+ jHjpzRt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RIH t ^RI H t ^RI H t ^RIHtRtRRRR/R R lltR R ltR RltRt]]P.]3tRRlt]3RRlltRRltRRltRRltRRltRRlt RRlt!R R!lt"R"R#lt#RSR$R%llt$R&R'lt%RSR(R)llt&RTR*R+llt'R,R-/R.R/llt(R0R1lt)R2t*R3R4lt+R5R6lt,!R7R84t-RUR9R:llt.R;t/R<R=lt0R>R?lt1RVR@RAllt2RBRClt3RDRElt4RFRGlt5RHt6RSRIRJllt7RKRLlt8RMRNlt9RORPlt:RQRRlt;R#)WanDashboard/serve support: managed-service restart (systemd/respawn), status/listening probes, SSH session token file, named-profile routing, web-dist resolution, update stdio hangup protection. Split out of ``hermes_cli/main.py``. Names that still live in main (``PROJECT_ROOT``, ...) are imported lazily inside the functions that use them (avoids an import cycle). N)Path)NoReturn) line_input)is_desktop_owned_backendzG Pre-build first: npm install --workspace web && npm run build -w web exclude_pids scope_homecV^8dQhR\\,R,R\R,R\\,/#)rNrreturn)setintstrlist)formats">/home/ubuntu/.hermes/hermes-agent/hermes_cli/main_dashboard.py __annotate__rs8PPC4P+.:PAEcPc^RIHpHpHpHpV!VR7UUu.uFwrgVNK pppV!4p VUu.uFqc!Wi4'dKVNK ppV'd V!W4#T#uuppiuupi)auPIDs of running ``dashboard``/``serve`` backends the caller may stop. *scope_home*: keep only backends whose resolved Hermes home (see ``_hermes_home_for_pid``) is this home; unreadable ownership is spared, never guessed. ``--stop`` and the post-update cleanup pass their own home so another install's or profile's backend on the same machine is never a target (#113978). )_caller_ancestor_pids_is_caller_wrapper_shell_pids_owned_by_hermes_home_scan_dashboard_processes)r)hermes_cli.dashboard_procsrrrr) rrrrrrpid_cmdpids ancestorss $$ r_find_stale_dashboard_pidsrsr "; !U V!UICC!UD V&'I P4C'?'OCC4D P;E %d 7O4O W Qs A"A(A(cjV^8dQhR\R\\\\3,R,/#)r commandr N)r tupler )rs"rrr.s*ceCcM.BT.Ircj^RIHpV!V4pVR9dR#RpRp\P!RV4pV'd\ VP ^44p\P!RV4pV'd+VP ^4PR4;'gRpW$V3# \ dR#i;i) zBest-effort parse of a dashboard/server cmdline into mode, host, and port. The mode is the canonical holder subcommand, never an argv substring: this gates the launchd backend inventory (a kill + kickstart path) and ``--status`` (#121156). )_hermes_holder_subcommandNi# 127.0.0.1z(?:^|\s)--port(?:=|\s+)(\d+)z/(?:^|\s)--host(?:=|\s+)(\"[^\"]+\"|'[^']+'|\S+)z"') dashboardserve)hermes_cli.update_cmd_windowsr"researchr group ValueErrorstrip)rr"modeporthost port_match host_matchs& r_parse_dashboard_runtimer1.s H $W -D )) D D:GDJ z''*+DMwWJ"((/>>; t   sB## B21B2c>V^8dQhR\R,R\/#)r r.Nr r )rs"rrrJsd srcjT;'gRP4PR4pVR9dR#V#)zDMap wildcard binds to a loopback address suitable for local probing.r#z[]>::0.0.0.0)r+)r. normalizeds& r_dashboard_probe_hostr9Js5%%+,,.44T:J** rzhermes-dashboard.servicecfV^8dQhR\\,R\R\P/#)r cmdtimeoutr )rr r subprocessCompletedProcess)rs"rrrWs0ooDIo3o:3N3Norc <\P!VRRRRVRR7#)zQCaptured, text-decoded ``subprocess.run`` for short local probes (systemctl, ps).Tutf-8replaceF)capture_outputtextencodingerrorsr<check)r=run)r;r<s&$r _run_proberHWs& >> DtgiY`hm oorc<V^8dQhR\R\R\/#)r reasonunitr r bool)rs"rrr]s'LLsL#L\`Lrca\PR8XdR#R^ /RRllpRpR!FpV!.VORNSNRNR N5!pTP^8wdK(TP;'gR P 4p\ ;QJdT3R lT4F 'gK R M RM!T3R lT44'gKTpM VfR#V!.VOR NSN5!pV!.VORNSN5!pTP;'gR P4p TP;'gR P4p T R8wd T R"9dR#\RT R24T'dRMRp R.TORNSN5.p T'gT PRRRRS34.p T Fp\\T4^)rs"rr8_restart_managed_dashboard_service..__annotate__gs,AA#AAZ5P5PArc"\R.VOVR7#) systemctlr<)rH)r<rQs$*r _systemctl6_restart_managed_dashboard_service.._systemctlgs;..@@rNzlist-unit-filesz --no-legendz --no-pagerr5c3<"TF7qP4'gKVP4R,S.8HxK9 R#5i):NN)split).0rowrKs& r 5_restart_managed_dashboard_service..ws,NYc))+)syy{3D6)Ys A#ATz is-activez is-enabledactiveu+ ⟲ Restarting managed dashboard service ()zsystemctl --userzsudo systemctlrTrestartsudoz-nrU z: u ✓ restarted u ✗ failed to restart z zl Dashboard is managed by systemd; not raw-killing its PID because systemd would treat that as a clean stop.z Restart manually: z restart ))--user>linkedstaticenabled generatedlinked-runtimeenabled-runtime)sysplatform_SYSTEMCTL_ERRORS returncodestdout splitlinesanyr+printappendrHrjoinstderr)rJrKrVscope candidateresult unit_rowsr`ri active_state enabled_state scope_labelcommandsrEreerrs&f r"_restart_managed_dashboard_servicer]s ||wAbA%)E&  aa,=ata]aT`aF    ! ]]((b446 3NYN333NYN N NE ' }6U6K668e8\848MM''R..0L^^))r002MxM:% 8 BC(-$3CK6u6i667H  {ItDEF W r:F    ! &tf- . '*+2v}}/S/S /S/SQS.Z.Z.\-]^_ &tf -. 99;; F3%. !  4  Ytf => o!    .!  MMSXXg./r!5 6  s;I2JJ2 JJ JJ K"%KKc$V^8dQhR\/#)r rr )rs"rrrs  S rc#\"\RV R24pVP4'gR#VPRRR7pTP 4F@pTP 4PR^4p\T4^8XgK5T^,xKB R# \\3dR#i;i5i)zZYield the ``0::`` cgroup paths from ``/proc//cgroup``; nothing when unreadable./proc/z/cgroupN utf-8-sigrA)rDrEr6) ris_file read_textOSErrorPermissionErrorrrr+r[len)r cgroup_pathrClinepartss& r_pid_unified_cgroup_entriesrsVC501 ""$$ $$k)$L! ""4+ u:?(N" _ %s8B,%BB,BAB,B,B)%B,(B))B,c>V^8dQhR\R\R,/#r rr Nr r )rs"rrrsccDjrc\V4FUpVPR4'gKVPR^4R,pV'gK?\W!V4'gKSVu# R#)akThe systemd service unit that supervises *pid* (``hermes-serve.service``), or None. A ``.service`` cgroup alone only says where the process was started: a dashboard launched by hand from a shell that itself runs under some unit (a CI runner agent, ``cron.service``, a tmux or IDE user service, the gateway's own terminal tool) sits in THAT unit's cgroup. The unit owns the backend only when its live ``MainPID`` is this PID; otherwise restarting it restarts an unrelated service and leaves the dashboard down. None when the PID isn't part of a service, ownership can't be proved, the file is unreadable, or off Linux. z.service/N)rendswithrsplit_unit_main_pid_is)rcg_pathsvc_names& r_get_systemd_service_for_pidrsU/s3   J ' '~~c1-b1Hx-hEE 4 rcHV^8dQhR\R\R\R\/#)r rrrr r r rM)rs"rrrs(   # C D rc`\V4pRR..R../PT;'gR.R..4pVFdp\R.VORNVNRNRN^ R 7pTP^8XgK/TP ;'gRP 4\T48XgKcR # R # \dKxi;i) zPTrue when *svc_name*'s live ``MainPID`` is *pid* (read-only ``systemctl show``).userresystemr5rTshowz--property=MainPIDz--valuerUTF)_extract_scope_from_cgroupgetrHrorprqr+r )rrrrxscopes scope_argsrzs&&& rrrs &{ 3EzlHrd 3 7 7 b8*EU VF  ]z]6]8]=Q]S\]gikF    !v}}':':&A&A&Cs3x&O  !   sB B-,B-c>V^8dQhR\R\R,/#)r cgroup_entryr Nr3)rs"rrrsSS4Zrc*RV9dR#RV9dR#R#)uc``user`` / ``system`` from a cgroup path (``/user.slice/…`` vs ``/system.slice/…``), else None.z/system.slice/rz /user.slice/rNrf)rs&rrrs<'% rc>V^8dQhR\R\R,/#rr)rs"rrrs88c8cDj8rc,\\V4R4#)zGThe unified (``0::``) cgroup path from ``/proc//cgroup``, or None.N)nextr)rs&r_get_pid_cgroup_pathrs +C0$ 77rcnV^8dQhR\R\\\R,3,R,/#r)r r r )rs"rrrs0MMMc3:o(>(EMrcd\V4pVfR#T\\V4;'gR43#)z``(unit, scope)`` of the systemd unit whose live ``MainPID`` is *pid*; ``None`` when no unit provably owns it (see :func:`_get_systemd_service_for_pid`). Scope is ``user``/``system`` or ``None`` when the cgroup path does not say.Nr5)rrr)rrKs& r_systemd_owner_for_pidrs5 ( ,D | +,@,E,K,KL LLrc`V^8dQhR\R\R,R\\,/#)r rKrxNr )r r)rs"rrrs.aaCad atCyarcZRV 2RV 2r2RV.RV./PT;'gRW#.4#)zVThe command(s) that restart *unit* in its scope; both forms when the scope is unknown.zsystemctl --user restart zsudo systemctl restart rrr5)r)rKrxuser_cmd system_cmds&& r_systemd_restart_commandsrsC6tf=AXY]X^?_j XJ:, 7 ; ;EKKR(I_ ``rcFV^8dQhR\\,R\/#r rr rr )rs"rrrs33tCy3S3rc2RPRV44#)zRJoin restart commands as a user-facing hint: each backticked, separated by " or ".z or c3."TF pRV R2xK R#5i)`Nrf)r\cs& rr^+_format_restart_commands..s2A1#Qxs)rv)rs&r_format_restart_commandsrs ;;22 22rcJV^8dQhR\R\R,R\/#)r rrNr rL)rs"rrrs&3S4ZSWrcV'd \V4MRpRRV.pRRRV.pRV.RV./PW#V.4pVF#p\V^R7P^8XdR#K% R # \dK7i;i) zRestart *svc_name* via systemctl (``--user`` for user-scope units). True on success. Unknown scope tries system first, then user. NrTrbrerrrUTF)rrrHrpro)rrrxrr candidatesr;s&& r_try_restart_systemd_servicers 8C &{ 3Ey(3JXy(;H8*h =AA%V^I_`J #r*55:; !   sA%% A43A4c\V^8dQhR\\\\3,,/#r r )rr r r)rs"rrrs!T%T "23rc~R\P!4R, R, 3R\R43R\R43.#)agentLibrary LaunchAgentsz/Library/LaunchAgentsdaemonz/Library/LaunchDaemons)rhomerfrr_launchd_plist_dirsrs@ $))+ )N:; $./0 4012 rc V^8dQhR\\\\3,,R,R\\\\\\,\R,3,,/#)r plist_dirsNr )rr r rr )rs"rrrsJ11U39%&-1 %S$s)S4Z/ 011rc @\PR8wd.#^RIp^RIHp^RIHp\P!4p.pVeTM \4EFdwrg\VPR44pTEF<p \T R4;_uu_4p TPT 4p RRR4\#X \$4'gKK\'T P)R4;'gR4P+4p T P)R 4p T 'd\#T \,4'd T 'gKT Uu.uFp\'T4NK pp\/\0P2!T44fKTR 8XdRM R T 2R T 23pTF0pT!TT 4wppT'gKTP7TYT34EK: EK? EKg V# \dEKzi;i +'giEL9;i \\TP T3dEKi;iuupi \4dR RppLi;i)u``(domain, label, program_arguments, live_pid)`` for every LOADED launchd job whose ``ProgramArguments`` is a ``hermes dashboard`` / ``hermes serve`` backend. macOS only (empty elsewhere). Reads the plists (unreadable/malformed ones are skipped) and asks ``launchctl print`` per candidate label — a job that is not loaded in any domain is not returned, so an operator's stale plist never claims a process.darwinN) ExpatError)_launchd_print_service_pidz*.plistrbLabelr5ProgramArgumentsrzgui/zuser/F)r)rmrnplistlibxml.parsers.expatrhermes_cli.gatewayrosgetuidrsortedglobropenloadr*InvalidFileException isinstancedictr rr+rr1shlexrvroru)rrrruidjobskind plist_dirplists plist_pathfdatalabelrQaargvdomainsdomainloadedlive_pids& r_loaded_launchd_backend_jobsrs ||x ,= ))+C9;D*4*@JFYF[[ INN956F!J *d++q#==+D,dD)))//R0668E88./D 4 6 6d$()DqCFDD)' 4(89A%)X%5kd3%LERUQV-;XG!3'A&%'P$FH6KKh ?@")! \B K=   ,++ Z)F)F S  *)3',dHFH3sZF:7G! G G!,H> H : G  G  G G!G!!HH H H cvV^8dQhR\R\\,R,R\\\\\\,\R,3,,R\\,\\R3,,R\\\\R,3,R,/#)r rcmdlineNrr.r )r rr r )rs"rrrQs Cy4'/3E#sDIsUYz:Y4Z/[Cy5c?* 3S4Z  4'rcRRlpVFDwrVrxVeW8XgW9dWVV3u#VfK"V!\V44V!V48XgK@WVV3u# R#)uU``(domain, label, live_pid)`` of the loaded launchd job that owns *pid*: launchd reports *pid* (or one of its *ancestors* — a plist may wrap the backend in ``/bin/sh -c …`` without ``exec``) as the job's live process, OR the process runs the job's ``ProgramArguments`` — a detached copy of a supervised backend (an earlier respawn) holds the port the job needs, and respawning it again would only re-create that conflict. ``--no-open`` is ignored on both sides: the respawn path adds it, so an earlier respawn's argv is the plist's plus that flag. None when no loaded job claims the process.c\V^8dQhR\\,R\\,/#r rr r)rs"rr1_launchd_job_owning_backend..__annotate__\s"55DI5$s)5rc@VUu.uF qR8wgK VNK up#uupi) --no-openrf)rrs& r_norm*_launchd_job_owning_backend.._norm\s!44a #34444sN)r) rrrrrrrrrs &&&& r_launchd_job_owning_backendrQs\5*.%t  X_8M8, ,  5g#75;#F8, , *. rr<g.@c bV^8dQhR\R\R\R,R\R\/#)r rrold_pidNr<r )r r floatrM)rs"rrrgs5   S 3: SX dh rc^RIHp\RRV RV 2.^R7P^8wdR#V!WW0R7# \dR#i;i)uBring a launchd-supervised backend back after its process was stopped: ``launchctl kickstart /