted MM:SS / HH:MM:SS, or None on failure.z.wavc$V^8dQhR\/#rr)rFs"r;rG+_probe_audio_duration..__annotate__ s 0 05 0r=c<^RIpVPSR4;_uu_4pVP4pVP4;'g^pV\ V4, uuRRR4# +'giR#;i)rNrb)waver getnframes getframeraterE)rvwfframesraters r; _wav_duration,_probe_audio_duration.._wav_duration sSYYtT**b]]_F??,11D!E$K/+***s ._ogg_duration s!3WT]//6677r=ffprobe-vrz -show_entrieszformat=durationz-ofz"default=noprint_wrappers=1:nokey=1)stdoutstderrr1r)z.oggz.opusz.oga)rrsplitextrrmrrrLcreate_subprocess_exec subprocessPIPEr communicate returncoderEdecoder)rextr|rprocrrsf r;_probe_audio_durationr s ''  4  # ) ) +C f}  0 0 $'*;*;M*J$JK K ''  8 8$'*;*;M*J$JK K  33 tWo7H 7%%**73E3E3J3JLL"**4+;+;+=sKK  ??a #E&--/*?*?*A$BC C -%K   %K   LL    sV^8dQhR\R\R,/#r^)rDr)rFs"r;rGrG. s4449L4r=c$VPV4#)zgConsume and return the pending event; media metadata is kept so follow-ups re-enter preprocessing. )get_pending_message)rr@s&&r;_dequeue_pending_eventr. s  & &{ 33r=zStop requestedzSession reset requestedz Execution timed out (inactivity)zgateway inactivity watchdogz(Session ended while the turn was runningzsession evictedzgateway shutdownzSSE client disconnectedzGateway shutting downzGateway restartingis_still_currentc xV^8dQhR\R\R\\.\3,,R\/#)r?rsourcerrB)rDr r rmrQ)rFs"r;rGrGB s:!! !/2!xD12!>A!r=cV'g^#Ve(V!4'g\PRW4^#^RIHpVP WVR7pT'd\P RYPT4T# \d\PRYRR7L`i;i \d\P RYRR7^#i;i) zReap only background processes created by one abandoned turn. ``task_id`` is session-scoped, so a *replacement* turn can spawn its own process mid-reap; ``is_still_current`` lets the caller bail instead of killing it (that turn owns its own baseline).zdSkipping reap for turn %s (%s): a newer turn already claimed this session; it owns its own baseline.z>is_still_current check failed for turn %s (%s); reaping anywayTrG)process_registry)rz4Failed to reap background processes for turn %s (%s)zBReaped %d background process(es) created by abandoned turn %s (%s))rMrNrLtools.process_registryrkill_started_sincer)rprocess_baselinerrrkilleds&&$$ r;_reap_gateway_turn_processesrB s # 0#%% FGNX &8!44WW]4^  P V % M# 0 LLP$  0 0  BG^b  d s' A1A1B1#BB#CCc(V^8dQhR\RR/#)r?rrBNr_)rFs"r;rGrGk sEEcEdEr=c Ra\P!4p\P!4Uu/uFq"PVP bK pp^pVP 4FwrVV\P!48XdK!\P!V4pRPV4o\;QJd#V3Rl\4F 'gK RM RM!V3Rl\44'gKV^, pV^8d\PRV4M>\PRWPVR4VRPVR R44K V^8Xd\PR V4R#R#uupi \ d\P#R RR 7R#i;i) zLog the stack of every thread that looks like turn work, at reap time. The hard interrupt frees the wedged worker before a profiler can attach, so dump BEFORE it. Best-effort, bounded (turn-machinery threads only, capped output), never raises.rc3,<"TF qS9xK R#5irr)rmarkerjoineds& r;r+_dump_wedged_turn_stacks..x sU6TF'6TsTFzKWedged-turn stack dump for task %s truncated: more than 8 candidate threadsz7Wedged-turn stack dump (task=%s thread=%s ident=%s): %s?NzoWedged-turn stack dump for task %s: no thread with turn-machinery frames found (worker may have already exited)zWedged-turn stack dump failedrGi)r_current_frames threadingrYr<r-r get_ident traceback format_stackrr_TURN_STACK_DUMP_FRAME_MARKERSrMrr~rLrN) rrzrnamesdumpedr<framestackrs & @r;_dump_wedged_turn_stacksrk sTE$$&*3*=*=*?@*?Q!&&*?@"LLNLE ++--**51EWWU^F3U6TU333U6TUUU aKFz a LLJ5#.rwwuST{7K M+ Q; LLOPW Y %A, E 4t DEs6,FE;A&F5F!F2BF;F"F&%F&c V^8dQhR\R\PR\PR\PR\\ .\ 3,,R\ /#)r?r worker_done timeout_fired cleanup_lockrrB)rDrEventLockr r rm)rFs"r;rGrG s[!BK//??2;..xD12?Cr=c0T;_uu_4VP4'gVP4'd RRR4R#VP4RRR4\V4V'd V^,MRpVe&\V\\ R7^RI H pV!V4\WRVR 7R# +'giLh;i \ d\PRRR7LVi;i \ d\PR TRR7R#i;i) z@Interrupt one timed-out turn and reap only processes it created.NF) tool_reasonz Timed-out agent interrupt failedTrG)record_watchdog_turn_abortgateway_turn_timeout)rrz9Failed to reap background processes for timed-out turn %s) is_setrrr!_INTERRUPT_REASON_TIMEOUT_INTERRUPT_TOOL_REASON_TIMEOUTrLrMrN/hermes_cli.observability.shared_metrics_processrrr) agent_holderrrrrrrrrs $$$$$$$ r;_abandon_timed_out_gateway_turnr s      =#7#7#9#9    W%+LOE  L "5*CQo p _"5)a$ .D- / 1  L LL;dL K L a G[_  a as:,B3B3B3>C#C.3 C "C+*C+.#DD poll_intervalcV^8dQhR\R\R\PR\PR\PR\R\ \ .\3,,RR /#) r?rrrrrrrrBN)rDrErrrr r rm)rFs"r;rGrG sm  ! >C R[RaRa ?? 2;.. QV xD12 ?C r=c \P!4p \4p VP\ RV44'g\P!4p W, p V'd V^,MRp V ec\ V R4'dQV P 4PR4pVe-V P\ R\V444p W, p W8dK\WVWEVVR7R#R# \dL)i;i)a7Thread watchdog that remains runnable when gateway asyncio is starved. Until an agent publishes a usable activity snapshot, elapsed worker time is the liveness clock. Otherwise a provider hang before activity initialization can retain the session turn lease forever because every watchdog poll just skips it. g{Gz?Nget_activity_summaryseconds_since_activity)rrrrrrr) r monotonicr*waitrPrIrr~measurerErLr)rrrrrrrrractivity_origin awake_idler8 idle_secondsr reported_idles$$$$$$$$$ r;_watch_gateway_turn_inactivityr snn&O!Js4788nn, #/ QT  0F!G!G  % : : < @ @AY Z  ,#-#5#5c#u]?S6T#UL'*&8O  ! '%IY#|- / )9  sAC33 DDcFV^8dQhR\\,R\/#)r?rrBrB)rFs"r;rGrG s"YY8C=YTYr=cV'gR#RP\V4P4P44P 4\ 9#)z?Return True when an interrupt message is internal control flow.FrF)rrDrrr_CONTROL_INTERRUPT_MESSAGES)rs&r;_is_control_interrupt_messager s<  88CL&&(..0 1 7 7 9=X XXr=c0V^8dQhR\R\/#)r?responserBr_)rFs"r;rGrG s \ \# \3 \r=cVPV4wr#VPRR4PRR4P4#)aReturn the visible text portion of a response before direct send(). Only explicit ``MEDIA:`` attachments are stripped; bare paths/URLs stay visible. No broad regex after ``extract_media()``: it deliberately preserves protected code spans and unvalidated tags. Queued follow-up resends only replay explicit ``MEDIA:`` attachments in this path. Keep bare local paths and ordinary image URLs visible because the post-stream uploader intentionally ignores them (#20834). rrz[[as_document]])rreplacer)rrrcleaneds&& r;+_strip_response_attachments_for_direct_sendr s@&&x0JA ??/ 4 < <=NPR S Y Y [[r=cnV^8dQhR\R\\R,\R,3,/#)r?skill_mdrBN)rrrD)rFs"r;rGrG s,))4)E#*cDj:P4Q)r=cPVPRRR7pTPR4pTPR4'gR#TP R^4pT^8dR#RpT^TP 4FpTP 4pTPR4'gK,TPR ^4^,P 4p\T4^8d)T^,TR,8XdT^,R9dT^RpTP 4pM T'gR#TP4PR R 4PR R 4p\P!R RT4p\P!RR T4P R 4pT;'gRT3# \dRu#i;i)zDerive ``(slug, declared_name)`` from a SKILL.md; ``(None, None)`` if unreadable or no ``name:``. Matches ``scan_skill_commands``: the slug comes from frontmatter ``name:``, NOT the directory. utf-8-sigr)encodingerrorsNuz---z ---zname:r{rF-rz [^a-z0-9-]rz-{2,}r|rq>"') read_textrLrrr splitlinesrrrUrrrr)rrr declared_nameliner0slugs& r;_skill_slug_from_frontmatterr s~$$k)$LnnX&G   e $ $ ,,w "C Qw $M#))+zz| ??7 # #**S!$Q'--/C3x1}Q3r7!2s1v7K!BiIIKM ,     ( (c 2 : :3 DD 66-T *D 66(C & , ,S 1D LLD= ((/ sF F%$F%c>V^8dQhR\R\R,/#)r? command_namerBNr_)rFs"r;rGrG s&&3&3:&r=c|VP4PRR4p^RIHp^RIHpHpV!4pV!4FpVP4'gKVPR4FQpV!V4'dK\V4wrV'd V 'gK2W8XgK:W9gKB\RVR7uu# K ^RI H p \\4P4P P p V !V R , 4p V P4'dV PR4FvpV!V4'dK\V4wrV'dW8wdK0VP P#V 4pR R P%VP&4 2p\R WR 7u# R# \(dR#i;i)zYHint when a command matches a skill that is disabled or optional-install only; else None.rr)_get_disabled_skill_names)get_all_skills_dirsis_excluded_skill_pathzSKILL.mdzgateway.skills.disabled)r-)get_optional_skills_dirzoptional-skillsz official/rzgateway.skills.not_installed)r- install_nameN)rrtools.skills_toolragent.skill_utilsrrrrglobrrrrrrrr relative_torrrL)r normalizedrrrdisabled skills_dirrrrr repo_root optional_dir _declaredrel install_paths& r;_check_unavailable_skillr st##%--c37J" ?Q,.-/J$$&&&,,Z8)(33&B8&L#=%-*C6\JJ90 =N**,33:: .y;L/LM    (..z:)(33">x"Ht1oo11,?!*388CII+>*?@ 7lff;     s1A7F,F,$F,,F,=C*F,(F,, F;:F;c0V^8dQhR\R\/#r)rtrD)rFs"r;rGrG0 sCC8CCr=cHV\P8XdR#VP#)uNMap a Platform enum to its config.yaml key (LOCAL→"cli", rest→enum value).r)rtLOCALrrs&r;_platform_config_keyr0 s.5BHNNBr=c$V^8dQhR\/#rr)rFs"r;rGrG5 sfffr=c\\4RR.R7p\V\4;'dRV9;'gRV9#)zAReturn True when the standalone Teams pipeline plugin is enabled.pluginsr)rteams_pipelinezteams-pipeline)r,rrr)rs r;_teams_pipeline_plugin_enabledr5 s@*,iBOG gt $ e e*:g*E*d*dIY]dIder=c$V^8dQhR\/#rr)rFs"r;rGrG; s88d8r=cH\4pV'd \V4#\#)z7<7r=c>V^8dQhR\R,R\/#)r?r4NrBr)rFs"r;rGrGA s  dTk T r=cVf\4R, p^RIHpV!V4# \d\P RTRR7/u#i;i)uThe effective user config.yaml (managed overlay, ``${VAR}`` expansion, model-key canon; no DEFAULT_CONFIG merge) — ``{}`` on any error (fail-open). Defaults to the active gateway home (``_hermes_home`` monkeypatches apply); multiplexers pass a path. r.rz%Could not load gateway config from %sTrG)r rrrLrMrN)r4rs& r;rrA sR *,}< J)+66  V^8dQhR\R,R\/#)r?rNrBrrD)rFs"r;rGrGS s"NN4$;N#Nr=c ^RIHpVeTM \4PR/4p\ V\ 4'd+VPR4;'gVPR4p\ V\ 4'dTMR;'gV!4#)zThe profile's model when nothing else names one: config.yaml (single source of truth), else the claimed welcome trial's. Temporary AIAgents (e.g. /compress) otherwise use the hardcoded default, which fails under openai-codex.) trial_modelrrr)hermes_cli.anon_authrrr~rrrD)rrrs& r;rrS so1!-3G3INNwXZ[I)T""MM),FF g0F #Is33I M M Mr= thread_id parent_idc V^8dQhR\R\\,R\\,R\\,/#)r?rrrrB)rDr r)rFs"r;rGrG^ s@[[ [ ( [AI#[Z^_bZc[r=cP\\PRWV3444#)uOrdered, de-duplicated ``channel_overrides`` lookup keys (matches ``resolve_channel_prompt``: exact id first, then parent — Discord threads inherit parent overrides).c3J"TFq'gK \V4xK R#5irr_)rras& r;r0_channel_override_lookup_keys..b sY2Q3UXhc#hh2Qs ##)rrfromkeys)rrrs&$$r;_channel_override_lookup_keysr^ s#  Y7y2QYY ZZr=c V^8dQhR\R\R\R\\,R\\,R\\,/#)r?rrrrrrB)rrtrDr r)rFs"r;rGrGe sJ %-8;KSTW=}(0(Ar=c\VRR4pV'gR#VPV4pV'dVP'gR#VPp\W#VR7FpVPV4p V fKV u# R#)zQPer-channel override via chat_id, then thread_id, then parent_id; None if absent.rN)rr)r8r~channel_overridesr) rrrrrrr overridesraovs &&&$$ r;_get_channel_overrider e sr T2I mmH-O /"C"C"C11I,WU^_ ]]3  >I` r=cPV^8dQhR\\\,,/#r)r rrD)rFs"r;rGrGw sXd3i0r=c^RIpVPPR4e\PRR.#^RIpVPR4pV'dV.#R# \ dL/i;i)a,Hermes update/restart argv: the running interpreter's ``python -m hermes_cli.main`` (exactly this install), else ``hermes`` on PATH, else None. The module argv must win: a PATH-first lookup lets an attacker-planted ``hermes`` shadow the running install when /update or /restart re-execs it (#111569).N hermes_cliz-mzhermes_cli.mainr)importlib.utilutil find_specr executablerLshutilwhich) importlibr( hermes_bins r;_resolve_hermes_binr,w sk   >> # #L 1 =NND*;< < >h'J|     s3A A'&A'z^[a-z0-9][a-z0-9_-]{0,63}$c>V^8dQhR\R\R,/#r^)rDr)rFs"r;rGrG sCD4Kr=cVPR4p\V4^8dV^,R8XdV^,R 9g#\PV^,4'dmRV^,RV^,RV^,/pV^,R8wd\ V^,4VR&\V4^8dV^,R 9d V^,VR&V#R #) uvParse a session key (``agent:{ns}:{platform}:{chat_type}:{chat_id}[:{extra}...]``). ``{ns}`` is ``main`` for the default profile, ``main~`` for a profile literally named ``main`` (``gateway.session._session_key_namespace``), or a named-profile id (profile ids match ``[a-z0-9][a-z0-9_-]{0,63}`` — never contain ``:`` — so a plain split stays unambiguous). For group/channel sessions the suffix may be a user_id, not a thread_id, so ``thread_id`` is omitted. Named profiles are reported as ``profile``; ``main`` keys keep their historical shape exactly (no ``profile`` key) so equality assertions on parsed dicts stay stable. r{rmainr chat_typerprofilerN)r/zmain~>dmthread)rrU_PROFILE_ID_KEY_RErr)r@rrs& r;_parse_session_keyr5 s   c "E E a !H  1X* *.@.F.FuQx.P.PeAh U1Xy%PQ(S 8v  B58 LF9  u:>eAh*::"'(F;  r=c<V^8dQhR\R\R\/#)r?ralimitrBr)rFs"r;rGrG s!#c3r=cRPT;'gRP44p\V4V8dVRV^, R,pV#)zFCollapse a shell command onto one line and cap its length for display.rFrNu…)rrrU)rar7one_lines&& r;_shorten_command_for_displayr: sExxB--/0H 8}uKeai(50 Or=cHV^8dQhR\R\R\R\/#)r?rraoutputrBr_)rFs"r;rGrG s,!69UXr=cVR9pV'd \R4M \R4.p\V4pV'dVPRV R24.p\V\\ 34'dV^8d\ V4p V R8d.VPV R, RV R,^<, R24MAV ^<8d'VPV ^<, R V ^<, R 24MVPV R 24V'gVP\R VR 74V'd%VPR RP V4 R24RP V4p V'gV'dVP4P4U u.uFqP4'gKV NK up RRp RP V 4p \V 4R8dV RRp V 'dV \RV R7, p V'gV \R4, p V #uup i)z^One-line completion message for ``concise`` display mode; failure appends a short output tail.Nz gateway.background.task_finishedzgateway.background.task_failedu— ``rdzh mzm szgateway.background.exit_code)coderrr4rFrizgateway.background.last_output)tailzgateway.background.rerun_hint>Nri ) rr:rsrrQrErrrrU)rra exit_coder<duration_secondsokr short_cmddetailsrlrQln tail_linesrBs&&&&& r;$_format_concise_process_notificationrK s i B68Q1 2a@`>a bE,W5I uYKq)*G"S%L116F!6K#$ 4< NNddl^2td{r.A-B!D E RZ NNdbj\D2I;a8 9 NNdV1: & q7iHI q7+,A./ 88E?D &#)<<>#<#<#>M#>R((*bb#>MbcR yy$ t9s?;D  A6TB BD  122 KNs H H c>V^8dQhR\R\R,/#)r?evtrBNr)rFs"r;rGrG sdsTzr=cVPRR4pVPRR4pVPRR4pVR9dRVPRR4 R 2#VR 8XdeVPR R 4pVPR R4pVPR^4pRV RV RV RV 2pV'dVRV R2, pVR , pV#VR9d^RIHpV!V4#R#)zOFormat a watch pattern event from completion_queue into a [IMPORTANT:] message.r5 completionrrraz [IMPORTANT: rrrG watch_matchrrr< suppressedz[IMPORTANT: Background process z matched watch pattern "z ". Command: z Matched output: z (z/ earlier matches were suppressed by rate limit))format_process_notificationN)watch_disabledwatch_overflow_trippedwatch_overflow_released)async_delegation heartbeat)r~$tools.process_registry_notificationsrR) rMevt_type_sid_cmd_pat_out_suprQrRs & r;$_format_gateway_process_notificationr_ swwv|,H 77< +D 779i (DZZcggi45Q77= wwy#&wwx$ww|Q'-dV4#f%v0 8   c$NO OD   44T*3// r=c:V^8dQhR\\,/#r)rr)rFs"r;rGrG sT$Zr=cD.p.pVP4'gZVP4pTPRR4pTR9dTP T4KSTR8XgK\TP T4KoVFpVP V4K V# \dK*i;i)zDrain gateway-owned watch events without spinning on requeued events. Foreign events requeued inside ``while not queue.empty()`` never terminate: detach, then requeue.r5rOrV>rWrPrSrTrU)empty get_nowaitrLr~rsput)completion_queue watch_eventsrequeuerMrYs& r;_drain_gateway_watch_eventsrh s "LG$$&& "--/C776<0      $ + + NN3 S!    sB BBcR#rrrr=r;rr sDr= history_lencHV^8dQhR\R\R\R\/#)r? agent_resultrrjrB)rrDrQ)rFs"r;rGrG s2SSS"%S7:SCFSr=c\W4pV'dV'd\V4'gV#VPR4'dVPR4;'g \R4p\ V4P 4p\ VPR4;'gR4pVP R4'gRV9d5VPR4'gR V9d \R 4#\R 4#V'd \4#\PR \ V4R ,4\R4#\VPR^4;'g^4pVPR4'dV^8Xd \R4#V#V^8Ed!\V4'dR#VPR4'd\ VPR4;'g \R44p^RI Hp \ VPR4;'gR4V 9dFVP4'd0\V4'gVP R4'dV#RV 2#\V4'd!\PRVR ,4Rp M RVR, 2p \RV R7#\R4#V^8Xd#VPR4'g \R4#V#)aNormalize empty/None agent responses into user-facing messages. Covers ``failed``, work done (api_calls > 0) with no text, and never-ran (api_calls == 0, the post-/stop silent-drop from a stale generation token) with a retry hint. Consolidates the existing ``failed`` handler and adds a catch-all for the case where the agent did work (api_calls > 0) but returned no text. Fix for #18765. Also surfaces a retry hint when the agent never ran at all (api_calls == 0) for a non-interrupted, non-failed turn -- this is the silent-drop pattern observed after ``/stop`` where the next user message hits a stale generation token and returns an empty result, leaving the platform with nothing to send. (#31884) A failed context-overflow turn whose ``final_response`` is only the raw provider envelope (``HTTP 400: {...}``) is rewritten too: returned unchanged, chat sanitizers turn it into a generic provider-failed reply and the user never sees /compact. Curated agent text survives. rrzgateway.shared.unknown_errorfailure_reasonrsession_persistence_failedzsession storagez:diskdiskz/gateway.errors.session_storage_unavailable_diskz*gateway.errors.session_storage_unavailablez7Agent turn failed; reply sanitized for chat. Detail: %s:NiNzgateway.errors.generic_failed api_calls interruptedz'gateway.errors.interrupted_before_startpartialz$gateway.errors.processing_incomplete)SITE_FAILURE_CODESu⚠️u⚠️ z@Agent turn ended partially; reply sanitized for chat. Detail: %srrjz'gateway.errors.stopped_before_finishingrozgateway.errors.no_responsez$gateway.errors.previous_turn_cleanup)rrr~rrDrrendswithrzrMrrQ,_is_gateway_hidden_reasoning_incomplete_turnagent.turn_failure_copyrtr) rlrrj is_overflow error_detail error_strrnrqerrrtros &&$ r;_normalize_empty_agent_responser} sp"5\OK)KH)U)U!!#''0UUA6T4U  %++- \--.>?EE2F  $ $%A B BFW[dFd&&w//6Y3FJKKAB B *, ,PRUVbRcdhRij011L$$[!499:I && >>? ?1} 8 E E   I & &l&&w/\\15[3\]C CL$$%56<<"=ASS ,Ns,S,S!nnX66sKgcUOK1#66acfgkclmc$i[)>vN N-..A~l..y99788 Or=c0V^8dQhR\R\/#r?rlrBrrm)rFs"r;rGrG_ s > >t > >r=c\V\4'dFVPR4'g/VPR4'gVPR4'gR#\VPRR4;'gR4P 4pRVP 49dR#\VPR4;'gR4P 4pV'*;'gW!8H#) aDetect retry-exhausted turns with hidden reasoning but no visible answer. The loop returns the retry-exhaustion sentinel as BOTH ``final_response`` and ``error``, so a non-empty ``final_response`` proves nothing; any text other than the sentinel is a real answer.rrrrsFrrzremained incomplete afterfinal_response)rrr~rDrr)rl error_textrs& r;rwrw_ s |T * *l.>.>x.H.H ..l6F6Fy6Q6Q\%%gr288b9??AJ"**:*:*<<))*:;AArBHHJN  = =!==r=c0V^8dQhR\R\/#rr)rFs"r;rGrGm s66$646r=c\V\4'dVPR4'dR#VPR4'g/VPR4'gVPR4'dR#VPR4RJ#)zTrue only when a gateway turn really completed successfully. ``resume_pending`` is a durable restart-recovery marker; a soft interrupt can look like a normal empty result, and clearing then loses the signal.rrFrrsr completedr)rls&r;'_should_clear_resume_pending_after_turnrm so lD ) )\-=-=m-L-L!!\%5%5i%@%@LDTDTU\D]D]   K ( 55r=c<V^8dQhR\R\R\/#)r?current_resultfollowup_resultrBr&)rFs"r;rGrGx s) A A A+/ A48 Ar=c\V\4'd\V\4'gV#VPR4pVPR4p\V\4'gV#\V\4'd W28:dV#/VCRV/C#)zCarry the outer history offset through queued follow-up drains. Each recursive ``_run_agent()`` advances ``history_offset``; uncorrected, the outer persistence step sees only the *last* queued turn as "new" and drops earlier ones.r)rrr~rQ)rrcurrent_offsetfollowup_offsets&& r;(_preserve_queued_followup_history_offsetrx s ot , ,J~t4T4T#''(89N%))*:;O nc * */3''O,M @o @/ @@r=c6V^8dQhR\R,RR/#)r?rNrB)r)rFs"r;rGrG s$MM+>+EM$Mr=c "VfR#VP4GRjxL R#L \d;\PR\ TR\ T4P 4RR7R#i;i5i)uBest-effort dispose for an adapter that never made it onto ``self.adapters`` (may be ``None``). Nothing else calls ``disconnect()`` on it, so ``__init__`` resources (e.g. SQLite fds) would leak until GC (not prompt for asyncio-bound objects) and exhaust the fd ulimit over a long retry loop. The reconnect watcher in ``GatewayRunner._platform_reconnect_watcher`` constructs a fresh adapter on every retry attempt. When the connect call fails — for any of the three reasons (non-retryable error, retryable error, exception during connect) — the adapter is dropped without ever being installed, so nothing else will call its ``disconnect()``. ``APIServerAdapter`` opens a SQLite ``ResponseStore`` that holds 2 fds — the db file and its WAL sidecar) stay open until garbage collection sweeps the unreachable object, which Python's cyclic GC does not do promptly for asyncio-bound objects with native handles. The cumulative leak is 2 fds × every retry at the 300s backoff cap ≈ 12 fds/hour, and the default 2560-fd ulimit is exhausted in ~12h of continuous failure, after which every open() call on the gateway raises ``OSError: [Errno 24] Too many open files`` and the gateway becomes a zombie (#37011). Nz,Adapter dispose raised on unowned adapter %rr-TrG) disconnectrLrMrNr8r5r6)rs&r;_dispose_unused_adapterr sdM  """ M : GVT']%;%; h&)T2 H3w<WV[$?WV[$? A A     s!B B #B (B BBc<V^8dQhR\R\R\/#)r?module adapter_name requirementr_)rFs"r;rGrG s&AACAsAAr=c^^RIpVPRV 24p\WA4\WB43#)zSLazy-import ``(adapter_cls, requirements_ok)`` from ``gateway.platforms.``.Nzgateway.platforms.)r* import_moduler8)rrrr*mods&&& r;_builtin_adapter_importr s2  ! !$6vh"? @C 3 %ws'@ @@r=cRV^8dQhR\R\R\\,/#)r?rrrB)rtr r r)rFs"r;rGrG s'  8 S XNaEb r=c\PV4pVfR#Vwr4rV\W4V4wrx\V4'dV!4'g!MV'g\P V4R#V!V4#)zYInstantiate a core (non-plugin) adapter, or None when its requirements are unmet/unknown.N)_BUILTIN_ADAPTERSr~rrOrMr) rrspecrrrr adapter_clsrequirements_oks && r;_instantiate_builtin_adapterr sc   *D |15.F+#:6Q\#] K!)/!:!:O  w v r=)GatewayRuntimeInitMixinca]tRtRtoRtRtRtRt]t ] t ] t ]tRtRtRtRtRtRtRtRtRtRtRtRtRtRtRt]!R4t ]!R4t!]!R 4t"]!R 4t#]$!4t%]!R 4t&]!R 4t']!R 4t(]!R4t)]!R4t*]!R4t+]!R4t,]!R4t-]!R4t.]!R4t/]!R4t0]!R4t1]!R4t2]!R4t3V3RlRlt4V3RlRlt5V3RlRlt6V3RlR lt7V3R!lR"lt8Rt9Rt:Rt;R#tRt?RV3R$lR%llt@RV3R&lR'lltA]BV3R(lR)l4tC]CPV3R*lR+l4tCV3R,lR-ltEV3R.lR/ltFV3R0lR1ltG]HR2, tI]B!R34tJ]B!R44tK]B!R54tL]B!R64tMV3R7lR8ltN]O!R9R:04tPR;tQV3R<lR=ltRV3R>lR?ltSV3R@lRAltTV3RBlRCltUV3RDlREltVRV3RFlRGlltWV3RHlRIltXV3RJlRKltYV3RLlRMltZ^ t[]\P!RNRO44t^R;t_RPt`^taRQtb]O!0Rm4tc^tdRRteRRtf^tgRSthRRti^tjRTRURVRWRXRY/tkV3RZlR[ltlR\R]/V3R^lR_lltmV3R`lRaltnV3RblRcltoV3RdlReltp]BV3RflRgl4tqV3RhlRiltr]\P!RjRk44ts]\P!RlRm44ttRV3RnlRolltuRpRRqRRrR/V3RslRtlltv]wRpRRrR/V3RulRvll4tx]w!]y4ty]O!]zP]zP]zP]zP]zP]zEP]zEP]zEP]zEP]zEP]zEP ]zEP ]zEP]zEP]zEP04tV3RwlRxltV3RylRzlt]V3R{lR|l4tR}tR~tV3RlRltV3RlRltV3RlRlt]wV3RlRl4tRV3RlRlltRt]wV3RlRl4tRV3RlRlltV3RlRlt]\P!RR44t]\P!RR44tV3RltRtVtR#) GatewayRunneri zWMain gateway controller: manages adapter lifecycles, routes messages to/from the agent.c $VPV4#)a-The adapter that owns *source* for the session authority (admission checks, canonical automation, native route checks, recovery bindings). Main split the old resolver into the intake and delivery seams; the authority needs the answering adapter, so this is the delivery seam under its historical name.)_delivery_adapter_forselfrs&&r;_adapter_for_source!GatewayRunner._adapter_for_source s ))&11r= interruptNF_running_agents_running_agents_ts_active_session_leases _busy_ack_ts_session_run_generation_session_model_overrides _pending_one_turn_model_restores_session_reasoning_overrides_session_service_tier_overrides_last_resolved_model_queued_events_pending_turn_sidecar_notes_pending_messages&_pending_native_image_paths_by_session_session_ephemeral_pin_session_vc_last_pending_approvals_update_prompt_pendingc6<V^8dQhRS[S[S[3,/#r)rrDr)rFrs"r;rGGatewayRunner.__annotate__G stC$56r=c dVPPR4pVf/pWPR&V#)zSPer-session state map; lazily created so bare ``object.__new__`` test runners work. _sessions__dict__r~)rr/s& r; _sessions_mapGatewayRunner._sessions_mapG s2==$$[1  H)1MM+ &r=c&<V^8dQhRS[RS[/#r?r@rB)rDr)rFrs"r;rGrO s#,r=c lVP4pVPV4pVf\4pW2V&V#)z$>r=c&<V^8dQhRS[RS[/#rrd)rFrs"r;rGr] sBBsBtBr=c lVPV4pVRJ;'dVPPRJ#)zDTrue when the session holds a running-turn slot (agent or sentinel).N)rbturnr)rr@rXs&& r;_is_session_running!GatewayRunner._is_session_running] s4((5D AAUZZ%5%5T%AAr=c0<V^8dQhRS[S[,/#r)rr)rFrs"r;rGrb s11d5k1r=c VP4P4UUu.uF6wrVPPfKWPP3NK8 upp#uuppi)zV(session_key, agent) pairs for sessions with a running turn (incl. pending sentinels).)rrrr)rrarXs& r;_running_agent_items"GatewayRunner._running_agent_itemsb sW:>:L:L:N:T:T:V1:VJC::##(jj&&':V1 11s A"A"rc0<V^8dQhRS[S[,/#)r?r)r r)rFrs"r;rGrq s&+&+x 6&+r=c rVeTM \4VnVe'^RIHpHpV!VP4pVe V!V4^RIHpV!\\VPRR444/Vn RVn /Vn/VnVP!4\"P$!V4sVP)4VP+4VP-4VP/4VP14VP34R# \d\PRRR7Li;i)N)standalone_launcher_decisionrrrrFz#could not set multiplex-active flagTrG)rrrrrr&rrmr8rLrMrNadapters_session_db_init_error_profile_adapters_profile_configs'_warn_if_docker_media_delivery_is_risky_weakrefref_gateway_runner_ref_init_runtime_settings_init_session_store_init_lifecycle_state_init_runtime_caches_init_session_db_init_registries_and_clocks)rrrrdecisionrs&& r;__init__GatewayRunner.__init__q s !' 2f8V8X   n3DKK@H#&x0 O ? gdkk;OQV&W!X Y>@ 6:#QS13 446&ll40 ##%   " ""$ !!#  ((*) O LL>L N Os,D"D65D6c&<V^8dQhRS[RS[/#)r?raise_on_errorrB)rmr )rFrs"r;rGr s 9^9^9^QT9^r=c aaa ^RIHoHp^RIHo ^RIHp\V!44p\SRR4pVf&V!SPSPR7pVSn VV V3RlpRV3R llpVPWFWR 7#) uAsyncSessionDB for the active profile scope, resolved per access (not in ``__init__``) since ``SessionDB()`` reads the context-local HERMES_HOME; one handle cached per path. Construction failure enters bounded backoff; ``raise_on_error=True`` (priming) propagates it. Same per-path cache as ``SessionStore._open_session_db_for_active_scope`` (#88532): ``SessionDB()`` resolves ``_default_db_path()`` at call time through the context-local HERMES_HOME override installed by ``_profile_runtime_scope``, so resolving per access — instead of once in ``__init__`` — is what lets /resume, /title, /history and session search on a multiplexed gateway read the *serving profile's* store rather than the root one. One ``AsyncSessionDB`` is cached per resolved path, so the wrapper identity is stable per profile (callers compare and stash it) and two profiles never share a handle. A construction failure enters bounded backoff; one caller retries after the deadline while concurrent callers continue to see the unavailable fallback. ``raise_on_error=True`` (construction-time priming) propagates the failure after recording that recoverable state so ``__init__`` can record ``_session_db_init_error`` for the #88235 broadcast. )AsyncSessionDB_default_db_path)acquire)RecoverableHandleCache_session_db_handle_cacheN)handlesrc <\SRR4pVe\VRR4MRpVeS!V4pRVPR&V#Ve \R4hS!S!44# \dp\P RT4hRp?ii;i) session_storeNr7T_hermes_borrowed_handlez&SessionStore SQLite handle unavailablez&SQLite session store not available: %s)r8rrrLrMr)storeborrowedwrapperrYrr rs r;_open>GatewayRunner._open_session_db_for_active_scope.._open sD/48E6;6GwueT2TH#(2>B  !:; "#KLL %gi00 GM s A B'A>>BcV^8dQhRR/#rr)rFs"r;rGEGatewayRunner._open_session_db_for_active_scope..__annotate__ s : :D :r=c@<RSn\PR4R#)NzSQLite session store recovered)rrMrrsr; _recoveredCGatewayRunner._open_session_db_for_active_scope.._recovered s*.D ' KK8 9r=)r on_recovered) hermes_staterr hermes_state_registryr gateway.session_db_recoveryr rr8_session_db_handles_session_db_handles_lockr r~) rrr r rrrrrr s f& @@r;!_open_session_db_for_active_scope/GatewayRunner._open_session_db_for_active_scope sy" B1F$&'8$? =*00t7T7TVE,1D ) 2 : :yy^y]]r=c <V^8dQhRS[/#rr)rFrs"r;rGr s88S8r=c bVP\Jd VP#VP4#)uThe AsyncSessionDB for the active profile scope, or a pinned override (assigning ``runner._session_db`` pins it for every later read — tests install fakes/None this way).)_session_db_pinned_SESSION_DB_UNPINNEDr"rs&r;r6GatewayRunner._session_db s.  " "*> >** *5577r=c<V^8dQhRR/#rr)rFrs"r;rGr s((D(r=cWnR#r)r&)rrs&&r;r6r( s"'r=c<V^8dQhRR/#rr)rFrs"r;rGr s88d8r=c HRRlpVPPV4R#)aClose every per-profile AsyncSessionDB this runner opened. Drained under the lock, closed outside it; a pinned handle is the pinner's to close. Wrappers BORROWED from ``session_store`` are skipped: the store's sweep (runs first) closes them. See #98573. cV^8dQhRR/#rr)rFs"r;rG@GatewayRunner.close_all_session_db_handles..__annotate__ s S S$ Sr=c\VR/4PR4'dR#\VRV4pVe\VR4'gR#^RIHpV!V4R# \ d"p\ PRT4Rp?R#Rp?ii;i)rrNr7close)release_or_closez-SessionDB close error during handle sweep: %s)r8r~rIrr1rLrMrN)dbinnerr1rYs& r;_close:GatewayRunner.close_all_session_db_handles.._close syr:r*../HIIBr*E}GE7$;$; ? S ' S LcRR SsA B&BBN)r  close_all)rr4s& r;close_all_session_db_handles*GatewayRunner.close_all_session_db_handles s S %%//7r=c<V^8dQhRR/#rr)rFrs"r;rGr s^^d^r=c \PVP9dR#\4'g\P R4R#^RIHpT!T4pT'd\PR4R#TP'd#\PRTP4R#R# \d"p\PRT4Rp?R#Rp?ii;i \d"p\PRT4Rp?R#Rp?ii;i)z_Bind the Teams meeting pipeline runtime to Graph webhook ingress (no-op if adapter/plugin off).Nz:Teams pipeline plugin is disabled; skipping runtime wiring)bind_gateway_runtimez(Teams pipeline runtime import failed: %sz(Teams pipeline runtime wiring failed: %sz7Teams pipeline runtime bound to msgraph webhook ingressz&Teams pipeline runtime unavailable: %s) rtMSGRAPH_WEBHOOKrrrMrNplugins.teams_pipeline.runtimer;rLrr_teams_pipeline_runtime_error)rr;rYbounds& r;_wire_teams_pipeline_runtime*GatewayRunner._wire_teams_pipeline_runtime s  # #4== 8 -// LLU V   K (.E  KKQ R  / / / NN8$:\:\ ^0  NNEs K     NNEs K  s0 B.C. C9CC D (DD c<V^8dQhRR/#rr)rFrs"r;rGrsQQQr=c \P!RR4P4P4R8wdR#VPP 4pVUu.uF:q"\ P\ P\ P09gK8VNK< ppV'gR#\P!RR4P4p.pV'd`\P!V4p\V\4'd3VUu.uF&p\V\4'gK\V4NK( ppVF?p\$P'V4p V 'gK"V P)R 4\*9gK>R# \ P-R 4R#uupiuupi \d\ P#RRR7Li;i) zWarn when Docker-backed gateways lack an explicit export mount: MEDIA delivery runs in the gateway process, so model-emitted paths like `/output/report.txt` must be host-readable.rrdockerNr-zACould not parse TERMINAL_DOCKER_VOLUMES for gateway media warningTrG containeraFDocker backend is enabled for the messaging gateway but no explicit host-visible output mount (for example '/home/user/.hermes/cache/documents:/output') is configured. This is fine if the model already emits host-visible paths, but MEDIA file delivery can fail for container-local paths like '/workspace/...' or '/output/...'.)rr;rrrget_connected_platformsrtr API_SERVERWEBHOOKrrrrrDrLrMrN_DOCKER_VOLUME_SPEC_RErr$_DOCKER_MEDIA_OUTPUT_CONTAINER_PATHSr) r connectedpmessaging_platforms raw_volumesvolumesparsedr rrs & r;r5GatewayRunner._warn_if_docker_media_delivery_is_riskysX 99^R ( . . 0 6 6 8H D KK779 *3x)QQYQdQdfnfvfv@w7wqq)x" ii 92>DDF   qK0fd++/5Lv!As9Kvs1vvGLD*006Eu[15YY  P Q%yM q `ko p qs65FF0FF"F1FF"F>=F>zgateway_voice_mode.jsoncVP#r) _exit_cleanlyrs&r;rGatewayRunner./s 0B0Br=cVP#r)_exit_with_failurers&r;rrT0s T5L5Lr=cVP#r) _exit_reasonrs&r;rrT1s (9(9r=cVP#r) _exit_coders&r;rrT2sdoor=c&<V^8dQhRS[RS[/#r)rrD)rFrs"r;rGr4smr=c  <\VR4'dKVPe=VPPV4p\V\4'd V'dV#\ VRR4p^RIHpV!V4pRpVeVPpMJ\ VRR4'd8VP'dVPpM^RI H pV!4;'gRp\V\ VR R 4\ VR R4VR 7# \ dLi;i \ dRpLEi;i) zUResolve the current session key for a source, honoring gateway config when available.rNr identity_ofrrFrXrgroup_sessions_per_userTthread_sessions_per_user)r`rar1)rIr_generate_session_keyrrDrLr8gateway.session_identityr^session_key_profiler1rSrXr)rrr@rr^identity_profilerXs&& r;_session_key_for_source%GatewayRunner._session_key_for_source4s 4 ) )d.@.@.L "00FFvN k3//K&&x. 9v&  33H V15 9 9~~~!>>$K68EEIH! GFD D : DD DDrrr0c&<V^8dQhRS[RS[/#rr)rFrs"r;rGrXsaa a-ar=c VPV4pTfT#\P!YR7# \dTu#i;i)u^Apply Telegram DM topic recovery to a source for session-key purposes. Always derive override storage keys from the result: ``_handle_message_with_agent`` rewrites ``thread_id`` before deriving the session key, so keys from the raw ``event.source`` are never read next turn. ``_handle_message_with_agent`` rewrites ``source.thread_id`` via ``_recover_telegram_topic_thread_id`` *before* deriving the session key for a normal message turn (a lobby/stripped reply gets pinned to the user's last-active topic). Session-scoped command handlers like ``/model`` and ``/reasoning`` derive their override key from the raw inbound ``event.source``, which skips that recovery — so the override is stored under a different key than the next message turn reads, and the override is silently dropped on Telegram forum topics and after compression session splits (#30479). )r)!_recover_telegram_topic_thread_idrL dataclassesr)rr recovereds&& r;!_normalize_source_for_session_key/GatewayRunner._normalize_source_for_session_keyXsJ >>vFI#*v` 0C0CF0`` M s0 AAcF<V^8dQhRS[S[,RS[S[,/#rr)rFrs"r;rGrks& RZ[^R_r=c fV'gVfV#VPV4# \dR#i;i)zW``session_key`` if given, else the key for ``source`` (None when it cannot be derived).N)rgrL)rrr@s&&&r;_resolve_session_key_or_none*GatewayRunner._resolve_session_key_or_noneks7 &.  //7 7  s ! 00c <V^8dQhRS[/#rr )rFrs"r;rGrts))c)r=c,\VP4#r)rUrrs&r;_running_agent_count"GatewayRunner._running_agent_countts4''((r=c <V^8dQhRS[/#rr_)rFrs"r;rGrwsDDcDr=c.VP'dR#R#)restartshutdown)_restart_requestedrs&r;_status_action_label"GatewayRunner._status_action_labelws 333yCCr=c <V^8dQhRS[/#rr_)rFrs"r;rGrzszzszr=c RVP'd \R4#\R4#)zRLocalized "restarting" / "shutting down" for the busy/drain notices shown in chat.zgateway.busy.action_restartingz!gateway.busy.action_shutting_down)r}rrs&r;_status_action_gerund#GatewayRunner._status_action_gerundzs%6:6M6M6Mq12ySTUxSyyr=cJ<V^8dQhRS[S[,RS[S[,RR/#)r? gateway_state exit_reasonrBNr)rFrs"r;rGr~s. % %HSM %W_`cWd %pt %r=c\VRR4'dR#VR8XdVP4MRp\WVPVP 4VR7R#)_startup_cleanup_onlyFNdraining)rrrestart_requested active_agents active_work)r8_describe_active_workrr}_active_work_count)rrrrs&&& r;_update_runtime_status$GatewayRunner._update_runtime_status~sR 40% 8 8 7Dz6Qd002W[ #'"55TE\E\E^# %r=c<V^8dQhRR/#rr)rFrs"r;rGrsMMMr=c :\VP4R7R#)aPersist the live in-flight agent count to ``gateway_state.json`` at every turn boundary. Passes ONLY ``active_agents`` so the read-merge-write keeps lifecycle state (gateway_state=None would clobber it). Best-effort: a failed write must never disrupt a turn.)rN)rrrs&r;_persist_active_agents$GatewayRunner._persist_active_agentss $$2I2I2KLr=c <V^8dQhRS[/#r)r)rFrs"r;rGrsGGCGr=c VP4UUu0uF"wrVfK V\JgK\V4kK$ upp#uuppi)u``id()`` of every agent mid-turn — identity-keyed so the lookup is O(1) and independent of ``AIAgent.__eq__`` (MagicMock overrides it in tests).)rrr4)rras& r;_running_agent_ids GatewayRunner._running_agent_idssO#'";";"=G"=$!%&.E%E1"=G GGsAAAc6<V^8dQhRS[S[S[3,/#r)rrDr )rFrs"r;rGrsbb$sCx.br=cnVP4UUu/uFwrV\JgKWbK upp#uuppir)rr)rrrs& r;_snapshot_running_agents&GatewayRunner._snapshot_running_agentss3!%!:!:!<a!<I`@`!<aaas11c,a]tRtRtoV3RltRtVtR#)GatewayRunner._BusySteerOutcomeicV<V^8dQh/S[;R&S[;R&S[;R&S[;R&S[;R&#)r?effective_modedemoted_for_subagentsdemoted_for_compressionsteered redirectedrd)rFrs"r;rG,GatewayRunner._BusySteerOutcome.__annotate__sC $#"&%     r=rN)r6rDrErFrrHrrs@r;_BusySteerOutcomersr=rg$@z.restart_failure_countsrrrzgateway.busy.reject_modelz codex-runtimez!gateway.busy.reject_codex_runtimemoazgateway.busy.reject_moac <V^8dQhRS[/#rr_)rFrs"r;rGrscr=c V^RIHpV!4;'gR# \dR#i;i)z0Return the profile name this gateway represents.r_r)rSrXrL)rrXs& r;_active_profile_name"GatewayRunner._active_profile_names-  C*,99 9  s ((allow_adapter_delegationTc,<V^8dQhRS[RS[RS[/#)r?rrrBrrm)rFrs"r;rGrs* A A# ABF ARV Ar=c BaaaRVVV3RllpSPSV4#)zAuthorize under the live transport's profile, not the routed runtime (which need not copy the shared bot token/allowlist); the transport home is stamped on the source for this read only.c$V^8dQhR\/#rr)rFs"r;rGBGatewayRunner._is_user_authorized_for_source..__annotate__s T T Tr=c\<S'dSPS4#SPSRR7#)F)r)_is_user_authorized)rrrsr;_check._checks-'//77++FU+S Sr=_under_authorization_profile)rrrrsffd r;_is_user_authorized_for_source,GatewayRunner._is_user_authorized_for_sources$ T T 00@@r=c&<V^8dQhRS[RS[/#rr)rFrs"r;rGrsbbMbdbr=c 4aaSPSVV3Rl4#)zCount a bot message under the profile that authorized it, so the guard's peek, count and config all read the transport profile's ``gateway.bot_loop_guard``.c&<SPS4#r)_admit_bot_messagersr;r=GatewayRunner._admit_bot_message_for_source..sAXAXY_A`r=rrsffr;_admit_bot_message_for_source+GatewayRunner._admit_bot_message_for_sources009`aar=c <V^8dQhRS[/#)r?rrj)rFrs"r;rGrs=r=cVPV4pVfV!4#\\V44;_uu_4V!4uuRRR4# +'giR#;ir)_authorization_home_for_sourcerr)rrcheckauthorization_homes&&& r;r*GatewayRunner._under_authorization_profilesE!@@H  %7N #D);$< = =7> = = =s A  A c$<V^8dQhRS[RR/#r^r_)rFrs"r;rGrsr=cV'dVfR#\VRR4pVf\4pW0n\P!V4W1&TPT4\TRR4p\T4T8dTPRR7K$R# \ d\ PRTRR7R#i;i \ dR#i;i) N_session_sourcesz*Failed to cache live session source for %sTrG_session_sources_maxiF)last) r8rrrmrrLrMrN move_to_endrUpopitem)rr@rcached_sourcesmax_sizes&&& r;_cache_session_source#GatewayRunner._cache_session_sourcesfn  '94@  !(]N$2 ! *5*=*=f*EN '   & &{ 3t%;SAHn%0&&E&21   LLE{]aL b     s$B AB8#B54B58 CCc <V^8dQhRS[/#r)r)rFrs"r;rGrs%6r=c \VRR4pVeVPVPJd\VP4pWnV#)z>Return the single async facade for this runner's SessionStore._async_session_storeN)r8_storerrr)rfacades& r;async_session_store!GatewayRunner.async_session_storesD5t< >V]]$2D2DD&t'9'9:F(. % r=c <V^8dQhRS[/#ryr_)rFrs"r;rGrscr=cV'd\VRR4MRpV'gR#VPV4pVe4\\4;_uu_4VP V4RRR4V#V# +'giT#;i)rN)r8r~r}rLr)rr@rrs&& r;_get_cached_session_source(GatewayRunner._get_cached_session_sourcesgDO'94@UY##K0  )$$**;7% v %$ s A,, A= c0a]tRtRtoRtV3RltRtVtR#)GatewayRunner._HygieneSettingsizfj$7Gfi6G'B/03G H_-'' CLA'' 3w<@A(:gfi6<<"=CCE x+H~H)0% &r=r0rrc<V^8dQhRS[S[,RS[S[,RS[S[,RS[S[,RS[S[,RS[S[,RS[S[S[S[3,,/#)r?rrrr0rrrB)r rtrDr r)rFrs"r;rGrQsp *5=c]OWX[}C=>Fsm#+34S>*Br=c VfR#RV/pVPWW4VR7'd6RVR&\V4pV'd VR 9dWR&Ve\V4VR&V\P8XdVe\V4VR&V#) zGBuild thread metadata for synthetic sends that only have routing state.Nr)r0rT telegram_dm_topic_reply_fallbackdirect_messages_topic_idtelegram_reply_to_message_idr>rr)_is_telegram_dm_topic_targetrDrtru) rrrrr0rrrtids &&&&$$$ r;r)GatewayRunner._thread_metadata_for_targetQs  $/#;  , , yw - P P;?H7 8i.Cs)+7:34".;>?R;S78 x~~ %*=*I%()<%=H\ "r=c <V^8dQhRS[S[,RS[S[,RS[S[,RS[S[,RS[S[,RS[/#)r?rrrr0rrB)r rtrDr rm)rFrs"r;rGrhsS8$/7}IQRUC=2:3-KOr=c `V\P8wgVfR#VR8XdR#Ve]V'dU\\V4RR4p\ V4'd.V!V\ V4\ V44p\ V\4#R# \d\PRRR7R#i;i)z>Return True when a target is a Telegram private DM topic lane.NFr2T_get_dm_topic_infoz,Failed to inspect Telegram DM topic metadatarG) rtTELEGRAMr8r5rOrDrrrLrMrN)rrrr0rget_dm_topic_info topic_infos&&&$$ r;r*GatewayRunner._is_telegram_dm_topic_targetgs x(( (I,=    7 'W 7KT R )**8!27CL#i.!YJ&j$77 !`LL!OZ^L_ `sB"B-,B-c&<V^8dQhRS[RS[/#)r?r@rB)rr)rFrs"r;rGrsVVV4Vr=c  ^RIHp\VRR4;'g/PVPP 4p\VRR4p^RIHpV!4pVPRR4pT!R/RVPP PbR VPPbR VPP'd \VPP4MR bR VPP;'gR bR VPP'd \VPP4MR bRVPP'd \VPP4MR bRVPP 'd \VPP 4MR bRVPP"'d \VPP"4MR bR\\VPRR 4;'gR 4bR\\VPRR 4;'gR 4bRVP$bRVP&;'gR bRVPP('d \VPP(4MR bR\VPRR 4;'gR bRVbRR bRVbVB#)zSet session context variables (contextvars, not os.environ, so concurrent messages can't overwrite each other). Returns reset tokens for ``_clear_session_env`` in a ``finally``.)set_session_varsrNsupports_async_deliveryT)api_session_varssession_history_deliveryrrr0rrrr user_id_alt user_namerparent_chat_idr@rrr1async_delivery cron_sessionr)rrr8r~rrgateway.session_api_turnrrrrr0rDrrrrrr@rr)rr@r_adapter_async_deliveryr _api_vars_history_deliverys&& r;_set_session_envGatewayRunner._set_session_envs =D*d399r>>w~~?V?VW!(,EtL >$& %MM*DdKV^^,,22VNN**V8?~~7O7O7Oc'..223UWVnn..44" V 8?~~7O7O7Oc'..223UW V 4;>>3I3I3IC../r V>;U;U;UGNN667[]V8?~~7O7O7Oc'..223UWVR@FFBGVww~~7GLRRPRSV ++V))//RV:A9R9R9Rs7>>445XZV GNNIr:@@b!V"+#V$%V$7H9%V Vr=c$<V^8dQhRS[RR/#)r?tokensrBNr)rFrs"r;rGrs###$#r=c "^RIHpV!V4R#)z>Restore session context variables to their pre-handler values.)clear_session_varsN)rr$)rr!r$s&& r;_clear_session_env GatewayRunner._clear_session_envs >6"r=c <V^8dQhRS[/#)r?r@)r)rFrs"r;rGrs,,.,r=c# "VPV4pRxVPV4R# TPT4i;i5i)zBind session context variables for the duration of the block, e.g. a plugin command handler invoked outside the normal agent-turn path (``_set_session_env`` is otherwise only reached there). Always cleared on exit, including on exception.N)rr%)rr@r!s&& r;_session_env_scope GatewayRunner._session_env_scopes; &&w/ ,   # #F +D # #F +sA,A?Ac "\P!4p\4pVP!VP 4VP V.VO5!GRjxL #L5i)zJRun blocking work in the thread pool while preserving session contextvars.N)rrrr _get_executorr)rfuncrr?r#s&&* r;r+GatewayRunner._run_in_executor_with_contextsH'')n))$*<*<*>UPTUUUUsAAAAc "\P!4pVP!VP4\ 4P V.VO5!GRjxL #L5i)aRun best-effort session housekeeping off the TURN pool. Callers of this helper bound their await with ``asyncio.wait_for`` and, on timeout, log "the worker thread is left to finish on its own" and proceed. That bounds the AWAIT but NOT the OCCUPANCY: a ``concurrent.futures`` work item that has already begun executing is not cancellable, so an abandoned worker keeps its thread until its blocking call returns. The turn pool is unbounded (one thread per turn), so sharing it would let wedged housekeeping grow threads without limit. Housekeeping therefore gets its own bounded pool; exhausting that one delays only more housekeeping, which is best-effort by construction. N)rrr_get_housekeeping_executorrr)rr-rr?s&&* r;_run_housekeeping_in_executor+GatewayRunner._run_housekeeping_in_executorsW'')))  + + -|~/A/A4PJNPP PPsAAAAc<V^8dQhRS[RS[.S[PP3,RS[PP/#)r?r make_poolrB)rDr rrExecutor)rFrs"r;rGrsM   ZEWEWE`E`A`8a fpfxfxgBgB r=c X\VRR4pVf\P!4pW0nT;_uu_4\VRR4'd \ R4h\WR4pVe\VRR4'dV!4p\ WV4VuuRRR4# +'giR#;i)zeReturn (creating under ``_executor_lock``) the pool at ``attr``; one lock + closing flag fences both._executor_lockN_executor_closingFz.Gateway is shutting down; executor unavailable _shutdown)r8rrr7rsetattr)rrr4rexecutors&&& r;_get_or_create_pool!GatewayRunner._get_or_create_poolst-t4 <>>#D"&  Tt0%88"#STTt40H78[%#H#H$;H-TTTs AB B) cH<V^8dQhRS[PP/#rrrr5)rFrs"r;rGrs# f fz11:: fr=c 2\PVRR4#)aReturn the gateway-owned, UNBOUNDED executor for turn bodies and other blocking agent work. A turn body holds its thread for the whole turn (every tool call blocks), so a finite pool silently queued already-accepted turns behind running ones. Actual bound: one live turn per session, plus turns abandoned by the inactivity timeout (run_turn keeps no handle; their thread runs to completion). ``max_concurrent_sessions`` is the only admission cap and is unset by default. _executorc\RR7#)zhermes-gateway)thread_name_prefixr.rr=r;r-GatewayRunner._get_executor..s '?Sc'dr=rr<rs&r;r,GatewayRunner._get_executors!00 +df fr=cH<V^8dQhRS[PP/#rr?)rFrs"r;rGrs#``J,>,>,G,G`r=c 2\PVRR4#)zGReturn the gateway-owned executor for best-effort session housekeeping._housekeeping_executorcL\PP\RR7#)zhermes-gateway-hk) max_workersrC)rrThreadPoolExecutor_HOUSEKEEPING_MAX_WORKERSrr=r;r:GatewayRunner._get_housekeeping_executor..s!J&&995J]:_r=rErs&r;r0(GatewayRunner._get_housekeeping_executors#00 * _` `r=c <V^8dQhRS[/#rr")rFrs"r;rGrs???r=c Vf.#VPRRR7\\VRR4;'gR4# \dTPRR7L?i;i)zgShut ``executor`` down without waiting; return its threads to join (`_threads` absent on test doubles).NFT)rcancel_futures)r_threadsr)r|r/rr8)r;s&r; _stop_poolGatewayRunner._stop_poolsg  I *   5  >GHj$7==2>> *   5  ) *s;AAc&<V^8dQhRS[RS[/#)r? drain_timeoutrB)rErQ)rFrs"r;rGrsAAAAr=c D\VRR4pVf^#V;_uu_4RVn\VRR4pRVn\VRR4pRVnRRR4\P X4\P X4,p\ P!4\\T;'gR4R4,pVF9pV\ P!4, pV^8:dMVPV4K; \RV44# +'giL;i)uStop the gateway-owned pools; returns the number of worker threads still running. ``drain_timeout=0`` is fire-and-forget; shutdown passes a bounded budget so blocking DB work cannot outlive ``SessionDB.close()``. ``cancel_futures`` only drops unstarted work and cancelling a ``run_in_executor`` awaitable does not stop its thread, so running workers are joined — on the turn pool AND the housekeeping pool, both of which write to SessionDB.r7NTrArIrc3T"TFqP4'gK^xK R#5i)rN)is_alive)rworkers& r;r3GatewayRunner._shutdown_executor..s@7oo.?117s( () r8r8rArIrrTrrrPrErsum) rrWrr; housekeepingworkersdeadliner[ remainings && r;_shutdown_executor GatewayRunner._shutdown_executors t-t4 < T%)D "t[$7H!DN"4)A4HL*.D '  **84}7O7OP\7]]>>#c% 0D0D*Es&KKF 4>>#33IA~ KK "  @7@@@#Ts 0D D c*<V^8dQhRS[RS[RR/#)r?rinterrupt_depthrBN)r rQ)rFrs"r;rGr,s"""3"""r=c V^8XdP\P!4VnRVn\PVn\ VR4'd^Vn^VnR#)usReset per-turn state on a cached agent before a new turn starts. The activity ts/desc/provenance triple resets together and only at depth 0 — else a session idle 29 min trips the watchdog before the first call; interrupt-recursive turns keep it so stuck-turn idle time accumulates to the 30-min timeout. ``_last_activity_ts``, ``_last_activity_desc``, and ``_last_activity_provenance`` are only reset for fresh external turns (depth 0); they are a semantic triple - description and provenance describe the activity *at* ts, so updating one without the others would make get_activity_summary() misleading. See #15654, #9051. zstarting new turn (cached)_last_flushed_db_idxN) r_last_activity_ts_last_activity_descr)UNKNOWN_last_activity_provenancerIrg_api_call_count)rres&&r;_init_cached_agent_for_turn)GatewayRunner._init_cached_agent_for_turn+sP a &*iikE #(DE %.@.H.HE +u455-.* !r=cL<V^8dQhRS[RS[S[,RS[S[,/#)r?radapter_profilerB)rr rD)rFrs"r;rGrBs-22#26>sm2 #2r=c \VRR4p\VRR4'gR#\VRR4pV'gR#VfO\\VRR44'dVPV4MRp\V\4'd V^,p^RIHpHpV!WAPP\VRR4VP\VR R4\VR R4V\VR R4R 7pT'd\T4U U u0uFwrT kK p p p TP T 9dI\PRTPTP 4T!TPTP 4hTP #\P#RTPPTP\TR R4\TR R44R# \d<p \PR TPTPRR7T!R4T hRp ? ii;iuup p i \d;p \PRTPRR7T!TP4T hRp ? ii;i)uResolve the profile name for an inbound source via configured routes (most specific wins). ``None`` = default/active profile (or, for a secondary adapter, its own profile — the caller stamps it). Gated on ``multiplex_profiles``, since the scoped run only activates under multiplexing; otherwise keys would be profile-namespaced while the agent ran in ``agent:main``. ``adapter_profile`` is the profile owning the receiving bot; only routes declaring it as ``bot_profile`` apply (#104933).rNrrFprofile_routes_transport_adapter_ref)ProfileRouteRejectedmatch_profile_routeguild_idrrr)rrvrrrrprz.Rejecting %s/%s: profile route matching failedTrGmatcherzORejecting profile route %r because the served-profile set could not be resolvedz;Rejecting profile route %r: target profile %r is not servedzONo profile route matched: platform=%s chat_id=%s thread_id=%s parent_chat_id=%s)r8rO_transport_ownerrrgateway.profile_routingrtrurrrrLrMrrUr-r1rN) rrrprroutesownerrtrumatchedrYr-r[serveds &&& r;_profile_name_for_source&GatewayRunner._profile_name_for_sourceBsx.v3U;;!148  "5=gfNfhl>m5n5nD))&1txE%''"'(U ;)!6!6Q[]aAb'&+t2T&v/?F /TX9Y [G  B2J62RS2R;4$2RS f,QLL'//3+7<<II?? " ] OO ! !6>> FK .@PRV0W Y/ ; NN@$  @'y1s :  ;T BeLL41+7<<8cA  BsCAG 7H HH H6H  HH I#5IIc&<V^8dQhRS[RS[/#r)rr)rFrs"r;rGrvs"%"%}"%"%r=c  ^RIHp^RIHp^RIHpHpHp^RIH pV!V4pVe VP#Rp VP;'gRP4;'gVPV4p T ;'gRp V 'gV!4;'gRp V!V 4p V 'dWV!V 4'gI\PRWP P"VP$\'VR R44V!4#V # Tdh\(dY\PR TP P"TP$\'TR R4T ;'gR R R 7T!4u#i;i)zResolve which profile's HERMES_HOME serves this source: the pinned identity's runtime home, else ``source.profile``, then ``_profile_name_for_source`` (sources bypassing ``build_source``), then the active profile.)rtr])rXrYprofile_exists)rNrrz\Profile %r does not exist for source %s/%s (guild_id=%s), falling back to global HERMES_HOMErvzjFailed to resolve profile directory for source %s/%s (guild_id=%s), falling back to global HERMES_HOME: %sz (no profile)TrG)ryrtrcr^rSrXrYrrr runtime_homer1rr~rMrrrrr8rL) rrrtr^rXrYrrreexplicit_profiler-rgs && r; _resolve_profile_home_for_source.GatewayRunner._resolve_profile_home_for_sourcevsH A8``4v&  (( ( %NN((b//1ZZT5R5RSY5ZD#||t .0==I)$/Kt(<(<9$oo&;&;V^^FJ5 7 '(( #   % NN9%%v~~wvzSW7X 22NT  C #$ $  %sOD D#D> D DD* D8ADDE,AE,E,+E,cxa]tRtRtoRtRtRtRtRtRt Rt Rt Rt Rt RtRtRtRtRtRtRtRtRtV3RltRtVtR#)GatewayRunner._RunAgentDisplayizQPer-turn display / progress settings resolved by ``_run_agent_display_settings``.Nc<V^8dQh/S[;R&S[;R&S[;R&S[;R&S[;R&S[;R&S[;R&S[;R&S[;R &S[;R &S[;R &S[;R &S[;R &S[;R&S[;R&S[;R&S[;R&S[;R&#)r?rrrdisabled_toolsetsr progress_modeprogress_grouping_display_surface_modetool_progress_enabled_live_status_mode_live_status_adapterlog_mode_enabled log_queue"interim_assistant_messages_enabled_thinking_enabled_native_slack_task_cardsneeds_progress_queue_generic_status_phraser)rFrs"r;rG+GatewayRunner._RunAgentDisplay.__annotate__s  $  % "%+!% #) #)%"($ -06!"%#$#&,%&"('(!$*)r=r)r6rDrErFrGrrrrrrrrrrrrrrrrrrrrHrrs@r;_RunAgentDisplayrsw_  $!%'+! !%%)%)!%$( $ 26*!%(, $(&*)r=rcTa]tRtRtoRtRtRtRtRtRt Rt Rt Rt Rt V3RltRtVtR#)GatewayRunner._RunAgentWorkerizPExecutor future + inactivity-watchdog handles for one ``_run_agent_inner`` turn.Nrc<V^8dQh/S[;R&S[S[,;R&S[S[,;R&S[;R&S[;R&S[;R&S[;R&S[;R&S[;R &#) r? executor_task agent_timeout agent_warningrrrrr is_current)r r rErD)rFrs"r;rG*GatewayRunner._RunAgentWorker.__annotate__s! -   -   $! r=r)r6rDrErFrGrrrrrrrrrrrHrrs@r;_RunAgentWorkerrs=^! )- )-  $ !   r=rc<V^8dQh/S[;R&S[;R&S[;R&S[;R&S[;R&S[;R&S[S[,;R&S[;R&S[;R &S[;R &S[;R &S[;R &S[;R &S[;R&S[S[,;R&S[S[P,;R&S[S[P,;R&S[S[S[S[S[ S[P3,3,,;R&S[S[ ,;R&S[;R&S[S[P,;R&S[S[P,;R&S[S[ ,;R&S[S[ ,;R&S[;R&S[S[ P,;R&S[;R&S[S[P,;R&S[S[S[3,;R&S[ ;R&#)r?_busy_input_mode_busy_text_mode_restart_drain_timeout_restart_after_turn_timeout_cron_drain_timeout_signal_interrupt_grace_timeoutrZ _draining_external_drain_activer}_restart_task_started_restart_detached_restart_via_service _detached_restart_helper_started_restart_command_source _stop_task _restart_task_profile_failed_platforms_systemd_watchdog_startup_restore_in_progress_startup_warmup_task_loop_heartbeat_task_loop_floor_timer_handle_loop_liveness_watchdog_gateway_started_at_shutdown_watchdog_done _platform_lock_takeover_on_start_reconnect_watcher_task_BUSY_REJECT_TEXT_CACHE_BUSTING_CONFIG_KEYS)rDrEr rQrmrrTaskrrtr rrr)rFrs"r;rGr s '!"&#$"I%&"'S'(C)*&+[+, $-./0!(12$34 '56#78&9:'+2;<&m4;=>&-?@GLL)0AB (S$x7M2N-N(OPWCD }+EF#'.GH#7<<07I|#7<<07}~'sm2@&c]1AB$CD&ioo6=EF'+2GH&gll3:In CH~*o \!&S]r=) rrAr8r7rIrrr rr&rrrrFr|>rDrErestart_interrupted)r))rr)rr)rr)rr)rmodel_thresholds)rthreshold_tokens)rcodex_gpt55_autoraise)rcodex_app_server_auto)rcodex_responses_native)r!codex_responses_compact_threshold)rrh)rcheckpoint_required)r micro_compact)rmicro_compact_every_n_turns)r%micro_compact_defrag_threshold_tokens)r target_ratio)r tail_mode)rprotect_last_n)rproactive_prune_tokens)r proactive_prune_min_result_chars)r"proactive_prune_min_reclaim_tokens)rmin_tail_user_messages)rr)memoryrV) checkpointsr)r max_snapshots)rmax_total_size_mb)rmax_file_size_mb)r6rDrErFrGrrrrrrrrrrrrZrrr}rrrrrrrrrrrrrrrrr_turn_lease_tokensrrrrrrrrrrrrrrrrJrbrrrrrrrrrrr"propertyr6setterr7r@rr_VOICE_MODE_PATHshould_exit_cleanlyshould_exit_with_failurerrDrgr;_TELEGRAM_GENERAL_TOPIC_IDS#_TELEGRAM_LOBBY_REMINDER_COOLDOWN_Srorsrwr~rrrrr_BUSY_QUEUE_MAX_PENDINGrm dataclassr_CLEANUP_TIMEOUT_S_FINALIZE_TIMEOUT_S_STUCK_LOOP_THRESHOLD_STUCK_LOOP_FILE_AUTO_RESUME_REASONS_MAX_SUPERVISED_RESTARTS_SUPERVISED_HEALTHY_SECS"_RECONNECT_WATCHER_SLOW_RETRY_SECS_MAX_SLOW_WATCHER_RESPAWNS$_TELEGRAM_CAPABILITY_HINT_COOLDOWN_S_APPROVAL_TIMEOUT_SECONDS_MAX_INTERRUPT_DEPTHrrrrrrrrrrrr staticmethodrrrtr rurSIGNALrEMAILSMSDINGTALKFEISHUWECOMWECOM_CALLBACKWEIXIN BLUEBUBBLESQQBOTr_UPDATE_ALLOWED_PLATFORMSrr%_contextmanagerr)rr1r<r,r0rTrbrrmr~rrrrrHrrs@r;rr s  b2(&O$I)S!C-[# $JI#($"'#!&-2$7;)-J,0MSW'+). 37++<=O-.BC12JK'7L4623LM34NO';<^'_$#78V#W &:;\&]#/0FG)*:;N"67T"U,-@A-A0.2*12JK+,>?-.BC12JK?? BB 1148.2-1!$9=-2$6:&+&+P9^9^v88((880^^.QQ<$&??"#BC'(LM9:K56IB#,RI"6*.'aa&))DDzz % %MM GG bb!0 %%cd "),&!"+0( # ,< ()*  AIM A Abb (    $$L#'NR"&,#'BF*++BC!*8>>8+<+)S$"",22h"%"%H+++*   Mr=rg?chV^8dQhR\PR\PR\RR/#)r? stop_eventr?rrBN)rrrrArE)rFs"r;rGrGs6*'*'*'/6/H/H*'*'#'*'r=c^RIHpHpV!4pVP4'gVP 4'd[\ VRR4'gH\ VRR4'd5V!4'gVP V4KsVPVR4R#TP T4KR# \d!p\PRT4Rp?L;Rp?ii;i)uPoll for the planned-stop marker and trigger graceful shutdown (Windows lacks ``add_signal_handler``, so ``hermes gateway stop`` would never drain). Runs everywhere; on POSIX the signal handler consumes the marker first and ``_running``/``_draining`` guard re-triggers. On Windows, ``asyncio.add_signal_handler`` raises NotImplementedError for SIGTERM/SIGINT, so the standard signal-driven shutdown path never runs when ``hermes gateway stop`` signals the gateway. The consequence is that the drain loop is skipped — in-flight agent sessions are killed mid-turn and ``resume_pending`` is never set, so the next gateway boot has no idea those sessions need to be auto-resumed (issue #33778, v0.13.0 session-resume feature broken on native Windows). )_get_planned_stop_marker_path planned_stop_marker_targets_selfrF_runningNz#Planned-stop watcher tick error: %s) rjrr rrr8rcall_soon_threadsaferLrMrN) rryr?shutdown_handlerrrr marker_path_es &&&&$ r;_run_planned_stop_watcherr sI/1K!! D""$$ U;;FJ66899OOM2))*:DA  &5"0 D LL> C C Ds(B,2B,0B,B,, C7CCc(V^8dQhR\RR/#)r?labelrBNr_)rFs"r;rGrGs11s1D1r=cvV!V/VBR# \d"p\PRY4Rp?R#Rp?ii;i)zRun one housekeeping chore; failures log at debug (a persistent failure such as a broken import after a partial update would otherwise warn every tick forever) and never stop the loop.z %s error: %sNr)r rrkwargsrYs&&*, r;_housekeeping_chorer s51 DF 1 ^U001s 838cV^8dQhRR/#rr)rFs"r;rGrGs # #t #r=c^RIHpVe4\V!V4V\RR7pVeVP ^R7R#R#R#)r)build_channel_directoryNz*Channel directory refresh scheduling error)rM log_messager)gateway.channel_directoryr rrMr)rr?r futs&& r;_housekeeping_channel_directoryr sFA ' #H -tFDF ? JJrJ "  r=cV^8dQhRR/#rr)rFs"r;rGrGs``4`r=cd^RIHpV!4wrV'd\PRW4R#R#)r)_sweep_expired_pastesz4Paste sweep: deleted %d expired paste(s), %d pendingN)hermes_cli.debugr rMr)r deletedras r;_housekeeping_paste_sweepr s'6.0G JG_r=cV^8dQhRR/#rr)rFs"r;rGrGsLLTLr=cf^RIHpV!WVR7pV'd\PRV4R#R#)zExternal cron providers only: fire jobs whose time passed with no external fire delivered (dead loopback hop). No-op for the built-in ticker; enforces misfire_grace_minutes; CAS claim de-dupes.)fire_overdue_jobsrr?z)Misfire catch-up: fired %d overdue job(s)N)cron.scheduler_providerr rMr) cron_providerrr?r caught_ups&&& r;_housekeeping_misfire_catch_upr s*:!-NI ?Kr=cV^8dQhRR/#rr)rFs"r;rGrGsmmtmr=c:^RIHpV!\R4RR7R#)zYmaybe_run_curator() is gated by config.interval_hours (7 days default); this is the poll.maybe_run_curatorinfc.\PRV4#)z curator: %s)rMr)rTs&r;r'_housekeeping_curator..sFKKXegjLkr=)idle_for_seconds on_summaryN) agent.curatorr$ rEr# s r;_housekeeping_curatorr+ s/uU|@klr=cV^8dQhRR/#rr)rFs"r;rGrGs((4(r=c,^RIHpV!\R7R#)uPlugin update-check cadence (plugins_cadence): due-gated by plugins.auto_update_check_hours, read-only, receipt-surfaced; the opt-in auto-apply rides the manual update pipeline. A network error costs one warning and a stamped marker — never an apply.maybe_run_gateway_check)logN)hermes_cli.plugins_cadencer/ rMr. s r;!_housekeeping_plugin_update_checkr2 s C'r=c\V^8dQhR\\\\3,,/#rr rr)rFs"r;rGrG s! 1 1HU4:->$? 1r=cR\VRR4pVfR#\4\V43#)u``(launch home, its configured transcript dir)``, or ``None`` when the gateway carries none. MUST be called outside any profile scope — ``get_hermes_home()`` is what identifies the launch home. Consumed by :func:`_profile_sessions_dir`. sessions_dirN)r8rr)rr6 s& r;_launch_sessions_dirr7 s. 6>48L  d<0 00r=chV^8dQhR\\\\3,,R\/#)r?launchrBr4 )rFs"r;rGrG,s(  (5t+<"= $ r=c\4pVe*\V^,4V8Xd\V^,4#VR, #)aTranscript dir of the profile currently in scope. ``gateway.sessions_dir`` overrides the LAUNCH profile's transcript dir only; every other served profile keeps ``/sessions``. Hardcoding ``/sessions`` for the launch home too wrote transcripts to the configured dir while the prune unlinked under the default one, orphaning every pruned session's ``.json``/``.jsonl``/``request_dump_*`` forever. r/)rr)r9 r+s& r;_profile_sessions_dirr; ,s:  D d6!9o5F1I * r=c`V^8dQhR\\\\3,,RR/#)r?r9 rBNr4 )rFs"r;rGrG:s)xdDj8I/JVZr=c ^RIHp^RIHpHpV!4P R4;'g/pVP RR4'gVP RR4'gR#V!4pVP RR4'dFVP \VP R^44\VP R ^44R 7VP RR4'dVP\VP R ^Z44\VP R ^44\VP R ^44\VP R R44\V4R7V!V4R# T!T4i;i)uStale-session auto-archive plus auto-prune/VACUUM for ONE profile's state.db; both are gated by sessions.min_interval_hours (VACUUM additionally by its own throttles). Opens its own SessionDB — SQLite connections are thread-bound. Profile-scoped by its caller: ``acquire()``, ``get_hermes_home()`` and ``load_config()`` all resolve through the active scope, so an unscoped run swept only the LAUNCH profile's store with the LAUNCH profile's retention settings and a multiplexed secondary was never archived, pruned or vacuumed by anyone — the dashboard/serve trigger defers to the gateway for every profile a gateway owns (``web_server_sessions``). *launch* carries the launch home's configured transcript dir (:func:`_launch_sessions_dir`) so its override still governs its own profile.) load_config)r r1r/ auto_archiveF auto_pruneNauto_archive_daysmin_interval_hours) idle_daysrB retention_daysmin_vacuum_interval_daysvacuum_after_pruneT)rD rB rE vacuumr6 ) rr> rr r1r~maybe_auto_archiverErQmaybe_auto_prune_and_vacuumrmr; )r9 _load_full_configr r1 _sess_cfg_adbs& r;"_housekeeping_state_db_maintenancerM :s7C?"$((4::I MM.% 0 0IMM,PU4V4V 9D  == / /  # # .A1 EF#&y}}5I2'N#O $ Q ==u - -  , ,"9==1A2#FG#&y}}5I2'N#O),Y]];UWY-Z)[IMM*>EF26: - < s)E+AE+BE++ E5cV^8dQhRR/#rr)rFs"r;rGrG[s : :$ :r=c ^RIHpV!4;_uu_4pVFSp\VRR4p\V4'gK#V!4'gK2\P R\VRR44KU RRR4R# +'giR#;i)zA SessionDB opened while another process held the rebuild lock fails closed onto the LIKE fallback and the gateway stays up for days. Non-blocking, rate-limited inside SessionDB; no-op when not stale.)borrow_live_shared_session_dbsretry_deferred_fts_recoveryNzUDeferred state.db FTS rebuild completed in-process for %s; full-text search restored.db_pathzstate.db)rrP r8rOrMr)rP _session_dbs_sdb_retrys r; _housekeeping_deferred_fts_retryrV [sg E ' ) )\ DT#@$GFFHH kD)Z8:! * ) ) )s!A: A: %A:: B cV^8dQhRR/#rr)rFs"r;rGrGks9949r=c$^RIHpV!RR7R#)z[Messaging-gateway counterpart to the TUI idle reaper; config-gated and rate-limited inside. trim_memoryzmessaging gateway housekeepingruN)hermes_cli.mem_trimrZ rY s r;_housekeeping_memory_trimr\ ks/78r=cV^8dQhRR/#rr)rFs"r;rGrGqsr=c ^RIHpV!4R#)zCheckpoint store retention + size cap on a live timer; ``auto_prune_from_config`` gates on ``checkpoints.auto_prune`` and the 24h ``.last_prune`` marker. Off the startup path because its ``git gc`` can block for tens of seconds on a large store.auto_prune_from_configN)tools.checkpoint_maintenancer` r_ s r;_housekeeping_checkpoint_prunerb qsDr=cV^8dQhRR/#rr)rFs"r;rGrGysHHHr=c^RIHp^RIHpVfVeVPW4R#\ V4FwrVVfTpM\ VR/4P V4pVfK.\T;'g \44;_uu_4Ve:V'g2V'd*VP4pV'dVPW4pVPWq4RRR4K R# +'giK;i)zDrain each profile's worker queue through its matching live adapters. A credential-less satellite profile (empty adapter map) drains through the primary's adapters routed by its own profile routes.) scheduler)scheduler_preflightNr) cronre rf drain_delivery_queuer~r8r~rr(_primary_profile_routes_for_current_homeSharedRouteAdapters) rr?rycron_schedulersched_preflightrrprofile_adaptersrzs &&& r;#_drain_restart_safe_cron_deliveriesrn ys1; ~    / / ?&;F&C"  ' &v/BBGKKLY   #  #L$E$EO4E F F'0@X(QQS'6'J'J8'\$  / /0@ G G F'DG F Fs C#C#C#3"C## C4 cDV^8dQhR\PR\/#r?rintervalrrrQ)rFs"r;rGrGs$E0E0E0EHE0r=caaaaa^RIHpHpHp ^RIHp Hp ^RIHp H o^R\3.p SfSeV P^VVVV3Rl34V ^RVV3Rl3^.s/RS[]aci/jr=zChannel directory refreshc0<S;'d \SS4#r)r r sr;rr~ s1m1m>]^fhl>m1mr=zMedia cache cleanupz Paste sweepzAuto-prune low-disk promptc<S!SS4#rr)r?rz rysr;rr~ s.__annotate__s m md mr=c\<Se \S4UUu.uFwrVNK upp#R.#uuppir)r~)rur+rys r; served_homes1_start_gateway_housekeeping..served_homess3NTN`,A&,IJ,I[UD,IJ lgkfl lJs (c<\SSS4#rr| r} sr;rr~ s"EhPTV\"]r=z+Gateway housekeeping started (interval=%ds)zGateway housekeeping stopped) gateway.run_delivery_queue_watchrt ru rv gateway.run_profile_reconcilerw rx gateway.run_housekeeping_diskry rz rrsr restart_if_deadr+ r7 r8r2 rV r\ rb rMrrr )rrr?rq r ry cron_threadrt ru rv rw rx ry chores queue_watchr tick_counteveryr rrz s&ff&ff& @r;_start_gateway_housekeepingr sedZe !<= *?F v1  q+'jkl ')mn "$=> ]5688F  MM124fgh  q24yz{  q2K4O4OPQ  ^1&:OPQ (*> /$0OP <+= > !#7@a#bc %'GH .0IJ "$:6$BC #%CD#FFF*Kv1 m m) ]_  KK=xHJ!!a & E5"E!Q&#E2.!' :>QR KK./r=cDV^8dQhR\PR\/#rp rr )rFs"r;rGrGs#``9??`X[`r=cB^RIHpV!4PWW#R7R#)uDEPRECATED shim — runs ONLY the built-in in-process cron tick loop; the trigger now lives behind the ``CronScheduler`` provider and housekeeping in ``_start_gateway_housekeeping``.)InProcessCronScheduler)rr?rq N)r r start)rrr?rq r s&&&& r;_start_cron_tickerr s?"":t"_r=cV^8dQhRR/#rr)rFs"r;rGrGs<C !NR !r=ch"VfR#\P!4P4\RV4,pVP 4'dI\P!4P4V8d!\P !V4GRjxL K^VP 4'*#L5i)u.Wait for a daemon thread to exit WITHOUT blocking the event loop; True if it exited in time. A synchronous ``join()`` freezes the loop — fatal for the cron ticker, whose in-flight delivery is a coroutine on *this* loop: it could never run, so the join timed out and the message dropped. See #58818. NTr)rrrrPrZsleep)r3rr r`s&&& r;_await_thread_exitr s~'')..03sG3DDH //   8 8 : ? ? AH LmmD!!!   "sAB2AB2B0B2c<V^8dQhR\R\R\/#)r?rrrB)rEr rm)rFs"r;rGrGs"44U4#4Y]4r=caaa"^RIHo\VRR4'd \V4M.o\ RV\ S4^,, 4oRVVV3Rllp\ P!\4PV3RRR 7pVP4\W0R 7GR jxL pV'g\PR V4V#L$5i) uClose MCP servers off-loop with a bounded wait; True when done within ``timeout``. ``shutdown_mcp_servers()`` can block ~15s; on the loop thread short-grace supervisors (s6 3s) SIGKILL us before ``mark_exited()`` runs, so every later boot reports a phantom unclean death. On timeout shutdown proceeds and the daemon thread is left to finish or die. Teardown is per served profile, under that profile's runtime scope — the mirror of startup discovery (``_discover_mcp_tools_for_profiles``) and of the periodic reconcile chore. A server's close path reads its own config/credentials at call time, so an unscoped shutdown on a bare thread resolved every served profile's teardown against the LAUNCH home. The trailing wildcard call (under the launch profile's own scope) stops the shared loop and reaps anything the per-profile passes did not own. ``timeout`` is a TOTAL budget: each pass gets ``timeout / (N + 1)``, because the default 15s per-pass wait inside ``shutdown_mcp_servers`` let N profiles consume the whole caller budget and the trailing wildcard pass — the only one that stops the shared loop — never ran. The worker runs in a FRESH context, not ``copy_context()``: the caller may sit inside a served profile's scope, and the trailing wildcard pass must run under the launch profile's own scope (``launch_profile_scope_if_multiplexed`` binds the launch home) — inheriting the caller's made it resolve the live home to that profile. See #82874. )#launch_profile_scope_if_multiplexedrrFrcV^8dQhRR/#rr)rFs"r;rG7_shutdown_mcp_servers_nonblocking..__annotate__!s ? ? ?r=c<^RIHp^RIHpSFEwr#\ \ V4RR7;_uu_4V!VP 4SR7RRR4KG S!4;_uu_4V!SR 7RRR4R# +'giK~;i \d\PRTRR 7Ki;i +'giR#;i \d\PR RR 7R#i;i) r)_core)shutdown_mcp_serversF)r)scoperNz$MCP shutdown raised for profile '%s'TrGrzMCP shutdown raised) tools.mcp_tool_commonr tools.mcp_tool_lifecycler rr_mcp_registry_scoperLrMrN)r r rrr pass_timeout profile_homess r;_do._shutdown_mcp_servers_nonblocking.._do!s/A*7 &L b+D,>PUVV(u/H/H/JT`aWV+8  ?466$\:76 WVV b C\\` a b766 ? LL.L > ?s^BA= BC) B;3C= B BB#B87B8; C C C"C54C5z mcp-shutdownT)targetrr-daemonrNzxMCP shutdown did not finish within %.1fs; continuing gateway teardown (background thread will be reaped at process exit))rr r8rUrPrUrr rrr r rMr)rrr r3doner r r s&& @@@r;!_shutdown_mcp_servers_nonblockingr s0V-4F?L ? ?  WY]]#n]a bF LLN#F< EG,0F)R R AD QRs."AAc8V^8dQhR\P/#r)logging Formatter)rFs"r;rGrGFsQQ7#4#4Qr=c^RIHpV!R4#)zAReturn the redacting formatter used by the gateway stderr stream.RedactingFormatterz/%(asctime)s %(levelname)s %(name)s: %(message)s)rTr r s r;_gateway_stderr_formatterr Fs/ O PPr=c0V^8dQhR\R\/#)r? existing_pidrBrA)rFs"r;rGrGMsRR3R4Rr=caa^RIHpHpV!4pVeVPS8XdvVP V!\ 444'dQ\ PRS\VP4RPVP4;'gR4R#^R I HpHpHpHpHpHp HoHp T!4p R \,P./R R llp T!T!44p \1T \24'dT !T 4'g T !R S4#T!T 4pTS8wd T !RTS4#T P5R4p\1T\64'd\1T\84'dR#T!S4T8wd T !RS4#T P5R4p\1T\:4'dTP=4'g T !RS4#T !TT 4'gT !RTT \,P>R7#\ATT3Rl4pT'd-\CTT 4'dT !RST \,P>R7#R# \d\ PRSRR7ELi;i \d\ PRSRR7R#i;i)uReturn True when ``--replace`` must refuse to signal ``existing_pid``. A poisoned/stale PID record can point at another profile's LIVE gateway (cross-profile SIGTERM restart loop). Ownership is decided by the persisted identity record ALONE, bound to the live target by exact PID + start-time; live argv can never PROVE ownership (no HERMES_HOME), it is only a consistency check. Missing, legacy, conflicting or unprovable identity → refuse (fail closed).) host_gatewayprofile_name_for_homez--replace target PID %s is the host gateway serving %d profile(s) (%s); replacing it restarts the host process for all of them.rrFz1host served-set ownership probe failed for PID %sTrG) _get_pid_path_get_process_hermes_home_get_process_start_time_pid_from_record_read_pid_record_record_looks_like_gateway_read_process_cmdline_same_hermes_homelevelc0V^8dQhR\R\/#)r?rTrBrd)rFs"r;rG>_replace_target_belongs_to_other_profile..__annotate__|s   d r=cF\P!VRV,.VO5!R#)zRefusing --replace: T)rMr0 )rTr rs&$*r;refuse8_replace_target_belongs_to_other_profile..refuse|s JJu4s: BT Br=z9no valid gateway pid record to prove ownership of PID %s.z#pid record names %s, not target %s. start_timezRpid record start-time does not match the live process %s (stale/PID-reuse record).r zJpid record predates hermes_home stampings; ownership of PID %s unprovable.zpid record belongs to a different HERMES_HOME (%s, ours %s). Remove the stale PID record or stop the owning profile explicitly.)r c<S!S4#rr)r r sr;r:_replace_target_belongs_to_other_profile..s ,A,,Or=zYtarget PID %s command line explicitly advertises a different profile than HERMES_HOME %s.zMcross-profile --replace ownership probe failed for PID %s; refusing to signal)"gateway.host_attachr r rlservesrrMrrUprofilesrrLrNrjr r r r r r r r r WARNINGrrr~rQrmrDrERRORr)_looks_like_profile_conflict_from_cmdline)r r r r{r r r r r r r our_homer record record_pidrecorded_start recorded_home live_cmdliner sf @r;(_replace_target_belongs_to_other_profiler MsO gK  l!:u||%o&78@:@: NNJc%..1499U^^3L3Y3YPY [() d d d,- '//  "-/2&$''/I&/Q/QUWcd d%f-  %?\Z ZL1.#..*^T2R2R "< 0N Bn&( ( =1 ---]5H5H5J5Jf&( ( 99JKXZb ' / /$$OP ElT\]],-987==Z Zo g H,ae fgp f#d  4 sbBH.H.A#II I$=I#I9I?c0V^8dQhR\R\/#)r?rarBrd)rFs"r;rGrGs.V.Vs.V.Vr=ca ^RIHpV!V4p\P!V4o RV 3RllpRV 3RllpRRlpR F%pV!V4pVfKVeVR 8Xg W8wgK$R # V!R 4;'gV!4p \ V RJ;'dV!V 4V!\ V448g4# \dTP4o Li;i) aToken-exact contradiction check between a target argv and our home (authority is the pid record). Substring matching is not identity: ``--profile timothy`` must NOT read as profile ``tim``. Returns False whenever the argv does not clearly contradict our home.)_profile_name_for_homecFV^8dQhR\R\\,/#)r?flagrBrp)rFs"r;rG?_looks_like_profile_conflict_from_cmdline..__annotate__s . .# .(3- .r=c<.p^pV\S48dSV,pW08XdBV^,\S48d+VPSV^,,4V^, pK`VPVR,4'd%VPV\V4^,R4V^, pKV'd VR,#R#)z>Value of ``--flag X`` / ``--flag=X`` occurrences, token-exact.=Nrq)rUrsr)r valuesrtokr!s& r; _flag_value>_looks_like_profile_conflict_from_cmdline.._flag_values #f+o)C{q1us6{2 fQUm,Q~~dSj)) c#d)a-.12 FA#vbz--r=c:V^8dQhR\\,/#rr)rFs"r;rGr sXc]r=c~<Rp\S4F*pVPV4'gKV\V4Ru# R#)zAHERMES_HOME= env-style assignment on the argv, token-exact.z HERMES_HOME=N)rrrU)rlr r!s r;_env_home_valueB_looks_like_profile_conflict_from_cmdline.._env_home_values<F#C~~f%%3v;<(($r=c0V^8dQhR\R\/#ror_)rFs"r;rGr s88C8C8r=cz\PP\PPV44#r)rrnormcasenormpath)rs&r;_norm8_looks_like_profile_conflict_from_cmdline.._norms&ww 0 0 677r=NrTz --hermes-home)z --profilez-p)rjr shlexrrrmrD) rar r rr r r r r home_valuer!s && @r;r r s6)(3L!W% . .8$D! =   <9#<@U$_-BB1BJ  $&TT5+<c(m@T+T UUM !!sB00C CcV^8dQhRR/#rr)rFs"r;rGrGs  d r=cF^RIHpV!4R# \dR#i;i)z_Best-effort: the marker is scoped to one target; a stale one would grief an unrelated shutdown.clear_takeover_markerN)rjr rLr s r;_clear_takeover_marker_quietr s" 8    s   cHV^8dQhR\R\R\R\/#)r?rlattemptsdelayrB)rQrErm)rFs"r;rGrGs(#Utr=c"^RIHp\V4F2pV!V4'gR#\P!V4GRjxL K4 R#L 5i)uPoll for process exit without blocking the loop (a blocking sleep freezes signal handlers and health checks). ``os.kill(pid, 0)`` on Windows is NOT a no-op — use the handle-based check.) _pid_existsTNF)rjr rangerr )rlr r r rs&&& r;_wait_for_pid_exitr sB+ 8_3mmE"""  #s?AA  AcaV3RlpV#)z[Build the SIGUSR1 handler: log what the signal means, then the drain-aware service restart.cX<\PR4SPRRR7R#)uSIGUSR1 received (systemctl reload / hermes gateway restart): performing a graceful gateway restart — drain active turns, exit, supervisor relaunches. Not an in-process config reload.FT)detached via_serviceN)rMrrequest_restart)rysr;restart_signal_handlerJ_start_gateway_make_restart_signal_handler..restart_signal_handlers+     4@r=r)ryr sf r;*_start_gateway_make_restart_signal_handlerr sA "!r=c(V^8dQhR\RR/#)r?r[rBNr)rFs"r;rGrGsb'b'Db'Tb'r=c^RIHpV'gU^RIHpHpV!\ 4R4pVe8VP V8Xd'^RIHp\VP4\V4hVPVP4wrgWaPPJdMVP!VPR\#\ 44R7VP%VP4R#WaPP&Jd\(P+RV4R#RpTP1TPRR 7pT'd2\(P+R T'dTP3T4MR 4R#^RIHp Hp Hp Hp Hp^RIHp TeIT !TP@\ 44'd(\(P+RTP3T44R#T !\ 44'dXT !T R7pT!\ 4T4pTe:TP T 8XdR#^RIHp\TP4\T4h\C4'd;\(P+RT'dTP3T4MR\E44R#\GT4R# \,d\(P/RRR 7R#i;i \,d\(P/R RR 7ELi;i)uTake the HOST-wide gateway lock, publish the record — or REFUSE to be the second gateway. The lock is no longer observe-only. ``gateway.host_attach`` already answers "is there a host gateway and does it serve me?" before anything binds, but it reads a RECORD, and a record is published a moment after the owner starts: two gateways launched together (a supervisor restarting two units, an update relaunch racing a manual start) can both see no owner and both proceed. The lock is the only atomic arbiter of that race, so losing it means we are the second gateway on this host — the shape multiplex-only forbids. The refusal is deliberately EX_TEMPFAIL (75), never the parking 78: losing a lock race is a runtime observation, not a config verdict. Every supervisor we generate retries 75, and on the retry the owner's record exists, so the attach path resolves the profile properly (attach, rescan-then-attach, or a named refusal) instead of the unit being parked forever. ``--force`` skips the question exactly as it does in the attach path. host_rendezvous)REFUSEstandalone_attach_decisionN!GATEWAY_SERVICE_RESTART_EXIT_CODEr r+uHost gateway lock could not be opened (%s); this gateway is not discoverable. No second gateway is implied — the lock directory itself is unusable.zhost gateway rendezvous failedTrG) include_stalezhost gateway record unreadablez>--force: starting a second gateway although %s owns this host.zanother process)ATTACH_CHANNEL_WAIT_SSTARTr launched_by_other_tenantr )profile_is_standalonezZAnother Hermes home's gateway owns this host (%s); starting this home's gateway beside it.)wait_for_channelzAnother profile's standalone gateway owns this host (%s); starting beside it rather than retrying a race no second profile can win. Fold every profile onto one gateway with: %sz owner unknownr)$r9r r r r routcomegateway.restartr printrr claim_host_lock ROLE_GATEWAYHostLockOutcomeACQUIREDpublish_recordrDcleanup_on_exitCOULD_NOT_OPENrMrrLrN read_recorddescriber r r r rSr r+_owner_is_standalone_migrate_command_refuse_second_host_gateway)r[hrr r rr r! rr{r r r r r live_owners& r;_claim_host_gateway_roler2 se". J-o.?F  H$4$4$> I ("" #>? ?++BOO< ((11 1   boo_EVAW  X   r /  ((77 7 NNZ[` b  8 EFrdC W-2r{{5)8I K: 5ejj/BSTT  h KK   _.//!3HI .o.?L  5( I ("" #>? ?  .3 E*JZJ\ ^ &g  5 E F 5 EFs+$BJ&/JJ>"J;:J;>"K$#K$c$V^8dQhR\/#rr_)rFs"r;rGrGYs#r=c^RIHpV#)rMIGRATE_COMMAND)hermes_cli.gateway_migrater6 r5 s r;r. r. Ys : r=c$V^8dQhR\/#rr)rFs"r;rGrG_sdr=c>^RIHpHpHpV!4pVe%VP\ P !48XdR#V!V!\44VR7p\VRJ;'d VP4# \d\PRRR7R#i;i)aTrue when the host owner answers that it does NOT multiplex (an unmigrated fleet). Asked only on the lock-losing path, and any failure answers False: an owner we cannot reach is treated as a multiplexer, which keeps the second-gateway refusal as the default. )r r request_serve_profileNF)r{zAstandalone-owner probe failed; keeping the second-gateway refusalTrG) r r r r: rlrrmrrm standalonerLrMrN)r r r: r{answereds r;r- r- _s bb =EII4()>?P)QY^_HD(@@X-@-@AA  X"  $s9A6'A6%A66"BBcV^8dQhRR/#rr)rFs"r;rGrGss88$8r=c^RIHp^RIHpV'dVP V4MRpRV R\ 4 R2p\ PRV4\V4\V4h)aPrint the named refusal and exit 75 so a supervisor retries instead of parking the unit. Reached only after losing the host lock, so ``--replace`` is not offered: an owner that serves this profile was already handled before the claim, and ``--replace`` does not skip the lock. r r z"owner unknown (its record is gone)u,❌ Another gateway already owns this host: z Exactly one gateway per host serves every profile, so this process will not start a second one (it would double-bind this profile's platforms). Fold every profile onto the owner: z Or stop the other gateway first, then start this one. Or start one anyway (skips the host-lock check): hermes gateway run --force (--replace does not skip this check; it only replaces an owner that serves this profile.)3Refusing to start a second gateway on this host: %s) r9r r" r r, r. rMrr# r )r{r0 r whors& r;r/ r/ ssk .A %"++e +OC 6se<23C2D1EFg h  LLFL 'N 6 77r=cV^8dQhRR/#rr)rFs"r;rGrGsOOOr=c|\VPRR4'gR#^RIHpHp^RIHp\VP44pV!RRRR7F<wrVVR8wgKWT9gKV!V4'gK&\PR WS4K> R# \d\PR RR 7R#i;i) aOne INFO line per standalone profile when the MULTIPLEXER takes its served set at boot. The host gateway silently omits an opted-out profile from its served set; without this line an operator reading the boot log cannot tell "not created yet" from "excluded by config". rrFN)rQr )STANDALONE_DEPRECATION_NOTICET)include_standaloneinclude_parkedrzUprofile '%s' is standalone (gateway.standalone: true); not served by this gateway. %sz%standalone-profile boot notice failedrG) r8rrSrQr rrC rserved_profile_namesrMrrL)ryrQr rC r}r-r+s& r; _log_standalone_profiles_at_bootrG s Ov}}&:EBB PSV0023+DTZ^_JDy T%7NOs(B;B!B) B9B"B;:B;cV^8dQhRR/#rr)rFs"r;rGrGsJJDJr=c^RIHp^RIHpVP VP 4'gR#\ 4p\VPRR4'd\VP44pM V!V43pVPVP V\V4R7R# \d\PRRR 7R#i;i) uRRepublish the host record with the SETTLED served set, now that the channel answers. The claim-time publish is deliberately empty: only the runner knows whether multiplex ended up on and which profiles it took. A standalone gateway serves exactly its own profile — not the whole roster ``served_profiles()`` would have guessed for it. r )r NrrFr z"host gateway record refresh failedTrG)r9r r r owns_host_lockr% rr8rrrF r( rDrLrMrN)ryr0 r r+r}s& r;_refresh_host_gateway_recordrK s.9 J  11   6=="6 > >66689F+D13F "//FTK J 9D IJs B$A1B$$"C  C )+_start_gateway_make_shutdown_signal_handler(_start_gateway_replace_existing_instance_start_gateway_shutdown_tail*_start_gateway_start_cron_and_housekeepingcRV^8dQhR\R\R\\,/#)r?rr[rB)rmr )rFs"r;rGrGs%!!!T!htn!r=c"V'd\PR4R#^RIHpHpHpHpV!\4VR7pVPV8XdZ\PRVP'dVPP4MR4\VP4R#VPV8XdZ\PRVP'dVPP4MR4\VP4R #VPV8Xd?VPe1\VPP R4GRjxL 'gR #R#L5i) uAttach / rescan / refuse against the ONE host gateway; ``None`` = start normally. Returns ``True`` when this invocation is satisfied by the running host process (exit 0, nothing spawned) and ``False`` when it must refuse. The per-home duplicate guard below cannot answer this at all: another profile's gateway lives in another home, so it sees no PID and starts a second process — the shape multiplex-only forbids. ``force`` is the operator's escape hatch when the owner is wedged or lying: skip the whole question and start. Ignoring it here made ``--force`` print the starting banner and then attach anyway, leaving no supported way to start a gateway at all. z:--force: starting a gateway without asking the host owner.N)ATTACHr REPLACE_HOSTdecide)rzBAttaching to the host gateway instead of starting a second one: %srTr? F)rMrr rR r rS rT rr! rr{r, r# rrrM rl)rr[rR r rS rT rs&& r;_host_attach_or_nonerU s STHHo'9H6! X19HNN++-Y P h6! J2:...X^^,,.i Q h<'HNN,F=hnn>P>PRVWWW Xs&A0E'3A)E'A9E'E% E'!E'c V^8dQhR\\,R\R\\,R\R\R\/#)r?rr verbosityr[ idle_exitrB)r rrmrQ)rFs"r;rGrGsKII 7II#+C=I=AIVZIgkIr=c>"^RIHpV!WW#V4GRjxL #L5i)zKRun the process lifecycle; the runner facade remains the public entrypoint.) start_gatewayN)gateway.run_bootstraprZ )rrrW r[rX bootstraps&&&&& r;rZ rZ s A6IiH HH Hs cV^8dQhRR/#rr)rFs"r;rGrGs % %D %r=c^RIHpHpV!4R# Td0p\RT 2\P R7\ ^4ThRp?ii;i)a%Fail closed when the active profile's config.yaml cannot be parsed: nobody can repair it on this surface, and defaults would let provider auto-detection adopt ``.env`` credentials the config never named. Same policy and escape hatch (``HERMES_IGNORE_USER_CONFIG=1``) as ``hermes_cli/main.py``.)InvalidUserConfigErrorrequire_parseable_user_configzError: rN)rr_ r` r# rrr )r_ r` rYs r;_guard_corrupt_user_configra sCX%%' !% uoCJJ/m$%sA *AA c\4\PPRR4\PPRR4RRlpRRlpR R lpWV3Fp\ V4K ^R IHp^R IHpV!V!44pV'd\PV4^RI Hp^R IHpT!T!44^RIpTP!RR7p T P#RRRR7T P#RRRRR7T P%4p Rp T P&'dr^RIp \+T P&RR7;_uu_4p \,P.!T P1T 4;'g/4p RRR4^R IHpHpT!T!T 44\8P:!\=T 44pT'd^M^p\GT4R# \d\PR RR7ELLi;i \d\PRRR7EL[i;i +'giL;i \>dIpTP@f^M-\CTP@\D4'd TP@M^pRp?LRp?ii;i)!z CLI entry point for the gateway.AI_AGENTz hermes-agent HERMES_AGENTrcV^8dQhRR/#rr)rFs"r;rGmain..__annotate__s+++r=c4^RIHpHpV!R4V!4R#)r attach_self_to_kill_on_close_job register_selfr9N)hermes_cli.process_identityri rj rh s r;_register_identity main.._register_identitys_i (*r=cV^8dQhRR/#rr)rFs"r;rGrf s4r=c ^RIHpV!4R#)rarm_startup_watchdogN)hermes_startup_watchdogrq rp s r; _arm_watchdogmain.._arm_watchdogs Ar=cV^8dQhRR/#rr)rFs"r;rGrf s"""r=c ^RIHpV!4R#)rconfigure_windows_stdioN)hermes_cli.stdiorx rw s r; _utf8_stdiomain.._utf8_stdio s <!r=) check_runtime) install_rootzpm startup check failedTrG)maybe_run_boot_bootstrapzboot bootstrap failedNz)Hermes Gateway - Multi-platform messaging)rbz--configz-czPath to gateway config file)helpz --verboser store_truezVerbose output)actionr r)rr)$ra rrrrhermes_cli.venv_syncr| pm.pathsr} rMrrLrNhermes_cli.boot_bootstrapr~ argparseArgumentParser add_argument parse_argsr hermes_yamlrr from_dict safe_loadrrrrrrZ r rArrQ_exit_after_graceful_shutdown)rl rs rz _stepr| r} problemr~ r parserrryamlfrrrrDes r;r/r/s JJ*n5JJ.&1+  " %[AUB?6) /  NN7 #=F) 0  $ $1\ $ ]F  D/LM  T,EUV    D F {{{" $++ 4 4",,T^^A->-D-D"EF5 e5f=>V++mF34 Aa "),W ? . >? = ,t <=5 4* VAz!&N7NQVVTU VsN4 GG+G: 0H#+H6"G76G7:"H H # H3 6 J >JJ c(V^8dQhR\RR/#)r?rDrBNr )rFs"r;rGrGLs++S+T+r=c`a\P\P3F3p\\4;_uu_4VP 4RRR4K5 RRlpRV3RllpRRlpW#V3Fp\ V4K \P!S4R# +'giK;i)uhFlush stdio, release the PID file + runtime lock, then hard-exit. ``os._exit`` (not ``sys.exit``): SystemExit runs ``Py_FinalizeEx``, which joins every non-daemon thread — exactly the hang a wedged worker causes. It bypasses ``atexit``, so PID/lock release and the bounded log drain (file handlers sit behind a ``QueueListener`` thread) are done here explicitly. Graceful teardown is already complete by the time this runs, so there is nothing left that needs a clean interpreter shutdown. See #53107. ``os._exit`` bypasses ``atexit`` handlers, so we cannot rely on the ``atexit``-registered ``remove_pid_file`` / ``release_gateway_runtime_lock`` (registered in ``start_gateway``) to run. The full-shutdown path releases both explicitly in ``_stop_impl``, but the EARLY exit paths — clean-fatal-config (#51228) and startup-aborted-before-running — raise ``SystemExit`` right after ``runner.start()`` without going through ``_stop_impl``, so on those paths ``atexit`` was the only thing releasing them. Now that those paths are routed through this backstop (#53107), release both here explicitly. Both calls are idempotent — ``remove_pid_file`` only unlinks a PID file that belongs to this process, and ``release_gateway_runtime_lock`` no-ops when the lock is already released — so this is a no-op on the normal shutdown path and the actual cleanup on the early-exit paths. NcV^8dQhRR/#rr)rFs"r;rG3_exit_after_graceful_shutdown..__annotate__as''D'r=c2^RIHpHpV!4V!4R#)rremove_pid_filerelease_gateway_runtime_lockN)rjr r r s r;_release_locks5_exit_after_graceful_shutdown.._release_locksasP$&r=cV^8dQhRR/#rr)rFs"r;rGr gs;;$;r=cD<^RIHpV!R4^RIHpV!SRR7R#)r) stamp_exitclean) mark_exitedgraceful_shutdownruN)rr gateway.lifecycle_ledgerr )r r rDs r; _mark_exited3_exit_after_graceful_shutdown.._mark_exitedgs O78I&9:r=cV^8dQhRR/#rr)rFs"r;rGr os%%%r=c$^RIHpV!RR7R#)rdrain_log_queuerrN)rtr r s r; _drain_logs2_exit_after_graceful_shutdown.._drain_logsos 3$r=) rrrr}rLflushrr_exit)rDstreamr r r r sf r;r r Ls}$::szz* i LLN! +' ;;% ! <U=HHY1! s B B- __main__cfV^8dQh/^\9d\\R3,;R&^\9d \;R&^\9d \;R&^\9d\P ;R&^\9d6\\ \\\\\3,3,;R&#)r?.r\ri_CONVERSATION_SCOPED_STATErr)__conditional_annotations__rrDrrrrt)rFs"r;rGrGsEEt"%S/u"EbBdcBERG##E#SGEJ`10X\\0K`EbgJJ4%S#s(:";;<JcgEr=) session_reset user_exitsession_switch new_sessioni)r r>localwebhook api_servermsgraph_webhook) z3(?:\w+\.)?(?:api\s*)?connection\s*(?:error|timeout)%(?:\w+\.)?connect\s*(?:error|timeout)connection\s+refusedconnection\s+resetconnection\s+abortedactively\s+refusedwinerror\s+10061\b errno\s+111\bno\s+route\s+to\s+hostnetwork\s+is\s+unreachablecannot\s+connectfailed\s+to\s+establishcould\s+not\s+connect)r r z errno\s+104\bz errno\s+103\bz broken\s+pipezserver\s+disconnectedzpeer\s+closed\s+connectionzconnection\s+was\s+closedznetwork\s+connection\s+lostzunexpected\s+eofzincomplete\s+chunked\s+readzresponse\s+ended\s+prematurelyzsocket\s+hang\s+upz(?:\w+\.)?remoteprotocolerrorz(?:\w+\.)?readerror) r r r r r r r r r r > TimedOut ReadError WriteError PoolTimeout ReadTimeout ConnectError NetworkError WriteTimeout ClientOSErrorConnectTimeoutRemoteProtocolErrorClientConnectorErrorServerDisconnectedError)zapi\s+(?:call\s+)?failedz"provider\s+authentication\s+failedznon-retryable\s+errorz&rate\s+limited\s+after\s+\d+\s+retrieszerror\s+code\s*:zhttp\s*\d{3}\bzincorrect\s+api\s+keyzinvalid\s+api\s+key)z$all\s+connection\s+attempts\s+failedrd)r) reasoningrYreasoning_detailscodex_reasoning_itemscodex_message_items finish_reasonr>rtext_to_speechtext_to_speech_tool) host_imageimageagent_visible_image)rN) rrrr_pending_model_notesrr_session_stall_notified_transcript_lag_streaksrr|)run_conversationrun_sync _run_sync_with_timeout_lifecycle finalize_turnend_turnrun_in_session)P)r APIServerAdaptercheck_api_server_requirementsz!API Server: aiohttp not installed)r WebhookAdaptercheck_webhook_requirementszWebhook: aiohttp not installed)r MSGraphWebhookAdapter"check_msgraph_webhook_requirementsz&MSGraph webhook: aiohttp not installed)NN<NNN)NNr )g?)r1N)NFrFF(r rGrModuleNotFoundErrorrYr-rconcurrent.futuresrrmrr rrr rrsignalrrr collectionsr contextvarsrrpathlibrrtypingr r r r r rragent.async_utilsr agent.i18nragent.conversation_compressionrrrrrrrrrr&agent.conversation_compression_archiverrragent.conversation_loopr agent.interrupt_compatr!agent.message_metadatar"r#r$r%r&agent.turn_contextr(agent.session_activityr)r*rr+r,hermes_cli.fallback_configr-gateway.turn_executorr/_AGENT_CACHE_MAX_SIZE_AGENT_CACHE_IDLE_TTL_SECS&_PLATFORM_CONNECT_TIMEOUT_SECS_DEFAULT&_TELEGRAM_CONNECT_TIMEOUT_SECS_DEFAULT._TELEGRAM_INITIAL_CONNECT_TIMEOUT_SECS_DEFAULT(_ADAPTER_DISCONNECT_TIMEOUT_SECS_DEFAULTrM_USER_BOUNDARY_END_REASONS"_STALL_NOTIFY_SEND_TIMEOUT_SECONDS#_GATEWAY_PROXY_SSE_BUFFER_MAX_CHARScompiler_GATEWAY_HYGIENE_PLATFORMr IGNORECASEDOTALLrrSrV_HYGIENE_TURNHOLD_RETRY_SECONDSr<r\rdrorwrrrrrrrrr;rr_GATEWAY_PROVIDER_POLICY_RE_GATEWAY_AUTH_ERROR_REr_CONNECTION_ERROR_MARKERS_GATEWAY_CONNECTION_ERROR_RE_CONNECTION_INTERRUPTED_MARKERS"_GATEWAY_CONNECTION_INTERRUPTED_RE_ENDPOINT_UNREACHABLE_MARKERS _GATEWAY_ENDPOINT_UNREACHABLE_RErrr"r'r0r7r=rNrUr\rvrrzrr_PROVIDER_ERROR_MARKERSrrrrrrrrrrrr<rrrrrr r$r+rr7r>rLrQr\rcrgrrrhrmrxr|rrrrrrrragent.replay_cleanuprrrrrrrgateway.media_repairrrrrr rrrrrrrrDrrrrrrrrr _env_pathrr'r)r(r> contextlibr?_asynccontextmanagerr@rr}rrBrLrJrUr_rorvr~rrrrrrrrrrIrJhermes_cli.config_defaultsrrryr3rzr2r1rOrgrr0 _config_pathrir _bridge_errr# r5r6rrr~ _network_cfgrr_bootstrap_excrrgateway.cwd_placeholderrrrrrtrrrrgateway.sessionrrrrrrgateway.deliveryrgateway.turn_leasergateway.session_staterrrgateway.authz_mixinrgateway.kanban_watchersrgateway.slash_commandsrgateway.run_voicergateway.run_adaptersrgateway.run_topicsrgateway.run_turnrrgateway.run_shutdownrrgateway.run_busyrgateway.run_config_loadersrgateway.run_startuprrgateway.run_watchersrgateway.run_notificationsrgateway.run_inboundrgateway.run_goalsrgateway.run_agent_cacherr rgateway.run_plugin_rewirergateway.platforms.baserrrgateway.platforms.eventrrr" rrrr getLoggerrMr_EXECUTOR_QUIESCE_TIMEOUTrrNrr rrrrrr&r-r0r7r?rFrMrQrUr[rarmrr_INTERRUPT_REASON_STOP_INTERRUPT_REASON_RESETrr_INTERRUPT_REASON_EVICTED_INTERRUPT_TOOL_REASON_EVICTED'_INTERRUPT_TOOL_REASON_GATEWAY_SHUTDOWN _INTERRUPT_REASON_SSE_DISCONNECT"_INTERRUPT_REASON_GATEWAY_SHUTDOWN!_INTERRUPT_REASON_GATEWAY_RESTARTrrrrrrrrrrrrrr r gateway.session_worker_constructr _checkpoint_agent_kwargsrrr r,r4r5r:rKr_rhweakrefrrr}rwrrrrrrrr'_AUTO_RESET_CONTEXT_NOTESrrrrGrHr<rrgateway.run_runtime_initrrr r r r r r+ r2 r7 r; rM rV r\ rb rn r r r _CRON_SHUTDOWN_DRAIN_TIMEOUT$_HOUSEKEEPING_SHUTDOWN_DRAIN_TIMEOUTr r r r r r r r r r2 r. r- r/ rG rK r[ rL rM rN rO rU rZ ra r/r rG)r s@r;rM sEE     #-CCC6PPP srF9RR8E?@:#)-&).&26.+.(]%)"&6#!zz*TU-JJ   $ %&. /0  ) *+; <MMBII?B(1$ &"&2 #RLT$V(D E> RW> @ G[` GII&=#%**HH @ : OO "zz#9R0S*SVY*Y[][h[hi#> &(ZZ#((2 33c92==&J"!d$&::#((0 11C7$H .bK BF"(12-(.$ 2,2# =ETXEE5:EN:;9: ">?')PQ%'CD!#FG I0 W56$&:: hh&)B2)FFIsstu  MM $  ?"J*: C3l\`, FKPKO4 <")0%/3+(,$:,k]&R1 )*. )OS )(1EI(1(1V-JN-B- 11h,M(!a%O!_J$$(< JJ  I+FJI+#I+X0*(!\=@!>F  NMM O9+9+x(T[> < 29 !$ 3tH~,,3345__ '( 5 6 ! |h9O9O9Q9Y9YZ[9\_e9ef 0J$C(poR<R gig 3$_6&$ )E&,, / 3  3 3F&Rj:c<$de(1:'>$I*-og.FGc.d*e &' - "===;;5%'G+-S$&E G"#35EG^_759; < 02ajE.*rZ 3m+  "<0d#_6688Ir*L,%%,*:*:<*H*HD)U77U>> "! > WV\\\\((((,+77aaa99>><<//==77QQTT44@@EE<<??33//::FF>> >=444   8 $ <!(%##$"L"LJ ? ? d#$QFQFhAA" 1 1BB BBXXkkhhXX"7OS77,##!!H44 *3>!>F!2*<'#< %<"$8!!59!!H"3 EE@6:@ Y\ 6:  F(  "$;$A$A$C##%'G'M'M'O##%'I'O'O'Q%++- )/0YY \ \))>&&RCC ff 88  a`NN[04[QU[[[_#$$ZZ =>2D<0$00S=>SSl > >66 A A MM6BB L L * *x M      AA ? 9 I @JJ  =<p9;T35MO_13LNa!:>|}(A }!!}(+~3~~!)  A@ A@@A@