+ jHjRt^RIHt^RIt^RIt^RIt^RIt^RIt^RIH t ^RI H t H t H t HtHt] 'd^RIHt]P$!R4t!RR]4tR R ltRtRtR R ltR R/RRllt!RR4tR#)zSessionStore transcript I/O: SQLite append with a per-session retry queue, compression-reroute following, FTS corruption recovery, rewrite/rewind/load. Mixin split out of ``gateway/session.py``; bound onto ``SessionStore`` via the MRO.) annotationsN)extract_api_content_sidecar) TYPE_CHECKINGAnyDictListOptional) SessionEntryzgateway.sessionc2a]tRt^tRtRV3RlltRtV;t#)TranscriptReadErrorz4Raised when persisted history cannot be read safely.c V^8dQhRRRR/# session_idstrreturnNone)formats"?/home/ubuntu/.hermes/hermes-agent/gateway/session_transcript.py __annotate__ TranscriptReadError.__annotate__sMM3M4Mc 8<Wn\SV` RV 24R#)z#transcript read failed for session N)rsuper__init__)selfr __class__s&&rrTranscriptReadError.__init__s$ >zlKLr)r)__name__ __module__ __qualname____firstlineno____doc__r__static_attributes__ __classcell__)rs@rr r s>MMrr c V^8dQhRRRR/#)rrrmessagedict[str, Any]r)rs"rrrss^rcD^RIHpV!W4# \dR#i;i)zSpool one evicted/undeliverable message to disk (same machinery as the shutdown flush, so it is replayed after DB recovery); path or None.) spool_dropped_transcript_messageN)gateway.shutdown_flushr* Exception)rr'r*s&& r_spool_droppedr-s'K/ DD s  c V^8dQhRRRR/#)rvaluerrr)rs"rrr2s  # # rcVeG\V\\34'g+\V\4'dRTu;8:d R8dV#MV#\P !V\R7# \ \3d\T4u#i;i)z*value* when sqlite can bind it as is, else its JSON text (``str`` if that fails too). An int outside sqlite's signed 64-bit range raises OverflowError even for a TEXT column.)defaultll) isinstancerfloatintjsondumps TypeError ValueError)r/s&r_bindable_textr92su } 53,77 uc " "v'>'> (? zz%-- z "5zsA**B B  fallback_tsc(V^8dQhRRRRRRRR/#)rrrr'r(r:rrr)rs"rrr>s*~WZftrcVPR4R8HpVPR4pRVRVPRR4RVPR4RVPR4RVPR4R VPR 4/\Uu/uFqUV'dVPV4MR bK upCR VPR 4;'gVPR 4R \VPR 44RVfTMTR\V4RVPR4RVPR4/Cp\Fp\ Wg,4Wg&K V#uupi)a``SessionDB.append_message`` kwargs for one transcript row. The live writer and the restart replay of the transcript spool (gateway/shutdown_flush.py) both build rows here, so a replayed message lands as the row the live drain would have written. Fields are listed rather than splatted: a spooled message is arbitrary JSON from disk, and an unexpected key would raise and abort the replay. *fallback_ts* applies only to a message with no timestamp at all, because a truthiness test would rewrite epoch 0. Values bound straight to a TEXT column are made bindable (:func:`_bindable_text`), so one malformed field cannot make the row unwritable.role assistant timestamprunknowncontent tool_name tool_calls tool_call_idNplatform_message_id message_idobserved api_content display_kinddisplay_metadata)get_ASSISTANT_ONLY_KEYSboolr_BOUND_TEXT_KEYSr9)rr'r: is_assistantr?kkwargskeys&&$ rtranscript_append_kwargsrS>s=;;v&+5L K(Ij FI.7;;y)W[[-gkk,/ N3 AU U@T1 gkk!n$ 6@T U w{{+@A^^W[[Q]E^DZ01I$5[9 27;  N3GKK(:;#F& $V[1  M Vs$E c]tRt^`tRt^tRt^tRRltRRlt RRlt R t RR7R /R8R9lllt#R:t$R;#)?SessionTranscriptMixinzSessionStore transcript I/O: SQLite append with a per-session retry queue, compression-reroute following, FTS corruption recovery, rewrite/rewind/load.i,c V^8dQhRRRR/#)rr Optional[str]rr)rs"rr#SessionTranscriptMixin.__annotate__ns  - M rc V'dVPV4MRpVfV#VPV4;'gT# \d\P RTRR7Tu#i;i)zLatest compression continuation for *session_id* (heals a mapping left pointing at a compressed parent by a restart or failed send).Nz,Compression-tip lookup failed for session %sTexc_info)_db_for_session_idget_compression_tipr,loggerdebugrrdbs&& r_compression_tip_for_session_id6SessionTranscriptMixin._compression_tip_for_session_idnsj5?T $ $Z 0D :  ))*5CC C  LLG^bL c  s>>%A&%A&c(V^8dQhRRRRRRRR/#)rentryr original_session_idrWcanonical_session_idrrMr)rs"rrrXzs,  ! 8E + 04 rc V'd V'gR#VPV8wgW28XdR#\PRVPV4W1nR#)zDRewrite *entry* to the compression continuation if stale. Lock held.Fz8SessionStore healed compressed session mapping: %s -> %sT)rr^info)rrerfrgs&&&&r_heal_compression_tip_locked3SessionTranscriptMixin._heal_compression_tip_lockedzsJ#*>   2 26J6a FHXHX  "0rc(V^8dQhRRRRRRRR/#)r session_keyrexpected_session_idtarget_session_idrzOptional[SessionEntry]r)rs"rrrXs,58MP rc V'dV'd V'gR#VP;_uu_4VPV4pVf RRR4R#VPV8Xd VuuRRR4#VPWBV4'g RRR4R#VP 4VuuRRR4# +'giR#;i)uCAS-advance one route along an already-verified compression lineage. Unlike ``switch_session`` this never ends/reopens SQLite rows (the compression transaction owns that). ``None`` means the route moved after the caller's snapshot (e.g. /new) — caller must fail closed.N)_lock _entry_lockedrrj_save)rrmrnrores&&&& radvance_compression_session2SessionTranscriptMixin.advance_compression_sessions"5=N ZZZ&&{3E}Z#44 Z 44UQbccZ JJLZZZsB,B,-B,B,, B= c BVPR\P4#)z?Return the lock that serializes pending-queue drain boundaries._transcript_drain_lock)_lazy threadingRLock)rs&r_get_transcript_drain_lock1SessionTranscriptMixin._get_transcript_drain_lockszz2IOODDrFc(V^8dQhRRRRRRRR/#) rrrr'r(skip_dbrMrrr)rs"rrrXs0^^s^^^VZ^gk^rc V'dR#VP4;_uu_4VPVPV4V4RRR4R# +'giR#;i)aSerialize transcript draining across queue migration boundaries. A session with no usable store is NOT skipped: the write is queued and counted like any other failed append, so a dead/unopenable state.db escalates and spools instead of dropping turns silently (#114266).N)r{ _append_to_transcript_serialized_follow_reroutes)rrr'r~s&&&&rappend_to_transcript+SessionTranscriptMixin.append_to_transcriptsD    , , . .  1 1$2G2G 2SU\ ]/ . . .s "A A c V^8dQhRRRR/#rrrrr)rs"rrrXs33rc VPR\4p\4pW9d"W9dVPV4W!,pK'V#)z5Follow the compression reroute chain (cycle-guarded)._transcript_reroutes)rxdictsetadd)rrreroutesseens&& rr'SessionTranscriptMixin._follow_reroutess?::4d;u$)? HHZ !-Jrc$V^8dQhRRRRRR/#)rrrr'r(rlistr)rs"rrrXs"cNW[rc VPPV.4pVP\V44\ V4VP 8d\ WP^44pVeJVPR\4PV4\PRVVP V4V#\PRVVP 4V#)zKQueue *message* (retry lock held); evicts + spools the oldest past the cap._spooled_drop_sessionszsSession DB transcript pending queue full for %s (cap=%d); spooled oldest message to %s for replay after DB recoveryzzSession DB transcript pending queue full for %s (cap=%d); dropping oldest message to make room (on-disk spool unavailable)) _dirty_transcripts setdefaultappendrlen_MAX_PENDING_PER_SESSIONr-poprxrrr^warning)rrr'pending spool_paths&&& r_enqueue_transcript_message2SessionTranscriptMixin._enqueue_transcript_messages))44ZDtG}% w<$77 7' KKNCJ% 3S9==jIABL11:? GHR113rc(V^8dQhRRRRRRRR/#)rrrqueue_session_idexcr,rrr)rs"rrrXs,14;D rc H\PRV\V4PV4VP;_uu_4\ VP PV.44pVP PVR4VPPVR4RRR4XF*p\W4eK\PRVRR7K, ^RI H pV!W4R# +'giLQ;i \d\PRTRR7R#i;i)zStop SQLite writes on a replaced/quarantined handle and divert the backlog to the on-disk spool + JSONL fallback: retrying cannot succeed and the FTS rebuild must never run here.zSession DB refused further writes on this handle for %s (%s); stopping SQLite writes and diverting pending transcripts to the on-disk fallback: %sNz>pending fallback failed for replaced state.db transcript on %sTrZ)divert_session_transcript_jsonlz:JSONL divert failed for replaced state.db transcript on %s)r^errortyper_transcript_retry_lockrrrKr_transcript_append_failuresr-r hermes_staterr,)rrrr remainingdroppedrs&&&& r$_divert_transcript_after_db_replaced;SessionTranscriptMixin._divert_transcript_after_db_replaceds   LMW I   % ( ( (T44889I2NOI  # # ' '(8$ ?  , , 0 0T B)!Gj2:TV`!#!   D +J B) (  NNLj   sAC'C:' C7 :#D! D!c V^8dQhRRRR/#rr)rs"rrrXs  # # rc VPV4pVeVPV4MRpV'd:W18wd4VPV4pVeVPR4f \ V4#R#)aTransitive compression tip of *session_id* if it is a different, still-live row, else "" (a depth-1 lookup misses multi-hop lineages). Uses the PARENT's proven owner handle: the child's id is unpublished until its write succeeds, so a by-id lookup would hit the ambient store.Nended_at)r\r] get_sessionrKr)rrowner_dbtiptip_rows&& r_live_compression_child.SessionTranscriptMixin._live_compression_childsd **:6:B:Nh**:6TX 3$**3/G"w{{:'>'F3xrc ,V^8dQhRRRRRRRRRR/#)rrrrchild_idrrrr)rs"rrrXs414@CNR rc V'dV^,VJdVP^4VPPV.4pV'd!VPV4W@PV&M V'dTpVPPVR4VPPV^4pV'd3\ WpPPV^44VPV&W0P V&V#)aJMove the retry queue + failure counter from parent to child and record the reroute (retry lock held); returns the child's pending list. Older parent backlog must precede messages already queued directly on the child; routing is published only AFTER the queue moved (caller), so new child writes cannot bypass older parent backlog.N)rrrKextendrmaxr)rrrrrmsgexisting_child_pendingprevious_failuress&&&&&& r"_migrate_transcript_queue_to_child9SessionTranscriptMixin._migrate_transcript_queue_to_childs wqzS( KKN!%!8!8!.__annotate__s  4 rc<S'dS^,SJdSP^4S'g;SPPSR4SPPSR4R#R#)zCPop the acknowledged head (retry lock held). True if queue drained.NTF)rrr)rrrrrsr _ack_headJSessionTranscriptMixin._append_to_transcript_serialized.._ack_headsR71:, A''++,A0O44O9c$V^8dQhRRRRRR/#)rrrrrr4r)rs"rrrX|s"PSrc VP;_uu_4VPPV.4p\V4pRRR4^pXFp\ W4fM V^, pK V'dnVP;_uu_4VP R\ 4PV4XRV1V'gVPPVR4RRR4V#V# +'giL;i +'giT#;i)a]Move a stalled session's in-memory backlog (oldest first) to the on-disk pending spool so a crash/restart during the outage no longer loses it (#114266): ``recover_pending_to_db`` replays it at boot, ``_drain_spooled_drops`` before the next live write. Stops at the first spool failure so order holds; whatever stays in memory remains under the cap.Nr) rrrKrr-rxrrr)rrrrbacklogrr's&&& rr-SessionTranscriptMixin._spool_stalled_backlog|s  ( ( (--112BBGG7mG)Gj2: qLG ,,, 3S9==jIHWH%++//0@$G - w) (-, s(CAC2 C/ 2 D c V^8dQhRRRR/#)rrrrzException | Noner)rs"rrrXs  s 7G rc faaa \SRR4pV'dSV9dR#.o RV VV3Rllp^RIHpSP;_uu_4\ SP P S44pRRR4V!SVXR7wrgV'g1SP;_uu_4VPS4RRR4R#S 'd S R ,#\RS R24# +'giLu;i +'giR#;i \d#p\PR ST4Rp?R#Rp?ii;i) zReplay cap-dropped spooled transcript messages after DB recovery; return the replay failure while some of them are still on disk, else None. Best-effort: replay failures keep the spool files for the next successful flush; nothing here may raise.rNc V^8dQhRRRR/#)rr'r(rrr)rs"rrASessionTranscriptMixin._drain_spooled_drops..__annotate__s  N t rcx<SPSV4R# \dpSPT4hRp?ii;i)N)rr,r)r'rrrrs& rreplay;SessionTranscriptMixin._drain_spooled_drops..replays7 // GD $ s 949)drain_transcript_spool)db_known_failingz"older spooled transcript rows for z still pendingz+Failed to drain transcript spool for %s: %s) rr+rrrMrrKdiscard RuntimeErrorr,r^r) rrspooled_sessionsrr known_failing _replayedrrrs ff @rr+SessionTranscriptMixin._drain_spooled_dropss#4)A4H:5E#E$&    E,,, $T%E%E%I%I*%U V -#9F]$D I000$,,Z81#+8B< Q4ZLO2Q Q-, 10  NNH*VY Z s_D %C/1D C/2D<DD D C, 'D/ D :DD D0D++D0cV^8dQhRR/#)rrrr)rs"rrrXsJJJrc V'gR#VP;_uu_4VPR\4PV4RRR4R# +'giR#;i)zHave each session's next transcript write drain the on-disk spool first. Boot recovery marks the sessions it held back, so their next live row cannot land ahead of those files.Nr)rrxrupdate)r session_idss&&rmark_spooled_drop_sessions1SessionTranscriptMixin.mark_spooled_drop_sessionss?   ( ( ( JJ/ 5 < <[ I) ( ( (s &A A c$V^8dQhRRRRRR/#rr)rs"rrrXs'LLSL>LVZLrc VPV4pVf\RV R24hVP!R/\W4BR#)z7Write one transcript row. Caller handles retry queuing.Nzno owning session store for z; deferring transcript writer)r\rappend_messagerS)rrr'_dbs&&& rr1SessionTranscriptMixin._append_transcript_messagesL%%j1 ;.zl:VWY Y K5jJKrc V^8dQhRRRR/#)rrr,rrMr)rs"rrrXshhihDhrc R\V4P49dR#^RIp^RIHp\ WP 4;'dVPV4#)uaTrue only when the failure is provably scoped to the FTS index. A bare SQLITE_CORRUPT can mean structural B-tree damage; only errors naming ``messages_fts`` or carrying FTS provenance (``SessionDB._is_fts_write_corruption_error``) may authorize the one-shot rebuild-and-retry; everything else takes the retry path. A generic ``database disk image is malformed`` (bare SQLITE_CORRUPT) can mean structural damage to canonical B-trees, not just the FTS shadow tables — treating it as FTS-only here made the store rebuild the index and retry transcript writes against a structurally corrupt database (#97940). messages_ftsTN) SessionDB)rlowersqlite3rrr2 DatabaseError_is_fts_write_corruption_error)rrrs& rr/SessionTranscriptMixin._is_fts_corruption_errorsE SX^^- -*#445gg):b:bcf:ggrcV^8dQhRR/#rr)rs"rrrXs""4"rc \P!4pVPpVeW, VP8dR#VPpVe\ VR4'gR#WnRp\ VR4'dVP 4pV'd\PRV4R#VP4pT'd\PRT4T^8# \d"p\PRT4Rp?R#Rp?ii;i)aAttempt FTS5 ``rebuild``, at most once per ``_FTS_REBUILD_COOLDOWN_SECONDS`` window; True if any index was rebuilt. A permanent one-shot flag meant a single rebuild failure (e.g. a transient WAL split-brain guard hit) permanently disabled recovery for the life of the process, even though later corruption on the same store could be fixable. Retrying on a cooldown lets the store try again after the underlying condition (e.g. a foreign holder) has likely cleared, without hammering a database that is corrupt on every write. NF rebuild_fts_foreign_state_db_holderszSkipping Session DB FTS rebuild while foreign processes hold the database or WAL sidecars (%s); canonical transcript writes remain available.z!Session DB FTS rebuild failed: %sz;Rebuilt %d Session DB FTS index(es) after append corruption) time monotonic_fts_rebuild_last_attempt_at_FTS_REBUILD_COOLDOWN_SECONDSrhasattrrr^rr r,)rnow last_attemptraforeign_holdersrebuiltrs& rr(SessionTranscriptMixin._rebuild_fts_oncesnn88  #);t?a?a(a XX :WR77,/) 22 3 3 :: D s.C!! D ,DD c V^8dQhRRRR/#r r)rs"rrrXsCC#C$Crc VP;_uu_4VPPVR4VPPVR4RRR4R# +'giR#;i)zHDrop queued pending messages so a rewrite/rewind doesn't re-insert them.N)rrrr)rrs&&r_clear_dirty_transcript.SessionTranscriptMixin._clear_dirty_transcriptsI  ( ( (  # # ' ' D 9  , , 0 0T B) ( ( (s 9A A) c$V^8dQhRRRRRR/#)rrrrErrMr)rs"rrrXs"  # C TX rc VPV4pV'gR#VPW4# \d\P RRR7R#i;i)aWhether a message with this platform_message_id is persisted (False without a DB). Thin wrapper over SessionDB.has_platform_message_id(). Returns False when no DB is available (in-memory sessions). Used by the gateway's transient-failure dedupe guard (#47237). Fz%has_platform_message_id lookup failedTrZ)r\has_platform_message_idr,r^r_)rrrEras&&& rr.SessionTranscriptMixin.has_platform_message_idsS  $ $Z 0 --jN N  LL@4L P s."AAc V^8dQhRRRR/#)rrrrrWr)rs"rrrXs  s } rc VPVPV44pVPV4pV'gR#VPV4# \d\ P RTRR7R#i;i)uRole of the newest live conversation row on the route ``load_transcript`` reads (``None`` when empty, no DB, or the read fails — the boundary write would fail the same way).Nz$transcript tail lookup failed for %sTrZ)rbrr\latest_conversation_roler,r^r_r`s&& rtranscript_tail_role+SessionTranscriptMixin.transcript_tail_rolesr99$:O:OPZ:[\  $ $Z 0 ..z: :  LL?VZL [ sA#A54A5c ,V^8dQhRRRRRRRRRR/#) rrrmessageslist[dict[str, Any]] active_onlyrMreject_active_turn_leaserr)rs"rrrXs4   )= LP "& 37 rc  bVPV4pV'gR#VP4;_uu_4VPWVVR7TP T4RRR4R# \d*p\P RT4Rp?RRR4R#Rp?ii;i +'giR#;i)uReplace a session's transcript (/retry, /compress). DESTRUCTIVE by default: ``active_only=False`` DELETEs every row incl. soft-archived compaction history (pass ``active_only=True`` for sessions that may carry archived rows). True when the write lands or there is no DB, False on failure — callers committing a destructive change on top (/compress repointing) must check it. ``reject_active_turn_lease`` is for user-initiated rewrites that do not own the cross-process turn lease.T)r)r*z&Failed to rewrite transcript in DB: %sNF)r\r{replace_messagesr,r^r_r)rrr'r)r*raes&&&&& rrewrite_transcript)SessionTranscriptMixin.rewrite_transcripts $ $Z 0  , , . . ##k-E$G  ( ( 4)/ .   EqI%/ .  !/ . .s4BA& B& B1BBBB B. c$V^8dQhRRRRRR/#)rparent_session_idrchild_session_idrrMr)rs"rrrX>s#WZ_crc fV'd V'gR#VPV4pVfR#VPV4pV'dVPR4V8wdR#VPV4'gR#VP V4^8# \ d\ PRTRR7R#i;i)anTrue when *child_session_id* is an atomically-published compression continuation of *parent_session_id*: ``publish_compression_child()`` wrote the handoff (plus any cloned foreign-tail rows) in the SAME transaction that ended the parent with ``end_reason='compression'``, so the child transcript is already durable on disk. Rewriting such a child is redundant AND destructive: the in-memory handoff lacks the rows cloned during publication, and a failed rewrite reports a false "failed to persist compressed transcript" over a committed compression. Fails open (False) on any DB error so callers fall back to the rewrite.Fr1z/published-compression-child probe failed for %sTrZ)r\rrK_is_compression_child_rowget_active_message_watermarkr,r^r_)rr1r2rachilds&&& ris_published_compression_child5SessionTranscriptMixin.is_published_compression_child>s!(8  $ $%6 7 : NN#34EEII&9:>OO//66223CDqH H  LLJL\gkL l s#B B B 5B #B0/B0c(V^8dQhRRRRRRRR/#)rr1rr2r'r(rrMr)rs"rrrXYs2HH%(Hcurrentrarrowr-s&&& rhas_input_owner&SessionTranscriptMixin.has_input_owner`s  9++J7G((1B,,W5@@G5Dg1!--g==nnW-"">">s"C"C12 9%j1q 8 9s:9CC.CCC1C4 C C CCc V^8dQhRRRR/#)rrrrr(r)rs"rrrXws99#92F9rc VPV4'g.#VPV4p\P!\4;_uu_4VPV4pVP V4;'gTpRRR4VPV4P VRR7# +'giL3;i \d*p\PRYRR7\T4ThRp?ii;i)uLoad all messages from a session's transcript (state.db is canonical). Reads follow the same routing writes use — the in-memory reroute map, then the durable compression tip — otherwise the transcript "vanishes" while every message sits under the child.NT)repair_alternationzVTranscript read failed for session %s; refusing to treat the conversation as empty: %srZ) r\r contextlibsuppressr,r]get_messages_as_conversationr^rr )rrrar-s&& rload_transcript&SessionTranscriptMixin.load_transcriptws&&z22I**:6   + +((4B// ;IIzJ, 9**:6SStT5 5 , + 9 LL'T  ;&j1q 8  9s$ -B%!B8% B5 8 C,$C''C,require_retryable_compositec(V^8dQhRRRRRRRR/#) rrrnr4rMrMrzOptional[dict[str, Any]]r)rs"rrrXs,666"%6KO6 !6rc  BVPV4pV'gR#^RIHpVP4;_uu_4VP V\ V^4)VVR7pTPT4RTPRTPRTP/uuRRR4# Td*p\ PRT4Rp?RRR4R#Rp?i\dh\d*p\ PRT4Rp?RRR4R#Rp?ii;i +'giR#;i) uBack up ``n`` user turns via soft-delete (``active=0``), mirroring CLI ``/undo [N]``. Returns ``{"rewound_count", "turns_undone", "target_text"}`` or ``None`` (no DB / no rewindable turn / persistence failure); ``n`` clamps to the oldest user turn. ``require_retryable_composite`` is the gateway ``/retry`` guard: the selected turn must be a composite carrier whose live payload is losslessly replayable as text — that replay-policy ``ValueError`` propagates so /retry can explain why the carrier is unsafe.N)RewindTargetUnavailableError)require_retryablerequire_compositezrewind_session: %sz!rewind_session: rewind failed: %s rewound_count turns_undone target_text)r\hermes_state_rewindrQr{rewind_user_turnrr^r_r8r,rrTrU live_text)rrrOrMrarQoutcomer-s&&&$ rrewind_session%SessionTranscriptMixin.rewind_sessions $ $Z 0D  , , . . --Q >Y&A.C  ( ( 4#W%:%:NGL`L`!7#4#46/ . 0  115/ .   @!D/ . / . .sRD  B6D D $C:D  D  D  D !D7D D  D  D )rN)F)FF))%rr r!r"r#rrrrbrjrtr{rrrrrrrrrrrr staticmethodrrrrr$r.r7r;rCrKr[r$rrrrUrU`sT #%(!783  (E^.4 .PiV* DJLhh "HC   D6H9.9.6RW66rrU) reasoningreasoning_contentreasoning_detailscodex_reasoning_itemscodex_message_items)r=rBrDr_r`rE)r# __future__rrHr5loggingryragent.turn_contextrtypingrrrrrgateway.sessionr getLoggerr^rr r-rLrNr9rSrUrrrrjs,#  :;;,   , -M,M r ]aDJ 6J 6r