+ lHjXaR&t%0tRt^RIt^RIt^RIt^RIt^RIHtHt^RI H t ^RI H t ]P!R4t/t]^k]!4t]^k/t]^k/t]^k/t]^kRRltRR ltR't]^kR R ltR(R R lltRRltRRRRRR/RRlltRRltR(RRlltRRltRRlt R)RRllt!R R!lt"RR/R"R#llt#R$R%lt$R#)*zMCP process lifecycle: stdio child PID tracking and orphan cleanup, graceful server shutdown and draining of the background MCP loop.N)DictOptional)_core) mcp_tool_loopztools.mcp_toolcFV^8dQhR\R\\,/#)pidreturn)intr)formats"=/home/ubuntu/.hermes/hermes-agent/tools/mcp_tool_lifecycle.py __annotate__r &sCHSMcD^RIHpV!V4# \dR#i;i)uStart-time fingerprint of the pgroup leader (PGID == leader PID on setsid spawn); ``None`` only when the reading is genuinely unavailable (already-reaped PID, no /proc AND no psutil) — the psutil fallback covers macOS/Windows.)get_process_start_timeN)gateway.statusr Exception)rrs& r _leader_start_timer&s)6%c** s  c$V^8dQhR\/#rr set)r s"r r r 1scrc\P!4pRV R2p\4p\P!V4F\p\ V RV R2RR7;_uu_4pVP RVP 4P444RRR4K^ V# +'giKs;i \\\3dKi;i \\\3dMi;i^RI pTPT4P4Uu0uFqfPkK up#uupi \d\4u#i;i) zGCurrent direct-child PIDs: /proc on Linux, else psutil, else empty set.z/proc/z/task/z /childrenz utf-8-sig)encodingc3f"TF'qP4'gK\V4xK) R#5iN)stripr ).0ps& r '_snapshot_child_pids..Bs O1AAWWYQ1As11N)osgetpidrlistdiropenupdatereadsplitFileNotFoundErrorOSError ValueErrorpsutilProcesschildrenrr)my_pidtask_dirfoundtidfr,cs r _snapshot_child_pidsr51s YY[F F85)U::h'C XJauI6MMQRLL O1A OONM(  NMM%w ;   w 3   %~~f5>>@A@!@AAA u s})CB35BB3C B0 *B3.C0B33C  C C  CC)(C)-%D.D)&D.)D..EEc0V^8dQhR\R\/#)rpidsr r)r s"r r r XsssrcV'gV#^RIp\4pTF~pTPT4P 4p\;QJd#RTR,4F 'gK RM RM!RTR,44'dKmTPT4K T# \dTu#i;i TP TP \3dKi;i)zDrop non-MCP children from a PID snapshot delta. Tracking a stray child in _stdio_pgids is catastrophic if it lacks start_new_session: its pgid can be the TUI parent's, so the shutdown killpg() would kill the TUI itself.Nc3D"TFp\F q"V9xK K R#5ir)_NON_MCP_CHILD_CMDLINE_MARKERS)rargmarkers& r r '_filter_mcp_children..hsbHSCaS=Ca=Hs :NNTF) r, ImportErrorrr-cmdline NoSuchProcess AccessDeniedr*anyadd)r7r,keptrargvs& r _filter_mcp_childrenrGXs   5D >>#&..0DsbDHbsssbDHbbb HHSM  K   $$f&9&97C   s"B B3 B0/B03"CCcV^8dQhRR/#rr N)r s"r r r ms : :4 :rcVf?\PP4\PP4R#VFCp\PP VR4\PP VR4KE R#)zDrop connect-retry cooldowns: a restart must re-attempt every server immediately, not honour a stale per-server backoff. Caller holds ``_core._lock``.N)r_server_connect_retry_afterclear_server_connect_failurespop)keyskeys& r _clear_connect_cooldownsrRmsc | ))//1 &&,,.C  - - 1 1#t <  * * . .sD 9rcV^8dQhRR/#rIrJ)r s"r r r ys77t7rc"\P;_uu_4\\P4p\PP 4RRR4X'gR#^RIHp^RIHpH pH p^RI H pH p^RIHp^RIHpVP%4FwrR;rV!V 4p V!V!V!V 44V R7p V!4;'g/P%4U Uu/uFwrW9gK WbK pp pV'dVP'V4T e T!T 4T e T!T 4KK R# +'giL;iuupp i \(d\*P-RT R R 7L^i;i T e T!T 4T e T!T 4ii;i) aRe-run MCP registration for profiles whose ADOPTED shared connection an owner's ``/reload-mcp`` just tore down. Their tools vanished with the owner's teardown and nothing re-runs their discovery until THEY reload, so they sat tool-less behind a healthy-looking status (#106005). Runs after the owner's rediscovery, under each adopter's own home + secret scope (its ``${VAR}`` refs must resolve to ITS credentials): the adopter re-adopts the owner's new identical connection or connects its own.N)Path)build_profile_secret_scopereset_secret_scopeset_secret_scope)reset_hermes_home_overrideset_hermes_home_override)mcp_tool_discovery)_load_mcp_config) profile_homez0MCP: re-registration for profile scope %s failedT)exc_info)r_lockdict_orphaned_adoptersrMpathlibrUagent.secret_scoperVrWrXhermes_constantsrYrZtoolsr[tools.mcp_tool_configr\itemsregister_mcp_serversrloggerdebug)pendingrUrVrWrXrYrZ _discoveryr\adopternames home_token secret_tokennr4serverss r _reregister_orphaned_adoptersrsysN u//0   &&(  ccU66!--/$((  71':J+,FtG},UdklL)9);)A)Ar(H(H(JY(Jajtqt(JGY//8'"<0%*:6&* Z e LLKW_cL d e'"<0%*:6&sH8D1 AE  E/E5E 1 E E  #E0-E3/E00E33Fscoperntimeoutg.@chV^8dQhR\\,R\\,R\/#)rrtrnru)rstrrfloat)r s"r r r s/V,V,8C=V, V,"'V,rc a aaaa^RIHpVRJ;'dVRJo\P;_uu_4\PUu.uF3pS'g'\P P V4V8XgK1VNK5 upoVe!SUu.uFqC!V4V9gKVNK upoSUu.uFp\PV,NK upoVe \S4oMS'd\\P4\\P 4,\\P4,\\P4,\\P4,oM:\P P4UUu0uFwrEWP8XgK VkK uppoS'gvSFop\PP VR 4FHpW`8wgK \PPV\44PV!V44KJ Kq RRR4V3Rlo S'dV VVVV3Rlp\P;_uu_4\PpRRR4XeIVP!4'd3^RIHp V !V!4V\&RR7p V eV P)VR7\P;_uu_4S'gS !4\/S'dRMS4RRR4\0P2!S'*R 7Vf^R IHp V !VR 7R#R#uupiuupiuupiuuppi +'giEL3;i +'giL;i \*d!p \&P-R T 4Rp ? LRp ? ii;i +'giL;i)uClose MCP server connections (in parallel) and stop the background loop. Each server Task is signalled to exit its own ``async with`` so the anyio cancel-scope cleanup runs in the Task that opened it. ``scope`` restricts teardown to one multiplexed profile's servers (its ``/reload-mcp`` must not kill other profiles') and leaves the shared loop running if anything else is still connected. ``names`` restricts it further to those server names (dropped-from-config pruning); other servers' bookkeeping is untouched. Only the bare call (no ``scope``, no ``names``) is the process-wide wildcard: the launch profile's registry scope IS ``None``, so ``scope=None, names={...}`` prunes that unscoped owner's servers and must leave a served profile's same-named ``(B, name)`` connection alone. ``timeout`` bounds the wait for the close to land on the MCP loop — a caller running one pass per served profile under a total budget divides it, or N profiles × 15s starve the wildcard pass that actually stops the loop.) _key_nameNc<\PPS4SFcp\PP VR4\P P VR4\P P VR4Ke R#r)r_server_connectingdifference_update_server_connect_errorsrO_server_scope_keys_server_tool_scopes)rQselected_statuss r clear_selected_status3shutdown_mcp_servers..clear_selected_statussc   22?C"C  ( ( , ,S$ 7  $ $ ( (d 3  % % ) )#t 4#rc.<"\P!RS4RR/GRjxL p\SV4F>wr\V\4'gK\ P RVPV4K@ \P;_uu_4SFCp\PPVR4\PPVR4KE S!4\S'dRMS4RRR4R#L +'giR#;i5i)c3@"TFqP4xK R#5ir)shutdown)rservers& r r :shutdown_mcp_servers.._shutdown..s,^M]6__->->M]sreturn_exceptionsTNz!Error closing MCP server '%s': %s)asynciogatherzip isinstancerrirjnamerr__serversrOrrR) resultsrresultrQrselectedrservers_snapshotwildcards r _shutdown'shutdown_mcp_servers.._shutdowns#NN,^M],^wrvwwG"%&6"@fi00LL!DfkkSYZ#A#CNN&&sD1,,00d;$&'(O  xs.!DC?(D=DA&D5 D D D)safe_schedule_threadsafez MCP shutdown: failed to schedule)ri log_messageruzError during MCP shutdown: %s only_if_idle)_close_mcp_stderr_logs)rtrJ)tools.mcp_tool_scoperzrr_rrgetrrr|r~rgra setdefaultrD _mcp_loop is_runningagent.async_utilsrrir BaseExceptionrjrR_loop_stop_mcp_looprfr)rtrnrurzrQownerrmrlooprfutureexcrrrrrrs$$$ @@@@@r shutdown_mcp_serversrs/}..$H #(>>l>CXAYAYA]A]^aAbfkAkCC>l  '/Kx9S>U3JxKH;CD8CENN3//8D  !(mO ENN#c%*B*B&CCe//01e../025e6R6R2ST  6;5M5M5S5S5Uh5UzsY^Ygss5UhO$88< c V^8dQhR\R\\,R\\\ \3,\\ \ 3,\\ \ 3,3,/#)rinclude_active server_namer )boolrrwtupler`r )r s"r r r sl8C=USWX[]`X`Sacghkmphpcqswx{~AyAtBTBNCrc aRV3Rllp\P;_uu_4T!\Uu/uFq3\P VR4bK up4p\P V4VFp\P VR4K V'd=V!\4pVPV4VFp\P VR4K VUu/uF%qf\9gKV\P V4bK' ppVUu/uF%qf\9gKV\P V4bK' ppRRR4XXX3#uupiuupiuupi +'giL$;i)zPop the PIDs to reap (and their spawn-time pgids) out of the ledgers under the lock, so a future spawn can't collide with stale state. Returns ``(pid -> owner, pid -> pgid)``.ctV^8dQhR\\\3,R\\\3,/#)rentriesr )r`r rw)r s"r r )_take_reapable_pids..__annotate__s.mmS#Xm4S>mrcr<VP4UUu/uFwrSe VS8XgKWbK upp#uuppir)rg)rrrrs& r _owned#_take_reapable_pids.._owneds5-4]]_l_zs @SW\`kWk  _llls33orphanN) rr__orphan_stdio_pids_orphan_stdio_pid_serversrr}rO _stdio_pidsr& _stdio_pgids_stdio_starttimes) rrropidr7activerpgidsstartss &f r _take_reapable_pidsrs%mm WijWit6::4JJWijk,,T2D % ) )$ 5 K(F KK T*7;Stl?R+l&&s++tS=A^TcL]E]1#(,,S11T^   kT^ sH E D; AE AE  E!E;E  EE,E ;E  E cV^8dQhR\R\R\R\\,R\\,R\\,RR/#) rrsigrpgidmy_pgidexpected_startr N)r rwr)r s"r r r sN4-4-S4-s4-4-HSM4-\deh\i4-(0 4-AE4-rc^Ve>\V4pVe/^RIHpV!WV4'g\P RW4R#\\RR4pVe1Ve-VeW48Xd\PRW#4M V!W14R#\P!W4\PR8Xd\W4R#R# \ \ 3dLi;i \\\3d"p \P RY1Y)4Rp ? LRp ? ii;i \\\3dLi;i)uSIGTERM/SIGKILL via the spawn-time pgroup on POSIX (reaches reparented grandchildren), falling back to a per-pid signal. PID-reuse guard (#43044): only signal if ``pid`` still names the process we spawned. Once an MCP child exits and is reaped the kernel may recycle its PID/PGID onto an unrelated process group; signalling the stale number would kill a stranger (observed: a recycled PGID landing on a desktop browser's session leader). When ``expected_start`` was captured at spawn and no longer matches — compared drift-tolerantly, because same-host readings drift ~1 s on macOS (#117505) and exact equality skipped live, legitimately-owned servers — skip entirely. Without a baseline (the capture raced the child's exit), or when the current reading is unreadable (leader reaped: POSIX never reuses a PGID while a member lives, so its reparented grandchildren are still ours), fall through to the legacy best-effort path.N)start_time_fingerprints_matchuwSkip signalling MCP pid %d (%s): start-time mismatch — PID was recycled; refusing to kill an unrelated process group.killpguMCP server '%s' pgid %d matches gateway pgid; skipping killpg to avoid self-kill and using per-pid kill — any grandchildren in this group may not be reapedzHkillpg(%d, %d) failed for MCP server '%s': %s; falling back to kill(pid)nt)rrrrirj TypeErrorr+getattrr"warningProcessLookupErrorPermissionErrorr*killr_kill_windows_process_tree) rrrrrrcurrentrrrs &&&&&& r _signal_mcp_processr s.!$S)   H4^MMLLGHKZ NR4 (F F.  4? NNK MX  _ :t!    ww$"3,5z*  $'A : g! :: :  9   s;*C=CDCCD/D  DD,+D,c4V^8dQhR\R\RR/#)rrrr N)r )r s"r r r @s!Ccdrc^RIp^RIpTPT4pTP RR7pTFpTP4K T\TRTP48Xd2TPT^R7wrxTFpTP4K R#R# \dR#i;i TP TP \3dR#i;i \dKi;i \dKwi;i)u Windows counterpart of the POSIX killpg path (#61059): after the direct child is signalled, terminate every still-alive descendant (npx.cmd → node.exe) so graceful teardown cannot leave orphans reparented with ParentId=null. Best-effort, per-descendant; never raises.NT) recursiveSIGKILLr)signalr,r?r-r.rArBr* terminaterrSIGTERM wait_procsr) rr_signalr,parent descendantschild_alives && r rr@s$ooo5   OO   ggy'//::$$[!$<E  ;   &"5"5w ?      sEB#B)C?C$ B&%B&)"CC C! C!$ C32C3chV^8dQhR\\,R\\,R\/#)rrrr )rr r)r s"r r r \s)  x} x}  rcVeW8Xg\\R4'gR#\P!V^4R# \dR#i;i)zA reaped leader's descendants that ignored SIGTERM keep its group alive, so the SIGKILL pass must probe the group, not only the leader PID.rFT)hasattrr"rr*)rrs&&r _group_aliver\sD |tgb(.C.C $ s= A  A cJV^8dQhR\R\\,RR/#)rrrr N)rrrw)r s"r r r hs,AAA8TW=AdhArc ,^RIp\W4wr4pV'gR#\P!4pVP 4FPwrx\WrPWPV4WePV44\PRWx4KR \P!^4\VRVP4p ^RIHp VP 4FwwrxV !V4'g$\#VPV4V4'gK6\WyWPV4WePV44\P%RWx4Ky \&P(!RVP+44R# \\ 3dRpEL_i;i)aBest-effort reap of stdio MCP subprocesses: SIGTERM, wait 2s, SIGKILL survivors. By default only ``_orphan_stdio_pids`` are reaped so concurrent cron jobs / live sessions are untouched; ``include_active=True`` also kills every ``_stdio_pids`` entry and is only for final shutdown after the MCP loop has stopped. ``server_name`` limits the sweep to one server (stdio reconnects cleaning up their old transport).Nz,Sent SIGTERM to orphaned MCP process %d (%s)r) _pid_existsz6Force-killed MCP process %d (%s) after SIGTERM timeout unregister)rrr"getpgrpAttributeErrorr*rgrrrrirjtimesleeprrrrrr_update_death_supervisorvalues) rrrr7rrrrrsigkillrs && r _kill_orphaned_mcp_childrenrhs& -nJD **,jjl C%3R\R\]`Rab CSP# JJqMgy'//:G*jjl  s  |EIIcNGDD eYYs^WjjY\o ^ NNSUX `#  ""<@ G $sE<<FFc$V^8dQhR\/#r)r)r s"r r r s333rc0\P!RR7#)zStop the MCP loop only when no registered server still owns it. Probe paths create temporary MCPServerTasks not placed in ``_servers``; they may clean up an idle loop but must not tear down the process-global loop under live agent tools.Tr)rrrJrr _stop_mcp_loop_if_idlers   T 22rc>V^8dQhR\\,RR/#)rrur N)rrx)r s"r r r s"kkHUOktkrcp"Vf\Pp\P!4p\P!4Uu.uF$q"VJgK VP 4'dK"VNK& ppV'gR#\ PR\V44VFpVP4K \P!W0R7GRjxL wrVVF+pVP4'dKVP4K- V'd#\ PR\V4V4R#R#uupiLh5i)aCancel every task still pending on the MCP loop and reap it. ``Task.cancel()`` only schedules the throw, so tasks need a cancellation cycle before the loop goes away; wait for them here, on their owning loop, bounded so a task that suppresses cancellation cannot hang process exit.Nz-Draining %d pending task(s) from the MCP looprz3%d MCP loop task(s) still pending after %.1fs drain)r_MCP_LOOP_DRAIN_TIMEOUTr current_task all_tasksdonerirjlencancelwait cancelled exceptionr)rurtrktaskr still_pendings$ r _drain_mcp_loop_tasksrs //""$G!++-S-Q'1Aq!&&(qq-GS  LL@#g,O  ' W FFD~~ NN LcR_N`bijT Gs7AD6D/D/'D/-AD6 D4 D6/D6 *D6cV^8dQhRR/#rIrJ)r s"r r r s"""rc"\P!4p\\PR7GRjxL VP VP 4R#L! TP TP 4i;i5i)aDrain pending tasks, then stop the loop from its owning thread. Both must run as one loop-owned sequence: a ``loop.stop`` queued separately by a timed-out caller can overtake the scheduled drain, leaving the drain coroutine itself pending when the loop is closed.rN)rget_running_looprrr call_soonstop)rs r _drain_and_stop_mcp_loopr sU  # # %D"#E,I,IJJJ tyy! K tyy!s+A:AAAA:AA77A:cV^8dQh/^\9d\\\3,;R&^\9d \;R&^\9d\\\3,;R&^\9d\\\3,;R&^\9d\\\3,;R&^\9d\ \R3,;R&#)rrrrrr.r:)__conditional_annotations__r`r rwrr)r s"r r r s<<! T#s(^ <$ C%<&/.4S>.'<."!d38n!/&Ers< !'(   + ,! %,.. " !%'&B3 * :7DV,4V,PTV,*.V,r*4-n8 A>3kdk,"r