+ jHj"XRt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI H t H t Ht^RIHtRtR=t^Zt^t^RIHt]P0!R4t]P0!R4tR>tR?t^ gateway restart`` command; and - **``hermes-serve*`` systemd units**, restarted directly through ``systemctl``. ``hermes serve`` is not a gateway profile and has no per-profile relaunch command, but it is the runtime that hosts ``tui_gateway.server``: the process the original report saw answering every chat turn with an ``ImportError`` for a symbol that existed on disk. The unit family is enumerated from systemd itself rather than from the update inventory, so a manually launched or Desktop-owned ``hermes serve`` — which has no relaunch authority — can never enter this path. Serve-unit identity is always ``/`` (``user/hermes-serve``, ``system/hermes-serve``). The two managers can each own a unit of the same name and they are different processes: an identity that projects the scope away lets one settled unit suppress recovery of the other, and lets one scope's outcome speak for the other's. Scope is therefore never dropped and reconstructed — not in the skip payload, not in ``verified``/``failed``, not in the receipt. ) annotationsN)CallableIterableMapping)AnyHERMES_UPDATE_RESTART_RECOVERY) PROFILE_ID_REz^[a-z0-9][a-z0-9_-]{0,31}$z?^hermes-(serve|dashboard)(-[a-z0-9][a-z0-9_-]{0,63})?\.service$g?c ,V^8dQhRRRRRRRRR R /#) runCallable[..., Any]argv list[str]timeoutintextrarreturnz Any | None)formats"G/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_restart_recovery.py __annotate__rJs2&iSSV[ec rV!V3RRRRRRRRRR R V/VB# \\P3dR #i;i) zIRun ``argv`` capturing text output; ``None`` when it errors or times out.capture_outputTtextencodingzutf-8errorsreplacecheckFrN)OSError subprocessTimeoutExpired)r r rrs&&$,r _run_quietr"Jsn  !% ,0 ;B KT  !( ,1   Z.. /s 66c V^8dQhRRRR/#)r resultrrstrr)rs"rrrUs99C9C9rcL\VRR4;'gRP4#)stdout)getattrstripr$s&r_stdoutr,Us" FHb ) / /R 6 6 88rc V^8dQhRRRR/#)r r$rrboolr)rs"rrrYsHHsHtHrc:VRJ;'d\VR^4^8H#)N returncode)r)r+s&r _succeededr1Ys#   G G'&,"Ba"GGrcV^8dQhRR/#r rr%r)rs"rrr]s   rcp\PPRR4P4pV'd\PP V4p\PP \PPV44R8Xd \PP V4#R#)u Profile this recovery process was launched as: ``/profiles/`` in ``HERMES_HOME`` names it, anything else is the default profile. Mirrors ``hermes_cli.profiles.profile_root_for_env_home`` without importing it — this module stays stdlib-only at import time. HERMES_HOMEr(profilesdefault)osenvirongetr*pathnormpathbasenamedirname)homer;s r_launch_profiler@]st ::>>- , 2 2 4D ww% 77  BGGOOD1 2j @77##D) ) rc V^8dQhRRRR/#)r profilez str | Nonerzdict[str, str]r)rs"rrris nrc\4pVeTMTpVR8XdVR8wd^RIHpV!4pM6\PP 4pVeW8wd^RIHpV!V4\FpVPVR4K RV\&V#)uReturn an environment that cannot self-identify as the gateway owner. One updater environment relaunches EVERY profile, so a child for another profile would inherit this process's authorization gates (``DISCORD_ALLOWED_CHANNELS``, ``GATEWAY_ALLOW_ALL_USERS`` ...) and enforce them as its own — its ``.env`` only overwrites the keys it defines (#113270). Gates are dropped when *profile* is not the launch profile; a same-profile child keeps an operator export. Restarting the host multiplexer from a named profile does not copy this process's environ: the child is ``host_gateway_child_env`` (``served_profile_child_env`` for the default root) so the launching profile's platform credentials never become the primary adapter's. Nr7)host_gateway_child_env)strip_profile_gate_env1) r@tools.environments.localrDr8r9copy#tools.environments.local_env_policyrE_GATEWAY_MARKERSpop _RECOVERY_ENV)rBlaunchtargetrDenvrEmarkers& r_child_environmentrQis F+WF v2C$&jjoo  7#4 R "3 '" #C  Jrc$V^8dQhRRRRRR/#r rBr%r r rr.r)rs"rrrs' Y Y# Y/A Yd Yrc .R\PR\V4/p\PR8Xd,\ \R^4\ \R^4,VR&MRVR&\ PR R R VR R RR. p\\W3R\/VB4#)zGRun one profile restart without inheriting the updater's process state.stdinrOntCREATE_NEW_PROCESS_GROUPDETACHED_PROCESS creationflagsTstart_new_sessionz-mzhermes_cli.mainz-pgatewayrestartz --interruptz--detachr) r DEVNULLrQr8namer)sys executabler1r"_PROFILE_RESTART_TIMEOUT)rBr kwargsr s&$ r_run_profile_restartrcs%z'9'95BTU\B]^F ww$")*6PRS"TW^_ik}@AXB#B&*"# NND"3T7IyZgis tD jW4LWPVW XXrc V^8dQhRRRR/#)r rBr%rztuple[str, ...]r)rs"rrrsOOcOoOrc,VR8XdR#RV R2RV R23#)zGUnit names the existing systemd gateway lifecycle produces per profile.r7zhermes-gateway-.servicezgateway-)zhermes-gateway.servicezgateway.servicezgateway-default.servicer)rBs&r_systemd_unit_candidatesrgs-)WWgYh /8G9H1M NNrc$V^8dQhRRRRRR/#rSr)rs"rrrs"c3E$rcaa\P!R4o\S4;'dO\;QJd)VV3Rl\ V44F 'gK R# R#!VV3Rl\ V444#)uTrue only when systemd itself reports the profile's unit active — the observation separating ``verified`` from ``relaunch_attempted``. Any failure (no ``systemctl``, probe error, unit not ``active``) means we could NOT verify, never that the restart failed. systemctlc3F<"TFp\SR.VSRR7xK R#5i)--userT)r require_rc0N)_unit_is_active).0unitr rjs& r +_systemd_verified_active..s+#5D H-t$OO5s!TF)shutilwhichr.anyrg)rBr rjs&d@r_systemd_verified_activervsh [)I  ?  ss#,W5#ssss#,W5# rcV^8dQhRR/#r3r)rs"rrrs ? ? ?rc\PPR4pV'dV#\PPR4;'gRp\PP V4'g?\PP \PP R4RR4p\PP VRR4#) uThe path ``gateway.host_rendezvous.host_state_dir()`` resolves, computed locally. This module imports no Hermes code at runtime — importing the freshly pulled tree is exactly what aborted the phase that calls us — so the rule is duplicated here rather than shared. HERMES_GATEWAY_LOCK_DIRXDG_STATE_HOMEr(~z.localstatehermesz gateway-locks)r8r9r:r;isabsjoin expanduser)override state_homes r_host_state_dirrs zz~~78H 0177RJ 77== $ $WW\\"''"4"4S"98WM 77<< Ho >>rc V^8dQhRRRR/#)r pidrrr.r)rs"rrrscdrc^RIp\VPV44# \dMi;i\P R8XdR#\P !T^4R# \dR#\dR#i;i)uLiveness of ``pid``: ``psutil`` when importable, else the POSIX signal-0 probe. The signal probe is POSIX-only by construction — on Windows ``os.kill(pid, 0)`` sends a real control event and can kill the target — so an unimportable psutil there means "cannot prove". NrVFT) psutilr. pid_exists Exceptionr8r^killPermissionErrorr)rrs& r _pid_is_liversv  F%%c*++     ww$ Q   s* .. A"" A>0A>9A>=A>cV^8dQhRR/#)r rzset[str]r)rs"rrrsIIxIrc\\PP\ 4R4RR7;_uu_4p\ P !V4pRRR4\X\4'dTPR4R8wd \4#TPR4pTPR4p\T\4'd/T^8:g(\T\4'd\!T4'g \4#TUu0uF'p\T\"4'gKT'gK%TkK) up# +'giL;i \\\3d\4u#i;iuupi) uProfiles the ONE live host gateway multiplexes, from its rendezvous record. Restarting any one of them restarts the same process, so they are a single restart target. Empty (no collapsing, today's per-profile behaviour) when the record is absent, unreadable, dead, or when liveness cannot be probed — a missed collapse costs an extra restart, a wrong one would skip a profile that really has its own process. zhost-gateway.jsonz utf-8-sig)rNroler[rr6)openr8r;rrjsonloadrUnicodeDecodeError ValueErrorset isinstancedictr:rlistrr%)handlerecordrr6r^s r_host_served_profilesrs "'',,02EFQ\ ] ]agYYv&F^ fd # #vzz&'9Y'Fu **U Czz*%H c3  3!8:h3M3MUabeUfUfu % HXTD#)>D4DDX HH^ ] ' 4u  Is@;E D6E E/#E/-E/6 E E E E,+E, supervisorsr c(V^8dQhRRRRRRRR/#) r r6z Iterable[str]rzMapping[str, str] | Noner r rzdict[str, Any]r)rs"rrrs,###-E#Se##rc T;'g/pR.R.R./p\VUu0uF'p\V\4'gKV'gK%VkK) up4p\4pVUu.uF qwV9gK VNK pp\ V4^8d V^,MRp V 'd VR,M.p VFpWz9dK \ WrR7'gRp M-VP V4R8Xd\WrR7'dRp MRp W;,PV4Wy8XgKlW;,PV 4K V 'dW/M/VR&V#uupiuupi) aRestart the supplied profiles (only ones whose inventory identified a service supervisor). Profiles served by the SAME host gateway process are one restart target: a host multiplexes every profile, so N payload profiles meant N sequential ``gateway restart`` calls, each killing the successor the previous pass had just verified. The group is restarted exactly once through one representative and the rest are reported under ``covered`` with that restart's outcome. A profile only lands in ``verified`` when its supervisor is systemd and ``systemctl --user is- active`` independently confirms the unit after the relaunch command succeeded. verifiedrelaunch_attemptedfailedN:NNr systemdcovered) sortedrr%rlenrcr:rvappendextend) r6rr r$p requestedservedrBgrouprepresentativerbuckets &$$ rrestart_profilesrs$##K(".BBRTUF8H8az!S/Aa8HII " $F$- CIF1BWWIE C!$UaU1XTN)eBirG   #G55F __W % 27OPW7a7aF)Fg&  $ N ! !' *6D1F9 M'I CsD>D>D> E-EcV^8dQhRR/#)r rzlist[tuple[str, list[str]]]r)rs"rrrs F F6 Frc\P!R4pV'd\PR8wd.#RVR.3RV.3.#)u``(label, systemctl argv)`` for the user and system scopes (the pair the in-process phase walks), or nothing. ``systemctl`` comes from ``shutil.which`` so this module never imports a Hermes platform helper — importing the freshly pulled tree is exactly what aborted the phase that called us. Scopes carry their label because the same unit name in both managers is two different processes. rjlinuxuserrlsystem)rsrtr_platform)rjs r_systemctl_scopesrsA [)I  / i* +h -D EErc$V^8dQhRRRRRR/#)r scoperr r rr)rs"rrrs"y2Drc .p\Fp\VVRVRRR.,\R7pVfK'\VRR4;'gRP 4FipVP 4pV'gK\ PV^,4'gKAV^,V9gKQVPV^,4Kk K V#)zJServe/dashboard units systemd knows about in one scope, validated by name.z list-unitsz--plainz --no-legendz --no-pagerrr'r() _SERVE_UNIT_PATTERNSr"_VERIFY_TIMEOUTr) splitlinessplit_UNIT_RE fullmatchr)rr unitspatternr$linepartss&$ r_listed_serve_unitsrsE'  \7I}lS S#  > VXr288bDDFDJJLEu++E!H55%(%:O U1X&G( Lrc(V^8dQhRRRRRRRR/#) r rrrpr%r r rrr)rs"rrr(s))38Jsrc\W RVRR.,\R7p\V4'd\\ V4;'g^4#^# \ d^#i;i)zOThe unit's ``MainPID`` via ``systemctl show``; ``0`` when absent or unreadable.showz--property=MainPIDz--valuer)r"rr1rr,r)rrpr r$s&&$ r_unit_main_pidr(s[ fd4H)%TT^m nF,6v,>,>s76?''a(EAE s'AA A AArmFc ,V^8dQhRRRRRRRRR R/#) r rrrpr%r r rmr.rr)rs"rrr1s2''9'C'9K'Z^'ko'rc\W RV.,\R7pVeV'd\V4'gR#\V4R8H#)z is-activerFactive)r"rr1r,)rrpr rmr$s&&$$ rrnrn1s; k4%88/ RF ~+j.@.@ 6?h &&rc 0V^8dQhRRRRRRRRR R R R /#) r rrrpr% previous_pidrr r sleepCallable[[float], Any]rr.r)rs"rrr8s< /2Did the unit come back on a NEW main process? ``restart`` returning 0 is not evidence: a live process can keep serving the pre-update generation while every status command reports success. A changed ``MainPID`` on an ``active`` unit is the observation that the old interpreter and its stale ``sys.modules`` are gone. rTF)range_UNIT_SETTLE_ATTEMPTS_UNIT_SETTLE_DELAYrnr)rrprr rattemptcurrents&&&$$ r_serve_unit_replacedr8sM./  $ % 5C 0 0$Uc:G{w6 0 rc V^8dQhRRRR/#)r entryrrztuple[str, str]r)rs"rrrKs 6 6S 6_ 6rc4\V\4'dJ\VPR4;'gR4p\VPR4;'gR4pM(\V4P R4wrpV'gRTr!WP R43#)z[``(scope_label, base_unit)`` of a skip entry in either the mapping or ``scope/unit`` shape.rr(rp/rf)rrr%r: partition removesuffix)r scope_labelrpseps& r_split_skip_entryrKs|%!!%))G,223 599V$**+!$U!5!5c!: $ "K ))*5 55rc V^8dQhRRRR/#)r skip_units Iterable[Any]rz%tuple[set[tuple[str, str]], set[str]]r)rs"rrrWs  - 4Y rc\4p\4pT;'gRFHp\V4wrEV'gKV\9dVPWE34MVPV4KJ W3#)zSplit already-settled units into scope-qualified and legacy entries (a bare ``"hermes-serve"`` carries no scope and cannot say WHICH of two same-named processes was settled).r)rr _SCOPE_LABELSadd)r qualifiedlegacyrrbases& r_normalized_skipsrWsj'*eIuF!!r!-e4 43>-3OY]]K. /U[U_U_`dUe"  rrrc(V^8dQhRRRRRRRR/#) r rrr r rrrzdict[str, list[str]]r)rs"rrrcs,"" ",>"Xn""rc L\V4wr4/p\4p\4Fwrx\WR7Fp V P R4p Wz3p W9g W9gW9dK+VP V 4\ WVR7'gKQ\WVR7p V ^8;'d;\\WRRV .,\R74;'d\WWVR7W[&K K R\RVP444R \R VP444/#) a Restart every active ``hermes-serve*``/``hermes-dashboard*`` systemd unit from this process. Units are enumerated from systemd, never from the update inventory, so a manually launched or Desktop-owned ``hermes serve`` (no unit) structurally cannot be touched here. rrfz--no-ask-passwordr\r)r rrc3L"TFwwrq3'gKV RV 2xK R#5irNrrorroks& rrq&restart_serve_units..s*]FV1B%Z\,eWAdV,FV$$rc3L"TFwwrq3'dKV RV 2xK R#5irrrs& rrqrs*_DT/@}b\^*E7!D6*DTr)rrrrrrrnrr1r"_UNIT_RESTART_TIMEOUTrritems) rr rskipped_qualifiedskipped_legacyoutcomesseenrrrprrNrs $$$ rrestart_serve_unitsrcs!):*(E%-/H!$D/1 '7D$$Z0D!(F~!<@V HHV "5C88)%3?L ,a/ X XJ3).s6 i`hU\z'3' ' P P~/G/G/P+P P`hs A$ATFz/recovery profiles contain an invalid profile idrc3"TF~wr\V\4'*;'g[\V\4'*;'g>\P!V4'*;'g\PV4'*xK R#5ir)rr%rr_SUPERVISOR_RE)rorB supervisors& rrqrs|8 (?# 7C( ( 8 8j#.. 8 8!++G44 8 8"++J77 8(?s"BB"B%#Bz#recovery supervisors map is invalid serve_unitsz%recovery serve_units block is invalidrecoverskipc3X"TF p\V\\34'*xK" R#5ir)rr%r)rors& rrqrs$0jaiX]ZT{5S1S1Sais(*z)recovery serve_units skip list is invalidrprrfr)rrrrr:rrrurr.r%rrrrr) streampayloadr6raw_supervisorsr raw_serve recover_serverraw_skiprrrs & r_parse_payloadrsTiiG gt $ ${{:&H h % %HII s i`h isss i`h iiiJKKkk-0O"$K"/400CC8 (7'<'<'> 8 CCC8 (7'<'<'> 8 5 5 BC C?+  M*IMJ)T**DE EY]]956 ==(..B(D))SS0jai0jSSS0jai0j-j-jHI IE %&&!%))F"3S99$%PQQ!%))G"4c::#U6]3E 1% 8 K = @I[I[_c^ddl\mInIn    Qtf5$ O!" - ;;rc V^8dQhRRRR/#)r r zlist[str] | Nonerrr)rs"rrrsKKK3Krc\P!\R7pVPRR\PR7VP V4pVP 'gVPR4\\P 4wr4rV\W4R7pV'd \VR7MR.R./VR &\\P !TR R74TR,'gTR ,R,'d^#^# \\P3dBp\\P !R \#T4R.R .R.R R.R.//44R p?^#R p?ii;i)) descriptionz--stdin store_true)actionhelpz7this command is an internal update-recovery entry point)r)rrrrerrorrNT) sort_keys)argparseArgumentParser__doc__ add_argumentSUPPRESS parse_argsrUrrr_rrrrJSONDecodeErrorprintdumpsr%) r parserargsr6rr rr$excs & rmainr$s0  $ $ 9F  ,X=N=NO   T "D ::: NO ;I#));T8}!(D:G : 6jZ\^fhjMk } $**Vt ,-x  F=$9($C$C1JJ ,, - djj SXz2/CRSU JHb9    s3ADE6EE__main__)_HERMES_GATEWAYHERMES_GATEWAYHERMES_GATEWAY_MODE)z hermes-serve*zhermes-dashboard*)rrrr):r __future__rrrr8rersr r_timecollections.abcrrrtypingrrLrJrarhermes_constantsrrcompilerrrrrrrr"r,r1r@rQrcrgrvrrrr rrrrrnrrrrrrr$__name__ SystemExitrrrr2sX+Z#  770 O<9: ::X Y=" 9H 8 YO ?.I,#HL#hrhvhv#L F('af'& 6 "#%"AK"quq{q{"J0