+ lHj\a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI H t H t ^RI HtHt^RIHtHtHt^RIHt^RIHtHt^RIHt]P6!]4tR tR tRSt ]!!0RTm4t"R R lt#R Rlt$!RR]%4t&Rt'Rt(Rt)RRlt*RRlt+RRlt,RRlt-].!4t/R]0R&].!4t1R]0R&!RR ]24t3R!R"lt4R#R$lt5R%R&lt6] R'R(l4t7R)R*lt8].!4t9R]0R+&R,R-lt:R.R/lt;R0R1ltR5R/R:R;llt?R4RR5RR6R7/R<R=llt@R>R?ltAR@tBRARBRCRBRDRB/RERFlltCRGRHltDRIRJltERUtFRKtGRLRMltHRNR/RORPlltIRNR/RQRRlltJR#)Va1Canonical Bot Chat transport and durable legacy delivery receipts. Only gateway/session_bot.py admits execution. Old claimed/terminal records remain inspectable; the legacy UI claim consumer is retired. No authority means refusal. Receipt storage derives from FalconOrtiz's live-owner mailbox (#101564). ) annotationsN) ExitStackcontextmanager) make_user_dirunusable_dir_remedy)atomic_json_writeatomic_write_textfsync_directory)Path)AnyCallable) _FileLockbot_live_deliveryz .sequencec V^8dQhRRRR/#)homer return str | None)formats".request\s*!++,EtUV+WW ??g %););)C=> >%%(($II*8<3RtTTTXZ~~!44 !>??$R(((F" #ZZ9&99)((UTTXJU)9)U)(((UTTTTTsE'D AE',D-%E'DE'1E D E  D $D %D ( E 5D 6E : E'DE'E'E'E D E E'D4 !D$" D4 -D4 /E 7 E'EE' E$ E E$ E$  E') _run_async)rgr7r-hermes_cli.gateway_clientrUrVrWrXwebsockets.asyncio.clientrYr r8get_running_loop RuntimeErrorrun model_toolsrl ExceptionrCr=)rrhrOrjrlexcrUrVrWrgrYr-rXrisfff @@@@@@@@rrMrMSsDpp1 :   DK::  *  $ $ & +')$$  *;;wy) ) * s3x(c 1 s6A8%B8!BBBB C *CC c$V^8dQhRRRRRR/#)rrr)ownerdict[str, Any]rzdict[str, str]r)rs"rrr{s!N~rc\Uu/uFq"VPV4bK pp\;QJd*RVP44F 'dK RM RM!RVP444'g \ R4hVR,\ \ V4P448wd \ R4hV#uupi)c3t"TF.wr\V\4;'dT;'gVR9xK0 R#5i)r3N)r3r6) isinstancer=).0keyvalues& r _owner..~s91!/:3%%]]5+\+\C;\4\]!/s 8 88FTzEowner requires profile_home, session_id, lease_id and live_session_idr(z)owner belongs to a different profile home) _OWNER_KEYSgetallitemsr;r=r r8)rrvr|pinneds&& r_ownerr{s-8 9[c599S>![F 9 31!'13331!'1 1 1`aa nT$Z%7%7%9!::DEE M:sCc V^8dQhRRRR/#)rr}r=rr)rs"rrrsrcz\V\4'd\P!RV4f \ R4hV#)z[0-9a-f]{32,64}z5delivery id must be 32 to 64 lowercase hex characters)rzr=re fullmatchr;)r}s&r _delivery_idrs1 eS ! !R\\2De%L%TPQQ Lrc V^8dQhRRRR/#)rrr)rr r)rs"rrrs@@ @t@rcX\V4P4R, \, #)runtime)r r8DELIVERY_DIR_NAME)rs&r_rootrs :   ) +.? ??rc V^8dQhRRRR/#)rr(r)rboolr)rs"rrrs((j(T(rc4\V4P4#)u!Whether any delivery was ever admitted for this profile (the mailbox directory is created on first admission only). A cheap pre-check for pollers: no mailbox means nothing to claim, so the owner lookup — a state.db open plus the exclusive active-session registry lock — can be skipped.)ris_dir)r(s&r has_mailboxrs   % % ''rz set[Path]_warned_unhardened_warned_unusablec]tRt^tRtRtR#)MailboxUnusableaThis token cannot list, create or lock inside the mailbox dir (#139485, #138872). On Windows an elevated install/update creates ``runtime/bot_live_delivery`` owned by Administrators with no entry for the user; the same user's non-elevated gateway then cannot even open ``.lock``. Bot Chat deliveries pause; nothing else depends on the dir. A ``PermissionError`` subclass so every existing caller keeps its handling. rNrDrrrrrsrrc V^8dQhRRRR/#)rpathr rr=r)rs"rrrsTcrcT\PR8Xdd^RIp^RIpTP \ T4TP4pTPRTP44wrVpT'dT RT 2#T#^RI pVP4Pp TPT 4P # \dpRT R2uRp?#Rp?ii;i TPdpRT R2uRp?#Rp?ii;i \dpRT R2uRp?#Rp?ii;i \"d RT 2u#i;i)zbBest-effort owner name for the log line; never raises (an ACL that hides it is the reported case).ntNz unknown ()\zuid )osname pywintypes win32security ImportErrorGetFileSecurityr=OWNER_SECURITY_INFORMATIONLookupAccountSidGetSecurityDescriptorOwnererrorpwdstatst_uidOSErrorgetpwuidpw_nameKeyError) rrrrt descriptorrdomain_ruids & r _dir_ownerrs( ww$ &   &&66s4y-BjBjkJ+<C6D4 C?C C CC3#C.(C3.C36 DD D DD'&D'c$V^8dQhRRRRRR/#)rrootr rtPermissionErrorrrr)rs"rrrs&``D``?`rc"\V4pV\9d\PM\Pp\P V4\ P VRV\V4W4\VPRV 2\V44#)zbot_live_delivery: mailbox directory %s (owner %s) is not usable by this process (%s); Bot Chat deliveries are paused until it is repaired, other clients are unaffected. To repair, %sz%bot mailbox directory is not usable: ) rrloggingDEBUGWARNINGaddlogrrerrnor=)rrtremedylevels&& r _unusablersu  &F!%55GMM7??EGGEo *T"C1 399(McU&SUXY]U^ __rc V^8dQhRRRR/#)rrr rr)rs"rrrs4Drc<VP4'*p\VPRRR7\VRRR7VPR4V'd5\!VP4\!VPP4VR, p\ P"!V\ P$\ P&,R 4p\ P(!V4V# \dp\ P R8wd4TP4P\ P!48wdhT\9d\PM\Pp\PT4\PTRY4Rp?ELHRp?ii;i) zLCreate/harden the mailbox dir and its ``.lock`` file; returns the lock path.T)parentsexist_oki)moderrz=bot_live_delivery: could not harden mailbox directory %s (%s)Nz.lock)rrparentchmodrrrrrgetuidrrrrrrr openO_CREATO_WRONLYr#)rcreatedrtrlockfds& r_preparers++-G$++td;$UT2 c 5  $ **+ '>D rzzBKK/ 7BHHRL K'  c 77d?tyy{11RYY[@ "&);!; t$ VX\bb csC&& F1BFFcV^8dQhRR/#)rrr)r)rs"rrrs  * rc #:"\V4p\4;_uu_4pVP\\ V444\PT4TxRRR4R# \ dp\ Y4ThRp?ii;i +'giR#;i5i)zHold the mailbox dir lock. A dir this token cannot use raises ``MailboxUnusable`` (logged once per dir with its owner and the remedy); errors inside the body pass through.N) rr enter_contextr rrrrdiscard)rrstackrts& r_lockedrsy ;D  0    (4. 9 :   &  0D&C / 0 s?BB#A(B B( B3 A??BB B  Bc V^8dQhRRRR/#rrr rr*r)rs"rrrs.rc\P!VPRR74p\ T\ 4'g0\ RTP R\T4P R24hT# \dR#i;i)uaExact-id read: absent → None; unreadable or not a JSON object → raises (callers fail closed). utf-8-sigencodingNzticket z is not a JSON object (r) jsonloads read_textFileNotFoundErrorrzr<r;rtyperErrecords& r_readrssDNNKN@A fd # #7499+-DT&\EZEZD[[\]^^ M s&A// A>=A>_warned_unreadablec$V^8dQhRRRRRR/#)rrr rrwrrr)rs"rrrs!dNzrcaVPR4oVPR4VPRVPR44r2VPR4VP8wg!VPR4VP8wdR#VPR4p\V\4'dVRR 0\,9dR V: 2#\ ;QJdR W#34F 'dK R M R M!R W#344'gR#\S\ 4'dI\ ;QJd#V3Rl\4F 'dK R M R M!V3Rl\44'gR#R#)upWhy a parsed ticket is unusable by the scans, or None when it is well-formed. A ticket that parses as JSON but lost a field (truncated rewrite, foreign writer, hand edit) used to raise KeyError/TypeError out of the sequence scan and the claim sweep — wedging admission and delivery for the whole profile exactly like corrupt JSON did before ``_scan_read`` existed. rv created_atsequence delivery_idrzid does not match filenamestatusqueuedclaimedzunknown status c3|"TF2p\V\4;'d\V\4'*xK4 R#5iN)rzintr)r{vs& rr~&_ticket_shape_error..s.^G]!z!S!==*Q*=&==G]s<<FTz$created_at/sequence are not integersc3<"TF5p\SPV4\4;'d SV,xK7 R#5ir)rzrr=)r{krvs& rr~rs5-nbm]^j1s.K.X.XPUVWPX.Xbms *AAzowner pin is incompleteN)rstemrzr= _TERMINALrr<r)rrrrrrvs&& @r_ticket_shape_errorrs JJw E!::l3VZZ FJJWcLd5e zz- DII-D1ATYY1N+ ZZ !F fc " "fh 5JY5V&W  ++ 3^ G]^333^ G]^ ^ ^5 eT " "##-nbm-n###-nbm-n*n*n( rc V^8dQhRRRR/#rr)rs"rrrsT3rc\V4pVfRM \W4pVeeV\ 9d\ PM\ Pp\ PV4\PVRVPV4R#\ PV4V# \\3dpR\ T4r!Rp?LRp?ii;i)aBulk-scan variant: one unreadable or malformed ticket must not wedge the whole dir. Directory scans (sequence high-water mark, queued-claim sweep) may only treat a file as absent when it is provably absent; an unreadable ticket degrades to "that one delivery is uninspectable" with a warning. Exact-id reads (admission idempotency, completion, result lookup) keep using _read so a permission error still fails closed instead of licensing an overwrite of a possibly-live receipt. Nz5bot_live_delivery: skipping unreadable ticket %s (%s)) rrrr;r=rrrrrrrr)rrproblemrtrs& r _scan_readrs)t .$.A$.O!%);!; t$ NPTPYPY[bct$ M Z )C)sBC. B??Cc V^8dQhRRRR/#)rrr rrr)rs"rrr4s#rc,aV\, p\VPRR74p\ V3RlVP R44^R7p\ W#4^,p\V\V4RRR7V# \\3d^pLgi;i) abAllocate the next admission sequence under the dir lock. The high-water mark lives in a counter file beside the tickets, so a ticket the scan cannot read does not drop its sequence and hand a later admission a duplicate or lower one. Readable tickets still bootstrap dirs written before the counter existed. Wall time can roll back; sequences never do. rrc3x<"TF/p\V4;ofKSPRSR,4xK1 R#5i)Nrr)rr)r{ candidaters& rr~!_next_sequence..As<E$7y!+I!66v@6::j&*>??$7s:!:z*.json)defaultrT)r fsync_dir) _SEQUENCE_FILErrrr;maxglobrr=)rcounter persistedscannedrrs& @r_next_sequencer 4s^#G));)?@ E$(IIh$7ENOQG9&*Hgs8}5DI O Z  sA==BBc$V^8dQhRRRRRR/#)rrr rrwrNoner)rs"rrrIs&]]]~]$]rc &\WRRRRR7R#)NTr)indent sort_keysrr)rrs&&r_writerIsd444V[\rrauthornotification_categoryresultc4V^8dQhRRRRRRRRR R R RR R/#) rr(r)rvrwmessager=rrrr*rrr)rs"rrrMsH > > >%3 >>A > >/D > > >rc *\\WW#VVR7#)zReturn durable admission immediately, without waiting for the owner. Retry with the same id AND pinned owner/message to inspect the existing state. Reusing an id with a different payload is an error, never an overwrite. )rrr)_doorrP)r(rvrrrrs&&&$$$rdeliver_to_live_ownerrMs #\'ci'< >>rc 0V^8dQhRRRRRRRRRR R R/#) rr(r)rvrwrr=rrr*rr)rs"rrr[sBiizi.iSVihki!6iBPirc (\\WW#VR7#)zFinalize a refusal marked ``admitted: false`` under the same identity: the owner's terminal not-sent receipt (``refused``), or the receipt of an attempt that admitted the id meanwhile.)rr)rrR)r(rvrrrs&&&$$rsettle_held_deliveryr[s !<ag hhrcV^8dQhRR/#)rcallzCallable[[Path, dict], dict]r)rs"rrrbsRR,Rrc \W4p\V\4'g \R4hVR 9d \R4h\ V4P 4pVR8XdRR/M/p /T!T\ R R\VeTM\P!4P4RVPPR8Xd VPMRRV/VR ,'d R VR ,/M/BV'dR \ V4/M/BV B4CV C#) zmessage must be a string diagnosticzinvalid notification categoryrrprofileprofilesrrr3r)rrr) rrzr=r;r r8r<ruuiduuid4hexrr) rr(rvrrrrrrcategorys &&&&$$$ rrrbs% L (F gs # #344$<<899   % % 'D:OS_:_'6egH Rd4D[=TkZ^ZdZdZfZjZj!kD![[--; DDDJ .1rca \V4pV\9d \R4h\W#WER7p\ V4;_uu_4pW R2, p \ V 4o S f\ RV 24hS R,\9dt\;QJd-V 3RlVP44F 'gK RM" R M!V 3RlVP444'd \R 4hS uuRRR4#S R,R 8wd \R 4hS PV\P!4R 7\V S 4S uuRRR4# +'giR#;i)zNPersist an immutable terminal receipt; duplicate identical completion is safe.z invalid terminal delivery status)rr,rr-.jsonNzdelivery not found: rc3P<"TFwrSPV4V8gxK R#5ir)r)r{rrrs& rr~$complete_delivery..s B/$!6::a=A%/s#&TFz1delivery already has a different terminal receiptrz*delivery must be claimed before completion) completed_at) rrr;r<rrranyrupdatetimetime_nsr) r(rrr,rr-r|outcomerrrs &&$$$$ @rcomplete_deliveryr9s  { #C Y;<<&UJG   $Um#t >#&:3%$@A A ( y (sB'--/BsssB'--/BBB !TUU   ( y (IJ J gDLLN ;tV    s&AE "E.+E E1A E E c ,V^8dQhRRRRRRRRRR/#) rr(r)rr=rr-rr*r)rs"rrrs4+.:=GJrc |\V4p\V4;_uu_4pWT R2, p\V4pVe&VR,R8wgVPR4'd VuuRRR4#VP RRW#\ P !4R7\Wg4VuuRRR4# +'giR#;i) zCancel an ownerless queued receipt without racing a consumer's claim. A claim or terminal result that won the mailbox lock is returned unchanged. r0Nrrr( cancelledr2)rr,rr-r3)rrrrr5r6r7r)r(rrr-r|rrrs&&$$ rcancel_queued_deliveryr=s { #C   $Um#t >VH-9VZZ=W=W    [%#'<<>  3t    s?B*B*+4B** B; c$V^8dQhRRRRRR/#rr(r)rr=rr*r)rs"rrrs"  z  H] rcV\V4p\V4P4'gR#\V4;_uu_4p\ W2 R2, 4pRRR4Xe6VP R4'dVP R4R8Xd /VCRR/C#V# +'giLK;i)zLRead admission/claim/terminal state without waiting or deleting its receipt.Nr0r(rr4r)rrrrrr)r(rr|rrs&& rread_delivery_resultrAs { #C   % % ' '   $tUm+,  fjj88VZZ=QU`=`.&-(H-- M  s B B( g?c$V^8dQhRRRRRR/#r?r)rs"rrrs" AVrc\\V4\V4 R2, 4pVeVPR4R8Xd /VCRR/C#V#)a A waiter's read: the receipt file the owner republishes when the admission settles (and on restart recovery). Never an authority RPC: a wait outlives owner restarts, and replaying the envelope (``read_delivery_result``) is for producers re-confirming their admission.r0rr4r)rrrr)r(rrs&& r _poll_receiptrDsR5&L,E+Fe)LL MF fjj2kA-&-(H-- Mr should_stopc ,V^8dQhRRRRRRRRR R /# rr(r)rr=r/z float | NonerEzCallable[[], bool] | Nonerr*r)rs"rrrs=ZZZ+.Z9EZ-ZZrcrVfRM\P!4V,p\W4pVeVR,\9dV#VeV!4'dV#VfRMV\P!4, pVe V^8:dV#\P!Vf\ M\ \ V44K)ukPoll a receipt until the owner settles it, ``timeout`` lapses, or ``should_stop`` says so. Every transport that hands a turn to a live Bot Chat owner (local ``message_agent``, the Desktop relay, ``hermes peer dm`` and ``hermes peer run``) waits on the same receipt; keeping the loop here is what stops the lanes drifting (one lane returned a receipt sentence instead of the reply, two never waited at all). Returns the last record read — still pending when the budget lapsed, None when the receipt was never readable. Polls the local receipt file only, so an owner restart mid-wait is just a longer pending stretch. Nr)r6 monotonicrD_PENDINGsleep _POLL_SECONDSmin)r(rr/rEdeadliner remainings&&&$ rawait_deliveryrPstDNN,VH-X=M  "{}}M$,D(T^^=M2M  Y!^M I$5=3}i;XYrc ,V^8dQhRRRRRRRRR R /#rGr)rs"rrrs=ccc+.c9Ec-ccrc"^RIpVfRM\P!4V,pVP\W4GRjxL pVeVR,\ 9dV#VeV!4'dV#VfRMV\P!4, pVe V^8:dV#TP Vf\M\\V44GRjxL KLL5i)zX``await_delivery`` for an event loop: never blocks a worker thread for the whole budget.Nr) rgr6rIr_rDrJrKrLrM)r(rr/rErgrNrrOs&&&$ rawait_delivery_asyncrSs tDNN,VH-X=M  "{}}M$,D(T^^=M2M  Y!^MmmY->MC W`DabbbS cs+ACC,C1ACCCC)r(r3r5r6>failedsettled ambiguousr<)rr)K__conditional_annotations__rI __future__rrrrrr6r" contextlibrrhermes_dir_aclrrutilsrrr pathlibr typingr r hermes_cli.active_sessionsr getLoggerrErrrr frozensetrr&rAr;rCrPrRrMrrrrsetr__annotations__rrrrrrrrrrrr rrrrr)r+r9r=rArJrLrDrPrS)rWs@rrcs #  0=GG 0 !'K E F  T&c:c= < %P @(!$I%"e)#o4`:  !$I%,0*] >!% >GK >"* >i9=iR[_RhlR (R"A "$462(  ! Z04Z4c04ccr