+ jHjFaRt0tRt^RIt^RIHt^RIt^RIt^RIt^RIt^RI H t ]P!] 4t Rs]^k]!RR44t!RR4tRR R ^/R R lltR RltRRltRRltRRlt!RR4tR#)uThe gateway's local HTTP/WS listener: the native session WebSocket plus the dashboard API. The caller initializes session authority before starting this listener and owns all runtime services and signals. This module owns only HTTP resources; it does not bootstrap an agent, scheduler, hosted room, or a second gateway. The native session WebSocket (ticketed ``/api/ws`` — every local CLI/TUI/Desktop session) is served without the dashboard app: importing ``hermes_cli.web_server`` (about 690 routes, ~0.6 s) before the listener bound stalled every cold start and the control socket's identify. The dashboard is mounted on its first request (imported off the event loop) or warmed after READY for a supervised gateway (``warm_gateway_dashboard``); a gated listener (non-loopback bind or ``dashboard.public_url``) and a process that already imported it mount it before the listener starts, exactly as before. N) dataclass)Anyc,a]tRt^toV3RltRtVtR#)GatewayAPIHandlec~<V^8dQh/S[;R&S[;R&S[P;R&S[;R&S[P;R&#) api_originservertaskappsocket)strrasyncioTaskr )format __classdict__s"4/home/ubuntu/.hermes/hermes-agent/gateway/run_api.py __annotate__GatewayAPIHandle.__annotate__sIO K ,,  H  MM N)__name__ __module__ __qualname____firstlineno____annotate_func____static_attributes____classdictcell__rs@rrrsrrca]tRt^&toRtRt]V3RlRl4t]R4tV3RlRlt V3RlR lt R t V3R lR lt R t RtVtR#)GatewayDashboardMountugASGI app that imports and mounts the dashboard (``hermes_cli.web_server.app``) on first use. ``state`` is the listener's boundary state (``bound_host``, ``bound_port``, ``auth_required``, ``trusted_public_hosts``, ``gateway_runner``, ``session_authority``) — what the native WebSocket path checks, mirrored onto the dashboard app state once it is mounted. cZWuVnVnRVnRVnRVnRVnR#NF)runner_stateweb_lock _lifespan_closed)selfr#states&&&r__init__GatewayDashboardMount.__init__.s,#)  T[*.  rc <V^8dQhRS[/#rreturnbool)rrs"rr"GatewayDashboardMount.__annotate__6s$$$rcVPRJ#Nr%r)s&rloadedGatewayDashboardMount.loaded5sxxt##rc vVPe!VPPP#VP#)zBoundary state: the dashboard app's own state once mounted (operators and tests may change it there), the listener's pre-mount snapshot before.)r%r r*r$r6s&rr*GatewayDashboardMount.state9s*&*XX%9txx||!!Jt{{Jrc<V^8dQhRR/#rr/Nr)rrs"rrr2?s : :$ :rcRVPPnVPVPP RRR4VP VPPn\VP RR4VPPn VPP VPPnVPPVPPn R#)TFNsession_authority) r r*withhold_session_token_configure_auth_gater$ bound_hostr#gateway_runnergetattrr> bound_port)r)r%s&&r _bind_state!GatewayDashboardMount._bind_state?s04 ,   !7!7dK'+{{ $*1$++?RTX*Y '#';;#9#9  #';;#9#9  rc<V^8dQhRR/#r<r)rrs"rrr2Js>>t>rcVPerRVPPPnRVPPPnRVPPPnR#R#r")r%r r*rBr>r?r6s&r _unbind_state#GatewayDashboardMount._unbind_stateJsS 88 04DHHLL   -37DHHLL   08=DHHLL   5 rc "VPe VP#VPf\P!4VnVP;_uu_4GRjxL VPeVPuuRRR4GRjxL #VP'd \ R4h^RIp\PPR4;'g*\P!VPR4GRjxL pVP'd \ R4h\VPPRR4RVP39d \ R4hVP!V4VPP"P%VP4pVP'4GRjxL VP'd'VP)RRR4GRjxL \ R4hY#uTnTnTuuRRR4GRjxL #ELELELLhL= \*d Y nTP-4RTnhi;iL? +GRjxL 'giR#;i5i)zUImport (off the loop), bind and start the dashboard app once; returns ``web_server``.Nzgateway API stoppedhermes_cli.web_serverrBgateway API already started)r%r&rLockr( RuntimeError importlibsysmodulesget to_thread import_modulerCr r*r#rErouterlifespan_context __aenter__ __aexit__ BaseExceptionrIr')r)rPr%lifespans& rensureGatewayDashboardMount.ensurePs 88 88O ::  DJ::::xx#xx::|||"#899 ++//"9:BBGDUDU'')@EB?BC|||"#899sww}}&6=dDKKEXX"#@AA   S !ww~~66sww?H ))+++<<<",,T4>>>&'<== (+ $DHdn3::: ?B,>  ""$  ':::sAI&H I&!I ; I&H I&I  4I %I :H;I BI H-H.HHHH*I : I&II&I&I HH*II I& I# I I# I#  I&c<V^8dQhRR/#r<r)rrs"rrr2qs!!T!rc"RVnVPRuqnVeVPRRR4GRjxL VP4R#L TP4i;i5i)TN)r(r'rYrI)r)r[s& rcloseGatewayDashboardMount.closeqs] #'>>4 . !#((tT:::    ;    s+A&AAAA&AA##A&cv"VR,R 9dR#VP4GRjxL pTP YT4GRjxL R#L \d`\PR4TR,R8XdT!RRRR/4GRjxL M"^RIHpT!RR /R R 7!YT4GRjxL R#i;iLu5i) type websocketNz$Gateway dashboard API failed to loadwebsocket.closecodei JSONResponseerrordashboard_unavailablei status_code>httprd)r\ Exceptionlogger exceptionstarlette.responsesrhr )r)scopereceivesendr%rhs&&&& r__call__GatewayDashboardMount.__call__zs = 5 5   %Cgged+++&    C DV} +F$5vtDEEE<"G-D#ESVWX]hlmmm   ,s[B9A AA B9B7B9A =B4B "B4*B-+B40B93B44B9)r(r'r&r$r#r%N)rrrr__doc__r+propertyr7r*rErIr\r`rurrrs@rr r &sg$$KK : :>> B!! , ,rr host 127.0.0.1portc<V^8dQhR\R\R\/#)rryr{r/)r intr)rs"rrrs'BBSBcBRbBrc `aaa"^RIHpHp^RIHp\ P PR4p\f(Ve/\VPPRR4e \R4hV!4p\P!VRV!W4Wp\VRR4R7p\W4oV!SWVP ^R R 7wp o\"P$!W\"P&R 7^,wrrp\"P"!WV 4oVsSP)V4SP+R 4SP-4^,VnV P0'gV P34\5V P6VS4V nVP 'gVeSP94GRjxL V P;V 4SnSP?S.R 7GRjxL SP@'dSPB'd \R4hTTT3Rlp\HPJ!T!4RR7pRT9dRT R2MTp\MRT RTP. 2STSSR7#LL \Dd.SPG4RsSPG4GRjxL hi;i5i))_dashboard_public_hostslistener_auth_required)build_listener_serverrLNrBrMr>)rArD auth_requiredtrusted_public_hostsrBr>off)rtimeout_graceful_shutdownr[)rcFsocketsz#gateway API lifespan startup failedct<"SP4GRjxL SPS.R7GRjxL SP4SP4GRjxL RsR#LML3L Rsi;i SP4SP4GRjxL Rsi Rsi;i;i SPS.R7GRjxL SP4SP4GRjxL Rsi Rsi;i SP4SP4GRjxL Rsi Rsi;i;i;i5i)Nr) main_loopshutdownr`_ACTIVE_RUNNER)listenermountr srserve start_gateway_api..serves  *""$ $ $ *ooxjo999 *++-''%)N %:(%)N  *++-''%)NTN *ooxjo999 *++-''%)NTN  *++-''%)NTNsD8B+A&B+A3A(A3D8 A,A*A,"D8&B+(A3*A,,A00D83B(B!BB!B(!B%%B((D8+D5-C=CC= D5C6-C0.C63D56C::D5=D2D+"D% #D+(D2+D/ /D22D55D8z gateway-apiname:[]zhttp://)rr r r r )'hermes_cli.web_server_boundaryrrhermes_cli.web_server_lifecyclerrQrRrSrrCr r*rOtypesSimpleNamespacer rr getaddrinfo SOCK_STREAMbind setblocking getsocknamerDr7loadGatewayRuntimeAPI loaded_appr\lifespan_classr[startupstarted should_exitrZr`r create_taskr)r#ryr{rrr loaded_webtrustedr*configfamilykindproto_addressrr origin_hostrrr s&$$ @@@rstart_gateway_apirsZ^E!89J!  "wz~~/C/CEUW['\'h899%'G  ! !D8Nt8]$!&*=tD FE "& 0E*5$EL_L_EFQVXNFF&,&8&8 ++'' #F%G}}V51HN gU##//1!4}}} KKM-f.?.?O    *"8,,.  //7nnhZn000~~~!3!3!3DE E"4 *   uw] ;D!$AdV1+$K [M5+;+;*<=DeH 7 !0 kkm s\D J.B%I35I/60I3&I1'I3=I3 I3AJ./I31I330J+#J&$J++J.cV^8dQhRR/#r<r)rs"rrrs22d2rca\VRR4p\VRR4o\S\4'dSP'dR#V3Rlp\P !4P V!4RR7VnR#)uMount the dashboard in the background once the gateway is READY (supervised gateways, whose clients — Desktop, the dashboard SPA — call its routes right away). Never raises. session_apiNr c<"SP4GRjxL R#L \d1SP'g\P RRR7R#R#i;i5i)Nz?Gateway dashboard API warm-up failed; it loads on first requestTexc_info)r\rnr(rowarning)rsr_warm%warm_gateway_dashboard.._warmsK q,,.  q===`kop! qs6A!!A!AAAAAzgateway-dashboard-warmupr)rC isinstancer r7rget_running_loopr_gateway_dashboard_warmup)r#handlerrs& @rwarm_gateway_dashboardrslV]D 1F FE4 (E e2 3 3u|||q(/'?'?'A'M'M 0(N(2F$rc(V^8dQhR\RR/#)rrr/N)r)rs"rrrsNN#3NNrc"RVPn\P!\P!VP RR74GRjxL R#L5i)zGDrain sockets without stopping the session authority or taking signals.T)return_exceptionsN)r rrshieldgatherr )rs&rstop_gateway_apirs4 $FMM .. tL MMMsA A AAc$V^8dQhR\/#r.r0)rs"rrrsaaarcx\PPR4pVfR#\\ VRR44#)z``web_server._DASHBOARD_EMBEDDED_CHAT_ENABLED`` without importing the dashboard (always True unless a loaded dashboard says otherwise).rLT _DASHBOARD_EMBEDDED_CHAT_ENABLED)rQrRrSr1rCr5s r_embedded_chat_enabledrs6 ++//1 2C;4`D6XZ^)_$``rc$V^8dQhR\/#r.r0)rs"rrrsiiirc^RIHpVR,R8H;'d(V!WPR4VPR44#)r)restart_wait_readrcrmmethodpath)gateway.drain_controlrrS)r#rrrs&& r_restart_wait_readrs:7 =F " h h'88ATV[V_V_`fVg'hhrc6a]tRt^toRtRtRtRtRtVt R#)ratRedeem private local tickets at the existing WS subprotocol boundary. Other credentials and HTTP routes retain the complete dashboard gate. Local bootstrap never grants an exposure/worker ticket interactive permissions. *web_app* is the dashboard mount (or any object whose ``state`` carries the listener's ``bound_host`` / ``auth_required`` / ``trusted_public_hosts``). c0WVuVnVnVnR#r4r r#web_app)r)r r#rs&&&&rr+GatewayRuntimeAPI.__init__s.17+$+t|rc aaa"VR,R8wgVPR4R8wdVPWS4GRjxL #R;ooVVV3RlpVPWV4GRjxL #L+L \dopS'ga\P RTPR4;'gTPR 4S'dR MR \ T4P TR R 7hRp?ii;i5i)rcrdr/api/wsNFct<"RoS;'gVPR4R8HoS!V4GRjxL R#L5i)Trczwebsocket.acceptN)rS)messageacceptedrtrs&r send_watched0GatewayRuntimeAPI.__call__..send_watcheds4GLL7;;v#6:L#LHw-  s ,868z>Gateway refused a session WebSocket upgrade from %s %s: %s: %shermes.gateway_socket_peerclientz after its handler had refused itz with HTTP 500Tr)rS_servernrorircr)r)rrrsrtrexcrrs&&&f @@rruGatewayRuntimeAPI.__call__s =K '599V+< +IUT:: :""( U\BB B;C   ]"YY'CD[[ RZH[CJ?P_!#Y//tE  sR:C+A+C+A/&A-'A/*C+-A// C(:/C#*C# C##C((C+c aaaaaa"\SPRR4oVR,R49gSfSPWV4GRjxL #SR,R59;'dSSPP;'gSR,R8H;'d!VR,R8H;'d VR,R8HpSR,R8wgSPP'duV'gm\ SPV4'gQVR,R8XdV!RR R R /4GRjxL R#^R IHpV!R RRSR,/RR7!WV4GRjxL R#TPR4VR&^RIH pH pVR,R8wgVR,R8wd-V!SP4SPWV4GRjxL #ToRoRo^RI H oVVVVVV3RlpTp^RI Hp ^RIHp Hp Hp \SP&RR4p SP&VR&V !WV4pV !V4wppVR8Xg"VP(PR4'd?V'dVP+R R7GRjxL R#SPWV4GRjxL #VR8wgs\-4'dcV !W4fYV !W4fOVP(PR4'g.VP.'dVP.P0R69dVP+RR7GRjxL R#RpSPP2P5VRR R!7pT'*oS!SP4oSR,R8wgSPP'd-S'g%S'gTP+R R7GRjxL R#^R#IHpT!SPTR$,4pTfTP+RR7GRjxL R#TTR%&^R&IHp^R'I H!p^R(IH"pT!T4;_uu_4T!SP4;_uu_4T!TR)TR*,R+R,R$TR$,R-TR-,R.TR.,R/RR0TPR1R24/TTR37GRjxL RRR4RRR4R#ELHELuELLELEL?EL&EL \6dRpSPP2P5TRR"R!7pEL \6dHT'd TP+R R7GRjxL R#SPYT4GRjxL uu#i;ii;iELELTL +'giL;i +'giR#;i5i)7session_runtime_descriptorNrcrdr*readydrainingrrrerfrgrigateway_not_readyirkrr)attached_clientnote_client_activityF)restart_wait_openc<"S!4GRjxL pSR,R8wgSPP'd/S'g'S'dS!SP4'gRRRR/#V#L^5i)Nr*rrczwebsocket.disconnectrfr)r# _draining)radmitted_in_waitallow_draining descriptororiginal_receiverr)s rreceive_admitted2GatewayRuntimeAPI._serve..receive_admitted5s^,..GG$/4;;3H3H3HR`-2CDKK2P2P 6EEN/s& A/A--A/A/A/ A/% A/) WebSocket)#_gateway_ws_ticket_from_subprotocolws_client_reasonws_host_origin_reasonr noneorigin)rfoki3T interactive) profile_idpurposezworker-adoption)authority_for_profile_idrzhermes.session_authority)CANONICAL_GATEWAY_PROTOCOL) handle_ws) owner_scopeuser_idsubjectproviderlocal instance_id capabilitiesnative_bootstrap profile_scoperrprofile) auth_identity subprotocoloperator>rmrd>rr>::1rz)#rCr#r rrrqrhrSgateway.run_idle_exitrrrrstarlette.websocketsrrrrrrheadersr`rrrysession_ticket_storeredeemPermissionErrorgateway.session_authoritiesrgateway.session_contractrtui_gateway.wsrr)r)rrrsrtdraining_socketrhrrrrrrrr*wsticketreasonr grantr authorityrrrrrrrrsf&&& @@@@@rrGatewayRuntimeAPI._servesT[[*FM = 5 59K%$77 7%g.2GGLL&&KK*W*=*KLLf ,LL16v)1K  G +t{{/D/D/Do*4;;>>V} +F$5vtDEEE ="G-@':V]K^#_/2449DJJJ .3ii.A*+O =K '5=I+E  -%$77 7" ;  #2   gt4||e ut ,>(++yyyBIINN:N$N(((% % %  <KK44;;Ft]j;kE&,T[[9 G +t{{/D/D/Dn((((% % % H,T[[% :MN  (((% % % ,5()G,;  # #_T[[%A%ABy% :JJX_.:E,SUgim.=uyyR[?\ /^ )CX W W W&B # #k8FJ86*7 &  <H < 88??SWar?s" <"(((---!XXed;;;;  < < & & W&B%A # # #s?U%RU%U%=U%U%%6U%U%$9U%R+U% R A%U%/R0BU%?U%U%RU%8R9AU% U%0U% R! U%(R$=AU%U%U%U%%T6&?U%%T9&-U%U.A T> 8T< 9T> =U U%U%U%U%U%U%!U%$ T32(SU%T/0T/TT/ T3 U%T/$T'%T/*T3,U%.T//T33U%9U%<T> > U U U"  U%rN) rrrrrwr+rurrrrs@rrrs#C2^W^Wrrc@V^8dQh/^\9d \;R&#)rr)__conditional_annotations__r)rs"rrrs  23 r)rrwr dataclassesrloggingr rQrtypingr getLoggerrrorrr rrrrrrr)rs@rr#s !    8 $  a,a,HB;BABJ2&Nai BWBWr