+ lHjna0t$Rt^RIHt^RIt^RIt^RIHt]PRRl4t RR/RRllt RtR R llt R t ] !0Rum4tR RltRRRR/RRlltRRltRRltRtRRltRRltRRltRR ltR!R"ltR#R$ltR%R&ltR'R(ltR)R/R*R+llt]PR,R-l4tR.R/lt] !0Rvm4tR1R2lt RwR3R4llt!R5R6lt"RxR8R9llt#] !0Rym4t$R:R;lt%Rllt&R?R7/R@RAllt'RBRClt(/t)RD]*RE&RFRGlt+R?R7/RHRIllt,/t-RJ]*RK&RLRMlt.RNt//t0RD]*RO&RtRPRQllt1RRRSlt2R?R7RTR/RURVllt3RWRXlt4RYRZlt5R[RR\R]/R^R_llt6RtR`Rallt7/t8Rb]*Rc&RdRelt9RfRglt:RhRilt;RjRkltRrRslt?R#)za Session lifecycle: active-session slot leases, finalize/teardown/close, turn interrupt, WS-orphan reap scheduling, transport-scoped close. Bodies are rebound onto server.py's globals at install time (method_ctx.bind_module), so they reference server.py globals bare. ) annotationsN) bind_modulecV^8dQhRR/#sessiondict)formats"B/home/ubuntu/.hermes/hermes-agent/tui_gateway/session_lifecycle.py __annotate__r sTc #"^RIHpVP4;_uu_4q R,;_uu_4VxRRR4RRR4R# +'giL;i +'giR#;i5i)zXHold process admission until the history-locked running claim is visible to idle probes. retirement history_lockN)hermes_cli.backend_retirementrwork)rradmitteds& r _session_turn_admissionrsB9   h(?(?)@  (?(?   s1A0AA A A0 A A A- ' A0rc V^8dQhRRRR/#)rnamestrr dict | Noner )r s"r r r s{r caa^RIHp^RIHoSP 4'gR#VV3RlpV!WAR7pVeWRR&VP 4V# \ dSP4hi;i)zWReserve before spawning; release only after the worker (including cleanup) has unwound.)spawn_context_threadrNcb<S!4SP4R# SP4i;iNrelease)rtargetsr run _start_session_work..run s& ! H    J   s.)r _run_thread)agent.memory_providerrrracquirestart BaseExceptionr)r rrrr!threadrsf$$ @r _start_session_workr)si:8     ! %c5  %+M "   s "AA/c(V^8dQhRRRRRRRR/#)r event_typer session_id str | Noneplatformreturnz list[str]r )r s"r r r 1s**PZfor c \P!\4;_uu_4^RIHpHpHpVR8Xd$V!V!V\V4R74uuRRR4#V!W\V4R7RRR4.# +'gi.#;i)zcFire session lifecycle hooks with CLI parity; returns plugin ``on_session_finalize`` user messages.)finalize_session invoke_hooksession_end_messageson_session_finalize)r,r.N) contextlibsuppress Exceptionhermes_cli.lifecycler1r2r3_resolve_agent_platform)r+r,r.r1r2r3s&&& r _notify_session_boundaryr:1sp   Y ' '\\ . .'(8JYpqyYz({| ( ' J@WX`@ab ( I ( ' Is*A5A55 B z8Hermes could not safely reserve this session. Try again. ws_disconnectc V^8dQhRRRR/#)rlive_session_idrr/rr )r s"r r r ?s00S0T0r c RV/#)zWriter identity for a lease: ``live_session_id`` is half of ``_is_same_writer``. Bot Chat delivery is admitted by the session authority (gateway/session_bot), never gated on a lease flag.r=r )r=s&r _lease_metadatar??s  //r surfacetui profile_homec ,V^8dQhRRRRRRRRRR/#) r session_keyrr=r@rBzstr | Path | Noner/ztuple[Any, str | None]r )r s"r r r Es4666*-68;6Sd66r c ^RIHpT!Y\4T\V4\ T;'gR4P 4P 4R8HR7# \d)p\PRT4R\3uRp?#Rp?ii;i))try_acquire_active_sessiondesktop)r,r@config registry_homemetadatatrack_livenessz'Failed to claim active session slot: %sN) hermes_cli.active_sessionsrG _load_cfgr?rstriplowerr7loggerwarning_SESSION_OWNERSHIP_UNAVAILABLE)rDr=r@rBrGexcs&$$$ r _claim_active_session_slotrVEs 6I)"IKWc$_5w}}"-335;;=JL L 6@#F 4556sAA B #BB B c(V^8dQhRRRRRRRR/#)rsidrrrframer/Noner )r s"r r r Xs.FFFtFDFTFr c VPR4p\V\4'dVPR4eR#\VPR4;'gR4pV'd*\VPR4;'gR4V8wdR#^RIHpT!RVPR4;'gT 2T\VPR 4;'gR 4R R 7VR&R#) uAdopt the parent's registry slot as an INERT token on a compute-host child. An isolated turn runs in the compute-host CHILD process. The parent dashboard already claimed the session's active-session lease before routing the turn here, but the child's freshly built session record never carried it — so ``_admit_prompt_turn`` re-claimed from the child's pid and was fenced out by the parent's own entry (``_is_same_writer`` requires same pid AND same live_session_id): every isolated turn failed with "Session ... already has a live owner" (#101416). The slot is real and owned upstream, so the child must neither claim a second one nor be able to release/transfer the parent's: the token is ``enabled=False`` — ``release()`` is a no-op and ``transfer_active_session`` only retargets the token locally, so a compression rotation A->B inside the child never reaches the registry (the parent re-anchors its real lease from the reported ``session_key``, see ``_compute_host_adopt_frame_meta``). NOT ``released=True``: a released token makes the transfer fall through to a real registry claim under the child pid. Only installed when the frame's ``active_session_lease`` vouch names THIS stored session id — a parent lease still keyed on a pre-rotation id must not authorize its continuation. Anything else keeps the legacy behaviour — the child claims for itself and any ownership conflict fails CLOSED with the visible refusal. active_session_leaseNrDrHr,)ActiveSessionLeasez borrowed:lease_idsourcerIF)r^r,r@enabled)get isinstancerrrNr])rXrrYvouchkeyr]s&&& r _install_borrowed_leasereXs* II, -E eT " "gkk2H&I&U gkk-(..B /C #eii -334;=&8UYYz299c:;EIIh'4495u'FG "#r c$V^8dQhRRRRRR/#)rrXrrrr/r-r )r s"r r r ys!S4Jr cd\V4;peV#VPR4eR#\VPR4;'gR4p\W0\ V4VPR4R7wrEVf\ W4R#^RIHp\VRR4V8Xd\WV4'dR#V#) aClaim this session's cap slot on its first real turn; None when ok. session.create/resume deliberately do NOT claim: tile paints, reconnect-resumes and abandoned drafts would hold invisible slots (no DB row) that starve the messaging gateway sharing the cap. Anything holding a slot must be user-visible. An inert borrowed token (see _install_borrowed_lease) also lands here: present = slot held upstream.Nr\rDrHrBr=r@rB)SESSION_NOT_OWNEDreason) _canonical_ledger_refusalrarrV_session_source _attach_leaserNrigetattr!_take_over_detached_runtime_lease)rXr canonicalrdlease limit_messageris&& r _ensure_active_session_slotrsys /w77 D{{)*6 gkk-(..B /C5 /'*BQXQ\Q\]kQlnEg%<}h-1BBGhilwzG{G{ r zSELECT status FROM session_admissions WHERE target_session_id=? AND status!='terminal' UNION ALL SELECT status FROM worker_executions WHERE session_id=? AND status!='terminal' LIMIT 1c$V^8dQhRRRRRR/#)rr,r end_reasonr/boolr )r s"r r r s"C#RVr caaaa\SRR4pVfSPSS4R#VVVV3RlpV!V4'dR#\PRSS4R#)aEnd *session_id*'s row unless the gateway's durable ledger still holds work for it; True when the row may end (ended now, or already ended). The check and the stamp share one write txn. A viewer process (a dashboard, a second Desktop window) runs this reaper for a session the owning gateway is still executing; stamping it ended mid-turn made the owner treat its own live route as stale (#54878) and replace the conversation (#140642). The ledger names a local session by its logical id (the row's ``chat_id``), so the physical id, the key and that id are checked: a ``local-`` id, or the lineage owner its receipt names (an adopted conversation keeps its legacy id)._execute_writeNTc.<VPRS34P4pS\S;'gR40pVeS\V^,;'gR4PR4'd"VP \V^,44^RIHpVP V!VS44\RV4F-pVP\WD34P4fK,R# SPVR\P4SS3SS4R#)z'SELECT chat_id FROM sessions WHERE id=?rHNzlocal-)local_lineage_ownerFzRUPDATE sessions SET ended_at = ?, end_reason = ? WHERE id = ? AND ended_at IS NULLT) executefetchoner startswithaddhermes_state_localrzfilter_CANONICAL_PENDING_SQL _end_and_bumptime) connrowidsrzrXdbrur,rDs & r write&_end_unless_ledger_busy..writesllDzmT]]_3{00b12 ?s3q6< J Xr zJPreserving session %s during %s: the gateway's ledger still holds its turnF)rn end_sessionrRinfo)rr,rDru execute_writersffff r _end_unless_ledger_busyrs[B 0$7M z:.  U KK\^hjtu r cV^8dQhRR/#rr )r s"r r r s""t"r c ^RIp^RIHpHpHp\ VP R4;'gR4pV'gR#\V4;_uu_4p\VRR4pVf RRR4R#V!4;_uu_4p\\VP\WU344R4p RRR4RRR4X fR#\P#R YY^,4T!R T R T ^,R 8XdR MR R2T4p T ^,T nT # +'giLk;i +'giLv;i TPd)\PRTRR7T!\ T4u#i;i)a(Refusal when the gateway's durable ledger still holds work for this stored session, else None. The registry lease only fences other legacy backends. A session a gateway once owned can carry an ``unknown`` admission (outcome lost across an owner restart: never replayed, only Discard resolves it), queued input or a running worker; a legacy turn would run past that barrier and write the transcript beside the canonical FIFO. Checked on every turn, not only at the first claim, because a gateway may admit work while this backend still holds its lease.N)ActiveSessionRefusal SESSION_COORDINATION_UNAVAILABLErirDrH _read_ctxz#canonical ledger read failed for %sTexc_infoz;Refusing legacy turn for %s: canonical ledger holds %s workzSession z has unknownzoutcome-unknownpendingz work in the gateway's durable queue. Resume it through the gateway (hermes chat --resume, Desktop or the TUI) to resolve it; nothing was run here.)sqlite3rNrrrirra _session_dbrnnextiterr{rErrorrRrSrTr ledger_status) rrrrrirdrread_ctxrrrefusals & r rkrksKSS gkk-(..B /C  f  ! !Rr;5H" !t4 -CcZ PQSWX " { KKMsXYTZ[" 3%u#a&I2E.9UV, ,->@G  FG N " ! ==f._release_active_session_slot..sY^YfYfYhr z%Failed to release active session slotrrr`)rarrnrRrSr)rerrrqs& @r _release_active_session_slotrs3:GKK. /E }0@%!H!HAaQhiiv>M E:t , ,GE9d4S4S{{)*e3 *D1 r c V^8dQhRRRR/#rr )r s"r r r 's . .D .T .r cL^RIHp\V4V8Xd\V4R#R#)uEnd-of-turn release for hosted room member sessions (``source=bot_room``) only. A hosted room turn is serialized by the room driver's lease, not by this process, so the member profile's ``bot_room`` slot is needed only while a turn is in flight. Holding it for the life of the live session (which no reaper ever ends: room sessions have no client transport) locked every other room worker sharing the home — messaging gateway + Desktop ``serve`` — out of that member with ``Refused active session … already held by pid=…`` until this process exited (#106847). Call under ``history_lock`` next to ``running = False`` so the next admission never observes the stale lease and then runs lease-less; ``_admit_prompt_turn`` re-claims on the following turn. )ROOM_SESSION_SOURCEN)tui_gateway.hosted_room_driverrrlr)rrs& r _release_hosted_room_turn_slotr's#Cw#66$W-7r excludecV^8dQhRR/#)rr/zset[str]r )r s"r r r 7s99H9r c8\;_uu_4\P4Uu0uF6pVPR4;pfKW JgK!\ VP 4kK8 up\ \4,uuRRR4#uupi +'giR#;i)uSnapshot leases still backed by this process's live session records (plus leases deferred past a close for an unsettled isolated turn — still ours until the child settles).r\N)rrvaluesrarr^set_deferred_active_session_leases)rrrqs$ r _own_live_lease_idsr7sy 3<3C3C3E3E$[[)?@@E$RWRf$ENN#3E789  s(BBB B"BB B c V^8dQhRRRR/#)rr,rrrr )r s"r r r As!6!63!6!6r c #aaaaaaa a "SPR4o^RIHoHo \P!4o .o\SR7oRTTTTT TTT 3Rllp\^T4;pe.S P4\ P R ST4RxR#S^,xS P4SeA\SR R 4'd,SPR4SJdSPRR4R#R#R#R# \d'p\ P RST4RxRp?R#Rp?ii;i S P4Se>\SR R 4'd*SPR4SJdSPRR4iiii;i5i) zRelease this runtime and lock sibling ownership through the DB write. Yields True (another runtime owns the lifecycle -> preserve) when the guard can't be loaded/entered in 3 tries: unknown ownership never ends a row.r\)active_session_liveness_guard%release_active_session_liveness_guardzHFailed to load active session ownership guard; preserving session %s: %sTN)rcV^8dQhRR/#rr/rZr )r s"r r 0_other_runtime_lease_guard..__annotate__Os11D1r c<SP4Se \SRR4'd S!SSSR7pMS!SSPR4SR7pSPV4.SR&R#)Nr`F)own_live_lease_idsrB)rKr:NNN)closernra enter_context) guardactiverrqrrrr,stacks r _enter*_other_runtime_lease_guard.._enterOsb   5!A!A9%`rsE1'++n*EZlnE((/0q r zBFailed to inspect active session leases; preserving session %s: %srF)rarNrrr7rRrSr5 ExitStackrrrrnr) r,rrUrrrrrqrrrs ff @@@@@@r _other_runtime_lease_guardr@sT KK. /Es  "EF,U;11#1f-- : []gist 6Qi   E!B!Bw{{SiGjnsGs KK. 5Ht!B 5 acmors 2    E!B!Bw{{SiGjnsGs KK. 5Ht!B sHFC7A0F D+!AF7 D(D#F#D((F+AE>>Fc(V^8dQhRRRRRRRR/#)rrXrrrnew_session_idr/rvr )r s"r r r es)sTcVZr c@V'gR#VPR4pVfR#^RIHpV!W2\V4R7'dR#\VRR4'dR#\W \V4VPR 4R 7wrVVf"V'd\ PR WV4R#VPRR4;pe6\^VP4;p'd\ P R VR7WQR&R# \d\ P RRR7Li;i) Fr\NTrrz&Failed to transfer active session slotrrMrBrhz_Compression session lease re-anchor failed (kept old lease): sid=%s new_session_id=%s reason=%sz+Failed to release stale active session slot)rarNrr?r7rRdebugrnrVrlrSrrr) rXrrrqr new_leaserroldrs &&$ r _transfer_active_session_slotres  KK. /E }NF "5o^aNb c c du&.. :_W5M\c\g\ghv\w yI  NN|  ?{{1488ER^_`bebmbmRnKn3Kn BS Q&/ "# # N = MNsC88"DDrHc V^8dQhRRRR/#)rr_rr/rvr )r s"r r r s  S T r cT;'gRP4P4pV\9dR#^RIHpV!V4R# \ dR#i;i)zTrue when ``source`` resolves to a gateway ``Platform`` (enum member or plugin via ``Platform._missing_``, so new platforms are covered automatically); self-owned Platform members (local/webhook/api_server) are excluded.rHF)PlatformT)rPrQ_NON_GATEWAY_SOURCESgateway.configrr7)r_srcrs& r _is_gateway_owned_sourcersQ <%_lifecycle_own_sid..s `;LPTX_P_HH;Ls  N) rrar5r6r7rrrr)rrown_sidsf& r _lifecycle_own_sidrs}(77gkk&177R8G    + +^^`9??;L`bdeG.< + N7N.<^ + + Ns$B9))B& B9& B6 1B99 C c V^8dQhRRRR/#rr )r s"r r r see$e4er c^RIHpVPR4;p'dVPV4R#R# \d0\ P !\4PRRR7R#i;i)zbA per-session unlock ends with the session that made it; siblings in the same profile keep theirs.)unlockrz(vault manager lock on session end failedTrN) agent.vault_backendsr rarelease_sessionr7logging getLogger__name__r)rr rXs& r _lock_vault_managersrsce/++f% %3 %  " "3 ' & e(#))*T_c)des666A0/A0 tui_closec$V^8dQhRRRRRR/#rrrrurr/rZr )r s"r r r s&oo{oodor cJ V'dVPR4'dR#RVR&\V4VPR4;pe,VP4'gRVR&VP4V\9;'d+\ V4P 4P4R8HpV'g \V4VPR4;peVP4VPR 4pVPR 4;'g\P!4;_uu_4\VPR .44pRRR4\VR 4'dR\VR R4;p'd=\P!\4;_uu_4VP!V4RRR4\#V4;_uu_4Ve\P!\4;_uu_4^RIHpT!RRR\VRR4;'gVPRR4\VRR4\VRR4;'gRR7RRR4VeWX'dO\VR4'd=\P!\4;_uu_4VP)V4RRR4RRR4VPR4p \VRR4;'gT p \+RV \ V44;'g.VR&V'dV 'g \V4V'dV 'd \-W4M-\P!\/VPR444p T ;_uu_4p V '*p V 'd\0P3RW4V 'd\P!\4;_uu_4\5V4;_uu_4pVeb\7VP9V 4;'g/PRR44'dRp M$V 'dV'g\;WW4'gRp RRR4RRR4RRR4VeV'g X 'gRVn\P!\4;_uu_4^RIH pT!X 'd\CT ;'gR4MR\EV4VR 7RRR4X 'dKV 'dC\P!\4;_uu_4^R!I#H$pV!\CV 44RRR4VeA\P!\4;_uu_4^R"I%H&pV!VR#V R$2R%R&7RRR4\P!\4;_uu_4VPR'4;p'dVPO4RRR4R# +'giELv;i +'giEL';i +'giEL;i +'giELY;i +'giELe;i +'giEL;i +'giEL;i +'giEL;i +'giEL;i +'giEL_;i +'giEL/;i +'giR#;i)(zBest-effort finalize hook + memory commit; mirrors the CLI exit path so a force-quit mid-turn (double Ctrl-C, terminal close, SIGHUP) loses nothing.rNTresume_history_readyzsession resume cancelledresume_history_errorrI _notif_stopagentrhistory_persist_session_session_messagesr2on_session_endFr,rDrHmodelrr.rA) completed interruptedr,rr.commit_memory_sessionr4 _end_msgsrzEPreserving session %s during %s: another backend owns an active leaser_interrupt_for_session)rDorigin_ui_session_idrj) clear_session&cancel_background_review_for_live_turnzsession ended ()z session endedmessage tool_reason slash_worker)(raris_setr_AUTOMATIC_SESSION_END_REASONSrlrPrQrr5 nullcontextlisthasattrrnr6r7r_session_profile_runtime_scoper8r2r r:rrvrRrrr get_sessionr_end_session_on_closetools.async_delegationr#rrtools.approvalr%agent.background_reviewr'r)rru history_ready_desktop_automatic_cleanup stop_eventrrsnapshotr2rDr,_lifecycle_guard_other_runtime_owns_lifecycle_tui_owns_lifecyclerr#r%r'workers&& r _finalize_sessionr@s gkk,// GL! %;<< IR_RfRfRhRh*D&'44nn9Q9W9W9Y9_9_9aen9n &$W-kk-00 = KK E ++n % A A)?)?)A A Aw{{9b12 B u())75J]_c;d/dx/d   + +  " "8 ,, ( 0 0  $$Y//<$4&ulDAccW[[Q^`bEc!%)0 1K1Q1Qr0V0VW_ac0dee.3+,5O 7r{__27/2F/ * 8@S&+#   Y ' '@2EK--2.2!3G!O ],   Y ' '[[0 06 0 LLN ( 'w B A A , + +0//0// 1 0 0>2F1E1E///   2 ( ' ', + +, + + ( ' 's,V5W 'X-AW ?W X4XW1 !X*-Y"Y:X- !X 0X X X X 4X- <Y Y(Y;Y)Y=*Z5 W W  W. ( X1 X < X X  X*$ X- - X> 8 Y Y  Y& ) Y: = Z  Z" c$V^8dQhRRRRRR/#)rrrrurr/rZr )r s"r r r %s& J J J3 J4 Jr c  V\9dR#\RR\VPR4;'gR4R\VPR4;'gR4RV/4R# \d\ P R R R 7R#i;i) zTell connected clients a session was reclaimed out from under them. Broadcast, not session-targeted: reap paths run on timer threads with no contextvar binding and no live transport, so ``_emit`` would hit stdio.Nzsession.reclaimedr,rrHstored_session_idrDrjz"session.reclaimed broadcast failedTr)_RECLAIM_END_REASONS_broadcast_global_eventrrar7rRr)rrus&&r _announce_session_reclaimedrF%s--J 3 #gkk&177R8 W[[%?%E%E2!F j6" # J 9D IJs#A'#A'A''"B  B r,c(V^8dQhRRRRRRRR/#)rrrrjrr,r/rZr )r s"r r r 3s0KK4KKUXKbfKr c ~\VPR4;'gR4pV'gR#^RIHpV!V4pT'gR#TUu.uF'p\TPR4;'gR4NK) ppTUu.uFq'gK TNK pp\R R \T;'gTPR 4;'gR4R TR TR\T4RT/4R# \d\ P RRR7R#i;iuupiuupi \d\ P RRR7R#i;i)uTell connected clients pending gateway approvals are being dropped (interrupt/reap/teardown, #106678). Broadcast, not session-targeted: reap/interrupt run on timer threads with no live transport or contextvar, so ``_emit`` would miss detached clients (same as ``session.reclaimed``). Fail-open by design: a missing session key, an empty queue, and a broadcast failure never raise — the deny-resolve / teardown must proceed either way (silence in the notice channel must not strand the agent thread or the session teardown). rDrHN)list_gateway_approvalszlist_gateway_approvals failedTrrzapproval.cancelledr,rrCrjcancelled_count request_idsz#approval.cancelled broadcast failed) rrar6rIr7rRrrElen) rrjr,rDrIritemrKrids &&$ r %_announce_cancelled_gateway_approvalsrO3s#gkk-066B7K 9(5 AHI3txx -334KI"-5+333+K5K 4 #jEEGKK,?EE2F  f s7| ; 7( )  4t D J5 K :T JKsAC# !D . D ? D D-DD#"D D "D<;D<ruc$V^8dQhRRRRRR/#rr )r s"r r r Ss"{3QUr c V'gR#\WR7\W4\P!\4;_uu_4\ W4RRR4\P!\4;_uu_4^RIHpVPR4;p'd VPR4'g V!V4RRR4\P!\4;_uu_4\V4;_uu_4\VPR4;pR4'dVP4RRR4RRR4R# +'giL;i +'giL;i +'giL@;i +'giR#;i)zFully tear down a session: finalize, unregister notifier, close agent (``session.close`` + WS reaper). The slash-worker is closed in ``_finalize_session`` (the single chokepoint), NOT here. Idempotent via ``_finalized``.Nru)unregister_gateway_notifyrDrrr) r@rFr5r6r7rOr6rSrar2r1r)rrurSrdrs&$ r _teardown_sessionrTSs g54   Y ' ' .gB (   Y ' '<;;}- -C -w{{CV7W7W %c * (   Y ' ')G)P)P GKK005' : : KKM*Q ' ' ( ' ( '*Q)P ' ' 'sB D=:6E1E#E674E# +E6= E  E # E3 .E66 F c$V^8dQhRRRRRR/#)rrXrrrr/rZr )r s"r r r js!dtr c\;_uu_4\PV4VJdW!R&RRR4R#RRR4VP4R# +'giL";i)zkStore worker on session iff sid still maps to it, else close it (a concurrent teardown popped the session).r,N)rrrar)rXrr?s&&&r _attach_workerrWjsE  ==  (&,N #   (  LLN s A A# zdict[str, float]_closed_session_activityc V^8dQhRRRR/#)rrXrr/rr )r s"r r r ws  C K r c \;_uu_4\PVR4pVe^RIHp\ \ VPR4;'gV!44P44pVPR4'd\P4M#\VPR4;'g^4p\\PV^4V4\V&RVR&WR&RRR4V# +'giX#;i) uAtomically detach one live session from the registry — the ownership claim for teardown (a concurrent close/reaper no-ops). Separate from ``_teardown_session``: slow finalization must not run under the resume lock.N)get_hermes_homerBrunning last_activeT_closingr) rrrhermes_constantsr[rPathraresolverfloatmaxrX)rXrr[homer]s& r _pop_session_by_idrews --T*   8tGKK7LL?;LMUUWXD)0Y)?)?$))+U7;;WdKeKjKjijEkK-01I1M1MdTU1VXc-d $T *"&GJ !FO  N  NsAC94C90C987C99 D c$V^8dQhRRRRRR/#)rrrrurr/rvr )r s"r r r s"k#X\r chVfR#VPR4pVR8wdzVevV\P4Jd^VP4'dVP \ R7VP4'd\ PR\ 4VR8wd \V4\WR 7^R I H pT!VPR 4;'gR 4R# \d\ PRRR7Lli;i ^R I H pT!TPR 4;'gR 4i;i) zDFinish a close after the caller has atomically detached the session.Fr# tui_shutdown)timeoutz:session turn thread still alive after %.1fs teardown gracez&failed waiting for session turn threadTrrR)forget_sessionrrH)ra threadingcurrent_threadis_alivejoin!_TURN_SETTLE_BEFORE_CLOSE_SECONDSrRrSr7r"_settle_isolated_turn_before_closerTtui_gateway.event_replayrj)rru run_threadrjs&$ r _teardown_popped_sessionrss]+J^# (>:U^UmUmUoCo R""$$(IJ""$$PRsu^#*732'9 <w{{6*00b1  R LLADL Q R <w{{6*00b1s)C +C >C + D "DD)D1zdict[str, Any]rc V^8dQhRRRR/#rr )r s"r r r sRRRRr cVPR4'd\V4'gR#\P!\4;_uu_4\ \ V4V4RRR4\P4\,pVPR4'd1\P4V8d\PR4KGVR,;_uu_4VPR4'dVPRR4;pf RRR4R#W R&V\\VP4&\P4\\VP4&RRR4\ P#R\VPR44R# +'giELC;i +'giLP;i) uAn isolated turn runs in the compute-host child, not on ``_run_thread``: interrupt it and give it the same close grace, and if it still has not settled keep the REAL lease out of finalize's release — the completion callback releases it on the correlated turn.end/turn.error (child death fails pending turns the same way). The RPC close is bounded; ownership ends with the child's last write, never with the grace timer, else a second backend acquires the stored session while the child is still writing._compute_host_turn_idNrrr\_deferred_active_session_leasez^isolated turn still live after %.1fs close grace; holding lease for %s until the child settlesrD)ra_session_uses_compute_hostr5r6r7rrr monotonicrorrrrr^#_deferred_active_session_lease_agesrRrS)rdeadlinerqs& r rprps5 ;;. / /7QRY7Z7Z   Y ' ' 27 ;WE (~~"CCH ++- . .4>>3Ch3N 4  {{233MceiAj8j7s  ! 5:01?D'ENN(;Failed to force-release stale deferred active session lease %srzForce-released deferred active session lease %s held past %.0fs without a compute-host settlement (zombie concurrency slot, #62823)) rr0rzr*_DEFERRED_ACTIVE_SESSION_LEASE_TTL_SECONDSrrrrrRrS)r}r^ deferred_atstalereapedrqrs& r _reap_stale_deferred_leasesrs$))+#C.23V3\3\3^._ ._*X  I I ._  F+//$?/33HdC = 5==1 1C > NN[]e$'  ) S!K M !  M% s C5C5c V^8dQhRRRR/#rr )r s"r r r sWWDWTWr c@VPRR4pVfR#\P\VP4R4\P\VP4R4\ ^VP 4;pe\PRVR7R#R#)zdSettlement half of ``_settle_isolated_turn_before_close``; a no-op for sessions that never deferred.rwNz.Failed to release deferred active session slotr) rrrr^rzrrrRrS)rrqrs& r &_release_deferred_active_session_leasersz KK8$ ?E }#''ENN(;TB'++C,?FAu}}--:GRUV;r predicatec(V^8dQhRRRRRRRR/#)rrXrrurzCallable[[dict], bool] | Noner/rvr )r s"r r r s2 D D  D  D;X Ddh Dr c\;_uu_4\PV4pVeVeV!V4'g RRR4R#\V4pRRR4\ XVR7# +'giL;i)aMIdempotent teardown funnel for callers with no resume race (resume-sensitive callers pop under ``_session_resume_lock`` and call ``_teardown_popped_session`` after releasing it). Automatic reapers pass ``predicate`` to revalidate under ``_sessions_lock`` right before the claim, so a stale scan can't close a session that reattached.NFrR)rrrarers)rXrurcurrentrs&$$ r _close_session_by_idrs] --$  goYw=O=O %S)  $G CC s+A&A& A&& A6 c V^8dQhRRRR/#rr )r s"r r r srr[rTrr c\T;'d6VPR4'*;'dVPR4\J4#)zFTrue if a live session is still bound to the disconnected-WS sentinel.rr)rvra_detached_ws_transportrs&r _ws_session_is_detachedrs8 pp L 99ppgkk+>VZp>p qqr c V^8dQhRRRR/#rr )r s"r r r sQQ[QTQr cf\\V4;'dVPR4'*4#)zoTrue if a WS session sits on ``_detached_ws_transport`` (where ``handle_ws`` parks disconnected clients), idle.r\)rvrrars&r _ws_session_is_orphanedrs' '0OOY9O5O PPr rorphanFc ,V^8dQhRRRRRRRRR R/#) rrXrrrrr-rrvr/r )r s"r r r s;RR RR,6RGKR Rr c ^\V4p\VPR44p\VPR44;'dV'*pRpV'd;V'gVPR4'd\4P WR7M-VPR4;pRJ;'dVP 4pVR,;_uu_4R VR &RVR &VP R R4\VPR ^44^,VR &RRR4V'dC^RIH p \VRR7;_uu_4V !RVPRR4RRRR7RRR4V'gV'd^RIHp V !VPR44\ P"!\4;_uu_4^RIHp T !\)W4R\+\-VPR4RR4;'gR4R7RRR4V'gJV'gBVR,;_uu_4VPR4'dRVR&\/V4RRR4VPR4;p e=\ P"!\4;_uu_4^RIHp V !V RRR 7RRR4\5V4\ P"!\4;_uu_4V'dR!MR"p\7WVR#7^R$IHpV!VR,R%R R&7RRR4V# +'giEL;i +'giEL;i \d\PRR R7ELi;i +'giELm;i +'giEL0;i +'giL;i +'giT#;i)'uApply the shared ``session.interrupt`` contract to one claimed session; returns whether the compute-host control channel was used. The WS orphan reaper reuses this so a dead client gets the same partial-history/queue semantics. ``orphan=True`` (reaper path) labels dropped approvals ``ws_orphan_reap``; the label comes from the caller, never from request_id prefix sniffing — a future orphan caller may use another id (#106678). _manual_compress_activer\F_compute_host_activerr#NrT_turn_cancel_requested queued_promptqueued_prompts_queued_prompt_generationr)hydrate_secretsagent_loop_stoppedrDrHrA user_stopsession_interrupt)rDr.rjinvalidation_reasonz'agent_loop_stopped hook dispatch failedr)request_hard_interruptrr"r,)r$rjparent_session_idr&zsession interruptedr)ws_orphan_reap interrupt)r,)resolve_gateway_approvaldeny) resolve_all)rxrvra_get_compute_host_supervisorrrmrrhermes_cli.pluginsr2r2r7rRragent.interrupt_compatrr5r6r5r#rrrn_clear_inflight_turnr7r'_clear_pendingrOr6r)rXrrruse_compute_host compressingshould_interruptrun_thread_alivert _invoke_hookrr#agent_for_reviewr'rjrs&&$$ r rrs2':w{{#<=>KGKK 23GGK w{{+ABB ( * 4 4S 4 P")++m"<\P!\ 4;_uu_4VP 4RRR4R#R# +'giLS;i +'giR#;i)zCancel a pending WS-orphan reap for ``sid`` (client came back). Called from every path that re-binds a live transport; closes the fired-but-not-run Timer race and stops dead Timers accumulating on flappy clients.N)rrrr5r6r7cancel)rXtimers& r _cancel_ws_orphan_reapr}sa !%%c40     + + LLN, + , + +sA1B1 B  B c$V^8dQhRRRRRR/#)rrXrrrr/rr )r s"r r r s!d{r c\PV4VJd\VRR4#VPR4'd\VRR4#R#)uUnder ``_session_resume_lock``: why a reattaching RPC (resume/activate/prompt.submit) must NOT rebind ``session`` — it is stale, or a client-gone interrupt is still settling and the reap Timer must keep polling. None when the reattach may proceed.iz$session no longer live; retry resume _client_gone_interrupt_requestediz%session disconnect interrupt settlingN)rra_err)rNrXrs&&&r _reattach_refusalrsH}}S(CEFF{{566CFGG r c(V^8dQhRRRRRRRR/#) rrXrrrr Transportr/rZr )r s"r r r s($$$d$y$T$r cvV\JdR\V4'dA\;_uu_4\V4'dV\9d \ V4RRR4R#\ W4\P4VPR/4V&V\Jd\V4R#R# +'giR#;i)a Attach a live peer without displacing existing subscribers (caller holds ``history_lock``). Subagent control authority needs no bookkeeping here: it resolves against ``session["transport"]`` at RPC time (``tools.delegate_tool_registry._subagent_transport_matches``).Nviewers) rrrrr_schedule_ws_orphan_reap_attach_session_transportr setdefaultr)rXrrs&&&r _rebind_live_transportrs..3Ei3P3P^&w//C?P4P(- g14899;Gy"%i0..s#/^ s (B'' B8 c V^8dQhRRRR/#)rrrr/rvr )r s"r r r str c\^8:dR#VPR4'dVR,;_uu_4VPR4pVPRR4;'dS\V\4;'d;^\P 4V, R, u;8*;'d \8MuuuRRR4#\ \VPR4R R4;p4'gR#V!4PR 4pVRJ;'d\V4\8# +'giLt;i \dR#i;i) uWhether a detached RUNNING turn's activity clock (``_touch_activity``) is still fresh — the reaper must NOT interrupt healthy detached work (closed laptop). Conservative: disabled threshold, missing/opaque agent, unreadable summary or never-stamped clock all report NOT fresh (eligible for interrupt-at-grace) to keep the wedged-turn net. Reuses the agent's existing activity summary (``_touch_activity`` is stamped by API waits, stream tokens, and tool heartbeats — the same clock the turn-liveness watchdog samples; see agent/turn_liveness.py). See #100325, #98028. Isolated turns mirror that clock from the child under a unique dispatch token; their monotonic samples keep aging even if the child or its pipe stalls. Frvr_compute_host_activity_nsr\iʚ;Nrget_activity_summaryseconds_since_activity) _WS_ORPHAN_ACTIVITY_STALE_Srarbrrperf_counter_nscallablernrbr7)rstamp summary_fnelapseds& r !_ws_orphan_turn_activity_is_freshrs#a'{{*++ ^ $ $KK ;@VX\"]]J ^ ^,""#;<d"SSuW~8S'SS% $ s0AD"9.D"( D". D5D5" D2 5 EEdelay_s_expected_timerc(V^8dQhRRRRRRRR/#) rrXrrr~rzthreading.Timer | Noner/rZr )r s"r r r s2yy y&y@Vy yr caaaaa\^8:dR#Vf\M \RV4o\P4o\P4oRVVVVV3Rllp\;_uu_4Ve%\ P S4VJd RRR4R#\PVf\M \RV4V4oRSn \ PSR4pS\ S&RRR4Xe<\P!\4;_uu_4VP4RRR4SP4R# +'giLa;i +'giL5;i)uAfter a grace window, reap session ``sid`` iff it's still orphaned. Called from the WS-disconnect path; a reconnect or ``session.resume`` cancels the reap by re-binding a live transport. Disabled when grace is 0. The grace is measured in AWAKE (monotonic) time: ``threading.Timer``'s wait elapses in wall-clock time on platforms without a monotonic condvar (macOS lacks ``pthread_condattr_setclock``), so a system sleep makes the timer fire "early" in awake-time terms. Without the sleep check below, closing a laptop lid for longer than the grace reaped the parked session at the instant of wake — before the Desktop's WS reconnect or ``session.resume`` could re-bind a transport — so every sleep/wake cycle 404'd the open chat (#44183).NcV^8dQhRR/#rr )r s"r r ._schedule_ws_orphan_reap..__annotate__sYGYG4YGr c <\P4S , \P4S, , pV\8dE\RS \P4S, , 4pV^8:dM\ S VS R7R#R;p;r4\ ;_uu_4\ ;_uu_4\PS 4S JdRRR4RRR4R#\PS 4pVf*\PS R4RRR4RRR4R#\V4'gNVPRR4VPRR4\PS R4RRR4RRR4R#\S V4'gQVPR4'gBVPR4'g+\V4'g\V4'd \pEMVPR4'g \!S 4pMVPR4'g4\#V4'd#\$P'RS \(4\pM\+VPR4;'g^4^,;qeR&V\,8d>\$P/RS V^, V^, \0,4\!S 4pM$VPR4'gRVR&Tp\0pVf\PS R4RRR4RRR4Ve+\3S VR S 2RR 7p\$P5R S V4Ve\ S VS R7R#Ve.VPR4'd\$P5R S 4\;VRR7R# +'giL;i +'giL;i \6d\$P9R S 4\ ;_uu_4\PS 4TJd,\PS 4S JdTPRR4RRR4K +'giEL ;ii;i)r)rrNr_client_gone_interrupt_pollsr\zLclient_gone sid=%s action=defer (turn activity fresh; stale threshold %.0fs)ukclient_gone sid=%s: turn did not settle after %d interrupt polls (%.0fs) — force-reaping detached sessionTz client-gone-)rrz5client_gone sid=%s action=interrupt turn_isolation=%sz#client_gone interrupt failed sid=%szclient_gone sid=%s action=reaprrR)rry_WS_ORPHAN_REAP_SLEEP_SLACK_Srcrrrrrarrrr"_session_owns_live_wakeup_schedule*_session_owns_pending_process_notification_WS_ORPHAN_REAP_GRACE_SrerrRrrr#_WS_ORPHAN_INTERRUPT_REAP_MAX_POLLSerror _WS_ORPHAN_INTERRUPT_REAP_POLL_Srrr7rrs) slept_s rearm_delayreschedule_delayinterrupt_sessionrrpollsisolatedarmed_monotonic armed_wallgrace_srXrs r _reap'_schedule_ws_orphan_reap.._reapsw99;+0@?0RS 2 2c7dnn.>.P#QRKa )kSXY:>==, ! !>>!$$S)6 $2 ! !  mmC(G!%%c40$2 ! !+733  >E :DA!%%c40#$2 ! !$/sG<< I..#KK(JKK;GDDFwOO$; [[++,S1[[!CDDIjkrIsIs k "=?#: CFgkkRpFqFvFvuvBwz{B{{ >?>>LLFUQY6V(VX15G";;'IJJFJ BC,3)'G$'!%%c40g$2 !h  ( X2*cU7KTXZ SUXZbc  ' $S2BTY Z   7;;/Q#R#R KK8# > 5EFI$2> ! !r X  !FL#^! c*.?? 1 5 5c :e C)--.PRVW$^^^ XsN,.N N,0N N,A N )N,;(N $N ;AN <"N AN /A0N 'N N,)N? N) $N,, N< ?/Q.AP>3Q> Q QQT)rrcrryrrrarkTimerdaemonrr5r6r7rr&) rXrrrpriorrrrrs f$$ @@@@r rrs!#)0%c#w>OGnn&OJYGYGv   &+<+@+@+E_+\  7? 7PSTWY`Pachi !%%c40!&#     + + LLN, KKM , +s,D>AD>E> E  E! c V^8dQhRRRR/#)rrurr/ztuple[int, int]r )r s"r r r >s99C9Ve9r c \V4p^;r4VEFwrVRpRp\;_uu_4\;_uu_4\P V4p WJdRRR4RRR4KUV P R4;'g/P VR4\ ;_uu_4\WR7'dRRR4RRR4RRR4KRRR4V P R4'd \V4pMV P R4;'g/p V P VR4\V P4RR7U U u.uFwr\V 4'dKV NK p p p V 'd\WYV R ,4Me\V R&V P R R4V P R R4R p\P!\ 4;_uu_4\#V4RRR4RRR4RRR4VeV\%WqR 7, pEKV'gEK V^, pEK W43# +'giELj;iuup p i +'giLp;i +'giL{;i +'giL;i)uSingle WS-disconnect teardown entry point: reap close_on_disconnect sessions (sidecar/dashboard) immediately; re-point the rest at the detached transport (later emits miss the dead socket) for the grace-windowed WS-orphan reaper. Returns ``(reaped, detached)`` counts. Multi-client fan-out: the departing transport is DETACHED from every session first. A session that still has another client attached keeps streaming and is neither parked nor reaped — a watcher leaving must not end the turn the remaining client is reading. Only the sessions left clientless take the historical close_on_disconnect / park-sentinel path, so a single-client disconnect behaves exactly as it always has.NFr) excludingclose_on_disconnectcV^,#)r )kvs&r r/_close_sessions_for_transport..gs PRSTPUr )rdrrrTrR)_detach_transport_from_sessionsrrrrar_session_transport_lock_session_has_live_transportresortedrrrrr5r6r7rrs)rru clientlessrdetachedrXrclaimed_for_teardownshould_schedule_reaprrvttslives&$ r _close_sessions_for_transportr >s1;JF" #$" !>>mmC(G%$2 ! ! [[ # ) )r . .y$ ?)(.wLL)$2 ! !M){{011'9#'>$ "++i066B It,)/ EU)Vu)Vvr^pqs^t)Vu*3bB+AGK(KK BDIKK >E+/($,,Y77058G$2 !J + ./C[ [F ! ! MH[#\  9)((v87G$2> ! !sI/I I/&I >!I H/3I ;I/I -#I 4I II%A0I  I !I )I// I:I II  I,'I// I? cV^8dQhRR/#rr )r s"r r r zs000r c2\\4VRR7R#)zFPublish this module's helpers onto ``server``, rebound to its globals.)skipN)_)rglobals)servers&r registerrzs 6/r r> lru_evict idle_timeoutrhr;r>rHacpclirAcrontestlocalwebuikanbanrIwebhooksubagent api_servermsgraph_webhook)rH)r>rrr)@__conditional_annotations____doc__ __future__rr r5 method_ctxrcontextmanagerrr)r:rT frozensetr.r?rVrersrrrkrmrrorrrrrrrrrrr@rDrFrOrTrWrX__annotations__rersrrprrzrrrrrrrrrrrrrr r)r!s@r r(s  ## T2"\!*+{!|0 6>C6gk6&FB*hD"J+ >   . 949 !6!6HD!"@A eoh!!PQ JK[]K@..0*/   6354R>.4*8:#%5:0W D#. D[_ Dr Q R9=RNSRjD13-2$*6y)-yY]yx9/9x0r