+ lHj2Rt^RIHt^RIt^RIHt^RIHt^RIH t RRlt RuRR llt R R lt R R lt RRltRRltRRltRRltRRltRRltRRltRRltRRltR R!ltR"R#ltR$R%ltR&R'ltR(0tR)R*ltR+R,ltR-R.ltR/R0ltR1R2lt R3R4lt!R5R6lt"R7R8lt#R9R:lt$R;R<lt%R=R>lt&R?R@lt'RARBlt(RCRDlt)RERFlt*RGRHlt+RIRJlt,RKRLlt-RMRNlt.RORPlt/RQRRlt0Rvt1RSRTlt2RURVlt3RWt4RXRYlt5RuRZR[llt6RuR\R]llt7R^R_lt8]9!4t:]PvR`Ral4t<]PvRbRcl4t=RdRe/RfRgllt>RhRilt?RjRklt@RlRmltARnR/RoRplltBRqRrltCRsRtltDR#)waSession working-directory + durable session row: cwd resolution/healing, session.db row ensure, branch seed, history rewind, git meta persistence. Bodies are rebound onto server.py's globals at install time (method_ctx.bind_module), so they reference server.py globals bare. ) annotationsN)Any) git_probe) bind_modulec V^8dQhRRRR/#) path_partstrreturn)formats"@/home/ubuntu/.hermes/hermes-agent/tui_gateway/session_workdir.py __annotate__rs##cl\PPV4p\PR8wdVP RR4p\ V4^8d^V^,R8XdPV^,R8XdBV^,P 4'd%RV^,P4 RVR, 2#V#)nt\/:z/mnt/:NN)ospath expandusernamereplacelenisalphalower)rexpanded normalizeds& r _normalize_completion_pathr sww!!),H ww$%%dC0 z?a JqMS$8Z]c=QV`abVcVkVkVmVm:a=..01:b>2BC C Orc V^8dQhRRRR/#)rparams dict | Noner r r )r s"r rrs..K.3.rc>T;'g/pVPR4pVPR4p\PVPR4;'gR/4PR4pV'd \V4MRpVPR4'gV'd\ V4;p'dV#VRJ;'d \ V4p\ T;'gT;'g\V4;'guV'dRMR;'ga\4;'gO\PPR4;'g(\R4;'g\P44pV'd)\V4'dV#\V4;'gR#Vf+VPR4'd\ R4'dV#\ P"!\$4;_uu_4\P&P)\P&P+V44p\P&P-V4'd VuuRRR4#RRR4Vf%\V4'd\ R4'dV#\/V4'd\1V4R8wdV#\P4# \d7T'dTPR4'dT'g T'ghRpELi;i +'giL;i) cwdprofile session_idN cwd_explicit~ TERMINAL_CWDlocal)get _sessions _profile_homeProfileUnavailableError_profile_workspace_cwd_cwd_is_remoter _profile_default_cwd_launch_configured_cwdrenviron_sandbox_workspace_cwdgetcwd_is_remote_cwd_shape_declared_remote_profile_cwd startswith contextlibsuppress Exceptionrabspathrisdir_is_container_path_bound_terminal_backend) r" client_cwdr& session_cwd profile_home profile_cwd named_sshrawresolveds & r _completion_cwdrIs| \\rFE"Jjj#G-- < 8 > >BCGGNK18}W-d ::n % %*0> >; > D(II^L-II j__K__+? +M__"#__/E/G__/__4J$3O__TVS\S\S^ `C *3//sh6RS_6`6g6gdghs 3 3t8L8L   Y ' '77??277#5#5c#:; 77== " " ( ' " ( 4S 9 9nT>R>R ##:<#HG#S 99;C # vzz.99:Q\  , ( 's=.K6 K2A#L L L 2L :L L L  L c V^8dQhRRRR/#)rkeyr r r )r s"r rrJsssrc^\P!\4;_uu_4\4P R/4p\ V\ 4'd=\VP V4;'gR4P4uuRRR4#RRR4R# +'giR#;i)zEStripped ``terminal.`` from config, or "" when unset/unreadable.terminalr(N) r;r<r= _load_cfgr- isinstancedictr strip)rK terminal_cfgs& r _workdir_terminal_cfgrSJsy   Y ' ' {z26 lD ) )|'',22399; ( ' ) (  ( ' sA B1B B, cV^8dQhRR/#)rr rPr )r s"r rrSs  d rchV'g/#^RIHpHpV!\V44# Td/u#i;i)uA named profile's effective ``TERMINAL_*`` policy — the one its turns run under (``build_profile_terminal_scope``: defaults <- ``.env`` <- ``config.yaml``). {} for the launch profile or an unreadable profile.)TerminalPolicyUnavailablebuild_profile_terminal_scope)tools.terminal_scoperVrWPath)rDrVrWs& r _profile_terminal_policyrZSs8  \+D,>?? $ s % 11c V^8dQhRRRR/#)rpolicyrPr r r )r s"r rr`sLLDLSLrc\VPR4;'gR4P4P4;'gR#) TERMINAL_ENVr(r,)r r-rQr)r\s&r _policy_backendr_`s8 vzz.)//R 0 6 6 8 > > @ K KGKrcV^8dQhRR/#rr r r )r s"r rrdsvvSvrcNV'd\\V44#\4#)a!Terminal backend of the profile a session/RPC is bound to. A named profile reads ITS policy: at ``session.create`` the multiplex gateway has not rebound HERMES_HOME yet, so ``_effective_terminal_backend()`` would report the LAUNCH profile's backend, which must never leak into a named one.)r_rZ_effective_terminal_backendrDs&r rArAds"GS?3LA BuXsXuurcV^8dQhRR/#rr boolr )r s"r rrks::D:rc\V4R8H#)zWhether the bound profile's working directory lives on another host (ssh), so a host ``isdir`` check cannot vouch for it. Docker and the other backends mount or copy HOST paths and keep the host checks.ssh)rArds&r r2r2ks #< 0E 99rcV^8dQhRR/#rr str | Noner )r s"r rrqs[[*[rc\V4p\VPR4;'gR4P4p\ V4R8Xd\ V4'dV#R#)u=A named ssh profile's own ``terminal.cwd`` (``~``, ``~/…`` or absolute), unchecked against this host. ``_profile_configured_cwd`` requires ``os.path.isdir``; an ssh working directory lives on the remote, so that check drops it (or expands ``~`` to THIS host's home) and the launch profile's ``TERMINAL_CWD`` wins. r+r(riN)rZr r-rQr_r8)rDr\rGs& r r9r9qsU &l 3F fjj(..B / 5 5 7C!&)U27KC7P7P3ZVZZrc V^8dQhRRRR/#rrGr r rgr )r s"r rr|sFFcFdFrcn^RIHpV!RV4;'g \PP V4#)uAn ssh working directory the remote shell can resolve: ``~``, ``~/…`` or absolute (a relative one would be stored and git-probed relative to the gateway's own cwd).)_is_ssh_remote_tilde_cwdri)hermes_cli.configrqrrisabs)rGrqs& r r8r8|s); #E3 / E E277==3EErc V^8dQhRRRR/#ror )r s"r rrs<>#  ; ;s~~d';#;;rcV^8dQhRR/#rkr )r s"r rrsJrcV'dI\V4p\V4\VPR4;'gR4P 4r2MK\ 4p\ PPRR4P 4;'g \R4pVR9g7\V4'd&\ PPV4'dR#V#)aA container backend's configured ``terminal.cwd`` (docker ``/workspace``), unchecked against this host. ``_profile_configured_cwd``/``_launch_configured_cwd`` require ``os.path.isdir``, which a path inside the sandbox fails. Only a path missing on the host qualifies: an existing host dir keeps the host path (it is the ``docker_mount_cwd_to_workspace`` source). ssh has its own remote-cwd rules above.r+r(r%N>rir,) rZr_r r-rQrcrr5rSr@rr?)rDr\backendrGs& r r6r6s ),7&v.FJJ~4N4T4TRT0U0[0[0]-/jjnn^R0668XXrr?)rDrGrHs&& r _workspace_cwdrsl##  $ $JTUXTYZ[[wwrww11#67H 77== " "=cUCDD Orc V^8dQhRRRR/#rsessionr#r r r )r s"r rrs66 66rc&\V4^,#)zThe cwd terminal_tool should use for this TUI session (NOT host-validated: a non-local backend's cwd lives inside the target environment). "" when the backend's own default applies.)_terminal_task_cwd_with_sourcers&r _terminal_task_cwdrs *' 21 55rc V^8dQhRRRR/#)rrr#r ztuple[str, str]r )r s"r rrs((K(O(rcT;'g/PR4p\V4;'d \V4pV'dRM \4pVR8wdV'dCVPR4'd,VPR4'd\ VR,4R3#V'd\ V4pV'dVR3#R #\ PPRR 4P4;'g \R4pV'd VR 9dVR3#VR8XdR #\V4'dR #V'd,VPR4'd\ VR,4R3#\V4'gR #\4R3#) u.``(cwd, source)``: ``"session"`` for THIS session's workspace (``explicit_cwd``/tracked dir), ``"process"`` for the global ``TERMINAL_CWD``/``terminal.cwd`` fallback — under per-session docker isolation that is a PREVIOUS session's launch artifact, so terminal_tool refuses it as a bind-mount source.rDrir, explicit_cwdr%rprocessr+r()r*r>.r%auto)r(r) r-rgr2rcr r9rr5rQrS_is_remote_launch_cwd_host_cwd_is_terminal_cwdrI)rrDrFrx remote_cwdrGs& r rrsAMMr&&~6L\"CC~l'CI e&A&CG' w{{>22w{{57I7Iwu~& 1 1 5lCJ.8J * N>N Njjnn^R0668XX ! e ! !W%%7;;u%%75>"I-- $\ 2 2  i ''rc V^8dQhRRRR/#rr )r s"r rrsXX+X#XrcxV'd*VPR4'd\VR,4#\4#)r%)r-r rIrs&r _session_cwdrs)")gkk%.@.@3wu~ WoFWWrdesktopc V^8dQhRRRR/#rrr#r rgr )r s"r rrsyy[yTyrc\T;'d1VPR4'*;'d\V4\94#)zEWhether the session cwd came from app launch rather than user intent.r)rgr-_session_source_LAUNCH_CWD_NOT_A_WORKSPACErs&r _context_cwd_is_launch_artifactrs5 ww N ;;wwPW@X\w@w xxrc$V^8dQhRRRRRR/#)rr"rPsourcer r ztuple[bool, str, bool]r )r s"r rrs"111c1DZ1rc N\VPR4;'gR4P4p\V4;'d\ V4;'d \ V4pRp\ P!\4;_uu_4\V4;'ddT;'gZ\PP\PP\PPV444pRRR4\V4pV'dwV'goVR8XdhVPR4'dRpTpMKV'dDV\PP\PPV448XdRpWVV3# +'giL;i)uk``(explicit_cwd, session_cwd, remote_cwd)`` for a freshly created session. Only a chosen workspace persists as cwd; the launch-dir fallback is "No workspace". A chosen workspace is one the gateway host can ``isdir``-probe, an ssh-shaped cwd on a remote profile, or — the #108205 desktop arm — a nonblank desktop-sourced cwd the host probe could not vouch for: the client names a workspace its gateway host cannot see (Docker/remote backend topology), and a failed host-side isdir is a topology artifact, not a verdict on the client's path. The CLIENT vouches instead, with #52589 provenance: a deliberate pick (``cwd_explicit``) adopts the raw path outright; an inherited app-global workspace only counts once the completion resolution actually adopted it, so a launch-dir fallback still persists nothing and a named profile's configured ``terminal.cwd`` keeps winning. r%r(FNrr)T)r r-rQrgr8r2r;r<r=rrr?r>rrI)r"rrDraw_cwdrrrCs&&& r _resolve_create_cwdrs$&**U#))r*002Ggaa#7#@aa^T`EaJL   Y ' 'G}WW  U U"''--8J8J78S(TU  ("&)K|)(; ::n % %L!K [BGGOOBGG""G$$w#>>BWX_B`B` w{{5!''R ( 0 0D0rc V^8dQhRRRR/#rr )r s"r rrs \ \; \4 \rchV'dVPR4'dR#VPR4p\V4'dR#\VPR4;'gR4p\V4;'d8\ V4'*;'d \ P PV4#)aA cwd nobody picked for a session whose terminal does not run in host directories: an ssh session's, or a sandbox backend's (modal, daytona, singularity, sprites, ...) when it is a directory on THIS host: the gateway's launch directory (``/opt/data`` in the Docker image). Host-side context discovery reads it from memory, but it never becomes the terminal cwd and is never persisted: a resume adopts a stored cwd as the session's workspace. A sandbox path (``/workspace``) is not a host directory and stays.rFrDTr%r()r-r2r rgrrrr?)rrDr%s& r rrs gkk.11;;~.Ll## gkk% &&B 'C 9 [ [6|DD [ [WZI[[rcV^8dQhRR/#rfr )r s"r rr!sNNtNrc\V4pVR 9dR#^RIHpW9dR#^RIHpV'd \ V4MRpV!VRRVR7;'g V!VRRVR7'*#) aWhether a host directory can be the terminal cwd of a session bound to ``profile_home``: the local backend runs in it, docker mounts it at ``/workspace`` (``docker_mount_cwd_to_workspace``) or creates it (``docker run -w``), and a plugin backend declaring neither ``is_remote`` nor ``is_container`` runs on this host. ssh, modal, daytona, singularity, sprites and the other sandboxes run somewhere the host's directories do not exist.T)_BUILTIN_BACKENDSF) provider_flagN is_remote)scope is_container>r,docker)rAtools.terminal_tool_configragent.terminal_env_registryrr )rDrxrrrs& r rr!sm &l3G%%<#:!-C 4Eg{DFMM .$eL NNrc V^8dQhRRRR/#rr%r r rgr )r s"r rr4saacaDarca^RIHp^RIHp\P P V4'gR#\V4P4o\T;'g \44P4pVP4V!VR7P40p\;QJdT3RlT4F 'gK RM RM!T3RlT44;'g T!S4# \\3dR#i;i)aWhether ``cwd`` is inside Hermes's own host tree: the Hermes root (``/opt/data`` and its ``/opt/data/home`` subprocess home in the Docker image, which also holds every named profile) or the install tree (``/opt/hermes``). A ``~`` path is the remote's home, never this host's._is_install_treeget_default_hermes_rootFhomec3\<"TF!pSV8H;'gVSP9xK# R#5iN)parents).0rootrs& r '_is_hermes_owned_cwd..Cs)Ftt|33tt||33s,,T)agent.runtime_cwdrhermes_constantsrrrrsrYresolveget_hermes_homerOSError RuntimeErrorany)r%rDrrrrootsrs&& @r _is_hermes_owned_cwdr4s38 77==  Cy  "L55O$56AAC!8d!C!K!K!MN 3FF333FF F ` `JZ[_J`` \ "s&C+AC++D?Dc V^8dQhRRRR/#rr )r s"r rrFs444d4rc `^RIHp^RIHpHp\ P PV4'gR#\V4P4p\T;'g \44P4P4pV!VR7P4pWfR, WwR, \VP4\V!44P4\P4P40pYX9;'g T!T4# \\3dR#i;i)afWhether ``cwd`` IS a directory a Hermes process is launched from rather than a folder someone picked: the Hermes root (``/opt/data`` in the Docker image), a subprocess home (``/opt/data/home``), the bound profile's home, the install tree, the OS user's home or ``/`` (the desktop's launch dirs). Folders below them are not: a user may keep a workspace there.r)r get_real_homeFrr)rrrrrrrrsrYrrranchorrrr) r%rDrrrrrrlaunchs && r _is_launch_dirrFs 3G 77==  Cy  "L55O$56AACKKM&D199;v tF]D 3 3-d33 \ "s&DB&DD-,D-c V^8dQhRRRR/#rr )r s"r rr[sjjjdjrcVe7\V4'g&\PPV4'gR#^RIHp^RIHp\V4P4\V4P4P4rTV!VR7P4pYE8XgYTP9dR#YFTR, 39;'g'TR, TP9;'g T!T4# \\3dR#i;i)aWhether a NAMED local profile's stored cwd is a directory that belongs to another profile or to Hermes itself: the root (``/opt/data``), its subprocess home (``/opt/data/home``), a sibling profile's tree, or the install tree. Those are launch-profile workspaces that leaked into this profile's row before #87584, never a folder chosen for it. Other folders under the root stay: a user may keep a workspace there.Frrrrprofiles)r2rrrsrrrrrYrrrrr)r%rDrrrownrs&& r _is_other_profiles_cwdr[s ~l;;277==QTCUCU28I%%'l);)F)F)H)P)P)Rc&C088: {c\\) $-( ( i iTJ->4<<,O i iScdhSii \ "s AC33DDcV^8dQhRR/#rar )r s"r rrosrc8\T;'gR4pV'd%\V4'd\W4'dR#V'd6\V4'g%\V4'g\ W4'dR#V'd\ W4'dR#V#)a~A session row's stored cwd as a resume may adopt it: empty when an ssh session's row holds a path in Hermes's own host tree (a host launch directory, never a remote workspace), when a sandbox session's row holds a launch directory itself (:func:`_is_launch_dir`: rows written before launch dirs stopped being persisted), or when a named profile's row holds another profile's (the resume then lands in :func:`_profile_default_cwd` and re-persists it). Hydration and ``session.resume`` both adopt through here, then treat the result as the session's workspace. A folder a sandbox user picked (even under the Hermes root or ``$HOME``) stays.r()r r2rrrr)r%rDs&&r _resumable_stored_cwdrosk ciiR.C ~l++0DS0W0W >,//8QR^8_8_s11 %c88 Jrc V^8dQhRRRR/#)rr%r r r )r s"r rrsrcT;'gRP4pV'd&\PPV4'dV#Tp\ ^@4F[p\PP V4pV'dWB8XdM-Tp\PPV4'gK[M \PPV4'gV#\ P!\4;_uu_4\P!V4;'g!\P!V4;'gTuuRRR4# +'giT#;i)uRResolve a session cwd inside a now-deleted directory (e.g. a removed linked worktree, which probes to no branch while the sidebar folds it to the main lane): walk up to the first existing ancestor and take its common git root. Local backends only — a remote/SSH cwd may legitimately not exist on the host, so callers skip healing there.r(N) rQrrr?rangedirnamer;r<r=rcommon_repo_root repo_root)r%rGprobe_parents& r _heal_dead_cwdrs 99"   C "''--$$ E 2Y'  77==     77==     Y ' '))%0WWI4G4G4NWWRW ( ' ' ' Ls?;E;E E c V^8dQhRRRR/#rr )r s"r rrs 4 4{ 4t 4rcV'd1VPR4'd\VR,4R8wdR#\4R8H#)aWhether THIS session's cwd can be stat'ed / git-probed here. A session bound to a named ssh profile never can, whatever the launch process runs (one multiplexed gateway serves many profiles), and a per-profile gateway (``hermes -p x``) may set ``terminal.backend: ssh`` in config without ``TERMINAL_ENV``: an env-only check would heal a live remote cwd to its nearest host ancestor (``/home``) and persist that.rDr,F)r-rArcrs&r _session_is_local_backendrs< 7;;~..3J7SaKb3cgn3n ' (G 33rcV^8dQhRR/#rar )r s"r rrsSrc\PPR4;'gRP4P 4pV'dVR8Xd\ R4P 4pT;'gR#)zActive terminal backend name (``local``, ``docker``, ``ssh``, ...): ``TERMINAL_ENV`` when set (launchers bridge ``terminal.backend`` into env), else the ``terminal.backend`` config key (in-process gateways skip that bridge).r^r(r,rx)rr5r-rQrrS)rxs r rcrcs[zz~~n-33::<BBDG g(' 288:   grc V^8dQhRRRR/#rr )r s"r rrs  + # rc\V4p\V4'gV#\V4pV'dW!8wdVeW R&\W4V#)zpSession cwd for display/probe surfaces, healed past deleted worktrees (healed value persisted back; local only).r%)rrr*_persist_session_cwd_and_schedule_git_meta)rr%healeds& r _display_session_cwdrsF w C $W - - C F &-G$727C Mrc V^8dQhRRRR/#rr )r s"r rrs((+($(rcV'd/VPR4'dVPR4'gR#\V4'gR#^RIHpT!VPR4;'gR4;p'gR#\ P P\ P P\T444p\ P P\ P P\T444pY48Xg&\ P PT4'gR#\P!T4\P!T4reT'dT'dYV8XdR#\P!T4pT'dT\P!T48wdR#TPTRRR7\!T4\#Y4R# \dR#i;i) a2Re-anchor a session that SETTLED in another worktree of the SAME repo. Returns moved. An agent told to work in a fresh worktree `git worktree add`s and `cd`s in while the session stays pinned (labelled with the primary checkout's branch). A plain `cd` is deliberately NOT a workspace move (see ``_apply_project_workspace``): a non-git workspace stepping into a repo or a visit to an unrelated repo is browsing, and a workspace the user deliberately moved the chat into is never overridden. Local backends only (a remote cwd cannot be stat'ed or git-probed here). cwd_pinnedcwd_from_settleF)get_session_cwd session_keyr(T)r%rr)r-rtools.terminal_toolrr=rrr>rr rr?rrrupdate_register_session_cwdr)rrrecordedrHcurrentlanded current_root landed_commons& r $_reconcile_session_cwd_from_terminalrs^ w{{<00EV9W9W $W - -7+GKK ,F,L,L"MMMNwwrww11#h-@AHggoobgg00g1FGHG"''--"9"9%..x8):M:Mg:VL )?..x8M MY-G-G-PP NNxdDNI'".wA ' s G -G G/.G/c$V^8dQhRRRRRR/#)rsidr rrPr Noner )r s"r rrs!>>C>$>$>rc\V4\ RV\ W!44R# \d\PRRR7L NOs %"A  A c V^8dQhRRRR/#rr )r s"r rrs11[1S1rcV'd3\VPR4;'gR4P4MRpT;'g \4#)rr()r r-rQ_resolve_session_platform)rrs& r rrs<9@SX&,," - 3 3 5bF  0 0.00rc V^8dQhRRRR/#)rrr#r rr )r s"r rrshh;h4hrc V'gR#\VPR4;pR4'd!VPR4;'gRVnVPR4'd\VRR4MRpVe<\VR4'd*VP \ VPR444\ P!\4;_uu_4^RI H p\V4wrE^RI p\ P!4;_uu_4pVPR4pV'dhVPVP44VPV48wd5VP!VP"VP%\ V444V!VR,RVR V/4RRR4RRR4R# +'giL;i +'giR#;i) NrrCr%_subdirectory_hintsrebind_working_dir)register_task_env_overridesrDr cwd_source)hasattrr-rCgetattrr r r;r<r=rrrr ExitStackhermes_home_keyrcallbackreset_hermes_home_overrideset_hermes_home_override) rrhintsrr%rhcstackrDs & r rrs_  G,,um<<#KK.66$ Y>YZ]^jZk>lm ' (>\[e@f g $ ( '$ # ( ' 's%5G BF1 G1 G <G G c V^8dQhRRRR/#)rrrPr ztuple[str, dict]r )r s"r rrs%X%Xt%X0@%Xrc\VPR4;p\4'dTM/p\VPR4;'gR4P 4;'g\ V4^,pRUu/uF)qBPV4;p'gKV\V4bK+ pp\VPR4;'gR4P 4P 4R8XdZ^RIHpT!VPR4;'gRVPR4;'g T;'gRR 7pV'dWR&VPR 4;p eWR&VPR4;p eT ;'gRVR&VPR4;p 'dWR&RF p VPV 4'gKR Wl&K" \VPR4;p \4'dWR&^RI H pY>!Y`PR4;'gR43#uupi \d\PR R R 7Li;i)a``(model, model_config)`` for a fresh session row. The session's own model/effort/fast pick (composer override or restored /model switch) must own the row: the agent isn't built yet at first prompt.submit, and writing the global default here wins the INSERT-OR-IGNORE race (a reconnect silently reverts to the profile default). model_config carries provider/reasoning/service_tier so resume restores effort + fast too.model_overridemodelr(providerbase_urlcustom)canonical_custom_identityN)rrz1custom provider identity recovery failed (db row)Trcreate_reasoning_overridereasoning_configcreate_service_tier_overridenormal service_tierparent_session_id_branched_fromcomposer_override_profile)with_session_yolor)rrrapi_mode) room_plumbingfollow_profile_config)rOr-rPr rQ_session_default_routerhermes_cli.runtime_providerr!r=rrtools.approval_yolor*)rrGoverride row_modelkv model_configr!r reasoningr&r'flagcomposer_profiler*s& r _workdir_row_model_configr9s# ! 4D(E!EtLLsRTHHLL)//R0668^^(J ] M.%))*5==\EUEUV]E^EsEsbkEsEsosuF+1Z([[!<== J+4'( $BCC P(4'?'?x ^$#KK(;<<<):%&; ;;t  !%L ;gkk2M&NN"PTUU4D015 ' kk-6P6V6VTVW WW=v ] LLLW[L \ ]s6<HH3H#H#- H#7H#H##"IIc V^8dQhRRRR/#)rrrPr rgr )r s"r rr8s>>D>T>rcVPR4;p'gR#VPR4p\VR4;_uu_4pV\Jd RRR4R#Vf\RJuuRRR4#\ V4wrETP T\ V4YE;'gRVPR4;'gR\V4\V4\V4;'g \4R7VPR4'd,VPVR 4'dVPRR4VPR 4'd,VP!VR 4'dVPR R4\#WV4RRR4R # \d\PR R R 7L|i;i \d\PR R R 7Lbi;i \dp\%TR4Rp?LvRp?ii;i +'giR #;i)uIdempotently persist the session's DB row on first real activity (prompt.submit), so abandoned drafts never leave an empty "Untitled" session. INSERT OR IGNORE: re-calls and the AIAgent's lazy create are no-ops. Returns False only when the store is unavailable (no openable state.db) — prompt.submit fails the send loudly instead of streaming into a store that will never save it; no key / best-effort / success are all True. A cwd the user *chose* is always persisted. Otherwise the launch directory stands in only for terminal sessions (the user deliberately ``cd``'d there; dropping it left the sidebar with no cwd AND no git_repo_root); desktop launch dirs (``/``, home) stay null -> "No workspace". See #98924. rNrDz)failed to open profile db for session rowFr')rrr5r'r%user_id profile_namepending_hiddenTz#failed to apply pending hidden flagrpending_archivedz%failed to apply pending archived flagz%failed to persist desktop session row)r-_workdir_owner_db_WORKDIR_DB_OPEN_FAILED _db_errorr9create_sessionrr_session_auth_user_idprofile_name_for_home_current_profile_nameset_session_hiddenpopr=rrset_session_archived_schedule_row_git_meta_workdir_reraise_disk_full)rrKrDdbr2r5excs& r _ensure_session_db_rowrN8s;;}- -C -;;~.L 7$O P PTV ( ( Q P : $ Q P#># $ M M2C cggen"" # ) ) +C CGGL))cggo.F.F27BG/Gsrc$V^8dQhRRRRRR/#)rrM BaseExceptionlog_msgr r rr )r s"r rrs!))M)C)D)rc`^RIHpV!V4'dVh\PVRR7R#)zRRe-raise a disk-full write error (the caller must surface it); debug-log the rest.)is_disk_full_errorTrN)hermes_state_errorsrZrr)rMrXrZs&& r rKrKs%6#  LL4L(rc V^8dQhRRRR/#)rrrPr rr )r s"r rrsJJ$J4JrcVPR4;p'd/VPR4'dVPR4'dR#^RIHp^RIHpVR,;_uu_4\ VPR4;'g.4pVUUu.uFDpR VPR R 4/\ Uu/uFqfVPV4bK upCV!V4CNKF pppRRR4X'gR#\V4;_uu_4pVf RRR4R#VPWR R 7VR,;_uu_4V!XV4RRR4R VR&RRR4R#uupiuuppi +'giL;i +'giL=;i \dp \T R4Rp ? LWRp ? ii;i +'giR#;i)a2Persist a seeded transcript once its row exists. Seeded messages (a branch's copied parent, a client's opening turns) live only in ``session["history"]`` (ridden into the agent as ``conversation_history``, which ``_flush_messages_to_session_db`` skips by identity), so the row would otherwise resume without them. Runs once: at create for a seeded session, else at the first submit after ``_ensure_session_db_row`` wrote the row. ``seeded`` is stamped by session.create; a resumed session carries its stored transcript in ``history`` and must never re-append it.rseeded_branch_seed_persistedN)message_identity)sync_flushed_message_markers history_lockhistoryroleuseri) chunk_rowsTzbranch seed persist failed) r-agent.message_metadatar`agent.transcript_repairralist_WORKDIR_SEED_FIELDS _session_dbappend_messages_batchr=rK) rrKr`ralivemsgfseedrLrMs & r _persist_branch_seedrqs;;}- -C -gkk(6K6Kw{{[sOtOt7D  GKK *00b159;59c0*L`4aL`q ]L`4a*#C(*59 ; !  W   :    J  $ $S3 $ ?((,T48)04G, -   5b; ! )( J &s,H I I J   sx'*E$ E 1E E E$F.$F 8 E7  F E E$$ E4 7 F F  F+ F&!F.&F++F.. F? c V^8dQhRRRR/#)rrrPr r r )r s"r rrsqqDqSqrc\\VPR4RR4;'gR4;'g%\VPR4;'gR4#)uFThe session row an off-turn submit write must use: the live ``agent.session_id`` when it has rotated off ``session_key``, else ``session_key`` itself. The turn's own transcript is flushed under ``agent.session_id`` (``_db_flush_write``), while an off-turn write only has ``session_key`` to go on — and those diverge for the whole of a turn that begins after the agent's session rotated: a compression publish, an adopted continuation tip, or a lease-wait re-resolve all move ``agent.session_id`` while ``session_key`` is re-anchored only at TURN END (``_absorb_turn_result`` -> ``_sync_session_key_after_compress``). Writing the submit row to the stale key splits one turn's rows across two sessions: the user row in the parent, every tool row and the final text in the child (#123545, evidence A + B). The live id IS the authority — it is the value the turn will flush under, and the same ``getattr(agent, "session_id", None) or session_key`` the sibling system-prompt persist already uses against this handle (``_persist_live_session_system_prompt``). Do NOT re-resolve through the lineage here: ``resolve_resume_session_id`` returns the deepest node that has MESSAGES, so the freshly-minted child of a just-published rotation resolves back to the parent and the fix would no-op exactly when it is needed. The choice is made ONCE here and recorded on the staged dict under ``_SUBMIT_ROW_SESSION_KEY`` so every later addresser of that row — the @-expansion rewrite, the queue merge, the drain deactivation — reads the same key instead of re-deriving one that a rotation can invalidate mid-turn. rr'Nr(r)r rr-rs&r _submit_row_target_keyrtsI, ww{{7+\4@FFB G p p3w{{[hOiOoOomoKppr_submit_row_session_idc$V^8dQhRRRRRR/#)rstagedrPrr r r )r s"r rrs!77$77#7rc|\VP\4;'gR4pT;'g \V4#)a%The session id a staged submit row lives under: recorded at write time, else the current best. Every caller narrows to a dict (and checks ``_row_id``) immediately before, so the recorded value is the answer whenever the row exists; the re-derivation only covers a dict that predates the stamp.r()r r-_SUBMIT_ROW_SESSION_KEYrt)rwrrs&& r _submit_row_owner_keyrzs46::56<<"=H  6 6-g66rc ,V^8dQhRRRRRRRRR R/#) rrrPtextr display_kindrlaccept_metadatar#r r )r s"r rrs1%%D%%:%,7%CN%rc pVPR4'd-\V\4'dVP4'gR#^RIHp^RIHpHpV!RRRV/4pV'dW'R&V'd/VCVR &\V4;_uu_4pVf RRR4R#\V4p VPV RWVR ,V!V4VPR 4R 7VR &RRR4RYt&X T\&T# \d p \T R 4Rp ? RRR4R#Rp ? ii;i +'giLL;i)u\Write the submitted user turn to the transcript and RETURN the durable dict (stamped ``_DB_PERSISTED_MARKER``/``_row_id``) WITHOUT slotting it on the session. The write half of :func:`_persist_submit_user_row`, shared by the busy-queue accept (which attaches the dict to the queue envelope, never the shared session slot a possibly-still-staged in-flight turn owns). ``accept_metadata`` merges into ``display_metadata`` (the busy-queue accept's never-drained marker, retired by ``reopen_session`` — #125577). Returns None when nothing was written (no key / non-text / store unavailable / failed write).rN)_DB_PERSISTED_MARKER)stamp_message_timestampstamp_message_uidrdrecontentr}display_metadata timestamp)rr}r message_uidr_row_idz#submit-time user row persist failedT)r-rOr rQagent.context_compressorrrgrrrkrtappend_messager=rKry) rr|r}r~rrrrwrLtargetrMs &&&& r _write_submit_user_rowrs# ;;} % %Zc-B-B$**,,=Q $ffi%F GF!-~%8%8!" W   :  (0  " 1 1SYZeSf-f5!',>!?!2!AF9  $(F '-F "# M  &s,Q R     s6D% D%*6C88 D" DD%D""D%% D5 c ,V^8dQhRRRRRRRRR R /#) rrrPr|rr}rlr~r#r rr )r s"r rrs1 - -d -# -Z -.9 -EI -rcVVPRR4\WW#4;peW@R&R#R#)aWrite the submitted user turn at send time, before the agent build and turn: the agent's own crash persist only runs once the build finished, so quitting a frozen app during a slow first build left a session row with no message (#111868). The dict is staged on the session already stamped durable (the shape ``quiet_single_query`` re-stages an unanswered DM in) so the turn adopts it via ``_stage_turn_user_message`` and the flush writes no second row. A failed write stages nothing: the turn's crash persist then writes the row as before. ``accept_metadata`` marks a row that belongs to a still-QUEUED envelope (#125577); a dispatching turn's row is never marked._submit_user_rowN)rHr)rr|r}r~rws&&&& r _persist_submit_user_rowrs4 KK"D)( VVc&,"#drc(V^8dQhRRRRRRRR/#)rrrPpersist_user_messagerr|r rr )r s"r rrs*11D1s1RU1Z^1rc dVPRR4p\V\4'dVeVPR4V8wdR#VR,V8wda^RIHp\ V4;_uu_4pVf RRR4R#VP\W@4VR,V!V44RRR4Y$R&^R IH pV!V4;_uu_4WAn RRR4R# \d$\PRRR7RRR4R#i;i +'giLl;i +'giR#;i) aVHand the row written at submit to the turn as its user dict (``agent._pending_cli_user_message``, adopted by ``_stage_turn_user_message`` when the content matches). A prompt the prologue rewrote (@-expansion, image parts) first updates that row so the durable transcript replays what the model was sent and the ``api_content`` sidecar can address it; ``_row_id`` rides along for that stamp. ``text`` is THIS turn's raw submit: a staged row from an earlier send (its turn ended before the agent ran) is discarded untouched, so the DB row stays the user's message and never a synthesized turn's text.rNr)_durable_contentrz?submit-time user row update failed; the turn writes its own rowTr) _persist_lock)rHrOrPr-agent.session_persistencerrkset_user_message_contentrzr=rrr_pending_cli_user_message)rrrr|rwrrLrs&&&& r _adopt_submit_user_rowrs[[+T 2F fd # #u} 98MQU8U i00>  ! !Rz" ! ++)&:F922|2 ) 5"4 #5 #BCT Y% $$Y//B $0/'8 ) LLDL 1(B )0// $$Y//B $0///'8soD;B D; C.D;=C D;(CD;CD; C  D;/D8 D#  D8# D3 . D88D;cV^8dQhRR/#)rrrPr )r s"r rrMs<<O>OQXQfQfm m#1 B7LY G |3   i 8 9/89yGyI9"I!$W[[1BA%F!G!!KG  KK E "+ 50 1 1;FYAE & 51 2 2:E)A,4E '  ..;b " ! !:sHH?$HH+ H( c V^8dQhRRRR/#)rrcz list[dict]r r )r s"r rr|s]]J]:]rcv^RIHpVUu.uF"q!!V4'dKVP4NK$ up#uupi)zDReturn the durable transcript shape without transient recovery rows.)_is_ephemeral_scaffolding)rrr)rcrrs& r rr|s.C*1 \'w9RSZ9[NGLLN' \\ \s66cV^8dQhRR/#rfr )r s"r rrs``T`rcv\V\4'*;'d\V\4;'dV^8#)z>A claimed DB probe generation: a positive int (bool excluded).)rOrgr) generations&r _workdir_valid_generationrs0*d+ + _ _ :s0K _ _PZ^_P__rc(V^8dQhRRRRRRRR/#) rrrPr%r rrr rr )r s"r rrs.HHtH#H3H4HrcaaaaVPRR4oS'dS'd\S4'gR#RSRVPR4/oRVVVV3Rllp\PVRRR 7P 4R#) a=Resolve + persist a session's git branch / repo root on a daemon thread: inline ``git`` probes on the session-init / cwd-set path would stall startup on a slow or unreachable ``cwd``. Persists via the same profile-aware db the caller wrote ``cwd`` to. Best-effort: a probe failure leaves the enrichment columns unset.rr(NrDcV^8dQhRR/#rr rr )r s"r r/_persist_session_git_meta..__annotate__s R R$ Rrc f<\P!S4\P!S4rV'g V'gR#\S4;_uu_4pVeVP SSSW4RRR4R# +'giR#;i \ d\ PRRR7R#i;i)Nz&failed to persist session git metadataTr)rbranchrrkpublish_session_git_metadatar=rr)rrrLr% db_sessionrrs r _run'_persist_session_git_meta.._runs R$++C0)2L2LS2QDdZ((B>33KjRX_)((( R LLADL Q Rs5:B B A6,B 6 B B B "B0/B0zgit-metaT)rrdaemon)r-r threadingThreadstart)rr%rrrrs&ff @@r _persist_session_git_metarsk++mR0K c)B:)N)Nngkk.>YZJ R RDz$?EEGrrLc$V^8dQhRRRRRR/#)rrrPr%r r z int | Noner )r s"r rrs"   3 Wa rcVe\P!V4M \V4;_uu_4pVf RRR4R#VPVP RR4V4pRRR4\X4'gR#\YT4T# +'giL1;i \ d\ PRRR7R#i;i)z>Claim a DB-backed probe generation, then start Git enrichment.Nrr(zfailed to persist session cwdTr) r; nullcontextrkupdate_session_cwdr-r=rrrr)rr%rLowner_dbrs&&$ r rrs,.Nj$$R( G@TTTYaUT"44W[[PR5SUXYJU %Z 0 0gJ7 UT  4t Ds8-BB B"B !B B BB"CCc$V^8dQhRRRRRR/#)rrrPr%r r r )r s"r rrs!  d   rch^RIHpV!\V44p\VP R4V4pVP VRRRR7\ V4\W4\P!\4;_uu_4^RI H pV!VR,4RRR4V# +'giT#;i) )translate_cwd_for_wsl_backendrDTF)r%rrr) cleanup_vmrN) rrr rr-rrrr;r<r=tools.terminal_tool_lifecycler)rr%rrHrs&& r _set_session_cwdrs> 'C 1Cgkk.93?H NNxdtUZN['".wA   Y ' '<7=)* ( O ( ' Os B  B1 cV^8dQhRR/#rr )r s"r rrs000rc2\\4VRR7R#)zFPublish this module's helpers onto ``server``, rebound to its globals.)skipN)r)rglobals)servers&r registerrs 6/rr) rr6reasoning_contentreasoning_detailscodex_reasoning_itemscodex_message_itemsr}rr)E__doc__ __future__rr;typingr tui_gatewayr method_ctxrr rIrSrZr_rAr2r9r8r@r6r1r3rrrrrrrrrrrrrrrrrcrrrrrr9rNrJrKrjrqrtryrzrrrobjectrAcontextmanagerr@rkrrrrrrrr rr rs #!#.b Lv: [F< "Q  6 (BX )ky 1:1 \N&a$4*j($, 4 (V>1 h<%XP>B H)L JBq637%P -1@!( %%* <<%/CH%/P] ` H0 d   0r