+ jHj^Rt^RIHt^RIt^RIt^RIt^RIt^RIHt^RI H t ^RI H t ^RI H t HtHtHt] 'd ^RIHtHt]P(!R4tR R lt!R R 4tR#) aSessionStore durable-row recovery: session-key generation, legacy Slack key migration, rebuilding a routing entry from state.db, and the SQLite side of routing transitions (promote/reopen/create/ peer). Mixin split out of ``gateway/session.py``; bound onto ``SessionStore`` via the MRO.) annotationsN)replace)datetime)Platform) TYPE_CHECKINGAnyDictOptional) SessionEntry SessionSourcezgateway.sessioncV^8dQhRR/#)return Optional[str])formats"=/home/ubuntu/.hermes/hermes-agent/gateway/session_recovery.py __annotate__rsMc|VfR#\P!VP44# \dR#i;i)zA``source.to_dict()`` as JSON, or None when absent/unserializable.N)jsondumpsto_dict Exception)sources&r _origin_jsonrs7 ~zz&..*++ s #, ;;c]tRt^!tRtR5RRllt]RRl4t]RRl4tR R lt R5R R llt R Rlt RRlt ]RRl4t RRltRR/RRllt]RR/RRll4tRR/RRlltRR/RRlltR tRR/R!R"lltR#R$ltR%R&/R'R(lltR6R)R*lltR+R,ltR-R&/R.R/llt]R0R1l4tR2R3ltR4tR#)7SessionRecoveryMixinzMSessionStore durable-row recovery and the SQLite side of routing transitions.Nc V^8dQhRRRR/#)r rOptional[SessionSource]rrr)rs"rr!SessionRecoveryMixin.__annotate__$s/FR_rc \VPRR4'gR#^RIHpV!V4pVe VP#VeVP 'd VP #^RIHpV!4;'gR# \dR#i;i)zProfile namespace for session keys: None when multiplexing is off (legacy ``agent:main``), else the pinned identity's runtime profile, ``source.profile`` or the active profile.multiplex_profilesFN) identity_ofget_active_profile_namedefault) getattrconfiggateway.session_identityr#session_key_profileprofilehermes_cli.profilesr%r)selfrr#identityr%s&& r_resolve_profile_for_key-SessionRecoveryMixin._resolve_profile_for_key$s}t{{$8%@@8v&  // /  &...>> !  C*,99 9  s!A85A88 BBc V^8dQhRRRR/#)r session_keyrrr)rs"rrr 7s55}55rc ^RIHpV!V4#)z?Extract the profile namespace encoded in a gateway session key.)profile_from_session_key)hermes_state_keysr4)r2r4s& r_profile_from_session_key.SessionRecoveryMixin._profile_from_session_key6s ?' 44rcV^8dQhRR/#)r rstrr)rs"rrr =s#rc V^RIHpV!4;'gR# \dR#i;i)r$r&)r,r%rr$s r_active_profile_name)SessionRecoveryMixin._active_profile_name<s-  C*,99 9  s ((c$V^8dQhRRRRRR/#)r requested_session_keyr9 recovereddict[str, Any]rboolr)rs"rrr Ds)@@(+@8F@ @rc 8\VPR4;'gR4pV'dW18XdR#VPV4pVfR#\VPRR4'd"VPV4pVRJ;'gWE8H#W@P 48H#)uJPrevent a gateway from reviving another profile's row. Single-profile: the row's namespace must match the ACTIVE profile. Multiplexed: it must match the requested key's namespace (the active profile is meaningless there). Keyless rows stay adoptable. Multiplexed: several profiles serve traffic at once, so the active profile is meaningless — the requested key carries the profile the turn was routed to, and the recovered row must sit in the same ``agent::`` namespace (#74285). Rows with no key namespace stay adoptable in both modes (legacy/keyless data owned by this store). r2TNr"F)r9getr6r'r(r<)r-r?r@ recovered_keyrecovered_profilerequested_profiles&$$ r)_recovered_row_allowed_for_active_profile>SessionRecoveryMixin._recovered_row_allowed_for_active_profileDsIMM-8>>B?  F ::=I  $ 4;; 4e < < $ > >?T U $,VV0A0V V $=$=$???rc$V^8dQhRRRRRR/#)r rr key_sourcerrr9r)rs"rrr [s#;;M;G^;jm;rc  ^RIHpT!VeTMT\VPRR4\VPRR4VP V4R7#)zQSession key for *source* (profile from *source*; key from *key_source* if given).)build_session_keygroup_sessions_per_userTthread_sessions_per_userF)rOrPr+)gateway.sessionrNr'r(r/)r-rrLrNs&&& r_generate_session_key*SessionRecoveryMixin._generate_session_key[sN5 $0Jf$+DKK9RTX$Y%,T[[:TV[%\11&9 ; ;rc V^8dQhRRRR/#)r rr rrr)rs"rrr dsaa a-arc  VP\P8wgVP'gR#VP V\ VRRR74#)zPre-workspace Slack key for an explicitly scoped source. Deliberately Slack-only: an unscoped Slack session may be claimed by only one workspace (old key cannot tell teams).N)scope_idguild_id)platformrSLACKrVrRr)r-rs&&r_legacy_slack_session_key.SessionRecoveryMixin._legacy_slack_session_keyds< ??hnn ,FOOO))&'&4Z^2_``rc V^8dQhRRRR/#)r legacy_keyrrrBr)rs"rrr ks  - D rc V'gR#VPR\P4;_uu_4VPR\4pW9d RRR4R#VP V4RRR4R# +'giR#;i)z@Atomically reserve one ambiguous legacy Slack key for migration.F_legacy_slack_claim_lock_claimed_legacy_slack_keysNT)_lazy threadingLocksetadd)r-r]claimeds&& r_claim_legacy_slack_key,SessionRecoveryMixin._claim_legacy_slack_keyksb ZZ2INN C Cjj!=sCG$D C KK # D C C CsA7A77 B c$V^8dQhRRRRRR/#)r r@rArr rrBr)rs"rrr ws)QQ!Q+8Q Qrc VP\P8wg$VPR8XgVP'gR#\ P !VPR4;'gR4p\T\4'gR#TPRTPR44TP8H# \\3dR#i;i)aReject recovered rows whose origin belongs to another workspace: a workspace-scoped Slack lookup adopts a row only if its origin_json names the same scope_id; rows without a parseable origin are rejected (an unattributable transcript is exactly the ambiguity).dmT origin_jsonrDFrVrW) rXrrY chat_typerVrloadsrE TypeError ValueError isinstancedict)r@rorigins&& r#_recovered_row_matches_source_scope8SessionRecoveryMixin._recovered_row_matches_source_scopevs ??hnn ,0@0@D0HPVP_P_P_ ZZ m < B BCF&$''zz*fjj&<=PP :&  s'B;.B;;CCc ,V^8dQhRRRRRRRRR R /#) r rowrAr2r9rr nowrrr r)rs"rrr s;cc$c36c@McT\c crc ^RIHpRRlpV!VPR4\P!^44pVPR4pVe V!W4MTp VPR4p V f1\ VPR4;'g^4;'gVRJp ^R IHp V!V\VR ,4VWVPVPVP\ V 4V !V4R 7 #) r;)r c V^8dQhRRRR/#)r r&rrr)rs"rrKSessionRecoveryMixin._create_entry_from_recovered_row..__annotate__s   X rc~\P!\V44# \\\ 3dTu#i;iN)r fromtimestampfloatrorpOSError)valuer&s&&r_tsBSessionRecoveryMixin._create_entry_from_recovered_row.._tss7 --eEl;;z73  s !<< started_atlast_activity_atN _has_messages message_counttransport_profile_ofid) r2 session_id created_at updated_atrs display_namerXrmreset_had_activitytransport_profile) rQr rErr~rBr)rr9 chat_namerXrm) r-rwr2rrxr rr last_activityr had_activityrs &$$$$ r _create_entry_from_recovered_row5SessionRecoveryMixin._create_entry_from_recovered_rows 1 .0F0Fq0IJ  23 7D7PS3V` ww/   8 = =A>[[-W[B[LA#CI:!v?O?O__0@0@#L1EYZ`Ea c crraise_on_lookup_errorFc ,V^8dQhRRRRRRRRRR /#) r r2r9rr allow_peer_fallbackrBrrOptional[dict[str, Any]]r)rs"rrr s; U U! U+8 UOS U# U0H Urc  TPVPV4VPPTVPV'd VP MRV'd VP MRVPVR7#)aQuery one durable gateway session row. Scoped Slack lookups disable SessionDB's platform/chat/user fallback: that tuple has no workspace id and could revive another team's session; the caller performs one explicit exact lookup of the old unscoped key instead.N)rr2user_idchat_idrm thread_idr) _peer_row _db_for_keyrXrrrrmr)r-r2rrrs&$$$$r_find_gateway_session_row.SessionRecoveryMixin._find_gateway_session_rowsd ~~   [ )&//2G2GU`NN&9FNNt*=f&&4&&>S U Urc ,V^8dQhRRRRRRRRRR /#) r rr9r2rrBpeerrrrr)rs"rrr s13t":rc V'd\VRR4MRp\V4'gR#V!RRVRV/VB# \d+p\P RY&4T'dhRp?R#Rp?ii;i)a``db.find_latest_gateway_session_for_peer`` guarded for a missing store, a SessionDB without the finder, and a failing lookup (debug-logged -> None unless *raise_on_lookup_error*). Extra keyword arguments (user_id/chat_id/chat_type/thread_id) pass through to the finder.$find_latest_gateway_session_for_peerNrr2z-Gateway session DB recovery failed for %s: %sr)r'callablerloggerdebug)dbrr2rrfinderexcs&$$$, rrSessionRecoveryMixin._peer_rowsm OQCTJVZ II[IDI I  LLH+ [$  s 8 A-A((A- not_afterc$V^8dQhRRRRRR/#)r r2r9rzOptional[float]rzOptional[tuple[str, Any]]r)rs"rrr s$'"'"'".='" "'"rc RV'gR#VPV4pVfR#VPV4pV'dWC3#\V4PR4p\ V4^8dV^,R8Xd V^,MRpV'gR#VP W6VR7p\ V\4'dVPR4'gR#VPR4pVe4Ve0\P!\V44\V48dR#\VR,4V3#)aResolve a gateway session key to ``(session_id, db)`` for shutdown-flush recovery. The routing map (``peek_session_id``) is authoritative: it names the session the message was actually routed to at shutdown. When ``sessions.json`` was pruned, fall back to the durable row under the exact key (the peer finder keeps the reset fence: rows ended only by recoverable reasons match; explicit boundaries do not). A row started after the flush (``started_at > not_after``) cannot be the origin and is never adopted. Never mints a session; None means the caller must preserve the flush file. ``db`` is the store owning the key, so the append lands in the right profile partition. When that store cannot be resolved (``_db_for_key`` fails closed for a profile without a reachable home) the answer is None even if the routing map knows the id: appending to the ambient root store would split one session identity across two physical stores (#66887/#102157). N:agent)rr2rr) rpeek_session_idr9splitlenrrqrrrEmathfloorrint) r-r2rrrpartsrXrwrs &&$ rresolve_session_id_for_key/SessionRecoveryMixin.resolve_session_id_for_keys    k * :))+6 > !K &&s+"5zQ58w3F58DnnRknJ#t$$CGGDMMWW\*   Z%; 5Q[K\@]`cdm`n@n3t9~r!!rc ,V^8dQhRRRRRRRRR R /#) r r2r9rr rxrrrBrzOptional[SessionEntry]r)rs"rrr s4!+8?G#0Frc VPWVVR7wrVVfR#VPWP4V'd)VPVPWVPR7V#)zERebuild a missing session-key mapping from a recoverable durable row.)r2rrxrNr)_query_recoverable_row_reopen_session_rowr_record_gateway_session_peerr)r-r2rrxrentrymigrated_legacys&$$$$ r_recover_session_from_db-SessionRecoveryMixin._recover_session_from_dbss"&!.>?   - -  +EDVDV . X rc VPWVR7wrEVe1V'd)VPVPWVPR7V#)aDB-only half of _recover_session_from_db (no lock needed): a SessionEntry or None; the caller assigns _entries[key] under lock. The row is NOT reopened here: the caller evaluates reset policy first (an agent_close/ws_orphan row may need promotion to a real reset).)r2rrxr)rrrr)r-r2rrxrrs&$$$ r_query_recoverable_session/SessionRecoveryMixin._query_recoverable_sessionsU"&! (entry or None, migrated_legacy). The legacy (pre-workspace) Slack key fallback lives here: exact-key lookup, claimed once per process; ``migrated_legacy`` tells the caller to rewrite the peer row to the scoped key.N)r2rrrF)r?r@z\Gateway session DB recovery ignored %s for %s because the row belongs to a different profiler2)rwr2rrx)NF) rZrrgrBrqrrrtrIrwarningrEr) r-r2rrxrr]r@rrs &$$$$ rr+SessionRecoveryMixin._query_recoverable_rows 33F; 22# VZHZ"739  ZD,H,H,T,T66&5&;7=I#9oO)T** 77 JJ =="->DD NN$%.]]=%A; P 5566L%%rc(V^8dQhRRRRRRRR/#)r r2r9rreasonrNoner)rs"rrr #s*#3PS`drc <VPV4p\VRR4p\V4'd V!W#4MVPW#4RV 2pVP V4'dVP VR4R#R# \ dpT!T4Rp?R#Rp?ii;i)aTEnd *session_id* with *reason* via ``promote_to_session_reset`` (``end_session`` on old SessionDBs). Promote, not plain end: a row already ended with a recoverable accidental reason (agent_close / ws_orphan_reap) must be upgraded to the explicit boundary, or stale-route recovery resurrects it over the reset. ``log(exc)`` reports failures.promote_to_session_resetNz heartbeat:rD)rr'r end_sessionget_metaset_metar) r-r2rrlogrpromote heartbeat_keyrs &&&&$ r_promote_session_reset+SessionRecoveryMixin._promote_session_reset#s !!+.Bb".>&JZJZ\ \  U" U1=1Q1QAQAQ U(0 U/L U#4"S"S7KF7S  U  ` `,t, ` Lk__ ` \ LLH+ [ [ \sH23C4& C44 E' D  D9D4-E'4D99 E'E'E""E'c$V^8dQhRRRRRR/#)r rr r2r9rrr)rs"rrr bs'^^ ^C^TX^rc VPV4pV'gR#RpVP;_uu_4VP4VPP V4pW P9dVe\ VP RR4pVeWaP8HpMVPR8HpV'doVPV4'dXVPPV4pW$n WnVPVn VPVnW@PV&RRR4Ve;VP4VPVPW!VP R7R#R# +'giLP;i)aiOne-time migration of pre-workspace-scope Slack keys: MOVE (not copy) the legacy entry so a second workspace with identical Slack ids cannot attach to the same transcript. Adopt when the legacy origin names the same workspace; a scope-less DM is claimed once by the first workspace; a scope-less channel/group is refused (channel ids collide across workspaces).NrVrkr)rZ_lock_ensure_loaded_locked_entriesrEr'rsrVrmrgpopr2rX _save_entriesrrr)r-rr2r]migrated legacy_entry origin_scopeadopts&&& r_adopt_legacy_slack_entry.SessionRecoveryMixin._adopt_legacy_slack_entrybs2 33F;  +/ ZZZ  & & (==,,Z8L--/L4L&|':':JM +(OO;E",,4ET99*EE#}}00?SessionRecoveryMixin._finish_route_transition..sfnn_"K  Z^  rcV^8dQhRR/#)r rrr)rs"rrr s  bf rc VPV4P!R/VBVPVR,WVR7R# \dpT!T4Rp?R#Rp?ii;i)zINSERT a session row and record its routing peer; ``log(exc)`` on failure. A failed create is a routing hazard (visible warning), but the row is self-healed with full identity by the next per-turn peer refresh.rrNr)rcreate_sessionrr)r-r2db_create_kwargsrsrrrs&&&&&$ rr(SessionRecoveryMixin._create_session_rows^    [ ) 8 8 L;K L  - - . R^ . `  FF sr sU^# #55;   , -]]r