+ jHj5la0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI Ht^RI Ht^RIHt^RIHt^RIHt^RIHt]!4tR ]R &] P6!4tR tR t^ tR t Rt!RRlt"RRlt#RRlt$RRlt%]PLRRl4t']PLRRl4t(Rt)/t*R]R&] PV!4t,RRlt-R R!lt.R"R#lt/!R$R%]04t1R&R'lt2RnR(R)llt3R*R+lt4]Pj!R,4]Pj!R-43t6R.R/lt7R0R1lt8R2R3lt9R4R5lt:R6R7lt;R8R9lt]!R>R?44t?RnR@R/RARBlllt@RCRDltARERFltBRGRHltCRnR@R/RIRJllltD]PLRnR@R/RKRLlll4tERnR@R/RMRNllltFRotGRptHRqtIRrtJRstKRttLRORPltMRQRRltNRSRTltORURVltPRWRuRXRvRYRwRZRx/tQR[R\ltRR]R^ltSR_R`ltT^tURatVRbtWRcRdltXReRfltYRgRhltZ]PLRiRj/RkRlll4t[^RmI\H]t^R#)yaSQLite connection lifecycle for the Kanban DB: open/configure, cross-process init and dispatch-tick locks, WAL checkpoints, corruption detection + quarantine + repair, additive migrations and the busy-retrying ``write_txn`` boundary. Split out of ``hermes_cli.kanban_db``; origin-resident helpers are reached late-bound via ``_kb`` (import-cycle breaking) so monkeypatching ``kanban_db.`` keeps working. ) annotationsN) dataclass)field)add_column_if_missing)Path)Any)Optionalset[str]_INITIALIZED_PATHSsSQLite format 3ig$@g?cV^8dQhRR/#)returnint)formats"A/home/ubuntu/.hermes/hermes-agent/hermes_cli/kanban_db_connect.py __annotate__r1s]]#]c<\P!R\^R7#)zReturn the SQLite busy timeout for Kanban connections. Kanban is the shared cross-profile dispatch bus, so worker stampedes are expected; a long timeout lets WAL serialize writers instead of surfacing transient ``database is locked`` failures.HERMES_KANBAN_BUSY_TIMEOUT_MS)minimum)_kb_env_intDEFAULT_BUSY_TIMEOUT_MSrrr_resolve_busy_timeout_msr1s <<79PZ[ \\rc V^8dQhRRRR/#)r pathrr sqlite3.Connectionr)rs"rrr9s$#5rcN^RIHp\4pV!V\PRVR, R7pVP RV 24V# \ dQ\P!\4;_uu_4TP4RRR4h +'gih;ii;i)zOpen a Kanban SQLite connection via ``connect_tracked``: while registered, byte-level probes of the file are refused because an ``open()``/``close()`` would cancel this process's POSIX advisory locks (see ``sqlite_safe_read``).)connect_trackedNg@@) connect_fnisolation_leveltimeoutzPRAGMA busy_timeout=) hermes_cli.sqlite_safe_readrrsqlite3connectexecute BaseException contextlibsuppress Exceptionclose)rrbusy_timeout_msconns& r_sqlite_connectr.9s<.0O  ??&(  D  +O+<=> K   + + JJL, , + s#A -B$6B B$ B  B$cV^8dQhRR/#)r r boolr)rs"rrrTsDrcZ\P'dC^RIpVP^4VP VP 4VP ^4R#^RIpVPVP 4VPVP,4R# \dR#i;i)zOne non-blocking exclusive lock attempt on ``handle``; False when held elsewhere. Windows: 1-byte ``msvcrt.locking`` range at offset 0; POSIX: ``flock``.NFT) r _IS_WINDOWSmsvcrtseeklockingfilenoLK_NBLCKfcntlflockLOCK_EXLOCK_NBBlockingIOErrorhandler3r8s& r _try_lock_nbr?Ts~  Av}};    KK )F G   s;B B*)B*cV^8dQhRR/#)r r Noner)rs"rrrfs 4 4t 4rc\P'dC^RIpVP^4VP VP 4VP ^4R#^RIpVPVP 4VP4R#)zGRelease a lock taken by :func:`_try_lock_nb` (same byte range / flock).N) rr2r3r4r5r6LK_UNLCKr8r9LOCK_UNr=s& r_unlockrEfsN  Av}}; FMMOU]]3rcV^8dQhRR/#)r rrr)rs"rrrts))4)rc#"VPPRRR7VPVPR,4pVP R4pRp\ P !4\,p\V4pV'g\ P !4V8dM\ P!\4KLV'g&\PPRV\4RxV'd \V4VP!4R# \dRpLi;i TP!4i;i T'd \T4TP!4i TP!4i;i;i5i)uSerialize first-connect WAL/schema/integrity setup across processes. ``_INIT_LOCK`` only covers one process's threads; a dispatcher burst has many worker processes hit a fresh/legacy board with empty ``_INITIALIZED_PATHS`` caches. Post-init usage stays concurrent under WAL. **Bounded** acquire: a blocking ``flock`` let one stalled/stale holder hang every ``connect()`` (the gateway dispatcher's next tick included) with no traceback. After the deadline we WARN and proceed WITHOUT the lock — safe because ``_INIT_LOCK`` still serializes same-process threads and init is idempotent: two racing first-inits mean redundant work, not corruption. Tparentsexist_okz .init.locka+bFukanban init lock for %s not acquired within %.0fs — proceeding without the cross-process lock (in-process lock + idempotent init are the correctness backstop). A stuck holder is no longer able to block this connect indefinitely (#36644).N)parentmkdir with_namenameopentime monotonic_INIT_LOCK_TIMEOUT_SECONDSr?OSErrorsleep_INIT_LOCK_POLL_SECONDSr_logwarningrEr+)r lock_pathr>acquireddeadlines& r_cross_process_init_lockr\ss KKdT2tyy<78I ^^E "FH>>#&@@ !'/4>>+x7 JJ. / HH  D5     LLN' !  !& LLN   LLNFLLNsxAE?!E8 DE >E )E4D,E? D)&E(D))E,D>>E?E<E'E<'E99E<<E?cV^8dQhRR/#)r db_pathrr)rs"rrrs,,,rc#"VPVPR,4pRpRpVPPRRR7VP R4p\ V4pTxTe'T'd \T4TP4R#R# \ \3dRpLFi;i \ dRpRpL[i;i \ \3dLUi;i TP4i;i TeST'd \T4M \ \3dMi;iTP4i TP4i;ii;i5i)uoNon-blocking single-writer guard around one dispatcher tick; yields ``True`` if this process holds the board's ``.dispatch.lock``, else ``False`` (caller skips the tick). Two dispatchers (e.g. an orphan gateway escaping its service cgroup) both pass ``busy_timeout`` and race on WAL frames — the root cause of multi-writer corruption; this is defense-in-depth behind ``_guard_supervised_gateway_conflict``. Non-blocking on purpose: the gateway's async watcher must never stall; the loser retries next interval. Without ``fcntl``/``msvcrt`` it degrades to a no-op (yields ``True``). Motivation (issue #35240): a ``hermes gateway run --replace`` / ``gateway restart`` invoked from a shell on a systemd/launchd host can leave an orphan gateway whose dispatcher escapes the service cgroup, survives ``systemctl restart``, and becomes a *second* long-lived writer on the same ``kanban.db``. The startup guard (``_guard_supervised_gateway_conflict``) blocks the common way an orphan is born, but this lock is the defense-in-depth that prevents two dispatchers from ever writing concurrently *regardless of how the second one got there*. z.dispatch.lockNFTrHrK) rNrOrLrMrPr?rTAttributeErrorrEr+)r^rYr>rZs& r_dispatch_tick_lockras6(!!',,1A"ABI FH td;& #F+H    FO  ( H   ^,      FO^,     s'E .B. B%C/)E .CE B+(B.)E *B++B..C=E ?CE CCCCC,,E /E5D D1 DD1DD1 E1EEE gr@zdict[str, float]_LAST_WAL_CHECKPOINTc$V^8dQhRRRRRR/#)r r-rr^rr rAr)rs"rrrs'LL 2LTLdLrc\VP44p\P!4p\ ;_uu_4\ PV4pVeW4, \8d RRR4R#V\ V&RRR4VPR4P4p\PPRY%e \V4MR4R# \d\T4pLi;i +'giL};i \P d,p\PPRY&4Rp?R#Rp?ii;i)z``PRAGMA wal_checkpoint(PASSIVE)`` at most once per interval per board, from the dispatcher tick under the dispatch lock. Never raises: pure hygiene, must not fail a tick.NzPRAGMA wal_checkpoint(PASSIVE)zSkanban WAL checkpoint (PASSIVE) on %s -> %s (busy, wal_frames, checkpointed_frames)z'kanban WAL checkpoint on %s skipped: %s)strresolverTrQrR_WAL_CHECKPOINT_LOCKrbget _WAL_CHECKPOINT_INTERVAL_SECONDSr&fetchonerrWdebugtupler$Error)r-r^keynowlastrowexcs&& r_maybe_checkpoint_walrss'//#$ .. C  #'',  /O O    %(S! Lll;<EEG  6 sD  'l   ==L @#KKLs;C,C24 C2ADC/.C/2 D E EEc$V^8dQhRRRRRR/#)r databytesoffsetrr r0r)rs"rrrs!  E 3 4 rcD\V4V^,8dR#W,W^,,W^,,rCp\PW^,V^,R4pVR9;'d1V^8H;'d$VR9;'d^Tu;8;'dR8*#u#)z9Return True for a TLS record header at ``data[offset:]``.FbigiH>>r )lenr from_bytes)rurw content_typemajorminorlengths&& r_looks_like_tls_record_atrs 4y6A:!%tQJ/?qjAQL ^^D!FQJ7 ?F00  TM  3 3     %   rc V^8dQhRRRR/#r rrr rAr)rs"rrr s$4rc VP4P^8XdR#^RIHpT!T^@R7pTeTP \ 4'dR#RpTP R4'd\T^4'dRpM\T^4'dRp\P!RT T R TR ,PR 4 24h \dR#i;i) aKFail early with an actionable error for non-SQLite Kanban DB files. ``sqlite3.connect()`` creates missing and zero-byte files, so those pass; non-empty files must carry the SQLite header, so a corrupt page 0 isn't collapsed into a generic PRAGMA error and the gateway's corrupt-board handling can identify the board by fingerprint.N)read_header_bytes_preopen)rsSQLitz. (TLS record header detected at byte offset 5)z. (TLS record header detected at byte offset 0)z2file is not a database: invalid SQLite header for z ; first_32=:N N ) statst_sizerTr#r startswith_SQLITE_HEADERrr$ DatabaseErrorhex)rrhead signatures& r_validate_sqlite_headerr s  99;  ! #  $F $T" 5D |t~66I x  %>tQ%G%GD "4 + +D   < & ;tCy}}S'9&: <  sC CCc2a]tRtRtRtRV3RlltRtV;t#)KanbanDbCorruptErrori'uRaised when an existing kanban DB file fails integrity checks — a fail-closed guard against silently recreating a corrupt board (which would destroy the user's tasks). Carries the path and the backup made first.c$V^8dQhRRRRRR/#)r r^r backup_pathOptional[Path]reasonrer)rs"rr!KanbanDbCorruptError.__annotate__,s!   > 3 rc  p<WnW nW0n\SV`RV RV R\ V4 R24R#)z&Refusing to open corrupt kanban DB at z: z . Original preserved; backup at .N)r^rrsuper__init__ _backup_label)selfr^rr __class__s&&&&rrKanbanDbCorruptError.__init__,sF &  4WIRxH--:;-G,H K r)rr^r)__name__ __module__ __qualname____firstlineno____doc__r__static_attributes__ __classcell__)rs@rrr'sN  rrc V^8dQhRRRR/#)r rrr rer)rs"rrr6sNN~N#Nrc$Ve \V4#R#)Nz)re)rs&rrr6s*63{ M.corrupt..bak`` files plus their ``-wal``/``-shm`` copies. ``keep`` (the just-created backup) is never pruned regardless of mtime — ``shutil.copy2`` preserves the source timestamp, which may be older than existing backups. Best-effort: prune failures never mask the corruption error the caller is about to raise.z.corrupt.*.bakNc V^8dQhRRRR/#)r itemrr floatr)rs"rr,_prune_corrupt_backups..__annotate__MsTerc\VP4P# \dR#i;i)g)rst_mtimerT)rs&r_mtime&_prune_corrupt_backups.._mtimeMs+ 99;'' '  s  ++T)rnreverse-wal-shm) missing_ok) globis_filerTmax_CORRUPT_BACKUP_RETENTIONrsortrNrOr(r)unlink) rLrr candidatebackupsbudgetrstalevictims &&& r_prune_corrupt_backupsr:s&$[[I;n)EF F   " '0'8 IF  *43CaKQ OF 7|v  LLVTL*!ooejj6.ABEOOTYT^T^agTgDhiF$$W--  ..-j"% .--s8D'D"D"D"D'=D9 "D'' D65D69 E c V^8dQhRRRR/#)r rrr rr)rs"rrrZs88T8n8rca VP4pVPpVPp^RIHpV!V4'd#\ P PRV4R#\P!4pVPR4;_uu_4o \V 3RlR4FpVPV4K RRR4Y# RTP4R, R 2, pTPT8wdR#TP4'g%\ P"!Y4\%Y#TR 7R FpY#T,, p Y'PT,, p T PT8wg>T P4'd(T PT8wgT P4'dK{\&P(!\4;_uu_4\ P"!Y4RRR4K T# +'giELE;i \dR#i;i \dR#i;i +'giEK ;i) aCopy a corrupt DB (and WAL/SHM sidecars) to a content-addressed backup. The name is deterministic in the main DB's sha256, so repeated quarantines of the same bytes reuse one backup while changed bytes get a separate one. Returns the main backup path, or ``None`` if the copy failed (the caller still raises loudly). Writes are confined to the DB's parent directory: the basename derives only from ``path.name`` + content hash.)has_live_connectionzrefusing to quarantine %s: a connection to it is still open in this process, and fingerprinting the file would cancel that connection's POSIX locks. Close all connections first.Nrbc&<SPR4#)ii)read)r>sr$_backup_corrupt_db..xsfkk+&>rrz .corrupt.:NNz.bak)r)rr)rfrLrOr#rrrWerrorhashlibsha256rPiterupdaterT hexdigestexistsshutilcopy2rr(r)) rresolvedrLrrdigestchunkrsuffixsidecarsidecar_backupr>s & @r_backup_corrupt_dbrZs||~H __F I @8$$  E    ^^ F ]]4 F>D e$E! ;i0@0@0B30G/HMMI6!       LL - vyA"./>>F#:; NNf $GNN,<,<$$..2G2G2I2I    ) ) LL 1* )# 7!    * ) )sN6H)G48H HH,4 H ?HH HH H)(H), H> z+^wrong # of entries in index (?P.+)$z*^row \d+ missing from index (?P.+)$c V^8dQhRRRR/#)r messages list[str]r r0r)rs"rrrsFFYF4Frc~\V4^8H;'d)V^,P4P4R8H#)zDTrue iff ``PRAGMA integrity_check`` output is the single ``ok`` row.ok)rstriplower)rs&r_integrity_messages_okrs4 x=A  E E(1+"3"3"5";";"="EErc V^8dQhRRRR/#)r r-rr rr)rs"rrrsSS1SiSrcVPR4P4pVUu.uF'q"fKV^,fK\V^,4NK) up#uupi)z>Return all ``PRAGMA integrity_check`` message rows as strings.zPRAGMA integrity_check)r&fetchallre)r-rowsrqs& r_run_integrity_checkrsD <<0 1 : : >>?}} $ LL # $ ==1)#/000 1 si A(0B B>(B=B B B&B;8B>:B;;B>>C5C0C5C80C55C88D c V^8dQhRRRR/#)r rrr r0r)rs"rrrsrcVP4'*;'gVP4P^8H# \dR#i;i)uJTrue for a missing / zero-byte / unstat-able DB file — nothing to probe.T)rrrrT)rs&r_missing_or_emptyr sB??$$DD (?(?1(DD s<< A  A c V^8dQhRRRR/#)r rrr z)tuple[Optional[list[str]], Optional[str]]r)rs"rrrs ] ]D ]-V ]rc\V4p\ T4'dTR3#TRT'd T^,MR: 23# \Pdh\PdpRRT 23uRp?#Rp?ii;i)a``(messages, reason)`` from an integrity probe; ``reason`` is ``None`` when healthy and ``messages`` is ``None`` when sqlite refused to open the file at all. ``OperationalError`` (lock/busy) is NOT corruption and propagates raw so a locked healthy DB is never quarantined.Nzsqlite refused to open file: zintegrity_check returned )rr$OperationalErrorrr)rrrrs& r_probe_for_corruptionrs ;#H- h''~ 0!j0[\ \\  # #  ;4SE:::;s! ;(A6$A6%A1+A61A6c V^8dQhRRRR/#rr)rs"rrrs,9,9,9,9rclVP4p\T4'g\T4\9dR#\ T4wr#TfR#\ T4p\T;'g.4pT'd\PPRTRPT4\T44\Y4wrgT'd=\PPRTRPT4\T44R#T RT'd T^,MR: 2p\YT4h \dR#i;i)aRun ``PRAGMA integrity_check`` on an existing non-empty DB file. Narrow auto-repair when the failure is ONLY index-scoped (table b-trees intact): content-addressed corrupt backup FIRST, REINDEX under the caller-held init flock, re-check, proceed only if clean. Anything else (page corruption, ``malformed``, unclean re-check) fails closed: back up the file + sidecars and raise :class:`KanbanDbCorruptError` so callers never recreate the schema on top of a damaged DB. ``OperationalError`` (lock/busy) is NOT corruption and propagates raw (no spurious backup). No-op for missing / zero-byte files and paths already proven healthy this process. All writes are confined to the resolved path's parent. Nu|kanban DB %s failed integrity_check with index-only errors (%s); pre-repair backup at %s — attempting REINDEX auto-repair., zckanban DB %s auto-repaired via REINDEX (%s); integrity_check now clean. Pre-repair copy kept at %s.zC; REINDEX auto-repair attempted but integrity_check still returned r)rfrTr rer rrrrrWrXjoinrr r)rrrrbackuprrepairedposts& r_guard_existing_db_is_healthyrs<<>""c(m7I&I,X6H ~  )F)(..b9K  P dii ,mF.C 7xM  HH  I$))K0-2G  h)-d1g:@ B  x 88; sD$$ D32D3c]tRtRt$RtR]R&R]R&]!]R7tR]R &]!]R7t R]R &R t R ]R &]!]R7t R]R&Rt R #) RepairResulti*aOutcome of :func:`repair_db`. ``status``: ``"ok"`` (already clean), ``"repaired"`` (index-only errors, REINDEX applied, re-check clean; ``backup_path`` is the pre-repair copy), ``"corrupt"`` (non-index error class, or re-check still dirty), ``"missing"`` (no / zero-byte file).restatusrr^)default_factoryrrpost_repair_messagesNrr reindexedr) rrrrr__annotations__rlistrrrr rrrrrr*sLM K M5Hi5&+D&A)A"&K& 6Iy6rrboardc$V^8dQhRRRRRR/#)r r^rr# Optional[str]r rr)rs"rrr9s"- - ~- - Q]- rc "VeTM\P!VR7pVP4p\ V4'd\ RVR7#\ V4;_uu_4\V4wrEVf-\ RV\V4.\V4R7uuRRR4#Vf\ RW4R7uuRRR4#\V4p\V4pV'g\ RW4VR7uuRRR4#\W74wr\;_uu_4\P\V44RRR4\ V'dR MRVVV VVR 7uuRRR4# \dTpEL7i;i +'giLI;i +'giR#;i) aProbe a kanban DB and apply the narrow index-REINDEX repair if needed. Same policy as :func:`_guard_existing_db_is_healthy` (quarantine BEFORE any mutation; REINDEX under the init flock; anything non-index stays corrupt), but returns a :class:`RepairResult` instead of raising so ``hermes kanban repair`` can pick its exit code. ``OperationalError`` (locked/busy) still propagates raw: a locked healthy DB must not be quarantined.Nr#missing)rr^corrupt)rr^rrr)rr^rr)rr^rrrr )rkanban_db_pathrfrTr rr\rrerrr  _INIT_LOCKr discard) r^r#rrrrrrrrs &$ r repair_dbr-9sM)7s/A/A/ND<<>""9h?? !( + +0:    (c&k].x8 , + >tXQ , +$H--h7 y(cij! , +"7xMZ  & &s8} 5!):y!%!  - , + 2Z) , + +sGE 3E=E=9+E=/E= E* )"E= E'&E'* E: 5E== F c V^8dQhRRRR/#)r r-rr r0r)rs"rrris  / D rcVPR4P4pVRJ# \PdR#i;i)uWhether an open connection actually sees the kanban schema. ``tasks`` is the sentinel (SCHEMA_SQL always creates it; SQLite loses tables all-or-nothing), so one ``sqlite_master`` lookup on the resident page 1 suffices — cheap by design, it runs on every steady-state connect().zGSELECT 1 FROM sqlite_master WHERE type='table' AND name='tasks' LIMIT 1FN)r&rjr$r)r-rqs& r_schema_is_presentr0isJ ll U (*  d?  s %>>c V^8dQhRRRR/#)r rrr ztuple[sqlite3.Connection, Any]r)rs"rrrys  4 0N rc&\V4p\PVn\P Vn\;_uu_4^RIH pV!VRVP R2R7VPR4VPR4VPR4VPR4VPR 4VPR 4V!V4pR R R 4W$3# +'giTX3#;i \dTP4hi;i) adOpen ``path`` with the kanban PRAGMA set, then run ``under_lock(conn)``. WAL activation and ``under_lock`` share the ``_INIT_LOCK`` critical section: WAL setup can take an exclusive lock while SQLite creates sidecars for a fresh DB, and concurrent gateway startup threads must not race before ``_INITIALIZED_PATHS`` is populated. Closed if anything raises.)apply_wal_with_fallback kanban.db ()db_labelzPRAGMA synchronous=FULLzPRAGMA wal_autocheckpoint=100z!PRAGMA journal_size_limit=8388608zPRAGMA foreign_keys=ONzPRAGMA secure_delete=ONzPRAGMA cell_size_check=ONN)r.r$Row row_factoryr _lossy_text text_factoryr+hermes_state_walr3rOr&r*r+)r under_lockr-r3outs&& r_open_configuredr?ys 4 D";;OO Z A #D[ 13M N LL2 3 LL8 9 LL< = LL1 2 LL2 3 LL4 5T"C%, 9-Z, 9   s*8C3B CC3 C0 (C30C33Dc$V^8dQhRRRRRR/#)r rrr#r%r rAr)rs"rrrs&-w-w$-w}-w-wrc6VP4'dR#VfVPR, pVP4'dx^RIpVPVP RR74p\T\4'd<TPR4'd%\ RTPP: R24hR#\P!V4pT'dT\P8XdR#\P!T4pTPR4'd\ RT: R24h\P!T4P4'g\ RT: RT R 24hR# \ \ 3dR#i;i \ dR#i;i) ubRefuse to create a fresh DB for a board that is not live. ``board=None`` (or ``default``) is unaffected — except that a None board can still *resolve* through the current-board context (``--board`` scope, ``HERMES_KANBAN_BOARD``, the ``current`` file) to a named board dir; an ``archived`` tombstone in that dir gets the same refusal. For any other slug whose DB file does not exist yet, opening it would mkdir the board directory and leave an empty DB-only stub — exactly how archived boards (moved to ``_archived/`` with an ``archived`` tombstone ``board.json``) and hard-deleted boards (no directory left at all) used to reappear as empty active boards via stale dashboard/gateway read paths (#43243). Creation is the job of :func:`kanban_db.create_board` (which writes the metadata first); read paths get an actionable error instead of a resurrected board. Nz board.jsonz utf-8-sig)encodingarchivedz kanban board z/ is archived; refusing to recreate its databasez= does not exist; create it with `hermes kanban boards create `)rrLjsonloads read_textrT ValueError isinstancedictrhrOr_normalize_board_slug DEFAULT_BOARDread_board_metadataboard_metadata_path)rr# tombstonerErslugmetas&& r_refuse_dead_board_resurrectionrRsl {{}} } KK,.       jj!4!4k!4!JK#t$$)<)< #DKK$4$4#7888 ((/ 43,,,  " "4 (D xx =0_`aa  " "4 ( / / 1 1=0mnrmsstuvv 2#Z(   s$ !E1F 1FF FFc$V^8dQhRRRRRR/#)r r^rr#r%r rr)rs"rrrs'DD^DmDOaDrcda VeTM\P!VR7p^RIHpV!V4'd\P !VP 4P4R,RR7p\PVn \PVn \V4'gVP4\R4hV#\W!4VP P#RRR7\%VP 44o S \&9dy\)V\4wrEV'dV#VP4\*;_uu_4\&P-S 4RRR4\P.P1R V4\3V4;_uu_4^R IHpV!VR VP8 R 2R 7\;V4\=V4\%VP 44o RV 3Rllp\)W'4wrHRRR4V# +'giL;i +'giX#;i)aOpen (and initialize if needed) the kanban DB. WAL is (re)enabled on every connection so a re-created file stays robust; the first connection per path auto-runs :func:`init_db`, later ones skip via ``_INITIALIZED_PATHS``. Path: explicit ``db_path``, else ``board``, else :func:`kanban_db_path` (``HERMES_KANBAN_DB`` -> ``HERMES_KANBAN_BOARD`` -> ``/kanban/current`` -> ``default``).Nr')kanban_path_is_fencedz?mode=roT)urizOKanban descendants require an initialized board; ask its owner to initialize itrHzqkanban DB %s lost its schema after this process initialized it (deleted or replaced externally); re-initializing.)preflight_db_writabilityr4r5r6c V^8dQhRRRR/#r r-rr rAr)rs"rrconnect..__annotate__s 1 1"4 1 1rc<S\9dBVP\P4\ V4\P S4R#R#N)r executescriptr SCHEMA_SQL_migrate_add_optional_columnsadd)r-rs&r_init_if_needed connect.._init_if_neededs;11""3>>2-d3"&&x02r)rr*agent.delegation_contextrUr$r%rfas_urir8r9r:r;r0r+PermissionErrorrRrLrMrer r?r+r,rWrXr\ hermes_staterWrOrr) r^r#rrUr-schema_presentrWra_rs &$ @rr%r%s)7s/A/A/ND>T""t||~446CN";;OO!$'' JJL!"st t #D0KKdT24<<>"H%%/6HI K Z  & &x 0  A  "$ ' ' : +dii[0JK %%d+t||~& 1 1#49) (* K?Z ( '* Ks H A$H H  H/ c V^8dQhRRRR/#)r r^rr#r%r)rs"rrrs  ^ m rc #t"\WR7pVx\P!\4;_uu_4VP 4RRR4R# +'giR#;i \P!\4;_uu_4TP 4RRR4i +'gii;i;i5i)uHOpen a kanban DB connection and guarantee it is closed on exit. Use instead of ``with kb.connect() as conn:`` — sqlite3's context manager only commits/rolls back, it does NOT close the fd, so long-lived processes (gateway, dashboard) leak FDs until ``[Errno 24] Too many open files``. See #33159 for the production incident. )r^r#N)r%r(r)r*r+)r^r#r-s&$ rconnect_closingrksk 7 0D   + + JJL, + + +Z  + + JJL, + + +sJ B8A%"B8A B8 A"  B8%#B5B"  B5" B2 -B55B8c$V^8dQhRRRRRR/#)r r^rr#r%r rr)rs"rrr$s!  ^ m t rcVeTM\P!VR7p\W!4VPP RRR7\ ;_uu_4\ P\VP444RRR4\P!\V44;_uu_4RRR4V# +'giLC;i +'giT#;i)uCreate the schema if it doesn't exist; return the path used. Unlike :func:`connect`'s cached first-time auto-init, this always re-runs the migration pass — callers that know the on-disk schema may have drifted (tests writing legacy event kinds, external upgrades) use it to force it.Nr'TrH) rr*rRrLrMr+r r,rerfr(closingr%)r^r#rs&$ rinit_dbro$s )7s/A/A/ND#D0KKdT2 ""3t||~#67    GDM * *  + K  * * Ks-B<0C< C  C c$V^8dQhRRRRRR/#)r r-rtablerer r r)rs"rrrs'PP*P3P8PrcbVPRV R24Uu0uF q"R,kK up#uupi)PRAGMA table_info(r5rO)r&)r-rqrqs&& r _column_namesrts3#'<<2DUG10M#N O#NCKK#N OO Os,c$V^8dQhRRRRRR/#r r-rrqrer r0r)rs"rrrs"*34rcLVPRV R24P4RJ#)z