yj/UdZ ddlZn #e$rYnwxYwddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlZddlZddlmZddlmZddlmZddlmZddlmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$ddl%m&Z&m'Z'dd l(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0dd l1m2Z2dd l3m4Z4dd l5m6Z6dd l7m8Z8ddl9m:Z:m;Z;ddldZ?dZ@dZAdZBdZCdZDe jEdZFdZGe jEde jHe jIzZJdZKdZLdeMdeNdeNfdZOdeMddfdZPd eQd!eQd"eQd#eRd$eRd%eRd&eRdeQfd'ZS dd(eMd)eNd*eeMddfd+ZTd,eMdeMfd-ZUe jEd.Vd/e)e/e0e.e-e+e,e*fDe jHZWdeQfd0ZXeYhd1ZZd2e deQfd3Z[e jEd4e jHZ\e jEd5e jHZ]e jEd6e jHZ^e jEd7e jHZ_e jEd8e jEd9e jEd:e jEd;e jEd<e jEd=e jEd>fZ`dd?Zad2e deMfd@Zb dddAdBeeeMe fd2e deeeMe ffdCZcdDe dEeeeMe fdeQfdFZddGeedeQfdHZfdIdJdKeeMe fddfdLZgdMeMdeMfdNZhdOdPdeMfdQZidRdRdSdTdUeMdVeMdWeMdXeQdYeQdZeQdeMfd[ZjdMeMdeMfd\Zke jEd]e jHZldMeMdeQfd^Zmd2e dMeMdeMfd_Znd2e d`eMdaeMdeeMfdbZodeMfdcZpddZqdRded2e dfe dge dheQdeeMf diZrdjesdkeMdleMdeQfdmZtdSdddndjesdkeMdleMdoeQd2e dpeue dzdeQfdqZvdMeMd2e deMfdrZwdsZxdZydte deeNfduZzdeNfdvZ{deNfdwZ|dxe dee"eMeMffdyZ}dzeMdoeNdeNfd{Z~dDe d|eMd}d~deMddf dZddddte deeNdeeNdeQfdZ ddRddeeMdaeMdeQdeMfdZdZeeMdfed< ddeMde deeMe fdeQdeeMe ff dZdZdZdZdeeMdeQfdZde deueMfdZde deueMfdZde deMfdZde de deQfdZdjeesdeQfdZddSdde!eeMe fdeeMdeQdee!eeMe feeMffdZde!eeMe fde de!eeMe ffdZdae deeMde fdZdee!eeMe fde fdZhdZddlmZmZmZdZdZde deQfdZde de fdZdZe jEde jHZ dde!eeMe fdeRdeeudee!eMeQffdZde!eeMe fdeufdZddZdeMdeMfdZdeMdeMfdZdeQfdZdefdZdeQfdZddZde jd<eejdeMeejjddlmZmZddlmZmZeZddlmZddlmZedz Zeeeejddz ǦddȄZdd˄ZdeRfd̄ZddlmZddlmZmZGdτdeŦZGdфdeƦZeddԄZȐddքZd2ddddeQfdڄZe jEdۦZddhZddlmZeMedDde jd<edz ZeРr ddl9mZmZeeЦZeeԦZeeessiZ ddlmZejeԦZn #e$rYnwxYweԠD]1\ZZeeeMeReNeQfree jvreMeܦe je<2eԠdiZeސreeesryeMeޠdpe jdpdZiddddddddddddddddddddddddddddddddddddd d d d d ddddddddZeD]\ZZeevreeZedkreMeܦdvr&edkrDeeeMr8e:eeܠse jeܦZeeeesfre jeܦe je<eMeܦe je<eԠdiZereeesrhdZ ddlmZeD]Zeedn #e$rYnwxYweD]QZeeiZeeess&eMeddZeMeddZeMeddZeMeddZeZeredkree jd ed!<eree jd ed"<eree jd ed#<eree jd ed$<SeԠdDiZer*eeesrd%evreMed%e jd&<d'evreMed'e jd(<devreMede jd<d)evreMed)e jd*<d+evreMed+e jd,<d-evreMed-e jd.<d/evreMed/e jd0<d1evreMed1e jd2<d3evreMed3e jd4<eԠd5iZerLeeesr@d6evreMed6e jd7<d8evreMed8e jd9<eԠd:iZereeesrd;evreMed;e jd<<d=evreMed=e jd><d?evreMed?e jd@<dAevr%dBe jvreMedAe jdB<eԠdCdZer)eeeMree jdD<eԠdEiZeeesr>edFZe&eMee jdG<eԠdHiZeeesr;edIZeerdndJe jdK<edLZerSeeeMreZn7eeeefr'e jVdMeDZndZer ee jdN<edOZeerdndJe jdP<edQZeeMee jdR<dSevrIe jdTdseMedSe jdT<n\#e$rTZedUeejdVeejWedXejWYdZ[n dZ[wwxYw ddYlmZdZe vrenid[iZ eՐe esr%e d\redR]n1#e$r)Z ed^e ejWYdZ [ n dZ [ wwxYw dd_l9m Z e n1#e$r)Z ed`e ejWYdZ [ n dZ [ wwxYw ddal9m Z e n1#e$r)Z edbe ejWYdZ [ n dZ [ wwxYwde jdc<de jdd<ddelmZmZe jddZereevreee jdde jdfe jddgdhveMejiZee jddn ee jd<ddjlmZmZmZmZmZmZmZddklmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(ddll)m*Z*m+Z+m,Z,ddml-m.Z.m/Z/m0Z0ddnl1m2Z3m4Z4m5Z5m6Z6ddol7m8Z8ddpl9m:Z:ddql;m<Z<ddrl=m>Z>ddsl?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHddtlImJZJmKZKmLZLmMZMmNZNmOZOddulPmQZQmRZRmSZSmTZTmUZUmVZVddvlWmXZYmZZ[m\Z]e j^eZ_ej`dwejadxejbdyejcdzejdd{iZedeeMfd|ZfegZhd}Zieed~<egZjdesfdZkdeMdesfdZldeeMfdZmdesdzfdZndeRdeMfdZodeRdeQfdZpdeRdeQfdZqdeRdeQfdZrdeRdeQfdZsdeMfdZtdeMdeMdeMdeMfdZudeNdeMfdZvdeMdeeMfdZwdeMdeBdzfdZxdZydZzdZ{dZ|dZ}dZ~dddeMdeMdeegeQfdeRfdZdddeMdejdejdejdeegeQfdeQf dZddddeMdeNdejdejdejdeNdeegeQfddfdZeYeyeze{e|e}e~hZdaeeMdeQfdZdeMdeMfdZdedeeMdzeMdzffdZdeMdeMdzfdZd2ddeMfdZdeQfdZdefdZdesfdZdesdzdesfdZdesfdZddesdzdeMfdZddddeMdeeMdeeMdeeMfdZdddded2edeMdeeMdeeMdeef dZdeeeMfdZdeMddfdZdesddPfdZddZddlZdaejed<dddesdeMdeRdeMfdĄZdesdeQfdńZdesdeQfdƄZdesdesdesfdɄZdd̄Zd͐ZdeRdeRfdτZGdЄdѦZGd҄dӐe8e:e<ZdԐd՜dejdIejdeNddfdׄZddejdeRfdڄZddejdeRfdۄZdܐZdݐZ ddeejdeNdeNdeQfdZde ddfdZddeedeQdeeRdeQfdZdZdeRddfdZedkr edSdS(a< Gateway runner - entry point for messaging platform integrations. This module provides: - start_gateway(): Start all configured platform adapters - GatewayRunner: Main class managing the gateway lifecycle Usage: # Start the gateway python -m gateway.run # Or from CLI python cli.py --gateway N) OrderedDict) copy_contextPath)datetime) AwaitableCallableDictOptionalAnyListTupleUnioncast)consume_detached_task_resultsafe_schedule_threadsafe)COMPACTION_STATUS1COMPRESSION_RETRY_CONTEXT_REDUCED_STATUS_TEMPLATE*COMPRESSION_RETRY_MESSAGES_STATUS_TEMPLATE(COMPRESSION_RETRY_TOKENS_STATUS_TEMPLATE+COMPRESSION_RETRY_TOO_LARGE_STATUS_TEMPLATEIDLE_COMPACTION_STATUS_TEMPLATE#PRE_API_COMPRESSION_STATUS_TEMPLATE%PREFLIGHT_COMPRESSION_STATUS_TEMPLATE)"INTERRUPT_WAITING_FOR_MODEL_PREFIX)t)request_hard_interruptcompression_made_progress)_is_ssh_remote_tilde_cwdcfg_get)get_fallback_chain @>@gf@@g.@iz'(?)\s+\d[\d,]*\s+messages,\s+retrying|compressed\s+~[\d,]+\s+(?:→|->)\s+~[\d,]+\s+tokens,\s+retrying|context\s+reduced\s+to\s+[\d,]+\s+tokens\s+\(was\s+[\d,]+\),\s+retrying|session\s+compressed\s+\d+\s+times|rate\s+limited\.\s+waiting\s+\d|retrying\s+in\s+\d|max\s+retries\s+\(\d+\).*(?:trying\s+fallback|exhausted|invalid\s+responses)|stream\s+(?:drop|drop\s+mid\s+tool-call).+retry\s+\d|stale\s+connections\s+from\s+a\s+previous\s+provider\s+issue)) session_keybase_cooldown_secondsreturnc`d} ||j}|xjdz c_|j}n2#t$r%}td|Yd}~nd}~wwxYwt t|tt dz }t||ztS)uBump the hygiene failure streak and return the escalated cooldown. This is a MULTIPLIER ladder (x1, x3, x9) over the operator's configured ``hygiene_failure_cooldown_seconds``, clamped to ``_HYGIENE_COOLDOWN_MAX_SECONDS``, so a tuned base is preserved as rung 1. It exists because the in-agent equivalent is unreachable from here: ``ContextCompressor.record_timeout_failure`` escalates on an absolute 60 -> 300 -> 900s ladder driven by the in-memory ``_consecutive_timeout_failures`` counter, which ``bind_session_state`` zeroes. Session hygiene constructs a FRESH ``AIAgent`` per run and re-binds state every time, so from the gateway that streak is structurally always 0 and only the flat ``hygiene_failure_cooldown_seconds`` could ever be recorded — a session whose summary model always times out retried on that same fixed interval forever (#79624). Keeping the streak on ``PersistentState`` outlives the per-run agent, so failures climb. r(z(hygiene failure streak update failed: %sN) _session_state persistenthygiene_failure_streak Exceptionloggerdebug$_HYGIENE_COOLDOWN_LADDER_MULTIPLIERSminlen_HYGIENE_COOLDOWN_MAX_SECONDS)gatewayr+r,streakstateexc multipliers 1/home/ragecks/.hermes/hermes-agent/gateway/run.py_hygiene_cooldown_for_failurer?s,FF&&{33> $$)$$- FFF  ?EEEEEEEE F 6 FC<==>>BJ $z13P Q QQs16 A%A  A%c ||}|d|j_dSdS#t$r&}td|Yd}~dSd}~wwxYw)zClear the hygiene failure streak after a compression that reduced context. Peeks rather than get-or-creates: writing a 0 that is already 0 must not materialise a ``_sessions`` entry (those are never evicted). Nrz'hygiene failure streak reset failed: %s)_peek_session_stater0r1r2r3r4)r9r+r;r<s r>_reset_hygiene_failure_streakrBs E++K88  67E  3 3 3   EEE >DDDDDDDDDEs#) AAAabortedrotatedin_place msg_count new_count approx_tokens new_tokensc:|rdS|s|sdSt||||S)uTrue when a hygiene run actually recovered the session. Extracted from ``_handle_message_with_agent`` so the decision is unit testable: it previously lived inline in a ~2000-line async method, and the only way to pin it was a source-reading test — which AGENTS.md bans outright, naming this file. "Recovered" requires all three: * the compressor did not abort (no summary produced at all); * the transcript was actually rewritten — either rotated into a new session or compacted in place. The degenerate "did not rotate or compact in place" path (#21301) reuses the pre-compression counts, so relying on the numbers alone would read a no-op as success; * the request materially shrank, per the canonical :func:`compression_made_progress` (#39548) — a row-count drop counts even when the summary keeps the token estimate flat, and a sub-5% token wobble does not count at all. The token arguments are deliberately compared through that shared predicate rather than with a bare ``<``: ``approx_tokens`` can be provider-reported while ``new_tokens`` is always a rough estimate (documented to run 30-50% high on code-heavy sessions), so a bare comparison both misses real wins and counts noise as one. FrrCrDrErFrGrHrIs r>hygiene_compaction_recoveredrLsAFu xu $9mZ   session_idcooldown_secondserrorc0ddl}t|dd}|dSt|d|}t|dd}|dS ||||z|dS#t$r&}td|Yd}~dSd}~wwxYw)uPersist a session-hygiene compression-failure cooldown to the state DB. Uses the same ``compression_failure_cooldown_until`` column and ``record_compression_failure_cooldown`` method that the in-conversation compression path (``agent/context_compressor.py``) already uses, so the cooldown survives gateway restarts (#74136). ``error`` is forwarded because the recorder writes ``compression_failure_error`` UNCONDITIONALLY — omitting it clobbers to NULL any reason the in-conversation path recorded, and readers surface that reason to the user (falling back to "unknown error"). That matters more now that an escalated cooldown can last up to an hour. rN _session_db_db#record_compression_failure_cooldownz+session hygiene cooldown persist failed: %s)timegetattrr2r3r4)r9rNrOrP_time session_dbrecorderr<s r>_record_hygiene_cooldownrZs&-66JUJ77Jz#H$OOHIUZZ\\,<K|]}tj|VdSN)reescape.0parts r> z,_status_template_to_regex..s*<_status_template_to_regexrhs6 H]H - -E >><rdrd%s>    "),,      rMcZ t}t|tr|dnd}t|trIt |dddvSn#t$rYnwxYwdS)uTrue when the user opted into routine compression progress notices. Reads ``compression.progress_notices`` from the gateway's raw YAML config (#52995). Default False — routine compression stays silent-by-design on chat platforms unless explicitly enabled. Read live (mtime-cached) so a config edit on a running gateway takes effect on the next status. Fail-closed: any config read error keeps the silent default. compressionNprogress_noticesF>1onyestrue)_load_gateway_config isinstancedictgetstrstriplowerr2)configcompression_cfgs r>-_gateway_compression_progress_notices_enabledr|6s  %''7A&$7O7OY&**]333UY ot , , **+=uEEFFLLNNTTVV[        5sBB B('B(>localwebhook api_servermsgraph_webhookplatformc.t|tvS)zBTrue only for programmatic/local surfaces that must keep raw text.)_gateway_platform_value_GATEWAY_RAW_TEXT_PLATFORMSrs r> _gateway_surface_passes_raw_textrXs "8 , ,0K KKrMz(api\s+(?:call\s+)?failed|provider\s+authentication\s+failed|non-retryable\s+error|rate\s+limited\s+after\s+\d+\s+retries|error\s+code\s*:|\bhttp\s*\d{3}\b|incorrect\s+api\s+key|invalid\s+api\s+key)z(cybersecurity\s+risk|security\s+policy|safety\s+policy|policy\s+violation|violat(?:e|es|ed|ion)|blocked\s+(?:because|by|under)|request\s+(?:was\s+)?(?:blocked|rejected)|disallowed|moderation)zV(provider\s+authentication\s+failed|incorrect\s+api\s+key|invalid\s+api\s+key|\b401\b)z7(rate\s+limit|rate-limited|\b429\b|quota|usage\s+limit)z%\bsk-[A-Za-z0-9][A-Za-z0-9_\-]{12,}\bz\bgh[pousr]_[A-Za-z0-9_]{20,}\bz\bxapp-\d+-[A-Za-z0-9\-]{20,}\bz!\bxox[baprs]-[A-Za-z0-9\-]{20,}\bz\bhf_[A-Za-z0-9]{20,}\bz\bglpat-[A-Za-z0-9_\-]{20,}\bz'(?i)\b(Bearer\s+)[A-Za-z0-9._\-]{20,}\bctjdkrdSttjj}g}t jdr2| tt jd| |dz t}|D]} |}n#t$r|}YnwxYwt| }||vrQ|||dz dz }|st|}t|}|tjvr tjd|t%j||tjvrtj|tjrtjd|krdnd} tj| |t|t jd<||g} t jd r%| t jd t jt.| t jd <dSdS) a Make detached Windows gateway runs see the Hermes venv packages. Some Windows restart paths run the gateway under uv's base ``pythonw.exe`` to avoid the venv launcher respawning a visible console interpreter. That mode can import the source tree via cwd/PYTHONPATH but still miss optional packages installed only in ``venv/Lib/site-packages`` (notably the MCP SDK). Patch the live process before MCP discovery so tool injection does not depend on every launcher preserving PYTHONPATH perfectly. win32N VIRTUAL_ENVvenvLib site-packagesrr( PYTHONPATH)sysrr__file__resolveparentosenvironrvappendsetOSErrorrwryaddexistspathinsertsite addsitedirremovepathseprfrufromkeys) project_root candidatesseenvenv_dir resolved_venvvenv_key site_packages project_entry site_entry insert_at pythonpaths r>$_ensure_windows_gateway_venv_importsrsi |w>>))++29LJ z~~m$$;$rz-899:::lV+,,,UUD %$,,..MM % % %$MMM %}%%++-- t    %-? ##%%  L)) ''  ( ( HOOA} - - -  ###  ! ! HOOJ ' ' 'Ichqk]&B&BAA   :...$' $6$6 =!#Z0 :>>, ' ' 8   bj6 7 7 7#%:??4==3L3L#M#M < ?sC C&%C&ctt|d|pdS)zDReturn a normalized gateway platform value for enums or raw strings.value)rwrVrxryrs r>rrs9 wx(339r : : @ @ B B H H J JJrMrmetadatac\t|dkr|St|pi}d|d<|S)zEMark Discord lifecycle/status sends without changing other platforms.discordTnon_conversational)rru)rrmergeds r>_non_conversational_metadatars= x((I55 (.b ! !F#'F  MrMagent session_rowcd}t|tr@|d}t|tr|r|}||_t |S)a]Keep gateway hygiene from rebuilding a live session's system prompt. The hygiene helper intentionally skips memory-provider initialization. Compression is allowed to persist a system prompt, so letting that helper rebuild one would strip external provider blocks from the live session. Seed the exact persisted prompt instead. When no usable prompt can be restored, seed an empty cache entry. Compression either preserves that unusable value or rebuilds with the hygiene-only platform marker; the real turn will rebuild either form with its fully initialized providers. r system_prompt)rtrurvrwrx_cached_system_promptbool)rr stored_prompt raw_prompts r>_seed_hygiene_system_promptrslM+t$$' ___55 j# & & ':+;+;+=+= '&M"/E   rMr<ct}|}d}hd}|d|dkr^t|}||vrnJ|||dz }t|j}||vrdS|jp|j}||dk^dS)uhReturn True for transient network errors safe to log + swallow. The crash class targeted by #31066 / #31110: an unhandled Telegram ``TimedOut`` (or peer ``NetworkError`` / ``httpx`` connection error) propagating to the event loop and killing the entire gateway process. These are by definition transient — the next poll cycle or user action recovers — so they must never crash the process. Walk the exception cause chain so wrapped errors (e.g. PTB's ``NetworkError`` wrapping ``httpx.ConnectError``) are still classified. The chain is bounded to avoid pathological cycles. r> TimedOut ReadError WriteError PoolTimeout ReadTimeout ConnectError NetworkError WriteTimeout ClientOSErrorConnectTimeoutRemoteProtocolErrorClientConnectorErrorServerDisconnectedErrorN r(TF)ridrtype__name__ __cause__ __context__)r<rcurdepthtransient_class_namesidentnames r>_is_transient_network_errorrsUUD#&C E /ebjj3 D==    Cyy! ( ( (4m.s /ebjj 5rMloopzasyncio.AbstractEventLoopcontextc |d}|t|r|dp|d}d}|T t|dr|nt |}n#t $rt |}YnwxYwt d|pdt|j |t|||j f dS| |dS) aLoop-level safety net for transient network errors. Installed once during :func:`start_gateway`. Catches the ``telegram.error.TimedOut`` crash class (issues #31066 / #31110) and any peer transient network error before it can kill the gateway process. Logs at WARNING with full traceback so the originating call site stays diagnosable; non-transient errors are forwarded to the default loop handler so real bugs still surface. exceptionNfuturetaskrget_namez9Gateway swallowed transient network error from %s: %s: %szexc_info) rvrhasattrrreprr2r3warningrr __traceback__default_exception_handler)rrr<r task_names r>_gateway_loop_exception_handlerrs ++k " "C 6s;;{{8$$; F(;(;   '/6tZ/H/HXDMMOOOdSWjj  ' ' ' JJ  ' G  )) II  3iic&78     ""7+++++s3B B&%B&textct|pd} ddlm}||d}n#t$rYnwxYwtD]}|d|}|S)uSecret redaction before text can leave the gateway. Delegates to the authoritative ``agent.redact.redact_sensitive_text`` — the same Tirith-grade redactor already applied to logs, tool output, and approval-command prompts — so the outbound chat path masks the full credential set the startup banner promises ("chat responses are scrubbed before delivery"), not a divergent subset. ``force=True`` honors redaction even when ``security.redact_secrets`` is off, matching the ``_redact_approval_command`` reasoning (#23810). The narrow ``_GATEWAY_SECRET_PATTERNS`` set runs as a belt-and-suspenders second pass so nothing the gateway historically caught can regress, and so redaction still degrades gracefully if the import ever fails. rrredact_sensitive_textTforcecD|jr|dnddzS)Nr(rz [REDACTED]) lastindexgroup)ms r>z5_redact_gateway_user_facing_secrets..Vs  *K!''!***|)[rM)rw agent.redactrr2_GATEWAY_SECRET_PATTERNSsub)rredactedrpatterns r>#_redact_gateway_user_facing_secretsr=s4:2H 666666((>>>      ,gg;;[[]eff Os ' 44cmdz str | NonecFddlm}|t|pddS)ugRedact credentials from a command before it goes into an approval prompt. Tirith's *findings* are already redacted, but the gateway approval prompt is built from the raw command string, so a credential-shaped value Tirith flagged would otherwise be echoed verbatim to the chat platform (#48456). Uses ``redact_sensitive_text(force=True)`` — the same Tirith-grade redactor — so the prompt honors redaction even when ``security.redact_secrets`` is off. Module-level so the wiring is unit-testable (the call site is a deeply nested gateway closure that cannot be driven directly). rrrTr)rrrw)rrs r>_redact_approval_commandrZs6322222 SYBt < < <_format_exec_approval_fallbackrjs!,/w<<#+=+='$3$-%''7K?GPOOOOOPG WMW X X X X     W NNU~UUU V V V NN6~666777 HH;HH{HHH ))GCRCL ! ! "$:GBK$:$:$: ;rMct|r dSt|r dSt|rdS dS)z@Map raw provider/API errors to a short user-safe Telegram reply.uv⚠️ Provider authentication failed. Check the configured credentials; raw provider details are in the gateway logs.u⚠️ The model provider rejected the request. I kept the raw provider error out of chat; check gateway logs for details or try rephrasing.uX⏱️ The model provider is rate-limiting requests. Please wait a moment and try again.u|⚠️ The model provider failed after retries. I kept raw provider details out of chat; check gateway logs for diagnostics.)_GATEWAY_AUTH_ERROR_REsearch_GATEWAY_PROVIDER_POLICY_RE_GATEWAY_RATE_LIMIT_RErs r>_gateway_provider_error_replyrs}$$T**  <  #))$//  S  $$T**jii ;rMz^\s*(\W*\s*)?(api\s+(?:call\s+)?failed|provider\s+authentication\s+failed|non-retryable\s+error|rate\s+limited\s+after\s+\d+\s+retries|error\s+code\s*:|http\s*\d{3}\b|incorrect\s+api\s+key|invalid\s+api\s+key)c|sdSt|}t|dks|ddkrdSt t |S)uITrue when text is infrastructure/provider failure, not normal content. Two heuristics combined so the rewrite only fires on actual provider error envelopes, not on assistant prose that happens to mention an HTTP status code: 1. The text is short — real provider errors are 1–3 lines of envelope text; assistant answers are usually longer. 2. AND the error marker appears at the start of the message (optionally behind a punctuation/symbol prefix), not buried mid-paragraph in an explanation like "HTTP 404 means 'not found' — ...". F )rwrxr7countr _GATEWAY_PROVIDER_ERROR_SHAPE_REr)rbodys r>"_looks_like_gateway_provider_errorrso u t99??  D 4yy3$**T**Q..u 077== > >>rMcV|s|St|r|Sddlm}|t|}t|t rdStt|}t|rt|S|S)aSanitize final gateway replies before sending them to chat surfaces. Every human-facing chat surface (Telegram, WhatsApp, Discord, Slack, Signal, Matrix, plugin platforms, etc.) should receive concise, safe provider failure categories with secrets redacted instead of raw HTTP bodies, request IDs, leaked credentials, or policy text. Only programmatic surfaces in ``_GATEWAY_RAW_TEXT_PLATFORMS`` (CLI/TUI ``local`` diagnostics, API JSON, webhook payloads) keep the raw text unchanged. r)_sanitize_surrogatesr) ragent.message_sanitizationrrwrx startswithrrrr)rrrrs r> _sanitize_gateway_final_responser"s  '11 @?????  D * *D 4yy##$FGGr23t99==H)(337,X666 OrM event_typemessagecXt|pd}|sdSt|r|St|}t|r*t rt|sdSt|rt|S|S)zFilter/sanitize agent status callbacks before platform delivery. Local/CLI sessions keep the raw diagnostic stream. Messaging gateway surfaces should not receive transient auxiliary/compression chatter. rN) rwrxrr_TELEGRAM_NOISY_STATUS_RErr|_COMPRESSION_PROGRESS_STATUS_RErr)rr#r$rs r>_prepare_gateway_status_messager(s w}"   # # % %D t'11 .t 4 4D ''--  : ; ; /66t<< 4)$//3,T222 KrMcftt|ddpdS)uRender an AgentNotice to a single plaintext line for messaging platforms. Messaging has no persistent status bar (unlike the TUI), so a notice is a one-shot standalone push. The notice policy already bakes the level glyph (⚠ / • / ✕ / ✓) into the text, and the TUI + CLI REPL render that text verbatim — so we emit it as-is here too. Prepending a per-level glyph would DOUBLE it ("⚠ ⚠ Credits 90% used", "⛔ ✕ Credit access paused"). Plaintext only — no markdown — so it renders uniformly across Telegram/Discord/Slack/ SMS without per-platform escaping. Fail-soft: a malformed/empty notice degrades to "" rather than raising on the agent's callback path. rr)rwrVrx)notices r>render_notice_liner+s/ wvvr**0b 1 1 7 7 9 99rMcKt|dd}t|r|||||d{VS||||d{VS)a5Route a status message through adapter.send_or_update_status when supported. Issue #30045: adapters that implement send_or_update_status (currently Telegram) edit the previous bubble for the same status_key instead of appending a new one. Adapters without the method fall back to plain send. send_or_update_statusNr)rVcallablesend)adapterchat_id status_keycontentrsenders r>_send_or_update_status_coror6sW5t < slack mattermost)rVrwry)rr9r:r8platform_value platform_keys r>_resolve_progress_thread_idr@"sXw99N~+,,2244L C    $%%-=)>)>>>4(8Bs#$$$dB%#$$$...3C.#$$$ 4rM user_configr?settingc<t|tr|dnd}t|tsdS|d}t|tsdS||}t|to||vS)zFReturn True when display.platforms. explicitly sets setting.displayNF platformsrtrurv)rAr?rBrDrE platform_cfgs r>_has_platform_display_overriderHBs,6{D,I,ISkooi(((tG gt $ $u K((I i & &u==..L lD ) ) Eg.EErMdefaultrrequire_platform_override_forrJrKct|p|}d|p tD}||vrt|||sdSddlm}|||||} t | t r| St | tr(|  dvS| t |St | S)ajResolve a boolean display setting with optional platform-only opt-in. Some display features expose assistant scratch text rather than deliberate user-facing output. For high-noise threaded chat surfaces such as Mattermost, a global opt-in is too broad: they must be enabled with an explicit display.platforms.. override. c,h|]}t|Sr)rb candidates r> z0_resolve_gateway_display_bool.._s0  **rMFrresolve_display_setting>rorprqrr) rrrHgateway.display_configrSrtrrwrxry) rAr?rBrJrrKcurrent_platform platform_onlyrSrs r>_resolve_gateway_display_boolrWNs /x/G<HH7@355M M)).{L'RR *u>>>>>> # #Kw P PE% %C{{}}""$$(BBB }G}} ;;rMct|d|}|dkr|Sddlmdtjt dt ffd }t ||S)a%Rewrite slash-command mentions to Telegram-valid command names. Telegram Bot API command names allow only lowercase letters, digits, and underscores. Keep other platform renderings unchanged, but normalize Telegram help text so command mentions remain clickable/valid there. rtelegramr)_sanitize_telegram_namematchr-cx|d}|rd|n|dS)Nr(/r)r)r[ sanitizedrZs r>_replacez/_telegramize_command_mentions.._replaces<++EKKNN;; "+?9Q?rM)rVhermes_cli.commandsrZr_Matchrw_TELEGRAM_COMMAND_MENTION_REr)rrr>r_rZs @r>_telegramize_command_mentionsrcusXw99N## ;;;;;;@ @#@@@@@@ ( + +Hd ; ;;rMrcz|dSt|tr|St|trdSt|tt fr4t |dkrt |dz nt |St|t r|}|sdS t |}|dkr|dz n|S#t$rYnwxYw tj | ddS#t$rYdSwxYwdS)aBest-effort conversion of stored gateway timestamps to epoch seconds. Missing/unparseable timestamps return None so legacy transcripts keep the historical auto-continue behaviour instead of being silently dropped. Accepts: datetime, epoch seconds (int/float), epoch milliseconds (when the magnitude exceeds year-2286), ISO-8601 strings (with or without a trailing ``Z``), and numeric strings. Nld( g@@Zz+00:00) rtr timestamprintfloatrwrx ValueError fromisoformatreplace)rrnumerics r>_coerce_gateway_timestamprnsX }t%""!   %t%#u&&X(-e ~(E(EuU||f$$5QV<<W% {{}} 4 DkkG'.'?'?7V##W L    D  )$,,sH*E*EFFPPRR R   44  4s$C C,+C,09D** D87D8c"ddlm}|S)aReturn the configured auto-continue freshness window in seconds. Thin wrapper that delegates to the canonical implementation in ``gateway.session`` (the single source of truth shared with the routing-time zombie gate in ``get_or_create_session``). Reads ``HERMES_AUTO_CONTINUE_FRESHNESS`` (bridged from ``config.yaml`` ``agent.gateway_auto_continue_freshness`` at gateway startup, same pattern as ``HERMES_AGENT_TIMEOUT``). Falls back to the module default when unset or malformed. Non-positive values disable the freshness gate (restores the pre-fix "always fresh" behaviour for users who want to opt out). Kept here so existing call sites and test patches importing it from ``gateway.run`` continue to work. rauto_continue_freshness_window)gateway.sessionrqrps r>_auto_continue_freshness_windowrss%?>>>>> ) ) + ++rMctjd}||dkrttS t|S#t t f$rttcYSwxYw)u8Max seconds ``_finish_startup_restore`` waits on boot auto-resume turns before releasing the inbound gate and draining the queue. While startup restore is in progress the gateway QUEUES every inbound message (``_queue_startup_restore_event``) instead of processing it, so no channel gets a reply until the gate opens. The gate is opened by ``_finish_startup_restore``, which waits for the synthetic boot auto-resume turns to finish. A single long resumed turn therefore held the gate shut for every channel — inbound piled up unanswered for as long as that one turn ran. This bounds that wait. Duplicate-agent safety does NOT depend on the wait: ``_schedule_resume_pending_sessions`` claims each session's ``_running_agents`` slot SYNCHRONOUSLY (before the gate ever runs), so a message drained while a resume turn is still running queues behind that slot rather than spawning a second agent. So on timeout we release the gate and let the slow turn finish in the background. Reads ``HERMES_STARTUP_RESTORE_DRAIN_TIMEOUT`` (bridged from ``config.yaml`` ``agent.gateway_startup_restore_drain_timeout`` at gateway startup, same pattern as the other ``agent.*`` knobs). Non-positive disables the bound (restores the historical "wait forever" behaviour). $HERMES_STARTUP_RESTORE_DRAIN_TIMEOUTNr)rrrvri+_STARTUP_RESTORE_DRAIN_TIMEOUT_SECS_DEFAULT TypeErrorrj)raws r>#_startup_restore_drain_timeout_secsrys0 *..? @ @C {cRii@AAABSzz z "BBB@AAAAABsA %A43A4infoct|trSt|dkr@td|Dr't t t t f|SdS)z*info* as a (thread_id, initial_name) pair, or None if it isn't one. The pair comes back across the relay connector boundary, so its shape is the connector's word rather than ours. c3@K|]}t|tVdSr^rtrw)rbxs r>rdz"_as_thread_info..s-9[9[QR*Q:L:L9[9[9[9[9[9[rMN)rttupler7allrrrw)rzs r>_as_thread_infors] $+3t99>>c9[9[VZ9[9[9[6[6[>E#s(OT*** 4rMrctj|}||dkrt|S t|S#tt f$rt|cYSwxYw)zRead an env var as float, falling back to ``default`` on typos/empty. A misconfigured env var (e.g. ``HERMES_AGENT_TIMEOUT=abc``) must not crash the gateway or an agent turn. Unset/empty also falls back. Nr)rrrvrirwrj)rrJrxs r> _float_envrss *..  C {cRiiW~~Szz z "W~~sA A*)A*desc provenanceActivityProvenance debug_labelc |||dS#t$r t|dYdSwxYw)zJBest-effort activity provenance stamp for hygiene compression transitions.)rTrN)_touch_activityr2r3r4)rrrrs r>%_stamp_hygiene_compression_provenancers`1 dz::::: 111 [4 0000001s&AA)now window_secsrrc|t|ntt}|dkrdSt|}|dS|tjn|}||z |kS)aReturn True when an interruption marker is fresh enough to auto-continue. Unknown timestamps are treated as fresh for backward compatibility with legacy transcripts (pre-dating timestamp persistence) and with in-memory test scaffolding that constructs history entries without timestamps. A non-positive ``window_secs`` disables the gate (always fresh), which restores the pre-fix behaviour for users who opt out via config. NrT)ri%_AUTO_CONTINUE_FRESHNESS_SECS_DEFAULTrnrU)rrrwindowrgcurrents r>_is_fresh_gateway_interruptionr"sv"  " k 8 9 9 {{t)%00It [dikkkcG Y & ((rMr interactivereasonrcv|dkrdn |dkrdnd}|rd}d}n |rd}d}nd }d }d |d |d |d|rd|ndzS)upBuild the resume-pending recovery system note for an interrupted turn. ``reason`` is the session's ``resume_reason`` (``restart_timeout``, ``shutdown_timeout``, or anything else → generic interruption phrasing). ``message`` is the user's NEW message text; empty means this is the startup auto-resume turn synthesized by ``_schedule_resume_pending_sessions`` with no human message attached. ``interactive`` selects the empty-message guidance: on interactive platforms a human is present, so "report the restore and ask what next" is right. On non-interactive event platforms (webhook, API server — adapters with ``interactive_resume = False``) nobody can answer; the resumed turn must instead complete the interrupted work, or the task is silently abandoned behind a "restored" acknowledgement that goes nowhere (#57056). restart_timeoutza gateway restartshutdown_timeoutza gateway shutdownza gateway interruptionzTAddress the user's NEW message below FIRST and focus on what the user is asking now.u\Do NOT re-execute old tool calls — skip any unfinished work from the conversation history.zfReport to the user that the session was restored successfully and ask what they would like to do next.zNo user is present on this non-interactive platform, so do NOT emit a 'session restored' acknowledgement or ask questions. Review the conversation history and CONTINUE the interrupted task to completion.uDo NOT re-run tool calls whose results already appear in the history — resume from the first step that has no recorded result.z3[System note: The previous turn was interrupted by u; the gateway is now back online. Any restart/shutdown command in the history has already run — do NOT re-execute or verify it.  ]rrrN)rr$r reason_phraseresume_guidance tail_guidances r>build_resume_recovery_noter?s0 & & &  ' ' '" ! %   .   =     D   =   ;  +      4C        ' . '   B  0rM) reasoningreasoning_contentreasoning_detailscodex_reasoning_itemscodex_message_items finish_reason._ASSISTANT_REPLAY_FIELDSroler4msgpreserve_timestampc`||d}|d}|dvr5t|tr |r||dkr||d<|dkr6tD].}||vr||}|dkr|%n|s)|||</|r|d}|r||d<|S) u Build a replay entry for a non-tool-calling message, preserving the assistant fields the agent's API builders rely on for multi-turn fidelity. Lifted out of the inline ``run_sync`` closure so the field whitelist can be unit-tested in isolation. Mirrors the ``_ASSISTANT_REPLAY_FIELDS`` contract above. ``preserve_timestamp``: when True, copy the source row's ``timestamp`` onto the replay entry. Currently only user messages need this — the stale-dangerous-confirmation stripper in ``agent/replay_cleanup.py`` reads the timestamp to decide whether a confirmation is too old to replay safely. Assistant/tool messages are not timestamp-stripped in the same way, so we keep the existing default of dropping it. Empty values: most fields are dropped when falsy (matching the original PR #2974 behaviour) since an empty list/string for those carries no information. The exception is ``reasoning_content``: DeepSeek/Kimi thinking-mode replay treats an empty string as a meaningful sentinel that ``_copy_reasoning_content_for_api`` upgrades to a single space. Dropping it here would make the gateway send no ``reasoning_content`` at all on the next turn, which can cause HTTP 400 from strict thinking providers. rr4 api_content)user assistantr4rrNrg)rvrtrwr) rr4rrentry_sidecar_rkey_rvaltss r>_build_replay_entryrs:&*g>>Eww}%%H %%% x % % &  & swwy)) ) )'m {- ! !ECGGENNE+++=!  E%LL$ WW[ ! !  $!#E+  LrMzobserved Telegram group contextz>[Observed Telegram group context - context only, not requests]zh[Current addressed message - answer only this unless it explicitly asks you to use the observed context]channel_promptc2t|ot|vS)aReturn True for Telegram group turns that may include observed chatter. Telegram's observe-unmentioned mode persists skipped group chatter so a later @mention can see it. Those rows must not replay as ordinary user turns: a weak wake word like ``@bot cambio`` should not make the model treat old unmentioned chatter as pending work. The Telegram adapter marks these turns with a channel prompt; this helper keeps the run-path check explicit and unit-testable. )r(_TELEGRAM_OBSERVED_CONTEXT_PROMPT_MARKER)rs r>%_uses_telegram_observed_group_contextrs ]#K~#] ^ ^^rMrxc|tSt|tr d|DSt|}|stSd|dDS)zDNormalize a config list or comma-separated scalar into a string set.Nch|]D}t|#t|ESrN)rwrxras r>rQz&_csv_or_list_to_set..s=GGGdSYY__5F5FGD !!GGGrMc^h|]*}||+SrNrxras r>rQz&_csv_or_list_to_set..s- B B BTTZZ\\ BDJJLL B B BrM,)rrtlistrwrxre)rxss r>_csv_or_list_to_setrs{ {uu #tHGGcGGGG CA uu B BQWWS\\ B B BBrMrzct|ditj}d}|$t|did}|t jdpd}t |S)aReturn Slack channels that the generic gateway must never dispatch. The Slack adapter has the first-line drop, but this runner-level guard is intentionally duplicated as a fail-safe. If a future Slack code path, test hook, malformed event, or stale adapter instance bypasses the Slack plugin adapter, ignored channels still cannot reach auth, pairing, sessions, or the agent/home-channel prompt pipeline. rENextraignored_channelsSLACK_IGNORED_CHANNELS)rVrvPlatformSLACKrgetenvr)rzrGrxs r>+_slack_ignored_channels_from_gateway_configr sz6;3377GGL ClGR00445GHH {i0119T s # ##rMr2c\|sdSt|dddS)zFReturn the parent Slack channel from a possibly thread-scoped chat ID.r:r(r)rwrer2s r>_slack_parent_channel_idr s0 r w<<  c1 % %a ((rMclt|}t|}t|od|vp||vS)zDCheck the generic Slack gateway blacklist for channel or thread IDs.*)rrr)rzr2 channel_idignoreds r>_is_slack_ignored_channelr's=)'22J9&AAG  Hw G*2G I IIrMc@t|tsdS|d}t|tsdS|d}t|tr#t|ddSt|S)a;True when gateway.message_timestamps.enabled is opted in. Default OFF: injecting a ``[Tue 2026-04-28 13:40:53 CEST]`` prefix onto every user message changes what the model sees for all gateway users, so it must be explicitly enabled in config.yaml under ``gateway.message_timestamps.enabled``. Fr9message_timestampsenabled)rtrurvr)rAgwmts r>_message_timestamps_enabledr.s k4 ( (u  # #B b$  u $ % %B"d.BFF9e,,--- 88OrMrinject_timestampshistoryrc\ddlm}ddlm}|}g}g}t |}|pgD]} | d} | s| dvr | dkr'| d} |r<| dkr6t | tr!|| | d | } |rR| d r=| dkr7| r5|t|  d | v} d | v} | dk}| s| s|r5d| D}||| rx| dkrt| } | s2| dr| dd}d|d| } t| | | | dk}||t|}t|}t|t!j}d| pd}||fS)aConvert stored gateway transcript rows into agent replay messages. Observed Telegram group rows are returned as API-only context for the current addressed message instead of being replayed as normal prior user turns. Keeping that context out of ``conversation_history`` avoids consecutive-user repair merging it with the live user turn and then hiding the current message behind ``history_offset`` during persistence. When ``inject_timestamps`` is True (gateway.message_timestamps.enabled), each replayed user message is rendered with a single human-readable timestamp prefix from its stored metadata. r get_timezone)"render_user_content_with_timestampr> session_metasystemr4rrgtzobserved tool_calls tool_call_idtoolc"i|] \}}|dv || S)>rrgrNrbkvs r> z0_build_gateway_agent_history..{s)\\\$!QB[9[9[A9[9[9[rMmirror mirror_sourcezanother sessionz[Delivered from ] )rrrN) hermes_timergateway.message_timestampsrrrvrtrwrrxitems_strip_auto_continue_noiserstrip_interrupted_tool_tailsstrip_dangling_tool_call_tail#strip_stale_dangerous_confirmationsrUrf)rrr _get_msg_tz_render_msg_ts_msg_tz agent_historyobserved_group_contextseparate_observed_contextrrr4has_tool_callshas_tool_call_idis_tool_message clean_msg mirror_srcrobserved_contexts r>_build_gateway_agent_historyrBs&877777kmmG*,M(* En U U}"2(2(wwv   $ $ $  8   '')$$  PJw4L4L$nWcggk.B.BwOOOG $ )<)< T[ " ) )#g,,*<*<*>*> ? ? ? &,)S0&.  (- ( (\\#))++\\\I   + + + +  ( v~~4W==wwx   E WW_6GHH DZDD7DD (gsPTX^P^```E   ' ' '1??M2-@@M849;;Myy!788>>@@HD * **rMpersisted_history live_historyct|trRt|t|kr2ddlmt fd|D}|rt|S|S)aPrefer a cached live transcript only when it is longer and contains at least one real, non-ephemeral unpersisted row. Guards the FTS write-corruption case (#50502): when message writes fail silently through corrupt FTS triggers, the next turn reloads a stale/empty ``conversation_history`` from disk even though the same cached ``AIAgent`` still holds unpersisted real rows in ``_session_messages``. Replacing those rows with the shorter persisted copy causes immediate same-session amnesia. Length alone does not trigger retention. Returns ``persisted_history`` unchanged unless the live copy is a longer list containing at least one real transcript row without the intrinsic ``_db_persisted`` marker. A longer all-durable list can be an expected replay-filtering delta (for example, cleanup of an interrupted read-only tool block). Deliberately unpersisted retry scaffolding is ignored. r)_is_ephemeral_scaffoldingc3K|];}t|to!|d o | Vrdz/_select_cached_agent_history..sp" "  w % % 7KK000 7--g666" " " " " " rM)rtrr7 run_agentrany)rrhas_unpersisted_rowrs @r>_select_cached_agent_historyr s(,%% &#l*;*;cBS>T>T*T*T777777!" " " " ( " " "     & %% % rMrc|s|Std|dtd}t|tr||St|tr{d|D}|D]Q}t|t r:|ddkr!||dd|d<|cSRd|dg|zS|S)zDPrepend observed Telegram context to the API-only current user turn.rrcZg|](}t|trt|n|)SrN)rtruras r> z?_wrap_current_message_with_observed_context..s1VVVdD$!7!7A4:::TVVVrMrrr)rr)_OBSERVED_GROUP_CONTEXT_HEADER!_CURRENT_ADDRESSED_MESSAGE_HEADERrtrwrrurvrstrip)r$rprefixwrappedrcs r>+_wrap_current_message_with_observed_contextrs  * 1 1  1 1 , 1 1 1 '3$#'###'4  EVVgVVV  D$%% $((6*:*:f*D*D"(@$((62*>*>@@V 99:WDD NrMc|sdSt|D]Q}t|ts|d}|r|dvr4|d}||cSdSdS)uIReturn the ``timestamp`` of the last usable transcript row, if any. Skips metadata-only rows (``session_meta``, system injections) that are dropped before being handed to the agent. Returns ``None`` when no usable row carries a timestamp — callers should treat that as "fresh" for backward compatibility. Nr>rrrg)reversedrtrurv)rrrrs r>_last_transcript_timestamprs t   #t$$  wwv t999  WW[ ! ! >IIItt 4rM>image_generatetext_to_speechtext_to_speech_toolbfl_flux3_get_result)rrrz [System note: Your previous turnzystem note: A new messagect|tsdS|tp|tS)zReturn True if this user-message content is a gateway-injected auto-continue note that should NOT be replayed as a real user turn.F)rtrwr!_AUTO_CONTINUE_NOTE_PREFIX_AUTO_CONTINUE_FALLBACK_PREFIX)r4s r>_is_auto_continue_noiser sI gs # #u566 >   < = =rMct|s|St|}t|rK|d}|dkrdS||dzd}t|K|S)aWRemove persisted gateway auto-continue note prefix from user text. Older gateway builds prepended the recovery note directly to the user message, so the transcript row can contain both the synthetic note and the user's real question. Strip one or more leading synthetic notes while preserving any real text that follows. rrrr(N)r rwfindlstrip)r4rends r>rr(s #7 + + w<_collect_auto_append_media_tagsrBOs^..6 #h-->990  +-:: 776??k ) ) GGL))/R : :Dhhtnn;(;(;G*%%+Brvvf~~?&)9)9?R@@D :4 :59$S\\2  :J ' ' 776??"6 6 6 cggn--I1C1CIrJJ  # #G , ,4Q Q Q cggi((.B//(,,W55  ( ( (XW-D-D *W--    '4(( W[[-C-C 9E";;u--D"4-- . 8 8$ I I $,? ? ?"))/4//:::  7 " " #,,W55 3 3E;;q>>''))0077D 3$777!!/4//222 7 * *"&  * **s9G GGrc t i}dtddf fd }|D]}|ddkr|dpgD]}|dp|d }|d pi}t|d p|d pd }|r|r||t|<|D]~}|d}|dkr5t|dd pd } d | vr || S|dvrXt|dd pd } d | vr || t|dp|d pd }||dkr tj| } n#t $rd} YnwxYwt | trb| drMtD]E} | | } t | tr| r | nF S)aCollect every media path already delivered in prior assistant/tool output. Used to dedup auto-appended and model-emitted MEDIA tags so the same file is not re-sent on later turns. Covers three delivery shapes: * ``MEDIA:`` text tags in tool results, * ``MEDIA:`` text tags in assistant messages (model-generated tags), * ``image_generate`` JSON-payload paths (``host_image`` / ``image`` / ``agent_visible_image``), which carry no MEDIA: tag. Missing the JSON-payload shape caused #46627; missing the assistant-message shape caused repeated delivery when the model echoed a previous MEDIA tag. r4r-NcPt|D]S}|dd}|r|Tt j|\}}d|DdS)Nr(r0c3 K|] \}}|V dSr^rN)rbr _is_voices r>rdzN_collect_history_media_paths.._add_text_media_paths..s&==odIT======rM) r6r8rrxrrBasePlatformAdapter extract_mediaupdate)r4r[r media_files_pathss r>_add_text_media_pathsz;_collect_history_media_paths.._add_text_media_pathss#,,W55  E;;q>>''))0077D  $ -:7CC Q ==========rMrrrrr,r-rrr.>rr-rrr/) rrwrvr3r4r2rtrur5r)rr:rMrr;cidr<rrr4r@rAjprLs @r>_collect_history_media_pathsrPsE+- >s >t > > > > > >:: 776??k ) ) --3 : :hhtnn;(;(;XXj))/R266&>>CTXXf-=-=CDD:4:59(S2wwv ;  #'')R006B77G7""%%g...  + + + cggi,,233 w   ! !' * * * #''.))ESWWY-?-?E2FF  # #C ( (,< < < *W--    '4(( W[[-C-C 9E U++B!"c**r "  Ls G  G/.G/ctjd}|rntj|rdSt jtd|tj ddddl }| }|j |j fD]5}|r1tj|r|tjd<dS6 ddl}|tjd<dS#t $rYnwxYwdD]3}tj|r|tjd<dS4dS)aSet SSL_CERT_FILE if the system doesn't expose CA certs to Python. Windows startup paths (Desktop, Scheduled Tasks, installer children) can occasionally inherit a stale SSL_CERT_FILE. Returning just because the variable is present makes every later httpx/OpenAI client construction fail with FileNotFoundError from ssl.load_verify_locations(). Treat a missing path as unset and fall back to certifi instead. SSL_CERT_FILENz?Ignoring stale SSL_CERT_FILE=%r because the path does not existr)z"/etc/ssl/certs/ca-certificates.crtz /etc/pki/tls/certs/ca-bundle.crtz1/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pemz/etc/ssl/ca-bundle.pemz/etc/ssl/cert.pemz/etc/pki/tls/cert.pemz#/usr/local/etc/openssl@1.1/cert.pemz&/opt/homebrew/etc/openssl@1.1/cert.pem)rrrvrrlogging getLoggerrrpopsslget_default_verify_pathscafileopenssl_cafilecertifiwhere ImportError)configured_certrVrLrPrZs r>_ensure_ssl_certsr^ssjnn_55O. 7>>/ * *  F(##++ M     ---JJJ  ( ( * *ElE$89   22 *3BJ ' FF &-mmoo ?#           7>>) $ $ *3BJ ' FF   s-%D D! D! platform_namecZddlm}||}|r|S|dS)aReturn the configured home-target env var for a platform. Consults built-in ``_HOME_TARGET_ENV_VARS`` first, then the plugin registry via ``cron.scheduler._resolve_home_env_var``, then falls back to ``_HOME_CHANNEL`` for unknown names. r)_resolve_home_env_var _HOME_CHANNEL)cron.schedulerraupper)r_raresolveds r>_home_target_env_varrfsN544444$$]33H!!## 2 2 22rMc&t|dS)zDReturn the optional thread/topic env var for a platform home target. _THREAD_ID)rf)r_s r>_home_thread_env_varri%s"=11 = = ==rMc:tdz S)zIReturn True when a /restart completion marker is waiting to be delivered..restart_notify.json) _hermes_homerrNrMr>_restart_notification_pendingrm*s 1 1 9 9 ; ;;rMctdz S)Nz.restart_pending.json)rlrNrMr>"_planned_restart_notification_pathro/s 1 11rMcBtS)zHReturn True when a non-chat planned restart should notify home channels.)rorrNrMr>%_planned_restart_notification_pendingrq3s - / / 6 6 8 88rMcJtddS)NT missing_ok)rounlinkrNrMr>#_clear_planned_restart_notificationrv8s%&((//4/@@@@@rMro_HERMES_GATEWAY)get_hermes_homeget_hermes_home_override)atomic_json_writeis_truthy_value) load_dotenv)load_hermes_dotenv.envr( hermes_home project_envc ddlm}|rttdSt tt t jddz ttdS)a Reload .env for fresh credentials without letting stale .env override config. Gateway processes are long-lived, so per-turn code reloads ~/.hermes/.env to pick up rotated API keys. config.yaml remains authoritative for agent budget settings such as agent.max_turns; otherwise a stale HERMES_MAX_ITERATIONS in .env can replace the startup bridge on later turns. In multiplex mode this is a NO-OP for the credential reload: secrets come from the per-turn ``set_secret_scope`` (installed by ``_profile_runtime_scope``) which loads the routed profile's ``.env`` into an isolated mapping. Mutating the process-global ``os.environ`` here would defeat that isolation and leak the default profile's keys to every profile's turns and subprocesses. ris_multiplex_activeNr(r~r) agent.secret_scoper_bridge_max_turns_from_configrlr}rrrparentsrs r>/_reload_runtime_env_preserving_config_authorityrRs766666 &l333 NN**,,4Q7&@",/////rMhomerc|dz }|sdS ddlm}m}||}||}t |t si} ddlm}|j|}n#t$rYnwxYwn#t$rYdSwxYw| di}t |t r&d|vr"t|dtj d<| d i}t |t rNd |vr"t|d tj d <d |vr&t|d tj d <dSdSdS)zIBridge config.yaml agent.max_turns into HERMES_MAX_ITERATIONS (a global). config.yamlNr_expand_env_varsread_user_config_raw managed_scoper max_turnsHERMES_MAX_ITERATIONSsessionscjk_ftsHERMES_CJK_FTSsearch_slow_msHERMES_SEARCH_SLOW_MS)rhermes_cli.configrrrtru hermes_clirapply_managed_overlayr2rvrwrr)r config_pathrrcfgr agent_cfg sessions_cfgs r>rros&K     LLLLLLLL#";//s###t$$ C   0 0 0 0 0 05-5c::CC    D  $$I)T""J{i'?'?.1)K2H.I.I *+77:r**L,%%V  $ $+.|I/F+G+GBJ' ( | + +25lCS6T2U2UBJ. / / / VV , +s55A;A*)A;* A74A;6A77A;; B B ct ttjddS#tt f$rYdSwxYw)zGReturn the current per-turn iteration budget after runtime env refresh.r500)rrhrrrwrjrNrMr>_current_max_iterationsrsU3555294e<<=== z "sss!2AA)contextmanager)PORT_BINDING_PLATFORM_VALUESplatform_binds_portceZdZdZdS)MultiplexConfigErroraA profile multiplexer config is invalid. Distinct from a transient adapter-connect failure: a config error means the operator must fix config.yaml. Fatal configuration errors propagate to the startup guard instead of being treated as retryable adapter noise. Nr __module__ __qualname____doc__rNrMr>rrsrMrceZdZdZdS)SecondaryPortBindingConfigErrorzEA secondary profile conflicts with the multiplexer's shared listener.NrrNrMr>rrsOOOOrMr profile_homec#HKddlm}m}ddlm}m}m}ddlm}|t|}|t|||t|} dV||||dS#||||wxYw)uScope config/skills/memory AND credentials to a profile for one turn. Combines the two seams the multiplexer needs: 1. ``set_hermes_home_override`` — redirects ``get_hermes_home()`` (config, skills, memory, SOUL, sessions) to the profile's home. Contextvar, so it propagates into the agent worker thread via ``copy_context()``. 2. ``set_secret_scope`` — installs the profile's ``.env`` secrets as the authoritative credential source, so ``get_secret`` reads this profile's keys and never the process-global ``os.environ`` (which in a multiplexer may hold another profile's values). Only used on the multiplexed inbound path. Single-profile gateways never enter this scope, so their behavior is unchanged. Loading the profile's ``.env`` here does NOT mutate ``os.environ`` — ``build_profile_secret_scope`` returns an isolated dict — which is what keeps subprocesses (MCP, kanban) from inheriting cross-profile secrets. r)set_hermes_home_overridereset_hermes_home_override)build_profile_secret_scopeset_secret_scopereset_secret_scope)hydrate_profile_secret_sourcesN) hermes_constantsrrrrrrhermes_cli.env_loaderrrwr) rrrrrrr home_token secret_tokens r>_profile_runtime_scopers&VUUUUUUU EDDDDD))#l*;*;<$>tL?Q?Q$R$RSSL/ <((("":..... <((("":....s -B B! GatewayConfigcnt}t|dds|S t}n#t$r|cYSwxYw t t |5tcdddS#1swxYwYdS#t$r!t dd|cYSwxYw)u.Load gateway config for the process-level GatewayRunner. When ``gateway.multiplex_profiles`` is off, this is identical to ``load_gateway_config()`` (legacy single-profile path). When multiplexing is on, reload under the default/active profile's ``_profile_runtime_scope`` so platform tokens in that profile's ``.env`` resolve through the secret scope — the same path secondary profiles use in ``_start_one_profile_adapters``. Without this, primary startup calls ``load_gateway_config()`` unscoped: ``_getenv`` falls through to ``os.environ``, which often has no ``TELEGRAM_BOT_TOKEN`` once the token lives only under ``profiles//.env`` (#64674). Single-profile gateways never set ``multiplex_profiles``, so they keep the unscoped load and are unaffected. multiplex_profilesFNzAmultiplex default-scope config reload failed; using unscoped loadTr)load_gateway_configrVrxr2rrr3r4)rrs r>load_gateway_config_for_runnerrs,"   C 3,e 4 4      #DJJ / / ) )&(( ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )  O     sE2 AAB !A</ B <BB BB (B43B4rplatform_configPlatformConfigcddlm}||vrdSt|ddpd}t|tr|rdSt|ddpd}t|tr|rdSdS) zReturn True when a token-authenticated platform has a usable bot credential. Platforms that do not use ``PlatformConfig.token`` always return True so we never skip them here (Signal session paths, port-binding HTTP adapters, etc.). r)PLATFORM_TOKEN_ENV_NAMESTtokenNrapi_keyF)gateway.configrrVrtrwrx)rrrrrs r>_platform_has_bot_credentialrs 877777///t OWd 3 3 9rE%%++--toy$77=2G'3GMMOOt 5rMz=^(?P.+):(?P/[^:]+?)(?::(?P[^:]+))?$z/outputz/outputsDEFAULT_CONFIGgateway_turn_lease_timeoutHERMES_TURN_LEASE_TIMEOUTrrrterminalbackend TERMINAL_ENV degraded_modeTERMINAL_DEGRADED_MODEcwd TERMINAL_CWDtimeoutTERMINAL_TIMEOUT home_modeTERMINAL_HOME_MODElifetime_secondsTERMINAL_LIFETIME_SECONDS docker_imageTERMINAL_DOCKER_IMAGEdocker_forward_envTERMINAL_DOCKER_FORWARD_ENVsingularity_imageTERMINAL_SINGULARITY_IMAGE modal_imageTERMINAL_MODAL_IMAGE daytona_imageTERMINAL_DAYTONA_IMAGEvercel_runtimeTERMINAL_VERCEL_RUNTIMEssh_hostTERMINAL_SSH_HOSTssh_userTERMINAL_SSH_USERssh_portTERMINAL_SSH_PORTssh_keyTERMINAL_SSH_KEY container_cpuTERMINAL_CONTAINER_CPUTERMINAL_CONTAINER_MEMORYTERMINAL_CONTAINER_DISKTERMINAL_CONTAINER_PERSISTENTTERMINAL_DOCKER_VOLUMESTERMINAL_DOCKER_ENVTERMINAL_DOCKER_EXTRA_ARGSTERMINAL_DOCKER_SHM_SIZE&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACETERMINAL_DOCKER_NETWORK TERMINAL_DOCKER_RUN_AS_HOST_USER(TERMINAL_DOCKER_PERSIST_ACROSS_PROCESSESTERMINAL_DOCKER_ORPHAN_REAPERTERMINAL_SANDBOX_DIRTERMINAL_PERSISTENT_SHELL)container_memorycontainer_diskcontainer_persistentdocker_volumes docker_envdocker_extra_argsdocker_shm_sizedocker_mount_cwd_to_workspacedocker_networkdocker_run_as_host_userdocker_persist_across_processesdocker_orphan_reaper sandbox_dirpersistent_shell>rautor  auxiliary>visionapproval web_extract)get_plugin_auxiliary_taskskeyprovidermodelbase_urlrr  AUXILIARY_ _PROVIDER_MODEL _BASE_URL_API_KEYrrgateway_timeoutHERMES_AGENT_TIMEOUTgateway_timeout_warningHERMES_AGENT_TIMEOUT_WARNINGgateway_notify_intervalHERMES_AGENT_NOTIFY_INTERVALsession_stall_timeoutHERMES_SESSION_STALL_TIMEOUTrestart_drain_timeoutHERMES_RESTART_DRAIN_TIMEOUTgateway_auto_continue_freshnessHERMES_AUTO_CONTINUE_FRESHNESS%gateway_startup_restore_drain_timeoutrurrrrrrDbusy_input_modeHERMES_GATEWAY_BUSY_INPUT_MODEbusy_text_modeHERMES_GATEWAY_BUSY_TEXT_MODEbusy_ack_enabledHERMES_GATEWAY_BUSY_ACK_ENABLEDbusy_steer_ack_enabled%HERMES_GATEWAY_BUSY_STEER_ACK_ENABLEDtimezoneHERMES_TIMEZONEsecurityredact_secretsHERMES_REDACT_SECRETSr9strict0HERMES_MEDIA_DELIVERY_STRICTmedia_delivery_allow_dirsc#8K|]}|t|VdSr^rwrbps r>rdrds.5W5WUV5Wc!ff5W5W5W5W5W5WrMHERMES_MEDIA_ALLOW_DIRStrust_recent_filesHERMES_MEDIA_TRUST_RECENT_FILEStrust_recent_files_seconds!HERMES_MEDIA_TRUST_RECENT_SECONDSplatform_connect_timeout'HERMES_GATEWAY_PLATFORM_CONNECT_TIMEOUTu. Warning: config.yaml → env bridge failed: : )filezz Gateway will fall back to .env values, which may not match your current config.yaml. Run `hermes doctor` to investigate.)apply_ipv4_preference_cfgnetwork force_ipv4rz/ Warning: IPv4 preference application failed: )print_config_warningsz% Warning: config validation failed: )warn_deprecated_cwd_env_varsz% Warning: deprecation check failed: HERMES_QUIETHERMES_EXEC_ASK)CWD_PLACEHOLDERS resolve_placeholder_terminal_cwd MESSAGING_CWDfalse>rorqrr)configured_cwdterminal_backend messaging_cwdr home_fallback)ChannelOverrider_BUILTIN_PLATFORM_VALUESrr_getenvr) AsyncSessionStore SessionEntry SessionStore SessionSourceSessionContextbuild_session_contextbuild_session_context_promptbuild_channel_continuity_notebuild_session_keyis_shared_multi_user_session neutralize_untrusted_inline_text)DeliveryRouter#looks_like_telegram_private_chat_idresolve_delivery_transport)DEFAULT_LEASE_WAITSessionTurnLeaseRegistryTurnLeaseTimeoutError)SERVICE_TIER_UNSET SessionStatelegacy_dict_propertylegacy_lease_token_property)GatewayAuthorizationMixin)GatewayKanbanWatchersMixin)GatewaySlashCommandsMixin) TurnContext) rGEphemeralReply MessageEvent MessageType_prefix_within_utf16_limit_reply_anchor_for_eventbuild_auto_tts_output_pathmerge_pending_message_event utf16_len)DEFAULT_HEARTBEAT_INTERVAL_S_arm_loop_floor_timerarm_shutdown_watchdogloop_heartbeat_foreverresolve_shutdown_watchdog_delaystart_loop_liveness_watchdog)*DEFAULT_GATEWAY_RESTART_AFTER_TURN_TIMEOUT%DEFAULT_GATEWAY_RESTART_DRAIN_TIMEOUTGATEWAY_FATAL_CONFIG_EXIT_CODE!GATEWAY_SERVICE_RESTART_EXIT_CODE parse_restart_after_turn_timeoutparse_restart_drain_timeout)canonical_whatsapp_identifierexpand_whatsapp_aliasesnormalize_whatsapp_identifier)WECOM_DM_POLICYWECOM_GROUP_POLICYWECOM_ALLOW_ALL_USERS)WEIXIN_DM_POLICYWEIXIN_GROUP_POLICYWEIXIN_ALLOW_ALL_USERS)YUANBAO_DM_POLICYYUANBAO_GROUP_POLICYYUANBAO_ALLOW_ALL_USERS)NNQQ_ALLOW_ALL_USERS)WHATSAPP_DM_POLICYWHATSAPP_GROUP_POLICYWHATSAPP_ALLOW_ALL_USERSc.t|diD]o\}}t|ddst|}|s5|\}}}t|ddpi}t |dp|rt |dnd}t |dp|rt |dnd} |d kr| d krtj d d d v} | p%|o#t |d d v} | re|j d cSdS)zFReturn a startup-abort reason when open policy lacks allow-all opt-in.rErFrN dm_policypairing group_policyopenGATEWAY_ALLOW_ALL_USERSr>rorqrrz&: open policy without allow-all opt-in) rVr_OWN_POLICY_OPEN_ENVrvrwrWrxryrrr) rzrropen_envdm_env group_env allow_all_envrrrgateway_allow_allplatform_opted_ins r>"_own_policy_open_startup_violationr s%,V["%E%E%K%K%M%MII!/ 599  '++H55  +3( =$77=2 IIk " " E.4C ***)   %''%%''  IIn % % K1:I 9---    %''%%''    <6#9#9 I %r  %'')*.  K r**00226JJ    .HHHHHH 4rM) _session_model_overrides _pending_one_turn_model_restores_session_reasoning_overrides_session_service_tier_overrides_pending_model_notes_last_resolved_model_queued_events_session_stall_notified_pending_turn_sidecar_notes_CONVERSATION_SCOPED_STATEc ddlm}m}m}ddlm}m} |}n#|$rw}||rtd|ntd|t}||cYd}~St|||d}~wt$r}t|||d}~wwxYw|} d} tj d} | r* t| } nZ#t t"f$rd} YnEwxYwt%| t&r,| d} t%| tr| } | 2|d } t%| tr| dkr| } |d |d |d |d |d|dt)|dpg|d| d S)u5Resolve provider credentials for gateway-created AIAgent instances. Provider is read from ``config.yaml`` ``model.provider`` (the single source of truth). ``resolve_runtime_provider()`` falls through to env var lookups internally for legacy compatibility, but the gateway does not consult environment variables for behavioral config — config.yaml is authoritative. If the primary provider fails with an authentication error, attempt to resolve credentials using the fallback provider chain from config.yaml before giving up. r)resolve_runtime_providerformat_runtime_provider_error_get_model_config) AuthErroris_rate_limited_auth_erroru;Primary provider rate-limited (429): %s — trying fallbacku4Primary provider auth failed: %s — trying fallbackNHERMES_MAX_TOKENS max_tokensmax_output_tokensrrrrequested_providerapi_moderargscredential_pool rrrrrrrrr)hermes_cli.runtime_providerrrrhermes_cli.authrrr3r_try_resolve_fallback_provider RuntimeErrorr2rrrvrhrjrwrtrur)rrrrrruntimeauth_exc fb_configr< model_cfgr_env_mtr _runtime_mots r>_resolve_runtime_agent_kwargsr s FEEEEEEEH**,,  R R R & %h / / ] NNXZb c c c c NNQS[ \ \ \244        88BBCCQ HHH88==>>CGH"!##IJjnn011G WJJI&   JJJ  It $ $ ]]< ( ( b#   J{{#677 lC ( ( &\A-=-=%J;;y))KK ++KK ++%kk*>??KK ++;;y))W[[((.B//";;'899    s? CAB7C=B C#B<<C2DDDc ddlm}m} ||}n+#t$r}t |||d}~wwxYw|d|d|d|d|d |d t |d pg|d d S)zQResolve runtime credentials for a specific provider (e.g. from channel override).r)rr) requestedNrrrrrrrr)rrrrrrrr)rrrr2rrvr)rrrrr<s r>*_resolve_runtime_agent_kwargs_for_providerrQ sH**X>>> HHH88==>>CGH;;y))KK ++KK ++%kk*>??KK ++;;y))W[[((.B//";;'899   s  ?:?c,|r!t|sdS tt|dS#t$r!t d|dYdSwxYw)zJReturn the live credential pool for a provider id (e.g. ``custom:hyper``).Nrz1Failed to resolve credential pool for provider=%sTr)rwrxrrvr2r3r4)rs r>_credential_pool_for_providerrg s 3x==..00t 9#h--:M:M:O:OPPTT      ?     tt sAA(('BBc ddlm} t}t|}|sdS|D]} ddlm}||d|d||}td|dp|d|d |d |d|d|d |d |d t|dpg|d|d d cS#t$r:}t d|d|Yd}~d}~wwxYwn#t$rYnwxYwdS)zQAttempt to resolve credentials from the fallback_model/fallback_providers config.r)rN)resolve_entry_api_keyrr)rexplicit_base_urlexplicit_api_keyz'Fallback provider resolved: %s model=%srrrrrrr) rrrrrrrrrzFallback entry %s failed: %s) rr_load_gateway_runtime_configr"hermes_cli.fallback_configrrvr3rzrr2r4)rrfb_listrrrfb_excs r>rrx s!DDDDDD) +,,$S)) 4  E LLLLLL22#ii 33&+ii &;&;%:%:5%A%A =IIj))DW[[-D-DIIg&& '{{955 ' J 7 7 ' J 7 7*1++6J*K*K ' J 7 7&{{955 V!4!4!:;;'.{{3D'E'E"YYw//         ;UYYz=R=RTZ[[[ ; @      4s@GGEFG G/G GGG G&%G&indexcbt|ddpg}|t|kr||ndS)zReturn the per-attachment MIME for the attachment at *index*. Empty string when the platform didn't populate a per-file MIME for that slot (some adapters only set a message-level type). media_typesNr)rVr7)eventrrs r>_event_media_type_atr s< %55;K!&[)9)9!9!9;u  rArMct||}|r|dSt|ddtjkS)aTrue if the attachment at *index* is an image. Trust the per-attachment MIME when present. Only fall back to the message-level ``PHOTO`` type when this attachment's MIME is unknown -- otherwise a document (or any non-image) uploaded alongside an image in the same message gets mis-routed as an image, base64'd into a vision content part, and the provider 400s ("Could not process image"). image/ message_typeN)rr!rVrsPHOTOrrmtypes r>_event_media_is_imager sI ! . .E *))) 5.$ / /;3D DDrMct||}|r|dSt|ddtjtjhvS)zGTrue if the attachment at *index* is audio (per-attachment MIME first).audio/rN)rr!rVrsVOICEAUDIOrs r>_event_media_is_audior sO  . .E *))) 5.$ / /K4E{GX3Y YYrMct|dd}|tjtjhvrdS|tjkp"t ||dS)zFTrue when an audio attachment should enter the automatic STT pipeline.rNFr)rVrsrDOCUMENTrrr!)rrrs r>_event_media_is_stt_inputr s_5.$77L );+?@@@u )) C u - - 8 8 B BrMct||}|r|dSt|ddtjkS)zGTrue if the attachment at *index* is video (per-attachment MIME first).video/rN)rr!rVrsVIDEOrs r>_event_media_is_videor sG  . .E *))) 5.$ / /;3D DDrMcg}t|ddpg}t|D]\}}t||r|d|d/t ||r|d|dYt ||r|d|d|d|dd|S) agBuild a text placeholder for media-only events so they aren't dropped. When a photo/document is queued during active processing and later dequeued, only .text is extracted. If the event has no caption, the media would be silently lost. This builds a placeholder that the vision enrichment pipeline will replace with a real description. media_urlsNz[User sent an image: rz[User sent audio: z[User sent a video: z[User sent a file: r)rV enumeraterrrrrf)rrgriurls r>_build_media_placeholderr s E d339rJJ''773  * * 7 LL7777 8 8 8 8 "5! , , 7 LL4c444 5 5 5 5 "5! , , 7 LL6666 7 7 7 7 LL5s555 6 6 6 6 99U  rM display_name agent_pathrcP|dr d|d|dSd|d|dS)ufContext note prepended to a user turn when they attach a document. Text documents (``text/*``) have their content inlined upstream by the platform adapter, so the note just confirms that and records the path. Binary documents (PDF, DOCX, XLSX, …) cannot be inlined as text. The note must tell the agent to *extract* the text itself before answering — earlier wording ("Ask the user what they'd like you to do with it") steered the model into punting back to the user, which is why attached PDFs/DOCX looked "unreadable" to the agent even though it has the tools to read them. ztext/z![The user sent a text document: 'zC'. Its content has been included below. The file is also saved at: rz[The user sent a document: ''. It is saved at: u . Its text is not inlined here (it's a binary format such as PDF or DOCX). To read it, extract the document's text yourself — for example with the terminal tool or the ocr-and-documents skill — before answering, instead of asking the user to paste the contents.])r!)rrrs r>_build_document_context_noter si     8  8 8*4 8 8 8  6| 6 6  6 6 6rMsecondsctt|}|dkrd}t|d\}}t|d\}}|r |d|dd|dS|d|dS)Nrrd<r02d)rhrounddivmod)rtotalhoursremminutessecss r>_format_durationr s g  E qyyt$$JE33OOMGT 322'2222222 " " " " ""rMrc JKtjd}|dkrG dtffd }t j|d{V}t|S#t$rYnwxYw|dvrG dtffd }t j|d{V}t|S#t$rYnwxYw t j dd d d d d dt j j t j j  d{V}t j | dd{V\}}|jdkr@tt |Sn#t$rYnwxYwdS)zSBest-effort duration probe. Returns formatted MM:SS / HH:MM:SS, or None on failure.r(z.wavr-cddl}|d5}|}|pd}|t |z cdddS#1swxYwYdS)Nrrbr()waver getnframes getframerateri)rwfframesraters r> _wav_durationz,_probe_audio_duration.._wav_duration s YYtT**0b]]__F??,,1D!E$KK/000000000000000000s _ogg_durationz,_probe_audio_duration.._ogg_duration+ s1333333WWT]]/6777rMffprobe-vrPz -show_entrieszformat=durationz-ofz"default=noprint_wrappers=1:nokey=1)stdoutstderrr&rr)rrsplitextryriasyncio to_threadrr2create_subprocess_exec subprocessPIPEwait_for communicate returncodedecoderx)rextr rrprocrrKs` r>_probe_audio_durationr" s7 '  4  # ) ) + +C f}}  05 0 0 0 0 0 0 !*=99999999D#D)) )    D  '''  85 8 8 8 8 8 8!*=99999999D#D)) )    D   3 tWo7H 7%*73E3J          "*4+;+;+=+=sKKKKKKKKK  ?a  #E&--//*?*?*A*A$B$BCC C       4s75A88 BB 5C CCB=F F F c,||S)zConsume and return the full pending event for a session. Queued follow-ups must preserve their media metadata so they can re-enter the normal image/STT/document preprocessing path instead of being reduced to a placeholder string. )get_pending_message)r1r+s r>_dequeue_pending_eventr%B s  & &{ 3 33rMzStop requestedzSession reset requestedz Execution timed out (inactivity)zSSE client disconnectedzGateway shutting downzGateway restarting)is_still_currenttask_idsourcer&c|sdS|X |std||dSn.#t$r!td||dYnwxYwddlm} ||||}n/#t$r"td ||dYdSwxYw|rtd ||||S) uReap only background processes created by one abandoned turn. ``task_id`` is session-scoped (task_id == session_id), not turn-scoped, so a *replacement* turn on the same session can start and spawn its own legitimate process while this reap is still in flight. ``is_still_current`` — a closure over the run_generation captured when the reaping turn began or was interrupted — lets the caller detect that a newer turn has since claimed the session and bail out instead of killing that newer turn's process. The newer turn snapshots its own baseline independently, so skipping here does not leave anything permanently unreaped. rNzdSkipping reap for turn %s (%s): a newer turn already claimed this session; it owns its own baseline.z>is_still_current check failed for turn %s (%s); reaping anywayTrprocess_registryr(z4Failed to reap background processes for turn %s (%s)zBReaped %d background process(es) created by abandoned turn %s (%s))r3r4r2tools.process_registryr+kill_started_sincer)r'process_baseliner(r&r+killeds r>_reap_gateway_turn_processesr1T sk$ q# ##%%  F  q     LLP       877777!44  5        B      qq   P       Ms!&1(AA&A??(B+*B+ worker_done timeout_fired cleanup_lockc|5|s|r ddddS|dddn #1swxYwY|r|dnd}|C t|tn,#t$rt ddYnwxYw t||d|n-#t$r t d |dYnwxYwdS) z@Interrupt one timed-out turn and reap only processes it created.NFrz Timed-out agent interrupt failedTrgateway_turn_timeoutr(r&z9Failed to reap background processes for timed-out turn %s) is_setrr_INTERRUPT_REASON_TIMEOUTr2r3r4r1r) agent_holderr'r/r2r3r4r&rs r>_abandon_timed_out_gateway_turnr; s       =#7#7#9#9   , 5LOOE  L "5*C D D D D L L L LL;dL K K K K K L  $  )-          G        4s:*AAA!A4B &B32B37C 'C54C5) poll_intervalr&r<c V|td|s|r|dnd} | t| dsB t| dd} n#t $rYwxYw| |krt|||||||dSdS)zFThread watchdog that remains runnable when gateway asyncio is starved.g{Gz?rNget_activity_summaryseconds_since_activityr:r'r/r2r3r4r&)waitmaxrrir>rvr2r;) r:r'r/rr2r3r4r<r&r idle_secondss r>_watch_gateway_turn_inactivityrE ss47788#/9 QT =/E F F=   **,,001I3OOLL    H  ' ! ! '%-#'%-     +s5A:: BBc|sdSdt|}|t vS)z?Return True when an interrupt message is internal control flow.Fr)rfrwrxrery_CONTROL_INTERRUPT_MESSAGES)r$ normalizeds r>_is_control_interrupt_messagerI sV u#g,,,,..446677==??J 4 44rMresponsec||\}}|dd}|dd}|S)uReturn the visible text portion of a response before direct send(). Queued follow-up resends only replay explicit ``MEDIA:`` attachments in this path. Keep bare local paths and ordinary image URLs visible because the post-stream uploader intentionally ignores them (#20834). Do not apply a broad ``MEDIA:`` regex after ``extract_media()`` — the extractor deliberately preserves protected code/inline spans and unsupported or unvalidated tags in the cleaned text. r1r[[as_document]])rHrlrx)rJr1rKcleaneds r>+_strip_response_attachments_for_direct_sendrN si&&x00JAwoo2B77==??Goo/44::<"'r-rKz [^a-z0-9-]rz-{2,}) read_textr2r#r!r" splitlinesrxrer7ryrlr_r)rOr4r$ declared_namelinerxslug_res r>_skill_slug_from_frontmatterr^ s&$$gi$HH zznnX&&G   e $ $z ,,w " "C Qwwz $M#))++zz|| ??7 # # **S!$$Q'--//C3xx1}}Q3r7!2!2s1v7K7K!B$iIIKKM E   z    ( (c 2 2 : :3 D DD 77="d + +D 778S$ ' ' - -c 2 2D #]""  s  (( command_namec\|dd} ddlm}ddlm}m}|}|D]f}|s|dD]9}||rt|\}} |r| s%||kr| |vr d|dccS:gdd l m } ttjj} | | d z } | r| dD]z}||rt|\}} |s#||krQ|j| }t#|j}d d |}d|d |dcS{n#t($rYnwxYwdS)uCheck if a command matches a known-but-inactive skill. Returns a helpful message if the skill exists but is disabled or only available as an optional install. Returns None if no match found. The slug for each on-disk skill is derived from its frontmatter ``name:`` (via :func:`_skill_slug_from_frontmatter`), NOT from its containing directory name — because the two can differ (e.g. directory ``stable-diffusion`` + frontmatter ``Stable Diffusion Image Generation`` yields slug ``stable-diffusion-image-generation``). Matching on directory name would miss that slug entirely and fall through to the generic "unknown command" path. rKrWr)_get_disabled_skill_names)get_all_skills_dirsis_excluded_skill_pathzSKILL.mdThe **zJ** skill is installed but disabled. Enable it with: `hermes skills config`)get_optional_skills_dirzoptional-skillsz official/r]zQ** skill is available but not installed. Install it with: `hermes skills install rN)ryrltools.skills_toolraagent.skill_utilsrbrcrrglobr^rrerrrr relative_torrgrfr2)r_rHrarbrcdisabled skills_dirrOr\rZre repo_root optional_dir _declaredrelrg install_paths r>_check_unavailable_skillrq? s##%%--c377J, ??????QQQQQQQQ,,...-//  J$$&& &,,Z88  ))(33&B8&L&L#m=:%%-8*C*CBBBB  =<<<<<NN**,,3: ..y;L/LMM     (..z::  ))(33">x"H"Hi:%%"/55lCCC OOE#@sxx#@#@LSSSCOSSS &      4sBF1C(FF F)(F)c4|tjkrdn|jS)uNMap a Platform enum to its config.yaml key (LOCAL→"cli", rest→enum value).cli)rLOCALrrs r>_platform_config_keyru s..55HNBrMct}t|ddg}t|tsdSd|vpd|vS)zAReturn True when the standalone Teams pipeline plugin is enabled.pluginsrrJFteams_pipelinezteams-pipeline)rsr!rtr)rzrs r>_teams_pipeline_plugin_enabledrz sP ! # #FfiB???G gt $ $u w & E*:g*EErMcNt}|rt|StS)z_gateway_config_homer} s''))HH~~ rMct}|dz }i}d} ddlm}m}||kr |}d}n#t$rYnwxYw|s |rEddl}t|dd 5}||pi}dddn #1swxYwYn-#t$r t d |i}YnwxYw dd l m }|j t|tr|ni}n#t$rYnwxYwt|tsiS dd lm} | |}n#t$rYnwxYw|S) uLoad and parse ~/.hermes/config.yaml, returning {} on any error. Uses the module-level ``_hermes_home`` (so tests that monkeypatch it still see their fixture) and shares the mtime-keyed raw-yaml cache from ``hermes_cli.config.read_raw_config`` when the paths match. Managed scope is overlaid on the result (via the shared helper) so the gateway honors administrator-pinned values — neither read_raw_config nor a direct yaml.safe_load carries the managed merge on its own. Fail-open. rFr)get_config_pathread_raw_configTNrrQrRz%Could not load gateway config from %sr)_normalize_root_model_keys)r}rrrr2ryamlr safe_loadr3r4rrrrtrur) config_homerrxused_canonicalrrrfrrs r>rsrs s/'((K -KCN  FFFFFFFF //++ + +!/##C!N        !!## 2 +sW===2..++1rC222222222222222    LL@+ N N NCCC  ,,,,,,1m1C9N9N2V##TVWW      c4   @@@@@@((--      Jsi"< A A *B)9B B)B!!B)$B!%B))'CC-D DD-D?? E  E ct|tr|dini}t|trd|i}nt|tsi}ddlm}|d}|d|d|d|d|d|d|d|ddS) a,Translate gateway checkpoint config into ``AIAgent`` constructor args. The gateway reads raw YAML instead of ``load_config()``, so checkpoint defaults must be supplied here. Keep legacy ``checkpoints: true`` configs working while giving every gateway-created agent the same limits. checkpointsrrr max_snapshotsmax_total_size_mbmax_file_size_mb)checkpoints_enabledcheckpoint_max_snapshotscheckpoint_max_total_size_mbcheckpoint_max_file_size_mb)rtrurvrrr)rzcp_cfgrdefaultss r>_checkpoint_agent_kwargsr s/9.F.F NVZZ r * * *BF&$V$  % %000000m,H%zz)Xi5HII$*JJ Xo6% % )/ *=!>) ) (.zz ); <( (    rMct}t|tr|siSddlm}||}t|tr|niS)uLoad gateway config for runtime reads, expanding supported ``${VAR}`` refs. Runtime helpers should honor the same env-template expansion documented for ``config.yaml`` while still respecting tests that monkeypatch ``gateway.run._hermes_home``. Build on ``_load_gateway_config()`` rather than calling the canonical loader directly so both behaviors stay aligned. Expansion failures are intentionally NOT swallowed — silently returning the unexpanded dict would mask the very bug this helper exists to fix. rr)rsrtrurr)rrexpandeds r>rr sh  C c4  222222$$H!(D11 988r9rMc||n t}|di}t|tr|St|tr,|dp|dpdSdS)uRead model from config.yaml — single source of truth. Without this, temporary AIAgent instances (e.g. /compress) fall back to the hardcoded default which fails when the active provider is openai-codex. NrrJr)rsrvrtrwru)rzrrs r>_resolve_gateway_modelr s&&&,@,B,BC$$I)S!!H It $ $H}}Y''G9==+A+AGRG 2rM thread_id parent_idrrcg}t}|||fD]C}|st|}||vr||||D|S)zOrdered, de-duplicated keys for ``channel_overrides`` lookup. Matches ``resolve_channel_prompt`` semantics: exact thread/channel id first, then parent channel/forum id (Discord threads inherit parent overrides). )rrwrr)r2rrkeysrrsks r>_channel_override_lookup_keysr soDUUDI.   XX ::    B KrMct|dd}|sdS||}|r|jsdS|j}t|||D]}||} | | cSdS)zReturn per-channel override for this platform/chat_id, or None. Looks up ``channel_overrides`` by ``chat_id``, then ``thread_id``, then ``parent_id`` (forum threads / child channels inherit the parent entry). rENr)rVrvchannel_overridesr) rzrr2rrrEr overridesrovs r>_get_channel_overrider, s T22I tmmH--O /"Ct1I,9 ]]3   >III  4rMcddl}|d}|r|gS ddl}|jdt jddgSn#t$rYnwxYwdS)usResolve the Hermes update command as argv parts. Tries in order: 1. ``shutil.which("hermes")`` — standard PATH lookup 2. ``sys.executable -m hermes_cli.main`` — fallback when Hermes is running from a venv/module invocation and the ``hermes`` shim is not on PATH Returns argv parts ready for quoting/joining, or ``None`` if neither works. rNhermesrz-mzhermes_cli.main)shutilwhichimportlib.utilutil find_specr executabler2)r hermes_bin importlibs r>_resolve_hermes_binrI sMMMh''J|  > # #L 1 1 =ND*;< < >       4s,A AAz dict | Nonec |d}t|dkrZ|ddkrN|ddkrB|d|d|d d }t|dkr|dd vr |d|d <|Sd S)a@Parse a session key into its component parts. Session keys follow the format ``agent:main:{platform}:{chat_type}:{chat_id}[:{extra}...]``. Returns a dict with ``platform``, ``chat_type``, ``chat_id``, and optionally ``thread_id`` keys, or None if the key doesn't match. The 6th element is only returned as ``thread_id`` for chat types where it is unambiguous (``dm`` and ``thread``). For group/channel sessions the suffix may be a user_id (per-user isolation) rather than a thread_id, so we leave ``thread_id`` out to avoid mis-routing. rrrr(mainr|r)r)r chat_typer2>dmthreadrN)rer7)r+rgresults r>_parse_session_keyrd s   c " "E 5zzQ58w..58v3E3EaqQx   u::>>eAh*:::"'(F;  4rMevtc|dd}|dd}|dd}|dkrd|dd d S|d krb|d d }|dd }|dd}d|d|d|d|}|r |d|dz }|d z }|S|dkrddlm}||SdS)zOFormat a watch pattern event from completion_queue into a [IMPORTANT:] message.r completionrNunknownrwatch_disabledz [IMPORTANT: r$rr watch_matchr?output suppressedrz[IMPORTANT: Background process z matched watch pattern "z ". Command: z Matched output: z (z/ earlier matches were suppressed by rate limit)async_delegation)format_process_notificationN)rvr-r) revt_type_sid_cmd_pat_out_suprrs r>$_format_gateway_process_notificationr~ sLwwv|,,H 77< + +D 779i ( (D###7cggi447777=  wwy#&&wwx$$ww|Q'' 'd ' '# ' ' ' '!% ' '  P O$OOO OD   %%%FFFFFF**3/// 4rM list[dict]ctg}g}|s |}n#t$rYncwxYw|dd}|dvr||n|dkr||||D]}|||S)aDrain gateway-owned watch events without spinning on requeued events. Watch events are handled by the post-turn gateway drain. Process completions are owned by their per-process watcher task, and async delegation completions are owned by ``_async_delegation_watcher``. Requeueing async events inside ``while not queue.empty()`` would make the loop non-terminating, so detach the current batch first, then requeue any events this drain does not own after the queue is empty. rr>rrr)empty get_nowaitr2rvrput)completion_queue watch_eventsrequeuerrs r>_drain_gateway_watch_eventsr s "LG$$&&   "--//CC    E 776<00 8 8 8    $ $ $ $ + + + NN3   $$&&  ""S!!!! s / <<cdSr^rNrNrMr>rr sDrM_gateway_runner_ref history_len agent_resultrc|r|S|dr|dpd}t|t|dpd}|dsdvr|dsd vr d S d St fd d Dp dvo|dk}|r dSdt|dddSt |ddpd}|dr |dkr dS|S|dkrZt|rdS|dr1|dd}dt|dddS dS|dkrB|ds-|ds|ds dS|S) a>Normalize empty/None agent responses into user-facing messages. Consolidates the existing ``failed`` handler and adds a catch-all for the case where the agent did work (api_calls > 0) but returned no text. Fix for #18765. Also surfaces a retry hint when the agent never ran at all (api_calls == 0) for a non-interrupted, non-failed turn -- this is the silent-drop pattern observed after ``/stop`` where the next user message hits a stale generation token and returns an empty result, leaving the platform with nothing to send. (#31884) failedrP unknown errorfailure_reasonrsession_persistence_failedzsession storagez:diskdisku⚠️ Session storage was temporarily unavailable, so this turn was stopped to protect your conversation history. Please check available disk space, then send your message again.u⚠️ Session storage was temporarily unavailable, so this turn was stopped to protect your conversation history. Your message should already be saved — please send it again in a moment.c3 K|]}|vV dSr^rN)rbr; error_strs r>rdz2_normalize_empty_agent_response.. s;! !  N! ! ! ! ! ! rM)rrz too largeztoo longexceedr@4002}⚠️ Session too large for the model's context window. Use /compact to compress the conversation, or /reset to start fresh.zThe request failed: N,2 Try again or use /reset to start a fresh session. api_callsr interrupteduo⚠️ Your message was interrupted before processing started (likely by a recent /stop). Please send it again.partialprocessing incompleteu⚠️ Processing stopped: rz . Try again.u|⚠️ Processing completed but no response was generated. This may be a transient error — try sending your message again.uj⚠️ Your message wasn't processed (the previous turn was still being cleaned up). Please send it again.)rvrwryr!endswithr rh,_is_gateway_hidden_reasoning_incomplete_turn) rrJr error_detailris_context_failurererrrs @r>_normalize_empty_agent_responser s$!!) $''00CO  %%++-- \--.>??E2FF  $ $%A B B   * *&&w// 6Y3F3F%%   !! ! ! ! W! ! !   7y 5[2%5   )    @3|#4#4TcT#: @ @ @ L$$[!449::I && >>D  1}} 7 E E 2   I & & N""7,CDDCMS$3$MMM M P   Q  //   **   ++   7  OrMct|tsdS|ds|drdS|dsdSt|ddpd}d|vrdSt|dpd}| p||kS) uJDetect retry-exhausted turns with hidden reasoning but no visible answer. The conversation loop returns the retry-exhaustion sentinel as BOTH ``final_response`` and ``error`` ("Codex response remained incomplete after 3 continuation attempts"), so ``final_response`` being non-empty does not mean the model produced a visible answer. Treat the turn as hidden when the error sentinel is present and ``final_response`` is either empty or merely echoes that sentinel — any genuinely different final text means the model DID answer and must be delivered. FrrrrPrzremained incomplete afterfinal_response)rtrurvrwrxry)r error_textrs r>rr/s lD ) )u!!\%5%5m%D%Du   I & &u\%%gr228b99??AAJ"**:*:*<*<<<u))*:;;ArBBHHJJN  =:!==rMct|tsdS|drdS|ds*|ds|drdS|ddurdSdS)aReturn True only when a gateway turn really completed successfully. Restart recovery uses ``resume_pending`` as a durable marker for sessions interrupted during gateway drain. A soft interrupt can still bubble out as a syntactically normal agent result with an empty final response; clearing the marker in that case loses the recovery signal and startup auto-resume has nothing to schedule. FrrrrP completedTrF)rs r>'_should_clear_resume_pending_after_turnrGs lD ) )u &&u!!\%5%5i%@%@LDTDTU\D]D]u $$--u 4rMcurrent_resultfollowup_resultcFt|ts|St|ts|S|d}|d}t|ts|St|tr||kr|St|}||d<|S)aeCarry the outer history offset through queued follow-up drains. ``_process_message_background()`` persists transcript rows only once, after the entire in-band queued-follow-up chain returns. Each recursive ``_run_agent()`` call advances ``history_offset`` to the history it received, so without correction the outermost persistence step sees only the *last* queued turn as "new" and silently drops earlier turns from the same drain chain. Preserve the earliest (outermost) history offset so the final transcript slice still includes every queued turn that ran during the chain. r))rtrurvrh)rrcurrent_offsetfollowup_offsetrs r>(_preserve_queued_followup_history_offsetr[s ot , , nd + +#''(899N%))*:;;O nc * */3''O~,M,M / " "F-F  MrMr1BasePlatformAdapter | Nonec K|dS |d{VdS#t$rBtdt |dt |jdYdSwxYw)uTBest-effort dispose for an adapter that never made it onto ``self.adapters``. The reconnect watcher in ``GatewayRunner._platform_reconnect_watcher`` constructs a fresh adapter on every retry attempt. When the connect call fails — for any of the three reasons (non-retryable error, retryable error, exception during connect) — the adapter is dropped without ever being installed, so nothing else will call its ``disconnect()``. Any resources the adapter opened in ``__init__`` (e.g. ``APIServerAdapter`` opens a SQLite ``ResponseStore`` that holds 2 fds — the db file and its WAL sidecar) stay open until garbage collection sweeps the unreachable object, which Python's cyclic GC does not do promptly for asyncio-bound objects with native handles. The cumulative leak is 2 fds × every retry at the 300s backoff cap ≈ 12 fds/hour, and the default 2560-fd ulimit is exhausted in ~12h of continuous failure, after which every open() call on the gateway raises ``OSError: [Errno 24] Too many open files`` and the gateway becomes a zombie (#37011). This helper centralises the dispose-with-suppression so the three failure paths in the reconnect watcher can all call it without each one having to know that ``disconnect()`` may itself raise on a half-constructed adapter. ``adapter`` may be ``None``: the reconnect watcher initialises ``adapter = None`` before the ``try`` so the ``except Exception`` arm can dispose a half-constructed object, and also early-returns here when ``_create_adapter()`` returned ``None``. Nz,Adapter dispose raised on unowned adapter %rrTr) disconnectr2r3r4rVrrr1s r>_dispose_unused_adapterr{s:   """""""""""      : GVT']]%; < <        s$AA0/A0rattemptc>tdd|dz zztS)zCExponential reconnect backoff: 30s, 60s, 120s, ... capped at 5 min.r|r()r6_RECONNECT_BACKOFF_CAP)rs r>_reconnect_backoffrs! rQ7Q;'(*@ A AArMc eZdZdZdddeddfdZdded ed ed efd Zd Z dZ de de ddfdZ dededdfdZddZdededdfdZdZdS) TurnRunnera Per-turn collaborator carrying the tool-progress callbacks that used to be nested closures inside ``GatewayRunner._run_agent_inner``. The bodies are byte-identical to the original closures modulo ``local_name`` -> ``ctx.field`` rewrites (closed-over locals now travel on the shared :class:`gateway.turn_context.TurnContext`) and ``self`` -> ``self._runner`` (the owning :class:`GatewayRunner`). Module-global references (logger, cfg_get, BasePlatformAdapter, ...) resolve in this same module exactly as before. runner GatewayRunnerctxr-Nc"||_||_dSr^)_runner_ctx)selfr r s r>__init__zTurnRunner.__init__s  rMr#r?previewrc |j}|j|jdkr|dkr |dkr[|rY|rEddlm}|||jdkr|nd}|j|jj|n+|dkr%|j|jjdn2#t$r%} t d | Yd} ~ nd} ~ wwxYw|j {|dkrl|rj|dkrdtjd } |rd |d nd } |j | d|d| |jsdS|jr|sdS|dkr|jds |dpd} | |jkr|jdkrddlm} m}m}m}t9}t;t=|ddd}|rL||| s@d|jd<|j||t>dz | n2#t$r%}t d|Yd}~nd}~wwxYwdS|dks|dkr:|j sdS|dkr|n|}|rd|nd}|r|j|dS|j!sdS|dvrdS|dkrdS |j"r |j"dnd}|tG|ddrdSn#t$rYnwxYw|jdkr||j$dkrdS||j$d<ddlm%}||d }d}d} |j&'|j}n#t$rd}YnwxYwtG|d!dr|d"krtQ|tRrtQ|d#tTr|d#+rdd$lm,}|d#}|j-drd n|d%|d&}|d'|d(}|}|dkr|nd)} |.}!|!r|!dn|}"t_|!d*k}#t_|"| kr|"d| d+z d,z}"n|#r|"d-z}"|d'|"d(}|jd.kr|&d|j-d<|j|dSd|j-d<|rdd$lm,}|}taj1|dtT/}$|dkr#t_|$|kr|$d|d+z d,z}$|d%|d0te|3d1|$}n|r |d%|d2|d }n|d%|d,}|j|dS| |}d|j-d<n|rdd3lm,}m4}%m5}&m6}'m7}(|}|dkr|nd)} |&|||| 4})||8|)}n|)j9}|%|}*|*r(|(|r|d%|*}n |d%|*|'||}n |d%|d2|d }d|j-d<n|d%|d,}d|j-d<||j:dkr?|j;dxxd*z cc<|jd5||j;dfdS||j:d<d|j;d<|j|dS)6z3Callback invoked by agent on tool lifecycle events.Noff _thinking tool.startedr)build_status_phrasefullztool.completedzlive status update failed: %sz%Y-%m-%d %H:%M:%Sz "rUrz rdurationr)TOOL_PROGRESS_FLAGis_seen mark_seentool_progress_hint_gatewayrDtool_progress_commandFrxTrz(tool-progress onboarding hint failed: %su💬 >rclarifyis_interruptednew)get_tool_emojiu⚙️supports_code_blocksrr)get_tool_preview_max_lenrr```  ```(r(r)rz ...verbose) ensure_asciirJ(z) z: ")r# get_tool_verbprepare_tool_previewtool_verb_connectorverb_drops_preview)fallbackmax_len __dedup__)progress_callbackzTurnRunner.progress_callbacks i  $ 0%..[(( G//I/#BXBXBZBZ/AAAAAA11! # 5 ? ?TG,<V>V\^^,,-@AA18@o7oooob  !!R"D"D9"D"D{"D"D"K"K"M"MNNN% ! )?)?)A)A  F ) ) )#2J12M ) T!::j116Qs999c>OSX>X>X 011D-i1HII %GTwwt5G'H'HT6:03*../I/I/K/KLLL! ,">@RSSS T T T GSSSSSSSS T F  $ $ [(@(@( '0K'?'?GGYM-:D)-)))C ,"&&s+++ F(  F . . . F  ! ! F :=:J#T3#3A#6#6PT #/G$&655/    D    % %)s}Q7G*G*G F$ a 100000y(;;;   % $ @ @ L L   % % % $    % %'=u E E IZ''4&&(488I..44(Y%%''( ? > > > > >Y..00I 1!4RU:R:RY:R:R:R #0FFiFFF **,,C''33rD))++F&,;)JVqJ:%%'  2U:  1'&0 #0 H Hz H H H    ) )+15+A."&&'7888-2C ' * 0BBBBBB..00:dLLL77s8}}s22'q1E9HMMMMT$))++->->MM8MM 0;;;;;;;/////   " "3 ' ' ' F  (#C-1C ' * * $ 3              +*,,C''33rD 4 4  !!!  !,+??@QRR+0 "M),,E <%%i00V",,U,,CC"UUUU,?,? ,J,JUGUUCC;;;;;;;-2C ' * *++Y+++C-2C ' * #'* * *  Q   1 $      " "Kc6Fq6I#J K K K F#&a  s#####sUB B.. C8CCB5I I8I33I8)L LLM77 NNc  !K|jjsdS|jjsdSt t dd}||tjur_j sD j n#t$rYnwxYwj DdSg d!j dkd}d}ttrjnt t!t ddpd}n#t$rd}YnwxYwttr_ t!jjpd}jjn#t$rYnwxYwt)d||dkrd nd z d jrh t-jjj}d |vp*t3d |Dn#t6t8f$rd YnwxYwdt:dt:ffd dt<dt:fddt<dt<t<ffd d.fd dt:ffd dt>f !fd }  s_j sD j n#t$rYnwxYwj DdSj } j!r j!d nd}|,t |dd rtEj#d d{Vn#t$rYnwxYwt|tHrBt|dkr/|d dkr#|\} } } r| d| dzd d< r dn| } net|tHr9t|dkr&|d d krd!g dj%d <d j&d <|} '| |d{VrotQj)}tEj#d!d{V r,*jjj"d{VtQj)} || |z z }|d krtEj#|d{V\ sdSrQ!Nd#+ }!|d{V}|j,st |d$d%pd%-}t |d&d r"t\/d'j0d(|vsd)|vr4t\1d*j0tQj)}nd 2jj| j3j+d{V}j4rNt |d,d r=t |ddr,j5't;|j6nƉrId#+ }2jj|j3j+d{V}n32jj| j3j+d{V}|j,rA|j6r:|j6!j4r,j5't;|j6tQj)}tEj#d!d{V r,*jjj"d{VnE#tnj8$rtEj#d!d{VYntDj9$rj sW j }t|tHrFt|dkr3|d dkr'|\} } } r| d| dzd d<|d{Vnt|tHr}t|dkrj|d d kr^|d{Vr3 r1!r/ } !|d{Vn#t$rYnwxYwd!g dj%d <d j&d <n% '||d{Vn#t$rYnwxYwj Wr r!r|d{Vr3 r1!r/ } !|d{Vn#t$rYnwxYwYdSt$r?}t\:d-|tEj#dd{VYd}~nd}~wwxYwA)/N edit_messageseparater@g?MAX_MESSAGE_LENGTHir(r#@rFrc3FK|]}|jtjjuVdSr^kindinspect Parameter VAR_KEYWORDrbparams r>rdz4TurnRunner.send_progress_messages..sC! g&7&CCrM message_idr4cKjj||d}tddrd|d<r j|d<jdi|d{VS)N)r2rjr4REQUIRES_EDIT_FINALIZEFTfinalizerrN)r(r2rV_progress_metadatar^)rjr4rF_edit_accepts_metadatar1r s r>_edit_progress_messagezATurnRunner.send_progress_messages.._edit_progress_messages:-("F w 8%@@ *%)z"% <%(%;z"--7777777777 7rMlinesr-c@dd|DS)Nrc34K|]}t|VdSr^r9)rbr[s r>rdzLTurnRunner.send_progress_messages.._progress_text..&s(994SYY999999rM)rf)rqs r>_progress_textz9TurnRunner.send_progress_messages.._progress_text%s#9999599999 9rMcg}g}|D]=}||gz}|r1|kr|||g};|}>|r|||S)z>Partition progress lines into platform-sized editable bubbles.)r)rqgroupsrr[rP_PROGRESS_TEXT_LIMIT_progress_len_fnrts r>_split_progress_groupszATurnRunner.send_progress_messages.._split_progress_groups(s!#FG ( (#tf, (//y0I0IJJMaaaMM'***#fGG'GG ' g&&&MrMcjrPt|ddrAt|ddr2jt |jdSdSdSdS)Nr/Frj)_cleanup_progressrV_cleanup_msg_idsrrwrj)rr s r>_track_progress_resultzATurnRunner.send_progress_messages.._track_progress_result7s% DFIu55 DFL$77 D $++C0A,B,BCCCCC  D D D D D DrMrcKjj|jjd{V}||S)Nr2r4reply_tor)r0r(r2_progress_reply_torn)rrr}r1r s r>_send_progress_textz>TurnRunner.send_progress_messages.._send_progress_text?sl"<< *// (F # "6 * * *MrMcK r sdS }t|dkrdS|d} Q |d{V}|js7t|ddr"tdjdSd dSn&|d{V}|jr|jr|j |ddD]1}|d{V}|jr|jr|j 2|d dS) aStart fresh editable progress bubbles before a bubble exceeds limit. Returns True when it delivered/split the current buffer, or when a transient edit failure left the buffer and message identity intact for a later retry. In either case the caller should skip the normal send/edit path for this tick. Fr(rN retryableu>[%s] Transient overflow edit failure — keeping can_edit=TrueTr )r7r/rVr3r4rrj) rv first_textrrrprtrryr1can_editprogress_linesprogress_msg_ids r>!_roll_progress_overflow_if_neededzLTurnRunner.send_progress_messages.._roll_progress_overflow_if_neededIs"  u++N;;F6{{au'q 22J*55ozRRRRRRRR~ !v{E::$ \#L $t$H 5 ! 32:>>>>>>>>>8f&78&,&7O 8 822>>%3H3HIIIIIIII>8f&78&,&7O $BZN4rMTrr)r0u (×)r  __reset__333333?r.rrPrru5[%s] Transient edit failure — keeping can_edit=Truefloodz retry afterz-[%s] Progress edit flood control, backing offrr/zProgress message error: %sr-N);rr8r r@r(rVrrGr^rrr2progress_groupingrtmessage_len_fnr7rhmax_message_length_for_chatr2message_len_fn_for_chatrCrnre signature parametersr valuesrwrjrwrrr3r:rsleeprrDrErrU monotonic send_typingrfr/ryr3r4rrzr0rr{r|rjqueueEmptyCancelledErrorrP)"r _adapter_edit _last_edit_ts_PROGRESS_EDIT_INTERVAL_raw_progress_limit _edit_paramsrrxrMrKbase_msgrr_now _remaining full_textr_err _flood_result _pending_texterwrorprxrtrryr}r1rr rrs" @@@@@@@@@@@@@r>send_progress_messagesz!TurnRunner.send_progress_messagess i!  F,223:>>  F W ~tDD  M5H5U$U$U(..00 &113333 E(..00  F(J6 "%'#677 G " "   '"%gg7KT&R&R&ZVZ"["[   ' ' '"&    ' g2 3 3  &)77 8JKKSt''#$+#B#B3:CU#V#V       # )+>X\(+7G,.>==7&mA.........  Dc5))/c#hh!mmA+@U@U),&Ax%K08-J-Jeai-J-J-Jr*0>L.,,HCCU++/CA #a&KBWBW'+O%'N/3C)!,*+C$Q'C"))#...::<<<<<<<<$(N$4$4M!-,,,,,,,,,--//g%11#*2DsOe1fffffffff ~''4}8LM >>"- 333333333--//F<P ; $ . 9 9I#9#9/9#U#UUUUUUUF!>"W ' < < BIIKK #6;>>%"LL W ' %"d??mt.C.C#KK O ' -1N,<,~0N0N !)*@*@R_*`*`$`$`$`$`$`$`$`$`'0!)!)!)$(D!).2O-/N7;C1!423C,Q//*11#666"C"C"E"EEEEEEEE$5,2244:>>?>;;=========? .~ > >I44_iPPPPPPPPPP$ ' ' ' 91===mA&&&&&&&&&&&&&& 'u| 'sN B%% B21B2 D(( D76D7A F F+*F+A H!!H76H7.-^'K65^'6 L^'L^'!^';AN?^' N  ^' N  B&^'5B^' ;^'^'B ^'+G:^'')g))g)=C d)cd) c'$d)&c''Ad)(g)) d63g)5d66Ag);f g) fg)fg)! g)*5g$$g)c|j}|jds |jddS|sdSd|jd<|jjtj}|t|dsdS t| |jd|j tddS#t$r&}td|Yd}~dSd}~wwxYw)z?tool_start_callback: speak a one-time ack in the voice channel.rNTplay_ack_in_voicezvoice ack scheduling errorr3 log_messagezvoice ack schedule failed: %s)r_voice_ack_fired_voice_ack_guildr3r adaptersrvrDISCORDrrr_voice_ack_loopr3r2r4)rr,r?rr _adapter_ack_errs r>voice_ack_callbackzTurnRunner.voice_ack_callback3si   " c&:1&=&E F%%''  F"&Q<(,,X-=>>  785H#I#I  F D $**3+?+BCC#8         D D D LL8( C C C C C C C C C Ds;B?? C/ C**C/ iteration prev_toolsc |j}|sdSg}|pgD]d}t|tr+||dpdB|t |et|j d|j j r|j j j nd|j j |j|||d|jt ddS)Nrrz agent:step)ruser_idrNr tool_namestoolsz agent:step hook scheduling errorr)rr3rtrurrvrwr _hooks_refemitr(rrrrN_loop_for_stepr3)rrrr _names_ts r>_step_callback_synczTurnRunner._step_callback_syncHsi%%''  F# ' 'B"d## ' bffVnn23333 c"gg&&&& N   9<9LTCJ/55RT:-!n&$# //    : rMrc|j} tj|j|||jdS#t $r&}td|Yd}~dSd}~wwxYw)Nzevent_callback hook error: %s) rrrun_coroutine_threadsaferrrr2r3r4)rr#rr _es r>_event_callback_synczTurnRunner._event_callback_synccsi >  ,##J88"      > > > LL8" = = = = = = = = = >s3> A.A))A.c dtdtddfd}||_t|dd|jjrfd|_dSjsj rfd|_dSdS#t$r t d d YdSwxYw) aWire the platform thread-rename lane onto the agent as `_on_session_title`. The session titler runs inside the turn prologue now (it derives the title from the user's first message, so it no longer needs the response), which means the callback has to be attached before the run rather than registered after it. The lane predicates and their rationale are unchanged from the old post-response registration. rr<r-Nc>td||dS)Nz@Gateway auto-title failure suppressed (not user-visible): %s: %s)r3r4rr<s r>_title_failure_cbzDTurnRunner._attach_session_title_callback.._title_failure_cb{s* V#rMrNcH|dkoj|SNllm)r %_schedule_telegram_topic_title_renametitle title_sourcerrNr(s r>rz;TurnRunner._attach_session_title_callback..s1 E) JJ ErMcH|dkoj|Sr)r (_schedule_discord_semantic_thread_renamers r>rz;TurnRunner._attach_session_title_callback..s1 E) MM ErMz'Failed to attach session title callbackTr) rw BaseException_title_failure_callbackrVr(r _is_telegram_topic_lane_on_session_title_is_discord_auto_thread_lane_is_relay_discord_channel_laner2r3r4)rrr rrNr(s` @@r>_attach_session_title_callbackz)TurnRunner._attach_session_title_callbackms?. S   - D     ->E )  d;;JZF|33F;; ++++++''' ::6BB  ;;FCC ++++++'''  " S S S LLBTL R R R R R R SsAB$ AB$$&C Cr$c |jjrsdStjj||}|`t djjrjjjnd|tt|pddddSttjj ||jjt d|d}|dSjrd fd }||dSdS) Nz(status_callback suppressed for %s/%s: %srrzstatus_callback (z) scheduling errorrr-c |}n#t$rYdSwxYwt|dd}t|ddr+|r+jt |dSdSdS)Nrjr/F)rr2rVr|rrw)futresmidr s r>_track_status_idz:TurnRunner._status_callback_sync.._track_status_ids**,,CC FFc<663 511:c:(//C99999::::s  &&r)r_status_adapterr3r(r(rr3r4rrrwrr6_status_chat_id_status_thread_metadatarr{add_done_callback)rr#r$prepared_message_futrr s @r>_status_callback_syncz TurnRunner._status_callback_syncs`i" #*@*@*B*B  F: J       # LL:-0Z-@O #))i3C 24F4FGGM     F' '(;S=PR\^npsqL M M  JJJJJ     < F  5 : : : : : :  " "#3 4 4 4 4 4 5 5rMc 7opqrstuvjvvjjtjkrdnvjjj}vjpd}vjpd}|r|dz|z}j vjjvjj pdtvjddtvjdd}|r|dz|z}t} j vjvjvj\}}t"d||d vjpdn!#t($r}d |gd gd cYd}~Sd}~wwxYwj j} j vjvj| } | j _j vjvjj _dtd} vjd uttj dddd} | d dlm} | } vvj|d}|| jo | jdkntA|}|}vj!}|}|s|r d dl"m#}j $vj}|r{j %vj| |d\}}||vjj |vj&vj'vfdnd|vj(vj)t|rdtTddftuvfd } tvj+d <n2#t($r%}t"d|Yd}~nd}~wwxYw| udtTddfuvfd } dddtTdt@ddftvfd }j ,vj-||}vjd!pid"pi}||pi}|d#}|tA|nd}j .|d$|d%vj/|j 0vjtvjd&dtvjd'd|(}d}d} tj d)d}!tj d*d}"d}#|!rS|"Q|!5|"vj}$dddn #1swxYwY|$rtc|$d+kr|$d+}#d}%|#Evj2>|#vj2kr3 j j34|#}%n#t($rd}%YnwxYwd}&j j5Zvj2rS j j5j67vj2}'|'r|'d,d }&n#t($rYnwxYwd}(|!r*|"'|!5|"vj})|)r|)d-|krtc|)d.kr|)d.nd}*tc|)d+kr|)d+nd}+|+duovj2duo |+vj2k},|,o|%o|+|#k}-|-rvt"8d/vj|+j j9:vjd}.tw|.txr |.r|.d nd}/|/r |/tzur|/}(n|,s|*~|&||&|*krvt"8d0vj|*|&j j9:vjd}.tw|.txr |.r|.d nd}/|/r |/tzur|/}(n|)d }t}|"d1r, |"?vjn#t$rYnwxYwj A|vjB||_Ct"d2vjd3} dddn #1swxYwY| r4|2j D|j E|( tjGj jH|(fd3d4tUvjdd56In<#t($r/ j H|(n#t($rYnwxYwYnwxYw|(vjJdd$|d$i|d%tvjid7|d8d3d9dd:vj/d;vjLd<|pdd=j jMpdd>| d?j jd@|d@dA| dBdC| dDdE| dFdG| dHdI| dJddK| dLdMvj2dN|d&vjjNd'vjjOdOvjjPdPvjj dQvjjQdRvjjRdvjjSdSvjdTtj j5dUj j5dVj Ed#|dWd3}|!rH|"F|!5|||&vj2f|"vj<j Tdddn #1swxYwYt"dXvj|vjUsvjVsvjWvjXnd|_YvjZd vj[nd|_\vj]j^rvj_nd|_`| |_a|r|nd|_bvjc|_ddvfdY }0|0|_ed|_fvjg|_h| |_ij j|_j|d@pi|_kdlj mvj|_ntjorgptjpqdZtTddfvfd[ sdpqrsfd\ }1dZtTddfpqrsvfd] }2|2|_qvjrrtvjrmttvjrd^d(vjrtvj|1vju_n"tvjrd`d}3|3 |1|3vj<vjdaidb}4tw|4t@r|4rdcnd}4|4r!tU|4vndc|_wdddtTdet@dtTfvfdf }5|5|_xvjy|_z|vj{d <||vvj}|_~vj|_t}|dgr|jndvjd <tvjvjt vjh\}6}7| rt|dMdvj2krt |6t|did}8|8|6ur`t"djvjtc|6tc|8t|8tjk}6t|6}9d dllm}:m};m}vj}?vj}@tj doi}Avjr|A:vjdnd}B|Br|Bdzvj-zv_-t'}Ct)t+vj|Cp}Dd}Evjr= j j3jvj}En#t($rd}EYnwxYwd}F|E2t|Edqdr!t)t|Edrd|Cp}FtA|Eduot|Edqdo|Dp|F}GtA|6o |6dsdtduko|D}H|Grut|Edvdpdw}Ivj-}?j $vj}JtAt|Jdxd3}Kt/|Ivj-|Kyv_-n|Hrvj-}?dzvj-zv_-tj d{d}A|Ar?vjr8vj|Avr/|A:vjd}L|Lr|Ldzvj-zv_-twvj-tTrvj-sy|Ewt|Edqdrft|Edvdpdw}Mj $vj}Nt/|MdtAt|Ndxd3yv_-vjpdo| j vj}P|Pr d d|lm}Q|Qvj-|P\}R}S|Sr)t"d}tc|S|St7d~|RDr|R}Tnvj-}Tn@#t($r,}Ut"d|Uvj-}TYd}U~Und}U~UwwxYwvj-}Tt9|T|7}V|6vj2d}W|?|?|Wd<n |7r vj-|Wd<vj vj|Wd<|@|@|Wd<|j|Vfi|W}X|=o d dlm}Y|Yon#t($rYnwxYw|;|On>#|=o d dlm}Y|Yon#t($rYnwxYw|;|OwxYw|Xvjd <tt|Xd}Zd }[d }\d }]d }^vj{d }_|_r`t}|_drPt|_jdd }[t|_dd }\t|_dd }]t|_jdd pd }^|_rt|_d$dnd}`vj{d }d}a|rtAt|ddnd}b|rt|dMvj2nvj2}c|r~vjrv|cvj2krjd3}at"8dvj2|cj j3jvj}dd}e|drt|ddMd}fv)s)t"8dvjpdvjun|f|ckrd3}en|fvj2kr*t"8dvjpdvj2|fnR|c|d_2j j3j j3|cvjvjd3}e|ertvjdNdtjkrtvjdRddkrtvjddj j5 j j5j6|c}g|gr`|gdrKtU|gdvj_St"dvjjSvj2|cn,#t($rt"dd3YnwxYw|er"j vj|dd|c}hj |h||as|brd ntc|6}i|ZstU|X|Zpdtc|6}ZtWvjj|Z}Z|Zs"|Xdr d|Xdnd}Zid|Zd|Xdgd|Xdd d|Xddd|Xdd|Xddd|Xdd|Xddd|Xdd|Xdd|Xddd|Xdddgvjd pgd|id|bdM|hd|[|\|]|`|^dSd|ZvrtY|Xdgtc|6|9\}j}k|jrwt[}lg}m|jD]0}n|n|lvr*|l|n|m|n1|kr|md d|Zdzdl|mz}Zid|Zd|Xddvjd r!vjd dgngdvjd r!vjd dd nd dvjd r!vjd ddnddvjd r vjd dnddvjd r vjd dnddvjd r!vjd ddnddvjd r!vjd ddnddvjd r vjd dnddvjd r vjd dnddvjd r!vjd ddnddgvjd pgd|id|bd|[d|\|]|`|^|h|Xdd|Xddvjd r!vjd dd3nd3dS)Nrsrrrparent_chat_idrr(r+rAz3run_agent resolved: model=%s provider=%s session=%sru'⚠️ Provider authentication failed: rrr(rrr(r+rr(r+rz streamingStreamingConfigrGatewayStreamConsumerraiseon_missing_cursorc8jdS)N)r)r8r)r sr>rz%TurnRunner.run_sync..CsS%7%;%;N%K%KrM)r1r2rzron_new_messageon_before_finalizeinitial_reply_to_idrun_still_currentrr-cr.||dSdSdSr^r3on_delta)r_stream_consumer_stts_consumer_refr s r>_stream_delta_cbz-TurnRunner.run_sync.._stream_delta_cbLsa"5577F 0 9 9$ ? ? ?#5#A$6$?$?$E$E$E$E$E FF$B#ArMz$Could not set up stream consumer: %sc^r|dSdSr^r)rrr s r>rz-TurnRunner.run_sync.._stream_delta_cbZs;))++6&//5555566rMF)already_streamedrcxsdS|}.|rn|dS|s*jr#t |pdsdSt jj|j j tddS)Nrr.z+interim_assistant_callback scheduling errorr) r3on_segment_break on_commentaryrrwrxrr0rrrr3)rr display_textrr s r>_interim_assistant_cbz2TurnRunner.run_sync.._interim_assistant_cb^s))++ L+#A$557777$22<@@@ s': #lFXVXBYBYB_B_BaBa  $#(('  8) "I      rMr9rEskip_context_filesrrr user_id_alt) cache_keysrr r_agent_cache_lock _agent_cacher) message_countr(r|uAgent cache invalidated for session %s: cached agent's session_id %s is ended in state.db (stale self-heal artifact, #54878 x #54947) — discarding instead of reusing across the routing recoveryzfAgent cache invalidated for session %s: message_count changed (%s -> %s), possible cross-process write move_to_endz#Reusing cached agent for session %sTzagent-xproc-evict-targetrdaemonrmax_iterations quiet_modeverbose_loggingenabled_toolsetsdisabled_toolsetsephemeral_system_promptprefill_messagesreasoning_config service_tierrequest_overridesproviders_allowedonlyproviders_ignoredignoreproviders_orderorder provider_sortsortprovider_require_parametersrequire_parametersprovider_data_collectiondata_collectionrNr user_namer2 chat_namergateway_session_keyrXrSfallback_modelload_soul_identityz)Created new agent for session %s (sig=%s)c<jrsdS t|}n-#t$r tddYdSwxYw|sdSt jj |j tddS)Nzrender_notice_line failedTrz)notice_callback delivery scheduling errorr) rr3r+r2r3r4rr _deliver_platform_noticer(r)r*r[r rs r>_notice_callback_syncz2TurnRunner.run_sync.._notice_callback_syncs& c.D.D.F.F  )&11    84 HHH   $ 55cj$GG"G       s0&AAr$c jrsdStjj|t jjjj tddS)Nrr.z+background_review_callback scheduling errorr) rr3rr0rrrr(rrr3)r$r s r>_deliver_bg_review_messagez7TurnRunner.run_sync.._deliver_bg_review_messages& c.D.D.F.F  $#(('9#:U`c`j`sttt) "I      rMc5t}dddn #1swxYwY|D] }|dSr^)rrclear)pendingqueued_bg_review_pending_bg_review_pending_lock_bg_review_releaser2s r>_release_bg_review_messagesz8TurnRunner.run_sync.._release_bg_review_messagess  " " $ $ $( + +122"((*** + + + + + + + + + + + + + + +" 3 3**62222 3 3s$AA A c$jrsdSsR5s#| ddddS dddn #1swxYwY|dSr^)rr3r8r)r$r7r8r9r2r s r>_bg_review_sendz,TurnRunner.run_sync.._bg_review_sends& c.D.D.F.F %,,.. ,-4466*11'::: ' &w / / / / /s+A::A>A>register_post_delivery_callback generation_post_delivery_callbacksrDmemory_notificationsrpquestion multi_selectc ddlm}ddl}jsdS|jdd}||jpd||rt|ndt| j j n#t$rYnwxYw j r j dnd}t|dd}t|r |dn,#t$rt d d YnwxYwd }t%jj ||rt|nd|jpdj jt d} | d }nj | d} tt| dd }n4#t$r'} t d| d }Yd} ~ nd} ~ wwxYw|s|jpddS|} ||t7| } | | dkrdt9| dz dS| S)Nrclarify_gatewayr ) clarify_idr+rBr rCflush_pending_syncg@rz2Stream-consumer flush before clarify prompt failedTrF)r2rBr rHr+rzClarify send failed to schedulerr/zClarify send failed: %sz'[clarify prompt could not be delivered]z[user did not respond within rzm])rrFuuidruuid4hexregisterr+rrpause_typing_for_chatrr2stream_consumer_holderrVr/r3r4r send_clarifyrrrr clear_sessionget_clarify_timeoutwait_for_responserirh)rBr rC _clarify_mod_uuidrH_sc_flushsend_okrrr<rrJr s r>_clarify_callback_syncz3TurnRunner.run_sync.._clarify_callback_syncs = = = = = = & r*3B3/J  ! !%O1r!)0:W d!,// "    #99#:MNNNN     7:7Q[c033W[ &:DAAF##(F3''''    H!  G*#00/%-4>DMMM$) # 52 8 1"=   C{$ ZZZ33F"769e#D#DEEGG $$$NN#>Ls7R<7H7HLLLLOs=6B B#"B#'AC**&DD;4F00 G!:GG!rr_session_messageszPersisted transcript lagged live cached history for session %s (disk=%d, memory=%d); preserving live conversation context (possible FTS write corruption)r)register_gateway_notifyreset_current_session_keyset_current_session_keyunregister_gateway_notify approval_datac j j|dd}|dd}t |}t t jdd t j j| | j |dd|d d|d d   j td }|td| d}|jrdStd|jn2#t"$r%}td|Yd}~nd}~wwxYwt jdd}t%||||dd|d d|d d } t j j| j  j td}|| ddSdS#t"$r&}td|Yd}~dSd}~wwxYw)aYSend the approval request to the user from the agent thread. If the adapter supports interactive button-based approvals (e.g. Discord's ``send_exec_approval``), use that for a richer UX. Otherwise fall back to a plain text message with ``/approve`` instructions. rrrzdangerous commandsend_exec_approvalNrTrrF)r2rr+rrrrrz#send_exec_approval scheduling errorrz$send_exec_approval: loop unavailablerJrzLButton-based approval failed (send returned error), falling back to text: %sz6Button-based approval failed, falling back to text: %styped_command_prefixr]rr.z#Approval text-send scheduling errorz#Failed to send approval request: %s)rrOrrvrrVrrrbrrr3rrr/rrPr2rr0) r`rr _approval_fut_approval_resultr_pr_approval_send_fut_approval_session_keyr s r>_approval_notify_syncz2TurnRunner.run_sync.._approval_notify_syncs   5 5c6I J J J##Ir22C $$]4GHHD+3//C tC/002FMMY$<+>>$'$7$'(=(,%(%@,9,=,=>OQU,V,V*7*;*;OT*R*R)6):):>5)Q)Q?  *%$I%%%M%,*+QRRR'4';';B';'G'G$'/NNf(.!NNPRT,.DcJJB0 - 1 12CT J J+//FF*..~uEE C H%=',,+!$!<- &! E & & &"&1&--b-9999921 H H H BBGGGGGGGGG Hs8B1E4 E FE??F/AI I=I88I=r)rresume_pendinglast_resume_marked_atr rr resume_reasonrinteractive_resumerz[System note: A new message has arrived. The conversation history contains pending tool outputs from an interrupted turn. IGNORE those pending results. Address the user's NEW message below FIRST. Do NOT re-execute old tool calls from the history.] _pending_skills_reload_notes)build_native_content_partsz:Native image attachment: skipped %d unreadable path(s): %sc3HK|]}|ddkVdS)r image_urlNrvr:s r>rdz&TurnRunner.run_sync..s1HHA155==K7HHHHHHrMz8Native image attachment failed, falling back to text: %s)conversation_historyr'persist_user_message moa_configpersist_user_timestamprRrcontext_compressorlast_prompt_tokenssession_prompt_tokenssession_completion_tokenscontext_length_last_compaction_in_placeu/Session split detected: %s → %s (compression)uSSkipping session split sync for stale run %s — generation %s is no longer currentrznSkipping session split sync for %s because the session binding moved from %s to %s before compression finishedrrNuGRestored source.thread_id=%s from binding after session split %s → %szr unique_tagstagrhr7r8r9r2rrr sw` @@@@@@@@r>run_synczTurnRunner.run_syncs%i6!$ 3x~ E Euu3:K^Kd !/52 # 2 8b??AA  ^"4v"=@T"T![![!]!] !\HH J  J  $"cj+t<<cj*:DAA I    \"4v"=@R"R!Y!Y![![ 022 $(L$O$OzOO%P%% !E> LLE~))*55s7L"       "QC"Q"Q        \ +<II:J   *: &%)\%O%O:3?&P& &  "  !>qA h=={DQQ = 6 6 6 6 6 6#O%%E 55 O\;   & M 6eo6o&&  1!$!G!7 " N"8" N! NIIIIII<;;CJGGE BBJx.5CAM#@ (='< ( # 2,!$!< #1=LKKKK!%+H,/,@*-*@ ( ( ($+FF3F4FFFFFFFF 5EC.q1 N N N CWMMMMMMMM N  #(:(F 6s 6t 6 6 6 6 6 6 6JO    $ SW       .\<> 4A4MT-000SX |33 w  y !  |AA#/RRCJ 488 M4@@14   #dl,?FF ~t<<    26- : :$jj99  : : : : : : : : : : : : : : : 2s;//!33#.q> #  (* CN22 ,&*l&@&X&X$''## , , ,&+### ," < # /CN /  L48DDS^TT K)2)J)J&     $ n 36-m 3m 3CO44k3fQi4// /2&kkAoo4J/26{{Q&))DK$4/:N$6:'3>9)-</<'+;;* -M3  B  O[ #',";"?"?QU"V"V2, %JCO\\\.2+[m 3m 3m 3m 3m 3m 3m 3m 3m 3m 3m 3m 3m 3m 3m 3l  5#4 L 7 7t|;;==    +  <C.0Ic#/.B.B3B3.GII  %''''   L<<=QRRRR D   =CK%% )%Y'%+3?;;%%% .~ %  4 % !& %"%!5!5%#&"7"7%);(Bd%"&!?!G4%"2!1%"\77%#-..1D"E"E"E%#%&&...%#%&&"2"2"2% !#w!%"!ffVnnn#%$-/FF3G,O,O,O%%&*,0A)B)B)B'%(>>)%*&+%, **-%. J22/%0*..1%2 **3%4*..5%6*..7%8*..9%:%(OO;%<#4<#;UDLD\]]]=%@ $|CCEEEA%B$6#5C%H$(4I%%EL EE-%%% !"  % B '7?? B'@+@   $  'b!%%f--7 '&    m_dCCXGXG-0[ *#l>>szJJO"&)=tDD## 52ECKK" -0[ *W+  K!/MtTT  :co :#/^2S2S!%%cot<$$ .9?]$%;<<' K?B{$%;<~)58^$\2/;Aa$%=>+U+,<UU@TUUF % %&; < < < YYYYYY&&'<====     % %&= > > > > & %&; < < < YYYYYY&&'<====     % %&= > > > >%!  '  # # % % % $455  !!$  [gf&:;; [ '(ACWYZ [ [ !&*A1EEK"6+FJJL%f&?AQSTUUZYZOcj>QSabbN! \@F 7@S@S![!<6'?!">6::i77VZZ 44vzz-??$VZZ0C%D%D G,,!"(4KU)S)S#$' 3I5(Q(Q%&)!,2'(!";)*%&9+,2-.%&7/0!,!-("17 d > ) ).M :r**"=11$8/// +J+  Puu %00C$ #**3///&@&&q*>???!/$!6;9O9O!O% n% fjj)9::%  CDUVWDX`)!,00R@@@^`%  SEVWXEY`*1-11+qAAA_` % 3CTUVCWbc'*..x???]b % >A>OPQ>R\!!$(()9:::X\%  #BSTUBV`*1-11+>>>\`%  SM^_`Mal3,Q/33M5IIIgl%  SEVWXEYds(+// 5AAA_d%  #:KA:NXS&q)--g666TX%  RURcdeRf!p!21!5!9!9:M!N!N!Nlp% " #$Q'3!!$(()?GGG-2'% * S%a(.B+% , 7-% . !"5/% 0 !"31% 2 K3% 4*$-."(**-A5"I"I$*JJ/Eu$M$M VYUfghUi s 1! 4 8 89JD Q Q QosI% % % % sA&E,, F 6 F?F F B"L66 M%M  M%S>>TT=U U,+U,AW WW!F_;;^_; ^# _;"^##A _;;_?_??Ab c b87c 8 cc cc  c -k  kk%)~ ~~G !AL;HA)AI,I+AL;I, AJ"I6"AJJAL;JAJ"J"AAL;L ALL AL,L+AL,L; AM6MAMMAM6M AM'M$AM6M&AM'M'AM6X3BAZ;Z;&A[$[#A[$NNNr)rrrrrprrwrur\rrrhrrrrrr!rNrMr>rrsV  [TC$C$CC$CC$QTC$cgC$C$C$C$Ja'a'a'F DDD* S d t    6>s>T>d>>>>7S7S7S7Sr"5"5c"5d"5"5"5"5HV V V V V rMrc!v,eZdZUdZdZeed<dZeed<eZ e ed<e Z e ed<dZ eeed<d Zeed <d Zeed <d Zeed <d Zeed <d Zeed<d Zeed<d Zeed<dZeeed<dZeejed<dZeejed<dZeeeee ejffed<dZ!ee"ed<d Z#eed<e$dZ%e$dZ&e$dZ'e$dZ(e)Z*e$dZ+e$dZ,e$dZ-e$dZ.e$dZ/e$d Z0e$d!Z1e$d"Z2e$d#Z3e$d$Z4e$d%Z5e$d&Z6e$d'Z7e$d(Z8d)eed*ffd+Z9d,ed)d*fd-Z:d,ed)ed*fd.Z;d,ed)efd/Zfd0Z?dZ@ed1ed2<dZAee"ed3<dZBee"ed4<d5ZCe ed6<dZDed7ed8<d ZEeed9<dZFed1ed:<d+d;eeGfd<ZHd,d=ZId,d>ZJd)efd?ZKeLd@z ZMdAe dBed)efdCZNd)eeeffdDZOd,dEZPdBedFed)dfdGZQdBedHed)dfdIZRd,dJZSdKeTe"dLe d)efdMZUd,dNZVddOdPeed)dfdQZWd)e fdRZXd+d)e fdSZYd dTdUed)efdVZZd)efdWZ[e\d)efdXZ]e\d)efdYZ^e\d)eefdZZ_e\d)eefd[Z`d\ed)efd]Zad\ed)efd^Zbecd_d`hZdd\ed)efdaZed\ed)efdbZfdcZgd\ed)efddZhd)efdeZid)efdfZjd\ed)eefdgZkd\ed)dfdhZld\edied)dfdjZmd\ed)eefdkZnd\ed)efdlZoddddmd\eed,eedneepd)e>eepffdoZqdpedqedrepd)epfdsZrdtedue"d)dfdvZsdweee"fd)dfdxZtdyeud)dfdzZvdyeud)efd{Zwdyeud)dfd|Zxdyeud)dfd}Zydied)dfd~Zzd)efdZ{d)efdZ|d)efdZ}d)efdZ~died)efdZd)efdZd)e fdZd)e>fdZd)efdZd,dZd)efdZd,dZdZd-de d)dfdZd)efdZd)efdZd)efdZd,edddye"d)dfdZd,edye"dedd)edfdZddd,edye"d)efdZede"d)efdZd,edye"d)efdZdted)efdZd.deedeed)dfdZd,dZd,dZd,dZd/de d)dfdZdddddAedeedeedeed)df dZd_ddied)dfdZd)efdZed)e=eee"ffdZed)efdZdddddAe dBedneepdeedeed)ef dZddddAe dBedeedeed)ef dZed0dqed)epdzfdZeded)e>eeffdZddd_dd\eed,eedqed)epdzfdZd,edeepd)dfdZ d.d,eed)eefdZ d1d,eded)dfdZed)edzfdZed)efdZed)efdZed)efdZed)e fd„Zed)e fdÄZed)efdĄZed)epfdńZed)edzfdƄZd)edzfdDŽZedue"dedzd)dfdɄZd)eee"ffdʄZd)eefd˄Zd,ed)eefd̄Zd,ed\ed)e>e"eeffd̈́Zede"d)efdτZd,ed)efdЄZed,efdфZdZd,eded)dfdԄZded)efdՄZded,ed)efdքZdLe d)e>eee"feffdׄZdied)dfd؄Zd,dلZdeee"fd)dfdۄZd,eedue"dee"d)efd݄ZdcZdejdue"ded)dfdZd_ddue"ded)dfdZdue"d)dfdZdZdZded)dfdZd)efdZd,ed)dfdZ̐d,dZ͐d,dZd)efdZd d ddeded)efdZechdZdyeuded,ed)dfdZded)dfdZd)efdZԐd,dZed2dZd)efdZאd+d)efdZd)efdZ d.dyeeudAee d)efdZdejd)dfdZܐd,dZd)efdZd)e>eeffdZd)efdZdZdZdddddZd3de d)dfd Zd eee"fd)dfd Zd4defd Zd)e fd ZdZd,ed)eepfdZde d)efdZd-de fdZd)efdZd,dZd,dZd,dZd)efdZd,dZd d d ddededed)dfdZd,dZd)efdZd ed!d"d#ee>efd)efd$Zdyeud edAe d)dfd%Zd edAe d)dfd&Zd edAe dyeud)dfd'Zd edAe d)eeugeTdffd(Zd edAe dyeud)dfd)Zd efd*Zd+Zd,ZedAe dye"d)ee>fd-ZedAe dye"d)ee>fd.Zedye"d)eefd/ZdAe d;e"d)eeufd0Z d+dAe d eed)eeeeeegeffd1Zd2ed)dfd3Zd4ed5ed)eefd6Zd7d8d9d:Zeeefed;<dedZ dedded)efdZ?d\ed)efdZ@d\ed)efdZAd\ed)eeBeeffdZCd\ed)eeBeeffdZDded)efdZE d+d\edtededeeBeefd)df dZFd\edteded)dfdZGd\edteded)dfdZHd\ed)efdZId\edteded)dfdZJdZKd\ed)efdZLd)efdZMd\ed)efdZNd\ed)efdZOdeded)efdZPded)efdZQdedededed)eReddff dZSdedededfed)eef dZTd)eee"ffdZU d+deed)eeee"ffdZVdddddAee dBeedeedeedeedyee"d)eeee"ffdZWeddddAee dBeedeedeedyee"d)ef dZXeded)eefdZYdZZece j[e j\e j]e j^e j_e j`e jae jbe jce jde jee jfe jge jhe jihZjd,dZk d8de de dLe d)dfdZld)efdZmd)ee>eeeeffdZndddeee>eeeefd)ee>eeeeffdZodߐepd)efdZqded)dfdZrdZsd)etjujvfdZwd,dZxddddddd\eed,eedneepdeedqeed)ef d„Zydede=ed)efdńZzdede=ed)e>ee=effdDŽZ{d)e=efdȄZ| d+deed)e>edze=effdɄZ}ddʐd˜de=eded)dfd΄Z~edϜdyeded)e>ee=effdЄZdepfd҄Zdedepd)eefdԄZedepd)ee>eeeffdՄZded)efdׄZdedepd)eefd؄Zdepd)dfdلZd3de d)dfdڄZdepd)dfd܄ZdZdݐZe>ed<dߐZiZepe>eedzfepee"ffed<ed)epee"ffdZed)epee"ffdZednepdzd)epfdZe d9dqedepdededepdzdpedzdedzded)efdZd,ed)dfdZd,edqedrepd)e>fdZd,ed)epfdZd,edepd)dfdZd,eded)efdZddd,edUeed)efdZd,edUed)efdZd,edUeded)efdZd,edied)dfdZd,ed)dfdZd,ed)efdZd_dd,edied)efdZd,eded)efdZdye"d,ededzd)dfdZddd,ed\edededed)df dZd,edteed)dfdZd,ede=ed)dfdZd,ed)e=efdZd\ed,ed)eefdZded,eed)efd Zeded)efd Zd,ed)dfd Zedue"d ed)dfd Zdue"ded)dfdZdue"ded)dfdZdue"d)dfdZdZd)efdZd)e fdZd)efdZde=e>d)dfdZd,dZd)efdZd)eefdZd\dde"dye"ded)df dZ d7dfededJe=eee"fd\ddted,edUeed~eed)eee"ffd Z d:dfededJe=eee"fd\edted,edUeed!ed~eed"eed#eepd$ee"d%ee d&eed)eee"ffd'Zd\ed)eefd(Zd\ed)d"fd)Z d:dfededJe=eee"fd\edted,edUeed!ed~eed"eed#eepd$ee"d%ee d&eed)eee"ffd*ZdS(;r z Main gateway controller. Manages the lifecycle of all platform adapters and routes messages to/from the agent. interrupt_busy_input_mode_busy_text_mode_restart_drain_timeout_restart_after_turn_timeoutN _exit_codeF _draining_external_drain_active_restart_requested_restart_task_started_restart_detached_restart_via_service _detached_restart_helper_started_restart_command_source _stop_task _restart_task_profile_failed_platforms_systemd_watchdog_startup_restore_in_progress_running_agents_running_agents_ts_active_session_leases _busy_ack_ts_session_run_generationrrrrrrr_pending_messages&_pending_native_image_paths_by_session_session_ephemeral_pin_session_vc_last_pending_approvals_update_prompt_pendingr-rjcV|jd}| i}||jd<|S)z~The per-session state map; lazily created so bare test runners built via ``object.__new__`` work without ``__init__``. _sessions__dict__rv)rrs r> _sessions_mapzGatewayRunner._sessions_map$s5=$$[11  H)1DM+ &rMr+c|}||}|t}|||<|S)zr/zGatewayRunner._session_state-sA%%'' [)) = NNE$)H[ ! rMch|jd}|sdS||S)zAReturn the SessionState for ``session_key`` without creating one.rCNrD)rr+rs r>rAz!GatewayRunner._peek_session_state6s6=$$[11 4||K(((rMcP||}|duo |jjduS)zDTrue when the session holds a running-turn slot (agent or sentinel).N)rAturnr)rr+r;s r>_is_session_runningz!GatewayRunner._is_session_running=s/((55D AUZ%5T%AArMcbd|DS)z(session_key, agent) pairs for sessions with a running turn (including pending sentinels), matching the old ``_running_agents`` dict contents.cHg|]\}}|jj||jjf Sr^)rJr)rbrr;s r>rz6GatewayRunner._running_agent_items..Fs;   Uz+%*" #+++rM)rFrrs r>_running_agent_itemsz"GatewayRunner._running_agent_itemsBs;  "002288::    rM asyncio.Task_loop_heartbeat_task_loop_floor_timer_handle_loop_liveness_watchdogr@_gateway_started_atzthreading.Event_shutdown_watchdog_done _platform_lock_takeover_on_start_reconnect_watcher_taskrzc ||n t|_ ddlm}|t t |jddn,#t $rtddYnwxYwi|_ i|_ | tj |a||_||_||_||_||_||_||_||_||_ |!|_"|#|_$ddl%m&t |jj'd d }|r |dkr|d zndtQ|jj)|jfd  |_*tW|j*|_,t[|j|_.d|_/d|_0tcj2|_3d|_4d|_5d|_6d|_7d|_8i|_9d|_:d|_;d|_<d|_=d|_>d|_?d|_@d|_Ad|_BtjC|_Dd|_Ed|_Fd|_GtjI|_Jd|_Kd|_Li|_Mt|_Oi|_Pd|_Qd|_Rg|_Sg|_Tt|_Vd|_WtjI|_Xt|_Zt|_[d|_\ddlH}t|_]|I|_^|_|_`d|_ad|_bi|_ct|_dddle}|fd|_g ddlhmi}|dn#t $rYnwxYw ddljmk}|}tt|dddpdno} t t|ddd} t|ddd} | dkr| s| stpdn,#t $rtddYnwxYwd|_q ddlrms} mt} | | |_qn2#t $r%}tpd|Yd}~nd}~wwxYw|jq ddljmk}|ud pi}|ud!drc|jqjvwt|ud"d#t|ud$d %|ud&dr|jqjvzt|ud'd(t|ud$d t|ud)d*t |ud+d|jj),n2#t $r%}td-|Yd}~nd}~wwxYw ddljmk}|ud.pi}|ud&drxdd/l{m|}|t|ud'd0t|ud$d dt|ud1d23n2#t $r%}td4|Yd}~nd}~wwxYwdd5l}m~}||_i|_dd6lm}||_||_i|_t|_tjC|_d|_d|_d|_tjC|_d7|_dS)8Nr)set_multiplex_activerFz#could not set multiplex-active flagTrr*bg_process_max_age_hoursrrdc2|S)N)max_active_age)has_active_for_session)r_bg_max_age_secondsr+s r>rz(GatewayRunner.__init__..s$0@0W0W$71X11rM)has_active_processes_fnir()ensure_installed) log_failures load_config approvalsmodemanualrxr1tirith_enabledr ra6Gateway approvals.mode=manual with no automated risk assessor (security.tirith_enabled is false and auxiliary.approval is unset): dangerous commands and execute_code scripts will BLOCK until a human approves them in chat. Enable security.tirith_enabled or configure auxiliary.approval for unattended operation.z$approvals.mode startup check skipped)AsyncSessionDB SessionDBz&SQLite session store not available: %sr auto_archiveauto_archive_daysr)min_interval_hours idle_daysrm auto_pruneretention_daysZmin_vacuum_interval_daysrvacuum_after_prune)rqrmrsvacuum sessions_dirz%state.db auto-maintenance skipped: %sr)maybe_auto_prune_checkpointsrr)rqrmdelete_orphansrz'checkpoint auto-maintenance skipped: %s PairingStore) HookRegistryr@)rrzrrYrrVr2r3r4r_profile_adapters'_warn_if_docker_media_delivery_is_risky_weakrefrefr_load_prefill_messagesr_load_ephemeral_system_prompt_ephemeral_system_prompt_load_reasoning_configr_load_service_tierr_load_show_reasoning_show_reasoning_load_busy_input_moder%_load_busy_text_moder&_load_restart_drain_timeoutr' _load_restart_after_turn_timeoutr(_load_provider_routingr_load_fallback_model_fallback_modelr-r+default_reset_policyrZrvrrX_async_session_storercdelivery_router_running _gateway_looprr_shutdown_event _exit_cleanly_exit_with_failure _exit_reasonr)r*r4r5r+r,_signal_initiated_shutdownr-r.r/r0r1rU _startup_time_booted_from_restartr2r3rr_executor_lock _executor_executor_closingrCrg _turn_leasesrr6rV_startup_restore_queue_startup_restore_tasksr_session_sources_session_sources_max_completion_delivery_lockr_completion_deliveries_inflight _completion_deliveries_delivered_completion_delivery_retentionr r _active_profile_name_kanban_notifier_profile_teams_pipeline_runtime_teams_pipeline_runtime_error_failed_platforms_fatal_handler_tasks itertoolsr_slash_confirm_countertools.tirith_securityrarrdrwr!rxryrrR hermes_staterirjrvrSmaybe_auto_archiverirhmaybe_auto_prune_and_vacuumtools.checkpoint_managerrwgateway.pairingr{ pairing_storepairing_stores gateway.hooksr|hooks_load_voice_modes _voice_mode_recent_voice_transcripts_background_tasksrTrQrRrS_last_inbound_at_scale_to_zero_cooldown_until)rrzrY_bg_max_age_hours _threading _itertoolsra_load_full_config _appr_cfg _appr_mode _tirith_on _aux_approvalrirjr _sess_cfgr< _ckpt_cfgrwr{r|r^r+s @@r>rzGatewayRunner.__init__Vs !' 2ff8V8X8X  O ? ? ? ? ? ? gdk;OQV&W&W!X!X Y Y Y Y O O O LL>L N N N N N O=? RT 44666&l400"&!!>(,(J(J(L(L%!%!!>!4466#88:: $ : : < <#88::&*&F&F&H&H#+/+P+P+R+R(!%!!>#88:: <;;;;;# K ,.H"  ): ]>ORS>S>S  $ $Y] * K $dk%%%%%   %6d6H$I$I!-dk:: BF&}""'+/)-RT&!%',#"'+0'%*"!&$)!05-@D$%)IKK +0!2659'n..JN"' 35566F9;$ -2)16-:<#:<# DO==$'! *3)9)9&MPUU,^i^k^k-.2+ '&&&7B}}!+!2!2 )-(A(A(C(C%'+$<@* BD*-! '&&&&0&6&6q&9&9#  > > > > > >  % 0 0 0 0 0    D  P J J J J J J))++I ;IIIUXeggeegg gi=MW[\\\]]J#I{JPTUUUMX%%j%%C P P P LL?$L O O O O O P  H > > > > > > > >-~iikk::D   H H H NNCQ G G G G G G G G H   ' KNNNNNN..0044Z@@FB ==77$(;;"' 6I1(M(M"N"N+.y}}=QSU/V/V+W+W<==u55 $(DD'*9==9I2+N+N'O'O+.y}}=QSU/V/V+W+W14%MM*DbII22 $IMM2F$M$MNN%)[%=E K K K DcJJJJJJJJ K  I J J J J J J**,,00??E2I}}\511 QQQQQQ-,#&y}}5Eq'I'I#J#J'*9==9Mr+R+R'S'S#(&))--8KS*Q*Q&R&R   I I I LLBC H H H H H H H H I 100000)\^^9; /.....!\^^ ,0+A+A+C+CZ\&'*ee +/)++ <@!(,%'+$(,y{{58***s2A&A76A7Q00 Q=<Q=B-T//&UU# V V3V..V3?E&\&& ]0]]B3` `<`77`<ctj|jvrdStstddS ddlm}n3#t$r&}t d|Yd}~dSd}~wwxYw ||}n3#t$r&}t d|Yd}~dSd}~wwxYw|rt ddS|j r"t d|j dSdS) uBind the Teams meeting pipeline runtime to Graph webhook ingress. No-op when the msgraph_webhook adapter isn't running or the teams_pipeline plugin isn't enabled — lets the gateway start cleanly whether or not the user has opted into the pipeline. Nz:Teams pipeline plugin is disabled; skipping runtime wiringr)bind_gateway_runtimez(Teams pipeline runtime import failed: %sz(Teams pipeline runtime wiring failed: %sz7Teams pipeline runtime bound to msgraph webhook ingressz&Teams pipeline runtime unavailable: %s) rMSGRAPH_WEBHOOKrrzr3r4plugins.teams_pipeline.runtimerr2rrzr)rrr<bounds r>_wire_teams_pipeline_runtimez*GatewayRunner._wire_teams_pipeline_runtimesS  #4= 8 8 F-//  LLU V V V F  K K K K K K K    NNEs K K K FFFFF  ((..EE    NNEs K K K FFFFF    KKQ R R R R R  /  NN82       s0A A8A33A8< B B8B33B8ctjdddkrdS|j}d|D}|sdStjdd}g}|rc t j|}t|tr d|D}n,#t$rt dd YnwxYwd }|D]A}t|}|s|d } | t vrd }nB|rdStd dS)aWarn when Docker-backed gateways lack an explicit export mount. MEDIA delivery happens in the gateway process, so paths emitted by the model must be readable from the host. A plain container-local path like `/workspace/report.txt` or `/output/report.txt` often exists only inside Docker, so users commonly need a dedicated export mount such as `host-dir:/output`. rrdockerNc\g|])}|tjtjtjhv'|*SrN)rrt API_SERVERWEBHOOKr:s r>rzIGatewayRunner._warn_if_docker_media_delivery_is_risky..s3xxxQqQYQdfnfv@w7w7wq7w7w7wrMrcVg|]&}t|tt|'SrNr~rbrs r>rzIGatewayRunner._warn_if_docker_media_delivery_is_risky.. s-LLL!As9K9KLs1vvLLLrMzACould not parse TERMINAL_DOCKER_VOLUMES for gateway media warningTrF containeraFDocker backend is enabled for the messaging gateway but no explicit host-visible output mount (for example '/home/user/.hermes/cache/documents:/output') is configured. This is fine if the model already emits host-visible paths, but MEDIA file delivery can fail for container-local paths like '/workspace/...' or '/output/...'.)rrrxryrzget_connected_platformsr3r4rtrr2r3r4_DOCKER_VOLUME_SPEC_REr[r$_DOCKER_MEDIA_OUTPUT_CONTAINER_PATHSr) r connectedmessaging_platforms raw_volumesvolumesparsedhas_explicit_output_mountspecr[container_paths r>r~z5GatewayRunner._warn_if_docker_media_delivery_is_riskys 9^R ( ( . . 0 0 6 6 8 8H D D FK7799 xx)xxx"  Fi 92>>DDFF   q qK00fd++MLLvLLLG q q q `ko ppppp q%*!  D*0066E "[[55N!EEE,0)F %  F P     s5C &C43C4cL ddlm}|dduS#t$rYdSwxYw)z3Check if the hermes-agent-setup skill is installed.r) _find_skillzhermes-agent-setupNF)tools.skill_manager_toolrr2)rrs r>_has_setup_skillzGatewayRunner._has_setup_skill)sQ  < < < < < <;344D@ @   55 s  ##zgateway_voice_mode.jsonrr2c|jd|S)z6Return a platform-namespaced key for voice mode state.rr)rrr2s r> _voice_keyzGatewayRunner._voice_key5s.,,7,,,rMc tj|jd}n$#ttjt f$ricYSwxYwt|tsiShd}i}| D]>\}}||vr t|}d|vrt d|9|||<?|S)NrQr>rr voice_onlyrz}Skipping legacy unprefixed voice mode key %r during migration. Re-enable voice mode on that chat to rebuild the prefixed key.) r3r4_VOICE_MODE_PATHrXFileNotFoundErrorJSONDecodeErrorrrtrurrwr3r)rdata valid_modesrr2rfrs r>rzGatewayRunner._load_voice_modes9s :d3==w=OOPPDD!4#7A   III $%% I222 !ZZ\\  MGT;&&g,,C#~~U F3KK s-0AAc |jjdd|jt j|jdddS#t$r&}t d|Yd}~dSd}~wwxYw)NTrexist_okr|indentrQrzFailed to save voice modes: %s) rrmkdir write_textr3rBrrr3r)rrs r>_save_voice_modeszGatewayRunner._save_voice_modesSs @  ! ( . .td . K K K  ! , , 4+A666 -      @ @ @ NN;Q ? ? ? ? ? ? ? ? ? @sAA B $BB rjc,t|dd}t|tsdS|rT||t|dd}t|tr||dSdS||dS)zBUpdate an adapter's in-memory auto-TTS suppression set if present._auto_tts_disabled_chatsN_auto_tts_enabled_chatsrVrtrrdiscard)rr1r2rjdisabled_chats enabled_chatss r>_set_adapter_auto_tts_disabledz,GatewayRunner._set_adapter_auto_tts_disabled\s *DdKK.#..  F  ,   w ' ' '#G-FMMM--- /%%g..... / /  " "7 + + + + +rMrc,t|dd}t|tsdS|rT||t|dd}t|tr||dSdS||dS)zUpdate an adapter's per-chat auto-TTS opt-in set if present. Used for ``/voice on``/``/voice tts`` where the user explicitly wants auto-TTS even when ``voice.auto_tts`` is False globally. rNrr)rr1r2rrrs r>_set_adapter_auto_tts_enabledz+GatewayRunner._set_adapter_auto_tts_enabledjs  )BDII ---  F  +   g & & &$W.H$OON.#.. 0&&w///// 0 0  ! !' * * * * *rMcvt|dd}t|tsdSt|dd}t|dd}t|tst|tsdS ddlm}|}t |dpidd }n#t$rd }YnwxYwt|d r||_ |j d t|trL| | fd |jDt|trN| | fd |jDdSdS)aeRestore persisted /voice state into a live platform adapter. Populates three fields from config + ``self._voice_mode``: - ``_auto_tts_default``: global default from ``voice.auto_tts`` - ``_auto_tts_enabled_chats``: chats with mode ``voice_only``/``all`` - ``_auto_tts_disabled_chats``: chats with mode ``off`` rNrrrrcvoiceauto_ttsF_auto_tts_defaultrc3K|]9\}}|dk | |tdV:dS)rNr!r7rbrrfrs r>rdzBGatewayRunner._sync_voice_mode_state_to_adapter..sX""&/c45==S^^F%;%;=CKKLL! ===""rMc3~K|]7\}}|dv ||tdV8dS)>rrNrrs r>rdzBGatewayRunner._sync_voice_mode_state_to_adapter..s_!!&/c4000S^^F5K5K0CKKLL!0000!!rM)rVrtrrrrdrrvr2rrrr4rIrr) rr1rrrr _full_cfgrrs @r>!_sync_voice_mode_state_to_adapterz/GatewayRunner._sync_voice_mode_state_to_adapter|s"7J55(H--  F *DdKK)BDII .#.. z-QT7U7U  F & J J J J J J))++I $w''-222:uEE!!   & & & %    & 7/ 0 0 :(9G %N%%% nc * *   " " "  ! !""""373C3I3I3K3K"""    mS ) )     ! ! !  !!!!373C3I3I3K3K!!!       s9AC CC awaitablercK|dkr |d{VdStj|} tj|h|d{V\}}nB#tj$r0||t wxYw||vr |d{VdS||t dS)a~Wait for adapter cleanup without letting cancellation swallowing hang us. ``asyncio.wait_for`` cancels an overdue child but then waits for it to exit. An adapter close path that catches ``CancelledError`` can therefore block recovery forever. Keep ownership of the old task through its done callback, but release the runner at the deadline. rNTrF)r ensure_futurerBrcancelrr)rr rrdone_pendings r>#_await_adapter_cleanup_with_timeoutz1GatewayRunner._await_adapter_cleanup_with_timeouts a<<OOOOOOO4$Y// #*<#H#H#HHHHHHHND((%    KKMMM  " "#? @ @ @   4<<JJJJJJJ4  ;<<<us A ?Bc\K|} |||d{V}|s'td|||jnddSdS#t $r0}td||jnd|Yd}~dSd}~wwxYw)uCall adapter.disconnect() defensively, swallowing any error. Used when adapter.connect() failed or raised — the adapter may have allocated partial resources (aiohttp.ClientSession, poll tasks, child subprocesses) that would otherwise leak and surface as "Unclosed client session" warnings at process exit. Must tolerate partial-init state and never raise, since callers use it inside error-handling blocks. NzITimed out after %.1fs while disconnecting %s adapter; continuing shutdownr1z7Defensive %s disconnect after failed connect raised: %s) _adapter_disconnect_timeout_secsrrr3rrr2r4)rr1rrrrs r>_safe_adapter_disconnectz&GatewayRunner._safe_adapter_disconnects7799 "FF""$$gI _&.&:HNN        LLI"*"6I          sAA11 B+;%B&&B+profilerc:K|}|rd|dnd}tj} |||d{V}|s"t d|j||n9#t$r,}t d|j||Yd}~nd}~wwxYw || |d{V} | r8t d|jtj|z |dSt d|j||dS#t$rB}t d |jtj|z ||Yd}~dSd}~wwxYw) a>Tear down one adapter on the shutdown path with bounded awaits. Both ``cancel_background_tasks()`` and ``disconnect()`` can block indefinitely when a platform's network state is half-dead (e.g. a wedged Feishu/Lark WebSocket thread waiting on I/O). An unbounded await here stalls the entire shutdown sequence past systemd's ``TimeoutStopSec``; the resulting SIGKILL skips ``atexit`` PID-file cleanup, so the next start dies with "PID file race lost" (#14128). Each await uses the existing per-adapter timeout budget (``HERMES_GATEWAY_ADAPTER_DISCONNECT_TIMEOUT``). On timeout the old task is cancelled and detached, then teardown forces forward progress; the loop never hangs even if an adapter swallows cancellation. Never raises. z (profile: rrNuH✗ %s background-task cancel timed out after %.1fs - forcing continue%su)✗ %s background-task cancel error%s: %su✓ %s disconnected (%.2fs)%su<✗ %s disconnect timed out after %.1fs - forcing continue%su)✗ %s disconnect error after %.2fs%s: %s) rrUrrcancel_background_tasksr3rrr2r4rrzrP) rr1rrrsuffix started_at cancelledr disconnecteds r>_bounded_adapter_teardownz'GatewayRunner._bounded_adapter_teardowns3$7799-4<)w))))"^%%  a"FF//117I ^NGV a a a LLDhnV\^_ ` ` ` ` ` ` ` ` a !%!I!I""$$g""L  3NDN$4$4z$A6 RNGV    LL; 0 0: =vq          s7AB B>"B99B>A&E*"E F7FFctjdd}|rK t|}t d|S#t $rt d|YnwxYwtS)z?Return the per-adapter disconnect timeout used during shutdown.)HERMES_GATEWAY_ADAPTER_DISCONNECT_TIMEOUTrr@z=Ignoring invalid HERMES_GATEWAY_ADAPTER_DISCONNECT_TIMEOUT=%r) rrrxrirCrjr3r(_ADAPTER_DISCONNECT_TIMEOUT_SECS_DEFAULT)rrxrs r>rz.GatewayRunner._adapter_disconnect_timeout_secssiCRHHNNPP  ) )**3(((    S 87A %A21A2c&tjdd}|rK t|}t d|S#t $rt d|YnwxYw|tj krtStS)zBReturn the per-platform connect timeout used during startup/retry.rBrr@z;Ignoring invalid HERMES_GATEWAY_PLATFORM_CONNECT_TIMEOUT=%r) rrrxrirCrjr3rrr&_TELEGRAM_CONNECT_TIMEOUT_SECS_DEFAULT&_PLATFORM_CONNECT_TIMEOUT_SECS_DEFAULT)rrrxrs r>_platform_connect_timeout_secsz,GatewayRunner._platform_connect_timeout_secs%siA2FFLLNN  ) )**3(((    Q  x( ( (9 955r" is_reconnectr(cTK||}|dkr||d{VStj||} tj|h|d{V\}}nB#tj$r0||twxYw||vr|d{V}t|S||tt|j d|dd)uConnect an adapter without allowing one platform to block others. ``is_reconnect`` is forwarded to ``adapter.connect()`` so platform adapters can distinguish a cold first boot (drop any stale server-side queue) from a watcher reconnect after a prolonged outage (preserve the queue so messages sent during the outage are delivered rather than silently dropped — #46621). rr'Nrz connect timed out after gr) r&connectrrrBrrrrr TimeoutErrorr) rr1rr(rrrrrs r>_connect_adapter_with_timeoutz+GatewayRunner._connect_adapter_with_timeout6sZ55h?? a<< lCCCCCCCC C$ OOO 6 6   #*<#H#H#HHHHHHHND((%    KKMMM  " "#? @ @ @   4<<ZZZZZZF<<   ;<<<~ D D D D D D   s # B?CcKt|j|_ |||d{V d|_S#d|_wxYw)aTConnect one cold-start adapter with tightly scoped replace intent. The capability is visible only while this initial connect is awaited. Reconnects call ``_connect_adapter_with_timeout`` directly and adapters also default to deny, so a later network recovery can never evict a healthy token holder. NF)rrV_platform_lock_takeover_allowedr-)rr1rs r>%_connect_initial_adapter_with_timeoutz3GatewayRunner._connect_initial_adapter_with_timeout\sl37  13 3 / <;;GXNNNNNNNN N6;G 3 3eG 3 ; ; ; ;s A A c|jSr^)rrNs r>should_exit_cleanlyz!GatewayRunner.should_exit_cleanlyls !!rMc|jSr^)rrNs r>should_exit_with_failurez&GatewayRunner.should_exit_with_failureps &&rMc|jSr^)rrNs r> exit_reasonzGatewayRunner.exit_reasonts   rMc|jSr^)r)rNs r> exit_codezGatewayRunner.exit_codexs rMr(c t|drL|jE |j|}t|tr|r|Sn#t $rYnwxYwt |dd}d}t |ddr5|jr|j}n& ddlm }|pd}n#t $rd}YnwxYwt|t |d d t |d d| S) zUResolve the current session key for a source, honoring gateway config when available.rNrzrFrget_active_profile_namerJgroup_sessions_per_userTthread_sessions_per_user)r<r=r) rr_generate_session_keyrtrwr2rVrhermes_cli.profilesr;r`)rr(r+rz_profiler;s r>_session_key_for_sourcez%GatewayRunner._session_key_for_source|sE 4 ) ) d.@.L "0FFvNN k3//'K'&&    x.. 6/ 7 7 $~ $!>$KKKKKK6688EIHH $$$#HHH$ $+F4Mt$T$T%,V5OQV%W%W     s#2A AAB$$ B32B3cn|jtjks |jdkrdSt |dd}|dSt |d|} |t |jt |j}n-#t$r t dd YdSwxYw|duS) z>Return whether Telegram DM topic mode is active for this chat.rFrRNrSr2rz(Failed to read Telegram topic mode stateTr) rrrrrVis_telegram_topic_mode_enabledrwr2rr2r3r4)rr(rXrxs r>_telegram_topic_mode_enabledz*GatewayRunner._telegram_topic_mode_enableds ?h/ / /63Ct3K3K5T=$77  5Z ;;  ;;FN++FN++<CC    LLCdL S S S55  d{s ;B&B0/B0rroc|jtjks |jdkrdS||sdSt |jpd}||jvS)zUTrue for the main Telegram DM (or General topic) when topic mode has made it a lobby.rFrrrrrrErwr_TELEGRAM_GENERAL_TOPIC_IDSrr(tids r>_is_telegram_topic_root_lobbyz+GatewayRunner._is_telegram_topic_root_lobbysb ?h/ / /63Ct3K3K50088 5&"(b))d666rMc|jtjks |jdkrdS||sdSt |jpd}|r ||jvrdSdS)z9True for a user-created Telegram private-chat topic lane.rFrTrGrIs r>rz%GatewayRunner._is_telegram_topic_laness ?h/ / /63Ct3K3K50088 5&"(b)) cT===5trMr%ct|dsi|_t|jpd}|sdSddl}|}|j|d}||z |jkrdS||j|<dS)a+Rate-limit root-DM lobby reminders to one message per cooldown window. A user who forgets multi-session mode is enabled and types several prompts in the root DM would otherwise get a reminder for every message. Cap it so the first one lands and the rest stay quiet. _telegram_lobby_reminder_tsrTrNr@F)rrNrwr2rUrrv#_TELEGRAM_LOBBY_REMINDER_COOLDOWN_Srr(r2rWrlasts r>$_should_send_telegram_lobby_reminderz2GatewayRunner._should_send_telegram_lobby_reminderst:;; 2/1D ,fn*++ 4oo/33GSAA :@ @ @547(1trMc dS)Na This main chat is reserved for system commands. To start a new Hermes chat, open the All Messages topic at the top of this bot interface and send any message there. Telegram will create a new topic for that message; each topic works as an independent Hermes session.rNrNs r>"_telegram_topic_root_lobby_messagez0GatewayRunner._telegram_topic_root_lobby_messages *  rMc dS)Na0To start a new parallel Hermes chat, open the All Messages topic at the top of this bot interface and send any message there. Telegram will create a new topic for it. Each topic is an independent Hermes session. Use /new inside an existing topic only if you want to replace that topic's current session.rNrNs r> _telegram_topic_root_new_messagez.GatewayRunner._telegram_topic_root_new_messages W  rMc6||sdS dS)NzStarted a new Hermes session in this topic. Tip: for parallel work, open All Messages and send a message there to create a separate topic instead of using /new here. /new replaces the session attached to the current topic.)rrr(s r>_telegram_topic_new_headerz(GatewayRunner._telegram_topic_new_headers,++F33 4 9  rMc&t|dd}||jr|jsdSt|d|}|t |jt |jt |jpd|j|jdS)zEPersist the Telegram topic -> Hermes session binding for topic lanes.rRNrSr)r2rrr+rN)rVr2rbind_telegram_topicrwrr+rN)rr( session_entryrXs r>_record_telegram_topic_bindingz,GatewayRunner._record_telegram_topic_bindings T=$77  V^ 6;K  FZ ;; &&''&*++,"--%1$/ '     rMrc||sdS |||dS#t$r!td|dYdSwxYw)u4Update the topic binding to point at ``session_entry.session_id``. Telegram topic lanes persist a (chat_id, thread_id) -> session_id row so reopening a topic in a fresh process resumes the right Hermes session. When compression rotates ``session_entry.session_id`` mid-turn, the binding goes stale and the next inbound message in that topic reloads the oversized parent transcript instead of the compressed child, retriggering preflight compression — sometimes in a loop (#20470, #29712, #33414). Nz*telegram topic binding refresh failed (%s)Tr)rr]r2r3r4)rr(r\rs r>rz*GatewayRunner._sync_telegram_topic_bindings"++F33  F   / / F F F F F    LL!_recover_telegram_topic_thread_idz/GatewayRunner._recover_telegram_topic_thread_id(s Ox0 0 04''>(>(44V<<( 4f&,"--;M'T-M"M  4T=$77  4Z ;;  !GGFN++HHH    LL5L E E E44  4fn%%  A155##)r**g55k 2 2 8b99 %g!5!5$$$$tt 6 ts(B<<&C&%C&c ||}n#t$r|cYSwxYw||Stj||S)uApply Telegram DM topic recovery to a source for session-key purposes. ``_handle_message_with_agent`` rewrites ``source.thread_id`` via ``_recover_telegram_topic_thread_id`` *before* deriving the session key for a normal message turn (a lobby/stripped reply gets pinned to the user's last-active topic). Session-scoped command handlers like ``/model`` and ``/reasoning`` derive their override key from the raw inbound ``event.source``, which skips that recovery — so the override is stored under a different key than the next message turn reads, and the override is silently dropped on Telegram forum topics and after compression session splits (#30479). Returns a recovery-normalized copy when a rewrite applies, otherwise the original source unchanged. Always derive the override storage key from the result so storage and read use an identical key. Nr)rfr2 dataclassesrl)rr(res r>!_normalize_source_for_session_keyz/GatewayRunner._normalize_source_for_session_key^sa( >>vFFII   MMM   M"6Y????s  ''rrAc  |}|s+|) ||}n#t$rd}YnwxYwt|}|r|||r||nd}|r |jjnd}|r7|d|}|d|d|d|d|d|dd } | drq| d%t|d| d<t d |pd ||| d|| fSt d |pd ||ndt d |pd |dt| Dddpdt} | dd} | rtd|| | }t#|dd} | r||jrt'|jnd } t#|ddrt'|jnd}t#|ddrt'|jnd}t-| |j| ||}|rJ|jr|j}|jr5t5|j} | dd}|r |js|}|r|r|||| \}} |sb| drM ddlm}|| d}|r"td|| dn#t$rYnwxYw|sq|r||nd}|d}|r |jjnd p|r |jjnd }|r td|pd ||}nB|r@|r|| |j_|| dj_|| fS)uResolve model/runtime for a session. Priority (highest first): session ``/model`` → ``channel_overrides`` → global config/env (``_resolve_gateway_model(user_config)`` and default provider resolution). Nrrrrrrr)rrrrrrzZSession model override (fast): session=%s config_model=%s -> override_model=%s provider=%srz[Session model override (no api_key, fallback): session=%s config_model=%s override_model=%szFNo session model override: session=%s config_model=%s override_keys=%sc0g|]\}}|jj|Sr^) conversationmodel_override)rb_key_sts r>rz@GatewayRunner._resolve_session_agent_runtime..s2!c'6BBBBrMrz[]z;Runtime provider supplied explicit model override: %s -> %srzrrrr)get_default_model_for_provideru8No model configured — defaulting to %s for provider %sru{Empty model resolved for session=%s — recovering last-known-good model %s (config read likely returned empty; see #35314))!rAr2r!_rehydrate_session_model_overriderArmrnrvrr3r4rrFrrrUrzrVr2rwrrrrrrr_apply_session_model_overridehermes_cli.modelsrqlast_resolved_modelrr/)rr(r+rAresolved_session_keyr_override_stater|override_modeloverride_runtimer runtime_modelrr2rrchch_runtime_modelrq _lr_state_lr_star _recovereds r>rz,GatewayRunner._resolve_session_agent_runtimezs +# ,(: ,'+'C'CF'K'K$$ , , ,'+$$$ ,'{33  I  2 23G H H H$ D $ $%9 : : :       LLX$*E%)$*<*<*>*>*D*D*F*F%G%G1"    788&**7D99  " KKM    "EdHd++  16%-3^Cc&.)))G)0d)K)KUF$%%%QU  6#3T::F)***  '## B 18%HE;1%O &&N(6'9'9'4'H'H$(11 0  , $($F$F$e^%% !E> ++J77  LLLLLL66~j7QRRKKR~j9     N((()=>>>  //44H?HP';;bSAIQH)==r  #)).B  #  N# ;6;##(2HMD   $ $ 1 En$$s --<;N88 OO user_messagerrc ddlm}|d|d|d|d|d|dt|d pg|d |d d }||||d|d|d|d|dt |d fd }t |dd}|si|d<|S ||d}n#t $rd}YnwxYw|pi|d<|S)a2Build the effective model/runtime config for a single turn. Always uses the session's primary model/provider. If `/fast` is enabled and the model supports Priority Processing / Anthropic fast mode, attach `request_overrides` so the API call is marked accordingly. r)resolve_fast_mode_overridesrrrrrrrrrr)rrrrNrr)rtrrvrrrVr2) rrrrrrrouterrs r>rz(GatewayRunner._resolve_turn_agent_config"s BAAAAA&)))44&**:66&**:66"0"4"45I"J"J&**:66%)))44++F339r::-112CDD(,,\::    #,- # # "gfo&&   t_d;;  )+E% &L 33E'NCCII   III %._"!" s&D88 EErNrc  |r ||jdSt|dd}|sdSt|ddt|ddt|ddtt|ddd}d |D} |jj}||}|sdS|d}|d } |rtj|ni} n#t$ri} YnwxYwt| tsi} t| d pi ||kr/t fd |DrdS|| d <| |tj| | dS#t$r tddYdSwxYw)ufPersist the runtime model/provider actually used by a gateway turn. Provider fallback can switch ``agent.model``/``agent.provider`` after the session row was created. Keep the session DB metadata in sync so session lists, desktop/dashboard details, and follow-up session tooling report the backend that actually answered the latest turn. Called from the ``run_sync`` closure, which executes off the event loop in the executor thread — so the synchronous ``SessionDB`` (``_db``) is used directly rather than awaiting the AsyncSessionDB forwarder. Nrrrr_fallback_activatedF)rrrfallback_activec"i|] \}}|dv || S))NrrNrs r>rz@GatewayRunner._sync_session_model_from_agent..hs(KKKDAqq 7J7J1a7J7J7JrM model_configgateway_runtimec3PK|] \}}||kV!dSr^rr)rbrrrs r>rdz?GatewayRunner._sync_session_model_from_agent..xsK..041##A&&!+......rM)rz-Failed to sync gateway session model metadataTr)rRrVrrrSrrvr3r4r2rtrurupdate_session_metarBr3r4) rrNrrrdbrow current_model raw_configrzrs @r>rz,GatewayRunner._sync_session_model_from_agentQs; U]d.>.F Fw--  Fz488z488z488#GE3H%$P$PQQ    LKGMMOOKKK Y!%B..,,C GGG,,M00J 3=EJ///2    fd++ "6::.?#@#@#FBGGO%%#....8? ...++%(/F$ %  " ":tz&/A/A " O O O O O Y Y Y LLHSWL X X X X X X YsC#F/8*F/#C<;F/< D F/ D  A1F/>/F//&GGr cKt|dpd} |j||d{VdS#t$r t ddYdSwxYw)uFan a normalised platform reaction event out to the HookRegistry. Adapters call this via ``set_reaction_handler`` for every platform-native reaction event they surface. The adapter-supplied ``event_name`` ("reaction:added" / "reaction:removed") becomes the hook event so user hooks subscribe with the same name scheme as the existing ``agent:*`` family. Errors never block the adapter's event loop — the hook contract is non-blocking. event_namezreaction:addedNz#[Gateway] reaction hook emit failedTr)rwrvrrr2r3r4)rr rs r>_handle_reaction_eventz$GatewayRunner._handle_reaction_events..B2BCC  O*//*c22 2 2 2 2 2 2 2 2 2 O O O LL>L N N N N N N Os!A &A54A5r1c:Kt|dd}|tx}|_tj||}||||jtj |d{VdS)a#React to an adapter failure after startup. If the error is retryable (e.g. network blip, DNS failure), queue the platform for background reconnection instead of giving up permanently. The notification arrives on the failing adapter's own polling task, and the disconnect inside the handler can cancel that task mid-flight: disconnect()'s current-task guard misses it because _safe_adapter_disconnect runs the close in a wrapper task. A cancelled handler dies between the fatal log and the reconnect queue, silently stranding the platform (observed 2026-07-21: telegram popped from adapters but never queued after a travel network outage). Run the real work in a detached task that adapter teardown cannot cancel. rN) rVrrr create_task$_handle_adapter_fatal_error_detachedrrrshield)rr1tasksrs r>_handle_adapter_fatal_errorz)GatewayRunner._handle_adapter_fatal_errors4d;; =03 5ED-"4#L#LW#U#UVV $ u}--- nT"""""""""""rMc|jsdS|jj|j}|r|j|jvrdS|dt j||j|| |j|d|j|j<t d|jj | dS)a&Queue a retryable fatal adapter for background reconnection. Returns True when the platform was newly queued. Idempotent if already queued. Must not await: callers invoke this *before* any disconnect await so a wedged close cannot strand the platform (#80598). Frrzattempts next_retrycredential_claimlistener_claimz%%s queued for background reconnectionT)fatal_error_retryablerzrErvrrrUr_adapter_credential_claim_adapter_listener_claimr3rzr!_ensure_reconnect_watcher_running)rr1rs r>_queue_retryable_fatal_platformz-GatewayRunner._queue_retryable_fatal_platforms, 5+/33G4DEE '"2d6L"L"L5%.** $ > > '!!#:: ' 4 4 w/0  3   "    ..000trMcK |}|dkr||d{Vn|tdtd|z}||||d{V}|s;t d|jj|| |n#tj $rP | |n7#t$r*t d|jjdYnwxYwt$rvt d |jj | |n7#t$r*t d |jjdYnwxYwYnwxYw|j}t|d d}|jo4||jvo+|t|d ivo|duo| }|rRt d |j|jd|_d|_|d{VdSdS#|j}t|d d}|jo4||jvo+|t|d ivo|duo| }|rQt d |j|jd|_d|_|d{VwwxYw)zRun the fatal handler; if the platform still ends up stranded (not reconnected, not queued, not intentionally disabled), exit the gateway with failure so the service manager restarts it instead of leaving a silent partial outage.rN@皙?zXFatal-error handling for %s timed out after %.1fs; ensuring reconnect queue is populatedz3Failed to queue %s after fatal-handler cancellationTrz/Fatal-error handling for %s raised unexpectedlyz0Failed to queue %s after fatal-handler exceptionrrzp%s adapter was lost without entering the reconnection queue; exiting gateway so the service manager restarts it.z( adapter lost without reconnection queue)r _handle_adapter_fatal_error_implr6rCrr3rPrrrrrr2r4rrVrrr8rrstop)rr1routerrrshutdown_eventstrandeds r>rz2GatewayRunner._handle_adapter_fatal_error_detachedsG " ;;==G!||;;GDDDDDDDDDD  #c3tW+=+=">">>"&"J"J99'BB## !BLL@(.  88AAA%    44W====    I$*!        A &     44W====    F$*!   'H$T+rz.GatewayRunner._handle_adapter_fatal_error_implsl=$$W%566  HG$;$; LLV &(5I    F -   "  $ 1  ' :?      #'7 7 7'NN  * %'NN$N ,,   ")/!5 -    w   M  g. 5 5 5,0MD ) ,,W555 w  //9IJJ J J J J J J J} T%;  ' ; d?dD , h*.' rssss fggg))++          4#9  NN'D*++          rMcTd|_||_|jdSNT)rrrr)rrs r>_request_clean_exitz!GatewayRunner._request_clean_exitxs-!"   """""rMc*t|jSr^)r7r7rNs r>_running_agent_countz"GatewayRunner._running_agent_count}s4'(((rMc~||z|zS)z>All agent work the gateway must expose and drain as one total.)r_active_cron_job_count_active_api_run_countrNs r>_active_work_countz GatewayRunner._active_work_counts@  % % ' '))++ ,((** + rMc` ddlm}t|S#t$rYdSwxYw)u9Count of cron jobs currently executing, from the cron scheduler's own in-flight tracking (``cron.scheduler._running_job_ids``). Cron jobs run through a standalone ``AIAgent`` on the scheduler's own thread pool (``cron/scheduler.py::run_job``), entirely outside ``self._running_agents`` — the dict every OTHER active-work check on this class (``_running_agent_count``, ``_drain_active_agents``) reads. Without this, the shutdown drain is structurally blind to in-flight cron work: it can report ``active_at_start=0`` and proceed straight to killing tool subprocesses while a cron job's terminal command is still running (#60432). Best-effort: returns 0 if the cron module can't be imported (e.g. a minimal test double for this class). r)get_running_job_ids)rcrr7r2)rrs r>rz$GatewayRunner._active_cron_job_countsS  : : : : : :**,,-- -   11 s  --c t|ditj}t|dd}t |r%t dt |ndS#t$rYdSwxYw)a/Count API-server work that is outside ``_running_agents``. The primary API server owns the sole HTTP listener. Secondary multiplex profiles cannot create an ``api_server`` adapter because it binds a port, so only the primary registry is a supported source of this work. ractive_agent_work_countNr)rVrvrrr/rCrhr2)rr1helpers r>rz#GatewayRunner._active_api_run_counts dJ33778KLLGW&?FFF,4V,<,<C3q#ffhh--(((! C   11 sA4A77 BBcV t|ditj}t|dd}t |r&t dt ||ndS#t$r&}t d|Yd}~dSd}~wwxYw)aInterrupt API-server agents that are not in ``_running_agents``. Counterpart of ``_active_api_run_count()``: that method folds adapter-owned API work into the shutdown drain, so this one must reach the same agents when the drain times out. Duck-typed on the adapter so an older adapter (or a minimal test double for this class) without the hook is simply skipped rather than raising mid-shutdown. rinterrupt_active_runsNrz7Failed interrupting api_server runs during shutdown: %s) rVrvrrr/rCrhr2r3r4)rrr1rr<s r>_interrupt_api_server_runsz(GatewayRunner._interrupt_api_server_runss dJ33778KLLGW&=tDDF2:62B2BI3q#ffVnn--... I    LLRTW X X X11111 sA5A88 B(B##B(cttd|jDrdS ddlm}|dkrdSn,#t$rt ddYnwxYw ddlm}| rdS|j rdSn,#t$rt ddYnwxYwd S) anLive background work that must block a suspend (D3/F7). Backgrounded delegate_task / kanban / terminal(background=true) are NOT counted by _running_agent_count(), but suspending mid-flight loses them. Checks the runner's own tracked tasks + the process registry's running processes + any pending process-completion watchers. c36K|]}|j VdSr^)r)rbrs r>rdzHGatewayRunner._scale_to_zero_has_live_background_work..s,<<61688|<<<<<'_scale_to_zero_has_live_background_workz5GatewayRunner._scale_to_zero_has_live_background_works" <#_scale_to_zero_idle_timeout_secondsz1GatewayRunner._scale_to_zero_idle_timeout_secondssDDDDDD +--H,6x,F,FPi(((DB-7D-A-AK"&&)))tC#t$$ 6gg455   CCC ))#...sBB B*)B*cddlm}|j}|j}|j} t }t |tr|dnd}t |tr|dnd}t |trt |dtr|d}t |dtr|ddkr|d}t |dtr|ddkr|d}n#t$rYnwxYw|||fS) a Return ``(max_restarts, window_seconds, max_gap_seconds)`` for the auto-resume restart-loop breaker (#30719, defense-3), read from ``gateway.restart_loop_guard`` in config.yaml with the module defaults as fallback. ``max_restarts <= 0`` disables the breaker. ``max_gap_seconds`` is the longest spacing between two consecutive restart-interrupted boots that still counts them as the same loop, so a crash cycle slower than ``window_seconds`` stays visible (#81642). rrestart_loop_guardr9Nr max_restartswindow_secondsmax_gap_seconds) r9rDEFAULT_MAX_RESTARTSDEFAULT_WINDOW_SECONDSDEFAULT_MAX_GAP_SECONDSrsrtrurvrhr2)r_rlgrrrrrrlgs r>_restart_loop_guard_configz(GatewayRunner._restart_loop_guard_configsg 7666660 46 +--H,6x,F,FPi(((DB2rz;GatewayRunner._scale_to_zero_should_arm.. s.___uq"YX]A^A^____rMN)rrelay_only_or_absentwake_url) gateway.relayrrrrrrzrErr2)rrrrrrErs r>_scale_to_zero_should_armz'GatewayRunner._scale_to_zero_should_arm s000000           ;__ 5 ; ; = =____ I    III  %~''HH   HHH z))++!B!B9!M!M    s#1A AA A"" A10A1cddlm}ddlm}m} |}|sdS |jr(d|jjDng}n#t$rg}YnwxYw||} |}n#t$rd}YnwxYwt d||pd|rdnd dS#t$r t d d YdSwxYw) uLog why the idle watcher did NOT arm — but only for an OPTED-IN instance. A non-opted instance (no HERMES_SCALE_TO_ZERO stamp) not arming is the normal case and must stay silent. When the Labs stamp IS set but the watcher still didn't arm, that's the surprising case worth one INFO line so "why won't it suspend/wake?" is a log grep, not a box-dive. rr)rrNcXg|]'\}}t|ddt|d|(S)rFrrrs r>rzEGatewayRunner._log_scale_to_zero_not_armed_reason..DsJ!Ar"2y%887A..rMuscale-to-zero: NOT armed despite opt-in — relay_only_or_absent=%s (enabled platforms=%s), wake_url=%s. Need relay-only messaging + a registered wake URL.nonerMISSINGz.scale-to-zero: not-armed reason logging failedTr) rrrrrrzrErr2r3rzr4)rrrrractive relay_onlyrs r>#_log_scale_to_zero_not_armed_reasonz1GatewayRunner._log_scale_to_zero_not_armed_reason0s 100000         Z++--G  { %)[%:%@%@%B%B     ::6BBJ )>++    KKE &!0y       Z Z Z LLITXL Y Y Y Y Y Y ZsX B11AB1 A B1A  B1/ A:9B1: B B1B  &B11&CCcddlm}||tj|jz ||S)Nr)is_idle)running_agent_countseconds_since_last_inboundidle_timeout_secondshas_live_background_work)rrrrUrrr)rrs r>_scale_to_zero_is_idlez$GatewayRunner._scale_to_zero_is_idle^sk111111w $ 9 9 ; ;'+y{{T5J'J!%!I!I!K!K%)%Q%Q%S%S     rMctj|_t|dddkrL |dn,#t$rt ddYnwxYwd|_dSdS) aStamp real inbound and restore lifecycle after a dormant wake. The watcher marks runtime status `draining` as it quiesces the relay, but dormancy is not the stop/restart drain path: the process remains alive and should present as running once real traffic wakes it and re-enters the gateway. Internal completion/replay events intentionally do not call this helper, so they do not keep an otherwise idle gateway awake. rr@rrunningz$scale-to-zero: status restore failedTrN)rUrrV_update_runtime_statusr2r3r4rrNs r> _scale_to_zero_note_real_inboundz.GatewayRunner._scale_to_zero_note_real_inboundhs!%  48# > > B B T++I6666 T T T Cd SSSSS T14D . . . C BsA&A.-A.cr ddlm}n#t$rYdSwxYw|j|jS)zHReturn the connected RELAY adapter, if any (the one go_dormant targets).rrN)gateway.platforms.baserr2rrvRELAY)rrs r>_relay_adapter_for_dormancyz)GatewayRunner._relay_adapter_for_dormancyysV  7 7 7 7 7 7 7   44 }  000s  intervalcKtjt|dd{V|jr tj|d{V|jsdSt j|jkrI|s^|}|ut|dd}t|st d|  | dn,#t$rtddYnwxYw |}tj|r|d{Vn,#t$rtd dYnwxYwt jt#|d z|_n;#tj$rt$rtd dYnwxYw|jdSdS) u>Watch for idle and drive the relay dormant so the platform can suspend. Started ONLY when _scale_to_zero_should_arm() (opted in via the Labs HERMES_SCALE_TO_ZERO stamp + relay-only/absent messaging + a wakeUrl). On a sustained idle window it runs the DORMANT sequence (D12/F12/F14): - mark runtime status `draining` (composes with the existing state machine, §3.4(6); does NOT set _running=False), - relay adapter.go_dormant() — going_idle->ack + supervisor-preserving socket close (NOT disconnect(), NOT the run.py stop path), - deliberately NO mark_resume_pending (D13 — suspend preserves RAM). The process stays alive; the platform (Fly autostop:"suspend") suspends the now-traffic-idle machine and autostart wakes it on the wakeUrl poke, at which point the preserved reconnect supervisor re-dials and the connector drains the buffered backlog. After driving dormant we set a re-arm cooldown so a wake's drained backlog isn't immediately re-quiesced. r%N go_dormantuuscale-to-zero: gateway idle for >= %.0fs — going dormant (relay buffered, socket closed, awaiting platform suspend)drainingz!scale-to-zero: status mark failedTrz scale-to-zero: go_dormant failedgN@z%scale-to-zero watcher iteration error)rrr6rrUrrr rVr/r3rzrr r2r4 iscoroutinerCr)rr r1r rs r>_scale_to_zero_watcherz$GatewayRunner._scale_to_zero_watcherst"mC$//000000000m% U$ UmH---------}F9;;!CCC2244::<<?$WlDAA  ++ Q<<>> U// ;;;; UUULL!DtLTTTTTUT'Z\\F*622%$  TTTLL!CdLSSSSST 6:Y[[3xQUCVCV5V22)    U U U Dt TTTTT UIm% U% U% U% U% Usw!F/F/4F/ F/ F/-F//DF/&D.+F/-D..F/2&EF/&F?F/F,F//5G'&G'c|jrdndS)Nrestartshutdownr,rNs r>_status_action_labelz"GatewayRunner._status_action_labels 3CyyCrMc|jrdndS)N restarting shutting downr rNs r>_status_action_gerundz#GatewayRunner._status_action_gerunds#6K||OKrMc"|jo|jdvS)N>rsteer)r,r%rNs r>_queue_during_drain_enabledz)GatewayRunner._queue_during_drain_enableds&V4+@DV+VVrM queued_eventrrc|dSt|dd}|dS||vr4||jj|dS|||<dS)z6Append a /queue event to the FIFO chain for a session.Nr<)rVr/rm queued_eventsr)rr+r r1 pending_slots r> _enqueue_fifozGatewayRunner._enqueue_fifos ? Fw(;TBB   F , & &    , , 9 G N N     )5L % % %rM pending_eventc||}|r |jjnd}|s|S|d}||S|t |dr ||j|<n|d||S)aYPromote the next overflow item after the slot was drained. Called at the drain site after _dequeue_pending_event consumed (or failed to consume) the slot. If there's an overflow item: - When pending_event is None (slot was empty), return the overflow head as the new pending_event. - When pending_event already exists (slot was populated by an interrupt follow-up or similar), stage the overflow head in the slot so the NEXT recursion picks it up. Returns the (possibly updated) pending_event for drain to use. Nrr<)rArmr rUrr<r)rr+r1r _q_stateoverflow next_queueds r>_promote_queued_eventz#GatewayRunner._promote_queued_events"++K88:BL8(66 ! ll1oo     774G#H#H 5@G %k 2 2 OOA{ + + +rMrc||}|rt|jjnd}||t |divr|dz }|S)u=Total pending /queue items for a session — slot + overflow.rNr<r()rAr7rmr rV)rr+r1r" rs r> _queue_depthzGatewayRunner._queue_depths^++K88_is_goal_continuation_eventz)GatewayRunner._is_goal_continuation_events5}fm<<B4yy##$STTTrMcd}|t|ddnd}t|trE||}||r||d|dz }||}|r |jjng}|rCg}|D]2} || r|dz }| | 3||j_|S)aRemove queued synthetic /goal continuations for one session. User-issued /goal pause/clear can race with a continuation already queued by the judge. Remove only synthetic goal continuations while preserving normal /queue and user follow-up events. rNr<r() rVrtrurvr* rUrArmr r) rr+r1removedr r r" r# keptr s r>!_clear_goal_pending_continuationsz/GatewayRunner._clear_goal_pending_continuationss FMFYww(;TBBB_c lD ) ) (,,[99M// >>   d3331 ++K88:BJ8(66  7D ( . . 33LAA.qLGGKK ----26H ! /rMc|sdS ddlm}||S#t$r&}td|Yd}~dSd}~wwxYw)z@Best-effort fresh DB check before running a queued continuation.Fr GoalManagerr~z2goal continuation: active-state recheck failed: %sN)hermes_cli.goalsr1 is_activer2r3r4)rrNr1 r<s r>_goal_still_active_for_sessionz,GatewayRunner._goal_still_active_for_session,s 5  4 4 4 4 4 4;*555??AA A    LLMs S S S55555 s#* AAA gateway_stater6c ddlm}||||j|dS#t$rYdSwxYw)Nrwrite_runtime_status)r5 r6restart_requested active_agents)gateway.statusr8 r,rr2)rr5 r6r8 s r>r z$GatewayRunner._update_runtime_status7s|  ; ; ; ; ; ; +'"&"9"5577            DD s ,0 >>cr ddlm}||dS#t$rYdSwxYw)u]Persist the live in-flight agent count to ``gateway_state.json``. Called at every turn boundary (a running-agent slot is claimed or released) so the dashboard ``/api/status`` readout reflects in-flight gateway turns in near-real-time. Without this the file is only rewritten on lifecycle transitions, so any ``active_agents`` read between transitions is stale (a turn could start and finish without the file ever moving). Deliberately passes ONLY ``active_agents`` — ``gateway_state`` and the other fields stay ``_UNSET`` so ``write_runtime_status``'s read-merge-write preserves the current lifecycle state (``running`` / ``draining`` / …). Passing ``gateway_state=None`` here would clobber it. Best-effort: a failed status write must never disrupt a turn. rr7 )r: N)r; r8 rr2)rr8 s r>_persist_active_agentsz$GatewayRunner._persist_active_agentsCsa   ; ; ; ; ; ; t/F/F/H/H I I I I I I    DD s $( 66c|jrdSd|_td||ddS)u)Begin external drain: stop accepting new turns, flip state. Idempotent — re-entering while already draining is a no-op beyond a best-effort status re-write. In-flight turns are NOT interrupted (the whole point is to let them finish); only NEW turns are refused. NTuExternal drain ENGAGED (.drain_request.json present) — refusing new turns; %d in-flight turn(s) will finish. Process stays up.r )r+r3rzrr rNs r>_enter_external_drainz#GatewayRunner._enter_external_draincsc  &  F&*#  M  # # % %    ##J/////rMc|jsdSd|_|js|jstddStd|ddS)uCancel external drain: revert state, re-accept new turns. Idempotent. Only reverts to ``running`` when we are actually mid-drain AND not also shutting down (a real shutdown ``_draining`` must win — never resurrect a stopping gateway to ``running``). NFugExternal drain marker cleared during shutdown — not reverting to running (shutdown takes precedence).ukExternal drain RELEASED (.drain_request.json removed) — re-accepting new turns; gateway_state -> running.r )r+r*rr3rzr rNs r>_exit_external_drainz"GatewayRunner._exit_external_drainws*  F&+# >   KK:    F  @    ##I.....rM?cKddlm}|jr |r)||n|nC#t j$rt$r'}t d|dYd}~nd}~wwxYwt j |d{V|jdSdS)uNBackground task: reconcile gateway accept-state with the drain marker. Polls ``.drain_request.json`` (presence-based contract, gateway/drain_control.py). Marker present -> ``_enter_external_drain``; marker absent -> ``_exit_external_drain``. The 1s cadence bounds the observe-the-marker latency the live-validation gate checks (point a). Reconciles once at startup. A marker stamped with a PRIOR instantiation epoch (one that survived a machine restart on the durable HERMES_HOME volume — NS-570) is treated as absent by ``drain_requested`` and is NOT honoured; only a marker from the current instantiation flips the gateway into drain. Best-effort: any tick error is logged and the loop continues (a transient stat() failure must not wedge the gateway). r)drain_requestedz$Drain-control watcher tick error: %sTrN) gateway.drain_controlrD rr? r= rA rrr2r3r4r)rr rD r<s r>_drain_control_watcherz$GatewayRunner._drain_control_watchers :99999m * Y"?$$0..000//1111--///)    Y Y Y CSSW XXXXXXXX Y-)) ) ) ) ) ) ) )m * * * * *sAAB2BBrrrrcT ddlm}|||||dS#t$rYdSwxYw)Nrr7 )rrrr)r; r8 r2)rrrrrr8 s r>rz-GatewayRunner._update_platform_runtime_statussm  ; ; ; ; ; ; !-%+            DD s  ''rct|di|}|dS|drdSd|d<|pd|d<td|d< ||jdd|d n#t $rYnwxYwt d |j|d d |d|jdS) u"Mark a queued platform as paused — keep it in ``_failed_platforms`` but stop the reconnect watcher from hammering it. Used by ``/platform pause `` for manual operator intervention. Paused platforms are surfaced in ``/platform list`` and resumed with ``/platform resume ``. Note: the reconnect watcher does NOT auto-pause — retryable (network/DNS) failures keep retrying at the backoff cap indefinitely so a transient outage self-heals without manual intervention. rNpausedTz#auto-paused after repeated failures pause_reasoninfrru%s paused after %d consecutive failures (%s) — fix the underlying issue then run `/platform resume %s` to retry, or `hermes gateway restart` to restart the gateway.rr)rVrvrirrr2r3r)rrrrzs r>_pause_failed_platformz$GatewayRunner._pause_failed_platformst0"5599(CC < F 88H    FX%N)N^#5\\\   0 0'">2 1         D  L NDHHZ33  (.      s$B BBct|di|}|dS|dsdSd|d<|ddd|d<tj|d< ||jd dd n#t$rYnwxYwt d |jd S) uUnpause a platform — reset its attempt counter and schedule an immediate retry. Returns True if the platform was paused and is now queued; False if it wasn't paused (or wasn't in the queue). rNFrI rJ rrrrru,%s resumed — retrying on next watcher tickT) rVrvrUrUrrrr2r3rz)rrrzs r>_resume_paused_platformz%GatewayRunner._resume_paused_platforms t0"5599(CC <5xx!! 5X &&&Z!^--\   0 0)" 1         D  BHNSSSts7B B#"B#ctjdd}|sWt}t|ddpd}|s"tt |dddpd}|sgSt |}|s t|z }| st d|gS t|dd 5}tj|}d d d n #1swxYwYt!|t"st d |gS|S#t$$r(}t d ||gcYd }~Sd }~wwxYw) a\Load ephemeral prefill messages from config or env var. Checks HERMES_PREFILL_MESSAGES_FILE env var first, then falls back to the top-level prefill_messages_file key in ~/.hermes/config.yaml. agent.prefill_messages_file is accepted as a legacy fallback. Relative paths are resolved from ~/.hermes/. HERMES_PREFILL_MESSAGES_FILErprefill_messages_filerrxz#Prefill messages file not found: %srrQrNz3Prefill messages file must contain a JSON array: %sz+Failed to load prefill messages from %s: %s)rrrrwrvr!r expanduser is_absoluterlrr3rrr3loadrtrr2) file_pathrrrrrs r>rz$GatewayRunner._load_prefill_messages sIrz+GatewayRunner._load_ephemeral_system_prompt) sR RQQQQQ;R@@  M*,,::3???rM)rArrrrcddlm}d}t|dd}|rt|||||}|d|t |S)uResolve model for this channel: channel_overrides else global default. Delegates the precedence rule to :func:`hermes_cli.model_switch.resolve_effective_model` (session override > channel override > global default) — the single owner shared with the API server, so the two surfaces cannot diverge again (see 7dd00bb47d). This call site has no session tier: session /model overrides are applied later by ``_apply_session_model_override`` on the resolved runtime. r)resolve_effective_modelNrzr)hermes_cli.model_switchr[ rVrr) rrr2rArrr[ r|rzs r>_resolve_model_for_channelz(GatewayRunner._resolve_model_for_channel8 s& DCCCCCx..  ,## H'&   "; / /   rMrct|dd}|r8t|||||}|r"|jr|jpdSt|ddpdS)aEEphemeral system prompt for this channel/thread. Uses ``channel_overrides`` when set, else the global gateway prompt. Legacy ``channel_prompts`` are applied separately via ``event.channel_prompt`` in ``run_sync`` (adapter ``resolve_channel_prompt``), so they are not duplicated here. rzNrrr)rVrrrx)rrr2rrrzr|s r>rz,GatewayRunner._get_system_prompt_for_channel] sx..  >,## H >H2 > .4";;===t7>>D"DrMcBddlm}t}|||S)aLoad reasoning effort from config.yaml, respecting per-model overrides. Thin wrapper over the shared chokepoint :func:`hermes_constants.resolve_reasoning_config` (per-model override > global ``agent.reasoning_effort``; YAML boolean False = disabled). Closes #21256. Args: model: The effective model for the calling session. When empty, the config's ``model.default`` is used. r)resolve_reasoning_config)rr` r)rr` rs r>rz$GatewayRunner._load_reasoning_configy s4 >=====*,,''U333rMraw_argscddl}t|pddd}|sdS |j|}n$#t $r|}YnwxYwd}g}|D] }|dkrd } ||!d ||fS) zParse `/reasoning` args into `(value, persist_global)`. `/reasoning ` is session-scoped by default. `--global` may be supplied in any position to persist the change to config.yaml. rNru—z--)rFFz--globalTr) shlexrwrxrlrerjrrfry)ra rc rtokenspersist_global value_tokensrs r>_parse_reasoning_command_argsz+GatewayRunner._parse_reasoning_command_args s  8>r""((**225$?? 9 " U[&&FF " " "ZZ\\FFF "  + +E ""!%##E****xx %%++--3355~EEsAA32A3rc|}|s+|) ||}n#t$rd}YnwxYw|r/||}||jj |jjS||S)uResolve reasoning effort for a session, honoring session overrides. Priority: session-scoped ``/reasoning --session`` override > per-model override (``agent.reasoning_overrides``) > global ``agent.reasoning_effort``. ``model`` should be the session's *effective* model (session ``/model`` override included) so per-model overrides track what the session actually runs — when empty, the config's ``model.default`` is used. N)rAr2rArmreasoning_overrider)rr(r+rrv_r_states r>rz/GatewayRunner._resolve_session_reasoning_config s +# ,(: ,'+'C'CF'K'K$$ , , ,'+$$$ ,  @//0DEEH#(=(P(\,??**5111  --rcn|sdS|dnt|||j_dS)z3Set or clear the session-scoped reasoning override.N)rur/rmri )rr+rs r>_set_session_reasoning_overridez-GatewayRunner._set_session_reasoning_override sG   F %,DD$7G2H2H K((5HHHrMc|}|s+|) ||}n#t$rd}YnwxYw|r6||}||jjt ur |jjS|S)uResolve the effective service tier for a session. A session-scoped /fast override wins over the config default. The override dict stores "priority" or None (explicit normal), so key presence — not value truthiness — decides whether it applies. N)rAr2rArmservice_tier_override_SERVICE_TIER_UNSETr)rr(r+rv_t_states r>rz+GatewayRunner._resolve_session_service_tier s +# ,(: ,'+'C'CF'K'K$$ , , ,'+$$$ ,  C//0DEEH$)?*++ ,BB&&(((rk r4c^|sdS|rtn|||j_dS)zSet or clear the session-scoped /fast override. ``service_tier`` is "priority" or None (explicit normal). Pass ``clear=True`` to remove the override entirely (fall back to config). N)rp r/rmro )rr+rr4s r>"_set_session_service_tier_overridez0GatewayRunner._set_session_service_tier_override s@  F $) :  l K((5KKKrMct}tt|dddpd}|}|r|dvrdS|dvrdSt d |dS) aLoad Priority Processing setting from config.yaml. Reads agent.service_tier from config.yaml. Accepted values mirror the CLI: "fast"/"priority"/"on" => "priority", while "normal"/"off" disables it. Returns None when unset or unsupported. rrrrx>rrnormalrJstandardN>rpfastpriorityrx z#Unknown service_tier '%s', ignoring)rrwr!rxryr3r)rrxrs r>rz GatewayRunner._load_service_tier!s+,,'#wCCCIrJJPPRR  !QQQ4 . . .:rz"GatewayRunner._load_show_reasoning!s9+,, C$4 5 5    rMcDtjdd}|sTt }t t |dddpd}|dkrdS|dkrdSdS) zrz#GatewayRunner._load_busy_input_mode!sy92>>DDFFLLNN e.00CwsI/@"MMMSQSTTZZ\\bbddD 7??7 7??7{rMctjdd}|sTt }t t |dddpd}|dkrdS|dkrdSt}|dkrdndS)aResolve normal busy TEXT follow-up behavior. ``busy_input_mode`` is the single source of truth (default ``interrupt``). The legacy ``busy_text_mode`` knob is honored only when a user explicitly set it, so existing queue setups keep working; new installs follow ``busy_input_mode``. Returns one of ``interrupt`` | ``queue`` (``steer`` is handled upstream by ``busy_input_mode`` and maps to non-queue text handling here). r*rrDr)rxr$r) rrrxryrrwr!r r)legacyr input_modes r>rz"GatewayRunner._load_busy_text_mode*!s:B??EEGGMMOO f.00Ci1A2NNNTRTUU[[]]cceeF [ ; W  7"88:: $//ww[@rMctjdd}|sBt}t t |dddpd}t |}|rT|tkrI t|n8#ttf$r$t d|tYnwxYw|S)zrz)GatewayRunner._load_restart_drain_timeoutB!si6;;AACC `.00Cgc7,CRPPPVTVWW]]__C+C00  5AAA c z*   M9   s B2C Cctjd}|(t|dkr|}n!t }t |ddd}t |}|nt|dkrI t|n8#ttf$r$t d|tYnwxYw|S)z?Load in-band restart wait-for-idle timeout in seconds (#77184).!HERMES_RESTART_AFTER_TURN_TIMEOUTNrrrestart_after_turn_timeoutrxzrz.GatewayRunner._load_restart_after_turn_timeoutU!s)?@@  3w<<#5#5#7#72#=#=!CC.00C#w(DdSSSC055 ?s3xx~~//255 c z*   R>   sB''2CCc@tjdd}|s9t}t|dd}|durd}n|dvrt |}|pd}hd }||vrtd |dS|S) uLoad background process notification mode from config or env var. Modes: - ``all`` — push running-output updates *and* the final message (default) - ``result`` — only the final completion message (regardless of exit code) - ``error`` — only the final message when exit code is non-zero - ``off`` — no watcher messages at all HERMES_BACKGROUND_NOTIFICATIONSrrD background_process_notificationsFr>Nrr>rrrPrzBUnknown background_process_notifications '%s', defaulting to 'all') rrrr!rwrxryr3r)rfrrxvalids r>#_load_background_notifications_modez1GatewayRunner._load_background_notifications_model!sy:B?? .00C#y*LMMCe||J&&3xx $$&&,,..111 u   NNT   5 rMct t}|dipiS#t$rYnwxYwiS)z>Load OpenRouter provider routing preferences from config.yaml.provider_routing)rrvr2r{ s r>rz$GatewayRunner._load_provider_routing!sS /00C77-r228b 8    D  s %( 55cl t}t|}|r|Sn#t$rYnwxYwdS)zLoad fallback provider chain from config.yaml. Returns the merged effective chain from ``fallback_providers`` plus any legacy ``fallback_model`` entries. ``fallback_providers`` stays first when both keys are present. N)rr"r2)rfbs r>rz"GatewayRunner._load_fallback_model!sX /00C#C((B       D ts $ 11c ddlm}tdz }|sd|_|jS||} ddlm}|j|}n#t$rYnwxYw ddlm }||}t|tr|}n#t$rYnwxYwn3#t$r&t dd |jcYSwxYwt|pd|_|jS) aRe-read fallback_providers from disk for the next agent create/reuse. Cron already does this per job via ``get_fallback_chain``; the gateway previously froze ``self._fallback_model`` at process start, so a chain configured (or changed) after ``hermes gateway`` was running never reached messaging sessions even though the same process's cron jobs fell back correctly. Fixes #60955. A TRANSIENT read/parse failure (user mid-edit of config.yaml with a non-atomic write) keeps the last known-good chain instead of wiping a cached agent's working fallback for that turn. Only a successful read that genuinely lacks the key clears the chain. r)rrNrrzRfallback_providers refresh: config.yaml read failed; keeping last known-good chainTr)rrrlrrrrrr2rrtrur3r4r")rrcfg_pathrrrrs r>rz%GatewayRunner._refresh_fallback_model!sr ( > > > > > >#m3H??$$ ,'+$++ '&x00C 4444449m9#>>     >>>>>>++C00h--#"C     ( ( ( LL0:>    ' ' ' '  ( 2#66>$##s^1B" B"AB" A$!B"#A$$B"((BB" BB"BB""-CCchainc|dSt|pg}t|ddpd}t|ddr|tjkrdStt|dgpg}||_|r|dnd|_t|ddsd|_||kr)t|dd}|r|dSdSdS)uKeep a cached agent's fallback chain aligned with current config. Skips rewrite while a cooldown is holding the agent on an already- activated fallback provider — ``restore_primary_runtime`` owns that turn-scoped lifecycle. When primary is active (or cooldown expired), replace the chain so mid-uptime ``fallback_providers`` edits take effect without requiring a gateway restart (#60955). N_rate_limited_untilrrF_fallback_chain_unavailable_fallback_keys)rrVrUrr r_fallback_indexr4)rr new_chainrate_limited_until old_chain unavailables r>rz,GatewayRunner._apply_fallback_chain_to_agent!s = F"%% $U,A1EEJ E0% 8 8 "T^%5%555 F(92>>D"EE )09 C ! tu3U;; &$%E !  ! !!%)EtLLK $!!##### " ! $ $rMc>d|DS)Nc,i|]\}}|tu||SrN)r)rbr+rs r>rz:GatewayRunner._snapshot_running_agents..!s4   " U333 333rM)rOrNs r>_snapshot_running_agentsz&GatewayRunner._snapshot_running_agents!s/  &*&?&?&A&A    rMcf ddlm}|t|ddS#t$rYdSwxYw)z:Return the configured active chat session cap, if enabled.r)resolve_max_concurrent_sessionsrzN)hermes_cli.active_sessionsr rVr2)rr s r>_get_max_concurrent_sessionsz*GatewayRunner._get_max_concurrent_sessions"sX  R R R R R R227443P3PQQ Q   44 s " 00c|}|dS||rdS|}||krdSddlm}|||S)zKReturn a user-facing rejection when starting a new session exceeds the cap.Nr)active_session_limit_message)r rKrr r )rr+ max_sessionsrr s r>_active_session_limit_messagez+GatewayRunner._active_session_limit_message "s88::  4  # #K 0 0 40022 , & &4KKKKKK++L,GGGrMc ||rdS||}|d|fS ddlm}|r|jr |jjnd}||d|t |dd|t |dd pd t |d d pd d  S#t$r&}t d |Yd}~dSd}~wwxYw)zAClaim a cross-process active-session slot for a new gateway turn.rTNr)try_acquire_active_sessionr9gateway:rzr2rr)rr2r)rNsurfacerzrz'Failed to claim active session slot: %s) rKr r r rrrVr2r3r)rr+r(local_limit_messager rr<s r>_claim_active_session_slotz(GatewayRunner._claim_active_session_slot"s'  # #K 0 0 :"@@MM  *,, ,  M M M M M M06Y6?Yv,,PYH--&-8--tXt44 (&vy"==C&vy"==C        NNDc J J J::::: sA#B C"CC running_agentcH| |turdSt|dd}t|ttt fsdS|sdSt|dd} |)|5t |cdddS#1swxYwYt |S#t$rYdSwxYw)aLReturn True when *running_agent* is currently driving subagents via the ``delegate_task`` tool. Background (#30170): ``AIAgent.interrupt()`` cascades through the parent's ``_active_children`` list and calls ``interrupt()`` on every child synchronously, which aborts in-flight subagent work and produces a fallback cascade with no actionable signal. Demoting ``busy_input_mode='interrupt'`` to ``queue`` semantics whenever this helper returns True protects subagent work from conversational follow-ups while leaving the explicit ``/stop`` path (which goes through ``_interrupt_and_clear_session``) untouched. Safe-by-default: returns False on any attribute or lock error so a missing/broken parent never blocks the existing interrupt path. NF_active_children_active_children_lock)rrVrtrrrrr2)r childrenlocks r>_agent_has_active_subagentsz)GatewayRunner._agent_has_active_subagents5"s "  M5L$L$L5=*>****************>> !   55 s6BA9, B9A==BA=B B! B!cLKt|dd}|r|dS tj|j||d{V}nA#tt f$rYdSt $r!td|dYdSwxYw|sdSt|dd}|dSt|d|} tj|j t|d{V}t|S#tt f$rYdSt $r!td |dYdSwxYw) uReturn True when a compression lock is held for this session's id. Context compression is interrupt-protected (#23975) but gateway ``interrupt`` busy-input mode can still start a follow-up turn against the pre-rotation parent while compression is mid-flight, producing orphaned compression siblings (#56391). Callers demote interrupt to queue when this returns True. Both blocking sources — the ``session_store`` lock + JSON load, and the SQLite ``get_compression_lock_holder`` SELECT — are offloaded to a worker thread so a large state.db never freezes the event loop (#5). rNFzCompression in-flight check failed while reading session %s; treating compression as active to avoid interrupting a possible parent-session rotationTrrRrSzCompression in-flight check failed while reading lock holder for session %s; treating compression as active to avoid interrupting a possible parent-session rotation) rVrr#_lookup_session_id_under_store_lockAttributeErrorrwr2r3rget_compression_lock_holderrwr)rr+rrNrXraw_dbholders r>"_session_has_compression_in_flightz0GatewayRunner._session_has_compression_in_flight["s ot<<  m35 &08-  JJ *   55    NN*    44  5T=$77  5UJ77 ",2C OOF<<  *   55    NNB    44 s-!=A;&A;:A;);C%%D#9&D#"D#c|j5||j|}dddn #1swxYwY|t |ddndS)zISync helper run in the thread pool: read session_id under the store lock.NrN)_lock_ensure_loaded_lockedrrvrV)rr+rs r>r z1GatewayRunner._lookup_session_id_under_store_lock"s  < <  / / 1 1 1!*..{;;E < < < < < < < < < < < < < < <6;5FwulD111DPs/AA A rc||j}|sdSt|dd}t|tr||nd}|t|ddt jksQ|jt jks_queue_or_replace_pending_eventz-GatewayRunner._queue_or_replace_pending_event"sk**5<88  Fw(;TBB 4>|T4R4R\<##K000X\   Hnd 3 3{7H H H![%666GHlD99::7GE<66777 () -1AA      F   ['  : :d>Z Z Z NN\,    F ;w77777rMc"K|jpd}||s|S||j}||||j|dd{V\}}|s|S|p|S)uReturn steerable text for a busy follow-up, transcribing voice first. Fresh and queued voice messages reach the normal inbound STT pipeline, but successful steer messages intentionally bypass that queue. Without preprocessing here, a media-only voice follow-up has an empty text payload and steer mode silently degrades to queue mode. Audio file attachments remain files; only voice-message media follows the automatic STT contract used by ``_prepare_inbound_message_text``. If transcription fails, preserve any caption and let the existing steer fallback handle an otherwise empty event without losing it. Routes through ``_transcribe_and_echo_pending_voice`` — the single out-of-band transcription choke point shared with the interrupt monitor and the pending-drain path — so the STT call is made at most once per platform message (cached on the event) and the transcript echo respects the count-based ledger. If steering later falls back to queue mode, the drain path reuses the cached transcript instead of paying for a second STT call or re-echoing the same line. rz Busy-steer log_contextN)rrx_pending_event_audio_pathsr@r("_transcribe_and_echo_pending_voice)rrrr1 enriched_textsuccessful_transcriptss r>_prepare_busy_steer_textz&GatewayRunner._prepare_busy_steer_text"s*  b''))..u55 K**5<886:6]6]   L $ 7^7 7 1 1 1 1 1 1 - -& K%,,...rMc K||jsQtd|jj|jj|jjr|jjjnd|dS|jr9| |j}|sdS| |}| |j|}| r/| ||d|d}nd|d}||jj||jjt"jkr|jjdkr|jjr|n.|jjt"jkr|jjrdn|j| d{VdS d d lm}||rO|jpd }hd } hd} d} d } || vr|j} n'|| vr|j} n|dvr |j} d} n |dvr |j} d} | | |jurdnd} d| }| r|d| }||_| |d{V}td|| | | |j}|rs|rq||\}}|rW| |}||jj||| |j| d{VdSn-#t>$r td|dYnwxYw| |j}|sdStA|ddrdS|!|}|r |j"j#nd}|j$}tA|dd}|j%tLj'kr|dkr|dkrdS|dko|(|}|rtd |d}|dko|)|d{V}|rtd!|d}d}d}|dkr|*|d{V}tA|d"dpg}tW|o2tY|-|tY|k}|oC|j%tLj'ko|j. o|j/ p|o|duo|t`uotc|d}|rY tW|2|}n5#t>$r(} td#|| d}Yd} ~ nd} ~ wwxYw|sd}n|dkr|j%tLj'kr|j.s|j/s||t`urtA|d$ddurtc|d%rr tW|3|jpd }n5#t>$r(} td&|| d}Yd} ~ nd} ~ wwxYw|s|s| |||dk}!|dk}"|dko|}#|dkr|s|r|t`ur |j}$tA|d"dpg}%|-|r0|4|||j|jpd d'(d{V\}$}&n|$s|%rtk|}$|6|$n#t>$rYnwxYwtnj89d)d*d*k}'|'st:d+|dSd,}(twj;})|r |j"j<nd }*|)|*z |(krdSd d-l=m>}+t|jj},|"rtnj89d.}-|-)|-d/v}.n'tW|+t|,d0d}.|.st:d1|dS|)|A|j"_<g}/tW|+tt|jjd2d}0|0r|r|t`ur |B}1|19d3d }2|19d4d }3|19d5}4|r |j"jCnd }5|5r3t|)|5z d6z }6|6d kr|/E|6d7|3r|/Ed8|2d|3|4r|/Ed9|4n#t>$rYnwxYw|/rd:d;F|/d<nd }7|"rd=|7d>}n.|#rd?|7d@}n%|!r |rdA|7dB}n|!r |rdC|7dB}n|!rdD|7dE}ndF|7dG} d dHlGmH}8mI}9mJ}:mK};t}<|:|<|8s5|"rd}=n |!rd}=n|#rd%}=nd}=|dI|9|=}|;tdJz |8n2#t>$r%}>t:dK|>Yd}>~>nd}>~>wwxYw| |}| |j|} ||jj||jjt"jkr|jjdkr|jjr|n.|jjt"jkr|jjrdn|j| d{Vn2#t>$r%}?t:dL|?Yd}?~?nd}?~?wwxYwdS)MNz`Dropping message from unauthorized user in active session: user=%s (%s), platform=%s, session=%srT ⏳ Gateway 2 — queued for the next turn after it comes back.⏳ Gateway is - and is not accepting another turn right now.rrrhas_blocking_approvalr>👍yokrqokayapproveconfirm>👎nnodenyrreject>approve alwaysalwaysalways approver >approve sessionsession approvesessionr r r r]rzrorprqrrr-z(Busy steer ack suppressed for session %sbusy_ack_detailapi_call_countr current_toolrz min elapsed iteration z running:  (rru⏩ Steered into current runz0. Your message arrives after the next tool call.u↪ Redirected current runz$. I'll adjust using your correction.u⏳ Subagent workinguR — your message is queued for when it finishes (use /stop to cancel everything).u⏳ Compressing contextu⏳ Queued for the next turnz.. I'll respond once the current task finishes.u⚡ Interrupting current taskz'. I'll respond to your message shortly.)BUSY_INPUT_FLAGbusy_input_hint_gatewayrrrrz.Failed to apply busy-input onboarding hint: %szFailed to send busy-ack: %s)M_is_user_authorizedr(r3rrr)rrr*r@ru_thread_metadata_for_sourcer r r _send_with_retryr2rrrrrjrr rrxry_handle_approve_command_handle_deny_commandrz_unwrap_ephemeralr2rVrArJrr%rrsr r r r rr7r rrrrr r r rr$rrrvr4rU busy_ack_tsrTrSrursr/r> started_tsrhrrfr<r r rrrl)@rrr+r1 reply_anchor thread_metar$r _raw_text_approve_words _deny_words_approval_handler_normalized_argsr[_synth_replyr_text_eph_ttl_anchor _busy_stater effective_moder)demoted_for_subagentsdemoted_for_compressionsteered redirected steer_text_steer_media_urls_steer_all_voice can_steerr< is_queue_mode is_steer_modeis_redirect_mode_interrupt_text _media_urlsrKr+_BUSY_ACK_COOLDOWNrlast_ackrSr? steer_ack_envsteer_ack_enabled status_partsbusy_ack_detail_enabledsummaryrmax_iterr start_ts elapsed_min status_detailr r rr _user_cfg _hint_mode_onb_errrs@ r>#_handle_active_session_busy_messagez1GatewayRunner._handle_active_session_busy_message"s '' 55  NN8 $ &/4|/DS %++)    4 > ..u|<>L::5<VVK//11 x44[%HHHy)C)C)E)EyyywD,F,F,H,Hwww** ,|,0AAA .$66 .7!L#(,"78;L"L"LQVQ]Qg"L$$mrm}$+         4.4  < < < < < <$$[11, "Z-24466<<>> !Y!Y!YMMM $(!#% ..(,(D%%+--(,(A%%"PPP(,(D%'/$$"SSS(,(D%'0$$0*;d>Z)Z)ZII`fE([[F'@$*!?!?-=!?!?!'EJ#4#4U#;#;;;;;;;FKKV#U,< $77 EEH F *2*D*DV*L*Lx &*&B&B5&I&IG"*";";(- (<(-)0)-)I)I%,X_)`)` #<##  4    NN3d       **5<88 5 5*e , , 5..{;; 2=G (..4 . '8+FF  +"2 2 2'))'))5 k ) @00??  ! % KKJ    %N k ) K==kJJJJJJJJ  # % KKD    %N W $ $#<>2 % 002 % 11( ( 4"- 4")@@ 4M733  $$"=#6#6z#B#BCCGG $$$NN#Lk[^___#GGGGGG$ )!( k ) )"k&666$7%7)%<<< 'GOOSWWW z22X #!-"8"8%*:J9Q9Q9S9S"T"TUU  # # #K[Z]^^^"  #& Ez E  0 0e D D D&'1 &'1 )[8GZ k ) ) * *%<<< "'*%e\4@@FB 22599 F/3/V/V  (b$: 0W00******&OQQ)F[F&>u&E&EO''8888     :>>*KVTTZZ\\`ff  LL={ K K K4  ikk3>E;#//A >. . .4BBBBBB+EL,ABB  JNN+RSSM($1$7$7$9$9$?$?$A$AE_$_!!$(++,..$0 %%!%  GUUUt>#KK(8!<< ";;'7;;&{{>:: :EL;+661J"%sX~&;"<"> \  \ 1Cf ff(Ai i3i..i3'Bl66 m%m  m%c` K}d d dtddf fd }jsdkrdkr|d|dfS|d|dkr|dfSt j|z}tjs(srt j|kr|t j d d{Vtjs(sr)t j|kt tjpAt p t }|d||fS) Nr@Frr-cBtj} } } }|s|ks|ks|ks |z dkr d||||dSdS)NrB r )rget_running_looprUrrrr ) rrr cron_count api_countlast_active_countlast_api_countlast_cron_countlast_status_atrs r>_maybe_update_statusz@GatewayRunner._drain_active_agents.._maybe_update_status$s*,,1133C4466L4466J2244I %#44400...(S00++J777$0!",!*!$ 10rMrTr皙?r) r rrrrr7rr! rUr7r) rrsnapshotr( deadline timed_outr$ r% r& r' s ` @@@@r>_drain_active_agentsz"GatewayRunner._drain_active_agents$s0022 557755773355 % % % % % % % % % % % % %2# #1(<(<STATAT t , , , ,U? "4(((( a<<T> !+--2244w>D()) %..00 %--// % (**//11H<< " " "-$$ $ $ $ $ $ $ $D()) %..00 %--// % (**//11H<< T)** + + 2D//1122 2D..0011  4((((""rMct|jD]m\}}|tur t ||t d|<#t$r%}t d|Yd}~fd}~wwxYw||}|rt d|dSdS)Nz8Interrupted running agent for session %s during shutdownz-Failed interrupting agent during shutdown: %sz0Interrupted %d api_server run(s) during shutdown) rr7rrrr3r4r2r)rrr+rrinterrupted_apis r>_interrupt_running_agentsz'GatewayRunner._interrupt_running_agents$s"&t';'A'A'C'C"D"D Q Q K/// Q&uf555 WYdeeee Q Q Q LaPPPPPPPP Q 99&AA  ^ LLK_ ] ] ] ] ] ^ ^s+A## B-B  Bc : K|}|jr|jnd}|jrdnd}|jrdnd}d|d|}t}|D]}d} t |ddS|jd{V|jj |} | rt | d dnd}n3#t$r&} t d || Yd} ~ nd} ~ wwxYw|| |}|(|jj} t!|j} |j} n7t'|}|s|d } |d } | d } | | | rt!| ndf}||vr2 t)| }|j |}|s`|jj |}|$|jstd| |t |ddnd}|k|i |jj}t!|j}|jrt!|jnd}|||f|krt |dd}n#t$rYnwxYw||| | |t |ddnd||}|| ||d{V}|At |dddur.t d| | t |dd||td| | #t$r(} t d| | | Yd} ~ d} ~ wwxYw|jr|t ddS ddlm}|rtddSn2#t$r%} t d| Yd} ~ nd} ~ wwxYwt?|j D]\}}|j!|}|r|js*|jj |}|(|js!td|js|jt!|j|jrt!|jndf}||vr |||j|j| }|r1|t!|j||d{V}n.|t!|j|d{V}|Kt |dddur8t d!|j|jt |dd||td"|j|j#t$r2} t d!|j|j| Yd} ~ d} ~ wwxYwdS)#u4Send shutdown/restart notifications to active chats and home channels. Called at the very start of stop() — adapters are still connected so messages can be delivered. Best-effort: individual send failures are logged and swallowed so they never block the shutdown sequence. Nr r zpYour current task will be interrupted. Send any message after restart and I'll try to resume where you left off.z&Your current task will be interrupted.u⚠️ Gateway  — roriginz>Failed to load session origin for shutdown notification %s: %srr2rz^Shutdown notification suppressed for active session: %s has gateway_restart_notification=falserjrrreply_to_message_idr1r.r/TFz1Failed to send shutdown notification to %s:%s: %srPsend returned success=Falsez/Sent shutdown notification to active chat %s:%sz@Skipping home-channel shutdown notifications for in-chat restartr)drain_notification_suppressedzWHome-channel shutdown broadcast suppressed by drain marker (suppress_notification=true)z.drain_notification_suppressed check failed: %sz\Shutdown notification suppressed for home channel: %s has gateway_restart_notification=falserz>Failed to send shutdown notification to home channel %s:%s: %sz0Sent shutdown notification to home channel %s:%s)"r r,r1rrVasync_session_store_ensure_loadedrrrvr2r3r4_get_cached_session_sourcerrrwr2rrrrrzrEgateway_restart_notificationrz_thread_metadata_for_targetr0rrE r7 rrget_home_channel)rrrestart_sourceactionhintrnotifiedr+r(rr platform_strr2r_parsed dedup_keyrr1rGr5 restart_platformrestart_chat_idrestart_thread_idrrr7 rs r>#_notify_active_sessions_of_shutdownz1GatewayRunner._notify_active_sessions_of_shutdown$s..009=9PZ55VZ!%!8Mo& : X X: 433T338;![ [ KF 4$77C2AACCCCCCCCC .7;;KHHE?DNWUHd;;;$F    T ~88EE!%4 fn--", -[99&z2 !),#KK 44 &w)0UIQUVIH$$5 #L11-++H55#{488BB +L4]+KKx$MSM_gflD&I&I&Iei#&.>3M+9+B+H(*-n.D*E*EM[Me,oC0H,I,I,Iko),o?PQU^^^29.,X\2]2]/$ ;;DJDVgfk4@@@\`(;# < '||GS8|LLLLLLLL%'&)T*J*Je*S*SLLK$1NOO   Y''' E '    G '1   " ~'A LL[ \ \ \ F N K K K K K K,,..  3    N N N LLI1 M M M M M M M M N"&dm&9&9&;&;!>L' 0Y' rN!T\):):SWSa5AL>:L>AI,+L>, I96L>8I99BL> 1L>> M0M++M0*O O5O00O5CW;W X&'XXr: c .K|D]|} t|dd}t|dd}t|rt|tr|rt|dd}t|r ||n#t $rYnwxYw ||na#t $rT}t d|t|ddl m }|t|dd|Yd}~nd}~wwxYwn2#t $r%}t d|Yd}~nd}~wwxYw dd l m } | t|ddd d n#t $rYnwxYw||d d{V~dS)N_flush_messages_to_session_dbr[)_drop_trailing_empty_response_scaffoldingz^Shutdown transcript flush failed (%s); preserving %d in-memory message(s) to recovery snapshotr)flush_agent_history_to_filerNz$Shutdown transcript flush failed: %sfinalize_sessionr9r rNrrzshutdown finalizer)rrVr/rtrr2r3rr7gateway.shutdown_flushrL r4hermes_cli.lifecyclerN !_cleanup_agent_resources_off_loop) rr: rrXr[_strip _flush_errrL rrN s r>_finalize_shutdown_agentsz'GatewayRunner._finalize_shutdown_agents%s"))++E E E ' I (GNN$+E3F$M$M!F##" 3Dd(K(K"Pa" %JDF ''!!"F#45555(!!! D!01111$K& 122  WVVVVV33#E<>>-!( I I I CRHHHHHHHH I AAAAAA  &ulDAA&%     8829        GE E syA(D BD BDBD! B-,D- D 7A DDD  D D>D99D>#E&& E32E3 executor_taskc|dS||rdS|r)||}|r |jjnd|urdSdS)aOnly emit the heartbeat while this task still owns the live run. Guards against a stale ``running: delegate_task`` heartbeat outliving the run that started it: stop once the executor finishes, the agent is gone, or the session key has been rebound to a different live agent (e.g. the user sent ``/new`` and a fresh agent took the slot mid-run, #12029). NFT)rrArJr)rr+rrW _hb_states r>&_should_emit_long_running_notificationz4GatewayRunner._should_emit_long_running_notification&si =5  $););)=)= $5  00==I(1; $$tEIIutrMrrcdfd }tj|}tdd}|t}|_||||jdS)a}Clean up ``agent`` only after its executor future has finished. A timed-out executor call keeps running in its worker thread. Closing the agent before that thread exits can tear down clients or providers it is still using. Keep a strong task reference and wait for the real future before invoking the normal bounded, off-loop cleanup path. r-NcK tjd{VnL#tj$rYdSt$r.}tdrddnd|Yd}~nd}~wwxYwd{VdS)Nz2Deferred agent worker%s finished with an error: %sr rrrP )rrrr2r3r4rS )r<rrrrs r>_cleanup_when_donezPGatewayRunner._defer_agent_cleanup_until_future_done.._cleanup_when_done3&s nV,,,,,,,,,,)       H'.6OOOOOB  888PP P P P P P P P P Ps A) A)$A$$A)_deferred_agent_cleanup_tasksr)rrrVrr^ rrr)rrrrr] rrs```` r>&_defer_agent_cleanup_until_future_donez4GatewayRunner._defer_agent_cleanup_until_future_done$&s Q Q Q Q Q Q Q Q Q"#5#5#7#788=tDD =EEE16D . $ u}-----rMrP cK|dS|ds|dkr d|_n#t$rYnwxYw tj||j||jd{VdS#tj$r-t d|rd|dnd |jYdSt$r/}t d |rd|dnd |Yd}~dSd}~wwxYw) uRun _cleanup_agent_resources in a worker thread with a bounded wait. Safe to await from coroutines on the gateway event loop: a slow or wedged teardown (memory provider IO, subprocess close) can no longer block message processing. On timeout the await is cancelled and the worker thread is left to finish (or leak) on its own — the caller proceeds regardless, exactly as the /new reset path does (#35994). Nr session expiryFrzAgent resource cleanup%s exceeded %ss; proceeding without blocking the event loop (the worker thread is left to finish on its own). (#53175)r rrz,Agent resource cleanup%s failed: %s (#53175)) r!_end_session_on_closer2rr_run_in_executor_with_context_cleanup_agent_resources_CLEANUP_TIMEOUT_Sr,r3r)rrr cleanup_excs r>rS z/GatewayRunner._cleanup_agent_resources_off_loopJ&s = F   j ) ) W8H-H-H .3++     "2215/           #    NN($+2W'           NN>#*2W          s)+ 88:A888C+3 C+<$C&&C+c8|dS t|drt|dd}|8t|dr( |dn#t$rYnwxYwt|dd}t |t r||n|n#t$rYnwxYw t|dr|n#t$rYnwxYw d d lm }|dS#t$rYdSwxYw) zrd z&GatewayRunner._cleanup_agent_resourcesr&s = F$ u899! 5e%6==?wsO'D'D?))")5555$$+52Et#L#L .555223CDDDD22444    D   ug&&      D    J J J J J J ' ' ) ) ) ) )    DD sY3B2AB2 AB2AAB22 B?>B?$C(( C54C59D DDr)z.restart_failure_countsactive_session_keyscVddl}t|jz } |r$|j|dni}n#t $ri}YnwxYwi}|D]}||ddz||< t||ddS#t $rYdSwxYw)aIncrement restart-failure counters for sessions active at shutdown. Persists to a JSON file so counters survive across restarts. Sessions NOT in active_session_keys are removed (they completed successfully, so the loop is broken). rNrQrr(r) r3rl_STUCK_LOOP_FILErr4rXr2rvrz)rrp r3rcounts new_countsrs r>!_increment_restart_failure_countsz/GatewayRunner._increment_restart_failure_counts&s  d33 EI[[]]ZZTZ @ @AAAXZFF   FFF  & 5 5C$jja0014JsOO  dJt < < < < < <    DD s#:A AAB B('B(cddl}tjz }|sdS |j|d}n#t $rYdSwxYwd}fd|D}|D]i} jj |}|r5|j s.d|_ |dz }t d|||Z#t $rYfwxYw|r+ jn#t $rYnwxYw |d n#t $rYnwxYw|S) u,Suspend sessions that have been active across too many restarts. Returns the number of sessions suspended. Called on gateway startup AFTER suspend_recently_active() to catch the stuck-loop pattern: session loads → agent gets stuck → gateway restarts → repeat. rNrQrc0g|]\}}|jk|SrN)_STUCK_LOOP_THRESHOLD)rbrrrs r>rz>GatewayRunner._suspend_stuck_loop_sessions..&s*VVVDAqa4;U6U6Ua6U6U6UrMTr(u_Auto-suspended stuck session %s (active across %d consecutive restarts — likely a stuck loop)rs)r3rlrr rr4rXr2rrrrv suspendedr3rrru)rr3rrs ry stuck_keysr+rs` r>_suspend_stuck_loop_sessionsz*GatewayRunner._suspend_stuck_loop_sessions&s  d33{{}} 1 TZ @ @AAFF   11  VVVVFLLNNVVV %  K *377 DD&*EONINNH#VK%8        "((****      KK4K ( ( ( (    D sH$A AA AC  C-,C-3D DDD55 EEc.ddl}t|jz }|sdS |j|d}||vr1||=|rt ||ddS|ddSdS#t$rYdSwxYw)zClear the restart-failure counter for a session that completed OK. Called after a successful agent turn to signal the loop is broken. rNrQrrTrs) r3rlrr rr4rXrzrur2)rr+r3rrs s r>_clear_restart_failure_countz*GatewayRunner._clear_restart_failure_count&s  d33{{}}  F TZ @ @AAFf$$;'1%dF4@@@@@@KK4K00000 %$     DD s?B,B BBc Kddl}ddl}t}|stddS|jrdSd|_t j}ttt|ddpddzd}tj dkryddl }ddlm}m}g|d d } |d } dd lm} | d d} | ddt-t.jj} tj}t-| dp| dz }|dz dz }|rt;|| d<t;| t;|g}| dr|| dt j tB"|| d<|d| t;|t;|g| } |j#|f|j$|j$| d|n#tJ$r |#||j$|j$| |ns#tJ$rf}t|dd}||n|j&}|dnd}t'dt j()|||Yd}~nd}~wwxYwYnwxYwdSd d|D}dtU|d|d|d }dd lm} | d d} | dd|+d!}|r*|#|d"d#|g|j$|j$| d$dS|#d"d#|g|j$|j$| d$dS)%Nrz4Could not locate hermes binary for detached /restartTr'r@r&r)&windows_detach_flags_without_breakawaywindows_detach_popen_kwargsr9r u import os, subprocess, sys, time from hermes_cli._subprocess_compat import windows_detach_flags_without_breakaway pid = int(sys.argv[1]) restart_after_s = float(sys.argv[2]) cmd = sys.argv[3:] deadline = time.monotonic() + restart_after_s def _alive(p): # On Windows, os.kill(pid, 0) is NOT a no-op — it maps to # GenerateConsoleCtrlEvent(0, pid) (bpo-14484). Use the # Win32 handle-based existence check instead. if os.name == 'nt': import ctypes k32 = ctypes.windll.kernel32 k32.OpenProcess.restype = ctypes.c_void_p k32.WaitForSingleObject.restype = ctypes.c_uint k32.GetLastError.restype = ctypes.c_uint h = k32.OpenProcess(0x1000 | 0x100000, False, int(p)) if not h: return k32.GetLastError() != 87 try: return k32.WaitForSingleObject(h, 0) == 0x102 finally: k32.CloseHandle(h) try: os.kill(int(p), 0) return True except ProcessLookupError: return False except PermissionError: return True except OSError: return False while time.monotonic() < deadline: if not _alive(pid): break time.sleep(0.2) subprocess.Popen( cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, creationflags=windows_detach_flags_without_breakaway(), ) build_subprocess_envF) scrub_secretsinherit_profile_homerwrrrrr-crrenv)rrr creationflagswinerrorerrnozDetached restart watcher was not started after the no-breakaway retry (%s; %s=%r). The gateway will not be respawned by this restart attempt.rc3>K|]}tj|VdSr^)rc quoteras r>rdzAGatewayRunner._launch_detached_restart_command..'s,@@Tu{4((@@@@@@rMzdeadline=$(( $(date +%s) + z )); while kill -0 zC 2>/dev/null && [ $(date +%s) -lt $deadline ]; do sleep 0.2; done; z gateway restartsetsidbash-lc)rrr start_new_session),rrrr3rPr0rgetpidrCrirVrrtextwraphermes_cli._subprocess_compatr r dedentrxtools.environments.localr rUrrrrrrvrrwrrrfrurPopenDEVNULLrr rrbasenamerhr)rrr hermes_cmd current_pidrestart_after_sr r r cmd_argvwatcherr watcher_envrwatcher_pythonrrr watcher_argvr<r r error_fieldr shell_cmd setsid_bins r> _launch_detached_restart_commandz.GatewayRunner._launch_detached_restart_command's (**   LLO P P P F  0  F04-ikk eGD2JC$P$P$WTWXX[^^`cdd <7 " " OOO         ;:Y: :Hoo-//^egg_ ` F E E E E E..UY]^^^K OO-t 4 4 4>>1133:AL!^NKOOM::SlV>STTH$u,>M##%% W-0]] M*!,//]1C1CD ??<00A%%k,&?@@@,.JOODMM**> % %( % % % % %  BAAAAA**UYZZZ )4000\\(++     VUI6!)!)"&          *!)!)"&      s==$I"" L-,JL L $ALLL  LLc |tjdkstjdsdS ddl}ddl|d}|d|rsdS ddlm }|n#t$rdYnwxYwtj }fd }|g}|d g}t||krg}d} nt||krd g}d } ndStj} d |d | d| d| d| } d|dd} |g|dd| dd| jjdt$d||rdnddS#t$r&} t$d| Yd} ~ dSd} ~ wwxYw)aBest-effort helper to bypass systemd's automatic restart delay. For planned in-chat restarts, the gateway exits cleanly so systemd does not record a failure. However, units with RestartSteps still count automatic restarts and can delay repeated /restart tests. A transient user service survives our cgroup teardown and explicitly starts the gateway as soon as this PID exits, while the unit keeps its normal backoff for real crash loops. linux INVOCATION_IDNrz systemd-run systemctl)get_service_namehermes-gatewayc g|dddddddd}|jpd S#t$rYd SwxYw) Nshowz--property=MainPIDz--valueTrQrlr|)capture_outputrrRrSrr)runrrxr2) scope_flagsout service_namerr s r> _query_pidzBGatewayRunner._launch_systemd_restart_shortcut.._query_pid's$..":[:&:,:-:/8:'+$QZde)C  J,"33555 22sAA AAz--userzsystemctl --userzwhile kill -0 z" 2>/dev/null; do sleep 0.2; done; z reset-failed ; z restart z-planned-restart-r rWz --collectz--unitz/bin/shr T)rrr zALaunched systemd planned-restart helper for %s (pid=%s, scope=%s)rrz3Failed to launch systemd planned-restart helper: %s)rrrrrvrrrhermes_cli.gatewayr r2r rwrc r rlr r r3rzr4)rr systemd_runr r r system_piduser_pidr systemctl_scope service_argr unit_namerr rr s @@@r> _launch_systemd_restart_shortcutz.GatewayRunner._launch_systemd_restart_shortcut's <7 " ""*..*I*I " FP S MMM     ,,}55K [11I i  0??????//11  0 0 0/  0)++K       $BJ!z8*--H;:-- "-[!!X--'j "4 +l33K;;;";;2=;;";;-8;;  (GG+GGOOPSUXYYI               ")!)"&     KKS%38        S S S LLNPQ R R R R R R R R R SsC6F /B?F B F BA%F 6BF F;F66F;cK|}|dkrdStt|ddpd}|dkrtd|dStd|| |dn#t $rYnwxYwtj}| |z}d}|dkr| }||kr0t d ||dS||z d krZtd |||z  |dn#t $rYnwxYw|}tj d d {V|dktddS)aWait for in-flight work to finish before entering ``stop()``. In-band restart used to call ``stop()`` immediately, which folded the requesting turn into the drain wait set and force-interrupted it at ``restart_drain_timeout`` (#77184). Instead we refuse new turns and wait here for active agents/cron/api work to reach zero, then let ``stop()`` run against an idle gateway (drain is instant). Returns True when work drained to zero, False when the safety cap elapsed with work still active (caller proceeds to ``stop()``, which may then interrupt remaining runs under ``restart_drain_timeout``). rTr(r@uqRestart requested with %d active work unit(s); restart_after_turn_timeout=0 — entering stop()/drain immediatelyFzRestart requested with %d active work unit(s); deferring stop() until they finish (cap=%.0fs) so in-flight turns are not amputated (#77184)r zRestart after-turn wait timed out after %.0fs with %d still active; proceeding to stop()/drain which may interrupt remaining work (#77184)r%zXRestart deferred: waiting on %d active work unit(s) (%.0fs remaining before force drain)r) NuLRestart deferred wait complete — active work drained; proceeding to stop()) rrirVr3rzr r2rr! rUrr)rrrrr+ r' rs r>!_await_active_work_before_restartz/GatewayRunner._await_active_work_before_restart+(s?((** Q;;4&CSIIPSQQ a<< KKU    5  /         ' ' 3 3 3 3    D '))99;;(%%''!++))++Ch8++-- un$-- ;++--sN  // ;;;; D!$-$$ $ $ $ $ $ $ $/%%''!++2   #   ts$?B B"!B".F FFdetached via_servicer r cjrdSd___d_d_dfd }t j|_dS)NFTr-cPKd{VrN d{Vn2#t$r%}td|Yd}~nd}~wwxYwt jdd{Vdd{VdS)Nz4Failed to launch detached gateway restart helper: %srTr detached_restartservice_restart)r r r2r3rPrrr)rr rr s r> _run_restartz3GatewayRunner.request_restart.._run_restart(s88:: : : : : : : :  \\??AAAAAAAAAA \\\LL!WYZ[[[[[[[[\-%% % % % % % % %))D8U`)aa a a a a a a a a as< A+A&&A+r)r-r,r.r/r*rrr3)rr r r s``` r>request_restartzGatewayRunner.request_restarts(s  % 5"&!)$/!%)" b b b b b b b b4%0@@trM>rrrestart_interruptedcK ||d{Vt|di}t|tr||nd}|t j|d{V||}|r |jj ndtur| |dSdS#||}|r |jj ndtur| |wwxYw)aDispatch one synthetic startup resume and wait for its agent turn. ``BasePlatformAdapter.handle_message()`` returns after it installs the adapter-level guard and spawns the background processing task. Startup restore needs a stronger boundary: inbound messages must stay queued until the resumed agent turn itself has finished, otherwise a user message can race the restore turn immediately after ``handle_message`` returns. N_session_tasks) handle_messagerVrtrurvrrrArJrr_release_running_agent_state)rr1rr+ session_tasksr _pre_states r>_run_startup_resume_eventz'GatewayRunner._run_startup_resume_event(s7 ?((// / / / / / / /#G-=rBBM5? t5T5T^=$$[111Z^DnT********* 11+>>J)3= %%BYYY11+>>>>>ZY11+>>J)3= %%BYYY11+>>>>Zs A4B==ADct|dd}| g}||_|j| |j}td|r|jr |jjnd|r|jnddS#t$rYdSwxYw)NrzJQueued inbound message during gateway startup restore: platform=%s chat=%sr) rVrrr(r3rzrrr2r2)rrrr(s r>_queue_startup_restore_eventz*GatewayRunner._queue_startup_restore_event(s6== =E*/D ' U \F KK\)/RFOR%%"(7i          DD sAA11 A?>A?c Kd}t|dd}|dS|r|jd}t|dd}||}|:tdtt|ddddt t |dd n#t $rYnwxYw||d{V|d z }||S) z=Replay inbound messages queued while startup auto-resume ran.rrNr(zCDropping startup-restore queued message: adapter unavailable for %srr_hermes_startup_restore_replayTr()rVrUr@r3r4setattrr2r )rdrainedrrr(r1s r>_drain_startup_restore_queuez*GatewayRunner._drain_startup_restore_queue(s6== =1 EIaLLEUHd33F..v66G YGFJ==wMM ?FFFF    ((// / / / / / / / qLG# $sB!! B.-B.cKtt|dgpg}|rt}|dkrjtj||d{V\}}|rHt d|t||D]}||j n&tj |ddid{Vt|}|D]^}| r| }|1t dt|||jf _g|_|d{V}d |_|rt d |dSdS) u Wait (BOUNDED) for startup auto-resume, then release + drain inbound. The wait is bounded by ``_startup_restore_drain_timeout_secs`` so that a single pathologically long boot-resume turn cannot hold the inbound gate shut for every channel. On timeout we release the gate and let the still-running resume turn(s) finish in the background — they are NOT cancelled. This is safe because duplicate-agent protection does not depend on the wait: ``_schedule_resume_pending_sessions`` claims each session's ``_running_agents`` slot SYNCHRONOUSLY before this gate runs, so any inbound message drained while a resume turn is still in flight queues behind that slot instead of spawning a second agent. rrrNzStartup-restore gate released after %.0fs with %d boot auto-resume turn(s) still running; draining inbound queue now (resume slots already claimed, so no duplicate agents). Slow turn(s) continue in the background.return_exceptionsTzstartup auto-resume task failedrFz;Drained %d inbound message(s) queued during startup restore)rrVryrrBr3rr7r_log_background_resume_resultgatherrrrr4rrrr r6rz)rrrrr5rr<r s r>_finish_startup_restorez%GatewayRunner._finish_startup_restore(sWT#;R@@FBGG % 9;;G{{'.l5'&J&J&J J J J J J J gSNN&  G !(SS..t/QRRRRneDtDDDDDDDDD5zz  >>##nn&&?LL9"&s))S#2C!D!')#99;;;;;;;;,1)  ` KKUW^ _ _ _ _ _ ` `rMrc|rdS|}|3tdt |||jfdSdS)a Done-callback for a boot-resume turn that outlived the startup-restore gate. Logs a late failure that would otherwise be swallowed once the task is discarded from ``_background_tasks``. Cancellation is expected (shutdown) and is not an error.Nz=background startup auto-resume task failed after gate releaser)rrr3r4rrrs r>r z+GatewayRunner._log_background_resume_result')sq >>    Fnn ? LLOs))S#*;<       ?rMc K ddlm}m}m}m}m}t j|d{VsdSd|jD}t j|d|d{V}n-#t$r t ddYdSwxYw|sdSd}|D]h} t| d } nE#t$r8t d | d | d Y[wxYw|j | } | || d } | d r|| z} | dr d| dind} | | d| | d{V}n;#t$r.}td| d |d}Yd}~nd}~wwxYw |nt!|ddr]t j|| d d{V|dz }td| d | d| d | dn@t j|| d t%t!|ddpdd{Vn,#t$rt ddYnwxYw| dpd}|rQ |j|d{V:#t$r!t d|dYdwxYwj|S)uRedeliver final responses recorded in the delivery ledger by a previous (now dead) gateway process. Runs at startup BEFORE ``_schedule_resume_pending_sessions``. A session with a recoverable obligation already produced its answer — the turn completed and only delivery is owed — so this method sends the stored text and clears ``resume_pending`` for that session, preventing the resume path from re-running (and re-paying for) a turn whose output we hold. Crash-ambiguity contract (see gateway/delivery_ledger.py): rows that were mid-send or previously rejected carry a visible recovered-reply marker so a possible duplicate is labeled, never silent. Returns the number of redeliveries attempted. r)RECOVERED_MARKERledger_enabledmark_delivered mark_failedsweep_recoverableNc Jh|] }t|dt|!Sr)rVrwr:s r>rQz?GatewayRunner._redeliver_pending_obligations..T)s7017CFF++rM)deliverable_platformszdelivery ledger sweep failedTrrz"obligation %s: unknown platform %r obligation_idr4 needs_markerrr2r2r4rz)obligation %s: redelivery send raised: %sr/Fr(zIRedelivered recovered final response to %s:%s (obligation %s, attempt %d)rrPrz send failedzdelivery ledger update failedr+z"clear_resume_pending failed for %s)gateway.delivery_ledgerr r r r r rrrr2r3r4rrvr0rrVrzrwr8 clear_resume_pending)rr r r r r _deliverableclaimed redeliveredrrr1r4rrsend_errr+s r>_redeliver_pending_obligationsz,GatewayRunner._redeliver_pending_obligations6)s                !*>:::::::: q59]L$-!4|GG    LL7$L G G G11  1 = = C #C O44    8(#''**=*=   m''11G)nGww~&& 5*W43677;3G3GQc+.//T  &|| N#% ,      ?((    M%'&)U*K*K%!+NCrzCGatewayRunner._schedule_resume_pending_sessions..)sm#+"O 0+t/HHH!)U\-Bh-N-N  .O-N-NrMNz/Failed to enumerate resume-pending sessions: %srr)rz$Restart-loop guard check skipped: %sz5Skipping auto-resume for %s: adapter not ready for %srz^Skipping auto-resume for %s: session owner is no longer authorized under the current allowlistz;Skipping auto-resume for %s: authorization check failed: %srT)rrr(r r6Frr(z;Scheduled auto-resume for %d restart-interrupted session(s)).rsrr r rrr2r3rr9rrcheck_and_recordr4rrrk updated_at total_secondsrKr+r3 r@rVrr r/rrJrrUr r= rrrsr rrr rrrrrrrz)rrrrr<r _max_restarts_window_max_gapr scheduledrmarkerr(r1 _resume_staterrrs`` r>!_schedule_resume_pending_sessionsz/GatewayRunner._schedule_resume_pending_sessions)so.122 #)  "88:::'+'9'B'I'I'K'K                    NNLc R R R11111   J J>>>>>>373R3R3T3T0 w((!7H)1 J J J CSIIIIIIII Jlnn G G E0DE4DF!sV|&B&B&D&Dv&M&M''(9:: \F..v66G K%FOWfoFF  //77NNH)     Q%s  !//0ABBM'>M  $,0IKKM  )  ' ' ) ) ) !(- E &..wu?PQQD  " & &t , , ,  " "4#9#A B B Bt;UCC #&>EE=E27D/ T""" NII   KKM   sk A;AA/# A;/A33A;6A37A;; B+B&&B+16C** D4DD5H I!H??IcP|jp|jp|jSr^)r,r*rr8rNs r>_startup_should_abortz#GatewayRunner._startup_should_abort/*s.  # -~ -#**,, rMcK|sdS|r|p |d{Vn8#t$r+}td|j|Yd}~nd}~wwxYw|||d{V|j}tj }| ||ur |d{VnF|j s-| |j |j|jd{VdS)zCClean up and exit startup when restart/shutdown begins mid-startup.FNu'✗ %s background-task cancel error: %sr T)r rr2r3r4rrr2r current_taskrr8rr,r.r/)rr1rr stop_taskr s r>$_abort_startup_if_shutdown_requestedz2GatewayRunner._abort_startup_if_shutdown_requested6*sn ))++ 5  8#7 [557777777777 [ [ [ FXYZZZZZZZZ [//BB B B B B B B BO +--  Yl%B%BOOOOOOOO%,,.. ))/!%!7 $ 9        ts9 A.!A))A.rct|dd}|t|ddsdSt|ddB t||_n,#t$rtddYnwxYwt|dd}||sD t||_dS#t$r td dYdSwxYwdS) uArm the selector floor and out-of-loop watchdog before adapters. Disabled entirely with ``gateway.loop_watchdog: false`` in config.yaml (no env override — config-only knob, #69089). rzN loop_watchdogTrRz&Failed to arm gateway loop floor timerrrSz.Failed to start gateway loop liveness watchdog) rVrzrRr2r3r4is_aliver~rS)rrrzwatchdogs r>_start_loop_liveness_guardsz)GatewayRunner._start_loop_liveness_guardsP*s) x..  gfot&L&L  F 43T : : B V0Ed0K0K-- V V V EPT UUUUU V4!:DAA  8#4#4#6#6  ^/KD/Q/Q,,, ^ ^ ^ MX\ ]]]]]] ^  s#A&A76A7"B88&C"!C"czt|dd}d|_|B |n,#t$rtddYnwxYwt|dd}d|_|D |dS#t$r tddYdSwxYwdS)zBDisarm lifetime liveness guards before shutdown can load the loop.rSNz-Failed to stop gateway loop liveness watchdogTrrRz)Failed to cancel gateway loop floor timer)rVrSrr2r3r4rRr)rr floor_timers r>_stop_loop_liveness_guardsz(GatewayRunner._stop_loop_liveness_guardsf*s4!:DAA'+$   ]  ] ] ] LW[ \\\\\ ]d$>EE (,%  " Y""$$$$$ Y Y Y HSW XXXXXX Y # "s!1&AA8B&B87B8cpK|jd{V}||S)a)Discard orphan turn markers before consuming a clean-exit receipt. If either persistence or marker removal fails, startup must fail closed. Continuing with the old receipt would let a later unclean exit masquerade as clean and discard genuinely interrupted turns. N)r8 discard_active_turn_markersru)r marker_path discardeds r>_consume_clean_shutdown_markerz,GatewayRunner._consume_clean_shutdown_markerx*sF2NNPPPPPPPP rMcKd}d} tdtdd}tdt|dz}|j|d{V}n2#t $r%}t d |Yd}~nd}~wwxYw |jd d{V}n2#t $r%}t d |Yd}~nd}~wwxYw||fS) zARecover exact active turns, then run the legacy recency fallback.rrB rrdr|)max_age_secondsNz0Exact active-turn recovery on startup failed: %sxz-Legacy session recovery on startup failed: %s) rCrrhr8 recover_interrupted_turnsr2r3rsuspend_recently_active)rexactr. agent_timeoutmarker_max_ager<s r>_recover_unclean_sessionsz'GatewayRunner._recover_unclean_sessions*sp TZ0F%M%MNNM #ma.?*@*@AAN2LL .MEE T T T NNMs S S S S S S S S T Q!5MM #NHH Q Q Q NNJC P P P P P P P P Qhs0AA(( B2BB!B== C,C''C,c B3OKtd tjn#tt t f$r tjddp8tj ttd}tj|dtj |d}t|dd }tj|d n,#t $rtd d YnwxYwYnwxYwtt$dd}|t'tdr tjddp8tj ttd}tj |d}tj|dt|dd }tj||ddn,#t $rtdd YnwxYw t+j_n#t$r d_YnwxYwjjtdjj ddlm}|j} | Y| drDtd| dd| d| d| dn2#t $r%} td| Yd} ~ nd} ~ wwxYw t?tj dd} td| n#t $rYnwxYw tj d d!} | !d"v} | rtd#ntd$| n#t $rYnwxYw dd%l"m#}|}|r!|d&krtd'|n#t $rYnwxYw dd(l$m%}|d)d*n#t $rYnwxYw dd+l&m'}dd,l(m)}||_*tj*d-d.rtd/n,#t $rtd0d YnwxYw dd1l+m,}m-}|}||}|r5td2|td3n,#t $rtd4d YnwxYw.d{VrdSd5}d6}d7}d7} dd8l/m0}tcd9|2D}tcd:|2D}n#t $rYnwxYwtgd;||zD}tj dvptgd?||zD}|s|std@tij}|r|5dAdBd}d} tl7D]\}!}"|!j8|kr |"dC} nt9dD|| pdE dd(l$m%}|dF|*n#t $rYnwxYw:|dS ddGl;m<}#|#n,#t $rtdHd YnwxYw ddIl=m>}$m?}%m@}&mA}'|&|$r-tdJ|%|'n,#t $rtdKd YnwxYw dd+l&m'}ddLlBmC}(|})|(|)d.MddLlDmC}*|*|)n,#t $rtdNd YnwxYwjEF ddOlGmH}+|+I},|,rtdP|,n2#t $r%}-tdQ|-Yd}-~-nd}-~-wwxYwtdRz }.|.KrtdS L|.d{V}/n=#t $r0}0t9dT|0t dU|0d}0~0wwxYw|/rtdV|/nAMd{V\}1}2|1|2z},|,rtdW|,|1|2 N}3|3rtdX|3n2#t $r%}-tdY|-Yd}-~-nd}-~-wwxYwd_Og_Pg_Qd}4d}5g}6g}7ttjdZd.}8g}9jjS7D]u\}!}:.d{VrdS|:jTs+|8rFt|!|:s6td[|!j8|9V|!s|5dBz }5W|!|:};|;sk|!j8}t|>r|>jd|;ejf|;gh|;jijj|;_jtd`|!j8k|!j8daddb l|;|!d{V}?.|;|!d{VrdS|?r|;jm|!<n|;t'|;dcr jo|;_p|4dBz }4k|!j8ddddbtde|!j8n~tdf|!j8q|;|!d{V|;jrrk|!j8|;jsrdgndh|;jt|;jub|;jsr|7n|6}@|@V|!j8di|;ju|;jsrL|:dBtjwdjzx|!|;y|!|;dkjz|!<nk|!j8dgddlb|7V|!j8dm|:dBtjwdjzx|!|;y|!|;dkjz|!<n#t $r}-t9dn|!j8|-q|;|!d{Vk|!j8dgdt|-b|7V|!j8di|-|:dBtjwdjzx|!|;y|!|;dkjz|!<Yd}-~-nd}-~-wwxYw.d{VrdSw {d{V}A|4|Az }4n#t$r}-t|-}t9do| dd(l$m%}|dF|*n#t $rYnwxYwt_~:|d._OYd}-~-d._dSd}-~-wt $r'}-t9dp|-d Yd}-~-nd}-~-wwxYwd._n #d._wxYw|9D]VOtgOfdqjZD}B|Bs tdrOj8W|4dkr|6r|7sds |6}t9dt| dd(l$m%}|dF|*n#t $rYnwxYwt_~:|d._OdS|6r=t9dut|6ds |6|5dkr|7rids |7}tdvtjz| dd(l$m%}|dwd*n#t $rYnwxYwtdx|5n4tdytdz.d{VrdSjmj_md_d{ td|d}C|C|Crt+jtttd}d~_tdd}D|D9|Djj|Djn,#t $rtdd YnwxYwtjEj}E|Ertd|EjEdddjmDid{V|4dkrtd|4 ddlm}F|Fjmd{V}Gt'd|GdiZD}Htd|Hn2#t $r%}-td|-Yd}-~-nd}-~-wwxYwd{V}I|Is?tgdtdz tdz fDr|4dkrt+jdd{Vt/}Jt1}K|Jrd_d{V|KrA dd{Vt9n#t9wxYwd{Vd{V ddOlGmH}+|+j}Lg|+_tC|LD]\}M}N|Nffd d|Ndd.td|Nd|Mdzdkrt+jdd{Vn2#t $r%}-t9d|-Yd}-~-nd}-~-wwxYwjdjdjdjdjzrQtdtjzd djzDjdfd_jdjd rItdjdnn,#t $rtdd YnwxYwjdtddS)z Start the gateway and all configured platform adapters. Returns True if at least one adapter connected successfully. zStarting Hermes Gateway...log_dirNlogsT)rzgateway_faulthandler.logarQr)rD all_threadsz!faulthandler.enable() unavailablerSIGUSR2rN)rDr r z*Could not set up faulthandler file loggingzSession storage: %sr)check_systemd_timing_alignmentmismatchzStale systemd unit detected: %s has TimeoutStopSec=%.0fs but drain_timeout=%.0fs (expected >=%.0fs). systemd may SIGKILL the gateway mid-drain. Run `hermes gateway install --force` to regenerate the unit, or shorten agent.restart_drain_timeout.unitz (unknown)timeout_stop_sec drain_timeout expected_minz)check_systemd_timing_alignment failed: %srrzvAgent budget: max_iterations=%d (agent.max_turns from config.yaml, or HERMES_MAX_ITERATIONS from .env, or default 500)r3rr>rorprqrrz^Secret redaction: ENABLED (tool output, logs, and chat responses are scrubbed before delivery)zSecret redaction: DISABLED (HERMES_REDACT_SECRETS=%s). API keys and tokens may appear verbatim in chat output, session JSONs, and logs. Set security.redact_secrets: true in config.yaml to re-enable.r:rJzActive profile: %sr7 starting)r5 r6rc)start_gateway_health_exportrFz#Gateway health OTLP export: enabledz)gateway health OTLP export startup failed)detect_compromisedgateway_log_message%szCRun `hermes doctor` on the gateway host for full remediation steps.z1security advisory check failed at gateway startup)TELEGRAM_ALLOWED_USERSDISCORD_ALLOWED_USERSWHATSAPP_ALLOWED_USERSWHATSAPP_CLOUD_ALLOWED_USERSSLACK_ALLOWED_USERSSIGNAL_ALLOWED_USERSSIGNAL_GROUP_ALLOWED_USERSTELEGRAM_GROUP_ALLOWED_USERSTELEGRAM_GROUP_ALLOWED_CHATSEMAIL_ALLOWED_USERSSMS_ALLOWED_USERSMATTERMOST_ALLOWED_USERSMATRIX_ALLOWED_USERSDINGTALK_ALLOWED_USERSFEISHU_ALLOWED_USERSWECOM_ALLOWED_USERSWECOM_CALLBACK_ALLOWED_USERSWEIXIN_ALLOWED_USERSBLUEBUBBLES_ALLOWED_USERSQQ_ALLOWED_USERSYUANBAO_ALLOWED_USERSGATEWAY_ALLOWED_USERS)TELEGRAM_ALLOW_ALL_USERSDISCORD_ALLOW_ALL_USERSrWHATSAPP_CLOUD_ALLOW_ALL_USERSSLACK_ALLOW_ALL_USERSSIGNAL_ALLOW_ALL_USERSEMAIL_ALLOW_ALL_USERSSMS_ALLOW_ALL_USERSMATTERMOST_ALLOW_ALL_USERSMATRIX_ALLOW_ALL_USERSDINGTALK_ALLOW_ALL_USERSFEISHU_ALLOW_ALL_USERSrWECOM_CALLBACK_ALLOW_ALL_USERSrBLUEBUBBLES_ALLOW_ALL_USERSrrrNplatform_registryc32K|]}|j |jVdSr^)allowed_users_envrbrs r>rdz&GatewayRunner.start..b+sB))()&)#))))))rMc32K|]}|j |jVdSr^)rrQ s r>rdz&GatewayRunner.start..f+s@++$%?+++++++rMc3>K|]}tj|VdSr^)rrrs r>rdz&GatewayRunner.start..l+s;  BIaLL      rMrr>rorqrrc3hK|]-}tj|ddvV.dS)r>rorqrrN)rrryrs r>rdz&GatewayRunner.start..o+s\e e  Ia   " " $ $(< <e e e e e e rMa4No env user allowlists configured. Messaging platforms default to pairing/allowlist policies and will deny unknown senders unless you configure platform allowlists (e.g., TELEGRAM_ALLOWED_USERS=your_id) or explicitly opt in with GATEWAY_ALLOW_ALL_USERS=true plus dm_policy/group_policy: open on the platform.rr(r|zuRefusing to start: %s has dm_policy/group_policy set to 'open' but neither GATEWAY_ALLOW_ALL_USERS nor %s is enabled.za platform allow-all flagstartup_failed)discover_pluginsz*plugin discovery failed at gateway startup)register_relay_adapter relay_urlself_provision_relaysend_relay_policyz*relay adapter registered (connector at %s)z4relay adapter registration failed at gateway startup)register_from_config) accept_hooksz1shell-hook registration failed at gateway startupr*z5Recovered %s background process(es) from previous runzProcess checkpoint recovery: %s.clean_shutdownu?Previous gateway exited cleanly — skipping session suspensionzrClean-start marker cleanup failed; refusing startup so the clean-exit receipt cannot mask a later unclean exit: %sz#clean-start recovery cleanup failedz>Discarded %d orphan active-turn marker(s) after clean shutdownzSMarked %d in-flight session(s) as resumable from previous run (%d exact, %d legacy)z'Auto-suspended %d stuck-loop session(s)zStuck-loop detection failed: %srzSkipping %s on default profile: no bot credential in this profile's secrets. Secondary multiplexed profiles that provide the token will still connect.ch|] }|j SrNrrbrs r>rQz&GatewayRunner.start..C,s!Q!Q!Qa!'!Q!Q!QrMuqNo adapter for '%s' — is the plugin installed? (platform is enabled in config.yaml but no plugin registered it)zNo adapter available for %sset_reaction_handlerzConnecting to %s... connectingr_voice_input_callbackru✓ %s connectedu✗ %s failed to connectrrrCrrzfailed to connectz: failed to connectu✗ %s error: %sz$Gateway multiplexer config error: %sz,Secondary-profile adapter startup failed: %sc3 K|]}|vV dSr^rN)rb _profile_mapr s r>rdz&GatewayRunner.start..,s<'' L(''''''rMu%s is enabled but no profile (default or secondary) provided a bot credential for it — the platform is not being served. Add its token to the profile that should own it, or disable the platform.r z0Gateway hit a non-retryable startup conflict: %szf%d platform(s) fatally misconfigured and parked: %s. Staying alive so retryable platforms can recover.uSGateway started with no connected platforms — %d platform(s) queued for retry: %sdegradedzNo adapter could be created for any of the %d configured platform(s). Check that required dependencies are installed and credentials are set. Gateway will continue for cron job execution.zNo messaging platforms enabled.z5Gateway will continue running for cron job execution.r rQrTr@) interval_s start_timerz&Failed to start gateway loop heartbeatz%s hook(s) loadedzgateway:startuprEcg|] }|j SrNrr:s r>rz'GatewayRunner.start..p-s@@@a!'@@@rMz#Gateway running with %s platform(s)build_channel_directoryc34K|]}t|VdSr^)r7)rbchss r>rdz&GatewayRunner.start..z-s(WW3s88WWWWWWrMz%Channel directory built: %d target(s)z"Channel directory build failed: %sc3>K|]}|VdSr^)rrbrs r>rdz&GatewayRunner.start..-s>   KKMM      rM.update_pending.json.update_pending.claimed.jsonrB  skip_targetsc.|Sr^)_run_process_watcher)wrs r>rz%GatewayRunner.start..-sd&?&?&B&BrMzprocess_watcher:rN)r z(Resumed watcher for recovered process %sdcz!Recovered watcher setup error: %ssession_expiry_watchersession_stall_watcherkanban_notifier_watcherkanban_dispatcher_watcherz;Starting reconnection watcher for %d failed platform(s): %src3$K|] }|jV dSr^rr:s r>rdz&GatewayRunner.start..-s$BBa!'BBBBBBrMplatform_reconnect_watcherc&td|SNrWr rrs r>rz%GatewayRunner.start..-wt-FJJrMon_spawnhandoff_watcherasync_delegation_watcheru?scale-to-zero: armed (idle timeout %.0fs) — watching for idlescale_to_zero_watcherz*scale-to-zero: arm check failed at startupdrain_control_watcherzPress Ctrl+C to stop)r3rz faulthandlerenablerrjrrVrzrrrfrwrxmakedirsrr2r4signalrrNrr! rr rvgateway.shutdown_forensicsr r'rvrrhrryr?r;r; r8 rrd&agent.monitoring.gateway_health_exportr& _gateway_health_export_runtimehermes_cli.security_advisoriesr' r( r gateway.platform_registryrN rplugin_entriesr rrerrrrPrhermes_cli.pluginsrV rrW rX rY rZ agent.shell_hooksr[ agent.outbound_webhooksrdiscover_and_loadr-r+recover_from_checkpointrlrr r r{ r6rrrrErrr_create_adapterr __members__rset_message_handler_primary_message_handlerset_fatal_error_handlerrset_session_storerset_busy_session_handlerr r/rset_topic_recovery_fnrfset_authorization_check_make_adapter_auth_checkrr&rr0rr _handle_voice_channel_inputrb rhas_fatal_errorrrrrUrrrr!_start_secondary_profile_adaptersrrr)rVr}r7rrrr rrr|ryrQrrrrrrgateway.channel_directoryrj sum_send_update_notification#_schedule_update_notification_watchrrmrqr_send_restart_notification(_send_home_channel_startup_notificationsrvr r r rr_spawn_supervised_session_expiry_watcher_session_stall_watcher_kanban_notifier_watcher_kanban_dispatcher_watcher_platform_reconnect_watcherrW_handoff_watcher_async_delegation_watcherrrr rrF )Pr _fh_log_dir_fh_enable_path_fh_enable_file_sigusr2_log_dir_faulthandler_path_fhr _alignmentr_effective_max_iter _redact_raw _redact_onr;r@r8 rdr& r' r( _adv_hits_adv_msg_builtin_allowed_vars_builtin_allow_all_vars_plugin_allowed_vars_plugin_allow_all_varsrN _any_allowlist _allow_allrr>rrrrV rW rX rY rZ r[ _hooks_cfgregister_outbound_webhooksr+rer _clean_markerr r<r r.stuckconnected_countenabled_platform_countstartup_nonretryable_errorsstartup_retryable_errors _multiplex_on_multiplex_skipped_platformsrr1_pval_builtin_names _set_reactionr/r_secondary_connected_served_by_secondary _existing_hb_bg hook_countrj directorych_countrA !chat_restart_notification_pending$planned_restart_notification_pendingwatchersrr r sP` @r>rzGatewayRunner.start*s!  0111 Q   ! ! ! !j'2 Q Q Q Q%dk9dCCrw||))**HH  K$7777"$',,{ 3     D   C C C C C C..00H -M-M-O-O)))$$ &+++):)I)I)K)K+++&& " "    D   "7:N"N     Y8"==CCEEI]] ade e ,/EEe e e b b  j  NN@   4DK@@  #\\#q11!4N M&:&@&@&B&B  "(>^33$,QKME4 LLI > > > > >$J % @ @ @ @       ' &z 2 2 2 2    LLC        $$&&& A ? ? ? ? ? ?(@@BBI ` SU^___ A A A NN > > > > > > > ?-1)&(#&(#!"13#.0 WT[2FNNOO 79$)-)>)D)D)F)Fi i  %Ho>>@@@@@@@@ tt"*  %A(O%\%\  <N  -33H=== "a ' "**8_EEG  !Q!Q83G3N3N3P3P!Q!Q!Q..NN[ NN#@%HHH  ' '(E(E(G(G H H H  + +D,L M M M  % %d&8 9 9 9  , ,T-U V V V#G-CTJJM && ; d9:::  ) )$*P Q Q Q  + +D,I,I'JZ,[,[ \ \ \&*&:G # KK-x~ > > >  0 0+" 1    j  $ J JX!!BB7HUUUUUUUU 44K.5DM(+::7CCCw(?@@Y8<8X5#q(O88 '2#'&* 9 KK 2HNCCCCNN#=x~NNN77JJJJJJJJJ.1<<$N9@9V+c::\c'.'?*1*E = '<=44!<  '~NN1LNN#8 *9,-.2n.>.>.C484R4R$,g5"5"372N2N$,g3"3" @ @D28<<<$N+5'+*= = 177'~BBB '6()*..*:*:R*?040N0N ('11/3.J.J ('// < <.x8    /CCC33GXFFFFFFFFF44N#-#"%a&& 5 )//8>0H0HQ0H0HIII. !"&."2"2R"7(,(F(F '))'+&B&B ''' 4 4&x000000 2>>@@@@@@@@ tt  :)-)O)O)Q)Q#Q#Q#Q#Q#Q#Q 3 3OO#   VVF LL? H H H ??????$$3CQWXXXXX    ?? OQWXXXCCCCCC((7GU[\\\\\ D"@((000491t*  H344II9::  &))+"YY'?@@FNN>D233V GGGGGG,,*4(,%D+ @AAA STTT::<< < < < < < < 4(, % ))+++  ##I...  R"4)?FFL#|'8'8':':#,3,?*#?#*41F#L#L--) d$7>>?GGD5666-?? LLL R R R LLADL Q Q Q Q Q R011  9 KK+Z 8 8 8joo/ @@4=+=+=+?+?@@@2           Q   KK= O O O D I I I I I I55dmDDDDDDDDIWWy}}["/M/M/T/T/V/VWWWWWH KK? J J J J D D D NN? C C C C C C C C D 7799999999 7C  55==      7  4 4 6 6 6 Q  -$$ $ $ $ $ $ $ $-J,K,K)/T/V/V, - -(,D %--///////// 0 6 6CC!%D455553555511333333333 ..000**,,,,,,,,, A ? ? ? ? ? ? (8H02  -(11 + + 7&&$BBBBBBw{{<'@'@BB!'  F T`HaHabbbs7b==!-********* + A A A LLWXXX t>@[\\\  !  KKMD*++ BB4+ABBBBB   *(,'='=  , (JJJJ(>( ( $ t46GHHH t=?YZZZ V--// ; U<<>>&&t'BD[\\\\ 88::: V V V LLEPTL U U U U U V t:S?AU&VV)AX XX\00 \=<\=]))&^^A _$$&`  ` 4a&a/.a/ 7c c3c..c3/e f+ff(1h i $ii 8|H| A@$C<<A@@$AAAADA ADA*ACA9AB B ACB ABBACBABB+ACCADC ADCADC<ADDADDADD ADF2AGG AGGAGJ AJ J AJ-J,AJ-MB1APP&AP9P8AP9SA7AUU AVUAU;U;AVYAY.Y.AY?[ B.A]:]: A^)^A^$^$A^)c A1Ad>d>&Ae'e&Ae'rrTrr _attemptr ctddt_tjt j}j|: |n-#t$r t ddYnwxYwfd}| ||S)uLaunch a long-lived background task with task-level supervision. Complements upstream's per-iteration inner-loop try/except (which only guards a single loop-body) by covering what that CANNOT: an exception raised in the watcher's OUTER ``while self._running:`` loop or its pre-try setup region, plus task-level death generally. A bare ``asyncio.create_task`` drops such an exception on the floor — no log, no restart, the watcher silently gone. This retains the handle in ``self._background_tasks``, logs any crash, and restarts with capped exponential backoff up to ``_MAX_SUPERVISED_RESTARTS`` failures in rapid succession (each within ``_SUPERVISED_HEALTHY_SECS`` of its restart). The counter resets after any run that stayed healthy for at least ``_SUPERVISED_HEALTHY_SECS`` — so a long-lived daemon that crashes occasionally over days is never permanently abandoned. ``on_spawn`` (optional) is invoked with the freshly-created task on every spawn, INCLUDING internal backoff respawns. Callers that also track the live handle elsewhere (e.g. ``self._reconnect_watcher_task`` for ``_ensure_reconnect_watcher_running``) MUST pass it — otherwise the supervisor's own respawn creates a new task without updating that external handle, so ``_ensure_...`` later sees the stale/done handle and spawns a SECOND concurrent watcher (double reconnect attempts). rNzon_spawn callback for %s raisedTrc j||jrdS|j}|dStd || r߉ jrtjz }| j krdn j kr$td  j dStddtdz  fd}tj |} j|| jjdSdSdS) NzSupervised task %s died: %rrruhSupervised task %s died %d times in rapid succession (each within %ds of restart) — giving up restartsrr|cKtjd{VjrdzdSdS)Nr(r )rrrr )backoff coro_factoryeffective_attemptrr r rsr>_respawnz@GatewayRunner._spawn_supervised.._done.._respawn.sx!-000000000}..( $+%6%:%- /rM)rrrrr3rPrrUr_SUPERVISED_HEALTHY_SECS_MAX_SUPERVISED_RESTARTSr6rrrr)rr<ran_forr respawn_taskr r r _startedr rr r rs @@r>_donez.GatewayRunner._spawn_supervised.._doneb.s  " * *1 - - -q{}} !+--C{ LL6cCL P P P" O4=" O.**X5d;;; )*%%(0%$(EEELLN)5 Fb!s+> &**<888..t/E/MNNNNNE" O" O" O" OrM) rVrrrUrrrrr2r3r4r) rr rr r r rr r s `````` @r>r zGatewayRunner._spawn_supervised6.s0 4,d 3 3 ;%(UUD ">##"<<>>22 ""4(((   U U U U >t TTTTT U- O- O- O- O- O- O- O- O- O- O- O^ u%%% s8 B'B.-B.rc\Ktjdd{V|jr |jtj|d{V+|jd{V}|D]}|d}|s|j|d{Vs; ||d{V|j|d{Vx#t$rV}t d||d|j |t|d{VYd}~d}~wwxYwnC#tj$rt$r'}td|dYd}~nd}~wwxYwtj|d{V|jdSdS)uBackground task that processes pending CLI→gateway session handoffs. Polls ``state.db`` for sessions in ``handoff_state='pending'`` and, for each one: 1. Atomically claims it (pending → running). 2. Resolves the destination platform's configured home channel. 3. Re-binds the gateway's session_key for that home channel to the CLI's existing session_id via ``session_store.switch_session`` so the full role-aware transcript replays on the next agent turn. 4. Forges a synthetic ``MessageEvent`` (``internal=True``) with a handoff-notice text and dispatches through the normal gateway message pipeline so the agent runs and replies on the platform. 5. Marks the row ``completed`` (or ``failed`` with ``handoff_error``). The CLI process is poll-blocked on the row's terminal state and prints the result to the user. rNrz!Handoff for session %s failed: %sTrzHandoff watcher tick error: %s)rrrrRlist_pending_handoffsrv claim_handoff_process_handoffcomplete_handoffr2r3r fail_handoffrwrr4)rr r5rrNr<s r>r zGatewayRunner._handoff_watcher.sv*mAm * S#+!-111111111 $ 0 F F H HHHHHHH"RRC!$J%! !%!1!?!? !K!KKKKKKK! R"33C888888888".?? KKKKKKKKKK$RRR?&d'#.;;JCQQQQQQQQQQQQQQ RR )    S S S =sT RRRRRRRR S-)) ) ) ) ) ) ) )5m * * * * *sI!EAE%;C! E! E+A D<7E<EEFFFrc Kddlm}ddlm}m}ddlm}|d}|dpd }|std ||}n(#ttf$rtd |d wxYwt||j|j} | std |d | j} |j|} | r| jstd |d|dp |dd} d| } | t)| j| d{V}n7#t*$r*}t,d||dd}Yd}~nd}~wwxYw|p| jrt)| jnd}t)| j}||jkot5|}|r|sd}d}nd}|r|nd}||jkr|dkr|rt)|}n|}|||| j||d|}|jj|}|r|jni}|||dd|dd}|j |d{V|j!||d{V}|td|d ||"||#|d!| d"}|||d#}t,$d$||| j|||%|d{V}|sdSi}|r||d%< | &|t)| j||pdd{V}n%#t*$r}td&||d}~wwxYwtO|d'ds#tO|d(d)} td&| dS)*zAExecute one handoff row. Raises on failure (caller marks failed).rr )r[r`)rrrhandoff_platformrzhandoff_platform is emptyzunknown platform 'rVz platform 'z' is not active in this gatewayzno home channel configured for z(; run /sethome on the desired chat firstrNu Hermes — z/Handoff: create_handoff_thread raised on %s: %sTrrzsystem:handoffrHandoff)rr2r*rrr)rr<r=Fr<r=zcould not switch session key u → z([Session was just handed off from CLI ("z") to this channel. The full prior conversation history is loaded above. Briefly confirm you're working here and summarize what we were working on, so the user can continue from this device.])rr(r ubHandoff: dispatching synthetic turn for CLI session %s → %s (home=%s, thread=%s, session_key=%s)rzadapter.send failed: r/rPr6 )(rrrrr[r`r rrrvrxryrrjrrerzrr1r= r2create_handoff_threadrwr2r3r4rrrdrrrErr8 get_or_create_sessionswitch_session_evict_cached_agentr rz_handle_messager0rV)!rrrr[r`rrcli_session_idr_rrr1r cli_title thread_name new_thread_idr<effective_thread_id home_chat_idis_telegram_private_chatdest_chat_type dest_user_id dest_chat_id dest_sourcerGrr+switchedsynthetic_textsynthetic_event response_text send_metadatarrs! r>r zGatewayRunner._process_handoff.s++++++DDDDDDDD777777T!344:AACCIIKK  <:;; ; Fx ..HHH% F F FDMDDDEE E F/xdmTT  K]KKK #{++H55 4< :-:::  GGG$$:rr(: 0I//  !")"?"?DL!!;##MM ! ! ! LLAsT    !MMMMMM  !, #'> ;C   t 4<(( ) ) B3LAA !  Z!9 Z%N+LL "N+CY<>DL!!% FF  G G G&'+HIIC >s<, A88%B2.E!! F+ FF52N(( O 2OO c Ktjdd{Vi}d}|jr. |jd{Vg}t |jjD]E\}}|j r |j |d{Vs.| ||fF|ri}|D]S\}} | d} t| dkr| dnd} || ddz|| <Td d t!|D} t"d t|| |D]o\}} dd lm} | d} t| dkr| dnd }| |j|dn#t,$rYnwxYwd}t/|dd}|W|5|j|}t3|t4r|dn|r|nd}dddn #1swxYwY|%||}|r |jjnd}|r&|t<ur||dd{V| ||!|d|j"|d{Vt"#d|j|$|jd#t,$r}||jddz}|||j<||kr`t"%d||j||j"|dd{V|$|jdn#t"#d|||j|Yd}~id}~wwxYw|retMd|D}t||z }|rt"d||nt"d| |'}|rt"d|n2#t,$r%} t"#d| Yd} ~ nd} ~ wwxYw |(n2#t,$r%} t"#d| Yd} ~ nd} ~ wwxYwt/|d d!}d"}tSj)|z |kr tUt/|j+d#dpd}|dkr=|j,|d{V}|rt"d$|n2#t,$r%} t"#d%| Yd} ~ nd} ~ wwxYwtSj)|_-n2#t,$r%}t"#d&|Yd}~nd}~wwxYwt]|D]%}|jsntjdd{V&|j,dSdS)'aBackground task that finalizes expired sessions. Runs every ``interval`` seconds (default 5 min). For each session whose reset policy has expired, invokes ``on_session_finalize`` hooks, cleans up the cached AIAgent's tool resources, evicts the cache entry so it can be garbage-collected, and marks the session so it won't be finalized again. rNr)rr|rrr(rc3*K|]\}}|d|VdS)rNrN)rbr;cs r>rdz8GatewayRunner._session_expiry_watcher../sA..'+q!1 q ......rMz,Session expiry: %d sessions to finalize (%s)rM rsession_expiredrO r ra rP expiry_finalizedrzSession expiry finalized for %szkSession finalize gave up after %d attempts for %s: %s. Marking as finalized to prevent infinite retry loop.F)clear_model_overridez*Session finalize failed (%d/%d) for %s: %sc3.K|]\}}|j dVdS)r(N)r )rbrKrs r>rdz8GatewayRunner._session_expiry_watcher.. 0sB  "a!:L       rMz3Session expiry done: %d finalized, %d pending retryz!Session expiry done: %d finalizedz+Agent cache idle sweep: evicted %d agent(s)zIdle agent sweep failed: %sz%Agent cache pressure sweep failed: %s_last_session_store_prune_tsr@r$session_store_max_age_daysz,SessionStore prune: dropped %d stale entrieszSessionStore prune failed: %sz Session expiry watcher error: %s)/rrrr8 r9 rrrrr _is_session_expiredrrer7rvrfsortedr3rzrR rN rNr2rVr rtrrArJrrrS r _clear_conversation_scopeset_expiry_finalizedr4rUrr _sweep_idle_cached_agents!_sweep_agent_cache_under_pressurerUrhrzprune_old_entriesr range)rr _finalize_failures_MAX_FINALIZE_RETRIES_expired_entriesrr _platforms_krr _plat _plat_summaryrN _platform _cached_agentr_cached _exp_staterfailuresr _failed _idle_evicted_last_prune_ts_prune_interval_max_age_prunedrKs r>r z%GatewayRunner._session_expiry_watcher/smB-/ !mo 'i D.==?????????#% "&t'9'B'H'H'J'J"K"K::JC-! !%!9!M!Me!T!TTTTTTT! $++S%L9999#24J"2IIB!##-0[[1__q ),6NN5!,D,Dq,H 5))$(II../5j6F6F6H6H/I/I...%%MKKF,--} #3LLJCK !MMMMMM%(YYs^^F58[[1__q "I,,+0+;)2'8 )!!! D! )- &-d4G&N&N &2!,{{*.*;*?*?*D*D>HRW>X>X0z ip^z^e^evz {{{{{{{{{{{{{{{ )0)-)A)A#)F)FJEO,YJO,A,AUYM(]BY-Y-Y"&"H"H -7G#I##0055566(:7#6KKERRRRRRRRR =!,+..u/?FFFF$#5#9#9%:JA#N#NQR#R?G*5+;<#'<<<"NN!W (%*:A #'":"O"O %E#P##/2253CTJJJJ"LL L (*?AQST&$   &6   E""233e;G Q!7  ?D$($B$B$D$DM$ I)!DDDLL!>CCCCCCCCDN::<<<< NNNLL!H"MMMMMMMMN")/Ms!S!S"(9;;//AA J#&#DK1MqQQVUV$$$a<<,0,D,V,VW_,`,`&`&`&`&`&`&`G&" & $R$+!"!"!"%JJJ %DbIIIIIIIIJ8< D5 D D D ?CCCCCCCC D8__ ' '}EmA&&&&&&&&&&_mo 'o 'o 'o 'o 'sEW&A GL' G L'G  L':>I8 L'I L' I CL'%W&' O-1B1O("W&(O--A*W&1R W& R9R4/W&4R99W&=SW& TS<7W&<T0W&2A(VW& W %WW&W  W&& X0XXc"tddS)zCReturn configured stall timeout (seconds); 0 disables the watchdog.r!r)rrNs r>_session_stall_timeout_secondsz,GatewayRunner._session_stall_timeout_secondsP0s8#>>>rMc#Kt}tt|diD]2}|t |}||vr|||V3tt|diD]V}t|D]2}|t |}||vr|||V3WdS)zAYield every live platform adapter (default + multiplex profiles).rNr})rrrVrrr)rrr1aidamaps r>_iter_gateway_adaptersz$GatewayRunner._iter_gateway_adaptersT0sGD*b99@@BBCC  GW++Cd{{ HHSMMMMMMM':B??FFHHII  D ..  ?kk$;;     rMc t|ddpi|}| |turdSt|dsdS |}n#t $rYdSwxYwt |tr|ndS)zReturn the shared activity snapshot for stall progress (#72039). Single progress source: ``AIAgent.get_activity_summary()`` / ``agent.session_activity``. No turn-start or pending-inbound clocks. r7Nr>)rVrvrrr>r2rtru)rr+rr s r>_session_activity_for_stallz)GatewayRunner._session_activity_for_stalli0s 0$77=2BB;OO =E%<<<4u455 4 0022GG   44 $Wd33=ww=sA A*)A*timeout_secondsc Kddlm}m}m}m}t |dd}| i}||_d}tj}i} |D]K} t | ddpi} t| D]\} } | r | | vr | | | f| | <Ltt |ddpi D]J\} }| r| | vs|s|d} t | dd}|| |nd} | C| | f| | <Kt| D]o\} \} }|du}|r| | nd}|r |||nd}t|| }|||| r|| dd }||||| s|t!d t#|d z}|pi}t$d| ||||dp|dpd|dp|dpdt |dd}|t |ddnd}|s"t$d| d|| <tt | ddpi| dup2tt |ddpi| }|| | tj}|r|;||kr5t$d| |||| d? |%t+|dr||nd} t/j| t5||||t6d{V}n7#t.j$r%t$dt6| YwxYw|@t |ddd ur-t$d| t |dd1|d z }d|| <=#t:$r'}t$d| |Yd}~id}~wwxYwt|D]}|| vr||d|S) zScan pending inbound sessions and notify once per stall episode. Returns the number of notifications sent this pass (for tests). r)!format_session_stall_notification*resolve_session_idle_seconds_from_activity'should_clear_session_stall_notification&should_emit_session_stall_notificationrNr<rr(r)r8 rDhas_pending_inboundF)r8 rDr> already_notifiedr(rzSession stall detected: session=%s idle=%.0fs (timeout=%.0fs, ~%d min); pending inbound present | last_activity=%s | provenance=%s (agent.session_stall_timeout)last_activity_desclast_activity_descriptionrrlast_activity_provenancer2z5Session stall notify skipped (no chat_id): session=%sTzSSession stall notify aborted (no longer stale): session=%s pending=%s fresh_idle=%sr r.rzLSession stall notify send timed out after %.0fs for %s; will retry next tickr/z&Session stall notify failed for %s: %srPr6 )gateway.session_stallr: r; r< r= rVrrUr5 rrr@r7 rrvrUrCrhr3rrzrr rrr0rw"_STALL_NOTIFY_SEND_TIMEOUT_SECONDSr,r2r)rr8 r: r; r< r= notified_mapsentrrr1r r+rr# r(r has_pendingactivityrDalreadyminsr2 still_pending fresh_idlerrr<rs r>_check_session_stallsz#GatewayRunner._check_session_stallsz0s             t%>EE  L+7D (ikk13 2244 ? ?G"7,?FFL"L&*<+=+=+?+?&@&@ ? ?" U?;j#@#@UEV/6.>J{+ ?&* T+T 2 2 8b ? ? A A& & 7 7 !K +";";8";QKEUHd33F4:4F((000D '.&6J{ # #59*:J:J:L:L5M5ME E  1K1'='t3KALV00===RV  ::8MMMM  <++K8899G66 /)$/   d33399 /)$/!(   #q#lb01122D~2H NN0 122<< ;<< \**<< :;;    ]Hd;;F:@:Lgfi666RVG K -1 [)"5t<<BGGT#3T::@bEE# DC00==IKKJ! &:+G+G :!   d333* )gdr z$GatewayRunner._session_stall_watcher21sdmCc#uX&?&?@@AAAAAAAAAm ' E==??Q;;44W========= E E E >DDDDDDDD E3uX//00E5\\ ' '}EmA&&&&&&&&&&m ' ' ' ' 's5B B3B..B3cJ ddlm}|pdS#t$rYdSwxYw)z0Return the profile name this gateway represents.rr:rJ)r?r;r2)rr;s r>rz"GatewayRunner._active_profile_nameJ1sO  C C C C C C**,,9 9   99 s  ""c,tddsdStdd}||sdStd||ndjdfd _dS) aEnsure the platform reconnect watcher background task is alive. If the tracked reconnect watcher task has died (e.g. from exhausting its restart budget, or a terminal exception that _spawn_supervised could not recover), respawns it so platforms queued for reconnection are not permanently stranded. Called after queueing a retryable fatal error in _handle_adapter_fatal_error (#70344). rFNrWu7Reconnect watcher task is dead (done=%s) — respawningzN/Ar} c&td|Sr r r s r>rzAGatewayRunner._ensure_reconnect_watcher_running..m1r rMr )rVrr3rr r rW)rrs` r>rz/GatewayRunner._ensure_reconnect_watcher_runningX1stZ//  Ft6==  DIIKK  F E+DIIKKK   (,'='=  , (JJJJ(>( ( $$$rMc x Ktjdd{V|jr|js@t dD]/}|jsdS|jrntjdd{V0Ot j}t|jD]}|jsdS|j |}|*| dr@||dkrM|d}|ddz}t||s)t d |j |j|=td |j |d} |||}|s)t d |j |j|=||||j||j||jt1|d d}t3|r||j||j|||j|j |_ |!||d d{V} | r ||j"|<|#|tI|dr |j%|_&|j"|j'_"|j|=|(|j dddtd|j  ddl)m*} | |j"d{Vn#tV$rYnwxYw |,|n:#tV$r&t-d|j d Yn wxYw|j.rs|j/sl|(|j d|j0|j1t d|j |j1te|d{V|j|=n|(|j d|j0|j1pdtg|} ||d<t j| z|d<td|j | te|d{V,#tV$r} |te|d{V|(|j ddti| tg|} ||d<t j| z|d<t d|j | | Yd} ~ d} ~ wwxYwt dD]&}|jsdStjdd{V'|jdSdS)u7Background task that periodically retries connecting failed platforms. Uses exponential backoff: 30s → 60s → 120s → 240s → 300s (cap). Retryable failures (network/DNS blips) keep retrying at the backoff cap indefinitely — they self-heal once connectivity returns, so a transient outage never requires manual intervention. Non-retryable failures (bad auth, etc.) drop out of the queue immediately. The circuit breaker (``_pause_failed_platform`` / ``/platform pause``) remains available for manual operator control via ``/platform list`` and ``/platform resume ``, but is no longer triggered automatically — auto-pausing a recovered platform was the cause of bots silently staying dead after a transient DNS failure. rGNrr(rI rrzrzKReconnect %s: no bot credential on queued config, removing from retry queuezReconnecting %s (attempt %d)...zGReconnect %s: adapter creation returned None, removing from retry queuer` Tr'rb rru✓ %s reconnected successfullyrri rz3resume-pending reschedule after %s reconnect failedrrzAReconnect %s: non-retryable error (%s), removing from retry queuerzfailed to reconnectz&Reconnect %s failed, next retry in %dsz)Reconnect %s error: %s, next retry in %ds)5rrrrr rUrrrrvrr3rrrzr r r r rr rr r rVr/rr rfr r rr&r-rr rr rb rrr rj r2r r4r rrrrrrw) rrKrrrzrrr1r r/rj r rs r>r z)GatewayRunner._platform_reconnect_watcherp1s7mBmB ') r++A=-!-**********.""C !7!!>??m m }FF-11(;;< 88H%%l+++"&x.z*Q.4HoNNNN4  .x8 5NG I"228_MMG"!e$N!28< //0M0M0O0OPPP33D4TUUU--d.@AAA44T5]^^^$+G5KT$R$RM ..C% d&ABBB11$2XYYY33D4Q4QRYRb4c4cddd.2.BG+ %)$F$F%G%%GP?29 h/>>wGGG"7,CDD]<@<\G98< ,5 28<<<$N+6'+*. =  $Ex~VVV!YYYYYY"9"9$-"H"HHHHHHHHH(!!! D! BBHBUUUU("LL U ()-)!0*?9V*?<<$N+2'.'?*1*E = _$NG,G6g>>>>>>>>> 28<<<<$N+5'.'?*1*E*^I^ = #5W"="=+2Z(-1^-=-=-G\* D$NG6g>>>>>>>>>!*6g>>>>>>>>>88 '1#'&)!ff 9 199G'.D$)-)9)9G)CD&NNC 7%62YY ' '}FFmA&&&&&&&&&&EmB 'B 'B 'B 'B 'sj"AS#F+SM,+S, M96S8M99S=NS,OSOD S U7BU22U7cK|j}t|tsdStj}g}|D]v}t|ts|D]I}t|tjr-||ur)|s||Jw|D]}| | }|rO|dkrItj ||d{V\}}|r(t dt||dS)aCancel profile-scoped reconnects before tearing down their registry. A reconnect can be waiting in adapter setup while shutdown begins. It must not republish an adapter after the secondary registry is drained. Waiting is bounded by the same adapter-cleanup budget; if a task does not finish in time, the stopped runner state still prevents it from installing an adapter when it eventually resumes. NrrzLTimed out waiting for %d secondary profile reconnect task(s) during shutdown)r4rtrurr rTaskrrrrrBr3rr7r4) rr5rrprofile_pendingrrr unfinisheds r>)_cancel_secondary_profile_reconnect_tasksz7GatewayRunner._cancel_secondary_profile_reconnect_tasksC2st0'4((  F&(($&&~~// ' 'Oot44 '..00 ' 'dGL11'd'6I6IRVR[R[R]R]6ILL&&& '  D KKMMMM7799  Wq[[&-l5'&J&J&J J J J J J J E: b OO  rMc|jr|jjdkrdS|jdSddlm}|d}|sdS||_|ddS)zAStart sd_notify only after a configured gateway is truly running.rFNT)SystemdWatchdog)config_enabledzHermes Gateway running)rrzsystemd_watchdog_secondsr5gateway.systemd_notifyrZ rready)rrZ r s r>_start_systemd_watchdogz%GatewayRunner._start_systemd_watchdogc2s}  D I I5  ! -4::::::"?$777~~ 5!)/000trMcbK|j}|dSd|_|d{VdS)z;Stop heartbeats before any potentially long shutdown drain.N)r5r)rr s r>_stop_systemd_watchdogz$GatewayRunner._stop_systemd_watchdogs2sG)   F!%mmoorMr r r r c2Ktdd}t|r ||rd_|_|_jjd{VdSdfd }dfd t j|_jd{VdS)z-Stop the gateway and disconnect all adapters.r NTr-cKdtddfd}tj}|_idtffd }t jds%ttj ||d |d{V| dS#| wxYw)Nphaser-c ddlm}|}|rtd||n3#t $r&}td||Yd}~nd}~wwxYw ddlm}|d|d}|r=t d |t|d |n3#t $r&}td ||Yd}~nd}~wwxYw dd l m }|d |d}|rtd||n3#t $r&}td||Yd}~nd}~wwxYw ddlm}|n3#t $r&}td||Yd}~nd}~wwxYw ddlm} | dS#t $r'}td||Yd}~dSd}~wwxYw)uwKill tool subprocesses + tear down terminal envs + browsers. Called twice in the shutdown path: once eagerly after a drain timeout forces agent interrupt (so we reclaim bash/ sleep children before systemd TimeoutStopSec escalates to SIGKILL on the cgroup — #8202), and once as a final catch-all at the end of _stop_impl() for the graceful path or anything respawned mid-teardown. All steps are best-effort; exceptions are swallowed so one subsystem's failure doesn't block the rest. rr*z,Shutdown (%s): killed %d tool subprocess(es)z(process_registry.kill_all (%s) error: %sN)mark_running_jobs_interruptedzGateway shutdown (z;) killed the job's tool subprocess before the run finished.z>Shutdown (%s): marked %d in-flight cron job(s) interrupted: %srz,mark_running_jobs_interrupted (%s) error: %s) interrupt_allzgateway shutdown (rrz6Shutdown (%s): interrupted %d background delegation(s)z"async interrupt_all (%s) error: %s)cleanup_all_environmentsz'cleanup_all_environments (%s) error: %s)cleanup_all_browsersz#cleanup_all_browsers (%s) error: %s)r-r+kill_allr3rzr2r4rcrf rr7rfrrg tools.terminal_toolrh tools.browser_toolri ) rd r+_killedrrf _interrupted_interrupt_async_async_nrh ri s r>_kill_tool_subprocesseszGGatewayRunner.stop.._stop_impl.._kill_tool_subprocesses2s XGGGGGG.7799G J!7!XXXLL!KUTVWWWWWWWWX\MLLLLL#@#@>U>>>$$L$\!3|#4#4dii 6M6M!\\\LL!OQVXZ[[[[[[[[\ RXXXXXX//7TE7T7T7TUUUH T!8!RRRLL!EubQQQQQQQQRWLLLLLL,,.... WWWLL!JESUVVVVVVVVWSGGGGGG((***** SSSLL!FrRRRRRRRRRSsv8; A+A&&A+/AC C4C//C484D-- E7EE!E22 F"<FF"&F88 G)G$$G)c |d}tjtjtjjtj|tj |z ndd S)Nr) r9 r r r: active_cron_jobsactive_api_runsr"watchdog_delay_sphase_elapsed_s) rvrr,r*rrrrr'r}rUr)started_stop_started_at_boxrs r>_shutdown_watchdog_snapshotzKGatewayRunner.stop.._stop_impl.._shutdown_watchdog_snapshot2s.22377)-d.E)F)F $T^ 4 4#DM22%)%>%>%@%@(,(C(C(E(E'+'A'A'C'C-1-H(G3))7>6I((722trMPYTEST_CURRENT_TESTr() done_event snapshot_fnr8) rwrrrUrurrrvr{r}r'r)rq _watchdog_donery rx _stop_impl_bodyrs @r> _stop_implz&GatewayRunner.stop.._stop_impl2s.? Ss? St? S? S? S? SN'_..N+9D (57         $:>>"788 %3D4OPP- ;  %%o+( ""$$$$$""$$$$s B))B?c X!Ktd"jrdndtj!!|d<dt f!fd }d"_d"_t"d d}t|r|d{V" d{V" d{Vtd |"j }g}t"jD]\}}|t ur "j|"jrd nd d{V||P#t($r&}td ||Yd}~{d}~wwxYw"} "} tj} "|d{V\} } td|tj| z | t3| "| "| " | sc|D]`}|"jvrU "j|d{V-#t($r&}td||Yd}~Xd}~wwxYwa| r|td|""""jrd nd }t"jD]d\}}|t ur "j||d{V2#t($r&}td||Yd}~]d}~wwxYw""jrt<nt>tAj!dz}"js"rtAj!|krs""dtAj#dd{V"js"r)tAj!|ks"js"rB""jrt<nt>td|dtd|"jrU"j$rN "%d{Vn2#t($r%}t&d|Yd}~nd}~wwxYw"'| d{Vt"dd}t"dd}|||5t|(}|)dddn #1swxYwY|D]>}tU|tVr|dn|}",|dd{V?t"j-D]!\}}".||d{V"tt"diD]^\}}t|D]#\}}".|||d{V$|)_t_"dr"j0)td |t"j1D]*}|"j2ur |"j3ur|4+"j1)"j-)t"jD]}"5| dd!l6m7}|tq"j9d"#n#t($rYnwxYw"j)"j:)t_"d$r"j;)"j9)"j<)t_"d%r"j=)"j>?|d&td'| dd(l@mA}|n2#t($r%}td)|Yd}~nd}~wwxYwt"d*d}t|d+|}|tt"d,dd+dfD]\}|t_|d-s |B+#t($r%}td.|Yd}~Ud}~wwxYwtD"td/|dd0lEmF}mG} || | s. td1z In*#t($rYnwxYwtd2| r4"Jt| K"jr"jL tttjt"jPt"j$d3d4n2#t($r%}td5|Yd}~nd}~wwxYw"jr5"jPr."Qt"_S"jTpd6"_Td"_t"d7dr="js6td8""d9"jTn""d:"jTt"td;|dS)_phase_elapsedzCGatewayRunner.stop.._stop_impl_body.._phase_elapsed3s~''*:::rMFTra z5Shutdown phase: notify_active_sessions done at +%.2fsrrz/pre-drain mark_resume_pending failed for %s: %szShutdown phase: drain done at +%.2fs (drain took %.2fs, timed_out=%s, active_at_start=%d, active_now=%d, cron_at_start=%d, cron_now=%d, api_at_start=%d, api_now=%d)z2clear_resume_pending after drain failed for %s: %szGateway drain timed out after %.1fs with %d active agent(s), %d in-flight cron job(s), and %d api_server run(s); interrupting remaining work.z%mark_resume_pending failed for %s: %sr&r r) z?Re-signaled interrupt for work still live at settle-window exitzpost-interruptz7Shutdown phase: post-interrupt tool kill done at +%.2fsz-Failed to launch detached gateway restart: %sr r rzshutdown idle-cacherP r}rz3Shutdown phase: all adapters disconnected at +%.2fs)flush_pending_to_filer rr9r:z final-cleanupz6Shutdown phase: final-cleanup tool kill done at +%.2fs)shutdown_cached_clientsz!shutdown_cached_clients error: %srRrSrrk zSessionDB close error: %sz.Shutdown phase: SessionDB close done at +%.2fsremove_pid_filerelease_gateway_runtime_lockr] uSkipping .clean_shutdown marker — drain timed out with interrupted agents; next startup will suspend recently active sessions.) requested_atr r rz7Failed to write planned restart notification marker: %szGateway restart requestedruGateway stopped by an unexpected signal — persisting gateway_state=running so container_boot auto-starts on the next boot (issue #42675)r stoppedz&Gateway stopped (total teardown %.2fs))Vr3rzr,rUrrirr*rVr/rX rH r'rr7rrr8 mark_resume_pendingrr2r4rrr- r7rr rr0 !_INTERRUPT_REASON_GATEWAY_RESTART"_INTERRUPT_REASON_GATEWAY_SHUTDOWNrr! r rr.r rPrV rr4rtrrS rrrr}rr2r3rr rQ r rur<r8r9r@r:rrrm r rk r _shutdown_executorr; r r rltouchru rr1rzrorr/r rr)r_shutdown_gateway_health_export)#rq rx r stop_watchdogr_pre_drain_keys_skrr_cron_at_start _api_at_start_drain_started_atr: r, _resume_reasoninterrupt_deadlinerrr _idle_agents_entryrr1_prof_amap_task _session_keyr r _self_dbrSr r r rs# @r>r~ z+GatewayRunner.stop.._stop_impl_body2s KK'"&"9Ar    $~// (8  % ;E ; ; ; ; ; ;"DM!DN#D*BDIIM && &#moo%%%%%%%@@BB B B B B B B B::<< < < < < < < < KKG      1G *,O#D$8$>$>$@$@AA ] ] V444]2FF-1-D\))J\$**3//// ]]]LL!RTWY[\\\\\\\\]"88::N 6688M $ 0 0 -1-F-Fw-O-O'O'O'O'O'O'O $M9 KK/    #44M""))++++--**,,     +C$"666"&":"O"OPS"T"TTTTTTTTT("LL T #R7[ 3--////11..00>*.)@X%%FX$((<(B(B(D(D#E#E  KC!888 "6JJ3P^__________$ C ..9=9Px55Vx&-%=%?%?%D%D%F%F%L"(-,0,F,F,H,H-.005577:LLL// ;;;!-,,,,,,,,,(-,0,F,F,H,H-.005577:LLL'4+E+E+G+G222@99? LLY('(8999 M"N$$ & U4+A UU??AAAAAAAAAA UUULL!PRSTTTTTTTTU00?? ? ? ? ? ? ? ?"$(;TBBKT>488F&6+= ###' #8#8LLLNNN###############+  F%/%>%>Jq F @@(=A&*$-*=*=*?*?%@%@ H H!'44WhGGGGGGGGGG!%WT3F%K%K%Q%Q%S%S T T   u)-ekkmm)<)<%Hg8859 t011 /&,,... KKE      d455  DO++D...    " ( ( * * * M   ! ! ! $T%9 : : @ @ 11,????  HHHHHH%%d4+A&B&B:VVVVV      & & ( ( (  # ) ) + + +t566 4+11333  " ( ( * * *  # ) ) + + +t^,, *!'')))  $ $ & & & $ #O 4 4 4 KKH      FJJJJJJ'')))) F F F @"EEEEEEEE Ft]D99Hx99H ''$*N*NPUW["\"\] B B;gc7&;&;;BIIKKKK BBBLL!>>> D ' R66s=;M;M;O;O7P7PQQQ& _4+G+O _%:<<,0IKK+/0I+J+J(,T-C(D(D $!___LL!Z\]^^^^^^^^_& U4+D U55777&#D$($5$T9T!"DN,t95AA J$Ja J 3 ++It7HIIII++It7HIII +D 1 1 1 KK@..BRBR S S S S Ss"?E"" F,F  F J!! K+K  K-!N N?N::N?#U>> V-V((V-36X55X9<X9%a(( a54a56f f6f11f6h(( i2ii6k k k An o $oo r)rVr/r,r.r/r2rr)rr r r _stop_guardsr r~ s` @r>rzGatewayRunner.stop{2st%A4HH L ! !  LNNN  8&*D #%5D "(7D % ? &/ ! ! ! ! ! ! ! Fl %l %l %l %l %l %l %\X TX TX TX TX TX Tt "-jjll;;orMcHK|jd{VdS)zWait for shutdown signal.N)rrBrNs r>wait_for_shutdownzGatewayRunner.wait_for_shutdown4s3"'')))))))))))rMcKt|jddsdS ddlm}m}n#t $rYdSwxYw|pd}d}i}|jD]@\}}||}|||||f<| ||} | ||| <At|di D]6} dD]1} | | } t| tr||| <27|d D]\} }| |kr ||| ||d{Vz }.#t$r&}t d | |Yd}~Yd}~wt$$rt $r(}t d | |d Yd}~d}~wwxYw ddlm}ddlm}|gt1|jz}|D].}|r*||jvr!||kr|jn |||j|</||n,#t $rt dd YnwxYw|S)u8Bring up adapters for every non-active profile this gateway serves. Returns the number of secondary adapters that connected. No-op (returns 0) unless ``gateway.multiplex_profiles`` is on. Each profile's adapters are created and connected under that profile's HERMES_HOME + secret scope (``_profile_runtime_scope``), stored in ``self._profile_adapters[profile]``, and given a message handler that stamps ``source.profile`` before delegating to the shared ``_handle_message`` — so the agent turn resolves that profile's config, skills, and credentials. Same-platform credential collisions (two profiles polling the same bot token) are detected and refused here, the only point that sees every profile's resolved credentials together. rFr)profiles_to_server;rJNr)rrT multiplexzDSkipping secondary profile '%s' due to port-binding config error: %sz-Failed to start adapters for profile '%s': %srr7 rzr)served_profilesz could not record served_profiles)rVrzr?r r;r2rr_adapter_credential_fingerprintrrrvrtr_start_one_profile_adaptersrr3rrrPr; r8 rr{r r}rrrr4)rr r;rrr r# _adfpr retry_info claim_name retry_claim profile_namerrr8 r{servedrs r>r z/GatewayRunner._start_secondary_profile_adapters4st{$8%@@ 1  V V V V V V V V V   11 )(**7i %'---// 1 1JE355c::B~'- $!99%EEN)*0'"$(;R@@GGII 2 2JD 2 2 (nnZ88 k5112+1GK( 2 +<*;d*K*K*K   &L,v%% 4#C#C ,$$ 3   Z  (       C !d  L ; ; ; ; ; ; 4 4 4 4 4 4Xt'='B'B'D'D E EEF   D(;;; 6>>**)\$777'- !  8 8 8 8 8 L L L LL;dL K K K K K LsC% 33 D44 F>EF6FF"A3H&H?>H?r rrr c vKddlm}t|5|}t|}dddn #1swxYwY|rt d|d|dt d|jD}|r1d|}td|d |d |d |d |j |i} d} |jD]\} } | j st|jd dr| tjur3 t|5|| | } dddn #1swxYwYn;#t$$r.}t&d|| j|dYd}~d}~wwxYw| s"t&d|| j|| | }|A||}|*t&d||| j| j*|| | }|Q||}|:|dd\}}t&d||| j||| j||| ||  t|5|| | d{V}dddn #1swxYwY|r:| | | <||||<||||<| dz } t&d| j|n=t&d| j||| | d{Vi#t$$rI}t&d| j|||| | d{VYd}~d}~wwxYw| S)z>Create+connect one profile's adapters under its runtime scope.rrNz Profile 'z ' enables z. Enable GATEWAY_ALLOW_ALL_USERS or the platform allow-all flag for that profile, or change dm_policy/group_policy away from 'open'.c3lK|]/\}}|j t|j|j&|jV0dSr^)r_platform_binds_portrr)rbrrs r>rdz.5s^( ( )/&( %X^_5JKK ( N( ( ( ( ( ( rMrz#' enables port-binding platform(s) z, but gateway.multiplex_profiles is on. The default profile owns the single shared HTTP listener and serves every profile through the /p/z:/ URL prefix. Remove these platform entries from profile 'z='s config.yaml or configure them only on the default profile.rFz9[MULTIPLEX] Profile '%s': _create_adapter('%s') raised %sTrzQ[MULTIPLEX] Profile '%s': skipping platform '%s' - adapter creation returned NoneuProfile '%s' and '%s' both configure %s with the same credential — refusing to start the duplicate (one credential cannot be consumed twice). Give each profile its own %s credential.uProfile '%s' and '%s' both configure %s sidecars on %s:%s — refusing to start the duplicate listener. Set platforms.%s.extra.sidecar_port to a distinct port for profile '%s'.r(u✓ %s connected (profile: %s)u&✗ %s failed to connect (profile: %s)u✗ %s error (profile: %s): %s)rrrrrr rErrfrr} setdefaultrrVrzrr r r2r3rPrrrrvr_configure_profile_adapterr0rzr)rr rr r profile_cfg violationport_binding_platformsjoined profile_maprrrr1rrownerrbindportr/s r>r z)GatewayRunner._start_one_profile_adapters4s 766666 #L 1 1 H H--//K:;GGI H H H H H H H H H H H H H H H  &LI "(( ( -8-B-H-H-J-J( ( ( " "  " YY566F1BLBBBB+7BB9E BBB ,77 bII  )4)>)D)D)F)F[ G[ G %Ho"*   %95AA .. +L99NN"228_MMGNNNNNNNNNNNNNNN    O N!   g N  $==hPP + $455$LL1|X^X^ !99(GLLN) N33$!/!4JD$LL,$  $     + +G\8 L L L G+L99$($N$N%%G K,3K)'34@ 01%12>/NIKK @(.R^____NN#KX^]ijjj77JJJJJJJJJ G G G =x~|]^___33GXFFFFFFFFFFFFFF Gs>AA.E,=E  E, E$ $E,'E$ (E,, F$6$FF$%M#4K M#K! !M#$K! %AN11N6c|||||||||j||jt|dd}t|r||j | |j | ||||j|_dS)zDInstall the profile-scoped handlers shared by startup and reconnect.r` N)r )r _make_profile_message_handlerr !_make_profile_fatal_error_handlerr rr r rVr/rr rfr r r&)rr1r rr s r>r z(GatewayRunner._configure_profile_adaptery5s ##D$F$F|$T$TUUU''  2 2< J J    !!$"4555(()QRRR)?FF M " " 7 M$5 6 6 6%%d&LMMM''  ) )( ) N N   #'"6rMcKd}tj} |jr+d} ddlm}ddlm}||}t|5|j |} | | j s ddd|j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS||| }|t"d|j| ddd|j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS|||||||dd{V} dddn #1swxYwY| r|jr |j|i}||vr|||<||t"d|j| |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS|||d{V |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS| r|||d{V |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS|||d{Vt7|d d rt7|d ds |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdSn~#tj$r ||||d{Vt:$rD||||d{Vt"d |j|d YnwxYw|js |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS|dz }t?|}t"d|j||tj |d{V|j+|j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS#|j } t| tr| |} t| tr| |nd} t| tjr| |urFt| tr0| |d| s| |dwwwwwxYw)zDReconnect a retryable secondary adapter under its own profile scope.rNget_profile_dirr zASecondary %s reconnect skipped: adapter unavailable (profile: %s)Tr'u ✓ %s reconnected (profile: %s)r Frz3Secondary %s reconnect attempt failed (profile: %s)rr(z1Secondary %s reconnect retry in %ds (profile: %s))!rr rr?r rrrrErvrr4rtrurU rUr r3rrr r-r}r r rzrrVrr2r4rr)rr rrr r1r rrprofile_configr5rV rr/r r s r> _run_secondary_profile_reconnectz.GatewayRunner._run_secondary_profile_reconnect5s^ +-- Z <-O -ACCCCCCBBBBBB#2?<#@#@L/ ==)<)<)>)>)H)L)LX)V)V)19O1"T4G'4(( <")++l";";8B?TX8Y8Yc**8444_c!$ 55<9M9M!/488<'++Hd;;;.<#KK d;;;;; < <<<:N9M<<[#'"6"6x"P"P"?"NN c ( , #T4G'4(( <")++l";";8B?TX8Y8Yc**8444_c!$ 55<9M9M!/488<'++Hd;;;.<#KK d;;;;; < <<<:N9M<Z&%d&A8\!d \!! d4AdCgc|jr|jsdS|j}t|ts i}||_||i}||vrdSt j|||d|d|j }|||<t|dd}t|tst}||_ | |||jdS)zDSchedule one runner-owned reconnect without sharing primary secrets.Nzsecondary-reconnect:r)rr)rrr4rtrur rrr rrVrrrrr)rr rr1r5rV rbackground_taskss r>%_schedule_secondary_profile_reconnectz3GatewayRunner._schedule_secondary_profile_reconnect5s} G$A  F0'4(( 5G-4D *!,,\2>>  & & F"  1 1, I IG GGx~GG   %)!"4)_handlerzAGatewayRunner._make_profile_fatal_error_handler.._handler6s8::<SZ[[ [ [ [ [ [ [ [ [ [rMrG)rr rr s``` r>r z/GatewayRunner._make_profile_fatal_error_handler 6sM \$7 \D \ \ \ \ \ \ \ \rMcKt|di|}t|tr|||ur#td|j|dS||d|||d{V|j sdS| |||t d|j||j pddS)amRemove a failed multiplexed adapter without touching the primary slot. Secondary adapters are owned by ``_profile_adapters`` rather than ``self.adapters``. The primary-only fatal handler intentionally ignores them; without this route, a fatal secondary Discord client stayed live forever after its liveness sampler stopped. r}zBIgnoring stale fatal error from secondary %s adapter (profile: %s)Nz6Fatal %s adapter error for multiplexed profile %s (%s)r) rVrvrtrur3r4rrUrrr rPr)rr rr1r s r>r z1GatewayRunner._handle_profile_adapter_fatal_error6sd$7<<@@NN +t,,  0I0IQX0X0X LLT    F$'''++GX>>>>>>>>>}  F 22<7SSS D N   $ 1      rMcdddlm} |n#t$rdYnwxYwfd}|S)atReturn a message handler that stamps source.profile then delegates. Auth runs inside ``_handle_message`` *before* the agent-turn scope is installed. For secondary profiles under multiplex, wrap the whole handler in ``_profile_runtime_scope`` so allowlists/tokens from that profile's ``.env`` are visible to ``get_secret`` / authz. rr Nc<K t|dd|jjs |j_n#t$rYnwxYwBt 5|d{VcdddS#1swxYwY|d{VS)Nr()rVr(rr2rr )rrr rs r>r z=GatewayRunner._make_profile_message_handler.._handlerE6s  5(D11=elFZ=+7EL(    '+L99==!%!5!5e!r z+GatewayRunner._make_profile_message_handler66s} 877777 *?<88LL   LLL  5 5 5 5 5 5 5s  &&cLttfd}|S)z@Scope a multiplexed default-profile message from ingress onward.cKt5|d{VcdddS#1swxYwYdSr^)rr )rrrs r>r zEGatewayRunner._make_default_profile_message_handler.._handlerV6s' 55 9 9!11%88888888 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9s ;??)rrx)rr rs` @r>%_make_default_profile_message_handlerz3GatewayRunner._make_default_profile_message_handlerR6s<O--..  9 9 9 9 9 9rMcdt|jddr|S|jS)z:Return the correctly scoped handler for a primary adapter.rF)rVrzr r rNs r>r z&GatewayRunner._primary_message_handler\6s5 4; 4e < < @==?? ?##rMcFt|}|dS||fS)z?Return the exclusive credential resource claimed by an adapter.N)r r )rr1 fingerprints r>rz'GatewayRunner._adapter_credential_claimb6s- $CCGLL  4+&&rMcpt|dddkrdSt|dd}t|dd}t|tr|sdS t |}n#t t f$rYdSwxYwdd||fS)aReturn the exclusive listener resource claimed by an adapter. Photon sidecars are per-profile processes. Even when two profiles use different project credentials, their sidecars cannot share a bind and port. Represent that endpoint as a claim so multiplex startup rejects the later adapter before either ``connect()`` or ``disconnect()`` can disturb the first profile. rNphoton _sidecar_bind _sidecar_portlistener)rVrtrwrxrhrwrjry)rr1r r s r>rz%GatewayRunner._adapter_listener_claiml6s 8Wd + +x 7 74w66w66$$$ DJJLL 4 t99DD:&   44 Hdjjll&8&8&:&:DAAs&A66B  B cd}dD]R}t||d}t|tr*|r|}nS|sht|dd}|UdD]R}t||d}t|tr*|r|}nS|s_t|dd}t|dd}t|tr(|r|}|sdSddl}|d|zddd S) asReturn a stable, log-safe fingerprint of an adapter's credential. Used only to detect two profiles claiming the same platform credential. Returns a salted hash (never the credential itself) of the adapter's primary credential, or None when no credential is discoverable (in which case we don't attempt conflict detection for it). N)r bot_token_token api_token _bot_token_project_secretrz)rr rrz hermes-mux:rQ)rVrtrwrxhashlibsha256encode hexdigest)r1rattrvalrrzr s r>r z-GatewayRunner._adapter_credential_fingerprint6s    D'4..C#s##     '8T22C2D!#tT22C!#s++  #  $Wh55F&'400C#s## $  $  4~~}u4<Yuanbao: websockets not installed. Run: pip install websockets)9rrtrrur rzr<rVr rN is_registeredrcreate_adaptergateway_runnerr3rPr2r4rWHATSAPP_CLOUD gateway.platforms.whatsapp_cloudr r rSIGNALgateway.platforms.signalr r r WEIXINgateway.platforms.weixinr r rgateway.platforms.api_serverr r rgateway.platforms.webhookr r r!gateway.platforms.msgraph_webhookr r BLUEBUBBLESgateway.platforms.bluebubblesr r QQBOTgateway.platforms.qqbotr r YUANBAOgateway.platforms.yuanbaor r )rrrzrN r1rr r r r r r r r r r r r r r r r r r r s r>r zGatewayRunner._create_adapter6sD 67 # #  6<(F(F  L # #) 3    L # #* %?GG     \ C C C C C C ..x~>> +::8>6RR&.2G*"N 6N t' ( \ \ \ LLGYZ [ [ [ [ [ [ [ [ \ x. . .        5466 Vt''// /  ( (           -,.. EFFFt))&11 YZZZt =(( (  ( ( Y Y Y Y Y Y Y Y,,.. KLLLt =(( ( , , , d d d d d d d d0022 BCCCt&&v..G%)G "N ) ) ) \ \ \ \ \ \ \ \--// ?@@@t$nV,,G%)G "N 1 1 1        6577 GHHHt((00 0 - - - h h h h h h h h1133  BCCCt%%f-- -  ' ' P P P P P P P P((** jkkkt9V$$ $ ) ) ) V V V V V V V V' _```t!>&)) )tsAC) C)) D3!DDc  ddtdttdttdtffd }|S)u@Build a platform-bound auth callback for adapter use. Adapters that fetch external context (e.g. Slack ``conversations.replies``) call this through ``BasePlatformAdapter._is_sender_authorized`` to mark non-allowlisted senders as unverified in LLM context, mitigating indirect prompt injection from third parties in shared threads/channels. The returned callback delegates to :meth:`_is_user_authorized` so the full auth chain — platform allowlists, group allowlists, pairing store, allow-all flags — stays the single source of truth. ``profile_name`` binds the callback to the secondary adapter's own multiplex profile, so its ``SessionSource`` resolves that profile's secret scope instead of falling back to the active profile. Nrrr2r-cf|sdSt|pd|pd|}|S)NFrr)rr2rrr)r[r )rrr2r(rr rs r>checkz5GatewayRunner._make_adapter_auth_check..checkK7sT  u"! 2#.w$ F++F33 3rMrT)rwr r)rrr r s``` r>r z&GatewayRunner._make_adapter_auth_check67sm.(,%) 4 4 4} 4c] 4  4 4 4 4 4 4 4 4 rMr4c $K||}|sdSt|dd}|rjt|ddtjkrKt |t|ddr,t dt|dddSd}|r*t|dr||j }| |}|dkrt|d drz | |j |j || d{V}t|d d rdSn<#t$r/t d t|dddYnwxYw||j || d{VdS)zIDeliver a setup/operational notice using platform-specific privacy rules.Nrzrr2z@Skipping Slack platform notice for configured ignored channel %spublicget_notice_deliveryprivaterr.r/Fz7[%s] send_private_notice failed, falling back to publicrTr)r@rVrrrr3rzrr rr send_private_noticer2rr2r4r0)rr(r4r1rznotice_deliveryrrs r>r/z&GatewayRunner._deliver_platform_noticea7s**622  Fx..   D11X^CC)&'&)T2R2RSSD KKR 400    F"  Jgf&;<< J$88IIO33F;; i ' 'GFIt,L,L ' &::NN% ;   69e44F    MFJ44! ll6>7XlFFFFFFFFFFFs4:D116E*)E*r\pinned_session_idcKtt|j}|tddSd} ||d{V}n-#t $r td|dYnwxYw|td|dS|}d}|dr|d d kr1td ||d dSd} | |d{V}n/#t $r"td |dd}YnwxYw|r||krtd |dS ||d{V}n#t $rd}YnwxYw||dr"td||dnddS|j ||hv}|s ||j d{V} | N| dr9| d d kr | |j d{Vnd} n#t $rd} YnwxYw| |k}|s$td|||j dS||j kr|S|j } |r(|j |j | |d{V} n&|j |j |d{V} | #td|j |dStd|| |j | S)aResolve an async completion to its verified owning gateway session. A compression rotation ends the physical parent row while continuing the same logical conversation in a child. Follow that lineage, but never let a late completion override an unrelated /new or restored route. Unknown ownership remains fail-closed; the result is still available in the delegation records. Nz]Async-delegation completion has no session database; dropping injection (#55578 fail-closed).z,Async-delegation parent lookup failed for %sTrzeAsync-delegation completion has unknown spawning session %s; dropping injection (#55578 fail-closed).Fended_at end_reasonrmzAsync-delegation completion pinned to ended session %s (end_reason=%r); dropping injection instead of resurrecting it (#55578 fail-closed).z5Async-delegation compression-tip lookup failed for %szgAsync-delegation completion pinned to compressed session %s without a continuation; dropping injection.zGAsync-delegation compression continuation %s is %s; dropping injection.rendedzoAsync-delegation completion for compression lineage %s -> %s does not own current route %s; dropping injection.zcAsync-delegation completion could not bind routing key %s to owning session %s; dropping injection.z\Pinned async-delegation completion to owning session %s (was %s) for routing key %s (#57498))rr rRr3rrr2r4rvget_compression_tiprNr8 advance_compression_sessionr+r rz) rr\r rX pinned_rowtarget_session_idfollows_compressiontip_rowroute_owns_lineage route_row route_tipprior_session_idr s r>!_resolve_async_delegation_sessionz/GatewayRunner._resolve_async_delegation_session7s#t/00   NN;   4  )556GHHHHHHHHJJ    LL>!          NN;!    4-# >>* % %J ~~l++}<<,&NN<00 t"&  )*4*H*H%++%%%%%%!! ) ) ) K%! %)!!!  )% (9=N(N(NB% t  * 6 67H I IIIIIII    '++j"9"9*%!(IIg  t!.!9!!>" & D %&0&<&<]=U&V&V V V V V V VI%0%MM*551%MM,77=HH)<<]=UVVVVVVVVV" I!%%% $III%%.2C%C"% I%%!, t  8 8 8 (3  !5QQ) !HH "5DD)!H   NN9)!     4  3    %    sHA'BB D)))EE>F F)(F)3A2I&& I54I5u=Agent is running — wait or /stop first, then switch models.u>Agent is running — wait or /stop first, then change runtime.u8Agent is running — wait or /stop first, then run /moa.)r codex-runtimemoa_BUSY_REJECT_TEXT quick_keyc K|j}t|dd}t|dd}|rs|j|j|j|j|j|j|jd |}|||||d{VS|j |} | | S|dvrid|j d|j d |j d |jd |jd |jd |jd|jd|jd|jd|jd|jd|jd|jd|jd|jd|j|j|jd |} | | |d{VSt<d||d|dS)u`Dispatch a recognized slash command while an agent is running. Resolution order: 1. ``busy_handler`` — special mid-run variant (e.g. /goal's control-verb whitelist, /queue's FIFO enqueue, /model's custom reject text). 2. ``busy_policy == "dispatch"`` — the command's normal handler. 3. Catch-all busy-reject text. Rejecting is required rather than falling through to interrupt + discard: commands like /model, /reasoning, /voice, /insights, /title, /resume, /retry, /undo, /compress, /usage, /reload-mcp, /sethome, /reset (all registered as Discord slash commands) would interrupt the agent AND get silently discarded by the slash-command safety net, producing a zero-char response. See #5057, #6252, #10370. busy_policyr busy_handlerN)rrr rr egressgoal)dispatchinterrupt_then_dispatchstatusrr r r pauseagents backgroundkanbansubgoal heartbeatyolor'footerhelpcommandsr)rIversionuMbusy_policy=%s for /%s has no mid-run handler — falling back to busy-rejectu⏳ Agent is running — `/zE` can't run mid-turn. Wait for the current response or `/stop` first.) rrV_busy_start_command_busy_stop_command_busy_new_command_busy_queue_command_busy_steer_command_busy_egress_command_busy_goal_commandrvr, _handle_status_command_handle_context_command_handle_restart_commandr r _handle_pause_command_handle_agents_command_handle_background_command_handle_kanban_command_handle_subgoal_command_handle_heartbeat_command_handle_yolo_command_handle_verbose_command_handle_footer_command_handle_help_command_handle_commands_command_handle_profile_command_handle_update_command_handle_version_commandr3r) rrcmd_defr- r(rpolicy handler_keyspecial reject_textplains r>_dispatch_busy_slash_commandz*GatewayRunner._dispatch_busy_slash_command58ss$|-::g~t<<  #1/-113/c+ "$WUIv>>>>>>>>>044[AAK&"" < < <$5474747  1  3 $5d=$547T;147$51 D9!"47#$57'(c$ii) * "U5\\))))))) NN./5t    I$ I I I rMcKddlm}|pd}|dvr|rdSdS|}|'|s%|d}|rd |d nd}d |d S||pd |rd |d nd}d|dS)u\`/pause [reason]` engages the global emergency stop; `/pause off` (aliases: resume/stop) lifts it. This is the in-band resume path for messaging-only operators — the estop gate above deliberately lets recognized slash commands through while paused so a user without host-shell access is never locked out. r)estopr>rrresume disengageu.▶️ Resumed — new work is accepted again.zHermes wasn't paused.Nrz (reason: ru⏸️ Hermes is already pausedz. Use `/pause off` to resume.ru ⏸️ Pausedzh. New cron/kanban/gateway work is on hold; in-flight work finishes normally. Use `/pause off` to resume.) rra get_command_argsrxryrc get_statervengage)rrra rr;rrs r>rK z#GatewayRunner._handle_pause_command8s$ &&((.B5577 ::<<A A A   HGG**!!  T YYx((F/5=+&++++2F.&...   DLD ))))-5%d%%%%2 LF L L L rMc@Ktd|dS)Nz3Ignoring /start platform ping for active session %srr3rzrrr- r(s r>rA z!GatewayRunner._busy_start_command8s"  I9UUUrrMc&Kddlm}|S)Nrformat_status_text)hermes_cli.proxy_clirl )rrr- r(rl s r>rF z"GatewayRunner._busy_egress_command8s';;;;;;!!###rMcK|||tdd{Vtd|t t dS)N stop_commandinterrupt_reasoninvalidation_reasonu@STOP for session %s — agent interrupted, session lock releasedzgateway.stop.stopped)_interrupt_and_clear_session_INTERRUPT_REASON_STOPr3rzrqrri s r>rB z GatewayRunner._busy_stop_command8s~ //  3 . 0          VXabbba 677888rMcK|||tdd{V||d{VS)N new_commandrp )rs _INTERRUPT_REASON_RESET_handle_reset_commandri s r>rC zGatewayRunner._busy_new_command8sw//  4 - 0         //666666666rMc K|}tt|dd}|s|sdS||}|rt did|d|r|jn tjd|j d|j d|j dtt|dgpgdtt|dgpgd |j d |jd |jd |jd |jd|jd|jd|jd|jd|j}||||||||}|dkrdSd|dS)NrUsage: /queue rrr( raw_messagerjrr5 reply_to_textreply_to_author_idreply_to_author_namereply_to_is_own_message auto_skillrchannel_contextr rgrr(zQueued for the next turn.zQueued for the next turn. (z queued)rN)rd rxrrVr@rrrrsr r(r{ rjrr5 r| r} r~ r r rr r rgr r' ) rrr- r( queued_text has_mediar1r rs r>rD z!GatewayRunner._busy_queue_command8s ,,..4466  d;;<<  ,9 ,++**622  A' [3<RU//+BR||"--  !++   |R @ @ FBGGG ! r!B!B!HbIII%*$=$=$11$)#;#;&+%?%?).(E(E!++ %33!& 5 5 !" //#L&   y, @ @ @!!)T5M5Mf5U5U!VV A::..)rrr(rjrr u9Agent still starting — /steer queued for the next turn.r zSteer failed for session %s: %su⚠️ Steer failed: rrru8⏩ Steer queued — arrives after the next tool call: 'rVzSteer rejected (empty payload).u4No active agent — /steer queued for the next turn.)rd rxrArJrrr@rrrsr r(rjrr r rr r2r3rr7) rrr- r(r _steer_stater r1r acceptedr<rs r>rE z!GatewayRunner._busy_steer_command8s ++--3355  ,++// :: 3?I )//T 3 3 3..v66G E+#!,!1 <$/#(#7$)$9     ""9lGDDDNN  5W]G<< 5 5(..z:: 5 5 5@)SQQQ4s44444444 5 ]$SbS/c*oo6J6JUUPRS\RY\\\\44**622  A'(-| +$3 % 5 L   y, @ @ @EEsC'' D1 DDDcK|pd}|r|dddnd}| p|dvp|dv}|r||d{VSdS)Nrr(r>rrr4r6 rb r5 unwait>gaterBuiAgent is running — use /goal status / pause / clear / wait mid-run, or /stop before setting a new goal.)rd rxryre_handle_goal_command)rrr- r( _goal_arg _goal_verb _is_controls r>rG z GatewayRunner._busy_goal_command%9s ++--3::<<BBDD 4=EY__T1--a002 M .\\ .--   :22599999999 9zzrMc L\Kj} ddlm}|n,#t$rtddYnwxYwt tdd}|syt|dd tj krZttd d t|d d r,t d t|d d d Std dr*|s(tdds d S|s |s4 ddlm}|dtdd }n4#t$r'}td|g}Yd }~nd }~wwxYw|D]}t#|t$s|d} | dkrMt d|d|jr |jjnd|jpdd S| dkrI|d} t#| t.rt1j| j}n | dkrn|rn|j>|s'td|jjd SnՉ|std|j|j|jj|jdkr|j|j d!krZ|jr |jjnd} |} | t!d"| d S| "| |jrd S| #| |j|jpd#} | r|$|}|rdt| d$d }t#|t.r|r |d%krd&|d'nd#}|%|jd(| d)|d*| d'| d+ d {VnS$|}|r!|%|jd,d {V| &| |jd S|sf dd-l'm(}|}n#tR$rd }YnwxYw|?d}d } *}n#t$rd }YnwxYw|r' dd.l+m,}||d u}n#t$rd}YnwxYw|s -|}.|}||j/j0rd}|s1|rd}|sdd/l2m3}|4|rd}|sdd0l5m6}||rd}n#t$rYnwxYw|sMt d1tt|dd d2dt|d d pd|S-|}.|}|>|j/j0r1j7pd#8}*}|d3vrd4}nX|d5vrd6}nQd }|rF dd.l+m,} n#t$rd } YnwxYw| * | |}!|!r|!j9nd }n#t$rd }YnwxYw|rd#}n|}|rttd7z }"ttd8z }# |";d9}$|$<|d:;|$|"|#=d<n7#t|$r*}%td=|%d>|%cYd }%~%Sd }%~%wwxYwd|j/_0t|d?kr|n |d d?d@z}&dA|&dBS|rttd7z }"ttd8z }# |";d9}$|$<d#d:;|$|"|#=d<t dC||n2#t|$r%}%tdD|%Yd }%~%nd }%~%wwxYwd|j/_0d }' ddEl2m@}'|'A|dF}(n#t$rd }(YnwxYw|(|'t B})Cd {V}*|)r%|*s#t dG||(jDd#S|*r|*EdHs|'F||*}+|+rt dI||(jD$|},|,rH |,G|jn,#t$rtdJdYnwxYwd#Sdd/l2m3}-|-4|}.d}/ dd0l5m6}0|0|}/n#t$rd}/YnwxYw|.r|/s̉j7pd#8}1|1HdKI}2*}3d }4|3dLvrdM}4n"|3dNvrdO}4n|3dPvrdQ}4n|2dRvrdM}4n |2dSvrdO}4n|2dTvrdQ}4|44|-J||.dU|4d {V}+|+pd#S|-K|tdVdW}5.|}6|6r |6jMjNnd}7|6y|6jMjOl|7ritjP|7z }8|6jMjO}9tdX}:d#};|9rt|9dYr |9S}<|<dZtdX}:d[|<d\dd]|:d^d_|<d`ddH|<dad};n#t$rYnwxYw|5dkrt|5dbzdcntdX}=|9tuo|5dkr|:|5kp|8|=k}>|>rKtdd||8|:|5|;V|defW|1|rdd.l+m,}?*}@|@r |?|@nd }A|Ar&|Aj9dgkrXd {VS|Ar&|Aj9dhkrYd {VS|@r!|AZ||Aj9}B|B|BS|Ar[|A||d {VSj\tj^krJtdi|$|}|rt|j`|d Sttjbdjdk}C.|}D|Dr |DjMjNnd}E|jtjckrj\tjdkr|Cdkr|ErtjP|Ez |CkrtdltjP|Ez |$|}|r;jedmkrf||nt|j`|dnd S.|}F|Fr |FjMjOnd }G|Gtur*dokr?W|t dp|tdqS$|}|rt|j`|dnd Sjhrnirj|irdrkdsndtkduSjedmkr3tdv|j|d Sjedwkrj7pd#8}Hd}Ij\tjdkryjlsrjmsk|Hrit|GdwrY t |Gn|H}In5#t$r(}Jtdx||Jd}IYd }J~Jnd }J~JwwxYw|Irtdy|d Stdz|j|d So|Gr3t d{|j|d Sp|d {Vr3t d||j|d Sj\tjdkrjlsjmst|Gd}ddurt|Gd~r |Gqj7pd#8rtd|d Sn3#t$r&}Jtd||JYd }J~Jnd }J~JwwxYwtd|j7}Ktdd pg}LBr>r$||j7pd#dd {V\}K}Mn|Ks|Lrt}K|Gt|Kd S*}Nddl+mu}Omv}Pm,}Q|Nr |Q|Nnd }!|!r|!j9n|N}R|Nre|!bt#jwt$rjwdipi}Sntjwdipi}St#|St$r|N|Svr|S|N}T|Tddkr|Tdpd#8}U|Ur|UEdHr|UndH|U}U|UHdH}Vx8}W|Ud'|W8_7|Vr|Vydn|V}N|Nr |Q|Nnd }!|!r|!j9n|N}R|Nr'|Rr%|P|RrZ||R}B|B|BS|Nrg|P|Rr[x8}X|jr |jjnd#|j|R|N|X|Xd}Y jz{d|R|Yd {V}Zn5#t$r(}[td|R|[g}ZYd }[~[nd }[~[wwxYw|ZD]}\t#|\t$st/|\dd#8I}]|]r|]dkri|]dkr8|\d}^t#|^t.r|^r|^cSd|NdcS|]dkr2|\d}^t#|^t.r|^r|^nd cS|]dkrt/|\dd#8HdH}_|_s1t/|\dd#8}`dH|_d'|`8_7*}N|Nr |Q|Nnd }!|!r|!j9n|N}Rn|Rdkr|d {VS|RdkrZtj~j|d {VrSfd}addd|ad {VS|Rdkrd {VS|Rdkrd {VS|Rdkrt d|d#S|Rdkrd {VS|Rd$krd {VS|Rdkrd {VS|RdgkrXd {VS|Rdkrddlm}b|bS|RdhkrYd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdokrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrddlm}cx8}d|drdnd}e $|}|rE|}f|%t/|j|e|fd {Vn,#t$rtddYnwxYw |c|d_7n#t$rYdSwxYw|Rdkrddlm}gx8}h |g|h}in#t$rYdSwxYwd|ivrdnd}e $|}|rE|}f|%t/|j|e|fd {Vn,#t$rtddYnwxYw|i_7|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkr d {V}jt|jdd }k|krt|jdd#pd#}e|er $|}|rE|}f|%t/|j|e|fd {Vn,#t$rtddYnwxYw |k_7n6#t$rt|jdd#pd cYSwxYwt|jdd#pd S|Rdkrd {VS|RdkrfdƄ}ld}mx8}n|nrS tdǐtC|nyd}mn#tDtFf$rd}mYnwxYw|mdkrdnd|mdʝ}odd|o|ld {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|RdmkrCx8}p|psdS |p_7n#t$rYnwxYw|RdwkrCx8}q|qsdS |q_7n#t$rYnwxYw|Rdkrd {VS|Rdkrd {VS|Rdkrd {VS|Rdkrddlm}rm}sddlm}tx8}u|us |rS |t}v|st#|vt$r|vdni}wn#t$r|si}wYnwxYw|wd}x |u_7|}y|yjj_d|xdddd|yj_|d_n#t$rYdSwxYw|Rdkrd {VS|Rdkrd {VSjhrdtkdS|Nrt#jwt$rjwdipi}Sntjwdipi}St#|St$si}S|N|Svr*Z||N}B|B|BS|S|N}T|Tddkr |Tdd#}z|zr ddlm}{|{}|tj|ztjjtjj||d {V}}tj|}dd {V\}~}|~p|8}|rddlm}||}|r|ndS#tj$rYdSt$r}%d|%cYd }%~%Sd }%~%wwxYwd|NdS|Tddkr|Tdpd#8}U|Ur|UEdHr|UndH|U}U|UHdH}Vx8}W|Ud'|W8_7|Vr|Vydn|V}Nn d|NdSd|NdS|Nr ddlm}||Ndd}|r`x8}W||W}tj|r|d {V}|rt/|nd Sn3#t$r&}%td|%Yd }%~%nd }%~%wwxYw|Nrd} ddlm}m}||N}|x8}|jr |jjnd }|||||}|rB|\}}}|_7d}|r1t d|d|n3#t$r&}Jtd|JYd }J~Jnd }J~JwwxYw|Nr!tdds ddlm}m}m}|||N}|>|d d#}|jr |jjnd }|r$|r"dd lm}||| vr d |d |dSx8} ddlm}m}||\}}n#t$r d }g|}}YnwxYw|rH|rFdd lm}|| fd|D}|r d d|d|dS|r,|*||g|||}|r|\}}}|_7nd|NdS||||}|r|_7nft|N}|r|S|Ndd|Ovr9td|N|jr |jjndd|NdSn3#t$r&}%td|%Yd }%~%nd }%~%wwxYw|sKtj~j|d {Vr+|rSd Sjr"|s t d| dS||\}}|t d||S|}| ||jM_t|jM_OtjP|jM_N|} |||d {V}n#t$r}Jt!d||Jj Yd }J~J||d {VW|||dSd }J~JwwxYw d#}t#|t$r&t/|d pd#}nt#|t.r|}|8rU j|d {V}n#t$rd }YnwxYw||||!d {Vn3#t$r&}td"|Yd }~nd }~wwxYw|||d {VW|||S#||d {VW|||wxYw(#a Handle an incoming message from any platform. This is the core message processing pipeline: 1. Check user authorization 2. Check for commands (/new, /reset, etc.) 3. Check for running agent and interrupt if needed 4. Get or create session 5. Build context for agent 6. Run agent conversation 7. Return response r)reset_session_varsz*reset_session_vars failed at handler entryTrr FrNrzr2z9Dropping Slack message from configured ignored channel %sr6r ) invoke_hookpre_gateway_dispatchr)rr9rz*pre_gateway_dispatch invocation failed: %sr? skipz8pre_gateway_dispatch skip: reason=%s platform=%s chat=%srrrewriterrallowz(Ignoring message with no user_id from %sz Unauthorized user: %s (%s) on %srrpairz1Cannot offer pairing code on %s: no pairing storerrrJz-p rz;Hi~ I don't recognize you yet! Here's your pairing code: `z%` Ask the bot owner to run: `hermes zpairing approve rzrqr r >r r r .update_response.update_prompt.jsonz.tmprQrrsz#Failed to write update response: %su/✗ Failed to send response to update process: …u ✓ Sent `z` to the update process.ziRecognized /%s during pending update prompt for %s; cancelled prompt with default and dispatching commandz=Failed to write cancel response for pending update prompt: %srE)include_choice_promptszfGateway retained pending clarify after voice transcription produced no usable text (session=%s, id=%s)r]z=Gateway intercepted clarify text response (session=%s, id=%s)z.Failed to resume typing after clarify responsez!/>r rqr r once>r rememberr >r r r nevermindr> approve oncer r >r r >r rr confirm_idrr rK r>r?z | last_activity=r@ r .0fzs ago) | iteration=r rrGi zWEvicting stale _running_agents entry for %s (age: %.0fs, idle: %.0fs, timeout: %.0fs)%sstale_running_agent_evictionrr5 ruFPRIORITY photo follow-up for session %s — queueing without interrupt&HERMES_TELEGRAM_FOLLOWUP_GRACE_SECONDSz3.0uVTelegram follow-up arrived %.2fs after run start for %s — queueing without interruptrr ru7HARD STOP (pending) for session %s — sentinel cleareduE⚡ Force-stopped. The agent was still starting — session unlocked.r r r r z'PRIORITY queue follow-up for session %sr z(PRIORITY steer failed for session %s: %szPRIORITY steer for session %sz/PRIORITY steer-fallback-to-queue for session %szjPRIORITY interrupt demoted to queue for session %s because the running agent has active subagents (#30170)zdPRIORITY interrupt demoted to queue for session %s because context compression is in flight (#56391)r r z PRIORITY redirect for session %sz+PRIORITY redirect failed for session %s: %sz!PRIORITY interrupt for session %srzVoice-priority-interruptr )GATEWAY_KNOWN_COMMANDSis_gateway_known_commandr quick_commandsraliasr)rrr raw_commandrra zcommand:z/command:%s hook dispatch failed (non-fatal): %sdecisionr r$z Command `/z` was blocked by a hook.handledr_ra r6 r c>Kd{VSr^)rx rrsr> _do_resetz0GatewayRunner._handle_message.._do_resetd<s-!77>>>>>>>>>rMz/newzJThis starts a fresh session and discards the current conversation history.)rrrdetailexecutetopicr> rz,Ignoring /start platform ping for session %sr? whoamir1 rk r7 r rmemoryskillslearn)build_learn_promptu+Learning a skill from what you described…u*Learning a skill from this conversation…r.zlearn ack send failedu,Could not start /learn — please try again.init)build_init_prompt_for_cwd)ru+Could not start /init — please try again.zUPDATE the existing AGENTS.mdu)Updating AGENTS.md from a project scan…u+Generating AGENTS.md from a project scan…zinit ack send failedrw r'r= r< rerr* personalityr9 suggestions blueprint agent_seedzblueprint ack send failedretryundoc>Kd{VSr^)_handle_undo_commandr sr>_do_undoz/GatewayRunner._handle_message.._do_undo=s-!66u=========rMr(z;This removes the last user/assistant exchange from history.zThis removes the last z user turns from history.z/undosethomecompressusagetopupinsightsz reload-mcpz reload-skillsbundlesr rIr@ r4rrb rbranchrollbackdiffr8 rz zJUsage: /steer (no agent is running; sending as a normal message)r2 r; refiner+ ) moa_usagenormalize_moa_configrcdefault_presetz moa://localzmoa-virtual-providerchat_completions)rrrrrzFailed to prepare MoA turn.r: rz) and is not accepting new work right now.execrr r rrrzCommand returned no output.zQuick command timed out (30s).zQuick command error: zQuick command '/z' has no command defined.z' has no target defined.z4' has unsupported type (supported: 'exec', 'alias').)get_plugin_command_handlerrKrWz"Plugin command dispatch failed: %s)build_bundle_invocation_messageresolve_bundle_command_key)r'rz$Bundle %s skipped missing skills: %srzBundle dispatch failed: %s_bundle_handled)get_skill_commandsbuild_skill_invocation_messageresolve_skill_command_keyr)get_disabled_skill_namesrrdz** skill is disabled for z(. Enable it with: `hermes skills config`)&build_stacked_skill_invocation_messagesplit_stacked_skill_commandscg|]X}|iddv.|iddYS)rrrr)rbr_plat_disabled skill_cmdss r>rz1GatewayRunner._handle_message.._>sj+++ !)~~a4488DDVV'NN1b1155fbAAVVVrMz8** skill(s) in this stacked invocation are disabled for z*. Enable them with: `hermes skills config`r'z#Failed to load stacked skills for /r uOUnrecognized slash command /%s from %s — replying with unknown-command noticerzUnknown command `/zl`. Type /commands to see what's available, or resend without the leading slash to send as a regular message.z*Skill command check failed (non-fatal): %su;Refusing new turn for session %s — external drain active.u⏳ This agent is draining for a maintenance action and isn't accepting new turns right now. It'll be back in a moment — please resend shortly.z@Rejecting new active session %s: max_concurrent_sessions reachedzRejecting turn for routing key %s on session %s after turn-lease timeout; transcript load was not started and the user must resendu⏳ Another turn is still running on this session. To protect the transcript, this message was not processed. Wait for the active turn to finish, then resend it.r)r\r(rz!goal continuation hook failed: %s)r(gateway.session_contextr r2r3r4rrVrrrrzr r rR r rrtrurvrrr2rwrirlrr r)r_get_unauthorized_dm_behaviorr_pairing_store_forrP_is_rate_limited generate_coder@r0_record_rate_limit agent.estopr r\ get_commandr`r rArAr0update_prompt_pendingrKrr get_pendingrr rrxrrl with_suffixrrurr7rFget_pending_for_sessionr _prepare_clarify_reply_textrHr!!resolve_text_response_for_sessionresume_typing_for_chatr#ryrclear_if_stalerrJr rrUrirr>rCr"_invalidate_session_run_generationr rH rI _check_slash_accessr_ rrsrrwr<rrrr r%r rqr*r r r rrr r r r r rr$r r rzrd rer emit_collectrK rrrKrV _maybe_confirm_destructive_slash_handle_topic_commandrT rU rV _handle_whoami_commandrm rl rL _handle_platform_commandrJ _handle_stop_command_handle_reasoning_command_handle_memory_command_handle_skills_commandagent.learn_promptr r hermes_cli.init_commandr _handle_fast_commandrR rS rQ _handle_approvals_command_handle_model_command_handle_codex_runtime_command_handle_personality_commandrN _handle_suggestions_command_handle_blueprint_command_handle_retry_commandrhrj IndexError_handle_set_home_command_handle_compress_command_handle_usage_command_handle_topup_command_handle_insights_command_handle_reload_mcp_command_handle_reload_skills_command_handle_bundles_commandr r rW rX _handle_debug_command_handle_title_command_handle_resume_command_handle_sessions_command_handle_branch_command_handle_rollback_command_handle_diff_commandrM r rP _handle_refine_commandhermes_cli.moa_configr r rrdr/rmrn_moa_restore_overrider _moa_disable_after_turnrO _handle_voice_commandr r create_subprocess_shellrrrrrrrr,r r r agent.skill_bundlesr r rflocalsagent.skill_commandsr r r rgr r r rqrRrTr+r leaser= _begin_session_run_generation_handle_message_with_agentrhrN_restore_moa_one_shot(_restore_pending_one_turn_model_override_clear_durable_active_turn_release_turn_leaser8 r _post_turn_goal_continuation)rrr(r is_internal _invoke_hook _hook_results _hook_exc_result_action _new_textr_rcoder1 store_profile profile_arg_estop_paused_reply_paused_notice _estop_allow _estop_cmd_resolve_estop_cmd _estop_key _estop_state_estop_confirm_mod_estop_has_approval _quick_key _up_staterxrr _recognized_cmd_resolve_update_cmd_cmd_def response_path prompt_pathtmprlabelrU_pending_clarify_clarify_has_audio_raw_clarify_reply _resolved_clarify_adapter_slash_confirm_mod_pending_confirm_tool_approval_liver _raw_reply _norm_reply _cmd_reply_confirm_choice_raw_stale_timeout _quick_state _stale_ts _stale_age _stale_agent _stale_idle _stale_detail_sa _wall_ttl _should_evict_resolve_cmd_inner_evt_cmd_cmd_def_inner_denied_telegram_followup_grace _grace_state _started_at _ra_stater r r r<r r rKrr r _resolve_cmd canonicalr qcmdrtarget_command user_argsra hook_ctx hook_results _hook_err hook_resultr r$rv new_argsr rl r _learn_req_ack _ack_metar _init_notes _init_prompt_blueprint_result_blueprint_seedr _undo_n _undo_raw _undo_detail queue_payload steer_payloadr r rd moa_payloadrmoa_cfgpreset _moa_stateexec_cmdr sanitized_envr!rrrrr plugin_handlerrr r r bundle_keyuser_instruction _bundle_plat bundle_resultr_loadedmissingr r r cmd_key _skill_namer# _get_plat_disabled_build_stackedr extra_keysstacked_instruction_disabled_extrastacked_result_missing _unavail_msg_active_session_lease_limit_message _claim_state_run_generation _agent_result _final_textr\ _goal_excr r s`` @@r>r zGatewayRunner._handle_message:9s? V B B B B B B    V V V LLEPTL U U U U U V 75*e<<==   D11X^CC)h--wvy$/O/OD KKK 400   4 D8% @ @  E#CUKK   - -e 4 4 44 4  1 1 3 3 3#  #LLLLLL , * #*$"F"F!!!  # # #KYWWW "  #)  !'400!++h//f$$KKR H--17O--i3)   44i'' ' F 3 3I!)S11. + 3E J J J!&Eg%%E& D   ^ #++F33  GI^___t ))&118  NN=v~vO_agapav w w w D((66O"N7  :@ W 5 5i $ 7 7 ? ?  (LLK% 4!11-PP 4$22!6>63C3IrT"66v>>G(/ y$(O(O  *-==$ -$!. : :3-2222"$ $&ll"N7:>77(377 - 7704 777#66v>>G%ll"N6 "44]FNSSS4$5 * &KKKKKK!4!4!6!6 & & &!% &)$ ! &!&!2!2!4!4JJ &&&!%JJJ&--(:'9*'E'ET'Q $---', -#%)%A%A&%I%I '+'?'? 'K'K (4 , 7 M5,0L+00H0H0T0T0,0L+4QQQQQQ1==jII4/3 +4 32:>>4/3 $#*KK\ D A A7IVV 488EI *)11&99 ,,Z88  Y%9%O :#**,,C##%%C((( # && # "& 33^^^^^^^$333.2+++3*63':':3'?'?H?G.QhmmTOO(333.2OOO3"($&MM$'M D ,/A A *-BB Q'33F;;CNN=7NCCCKK ...&&$&7777QQQNN#H!LLLPQPPPPPPPPQ>C $:),]););r)A)A }UXVXUXGY\aGaCECCCC C ,/A A *-BB '33F;;CNN2N888KK ...&&$&777KKP'"  NNW >C $:  $ = = = = = =+CC4 D     $ $ $#    $  'L,D!%d&E&Ee&L&L!M!M '+'G'G'N'N!N!N!N!N!N!N ! *<  B$/  r " *<*G*G*L*L (JJ 2 KKW"$4$?(,'?'?'G'G$',CCFNSSSS("LL P)-)2 >=====-99*EE# ( < < < < < <"7"7 "C"C   ( ( ("'    (  :$7 :**1133J %++D117799K**,,J"O@@@"(555"*DDD"* CCC"( <<<"* ==="**"4"<"< 0 4 4\ B BO## !B&  - -j 9 9 9((>EE// ;; 4@GL%00a  # (9(?(KPY(Ky0J',2L  ,,KM  6L M M  &;;==C"%''*BE%LL"Q"QKeCGG4H),T,Tee'4ee'*ww/?'C'CeeFIggN^`aFbFbee"M !D ?QST>T>T.3T:::Z_`eZfZfI$;;'!+Q ?Q0Q.!I-  >B K&  779811*===  # #J / /H  R Q Q Q Q Q((**H=EO//9994N @."5"A"A!88????????? A."5"B"B!99%@@@@@@@@@ #N6226>;NOO&"N  !>>>:v![%666 egqrrr226::^/0I:W\]]]t', BEJJ(( $ 33J??L:FM,+66AK8#444&+*:::,q001Y[[;.3KKK lIKK+- 226:: ,77**:ugFFFF3#5&!'+  t00<>  N 44ZGGGt<$& $ H "%)Z%<%<*y**H&&        " " " Ey "  " ,   !+t44{z2>>??EEGGMMOO8w#6#6v%%)ooi88G!'3//'G'&IIIIIIIy(()ooi88G&0#&>&>T7T77PTTTTy(("%#;;##eggffSkk '! ";??:r#B#BCCIIKKH!=[!=!=8!=!=!C!C!E!EEJ#//11G8?I||G444TH19 F wIE)   33E:::::::: :   &t'I6RRRRRRRR ?<<>>> ? ? ? ? ? ?>>,"?            33E:::::::: :   22599999999 9    KKF S S S2  " "66u======== =  ! !55e<<<<<<<< <  44U;;;;;;;; ;  44U;;;;;;;; ;  ? ? ? ? ? ?%%'' '  ! !55e<<<<<<<< <  44U;;;;;;;; ;  " "66u======== =  ! !55e<<<<<<<< <   22599999999 9  # #77>>>>>>>> >  44U;;;;;;;; ;  44U;;;;;;;; ;    > = = = = =//117799JB==A   E226::V $ @ @ H HI!,,s6>':':D9,UUUUUUUUU E E E 4t DDDDD E F// ;;  F F FEEE F    J I I I I I002288::K E88{KKK  E E EDDD E3lBB<;B   D226::V $ @ @ H HI!,,s6>':':D9,UUUUUUUUU D D D 3d CCCCC D%EJ   22599999999 9  ! !55e<<<<<<<< <  44U;;;;;;;; ;   22599999999 9  # #77>>>>>>>> >   33E:::::::: :  ' ';;EBBBBBBBB B  % %99%@@@@@@@@ @  44U;;;;;;;; ;  % %99%@@@@@@@@ @  # #&*&D&DU&K&K K K K K K K %&7tLLO F0&"==CQQ"&":":6"B"B"^(,(H(H(P(PI"),,s6>/B/BDS\,"]"]]]]]]]]$QQQ %@4 PPPPPQJ!0EJJ JJJ"#4fbAAITIIIJ0&"==EE   33E:::::::: :    > > > > > >G..006688I  !!S):):1)=%>%>??GG"J/   GGG a<<NMPgPPP  >># ?   ! !66u======== =  " "66u======== =   33E:::::::: :   33E:::::::: :  " "66u======== =  $ $88???????? ?  ' ';;EBBBBBBBB B  ! !55e<<<<<<<< <  ! !55e<<<<<<<< <   22599999999 9  44U;;;;;;;; ;  ! !55e<<<<<<<< <   33E:::::::: :   33E:::::::: :  44U;;;;;;;; ;  " "66u======== =  44U;;;;;;;; ;  " "66u======== =   22599999999 9  $ $88???????? ?   !2244::<>>>>>>> >  44U;;;;;;;; ;             6 5 5 5 5 5002288::K # y{{" 3!kmm..CQUAVAV/^swwu~~~\^__ 3 3 3..r22 3-.F 5( !00<< .8.E.T+ %# -5 2 :: '6((44404-- 5 5 5444 5  ! !55e<<<<<<<< <   33E:::::::: : > mlT%?%?%A%Alll l ; l$+t,, R!%1A2!F!F!L"!(6F!K!K!Qrnd33 $!#.((2267CC&"N%g.88F##v--#xx 266HU?VUUUUU,@,@,B,BM)0)H ('.'9'>'.'9'>$1 ***$$$$$$D 4;3CDDTDTDVDV`b3c3c3c-c-c-c-c-c-cNFF&,&6%>%>%@%@%F%F%H%HF%G N N N N N N)>)>v)F)F-3#V669VV&3DDD#C#C#C(???#>1#>#>>>>>>>? U'TTTTXXf%%00"hhx006B==??FT+1+<+ > @ @I+^I66F*622.'-*0:3v;;;d: ;  H H HCQGGGGGGGG H ! B$O B87@@ )','='='?'?'E'E'G'G$ =CO#U6?#8#8QUL$C$C"$4j!-%%%M%0=-Wg%( *.""KK F *DIIg,>,>  B B B;SAAAAAAAA B j N688<<(95AAj Ni N 0/11 33G<<& #-W"5"9"9&""E"EK5;_NFO11$Edddddd&*<*N$7 O"eeddddd););U)K)K)K+++++%/+++ +!L?)C)C!L!LGL!L!L!L "-n&@)7$2z2/$.*** *T5C2C(),EJJ$T#S#S#SS<<#%5z-),EJ $>@@@4  & {  KKM    )  150O0O  1 1 -~  % KKR   " !**:66 ,&;L  #"9 '+y{{ $ ##%%%<BnnBv0n Bqn(#Bqo Bv0qBqqBv0q A(Bt r5 BssBt s Bs%s"Bt s$Bs%s%$Bt t Bv0t Bt:tBt5t0Bv0t5Bt:t:Bv0v0A3Bx#ct|ddsdS t|dd}|||j_||dS#t $rYdSwxYw)aRevert a ``/moa `` one-shot model override after its turn. Called from the ``finally`` of the message-handling path so the revert fires whether the turn succeeded, raised, or was interrupted. A no-op unless ``event._moa_disable_after_turn`` is set. ``_moa_restore_override`` carries the prior per-session override (``None`` means the user had no override, so the MoA override is cleared outright). rFNr)rVr/rmrnr r2)rrr- _restores r>r#z#GatewayRunner._restore_moa_one_shot$?su7??  F u&=tDDHIQD   * * 7 F  $ $Y / / / / /    DD sAA A*)A*c|sdS ||}|r |jjnd}| d|j_|sdS|||dS#t$r t ddYdSwxYw)zBRestore a per-session model override after ``/model --once`` runs.Nz)Failed to restore one-turn model overrideTr)rArmone_turn_restore_restore_session_model_overrider2r3r4)rr+ _otr_stater* s r>r$z6GatewayRunner._restore_pending_one_turn_model_override6?s  F U11+>>JCMWz.??SWH%;? '8   0 0h G G G G G U U U LLDtL T T T T T T Us5AA&A?>A?)r+rc @K|pg}t|d}|rt|ddn|jpd}t|jdd}t|jdd}|p||}||t |||} | rL|jrEt|j} |j tj kr|j r | d |j d } d | d |}t|d dr |j d|}g} g} |jr!g} g}t|jD]\}}|t!|jkr |j|nd}t%||r| ||jt*jkr| |n'|s%t/||r|||ds|s*|jt*jkr| || rKt5j|j||d{V}|dkrUt;| ||j_ tB"dt!| ntB"d|t!| d} |#||\}}tI|pi}||d<n,#tJ$rtB&ddYnwxYwddl'm(}||5|)|| d{V}dddn #1swxYwY|r|*||d{V\}}|r|+r|,|}|-||.|}|r_|D]\} |/|j0d|d|d{V+#tJ$r%}tB&d|Yd}~Ud}~wwxYw| rddl1m2}| D]}tfj45|}|6dd}t!|d kr|dn|} toj8d!d| } ||}!d"| d#|!d$}"|"d%|}| rddl1m2}| D]}#tfj45|#}|6dd}t!|d kr|dn|} toj8d!d| } ||#}!d&| d#|!d'}"|"d%|}|jrnddl9}$ddl1m2}%hd(}&t|jD]J\}}t%||s tu||stw||r7|t!|jkr |j|nd}|d)vr]tfj4<|d*=}'|'|&vrd+}n|$>|\}(})|(r|(}nd,}tfj45|}*|*6dd}+t!|+d kr|+dn|*},toj8d!d|,},|%|}-t|,|-|}.|.d%|}L|Mt|d-dtj@kr.t|d.drdd/lAmB}/|/r d0|jCd1|}t|d2dr8|jDr1|jEdd3}0t|d4dr d5|0d6|}nd7|0d6|}d8|vr6 dd9lFmG}1dd:lHmI}2tfjJKd;tfj4Ld<}3d}4d}5i}6g}7 t}5|5Kdi}6t|6tHr&|6Kd=}8|8t|8}4 dd>lPmQ}9|9|5}7n'#tJ$r|5Kd?pg}7YnwxYwn#tJ$rYnwxYw|#|||5@\}:};|;KdApd}|>dd|6KdA|<|6KdD|;KdDd{Vrd}4n#tJ$rd}4YnwxYw|7r,|[rr z [New message] rrnativezSImage routing: native (model supports vision). %d image(s) will be attached inline.zLImage routing: text (mode=%s). Pre-analyzing %d image(s) via vision_analyze.rz4vision enrichment: session runtime resolution failedrr)scoped_runtime_main 🎙️ "rUr.z&Transcript echo failed (non-fatal): %sto_agent_visible_cache_pathrKr|r)z [^\w.\- ]z*[The user sent an audio file attachment: 'ru3. Its content is not inlined here. If the user's request involves what the audio contains, transcribe or process it yourself — for example by passing the path to a transcription or media tool — instead of asking the user to describe it. Only ask what to do with it if their intent is genuinely unclear.]rz$[The user sent a video attachment: 'u1. Its content is not inlined here. If the user's request involves what the video contains, inspect or process it yourself — for example by passing the path to a video analysis or media tool — instead of asking the user to describe it. Only ask what to do with it if their intent is genuinely unclear.]> .md.cfg.csv.ini.log.txt.xml.yml.json.toml.yaml>rapplication/octet-streamr(z text/plainrrrj_discord_tools_loadedz[Triggering message id: `uG` — use as `message_id` for reply/react/pin via the discord tools.] r| rr z%[Replying to your previous message: "z"] z[Replying to: "@)#preprocess_context_references_async)get_model_context_length_asyncr~r|get_compatible_custom_providerscustom_providersrrrJshould_clear_context_pin_asyncr"get_custom_provider_context_lengthrrrrrrconfig_context_lengthrr)rr| allowed_rootrzContext injection refused.z(@ context reference expansion failed: %sz,@ context reference expansion failure detail)[rrVrrzrArrar)rbrrrrr rrr7rrrrrsrrr!rrr_decide_image_input_moderr/r0native_image_pathsr3rzrrur2r4rm r_enrich_message_with_vision"_enrich_message_with_transcription_should_echo_stt_transcriptsr@r rur0r2tools.credential_filesrrrr rer_r mimetypesrrrry guess_typerrrrrrjr5 r| agent.context_referencesragent.model_metadatarrrvrR rsrtrhrrhermes_cli.route_identityrrblockedrfwarningsrr$r)Errr(rr+_pending_stt_prepared message_text_group_sessions_per_user_thread_sessions_per_user_is_shared_multi_user_safe_user_nameaudio_file_paths video_paths image_paths audio_pathsrrr _img_modevision_runtime turn_modelrr_successful_transcripts _echo_adapter _echo_meta_tx _echo_exc_to_agent_path_apath _basenamer _display _agent_path_note_vpath _mimetypesr_TEXT_EXTENSIONS_extguessedrKr rgrr context_note_disc_tools_loaded reply_snippetrr_msg_cwd_msg_config_ctx_msg_cfg_msg_model_cfg_msg_custom_providers _msg_raw_ctxr _msg_model _msg_runtime _msg_base_url_msg_configured_modelrr_msg_custom_ctx _msg_ctx_len _ctx_resultrr<sE r>_prepare_inbound_message_textz+GatewayRunner._prepare_inbound_message_textE?sp*-R '/J K K% GE6 = = =  $+4;8QSW#X#X $+DK9SUZ$[$[!"IT%A%A&%I%I  00=== < $<%>! ! !  ! AV%5 A?v?OPPO(.00V^0&IIIII A@@,@@L 5+T 2 2 W#3VV VVL')!#  ` "KK$U%566 - -401C8I4J4J0J0J)!,,PR )22-&&t,,,%):::$++D1111.-3LUTU3V3V-&&t,,,##H---e-@RVaVg@g@g&&t,,,2 #*"31! +### ((7;;6G6G''# !3KKmK(( KKf!3{#3#3&*N 595X5X#)(36Y662 N*.n.B)C)C2<w//$ R%)% KJJJJJ,,^<<-1-M-M('..((((((   ">B>e>e ??9999995 5+"t/P/P/R/R"$($<$>,nV44 FFF'2FFF#(;;\;;  < \ \ \ \ \ \% < <G,,V44 "a00(+F q(8(86!99i6,X>>,nV44 F8FF'2FFF#(;;\;;  - C * * * * J J J J J Jyyy $U%566( C( C4*%33,UA66-UA66 01C8I4J4J0J0J)!,,PR<<<7++D11!4::<E 7++D11 sA..+.u::??uQxx !vlCFF 98>> ;L*V[\\ ".BBLBB    D11X5EEE|T22F T S S S S S!!## &0@&&#&& 5/4 0 0 UU5N U"/5Mu7?? U&M&&#&& UTTlTT ,  e \XXXXXXOOOOOO:>>."':L:LS:Q:QRR"&!#(*%355H%-\\'2%>%>N!.$77@'5'9'9:J'K'K '3.1,.?.?OWUUUUUU0O0OPX0Y0Y--$WWW08 =O0P0P0VTV---W D,0+N+N! + (,O,,( L !- 0 0 < < B ".$77(N&&y11P^5G5G5P5P'& !666&*O".:nd3S3S. /\\\\\\!?!?  *..z::)*..z::(,,Z88 ""3/3O$///*./( ]  XXXXXX*L*L",%2-B+++ +>.=O$%C%C*(,,Y77=2*9)--j99?R%: &&&       %H$G  #/!) %%% & #77??H&mm"N IIk&:;;[?[ 4'7#.#6L \ \ \I3OOO KVZ [[[[[[[[ \s=0K..&LL+MMM'P P2 P--P2)Ai;Aa`-,a-!aaaai a"i!a""Bi8Aei eiei'f?i f  i f  B2ii j7jjc6Ktt|ddddrYt||5|||||d{VcdddS#1swxYwY|||||d{VS)zDRun inbound preprocessing under the routed profile when multiplexed.rzNrFrr(rr+)rVr _resolve_profile_home_for_sourcer)rrr(rr+s r>,_prepare_profile_scoped_inbound_message_textz:GatewayRunner._prepare_profile_scoped_inbound_message_text@s+ 744002F N N '(M(Mf(U(UVV  !??!# + @                77# 8         sA11A58A5cK||s|jpdS||dd{V\}}dd|DS)zDReturn raw text or successful voice transcripts for a clarify reply.rNrc3fK|],}||V-dSr^r)rb transcripts r>rdz.@sT  !!           rM)r rrx$_transcribe_pending_audio_event_oncerf)rrrKr s r>r z)GatewayRunner._prepare_clarify_reply_text@s..u55 .J$"++-- -*.*S*S 2+ + % % % % % % ! !{{  4      rMc||}| |jjsgSt|jj}g|j_|Sr^)rAr0rr)rr+r;rLs r>rz1GatewayRunner._consume_pending_native_image_pathsAsL((55 = 0 C=IU%899.0+ rMc|r|dSt|dd}|t}||_ tj|||<n.#t $r!t d|dYdSwxYw ||t|dd}t||kr+| dt||k)dSdS#t $rYdSwxYw) Nrz*Failed to cache live session source for %sTrrr`FrQ) rVrrrirlr2r3r4rr7popitem)rr+r(cached_sourcesmax_sizes r>_cache_session_sourcez#GatewayRunner._cache_session_source As- fn F '94@@  !(]]N$2D ! *5*=f*E*EN; ' '    LLE{]aL b b b FF    & &{ 3 3 3t%;SAAHn%%00&&E&222n%%000000    DD s$A'A32A37A"C C+*C+c~t|dd}||j|jurt|j}||_|S)z>Return the single async facade for this runner's SessionStore.rN)rV_storerrXr)rfacades r>r8 z!GatewayRunner.async_session_store AsG5t<< >V]$2DDD&t'9::F(.D % rMcK |j|d{V}n4#t$r'}td||Yd}~dSd}~wwxYw|sdSt |d|t |d|dS)z=Persist the exact resolved routing key for this running turn.Nz/Could not persist active-turn marker for %s: %sF _gateway_active_turn_session_key_gateway_active_turn_tokenT)r8 mark_turn_activer2r3rr )rrr+rr<s r>_mark_durable_active_turnz'GatewayRunner._mark_durable_active_turn)As  2CCKPPPPPPPPEE    NNA    55555   5 9;GGG3U;;;ts % AAAcKt|dd}t|dd} |r|s) dD]#} t||#t$rY wxYwdSd}tddD]} t |j||d{VcdD]#} t||#t$rY wxYwS#t$r/}|}|dkrt d |||Yd}~d}~wwxYwt d || dD]#} t||#t$rY wxYwdS#dD]#} t||#t$rY wxYwwxYw) z5Best-effort CAS clear of the marker owned by *event*.rNr)rrFr(rr)z5Retrying active-turn marker cleanup for %s (%d/3): %sz>Could not clear active-turn marker for %s after 3 attempts: %s) rVdelattrr r rr8 clear_turn_activer2r3r4r)rrr+rr last_errorrr<s r>r%z(GatewayRunner._clear_durable_active_turn@Asve%GNN ;TBB%  e 8  E4((((%D   7/3J A;;  "6HH'0  E4((((%D  '!!$J{{ S'#  NNP      E4((((%D     E4((((%D  sD?A A AD?(-B>D?B-- B:9B:> C7%C2-D?2C77D?D-- D:9D:?E'EE' E# E'"E# #E'c|sdSt|dd}|sdS||}|' ||n#t$rYnwxYw|S)Nr)rVrvrr2)rr+r r(s r>r: z(GatewayRunner._get_cached_session_sourcekAs 4 '94@@ 4##K00   **;7777     sA AAr;rc~bKtj}t|jdr |jjnt |j}|jpddddd}t|dd}t|ddpddddd} t d ||j p|j pd |j pd ||| tj|j|d{V} | \t d |j |j |j| t#j|| } ||_n#t&$rYnwxYw|j|d{V} | j} t t|d dpidpd} | r"|| | d{V}|dS|} || |tj|j|d{Vr |jrF|jt |j t |jd{Vnd}n.#t&$r!tddd}YnwxYw|rt |dpd}|rb|j[ |j|d{V}n/#t&$r"td|d|}YnwxYw|r||kr|}|r0|| j kr%|j!| |d{V}||} |rK|t |dpdkr#tj|j"|| dd{VnO tj|j#|| d{Vn,#t&$rtddYnwxYwt| dd}|r3|$| d|%| d| _&| j'| j(kp|pt| dd}t| ddrd| _)|rC|j*+d|jr |jjnd|j | j | dd{VtY||j-| }|.|}d}d}d} t_}ta|dpidd}n#t&$rYnwxYw|1||| }g}|rt| d dpd!}|d"krd#}n|d$krd%}n |d&krd'}nd(} te| |}n#t&$rd}YnwxYw|r|d)z|z}|3| |j4j-5|jt|d*d+,} |jr |jjnd}!t| d-d}"|d.vp| j6o |"o|!| j7v}#|#r|8|}$|$r|d"krd/}%nJ|d&krd0}%nA|d$kr d1| j9d2}%n/| j:d3z}&| j:d3z}'|'s|&d4n|&r|&d5|'d6n|'d6}(d7|(}%d8|%d9}) tj|j;|d{V}*|*r|)d)|*})n#t&$rYnwxYw|$<|j |)|=|:d{Vn2#t&$r%}+td;|+Yd}+~+nd}+~+wwxYwd| _>t|dlAmB}.mC}/g}0g}1|-D]r}2|.|2|?}3|3rF|3\}4}5}6d@|6dA}7|/|4|5|7}8|8r*|03|8|13|2WtDdB|2s|0rP|03|jd)E|0|_t dC|1| n3#t&$r&}+tDdD|-|+Yd}+~+nd}+~+wwxYwt|dEd}9|9 |9F| j ||tdFtGd{V}:n$#t$r|J|wxYw|:(|K|jL};|:|;_M||;_N|O|| jd{V|jP| j d{V}<|<r@t|<dHkr,d=dIlRmS}=mT}>dJ}?dK}@d}AdL}BdM}CdN}DdO}Ed}Fd}Gd}Hd}Id}Jd}Kd}Li}M t_}M|Mrk|MdPi}Nt|Ntr|N}?nt|Ntr|NdQp|NdPp|?}?|NdR}O|O( t|O}Fn#ttf$rYnwxYw|NdSpd}G|NdTpd}H|MdUi}Pt|Ptrct |PdVdYdWv}A|PdX}Q|Q0 t|Q}R|Rd=kr|R}Bn#ttf$rYnwxYw|PdY}S|S0 t|S}R|Rd=kr|R}Cn#ttf$rYnwxYw|PdZ}T|T0 t|T}R|Rd=kr|R}Dn#ttf$rYnwxYwt|D|C}D|Pd[}U|U0 t|U}R|Rd=kr|R}En#ttf$rYnwxYw|?}J|G}K|H}L |\|| t|Mtr|Mnd\\}?}V|VdSp|G}G|VdTp|H}H|Vd]p|I}In#t&$rYnwxYw|F2 d=d^l]m^}W|W|J|?|L|H|K|Gd{Vrd}Fn#t&$rd}FYnwxYw|F|Hr d=d_l_m`}Xma}Y|X|M}Zn<#t&$r/|Md`}Zt|Ztsg}ZYnwxYw|Y|?|H|Za}[|[rt|[}Fn#ttf$rYnwxYwn#t&$rYnwxYw|A r%|>|?|Hpd|Ipd|F|Gpdbd{V}\t|\|@z}]t|\dcz}^t|<}_| jb}`|`d=kr|`dd}an |=|<de}a|B}b|]kp|_|bk}c|crt|dfd}d|dt|ddg|d}dt|ddhd}e|ei |e| j }fn#t&$rd}fYnwxYw|frC|fdid=d=kr)t dj| j |fdid}c|c rt dk|_dl|at|@dmz|\dl|]dl|=||c|}g d=dnldme}hd=dolfmg}i|\|| t|Mtr|Mnd\\}?}V|Vd]rdp| %srhrgateway_session_idr2rz%Failed to read Telegram topic bindingTrrNz$compression-tip lookup failed for %szcompression-tip-walkrz'Failed to record Telegram topic bindingwas_auto_resetF auto_resetis_fresh_resetz session:start)rrrNr+privacy redact_piiauto_reset_reasonidlery zy[System note: The user's previous session was stopped and suspended. This is a fresh conversation with no prior context.]dailyz[System note: The user's session was automatically reset by the daily schedule. This is a fresh conversation with no prior context.]resume_pending_expiredu[System note: The previous gateway session could not be recovered after a restart (API recovery timed out). This is a fresh conversation — use /resume to restore history if needed.]zy[System note: The user's previous session expired due to inactivity. This is a fresh conversation with no prior context.]rrr)r session_typereset_had_activity>ry r%z+previous session was stopped or interruptedz"gateway restart recovery timed outzdaily schedule at z:00rhzh rz inactive for u!◐ Session automatically reset (z). Conversation history cleared. Use /resume to browse and restore a previous session. Adjust reset timing in config.yaml under session_reset.r.z.Auto-reset notification failed (non-fatal): %sr r)_load_skill_payload_build_skill_messager z[IMPORTANT: The "zB" skill is auto-loaded. Follow its instructions for this session.]z#[Gateway] Auto-skill '%s' not foundz0[Gateway] Auto-loaded skill(s) %s for session %sz-[Gateway] Failed to auto-load skill(s) %s: %srr) owner_keyr?rr)estimate_messages_tokens_roughrzanthropic/claude-sonnet-4.6g333333?ir%g@r@rrJr|rrrmr>rorqrrhygiene_hard_message_limithygiene_timeout_secondshygiene_total_ceiling_seconds hygiene_failure_cooldown_secondsrrr)rrrr)rrrrffffff?actual estimatedrRrS get_compression_failure_cooldownremaining_secondszXSession hygiene: skipping compression for %s; previous failure cooldown active for %.1fsufSession hygiene: %s messages, ~%s tokens (%s) — auto-compressing (threshold: %s%% of %s = %s tokens)rrv )CompressionCommitFencerc@g|]}|ddv|S)r>rrrrrr_ s r>rz.Cs8)))&'#$55==4Q#Q#Q!"#Q#Q#QrMzSession hygiene could not restore the system prompt for session %s: %s. Preserving an empty prompt so the live turn rebuilds it with its configured providers.r )rrr skip_memoryrrNrXrxbind_session_statecdSr^rN)r kws r>rz:GatewayRunner._handle_message_with_agent..DsDrMc6dS)Nr)rH commit_fence)_compress_context)_approx_tokens _hyg_agent_hyg_commit_fence _hyg_msgssr>rz:GatewayRunner._handle_message_with_agent..%Ds( 0L0L,5r:H9J1M1*1*rMg{Gzt?ruSession hygiene compression for session %s still streaming after %.0fs (last progress %.1fs ago) — extending wait (ceiling %.0fs)g?zsession hygiene timeoutrP zKsession hygiene compression timed out with no output from the summary modelrz%session hygiene compression timed outz1hygiene compression timeout activity stamp failedzSession hygiene compression for session %s made no progress for %.1fs (total wait %.1fs, ceiling %.1fs); continuing without compressionu+⚠️ Context compression timed out after .1fus with no output from the summary model. No messages were dropped — continuing without compression. Run /compress to retry, /reset for a clean session, or check your auxiliary.compression model configuration.z9Failed to deliver compression-timeout warning to user: %szsession hygiene unwindr}uSession hygiene: failed to persist compressed transcript for rotated session %s → %s; keeping the live entry on the original session so the conversation is not droppedzhygiene-compressionuGateway hygiene compression for session %s did not rotate or compact in place (no session_db on the hygiene agent) — preserving the original transcript instead of overwriting it with the summary (#21301).u>Session hygiene: compressed %s → %s msgs, ~%s → ~%s tokensz3Session hygiene: still ~%s tokens after compression_last_compress_abortedrK_last_summary_errorz#session hygiene compression abortedz/hygiene compression abort activity stamp failedrrru$⚠️ Context compression aborted (u). No messages were dropped — conversation is unchanged. Run /compress to retry, /reset for a clean session, or check your auxiliary.compression model configuration.z9Failed to deliver compression-failure warning to user: %s_last_aux_model_failure_model_last_aux_model_failure_erroru%ℹ️ Configured compression model `z ` failed (u). Recovered using your main model — context is intact — but you may want to check `auxiliary.compression.model` in config.yaml.z7Failed to deliver aux-model-fallback notice to user: %szsession hygienez(Session hygiene auto-compress failed: %sz[System note: This is the user's very first message ever. Briefly introduce yourself and mention that /help shows available commands. Keep the introduction concise -- one or two sentences max.])PROFILE_BUILD_FLAGrrprofile_build_directiveprofile_build_modeaskrz@Profile-build onboarding directive failed, using plain intro: %s) get_secretrr rz/hermes sethomez/sethomeu 📬 No home channel is set for z^. A home channel is where Hermes delivers cron job results and cross-platform messages. Type z8 to make this chat your home channel, or ignore to skip.rr)coerce_message_timestampr strip_leading_message_timestampsrgrz2Message timestamp injection failed (non-fatal): %srr)rrr2rrrNr$z agent:start _moa_config) r$rrr(rNr+rr:rrurtrvr_stop_typing_with_metadata stop_typinguKDiscarding stale agent result for %s — generation %d is no longer currentrpop_post_delivery_callbackr>r@r#is_intentional_silence_agent_result(empty)u⚠️ The model returned no response after processing tool results. This can happen with some models — try again or rephrase your question.r(rzMresponse ready: platform=%s chat=%s time=%.1fs api_calls=%d response=%d charsz&clear_resume_pending failed for %s: %srzagent-result-compressionz{Skipping agent-result session split sync for %s because the session binding moved from %s to %s before compression finishedrz rrIr)escape_code_fences_for_displayrJz _... (z more lines)_rRreasoning_styler/subtextc3(K|] }|rd|ndVdS)z-# z-#NrNrblns r>rdz;GatewayRunner._handle_message_with_agent..KGsB,,;="6J"JJJ$,,,,,,rMu-# 💭 Reasoning blockquotec3(K|] }|rd|ndVdS)z> rNrNr]s r>rdz;GatewayRunner._handle_message_with_agent..PGsB,,9;4IIII,,,,,,rMu> 💭 **Reasoning:** u💭 **Reasoning:** ``` z ``` )build_footer_lineryr)rAr?rcontext_tokensr|r turn_secondszruntime_footer build failed: %s already_sentz agent:end)rJrrr*rw zProcess watcher setup error: %s&Watch notification injection error: %szWatch queue drain error: %srrPrc3 K|]}|vV dSr^rN)rbr;_err_str_for_classifys r>rdz;GatewayRunner._handle_message_with_agent..Gs9aq11rM) zcontext lengthz context sizezcontext windowzmaximum contextz token limitztoo many tokenszreduce the lengthzexceeds the limitzrequest entity too largezprompt is too longzpayload too largezinput is too longrrzjSkipping transcript persistence for context-overflow failure in session %s to prevent session growth loop.upTransient agent failure in session %s — persisting user message so conversation context is preserved on retry.zLSuppressing hidden-reasoning-only incomplete gateway turn for session %s: %srruCompression deferred for session %s — the compression lock is held by a concurrent compressor. Keeping the session intact; the next message retries normally.z7Auto-resetting session %s after compression exhaustion.compression_exhausted_resetzcompression-exhausted-resetu 🔄 Session auto-reset — the conversation exceeded the maximum context size and could not be compressed further. Your next message will start a fresh session.rr)rrrrrgrr)rr4rgrjz:Skipping duplicate user turn (message_id=%s) in session %s)skip_dbr)rrr)ryz5Suppressing intentional silence marker for session %s_streaming_tts_turn_completedcdSNFrN)_ar" s r>rz:GatewayRunner._handle_message_with_agent..HschrM)rdztrailing footer send failed: %szAgent error in session %srir4zrrrrz% The request was rejected by the API.z)Sorry, I encountered an unexpected error.rrN)rUrrrrwrrlrVr3rzr)rr2rrrfrrir(r2r8 r r+rvrxr) r rrRget_telegram_topic_bindingr4r rNr rr]r r r created_atr rrrr]rz_set_session_envrsr_pinned_session_context_promptr_rrget_reset_policynotifynotify_exclude_platformsr@at_hour idle_minutes_reset_notice_session_infor0r r"rtrrr)r*rrfacquirerrfrh_clear_session_envr/rJ lease_tokenlease_generationrload_transcriptr7rr,rrurhrwrjryrirCrrrrrrryruagent.conversation_compressionr7r rrr_GATEWAY_HYGIENE_PLATFORMcompression_in_placer/rb _print_fnr! run_in_executorrseconds_since_progressrrr,commit_in_flighttry_cancel_before_commitr"release_cancelled_compression_lockr_ rZr?agent.session_activityrrAGENT_COMPRESSION_TIMEOUTrrevoke_commit_admissionrewrite_transcriptrP_rebind_turn_leaserrLrBAGENT_COMPRESSION_COOLDOWNrrrS has_any_sessionsr<rKrrrLrMrlrrtrrfrrOrrr= rrrrr/_voice_channel_sidecar_noterrrrrPrrQr_set_pending_turn_sidecar_notes_bind_adapter_run_generation _run_agentrrrrSrT_is_session_run_currentrUr@rUrgateway.response_filtersrWrr} r rr"rrWru MATTERMOSTrrYrYrTrSgateway.runtime_footerrarr-r+rrrrt rrr_inject_watch_notificationr  reset_sessionappend_to_transcriptrrjhas_platform_message_idupdate_session"_refresh_agent_cache_message_count_should_send_voice_reply_send_voice_reply_deliver_media_from_responserrrr3mathceil)rrr(r;r_msg_start_time_platform_name _msg_preview _reply_id _reply_txtrer\r+r resolved_entrybindingbound_session_idcanonical_session_idr _was_auto_reset_is_new_sessionr_session_env_tokens _redact_piirtrv_pcfgrturn_sidecar_notes reset_reasonrcontinuity_noterZ r_ had_activity should_notifyr1 reason_textrrJ rr* session_infor_auto _skill_namesr)r*_combined_parts _loaded_names_snamer _loaded_skill _skill_dir _display_namer_part_lease_registry _lease_token _lease_staterr,r _hyg_model_hyg_threshold_pct_hyg_compression_enabled_hyg_hard_msg_limit_hyg_timeout_seconds_hyg_total_ceiling_seconds_hyg_failure_cooldown_seconds_hyg_config_context_length _hyg_provider _hyg_base_url _hyg_api_key_hyg_configured_model_hyg_configured_provider_hyg_configured_base_url _hyg_data _model_cfg_raw_ctx _comp_cfg_raw_hard_limitrC _raw_timeout _raw_ceiling _raw_cooldown _hyg_runtimer_gw_gcp_gw_gccl_hyg_custom_providers_hyg_custom_ctx_hyg_context_length_compress_token_threshold_warn_token_threshold _msg_count_stored_tokens _token_source_HARD_MSG_LIMIT_needs_compressrR_getter_cooldown_state _hyg_metar7r_hyg_session_rowr<_hyg_session_db_hyg_cleanup_deferred_bind_hyg_stater _hyg_future_hyg_wait_started_slice _compressedrK _hyg_waited_idle _cancelledr _timeout_msgr_werr _hyg_new_sid _hyg_rotated _hyg_in_place _new_count _new_tokens_comp _hyg_abortedrr _warn_msg _aux_model_aux_err_aux_msg _intro_noterKrrrLrM_onb_cfg_pb_errenv_keyhome_envrO_lgcprof sethome_cmd_vc_noter _get_evt_tz_coerce_msg_tsr _strip_msg_ts_evt_tz_evt_ts_clean_message_text _embedded_ts _event_epoch_ts_errrg_run_start_session_id_turn_started_monotonicr _turn_seconds_typing_adapter_stop_with_metadata _stop_typing_stale_adapterrJrW_intentional_silenceagent_messages_response_time _api_calls _resp_lenr_show_reasoning_effectiverrYrqdisplay_reasoningrS_reasoning_style_quoted _footer_line_bfl _footer_errr+r rr _pr _watch_eventsr synth_texte2agent_failed_earlyhidden_reasoning_incompleteis_context_overflow_failure new_entryr tool_defsr _user_entry _skip_persistrr9_user_msg_id_attachedrr _already_sent _stts_adapter_streaming_tts_done_media_adapter _foot_adapter _err_adapter_already_persisted_recent_transcript_msg_expected_user_content status_hintrn _hist_len _err_body _err_json _resets_inr_hoursrArgrBrCrDs @@@@@r>r"z(GatewayRunner._handle_message_with_agentyAsG)++29&/72S2Sm..Y\]c]lYmYm (b#2#.66tSAA E#8$?? e_d;;Ar3B3GOOPTVYZZ  a F,KK) N 'iy*   "+D,RTZ[[[[[[[[  KKC0@)   !(9EEEF %     #6LLVTTTTTTTT #/  UJ - - 3 8 89M N N TRT  %''   +#'#I#I!$$N%*M "";777"4#?HH H H H H H H8 [ &1!1!L!L//!&"233"M""-1    Dt TTT / [#&w{{<'@'@'FB#G#G $@(8(D @595E5Y5Y,66000000,,%@@@ B,t%0@,,, @-@04DDD+?(#1(8M>  ="2E : : 1+0M (  *///5;_LFO11"!>+6* 44       ( ]KK#33G<< #!% (**E ) 4 4 :?? eTTUUKK    D << [+  )+ P 3"=2EtLLVPVL{** [ (( f !999 Y  [  '"? v"V"V ' ' '"& ' G+f4F  % %l 3 3 3 1 R+2CC#_!(d!C!CD:@ P 5 5b &}6JERR !-0W W!MM$M%V-LL !"66v>>G';66*WKK)-EEE*NKK)W44*Rv~*R*R*RKK$*$72$=E#)#6#;D:>'p%{{{{[`DpuDWDWPTDWDWDWDWimfpfpfpH*D(*D*DKW WWW !181B $ ?22,,,,,,L ,G,2)F)F )F)F(!!! D!%ll"NF%)%E%Ef%M%M+ R R R MqQQQQQQQQ R /3M + |T22  au a&0&<&<ME77$u++L aZZZZZZZZ-/+- * V VF11&*MMMG VCJ@ z=J JJJ!5 4]JPU V V 9+225999)00888'LfUUUU"#**5:666!'_!=!=EJKKJ%{ a a aNP\^_```````` a$"$==  & %4%<%<!,(-&35G &=&&       )   ''(;<<<   '#22:>>C +7 (0> - ,,UM4MNNNNNNNNN0@@AYZZZZZZZZ" \ s7||q((        7J!% '+ $"& #' ). &,1 ))- & M ML$( !'+ $'+ $I| 022 ?%!*w!;!;J!*c22K%/ #J55 K%/^^I%>%>%g*..QXBYBY%g]g $.>>2B#C#C#/%=@]] : :$-z#:%%% $%)3z(B(B(Jd (2z(B(B(Jd !* mR @ @I!)T22(%36%MM)T::44%''%94:0+4--8T*U*U*6%*-o*>*>#*Q;;:A$7$-z#:%%% $%'0}}5N'O'O '3%*/ *=*=#*Q;;;B$8$-z#:%%% $%'0}}5T'U'U '3%*/ *=*=#*Q;;AH$>$-z#:%%% $%6968L662)2 6X(Y(Y (4%*/ *>*>#*a<#>#N,LL D.9 :\\\\\\!?!?1&4)4) "">:>6$:::59222: .5-5 ;5"~$9$9=.455.22488 !% @ @IeIefkIlIl m mIkYYYYYY555555373V3V#)(35? 45P5P(Z VZ4W440 L (++I66]*))+2)))I #9~~22!&=A=M=Y=Y(5(@>&>&8&8&8&8&8&8&$4$4(1 !& !& !&7;$4$*NN)@)6(@(+15%3%&%&%&%&%&%&%&%& !&3:$:JESWSc2d2d-4W ." ."&2 ."*434/3046>Z/ ." ." ." ." !<$.$4!"!"!"7P 38= 5j!*GKJ$C6=(/ Bn>N>NQb>b 8I8`8`8b8b49mE6J6J0J0J0J0J0J0J0J#/9.@$0:K)2 DO=N=N=N=N=N=NNK->,`,`,b,b,b,0,W,W0;0:8Q-X-.-.-. EI,A/LPQ/Q/Q0H48-:R4Q80H0A0X0X0Z0Z040@0@CT0T0J -. -. -.1]9M0U1]1]1]-9 -2;?;S;STZ;[;[3;1616:B--8>8DAJ;H;6;656565656565656 4=-2-2-2065J491212121212121212-2 -2K:;L,9%.%.%.):(Q(Q(S(S(S/D)I,0,W,W0;0:8P-X-.-.-. EI,A(-#%..4>3HL3?=C[3[L48(/ (4%.595M5`5`,8+6*6*0*0*0*0*0*0*).-3LL1N 1>0H0<-.-.-.,>)*)*)*-4J@TVZ,[,[E383D4&(-/GJ&J&L,8%.,H4@4@5B6@6@:H7B,*,*,* ).-J04k-.-.-.(4D%.+HA+M+M,D04m6N0M48+4Q12121849;PRV1212 -. -. -.)*)*)*)*)*)*)N,6,Q,>,Y-D )*)*)*07u>SUY/Z/Z/m^m)W(V(V(V(V(V/D/DTQU/V/V/V-=04-=-=-=)2).7;7O7OPV7W7WH/7-sFN-s6>mmFNT]hqm6r6r0r0r0r0r0r0r0r/8).).).,2NN0k05-.-.-.-.-.-.-.-.).*/):wuNmos?t?t):5mmFNT\gpm6q6q0q0q0q0q0q0q0q/8).).).,2NN0i05-.-.-.-.-.-.-.-.).%)$<$<[$I$I$I+@%*.2.T.T,6@Q/U/*/*)*)*)*)*)*)*)*%)$<$<[$I$I$I+@%*.2.T.T,6@Q/U/*/*)*)*)*)*)*)*)*)*%* %F# 7T%=%N%N%P%PPPPPPP# 7N  7011&&x00E99#GH.@AA:'--.E.E.G.G.M.M.O.OPPPIl]:>>r     QAHPBIg..4";;===b %DK$@$@$Q$Q%$H      JJJJJJ#FIt<<BIIKKD- 1 1!% 11&/BB-',H D D (.88&%# *}7J7J7L7L**(***33FFCCCCCCCCC33E6;OO  0  % %h / / /"NN# O          F X ? ? ? ? ? ?           "kmmGe[$77G 7 < = = 74AM W5.5.5.1#\':$-~g'BBB $0$+."$$$LL$7L X X X LLMw W W W W W W W W X  R+ R  0 0>P Q Q Q ))  $ $V , ,     ~ 96<_LFO11"!>!>/RHOPVXceiHjHjrSd!C!CDDDpr$V["==C+6'-H*//-:: : : : : : : : %2$< !&*n&6&6 #!%$-0'-!%!=!=e!D!D$3"5->>%9'="/"1""L!N,,/FFM  "&":":6"B"B&-))+G''# 'tO'<'$R@Z([([R";?? DQQQn  # #$7 8 8 8 8 8k$''(899?RH>>2GG TTTTTTTTTT LL@#R( W: (G R& g!-!1!12B!C!C!$gVVVVVV*0022==??E5zzB,0IIeCRCj,A,A))-VE R-V-V-VV)),:,@,@,B,B) 2RRRRRR+B+B0220AA-" ,,(( %222+1(((2'944"&)),,ARA]A]A_A_,,,##$Q#P#Ph#P#P)\99"&)),,?P?[?[?]?],,,##$UW#T#T(#T#T-K,JK\,],])#f@Q#f#f\d#f#f L "LLLLLL#t 4 6 6!5fo!F!F&**733#/#3#34H!#L#L#QPQ#/#3#34D#E#E#M ~r::!.     " " " > LLL!  " ; ;1A1A.1Q1Q ;Zn ;&::L::*//+00%^TcT2%))'266(,,Z<< 000        CCCCCCC,<46 1"+H"5"5//JAw'(A(A'(J(JKKK3w"}}%mA........./ C C C >BBBBBBBB C ?JJJJJJ ;C

>>>>>>> ?2"&l&6&6x&@&@!A!A *V++ '%( (8(8"(E(E$F$F$L$L$N$N ! += +\%%&=>>??J<J22Hs7||b7H (+  L!, $  M!, - )!, $$W.EFF " 677*  I1>FM,,3  !!"9::# }# Q\#  M!,#'":"H"H"U"UUUUUUU ((555..(E/(%.M!+9 6S%ND B +  (,,Wb99 .CC!, .!*b!7!9!9=C_$TFO$9$9RT%'          *+../@$BRZ^B^__O +e #c 'Bc #0;-,)2=/.   #F03E4D0E0EK - $"6NN%0#e6F2G2G ! KK8(-*B 2GG%0# /H +../?WNN ?B>?R?RU`?`?`~kll;;fh $2 & 4?10!- 6A32!# # #K'J478H4I4I L12GG%0# /H  "6KK)4%0XTVWW$3L-2)+776??h66$ 83 8 R 8 8 59 #6 9 9 % 0!: ,E 9 925e6F2G2GE,/481"6KK)4e$3L*99)#/#3#34H!#L#L:       .99]5       $  K!,!!1!1.!A!ABBM 44V<11%>`m1nn >,,UH=========//  8H8H8R8R %)%=%=f%E%EN%"??$e^ L L(,(@(@(H(H ("/"4"4 & ,)-)I)I&RVRnRnotRuRu)v)v#5## %LLL %FKKKKKKKKLn  # #$7 8 8 8 8 8kj  # #$7 8 8 8 8gp p p  #77?? &-&&(Dd''# 'tL'9'9=$OO CH-@$A$AC&AA88"D$@$@$G$G "Ch|&<&<C&226>BBBBBBBBB       8+ F F F% l!VXX--,2J}Oh).&0373K3[3[\i\t3u3u-u-u-u-u-u-u**$000-/***0 ();CDD)A B B""88F++v55$8#C!5 4%13 37((92E2EI_2_.!E6.$*$8#C!5 4%1$:#E!7 6%)Y[[ ' ' #5,==N8;E>1  # #$7 8 8 8 8 8!C''"IKDKDDD       # #$7 8 8 8 8gp f  # #$7 8 8 8 8s~E E%$E%2AJ(J-,J-! L)L.-L. )[76\>7 \\>\9\>> ]-]((]-6Cb b:b55b:7d !d*Bv(3jv(jv(jB+v(mv(m/,v(.m//v( n"!v("n63v(5n66v(o)(v()o=:v(<o==*v((q?v(qv(q v(A7sv( s# v("s##v()tv( tv(tv( t43v46u-*v,u--"vv(v$!v(#v$$v(( v54v51z zz5A^.]37A^*^*A^.^. A_^8A__A_`BAbb Acb 0AccAcd5)Aee Ae.e-Ae.f!#Agg AggAggAAh2h2 Ah?h>Ah?k'BAm<m< An+nAn&n&An+o3DBt4tCAw.w-Bt4w. Aw;w8Bt4w:Aw;w;B0Bt4{)Bt4{-A|{?Bt4| A|| Bt4|A||B+Bt4~; ABt4 B@ &B@@Bt4@B@ @ D#Bt4D0A"BFFBt4F3BG GBt4GBG G B.Bt4I83BJ,J+Bt4J, BJ;J8Bt4J:BJ;J;BBt4MBBO)O(Bt4O) BPO3BPPBt4PBPPBBt4RA4BTTBt4T BT?TBT:T5Bt4T:BT?T?Bt4U1BWU5BVVBWV BWVBV<V7BWV<BWWBWWBt4W BW5WBW0W+Bt4W0BW5W5Y:Bt4q0A!BssBt4s BtsBs=s8Bt4s=BttBt4tBt4t4 CD"uCBxxCDx Bx,x)CDx+Bx,x,CDy B}-y(%Bzz B}-z BzzB}-zBzzCB}-},CD}-'B~~CD~B~~A-CD@ACAACDA CAACDACAABCDCCD%C1CDDCD"DCD%DCD"D"CD%D%CD<ctt|ddddrNt||5|cdddS#1swxYwY|S)uSession-info block for the auto-reset notice, profile-scoped. When multiplexing, resolve model/provider/context inside the profile serving ``source`` — otherwise the banner advertises the base config's model while the session actually runs on the profile's (#59003). Mirrors ``_run_agent``'s gating so single-profile gateways never enter the scope. Call via ``asyncio.to_thread`` from async handlers: under the scope, resolution can do blocking work (credential refresh, context-length HTTP probes) that must not run on the event loop. The scope is entered inside this method, so contextvars behave correctly in the worker thread. rzNrF)rVrr_format_session_inforXs r>rzz(GatewayRunner._reset_notice_session_infonIs 744002F N N 3'(M(Mf(U(UVV 3 30022 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3((***sA$$A(+A(c^ddlm}m}t}d}d}d}d}d}d} d} d} d} t } | r| di} t | tr| dp| d} | d}|( t|}n#ttf$rYnwxYw| dpd}| dpd}|} |} dd l m }|| }n%#t$r| d }YnwxYwn#t$rYnwxYw t}|dp|}|dp|}|d }n#t$rYnwxYw|, dd lm}|| || || |rd}n#t$rd}YnwxYw|.|r,|r* dd l m}||||}|r|}n#t$rYnwxYw|||pd|pd||pd|}|d}n ||krd}nd}|dkr |dz dd}n|dkr |dzd}nt%|}d|dd|pdd|d|dg}|r$d |vsd!|vsd"|vr|d#|d$|S)%aResolve current model config and return a formatted info block. Surfaces model, provider, context length, and endpoint so gateway users can immediately see if context detection went wrong (e.g. local models falling to the 128K default). r)get_model_context_lengthDEFAULT_FALLBACK_CONTEXTNrrJr|rrrrr)should_clear_context_pinrrrrrzu:default — set model.context_length in config to overridedetectedi@BrFMiKu ◆ Model: `ru◆ Provider: openrouteru ◆ Context: z tokens (r localhostz 127.0.0.1z0.0.0.0u◆ Endpoint: r)rrFrGrrsrvrtrurhrwrjrrr2rrrHrrwrrf)rrFrGrrrrr custom_provsrconfigured_modelconfigured_providerconfigured_base_urlrraw_ctxrrrHr custom_ctxr| ctx_source ctx_displayrqs r>rDz"GatewayRunner._format_session_infoIsf \[[[[[[[&(( $ "" '))D @ HHWb11 i.. 3'0}}Y'?'?'Y9==QXCYCY$'mm,<==G*!47LL11 ):6!!! D!(}}Z88@DH(}}Z88@DH*2'*2'@QQQQQQ#B#B4#H#HLL @@@#'88,>#?#?LLL@    D  355G{{:..:(H{{:..:(Hkk),,GG    D  ! , -NNNNNN++$'' 1-1) - - -(,%%% - ! (\ (h ( PPPPPP??%%1 7,6)    21 ^Mr"7^)     ! ,!JJ 7 7 7UJJ#J Y & &+i7>>>>KK u $ $+u4777KKn--K $5 # # # 7X5 7 7 ?K ? ?* ? ? ?   600K84K4Ky\dOdOd LL4(44 5 5 5yysArdz4GatewayRunner._check_slash_access..Js(BBGGGBBBBBBrMrr rz . Use /whoami for the full list.zNo slash commands are enabled for non-admins on this platform. Ask an admin to add you to allow_admin_from or to set user_allowed_commands.u⛔ /z is admin-only here. )gateway.slash_accessrXrzrcan_runrr3rzrrr user_allowed_commandsrfr7)rr(rV_policy_for_sourcerZ allowed_previewrs r>r z!GatewayRunner._check_slash_accessIs/ QPPPPP 4##DK88~  !N!N 4 Z %+_ =FO ! !# N    !!=>>  ))BB_SbS-ABBBBBC00255552?55 F3  D}CC6CCCrMown_keyc t|dd}t|dd}|r|sgS|jj}t|ddpd}dd||t |t |g}g}|D]K\} } | |kr | t us| s| |ks| |dzr|| L|S)uFind running-agent keys for OTHER participants in the same thread. Only applies when the message originates in a thread. In per-user thread mode (``thread_sessions_per_user=True``) each participant gets an isolated session key of the form ``agent:main:{platform}:{chat_type}:{chat_id}:{thread_id}:{user_id}``, so a run started by another user is invisible to the caller's own ``/stop``. This returns the keys of any *actually running* agents (not the pending sentinel, not the caller's own key) whose key shares the caller's ``{chat_id}:{thread_id}`` prefix. Returns an empty list when the source is not in a thread, or when no sibling runs exist — callers must still gate on authorization. rNr2rrrz agent:main) rVrrrfrwrOrr!r) rr(r_rr2rrrmatchesrrs r>_sibling_thread_run_keysz&GatewayRunner._sibling_thread_run_keys-JsFK66 &)T22  I?(FK66<"  8YG c)nn M  3355 $ $JCg~~///u/f}}v| < <}s###rMcT||jdS|jdS|jjdS |jjj}n#t$rYdSwxYw|dkrdS t dz }|sEt|ddr2tjt|ddz dkr d|_ d SdStj | d }n#t$rYdSwxYw| d |krdS| d }t|tsdS|j|krdSt|ddr d|_ d S| d}t|tt frtj|z dkrdSd S)ajReturn True if this /restart is a Telegram re-delivery we already handled. The previous gateway wrote ``.restart_last_processed.json`` with the triggering platform + update_id when it processed the /restart. If we now see a /restart on the same platform with an update_id <= that recorded value, it is a redelivery when this process booted from that restart. Otherwise the marker must still be recent (< 5 minutes). Only applies to Telegram today (the only platform that exposes a numeric cross-session update ordering); other platforms return False. NFrYz.restart_last_processed.jsonrrr@rTrQrr update_idr r)r(platform_update_idrrr2rlrrVrUrr3r4rXrvrtrhri)rrr>r r recorded_uidr s r>_is_stale_restart_redeliveryz*GatewayRunner._is_stale_restart_redeliveryWJs =EL05  # +5 < (5 "\28NN   55  Z ' '5 &)GGK%%'' D"8%@@  gdOS&I&IIBNN05D-4u:k33W3EEFFDD   55  88J  > 1 15xx ,, ,,, 5  #l 2 25 4/ 7 7 (-D %4 xx// lS%L 1 1 y{{\)C//uts(6 AAAC3(C C*)C*c"K|pd}|j}d} t|jddpt t|ddpd}t|dd}|r4|r2|t |t|ddt|ddd}n#t $rd}YnwxYw d d lm}|||d S#t $r*}t d |d|cYd}~Sd}~wwxYw)zHandle /suggestions in the gateway. Delegates to the shared handler so CLI and gateway never drift. The origin is built from the event source so an accepted suggestion's job delivers back to this chat/thread. rNrrr2r*rrr2r*rr)handle_suggestions_commandr9r3 r zsuggestions command failed: %szSuggestions command failed: ) rd rxr(rVrrwr2hermes_cli.suggestions_cmdrjr3r4) rrrr(r3 rr2rjrs r>rz)GatewayRunner._handle_suggestions_commandJsl&&((.B5577 v>>l#gfV`bdFeFeFkikBlBlHfi66G G  ("7||!(d!C!C!(d!C!C     FFF  6 M M M M M M--d69UUU U 6 6 6 LL91 = = =5!55 5 5 5 5 5 5 6s0A=B33 CCC D$D D Dc@K|pd}|j}d} t|jddpt t|ddpd}t|dd}|r4|r2|t |t|ddt|ddd}n#t $rd}YnwxYw d d lm}|||d S#t $r9}t d |d dlm } | d|cYd}~Sd}~wwxYw)a Handle /blueprint in the gateway. Delegates to the shared handler so CLI, TUI, and gateway never drift. Returns a BlueprintCommandResult: ``text`` is shown to the user, and if ``agent_seed`` is set the dispatch site rewrites ``event.text`` to the seed and falls through to the agent (the ``/steer`` pattern) so the agent gathers the slot values conversationally. Origin is built from the event source so a directly created blueprint job delivers back to this chat. rNrrr2r*rrir)handle_blueprint_commandr9rkzblueprint command failed: %s)BlueprintCommandResultzCron blueprint command failed: ) rd rxr(rVrrwr2hermes_cli.blueprint_cmdrnr3r4ro) rrrr(r3 rr2rnrros r>rz'GatewayRunner._handle_blueprint_commandJs&&((.B5577 v>>l#gfV`bdFeFeFkikBlBlHfi66G G  ("7||!(d!C!C!(d!C!C     FFF  Q I I I I I I++DSSS S Q Q Q LL7 ; ; ; G G G G G G))*OA*O*OPP P P P P P P  Qs0A=B33 CCC D$.DDDc` t|jtr|jpidint |jdipi}|s'ddlm}|pidpi}t|ddpdS#t$rYdSwxYw)a%Resolve the configured /goal turn budget for gateway sessions. GatewayRunner.config is a GatewayConfig dataclass, not the full user config mapping. Top-level config blocks such as ``goals`` are therefore only available through hermes_cli.config.load_config(). goalsrrcrr ) rtrzrurvrVrrdrhr2)r goals_cfgrds r>_goal_max_turns_from_configz)GatewayRunner._goal_max_turns_from_configJs dk400="''444T['266<"   E999999([]]0b55g>>D" y}}["55;<< <   22 sBB B-,B-cK ddlm}n3#t$r&}td|Yd}~dSd}~wwxYw |j|jd{V}n3#t$r&}td|Yd}~dSd}~wwxYwt|ddpd}|sdS| }||| |fS) zReturn a GoalManager bound to the session for this gateway event. Returns ``(manager, session_entry)`` or ``(None, None)`` if the goals module can't be loaded. rr0 zgoal manager unavailable: %sNrTz'goal manager: session lookup failed: %srNrrNdefault_max_turns) r2 r1 r2r3r4r8 r r(rVrt)rrr1 r<r\sidrs r>_get_goal_manager_for_eventz)GatewayRunner._get_goal_manager_for_event Ks%   4 4 4 4 4 4 4    LL7 = = =:::::  "&":"P"PQVQ]"^"^^^^^^^MM    LLBC H H H::::: m\488>B :4466 {cYGGGVV' ;6;%A%% B/BBczK ddlm}n3#t$r&}td|Yd}~dSd}~wwxYw |j|jd{V}n3#t$r&}td|Yd}~dSd}~wwxYwt|ddpd}|sdS|| |fS) zReturn a HeartbeatManager bound to the session for this event. Returns ``(manager, session_entry)`` or ``(None, None)``. rHeartbeatManagerz!heartbeat manager unavailable: %sNrTz,heartbeat manager: session lookup failed: %srNrr~) hermes_cli.heartbeatr}r2r3r4r8 r r(rV)rrr}r<r\rxs r> _get_heartbeat_manager_for_eventz.GatewayRunner._get_heartbeat_manager_for_eventKs   = = = = = = =    LLB :3///>>rzctt|dd}| i}||_||f||<|dS)uTrack a session with an active heartbeat and start the poller. The registry maps ``quick_key`` → ``(source, session_id)`` so the poller can rebuild a MessageEvent and enqueue via the adapter FIFO. In-memory by design: heartbeat STATE survives restarts in SessionDB, but firing resumes when the user touches /heartbeat again in the new gateway process (documented; durable schedules belong to cron). _heartbeat_watchN)rVr_start_heartbeat_poller)rr- r(rNwatchs r>_register_heartbeat_watchz'GatewayRunner._register_heartbeat_watch3KsO0$77 =E$)D !"J/i $$&&&&&rMc\t|dd}|r||ddSdS)Nr)rVrU)rr- rs r>_unregister_heartbeat_watchz)GatewayRunner._unregister_heartbeat_watchCKs@0$77  ' IIi & & & & & ' 'rMctdd}||sdSddlmfd} t j|}|_tdd}|1||||j dSdS#t$r t dd YdSwxYw) z?Start the single gateway-wide heartbeat poll task (idempotent)._heartbeat_poll_taskNr) POLL_SECONDSc|K tj d{Vt dd}|s/t|D]\}\}} | jvrddlm}||}|s| |dP| }|sg |}|t|tj|dd} |||#t $r&} t"d|| Yd} ~ d} ~ wwxYw9)NTrrr|r~rrr(rjrz heartbeat poll for %s failed: %s)rrrVrrr7r~r} has_heartbeatrU due_promptr@rrrsr r r2r3r4) rr- r(rNr}mgrrY r1hb_eventr<rrs r> _poll_loopz9GatewayRunner._start_heartbeat_poller.._poll_loopPKs YmL111111111&8$??7;EKKMM7J7JYY3I3 Y$(<<<$IIIIII..*EEE"0022%!IIi666$!$!1!1%%$"&":":6"B"B"?$#/!')4)9#)'++/ $$$**9hHHHH$YYY %GTWXXXXXXXXY= Ys0 D 'rz%GatewayRunner._start_heartbeat_pollerHKs4!7>>     F555555 Y Y Y Y Y YD L&zz||44D(,D %$ 3T::C &&s{33333 L L L LL;dL K K K K K K LsA%B""&C  C r$cK||}|s,tdt|dddS ||}n#t $rd}YnwxYw||j||d{V}|=t|dds.tdt|dd dSdSdS) zCSend a /goal judge status line back to the originating chat/thread.$goal continuation: no adapter for %srNr.r/T)goal continuation: status send failed: %srPr) r@r3r4rVr r2r0r2r)rr(r$r1rrs r>_send_goal_status_noticez&GatewayRunner._send_goal_status_notice~Ks **622  LL?Q[]aAbAb c c c F 77??HH   HHH ||FNGh|OOOOOOOO  gfi&F&F  NN;99         sA A,+A,cHK}|s,tdtdddSd fd } }n#t $rd}YnwxYw|rt |dr d}t|di|}|t|dd}|||| dS#t $r%}td |Yd}~nd}~wwxYw|d{VdS) a Send a /goal status line after the main response is delivered. The gateway message handler returns the agent response to the platform adapter, which sends it after this method's caller has returned. For a natural Discord/Telegram reading order, goal status belongs after that send. Platform adapters provide a one-shot post-delivery callback for exactly this boundary; when unavailable, fall back to direct awaited delivery rather than silently dropping the notice. rrNr-cK d{VdS#t$r(}td|dYd}~dSd}~wwxYw)NrTr)rr2r3r)r<r$rr(s r>_deliverzHGatewayRunner._defer_goal_status_notice_after_delivery.._deliverKs `33FGDDDDDDDDDDD ` ` `JCZ^_________ `s# AAAr=_active_sessions_hermes_run_generationr>zAgoal continuation: post-delivery callback registration failed: %sr) r@r3r4rVrAr2rrvr=) rr(r$r1rr+r?rr<s ``` r>(_defer_goal_status_notice_after_deliveryz6GatewayRunner._defer_goal_status_notice_after_deliveryKs**622  LL?Q[]aAbAb c c c F ` ` ` ` ` ` ` `  66v>>KK   KKK   g77,MNN g g!  *r'z*GatewayRunner._post_turn_goal_continuationKs"  4 4 4 4 4 4 4    LLJC P P P FFFFF m\488>B  F4466 kSIFFF}}  F  R R R R R R" II   III **  b!*+   ll9%%+  M6%??LL L L L L L L L||-..  F344:  F G..v66G55f==J D: D)!,!1!##'  "":z7CCCCC D D D D G G G LL@# F F F F F F F F F Gs; ;6; B B-,B-6A#F G)G  Gct|dd}|dSt|dr|jrt|jSt|dr|jr |jjSdS)z5Extract Discord guild_id from the raw message object.r{ Nguild_idguild)rVrrrhrr)rrxs r> _get_guild_idzGatewayRunner._get_guild_id Lste]D11 ;4 3 # # %  %s|$$ $ 3  SY 9< trMcdK|j}t|dsdS|}|sdS|||jjd{V}|sdSt|dr j|_t|dr j|_ t|dr fd |_ | |d{V}n#t$rs}td |d|_t|}d |vsd |vsd |vrdt"jdcYd}~Sd|cYd}~Sd}~wwxYw|rt'|jj|j|<t|dr!|j|j|<dj|jj|jj<||jjdd|jdSd|_dS)z.Join the user's current Discord voice channel.join_voice_channelz2Voice channels are not supported on this platform.z,This command only works in a Discord server.Nz(You need to be in a voice channel first.rb _on_voice_disconnect_voice_mode_gettercjtjt |dS)Nr)rrvrrrrw)r2rs r>rz:GatewayRunner._handle_voice_channel_join..5Ls69I9M9M 0#g,,??::rMz Failed to join voice channel: %spynaclnacldaveyz@Voice dependencies are missing (PyNaCl / davey). Install with: `z -m pip install PyNaCl`zFailed to join voice channel: _voice_sourcesrT)rzJoined voice channel **zL**. I'll speak my replies and listen to you. Use /voice leave to disconnect.zFFailed to join voice channel. Check bot permissions (Connect + Speak).)r@r(rrget_user_voice_channelrr rb _handle_voice_timeout_cleanuprrrr2r3rrwryrrrhr2_voice_text_channelsto_dictrrrrrrr)rrr1r voice_channelr/r err_lowers` r>_handle_voice_channel_joinz(GatewayRunner._handle_voice_channel_joinLs**5<88w 455 HGG%%e,, BAA%<< el*         >== 73 4 4 M,0,LG ) 72 3 3 N+/+MG ( 70 1 1 ****G & 8#66}EEEEEEEEGG 8 8 8 NN=q A A A,0G )A I9$$)(;(;w)?S?SN&)nNNN8A77 7 7 7 7 7 7 8  589M5N5NG ( 2w 011 J38<3G3G3I3I&x0]bD T__U\-BELDXYY Z  " " $ $ $  . .w 8LVZ . [ [ [\-*<\\\  )-%WWs+C"" E,AE EEEEczK||j}||}|rt|dsdSt|dr||sdS ||d{Vn2#t $r%}td|Yd}~nd}~wwxYwd|j | |jj |jj <| |||jj dt|d rd|_d S) z Leave the Discord voice channel.leave_voice_channelzNot in a voice channel.is_in_voice_channelNzError leaving voice channel: %srTrjrb zLeft voice channel.)r@r(rrrrr2r3rrrrr2rrrb )rrr1rrs r>_handle_voice_channel_leavez)GatewayRunner._handle_voice_channel_leaveULsp**5<88%%e,, -ww0EFF -,,w 566 -g>Y>YZb>c>c -,, A--h77 7 7 7 7 7 7 7 7 A A A NN @TUUV     ++GU\5ITX+YYY 73 4 4 1,0G )$$s.B B9B44B9cd|j|tj|<||jtj}|||ddS)zCalled by the adapter when a voice channel times out. Cleans up runner-side voice_mode state that the adapter cannot reach. rTrN)rrrrrrrvr)rr2r1s r>rz+GatewayRunner._handle_voice_timeout_cleanuplLso HM)97CCD    -##H$455 ++GWt+LLLLLrMrrrc ddlm}tjdd|}tjdd|}|sdSt j d ||f}t|d d }t|ts i}||_ fd | |gD}|D]d\} } | |kr|||<d St| d kr>t|d kr+|d | |dkr|||<d Se| |f|dd ||<dS)arSuppress repeated STT outputs for the same recent utterance. Voice capture can occasionally emit the same utterance twice a few seconds apart, which creates a second queued agent run and overlapping spoken replies. Dedup exact and near-exact repeats per guild/user over a short window while allowing genuinely new turns through. r)SequenceMatcher\s+rz[^\w\s]rFg(@rNc0g|]\}}|z k||fSrNrN)rbrtxtrrs r>rz@GatewayRunner._is_duplicate_voice_transcript..Ls:   CRx>))I)))rMTr r2)difflibrr_rrxryrUrrVrtrurrvr7ratior) rrrrrrHr recent_storerecentrKpriorrrs @@r>_is_duplicate_voice_transcriptz,GatewayRunner._is_duplicate_voice_transcriptvLs ,+++++VFC44::<<BBDD VJJ77  5n!t%@$GG ,-- :L-9D *     '++C44      HAu ""$* S!tt5zzRC OOr$9$9"?4 ;;AACCtKK(.L%44 sJ'((("233K SurMc *K|jtj}|sdS|j|}|sdSt |di|}|r=t j|}t||_ t||_ nEt tjt|t|t|d}| |st d|dS||||r'td|||dddS |j|}|rS|ddd d d d } |d |d| d{Vn#t($rYnwxYwddlm} d} t |dd} t/| rE | t|} t1| tr| nd} n#t($rd} YnwxYwt3||t4j| |d| }||d{VdS)zHandle transcribed voice from a user in a voice channel. Creates a synthetic MessageEvent and processes it through the adapter's full message pipeline (session, typing, agent, TTS reply). Nrchannel)rr2rr)rz/Unauthorized voice input from user %d, ignoringz?Suppressing duplicate voice transcript for guild=%s user=%s: %srv z @everyoneu @​everyonez@hereu@​herez**[Voice]** <@z>: r)SimpleNamespace_resolve_channel_prompt)rr)r(rrr{ r)rrvrrrrVr[ from_dictrwrr)r r3r4rrz_client get_channelrlr0r2typesrr/rtrrrsrr )rrrrr1 text_ch_id source_datar(r safe_textrrresolverrers r>r z)GatewayRunner._handle_voice_channel_inputLs-##H$455  F155h??   Fg'7<<@@JJ  ",[99F \\FN"7||F  "!)JG g,,# F''//  LLJG T T T F  . .x* M M  KKQ4C4     F o11*==G M&uu-55kCTUU]]^egtuu ll#KG#K#K #K#KLLLLLLLLL    D  *))))))-7$=tDD H   & &#8C OO44-7#-F-F!PD & & &!% &$*'FFF)    $$U+++++++++++s%"A/G GG 1H== I  I rJrrdc^|r|drdS|jj}||jj|}|j|}|jtj k}|j |jj} d} | rFt| dr6 t| |} n#t$rd} YnwxYw|dkp |dko|p|duo| } | s/td|| ||jjjdSd} t%t'|D]5\} }|dd krt)|d z | z } n6| || dn|}t+d |D}|rdS|r|sdSd S) aDecide whether the runner should send a TTS voice reply. Returns False when: - voice_mode is off for this chat - response is empty or an error - agent already called text_to_speech tool (dedup) - voice input and base adapter auto-TTS already handled it (skip_double) UNLESS streaming already consumed the response (already_sent=True), in which case the base adapter won't have text for auto-TTS so the runner must handle it. zError:F_should_auto_tts_for_chatrrNzIAuto voice reply skipped: mode=%s adapter_auto_tts=%s chat=%s platform=%srrr(c3K|]K}|ddko-td|dpgDVLdS)rrc3rK|]2}|dpiddkV3dS)r-rrNrr)rbtcs r>rdzCGatewayRunner._should_send_voice_reply...'Ms[ ##)r..v66:JJrMrN)rvr )rbrs r>rdz9GatewayRunner._should_send_voice_reply..%Ms   GGFOO{ * 77<006B      rMT)r!r(r2rrrrvrrsrrrrrr2r3r4rrrr7r )rrrJrrdr2 voice_key voice_modeis_voice_inputr1adapter_auto_ttsshould last_user_idxrr turn_messages has_agent_ttss r>rz&GatewayRunner._should_send_voice_replyLs6$ 8..x88 5,&OOEL$97CC %)))44 , 0AA-##EL$9::   )ww(CDD ) )#'(I(I'(R(R#S#S   ) ) )#(    )5  9l*=~ 9 d"7'7   LL[,gu|7L7R   5  8 899 C CFAswwv&(( #N 3 3a 7! ; UU):G:S}~~66Yg   %        5  , 5ts."C C C cHtt|jddS)zFReturn whether inbound voice/STT transcripts should be echoed to chat.stt_echo_transcriptsT)rrVrzrNs r>rz*GatewayRunner._should_echo_stt_transcripts:MsGDK)?FFGGGrMrcKd}g} ddlm}m}||}|s4 |h|dhz D]'} tj|#t $rY$wxYwdSt |jj}tj |||d{V} tj | } nu#tj tf$r\td| r | ddn| Y|h|dhz D]'} tj|#t $rY$wxYwdSwxYw| dp| d|g}d |D}| d r|sbtd | d  |h|dhz D]'} tj|#t $rY$wxYwdS||j} ||} t)| d d} t)| dd}t)| dd}t+| o(t-| ot-|o || }||}||j|}|s*t-|r|t3|}d|d<nddi}|D]}|r@t5t6dt8t:f| }|| |d{VDt-|rLt5t6dt8t:f|}|jj|||d}|di|d{Vn4#t>$r'}td|dYd}~nd}~wwxYw|h|dhz D]'} tj|#t $rY$wxYwdS#|h|dhz D]'} tj|#t $rY$wxYwwxYw)zEGenerate TTS audio and send as a voice message before the text reply.Nr)r_strip_markdown_for_tts)r output_pathz.Auto voice reply TTS returned invalid JSON: %sr file_pathsrU cng|]2}|tj|#t|3SrN)rrisfilerwrn s r>rz3GatewayRunner._send_voice_reply.._MsJ"GNN400D rMr/zAuto voice reply TTS failed: %srPplay_in_voice_channelr send_voiceTrv.)r2 audio_pathrrzAuto voice reply failed: %srrN) tools.tts_toolrrrrurrvr(rrrr3r4rrwr3rrvr@rrVrr/rur rurr rr r2r2)rrrr actual_pathsrrtts_textr; result_jsonrr1rrrrin_voice_channelr r actual_path play_voicesend_voice_call send_kwargsrs r>rzGatewayRunner._send_voice_reply>Ms "$ U  S S S S S S S S..t44H X"1L1TF:  IaLLLLD  K4EL4IJJJ ' 1#( !!!K K00()4   OfqRCQ\]a^a]aQbQbxCDDDx"1L1TF:  IaLLLLD  } "::l33 ; 338L&2L::i((   @&**WBUBUVVV\"1L1TF:  IaLLLLD  Y..u|<>L::5<VVK# 3(<(< 3*"&{"3"3K,0K))#+T"2K+ 9 9 # 9!%hsIcN/B&CEZ![![J$*X{;;;;;;;;;;j))9&*8C34G+H*&U&UO#(<#7&1$0$/ 33K */88K888888888 9 L L L NN8!dN K K K K K K K K L"1L1TF:  IaLLLLD  z1L1TF:  IaLLLLD sM? A  A 6MBM=DM'C<< D D DBMF11 F>=F>FMO N &NON  ON11 N>=N> O6O%$O6% O2 /O61O2 2O6thread_metadatacHKddlm}ddlm d|v}ddlm}m}||\} } |j| } | | |t|n-| |j | |} hd} hd} g}g}| D]\\}}||j}|| vr|s|s||E|||f]|rp fd |D}||j j|| d{Vn8#t&$r+}t(d |j|Yd}~nd}~wwxYw|D]\}} ||j}||j j|| r)||j j|| d{VnU|| vr)||j j|| d{Vn(||j j|| d{V#t&$r+}t(d|j|Yd}~d}~wwxYwdS#t&$r&}t(d|Yd}~dSd}~wwxYw)uExtract explicit MEDIA: tags from a response and deliver them. Called after streaming has already sent the text to the user, so the text itself is already delivered — this only handles file attachments that the normal _process_message_background path would have caught. Unlike the non-streaming path in ``gateway/platforms/base.py`` (which also auto-detects bare local paths via ``extract_local_files``), this post-stream rescan is EXPLICIT-ONLY. The visible reply has already been streamed verbatim, so a bare path string here was either (a) already shown to the user as text, or (b) stale tool/inspected content that was never part of the intended visible reply. Promoting such paths into uploads after the fact sent files the model never asked to deliver (#20834). Only ``MEDIA:`` directives — the explicit attachment contract — trigger post-stream uploads. rr)r rL)rGshould_send_media_as_audioN.3gp.avi.mkv.mov.mp4.webm.gif.jpg.png.jpeg.webpc0g|]}d|dfS)zfile://rrN)rbr;_quotes r>rz>GatewayRunner._deliver_media_from_response..Ms/OOOa444b9OOOrM)r2imagesrz0[%s] Post-stream image batch delivery failed: %s)is_voicer2rrr2 video_pathrr2rU rz*[%s] Post-stream media delivery failed: %sz'Post-stream media extraction failed: %s)pathlibr urllib.parser r rGrrHfilter_media_delivery_pathsextract_imagesrur r(rurryrsend_multiple_imagesr2r2r3rrrr send_video send_document)rrJrr1rrforce_document_attachmentsrGrrJrM _thread_meta _VIDEO_EXTS _IMAGE_EXTSrnon_image_media media_pathr r r rr s @r>rz*GatewayRunner._deliver_media_from_responseMsH. !     000000Y I *;h)F & ^ ^ ^ ^ ^ ^ ^ ^#*#8#8#B#B KI-I+VVK  " "7 + + +#._%%%55L0077 LKKKDDDK !#K$&O(3 C C$ Hd:&&-3355;&& (' :' &&z2222#**J+ABBBB hhOOOO;OOOF!66 % 4%!-7 !hhhNN#UW^Wcefggggggggh)8 b b$ Hb$z**17799C11%,2GW_```%00$)L$8'1%11  ++%00$)L$8'1%11 &33$)L$8&0%14 !bbbNN#OQXQ]_`aaaaaaaab+ b b0 I I I NNDa H H H H H H H H H IsmC5I16D>=I1> E3!E.)I1.E33 I1>B8H76I17 I,!I'"I1'I,,I11 J!;JJ!rr:text_already_delivered deliver_mediacK|s5t||}|r#||j||d{V|sdStd||} ||| ||d{VdS)zADeliver a queued response using the normal text+attachment split.r.Nr)rr(rj)r)rNr0r2rrr) rrJr(r1rr:rr text_contentr s r>_deliver_queued_first_responsez,GatewayRunner._deliver_queued_first_responseNs& FxQXYYL llN %#  F&'    //   $ 0           rMrY r[r'rrc BKtt|dddds |||||||d{VS||}t|5|||||||d{VcdddS#1swxYwYdS)a>Profile-scoping wrapper around the background agent task. When multiplexing is active, resolve the inbound source's profile and run the whole task inside ``_profile_runtime_scope`` so credentials resolve from that profile's secret scope. Mirrors the pattern in ``_run_agent``. rzNrF)rV_run_background_task_innerrr)rrY r(r'r:rrrs r>_run_background_taskz"GatewayRunner._run_background_task5Ns3 wtXt446JERR 88)9:{ <r!z:GatewayRunner._run_background_task_inner..run_syncNsg$W- +/{;;$2>  $t  %*E &6%5'8&7&6%5"&!3!3'1nn5H&I&I&I')ffVnnn')ffX&6&6&6%'FF7OOO#%&&... 137KU0S0S0S!".0VV4E-F-F-F#$ 'w%&*\'(#NN)*!' 2 2+,%..-.#NN/0%..12%..34%..56 't'7@PQQQ7:$(#?#?#A#A#A;>9 11%4 '2 11%8888D11%8888s E::FrrPzError: r rru&✅ Background task complete Prompt: "z" r z(No response generated))r2rqcaptionr)rrrr(r r)r2 image_pathrrz" (No response generated)zBackground task %s failedz failed: ).r rr@r3rrr rsrrvr0r2ruhermes_cli.tools_configr(r rrrrrrrrr7r!rrr2rc rHr rGrr send_imagerrrrryrrsend_image_filerr)-rrY r(r'r:rrr1_thread_metadatarrr(rrrrrrr!rrJrJrGr r!rheaderrqalt_text_should_send_media_as_audiorrrrFrrrrr*rr?rrrrAs-` `` @@@@@@@@@@r>r$z(GatewayRunner._run_background_task_innerPNs%  &%%%%%%2 !'R **622  NNMv`g h h h F;;FDTUUv .00K$($G$G'%H%% !E>"%%i00 llN`7```-# /@@L C C C C C C%&9&9+|&T&TUU #006BI ) .A B B Jd 'B466N#EEU F   &6D "!%!C!C6!C!R!RD 88WWJ%O Z (4411GAt./#k2B2B.B.BKNNE''111#**4000ZZ040P0P"K11++++++%ZZZ'UWXYYYYYYYYZ& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9P ==hGGGGGGGGF;AIvzz"2B777rH 7 76::g+>+> 76VG_66M (/(=(=h(G(G% XFFFFFFM1MkZZ '.'='=h'G'G$  "+#f++2B2BKQ7QQQ !,, & & 5!1'   !,, & &)B B!1'-3Lb  'Ix%00$*N&/$,%5 1 % IHH OOO .9.?R)J 7++J77:@@BBD66viXX")"4"4(.+5)9#5## "[00")"4"4(.+5)9#5## "[00")"9"9(.+5)9#:## #*"7"7(.*4)9#8## %7<!"+#f++2B2BKll"Nkgkkk-#       8' B B B ll"NH7HHQHH-#        s/A$TD*THT I 'ITI  D:T$N,+T, N96T8N99AT B)R54T5 S?TSTA T VU>8)U"!U>" U/,U>.U//U>>VcbK||}t|dd}|t|dsddiS |d{Vn0#t$r#t ddddicYSwxYwd tffd }d|d |d d S)z?Read Telegram private-topic capability flags via Bot API getMe._botNget_mecheckedFz1Failed to fetch Telegram getMe topic capabilitiesTrrct|rt|Stdd}t|tr||vr||Sttr|SdS)N api_kwargs)rrVrtrurv)rr9mes r>_fieldz>GatewayRunner._get_telegram_topic_capabilities.._field0Osr4   )r4((( \488J*d++ , 0B0B!~~d+++"d## $vvd||#4rMhas_topics_enabledallows_users_to_create_topics)r7r<r=)r@rVrr6r2r3r4rw)rr(r1botr;r:s @r> _get_telegram_topic_capabilitiesz.GatewayRunner._get_telegram_topic_capabilities$Os**622gvt,, ;gc844;u% % &zz||######BB & & & LLLW[L \ \ \u% % % % &       "(&)=">">-3V4S-T-T   sA*B B cHK||}||jsdSd}t|dd}t|rR |t |jdd{V}n,#t $rt ddYnwxYw|sdSd} ||jddt|i d{V}t|d d}n,#t $rt d dYnwxYw|sdSt|d d}|t|d sdS | t |jt |dd{VdS#t $r t ddYdSwxYw)zJCreate/pin the managed System topic after /topic activation when possible.N_create_dm_topicSystemz&Failed to create Telegram System topicTrz,System topic for Hermes commands and status.rr.rjz*Failed to send Telegram System topic intror5pin_chat_message)r2rjdisable_notificationz)Failed to pin Telegram System topic intro) r@r2rVr/rhr2r3r4r0rwrrC)rr(r1r create_topicrj send_resultr>s r>_ensure_telegram_system_topicz+GatewayRunner._ensure_telegram_system_topic@OsU**622 ?&.? F w(:DAA L ! ! V V".,s6>/B/BH"M"MMMMMMM  V V V EPT UUUUU V  F  V ' >%s9~~6!-!!K !lDAAJJ V V V LLEPTL U U U U U V  Fgvt,, ;gc+=>>; F U&&FN++z??%)'           U U U LLDtL T T T T T T Us7$A++&BBAC""&D  D 8=E77&F! F!c K||}||jrt|dsdSttjdz dz }|sdS ||jt|d|j rdt|j indd{VdS#t$r t dd YdSwxYw) zFSend the bundled BotFather Threads Settings screenshot when available.Nr/assetsz'telegram-botfather-threads-settings.jpgu/BotFather → Bot Settings → Threads Settingsr)r2r,r+rz)Failed to send Telegram topic setup imageTr)r@r2rrrrrrr/rwrr2r3r4)rr(r1r,s r> _send_telegram_topic_setup_imagez.GatewayRunner._send_telegram_topic_setup_imageiOs4**622 ?&.?IZ8[8[? F(^^++--4x?Bkk   ""  F U))z??IAGAQ[+s6+;'<'<==W[ *           U U U LLDtL T T T T T T Us;AC &C54C5rctjddt|pd}|sdSt |dkr|dddz}|S) zFReturn a Bot API-safe forum topic name from a generated session title.rrr Hermes Chatr Nur)r_rrwrxr7rrrrMs r>_sanitize_telegram_topic_titlez,GatewayRunner._sanitize_telegram_topic_title{Osp&c%+2&6&677==?? ! = w<<#  dsdm**,,u4GrMc|jtjkoZ|jdkoOt t |ddo1t |jot t |ddS)z>Return True only for Discord threads Hermes just auto-created.rauto_thread_createdFauto_thread_initial_nameN)rrrrrrVrrXs r>rz*GatewayRunner._is_discord_auto_thread_laneOs{ Ox/ / H H, HWV%:EBBCC HV%&& HWV%?FFGG  rMc|jtjko7t|jo#|j o|jdvot|ddduS)aTShape-only check: a relay-delivered Discord CHANNEL event whose reply the connector MAY auto-thread (title-turn registration gate). Deliberately does NOT consult the send-result cache: at registration time (before delivery) the feedback can't exist yet. The rename lane polls the cache at fire time instead.)rrdelivered_via_upstream_relayFT)rrrrr2rrrVrXs r>rz,GatewayRunner._is_relay_discord_channel_laneOsi Ox/ / OV^$$ O$$ O $88 O >FF$N  rMc|jtjks|jsdSt |ddsdSt |dd}|rt |dfS||}t |dd}t|sdS t|t |jS#t$rYdSwxYw)uT(thread_id, initial_name) when the RELAY connector auto-threaded our reply to this source's chat — the title-turn sibling of _is_discord_auto_thread_lane. The marker-based check above only lights up for events ARRIVING IN an auto-created thread (turn 2+). The auto-title fires on the FIRST exchange, whose source is the PARENT channel event — the thread did not exist at ingest, so no markers can be present and the native lane check never matches on the relay title turn (staging repro 2026-07-29: initial titles fine, semantic renames never happened). Preferred path: the connector stamps ``prospective_thread_id`` on the inbound (the anchor message id, which IS the id of the thread it will auto-create). It's deterministic and per-message, so it identifies the EXACT thread even when several auto-threads spawn from one channel — unlike the send-result cache below, which held a single slot per parent chat and so only the FIRST thread in a channel ever renamed (staging repro 2026-08-02: thread A renamed, sibling thread B stuck at raw text). The connector's own created-name guard (prefer_connector_created) enforces no-clobber, so no initial name is needed here. Fallback: the connector reports where the reply actually landed on the send result (contract §SendResult thread_id/auto_thread_name); the relay adapter caches it per chat and this reads it back — kept for older connectors that don't stamp prospective_thread_id. NrTFprospective_thread_idrauto_thread_info_for_chat) rrrr2rVrwr@r/rr2)rr( prospectiver1info_fns r>_relay_auto_thread_infoz%GatewayRunner._relay_auto_thread_infoOs: ?h. . .fn .4v=uEE 4f&=tDD  * $$b) )**622'#>EE   4 "773v~+>+>#?#?@@ @   44 s)B88 CCc^K||}||S||}t|dd}t|r|jsdSt ddpd} t |t|j|d{VS#t$rYdSwxYw)u``_relay_auto_thread_info``, waited out until this turn delivers. The legacy send-result path can only answer once the reply is sent, and the caller asks at title time — one turn early. The adapter answers on the send either way, so the timeout is only a backstop for a turn that never sends at all; the turn's own inactivity limit is exactly how long that turn could still be alive. Nwait_for_auto_thread_inforr ) rZr@rVr/r2rrrwr2)rr(knownr1wait_fnrs r>_await_relay_auto_thread_infoz+GatewayRunner._await_relay_auto_thread_infoOs,,V44  L**622'#>EE    43T::Bd "V^1D1Dg)N)N#N#N#N#N#N#NOO O   44 s-0B B,+B,ctjddt|pd}|sdSt |dkr%t |ddz}|S)aReturn a Discord-safe semantic thread title from a session title. Discord thread names are capped at 100 characters measured in UTF-16 code units (emoji count double), so truncate with the UTF-16 helpers rather than Python code-point slices. rrrrLrMr)r_rrwrxrxrtrrNs r>_sanitize_discord_thread_titlez,GatewayRunner._sanitize_discord_thread_titleOst&c%+2&6&677==?? ! = W   " "0"==DDFFNGrM relay_infoc.K|Vtj|j|d{Vs6||sdS||d{V}|dSt |ddr||nd}|dSt |dd}|dS|r|dnt|j}|du}|rdnt |dd} | |} |r|j rt|j nd} t d||rdnd|  ||| || | d{V} t d |t| dS#t$r td d YdSwxYw)uBest-effort semantic rename of a newly auto-created Discord thread. ``relay_info`` is the (thread_id, initial_name) pair from the relay connector's send-result feedback — supplied on the title turn, where the source is the parent-channel event and carries no auto-thread markers (see _relay_auto_thread_info). When absent, the native marker-based lane supplies thread identity from the source itself. Nr rename_threadrrRz:discord auto-thread rename: thread=%s lane=%s new_title=%rrelayr)prefer_connector_createdonly_if_current_namerz7discord auto-thread rename result: thread=%s applied=%sz@Failed to rename Discord auto-thread for generated session titleTr)rrrrr_rVr@rwrrbr2r3rzrr2r4) rr(rNrrcr1retarget_thread_iduse_connector_guard guard_namer rrenameds r>-_rename_discord_auto_thread_for_session_titlez;GatewayRunner._rename_discord_auto_thread_for_session_titleOsX  G,=  -v- - ' ' ' ' ' ' 66v>> #AA&IIIIIIIIJ!6=dJPT6U6U_$**6222[_ ? F$??  F,6Q:a==C@P SC   t   H * 8GG      l)M )<%/- G KKI W        l l l LL[fjL k k k k k k ls)?E**&FFcd}|sdS||s.||}|||sdS tj}n!#t $rt |dd}YnwxYw||rdS tj |}n#t$r|}YnwxYwt| |||||td}|dSdd}||dS) zJSchedule Discord auto-thread rename from the auto-title background thread.Nr)rcz1Discord semantic thread rename failed to schedulerr-c |dS#t$r tddYdSwxYw)Nz%Discord semantic thread rename failedTrrr2r3r4rs r>_log_rename_failurezSGatewayRunner._schedule_discord_semantic_thread_rename.._log_rename_failurezPsX U  U U U Dt TTTTTT U&AAr)rrZrrr! rrV is_closedrirlr2rrmr3r) rr(rNrrcr copied_sourcerrrs r>rz6GatewayRunner._schedule_discord_semantic_thread_renameNPs   F0088 55f==J!$*M*M++! 8+--DD 8 8 84$77DDD 8 <4>>++< F #'/77MM # # #"MMM #)  > >z5Z ?   K     > F U U U U   !455555s$ AA=<A=B.. B=<B=cKtj|j|d{Vr|jr|jsdS||rdS||}|tt|dd}t|r\ ||t|jt|j}n#t$rd}YnwxYwt|trdSt|dd}| |t|jt|jd{V}|r7t|dpdt|krdSn-#t$r t dd YdSwxYw|dS||} t|d d} | :| t|jt|j| d{VdSt|d d} | t| d dnd} | | t| ddnd} | dS | t'|jt'|j| d{VdS#t(t*f$r"| |j|j| d{VYdSwxYw#t$r t dd YdSwxYw)zLBest-effort rename of a Telegram DM topic when Hermes auto-titles a session.N_get_dm_topic_inforRrrNrz5Failed to verify Telegram topic binding before renameTrrename_dm_topic)r2rrr5edit_forum_topiceditForumTopic)r2message_thread_idrz8Failed to rename Telegram topic for auto-generated title)rrrr2r$_telegram_topic_auto_rename_disabledr@rVrr/rwr2rtrurqrvr3r4rOrhrwrj) rr(rNrr1get_infooperator_topicrXr topic_name rename_topicr>rys r>(_rename_telegram_topic_for_session_titlez6GatewayRunner._rename_telegram_topic_for_session_titlePs&t'CVLLLLLLLL TZTb jpjz  F  4 4V < <  F**622  tG}}.BDIIH!! *%-Xgs6>7J7JCPVP`LaLa%b%bNN ***%)NNN*nd33FT=$77  !  * E E//!&"233!F!!s7;;|#<#<#BCCs:VVF    T_c ddd  ? F88??  d"7,=tDDL'"l//!&"233# '6400CILws,>EEE^b 'KN?730@$#G#G#G`d ' &&//&)&*:&;&;# z*   &&"N&,&6#   d d d LLS^bL c c c c c c ds\1C CC>A8E99&F#"F#A J? ?J?8J /J<8J?;J<<J??&K)(K)ct|ddr:t|jddr$|jj|jnd}|dSt|ddpi}|d}|dSt |t r|St |tr(| dvSt |S)zReturn True when operator disabled per-topic auto-rename for this Telegram chat. Controlled via ``gateway.platforms.telegram.extra.disable_topic_auto_rename``. Default is False (auto-rename enabled, preserves prior behaviour). rzNrEFrdisable_topic_auto_rename>rorprqrr) rVrzrErvrrtrrwrxry)rr(rGrrs r>r|z2GatewayRunner._telegram_topic_auto_rename_disabledPstXt,, 18kSW1X1X DK ! % %fo 6 6 6   5 gt44: 566 =5 eT " " L eS ! ! G;;==&&((,FF FE{{rMc|r||sdS||rdS tj}n!#t$rt |dd}YnwxYw||rdS tj|}n#t$r|}YnwxYwt| ||||td}|dSdd}| |dS)z>Schedule a topic rename from the auto-title background thread.Nrz.Telegram topic title rename failed to schedulerr-c |dS#t$r tddYdSwxYw)Nz"Telegram topic title rename failedTrrprqs r>rrzPGatewayRunner._schedule_telegram_topic_title_rename.._log_rename_failure QsX R  R R R AD QQQQQQ Rrsr)rr|rr! rrVrtrirlr2rrr3r)rr(rNrrrurrrs r>rz3GatewayRunner._schedule_telegram_topic_title_renamePsM D88@@  F  4 4V < <  F 8+--DD 8 8 84$77DDD 8 <4>>++< F #'/77MM # # #"MMM #)  9 9-UZ [ [ H     > F R R R R   !455555s#AA$#A$B B$#B$r-ct|dsi|_t|jpd}|sdSddl}|}|j|d}||z |jkrdS||j|<dS)zRate-limit the BotFather Threads Settings screenshot. If a user sends /topic repeatedly while Threads Settings are still off, we shouldn't keep re-uploading the screenshot every time. _telegram_capability_hint_tsrTrNr@F)rrrwr2rUrrv$_TELEGRAM_CAPABILITY_HINT_COOLDOWN_SrPs r>%_should_send_telegram_capability_hintz3GatewayRunner._should_send_telegram_capability_hintQs t;<< 302D -fn*++ 4oo044WcBB :A A A558)'2trMc dS)Nuz/topic — enable multi-session DM mode (one bot, many parallel chats) Usage: /topic Enable topic mode, or show status if already on /topic help Show this message /topic off Disable topic mode and clear topic bindings /topic Inside a topic: restore a previous session by ID How it works: 1. Run /topic once in this DM — Hermes checks BotFather Threads Settings are enabled and flips on multi-session mode. 2. Tap All Messages at the top of the bot and send any message. Telegram creates a new topic for that message; each topic is an independent Hermes session (fresh history, fresh context). 3. The root DM becomes a system lobby — send /topic, /status, /help, /usage there. Normal prompts go in a topic. 4. /new inside a topic resets just that topic's session. 5. /topic inside a topic restores an old session into it.rNrNs r>_telegram_topic_help_textz'GatewayRunner._telegram_topic_help_text(Qs M  rMc\K|jsddlm}|tdSt |jpd}|sdS |j|t |jpdd{V}n#t$rd }YnwxYw|sd S |j | d{Vn6#t$r)}t d d |cYd}~Sd}~wwxYwdD]>}t||d}t|tr||d? dS)z5Cleanly disable topic mode for a chat via /topic off.r)format_session_db_unavailablez,gateway.shared.session_db_unavailable_prefix)rrzCould not determine chat ID.rCNFz@Multi-session topic mode is not currently enabled for this chat.rz%Failed to disable Telegram topic modezFailed to disable topic mode: )rNruMulti-session topic mode is now OFF for this chat. Existing topics in Telegram aren't removed — they'll just stop being gated as independent sessions. The root DM works as a normal Hermes chat again. Run /topic to re-enable later.)rRrrrrwr2rDrr2disable_telegram_topic_moder3rrVrtrurU)rr(rr2currently_enabledr<r stores r>%_disable_telegram_topic_mode_for_chatz3GatewayRunner._disable_telegram_topic_mode_for_chat>Qs k B B B B B B00:h8i8ijjj jfn*++ 211 &&*&6&U&UFN0b11'V''!!!!!!   & & & %    &  VUU :">>w>OO O O O O O O O O : : :   D E E E9C99 9 9 9 9 9 9 : T ) )DD$--E%&& ) '4((( G  s06A;; B  B !B44 C'>C"C'"C'c HKgd} |jt|jt|jdd{V}n.#t $r!t ddg}YnwxYw|r|d|D]}t| dpd }t| d pd }t| d pd  }d |d|d}|r|d|z }||| d dddd|d ddgn| gdd |S)N)z*Telegram multi-session topics are enabled.rzTo create a new Hermes chat, open All Messages at the top of this bot interface and send any message there. Telegram will create a new topic for it.rrG)r2rlimitz)Failed to list unlinked Telegram sessionsTrzPrevious unlinked sessions:rrrzUntitled sessionrz- u — `rr2 zTo restore one:]1. Create or open a topic. To create a new one, open All Messages and send any message there..2. Send /topic inside that topic.zExample: Send /topic rz inside a topic.)z-No previous unlinked Telegram sessions found.rz$To restore a previous session later:rrr) rR(list_unlinked_telegram_sessions_for_userrwr2rr2r3r4rrvrxextendrf) rr(rqrr rNrrr[s r>#_telegram_topic_root_status_messagez1GatewayRunner._telegram_topic_root_status_messagecQs    !-VVFN++FN++WHH     LLDtL T T THHH    LL6 7 7 7# # # T!2!2!8b99 GKK00F4FGGgkk)44:;;AACC6E66666.-G---D T"""" LL!o@O (=(=OOO      LL   yysAA(A;:A;raw_session_idcK|j}|j|d{V}|sd|S|j|d{V}|sd|St |dpddkrdSt |dpdt |jkrdS|j| d{V}|j t |j t |j  d{V}|r|r|d |krd S| |} |j t |j t |j t |j||d d{Vn*#t$r} dt | vrYd} ~ d Sd} ~ wwxYw|j|d{Vp|} d} t!|j|d{VD]T} | ddkr9| dr$t | d} nUn#t$$rd} YnwxYwd| } | r| d| z } | S)zBRestore an existing Telegram-owned Hermes session into this topic.NzSession not found: r(rrYzNThat session is not a Telegram session and cannot be restored into this topic.rz3That session does not belong to this Telegram user.r~rrNz9That session is already linked to another Telegram topic.restored)r2rrr+rN managed_modezalready linkedrrr4zSession restored: z Last Hermes message: )r(rRresolve_session_idrxrrwrvr#is_telegram_session_linked_to_topicrqr2rrAr[rjget_session_titler get_messagesr2)rrrr(rNr linkedcurrent_bindingr+r<rlast_assistantr$rJs r>_restore_telegram_topic_sessionz-GatewayRunner._restore_telegram_topic_sessionQs+>>~?S?S?U?UVVVVVVVV  BA)=)=)?)?AA A(44Z@@@@@@@@ BA)=)=)?)?AA A w{{8$$* + +z 9 9cc w{{9%%+ , ,FN0C0C C CHH'KKWaKbbbbbbbb $ 0 K K''&*++!L! !         S" So&9&9,&G&G:&U&URR226::  "66FN++f.//FN++'%' 7           3s88++RRRRRR   &88DDDDDDDDR  "#$*:*G*G *S*S$S$S$S$S$S$STT  ;;v&&+55'++i:P:P5%(Y)?)?%@%@NE " " "!NNN "0//  F E^EE EHs2AG-- H7HHH_execute_mcp_reloadz!GatewayRunner._execute_mcp_reloadQs~'))a ; ` ` ` ` ` ` ` ` ` ` ` ` 3 3!(--//22  3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 &&t-ABB B B B B B B B#2249KLLLLLLLLI 9 9$' $8$8! 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9& 3E!$55G+k9K2334E h Q?tyyQWXcQdQdGeGefffggg \ Q96RW==AYAYZZZ[[[ ` Q;499VT[__C]C]^^^___$ | QBCCDDDD QC3y>>cfgxcycyzzz{{{ BBBBBB ~t<<%d,?FF *v*$MM15fllnn1E1EMM-Iv)6@6O6O)[U[#,))) ()%~ (43FtLLLLL!MMMMMMMMMMMMMMMM$    N L R##$Pdiiu 6N6N$P$PQQQ V##$T &//8R8R$T$TUUU ^##$\DIIf[FYFYJRDIIl33d::PRMl-lYelllJ &*&>&T&TUZUa&b&b b b b b b b .CC!,j    99U## # ; ; ; NN2A 6 6 60::: : : : : : : ;sQ("A Q(AQ(A=Q("C: Q(C  Q( C EQ('.K'K =JK  J*'K )J**K ? K KKKKQ( L!L<Q(LC0Q(7A QQ( Q Q(QQ(( R(2+R#R(#R(rr rqc < Kd} |}t|tr|dnd}t|tr#t |dd}n#t $rYnwxYw|sd{VS||j dtf fd } | |jj } dd|d | d | d | d } | ||| | d{VS)uGate a destructive session slash command (/new, /reset, /undo). ``execute`` is an async callable ``execute() -> str | EphemeralReply`` that performs the destructive action. If the ``approvals.destructive_slash_confirm`` config gate is off, ``execute`` runs immediately (returning its result). Otherwise this routes through ``_request_slash_confirm`` — native yes/no buttons on Telegram/Discord/Slack, text fallback elsewhere. Three-option resolution: - ``once`` — run ``execute`` and return its result - ``always`` — persist ``approvals.destructive_slash_confirm: false``, then run ``execute`` - ``cancel`` — return a "cancelled" message; do not run ``execute`` TreNdestructive_slash_confirmchoicecK|dkrddSd}|dkr ddlm}t|dd}|rtd ntd n2#t $r%}td |Yd}~nd}~wwxYwd{V}|dkr#|rd }nd }t|tr||zS|S|S)Nru🟡 /z# cancelled. Conversation unchanged.Fr r)save_config_valuez#approvals.destructive_slash_confirmz8User opted out of destructive slash confirm (session=%s)z[Could not persist destructive_slash_confirm=false (session=%s); config.yaml is not writablez5Failed to persist destructive_slash_confirm=false: %su ℹ️ Future /clear, /new, /reset, and /undo will run without confirmation. Re-enable via `approvals.destructive_slash_confirm: true` in config.yaml.u ⚠️ Could not save that preference (config.yaml is not writable), so /clear, /new, /reset, and /undo will ask again next time. To silence it permanently, set `approvals.destructive_slash_confirm: false` in config.yaml.) rsrrr3rzrr2rtrw) r persistedrr<rnoterr r+s r> _on_confirmzCGatewayRunner._maybe_confirm_destructive_slash.._on_confirmrRs~!!LLLLLI!!555555!%))*OQVWW!!I!  V' H' !NNOQT#799______F!!VDW fc**)!D=( MsAA22 B!<BB!u⚠️ **Confirm /z** u Choose: • **Approve Once** — proceed this time only • **Always Approve** — proceed and silence this prompt permanently • **Cancel** — keep current conversation _Text fallback: reply `z approve`, `z always`, or `z cancel`._)rrrr$handler) _read_user_configrtrurvrr2rAr(rw_typed_command_prefix_forr_request_slash_confirm) rrrrr r confirm_requiredrrerrfprompt_messager+s ` ` @r>r z.GatewayRunner._maybe_confirm_destructive_slashJRs4  ((**C0:30E0EO ,,,4I)T** Z#' 6QSW(X(X#Y#Y     D   # ?????? "225<@@ 4 c4 4 4 4 4 4 4 4 l + +EL,A B B T T T T T ')  T T 68  T T GI  T T T 00" 1         sA8B BBc|Kddlm}|j}||}t |dd} | ddl} | d} | |_t| } | || ||| |} | || |} d}| v | |j|||| | d{V}|rt |ddrd }n9#t$r,}t d ||j|Yd}~nd}~wwxYw|rdS|S) aRAsk the user to confirm an expensive slash command. ``handler`` is an async callable ``handler(choice: str) -> str`` where ``choice`` is ``"once"``, ``"always"``, or ``"cancel"``. The handler runs on the event loop when the user responds; its return value is sent back as a gateway message. Returns a short acknowledgment string to send immediately (before the user's response). If buttons rendered successfully the ack is ``None`` (buttons are self-explanatory); if we fell back to text the message itself IS the ack. rr rNr(F)r2rr$r+r rr/Tz*send_slash_confirm failed for %s on %s: %s)rr r(rArVrrrnextrNr@r rusend_slash_confirmr2r2r3r4r)rrrrr$rrIr(r+counterrr r1r used_buttons button_resultr<s r>rz$GatewayRunner._request_slash_confirmRs* >=====226:: $ 8$?? ? * * * * &&q))G*1D 'W '  ##KWgNNN**62233FDrzGatewayRunner._read_user_configRsa   5 5 5 5 5 5+--C$S$//733R 7   III s (+ ::r5 c ~|t|ddt|ddt|ddt|dd|pt|dd}t|ddtjkr6t|dd}|r#t |pi}t ||d <|S) z@Build the metadata dict platforms need for thread-aware replies.rNr2rrrjrr5 scope_id slack_team_id)r< rVrrrurw)rr(r5 rteam_ids r>r z)GatewayRunner._thread_metadata_for_source Ss 33 FJ - - FIt , , FK . .fk488 3 Zwv|UY7Z7Z 4   6:t , , > >fj$77G 9B//,/LL)rMr4 rc|dSd|i}||||||r3d|d<t|}|r |dvr||d<|t||d<|tjkr|t||d <|S) zGBuild thread metadata for synthetic sends that only have routing state.Nrrr1T telegram_dm_topic_reply_fallback>rrodirect_messages_topic_idtelegram_reply_to_message_idrj)_is_telegram_dm_topic_targetrwrr) rrr2rrr5 r1rrJs r>r< z)GatewayRunner._thread_metadata_for_targetSs  4$/#;  , ,    -   T<@H7 8i..C ;s)++7:34".;>?R;S;S78 x~ % %*=*I&))<%=%=H\ "rMrcr|tjks|dS|dkrdS||rtt|dd}t |ri ||t |t |}t |tS#t$rt ddYnwxYwdS)z>Return True when a target is a Telegram private DM topic lane.NFrTrwz,Failed to inspect Telegram DM topic metadatar) rrrVrr/rwrtrur2r3r4)rr2rrr1get_dm_topic_info topic_infos r>rz*GatewayRunner._is_telegram_dm_topic_targetCSs x( ( (I,=5   4  7  'W 7KT R R )** 88!2!27CLL#i..!Y!YJ&j$777!```LL!OZ^L_____`us'B &B43B4c t|S)zBReturn the platform-specific reply anchor for GatewayRunner sends.)ru)rs r>ruz%GatewayRunner._reply_anchor_for_eventcSs'u---rMct|dd}|r|sdS tj||_dS#t $rtdYdSwxYw)z;Ensure a background task is watching for update completion._update_notification_taskNz;Skipping update notification watcher: no running event loop) rVrrr_watch_update_progressrrr3r4)r existing_tasks r>r z1GatewayRunner._schedule_update_notification_watchSs&A4HH  !3!3!5!5  F X-4-@++--..D * * * X X X LLV W W W W W W Xs+A$B?B@ @r<stream_intervalc #$%&'()*Ktdz }tdz }tdz }tdz }tdz }tj((|z} d$d&d} d)||fD]#} | r t j| d} | d } | d &| d }| d } | d }| d}| rO&rMt| *|j *$| *&|||$)| s| d&} n#t$rYwxYw%$r&sStd|s|r(| kr|r|d{VrdStj|d{V|s|r(| k|s|rE|s1|dd|d{VdSdt$dt$fd#dt&dt(dt*t$t(ffd}d}('d%d9#$%&'()*fd }(| krt|r|r( |||\}}|r%|z %n#t,$rYnwxYw|d{V |dpd}t)|}|dkr.$&dt3)*d{Vn@$&d |t3)*d{Vtd!|| n2#t$r%}td"|Yd}~nd}~wwxYw|||||fD]}|d#$td%z d#$|| }| d&|j_dS|r( |||\}}|r%|z %n#t,$rYnwxYw%r+('z |kr|d{V| r|| nd}|r| r| |jjs t j|d}|d'd}|d(d}|r.|d{Vd&}tAtC$d)de $"&||| t3)**d{Vd#}n2#t$r%}t#d+|Yd}~nd}~wwxYw|sT|rd,|d-nd} tA$d.d/}!$&d0|| d1|!d2|!d3t3)*d{Vd#|$| j_td4| |dd5n>#t j%t,f$r%}t#d6|Yd}~nd}~wwxYwtj|d{V(| kt|std7||dd|d{V $&d8t3)*d{Vn#t$rYnwxYw|||||fD]}|d#$td%z d#$|| }"|"d&|"j_dSdSdS):aWatch ``hermes update --gateway``, streaming output + forwarding prompts. Polls ``.update_output.txt`` for new content and sends chunks to the user periodically. Detects ``.update_prompt.json`` (written by the update process when it needs user input) and forwards the prompt to the messenger. The user's next message is intercepted by ``_handle_message`` and written to ``.update_response``. ro rp .update_output.txt.update_exit_coder NrQrrr2rr+rrjr4 rzOUpdate watcher: cannot resolve adapter/chat_id, falling back to completion-only124rr-c$ddlm}||S)Nr strip_ansi)tools.ansi_stripr)rrs r> _strip_ansiz9GatewayRunner._watch_update_progress.._strip_ansiSs$ 3 3 3 3 3 3:d## #rMroffsetc |}n#t$rd|fcYSwxYwt||krdt|fS||dddt|fS)z?Read update output defensively; logs may contain invalid UTF-8.rNrQrlrS) read_bytesrr7r)rrrs r>_read_output_sincez@GatewayRunner._watch_update_progress.._read_output_sinceSs "(( " " "6z!!! "4yyF""3t99}$='' 'BBCIIM Ms ((rrc KsddSd  sdSdfdtdtD}|D]f} d|dt  d{V5#t $r%}td |Yd}~_d}~wwxYwdS) z!Send buffered output to the user.rN c*g|]}||zSrNrN)rbrclean max_chunks r>rzOGatewayRunner._watch_update_progress.._flush_buffer..Ss&VVVeAa)mO,VVVrMrr$r%rr.zUpdate stream send failed: %s) rxrUr r7r0rr2r3r4) chunkschunkrrrrr1bufferr2last_stream_timerrrs @@r> _flush_bufferz;GatewayRunner._watch_update_progress.._flush_bufferSs_<<>> K''--//EF#yy{{  IVVVVVeAs5zz96U6UVVVF E EE!,,,,,,!=hQY!Z!Z!Z' !EEELL!@!DDDDDDDDE E Es1B99 C(C##C(rou✅ Hermes update finished.rr.u(❌ Hermes update failed (exit code {}).z&Update finished (exit=%s), notified %sz$Update final notification failed: %sTrsr FrY rJsend_update_prompt)r2rY rJr+rz%Button-based update prompt failed: %sz (default: rrcr]u"⚕ **Update needs your input:** z Reply `zapprove` (yes) or `z)deny` (no), or type your answer directly.z!Forwarded update prompt to %s: %srz Failed to read update prompt: %sz$Update watcher timed out after %.0fsu-❌ Hermes update timed out after 30 minutes.r)&rlrr! rUrr3r4rXrvrrr< r2r3rr rrrwrrhrrrxr0rformatrzrurAr0r rVrrr4r/r)+rr<rr pending_path claimed_pathrexit_code_pathrAr+ r+rr5rB rrrjr bytes_sentrr exit_code_rawr8rr;_up_done_up_pending_state prompt_data prompt_textrJ sent_buttonsbtn_err default_hintrf_up_timeout_staterr1rr2rrrrs+ @@@@@@@@r>rz$GatewayRunner._watch_update_progressSs $&<< #&DD "%99 %(;;"%:: '))99;;( !<0  D{{}} "j)I)IJJG#*;;z#:#:L%kk)44G ' K 8 8I")++m"<"B++'$%: $GVabecebeVfggg,g6HHHLL!CQGGGGGGGGH- .. . . . . . . .eiikkH$$j$$&& K NNA7 K K K  % %eg % > > >-// ! ! ! ! ! ! ! llC9(XVVV#     "L+$k3 * *D)))) . . 6 6$ 6 G G G $ 8 8 E E  ,EJ!,BBB% K K"-,s C7F FFN,, N98N9 C R S!SSU U%$U%(B].01Z"!]." [,[ ]. [B]..^)^$$^)6-a$$ a10a1cN Ktdz }tdz }tdz }tdz }|s|sdSd}|} |r ||n#t$rv|s_Y|rZ|d|d|d|ddSdSYnwwxYw|s_ |rZ|d|d|d|ddSdSt j|d }|d }|d } |d } |d } |d} |st dd}|}|| |rZ|d|d|d|ddSdS|d  pd} t| }d}|r)| dd}t|}|j|}|s| rt d|d}|}|| |rZ|d|d|d|ddSdS|r| r||| | | | |}ddlm}|| }|r4t)|dkr d|ddz}|dkrd|d}nd|d}n |dkrd}nd }|| |t-||!"d{Vt d#|| |n2#t.$r%}td$|Yd}~nd}~wwxYw|rX|d|d|d|dn`#|rY|d|d|d|dwwxYwdS)%aIf an update finished, notify the user. Returns False when the update is still running so a caller can retry later. Returns True after a definitive send/skip decision. This is the legacy notification path used when the streaming watcher cannot resolve the adapter (e.g. after a gateway restart where the platform hasn't reconnected yet). ro rp rrFTrsrQrrr2rrrjz2Update notification deferred: update still runningrorrlrz:Update notification deferred: %s adapter not connected yetr4 rrrr iTNu!✅ Hermes update finished. ``` r%u❌ Hermes update failed. ``` u(✅ Hermes update finished successfully.u]❌ Hermes update failed. Check the gateway logs or run `hermes update` manually for details.rr.z0Sent post-update notification to %s:%s (exit=%s)z#Post-update notification failed: %s)rlrrlrrur3r4rXrvr3rzrxrhrrrrr< rrr7r0rr2r)rrrrrcleanupactive_pending_pathr5rB r2rrrjrr8rrr1rrrrs r>r z'GatewayRunner._send_update_notificationTs$&<< #&DD "%99 %(;;""$$ \-@-@-B-B 5*_ 7""$$ $ ((6666($$$'..00$#j 7#**d*;;;##t#444""d"333%%%66666  7 7m$$$"((** f 7#**d*;;;##t#444""d"333%%%66666  7 7cj!7!7!7!I!IJJG";;z22Lkk),,G K00I K00I \22J!((**  PQQQ&2#$$\222J 7#**d*;;;##t#444""d"333%%%66666  7 7G+44g4FFLLNNURUMM**IF!!## T$//11888SS --Hm''11G w  P  &2#$$\222N 7#**d*;;;##t#444""d"333%%%66666  7 7K! 7! ;;'(2# <877777#F++1133 z6{{T))!&!7 A~~RVRRRP6PPP!^^DCCyCll9(XVVV#  F    E E E NN@! D D D D D D D D E 7#**d*;;;##t#444""d"333%%%666  7#**d*;;;##t#444""d"333%%%6666  7 tspR8/BR8D#R8R8DR8;CR82CR8*C R87U8 S'S"U"S''UAV"c Ktdz }|sdS tj|d}|d}|d}|d}|d}|d }|r|s |d dSt|}t||j |j } | 4t d | |d dS|j j |} | ;| js4td | |d dS||||||| j} |dd urkt%| pi} |drt'|d| d<|drt'|d| d<| |t'|dt+| |d{V} | Xt-| dd durEtd||t-| dd |d dStd||t'|t'||rt'|ndf|d S#t0$r<} td| Yd} ~ |d dSd} ~ wwxYw#|d wxYw)zANotify the chat that initiated /restart that the gateway is back.rkNrQrrr2rrrjTrsz6Restart notification skipped: no live transport for %szJRestart notification suppressed: %s has gateway_restart_notification=falser4 rTrru;♻ Gateway restarted successfully. Your session continues.rr.r/Fz3Restart notification to %s:%s was not delivered: %srPr6 z"Sent restart notification to %s:%szRestart notification failed: %s)rlrr3r4rXrvrurrerzrr3r4rEr; rzr< r1rurwr0rrVrr2)r notify_pathrrB r2rrrjrrrGrrrs r>r z(GatewayRunner._send_restart_notificationUs "%;; !!## 4G 0:k33W3EEFFD88J//Lhhy))G--I--I,//J w |   $  / / / / /y --H28T[$-XXI  L j   $  / / / / /g ;044X>>L' 0Y' ` Z   $  / / / / /W77#$.!) 8Hxx6774??B//88I&&?*-d9o*>*>HY'88J''A+.tJ/?+@+@HZ($>>G M5hRRR *F!gfi&F&F%&O&OI FG-JKK     $  / / / / / KK4    |$$c'lli4YC NNNUYY   $  / / / /     NNr z6GatewayRunner._send_home_channel_startup_notificationsQUs:= '#%%G&*k&;&A&A&C&C@ @  "Hl,D t| 28T[$-XXI <  mNnc$,&7&7PTP^9hT^9L9L9LdhiF  Fi$7$7, ;;LN%- < %=#HN33H|;.2l+}=/3}, > DL))!. $2$$FF$-#4#9#9#dl:K:KW#U#UUUUUUUF%'&)T*J*Je*S*SNNP  1NOO   f%%% ENL    LNL  sD,I  ;I  J'JJcddlm}t|ddpi}||jj}t|dd}||jjj|jj|jjrt|jjnd|jj pd|jj rt|jj nd|jj rt|jj nd|jj rt|jj nd|j|jjrt|jjndt|jddpd|d S) a@Set session context variables for the current async task. Uses ``contextvars`` instead of ``os.environ`` so that concurrent gateway messages cannot overwrite each other's session state. Returns a list of reset tokens; pass them to ``_clear_session_env`` in a ``finally`` block. r)set_session_varsrNsupports_async_deliveryTrr) rr2rr*rrr)r+rjrasync_delivery cron_session)r rrVrvr(rrr2rrwr*rrr)r+rj)rrr _adaptersr_async_deliverys r>rszGatewayRunner._set_session_envUsP =<<<<<D*d339r ==!899!(,EtLL^,2N*181IQGN,---rn.4"7>~7OWc'.2333UW3:>3IQC.///r7>~7OWc'.2333UW+9@9RZs7>4555XZGNIr::@b*    rMrd c(ddlm}||dS)z>Restore session context variables to their pre-handler values.r)clear_session_varsN)r r)rrd rs r>r|z GatewayRunner._clear_session_envUs+>>>>>>6"""""rMcKtj}t}|j||j|g|Rd{VS)zJRun blocking work in the thread pool while preserving session contextvars.N)rr! rr _get_executorr )rfuncrrr s r>rc z+GatewayRunner._run_in_executor_with_contextUsx'))nn)T)    G             rMcpt|dd}|tj}||_|5t|ddrt dt|dd}|t|ddr(t jdd }||_|cdddS#1swxYwYdS) z:Return the gateway-owned executor for blocking agent work.rNrFz.Gateway is shutting down; executor unavailabler _shutdownrGr ) max_workersthread_name_prefix) rVrrrr concurrentfuturesThreadPoolExecutorrrr executors r>rzGatewayRunner._get_executorUst-t44 <>##D"&D    t0%88 U"#STTTt[$77H78[%#H#H%-@@ "'7A"*                  sA.B++B/2B/c(t|dd}|dS|5d|_t|dd}d|_dddn #1swxYwY|dS |dddS#t$r|dYdSwxYw)zBStop the gateway-owned executor without touching the loop default.rNTrF)rBcancel_futures)rB)rVrrr rwr(s r>r z GatewayRunner._shutdown_executorUst-t44 < F  " "%)D "t[$77H!DN " " " " " " " " " " " " " " "   F *   5  > > > > > * * *   5  ) ) ) ) ) ) *s# AA AA-- BB)r(r+rArrrc ddlm}ddlm}m}ddlm} t|tr|n | } |pd } |pd } d} | p| }|dup|}|r)|r& | ||| \}}| s)t|tr| } t|tr| dnd}t|tr| d nd}| s)t|tr| } t|tr| } n2#t$r%}td |Yd}~nd}~wwxYw| s |} | s |} || | | | S#t$r&}td |Yd}~d Sd}~wwxYw)aiResolve image-input routing for the effective model this turn. Returns ``"native"`` (attach pixels on the user turn) or ``"text"`` (pre-analyze with vision_analyze and prepend the description). See agent/image_routing.py for the full decision table. Gateway sessions can have /model overrides that live outside config.yaml. Image preprocessing runs before AIAgent sets the auxiliary_client runtime globals, so resolve the same per-session runtime bundle the upcoming agent turn will use instead of consulting only the persisted default model. r)decide_image_input_mode)_read_main_model_read_main_providerrcrNrrruOimage_routing: session runtime resolution failed, falling back to config — %s)ru;image_routing: decision failed, falling back to text — %sr)rr-rm r.r/rrdrtrurxrrwrvr2r3r4)rr(r+rArrr-r.r/rdrresolved_providerresolved_modelresolved_requested_providerneeds_session_runtimehas_session_identityrrruntime_providerruntime_requested_providerr<s r>rz&GatewayRunner._decide_image_input_modeUs*2  C C C C C C T T T T T T T T 5 5 5 5 5 5!+K!>!>Q++KKMMC!)R 6 6 8 8 #kr0022N*, '(9$9$O=O !#)#5#D $ )= 151T1T%$/$'2U22.J *       LLVX[ \ \ \66666 sCA5G8C2E+*G+ F5FGF)G G4G//G4 user_textrclKddlm}ddlm}d}g}|D]} td||||d{V}t j|} | dr>| d d } || } | d | d |d n| d|d#t$r>} t d| | d|dYd} ~ d} ~ wwxYw|r d |} |r| d|S| S|S)a Auto-analyze user-attached images with the vision tool and prepend the descriptions to the message text. Each image is analyzed with a general-purpose prompt. The resulting description *and* the local cache path are injected so the model can: 1. Immediately understand what the user sent (no extra tool call). 2. Re-examine the image with vision_analyze if it needs more detail. Args: user_text: The user's original caption / message text. image_paths: List of local file paths to cached images. Returns: The enriched message string with vision descriptions prepended. r)vision_analyze_tool)sanitize_contexta(Concisely describe this image in 2-4 sentences (~200 Chinese characters or ~150 English words). Cover the main subject, key visible text/data/code, and overall context. If it is a chart, diagram, or scientific figure, include the important labels, legend, and key values. Skip decorative details.zAuto-analyzing user image: %s)rq user_promptNr/analysisrz0[The user sent an image~ Here's what I can see: zA] [If you need a closer look, use vision_analyze with image_url: z ~]z[The user sent an image but I couldn't quite see it this time (>_<) You can try looking at it yourself with vision_analyze using image_url: rzVision auto-analysis error: %sz[The user sent an image but something went wrong when I tried to look at it~ You can try examining it yourself with vision_analyze using image_url: r) tools.vision_toolsr9agent.memory_managerr:r3r4r3r4rvrr2rPrf) rr7rr9r:analysis_promptenriched_partsrrrrrrs r>rz)GatewayRunner._enrich_message_with_visionHVs$* ;:::::999999 G   D  rzDGatewayRunner._enrich_message_with_transcription..Vs-SSSQ$txxPQ{{qrM stt_enabledTNz [The user sent a voice message: z (duration: z)]rrz.(The user sent a message with no text content)r)transcribe_audiotranscribe_audio_local_fallbackz$Transcription module unavailable: %sz([voice message could not be transcribed]zTranscribing user voice: %sr/z6Configured STT failed for %s; recovered with local STTrru[The user sent a voice message but it came through empty or inaudible — speech-to-text returned no words. Do not guess at the content; ask the user to resend or type it out.]rUrPrz%Voice transcription failed for %s: %srzR[voice message could not be transcribed automatically; the audio is available at: zTranscription error: %s)rrVrzrrabspathr"rrfrxtools.transcription_toolsrDrEModuleNotFoundErrorr3rPr4rrrvrzrrr2)rr7rnotesrabs_path duration_strr _placeholderrDrErunavailable_noter@r rr.rrPrrrs @r>rz0GatewayRunner._enrich_message_with_transcriptionVs,uuSSSS+SSS t{M488 E# Q Q7??400%:8%D%DDDDDDD QLLa8aaQ]aaaLL!OH!O!O!OPPPP % "}$[[''FKL "Y__..,>>rz! 6 11i112552:  (         # ( ( ( LL? C C CI KL ,Y__..,>>'+++++++ @*;; ;;R???????#R' ' ' ' ' ' ' (,.@ @ D?  :DAAA&01A4HHHHHHHHzz),, *%,%67&&      H ||I..* T "*)$(!' !5J ',"3355!&--9 !*11*=== #))*;j*;*;*;<<<<"JJw@@EKK GuUUURRRRRR!>555 J 11i113III11 1000sW4C== E'r z(GatewayRunner._pending_event_audio_pathsWse!# UL$77=2  ,, ) )GAt(22 )""4(((rMcKt|dr4t|d}t|dgpg}|t|fS||}|s||nt|ddpdgfS||nt|ddpd}|||d{V\}}t |d|t |dt|||fS)aWTranscribe a pending audio event once and cache the result on the event. Voice follow-ups can be inspected first by the interrupt monitor and later consumed by the pending-drain path. Both need the same transcript, but only one STT call and one transcript echo should happen for the platform message. r _gateway_pending_stt_transcriptsNrr)rrVrr rr ) rrr7 cached_textcached_transcriptsrrr r s r>rz2GatewayRunner._transcribe_pending_audio_event_once$Ws9 55 6 6 9!%)DEEK!(0RTV!W!W!][] %7 8 88 855e<<  f ) 599GE6SW"_echo_pending_stt_transcripts_oncez0GatewayRunner._echo_pending_stt_transcripts_onceBWs>. 4466  FWU,I1MMRQRSS^__-4ns6{{6RSSS V VB VllN%%%%%#  V V V ={HUUUUUUUU V V Vs-'B CCCr.cK||s|gfS |||d{V\}}|tur)||||n|} |||||| |d{V|p||fS#t $r*} td|| |gfcYd} ~ Sd} ~ wwxYw)a]Transcribe a pending voice event and echo transcripts once. Unified helper for all interrupt/monitor/backup/drain paths that need to transcribe a pending voice event and echo the transcript to chat. Returns ``(enriched_text, transcripts)`` so the caller can feed the enriched text into ``agent.interrupt()`` or the pending-drain flow. If the event has no STT-eligible media, returns ``(text, [])`` unchanged. The caller is responsible for the ``_build_media_placeholder`` fallback when ``text`` is empty and the event has non-audio media. NrTz%s transcription failed: %s) r r_UNSETr rur\r2r3r) rrr1r(rr rr rU echo_meta trans_excs r>r z0GatewayRunner._transcribe_and_echo_pending_voicekWsY*..u55 8O /3/X/X00****** &M;V##88,,U33*2 99"' :       !(D+5 5    NN8+y Q Q Q8OOOOOO sA9B C !CC C rc ddlm}t|dpd}d}d}d}|r |j|jj|}|rt|ddr|j Sn3#t$r&}t d||Yd}~nd}~wwxYw| |} | | St|} | r| d}| d }| d }t|dp|pd} t|d p|pd} t|d p|pd} | r| r| s5td || | | |d d dS t#| }|jt&vrN ddlm}||jst/| n#t$rt/| wxYwn,#t$rtd| YdSwxYw||| | t|dpdpdt|dpdpdt|dpdpdS)aResolve the canonical source for a synthetic background-process event. Prefer the persisted session-store origin for the event's session key. Falling back to the currently active foreground event is what causes cross-topic bleed, so don't do that. r)r[r+rr3 Nz>Synthetic process-event session-store lookup failed for %s: %srrr2zcSynthetic event source unresolvable: session_key=%r platform=%r chat_type=%r chat_id=%r evt_type=%srrrM z9Synthetic process event has invalid platform metadata: %rrrr))rr2rrrr))rrr[rwrvrxrr9 rrVr3 r2r3r4r: rryrrrrVr rN r rj)rrr[r+derived_platformderived_chat_typederived_chat_idrr< cached_sourcerC r_rr2rrN s r>_build_process_event_sourcez)GatewayRunner._build_process_event_sourceWs 211111#''-006B77==??   5 "11333*377 DD(WUHd;;( <'    T !;;KHHM($$(55G 5#*:#6 $+K$8!"))"4CGGJ//I3CIrJJPPRRXXZZ  ,,G0AGRHHNNPPVVXX cggi((AOArBBHHJJ I W  NN]Iw$$    4  ..H~%===4KKKKKK,::8>JJ8(7778 444$]3334    NNK   44  }#''+..4"55;;==E **0b117799AT#''+..4"55;;==E     sCAB C #CC J4/I$#J$I>>J%J+*J+r)c K||}|spt|dpd}|sIt|dpd}|rt ||}|r|jt j}ddlm }m }|q||sf t d|||||d{Vd S#t$r'} td || Yd} ~ d Sd} ~ wwxYwtd |dStd |dddSt|jdr |jjnt|j} d}|jD]\} } | j| kr| }n|sdSddlm } | |sddlm }t|dpdpt|jpd} t d|||||d{Vd S#t$r'} td || Yd} ~ d Sd} ~ wwxYw i}t|dpd}|r||d<t)|t*j|d t|dpdpd|}t d| |j|j||d{Vd S#t$r&} td| Yd} ~ d Sd} ~ wwxYw)a Inject a watch/completion notification as a synthetic message event. Routing must come from the queued event itself, not from whatever foreground message happened to be active when the queue was drained. Returns ``True`` after adapter acceptance, ``False`` after a retryable adapter failure, and ``None`` when the event has no gateway route. This is not a transactional boundary: a process crash after adapter acceptance can still cause durable at-least-once replay. origin_session_idrr+Nr)adapter_supports_push deliver_wakeuIWatch pattern notification — waking api_server session %s via self-post)rrNTz;Watch notification self-post wake failed for session %s: %sFzZDropping watch notification for raw session %s: no api_server adapter to self-post throughzCDropping watch notification with no routing metadata for process %srNrr)ri)rjparent_session_idrrj)rrr(r rjruAWatch pattern notification — injecting for %s chat=%s thread=%sre)rfrwrvrxrrrr gateway.wakerirjr3rzr2rrrrrr2rrrsr rr rP)rr)rr(raw_sidr r1rirjrr_r;r _wake_push_okrrk synth_events r>rz(GatewayRunner._inject_watch_notificationWs11#66* #''"566<"==CCEEG "#''-006B77==??"-c22:!G -++H,?@@LLLLLLLL&/D/DW/M/M&% 7# +l7PWXXXXXXXXXX#t$%%%-#Q %uuuuu %> t NNU i00   418'1R1Rl--X[\b\kXlXl M''))  DAqw-''( 4GGGGGG}W%%  2 1 1 1 1 1#''"566<"==CCEEbV^Ma_aIbIbG  ' #l7PPPPPPPPPPt   Q uuuuu   H #CGG,?$@$@$FB G G M M O O   C1B-.&(-sww|44:;;AACCKt! K KKS     ((55 5 5 5 5 5 5 54    LLA1 E E E55555 sI/D D:D55D:/J J:J55J:>CN O OOcDt|dpd}|dkr-t|dpd}|r||dfndS|dkrBt|dpd}|d}|r||||fSdS) aReturn a producer-stable identity when one is available. Delegation UUIDs identify one producer completion. Process session IDs are normally unique too, but include the persisted spawn epoch so an explicitly reused ID represents a distinct process incarnation. Legacy process events without ``started_at`` are delivered without deduplication rather than risking suppression of a real completion. rrr delegation_idNrrNr)rwrv)rr producer_idrs r>_completion_delivery_identityz+GatewayRunner._completion_delivery_identityWXsswwv,"-- ) ) )cggo66<"==K2=GHk2..4 G | # #cggl339r::K..J ;z5 +z::trMrkcHKt|dd}|dS ||d{V}n.#t$r!td|dYdSwxYw|dS|dsd S|d d krdS ||d{V}|r||krdS||d{V}n.#t$r!td |dYdSwxYw||drdSd S) u0Classify an async-completion delivery target before adapter acceptance. Returns one of: - ``"deliver"`` — the spawning session is live, or ended by a compression rotation with a verified live continuation. The inner #55578 resolver (:meth:`_resolve_async_delegation_session`) still owns the actual route retarget; this pre-flight only proves the completion is deliverable so the durable ack stays honest. - ``"terminal"`` — the spawning session is gone for good (unknown, or ended at an explicit user boundary such as /new). Delivery can never succeed; the durable row should be terminally dropped rather than falsely acknowledged as delivered or replayed forever as pending. - ``"retry"`` — transient uncertainty (session DB unavailable, lookup error, or a compression rotation caught mid-flight before its continuation exists). The claim should be released so a later consumer can retry; the attempt cap bounds the churn. rRNr z7Async-completion pre-flight parent lookup failed for %sTrrr deliverr rmz4Async-completion pre-flight tip lookup failed for %s)rVrr2r3r4rvr )rrkrXrtip_session_idtips r>_classify_completion_targetz)GatewayRunner._classify_completion_targetlXs&T=$77  7 %112CDDDDDDDDFF    LLI!D    77   >:zz*%% 9 ::l # #} 4 4: #-#A#ABS#T#TTTTTTTN! ^7H%H%Hw"..~>>>>>>>>CC    LLF!D    77   ;#''*--;7ys'5'A A #C?C'DDc K||}d}d}|ddkrt|dpd}|r ddlm}dt |dt d j}|||sd Sn4#t$r'}t d ||Yd }~d Sd }~wwxYwt|d pd }|r| |d {V} | dkrbt d|pd||r@ ddlm} | ||n,#t$rtddYnwxYwd S| dkrD|r@ ddlm} | ||n,#t$rtddYnwxYwd S|Y|j5||jvs ||jvr d d d d S|j|d d d n #1swxYwYd } |||d {V} | dur| |;| s9|j5|j|d d d n #1swxYwY|rB| sA ddlm} | ||S#t$rtddYSwxYwSSd} ||j5|j|d |j|<t/|j|jkr8|jd t/|j|jk8d d d n #1swxYwY|rG ddlm}|||n3#t$r&}t d||Yd }~nd }~wwxYw |;| s9|j5|j|d d d n #1swxYwY|rD| sD ddlm} | ||dS#t$r tddYdSwxYwdSdS#|;| s9|j5|j|d d d n #1swxYwY|rB| sA ddlm} | ||w#t$rtddYwwxYwwwxYw)aDeliver once per live gateway, or return False for a retry. ``True`` means this caller reached adapter acceptance, ``False`` means injection failed and the claim was released for retry, and ``None`` means either another same-lifecycle caller owns/delivered the producer event or the event has no gateway route. No cross-process exactly-once guarantee is claimed. rrrrqr)claim_completion_deliveryr rrKNz/Could not claim durable async completion %s: %sFrkrzAsync delegation %s targets permanently-gone session %s; terminally dropping delivery (result remains in the delegation records).z)drop_completion_deliveryz'Could not drop durable completion claimTrr )release_completion_deliveryz*Could not release durable completion claimr)complete_completion_deliveryz5Could not acknowledge durable async completion %s: %s)rsrvrwrrzr __import__rLrMr2r3rrxrxr{r4r|rrrrrrr7rrr})rr)ridentitydurable_claim_iddurable_delegation_idrzr<rkverdictr{r|r injection_resultr}s r> _deliver_completion_notificationz.GatewayRunner._deliver_completion_notificationXs" 55c:: " 776??0 0 0$'(@(@(FB$G$G !$ ! !PPPPPP']"T((']']Z=O=O=U=U=W=W=[']']$44-/?$ $t$!!!!NNI-s!55555 ! !$CGG,?$@$@$FB G G M M O O  ) !!% @ @AR S SSSSSSSj((NN/.;=N  (  WWWWWW44 57G )"LL I)-)  4g%%'  ZZZZZZ77 57G )"LL L)-) !5  / C C DDD4#HHH  C C C C C C C C 488BBB  C C C C C C C C C C C C C C C, ^%)%D%DZQT%U%UUUUUUU t++'<#H#3KK8@@JJJKKKKKKKKKKKKKKK ^ ^^RRRRRR//-/?!^^^LL!MX\L]]]]]^ ^ ^AH#3RR8@@JJJFJD9(CDABB=>>=EE5EQQQDABB=>> RRRRRRRRRRRRRRR  SSSSSS00-/?!NNO-s #H#3KK8@@JJJKKKKKKKKKKKKKKK ^ ^^RRRRRR//-/?!^^^LL!MX\L]]]]]]^ ^ ^ ^ ^#H#3KK8@@JJJKKKKKKKKKKKKKKK ^ ^^RRRRRR//-/?!^^^LL!MX\L]]]]]^ ^ ^sFA B++ C5CCE,,&FF#F66&GG-H4H44H8;H8!Q.JJ J %J88&K! K!& Q1A:M7+ Q7M;;Q>M;?QNQ O"O>QOQO>>PPP""&Q  Q  SR: SR S R SR)(S)&SSSSc`|drdSt|ddpd}|sdS|dd|d<|dd|d<|dd|d<|dr |d|d<dSdS)aFill platform/chat_id/thread_id/chat_type on an async-delegation event. Async-delegation completion events only carry ``session_key`` (the daemon worker has no access to the per-message routing metadata the terminal background watcher captures at spawn time). Parse the session_key into the routing fields ``_build_process_event_source`` expects. Best-effort: a CLI-origin event (empty session_key) is left as-is and simply won't route on the gateway. rNr+rrr2r)rvr)rrrs r> _enrich_async_delegation_routingz.GatewayRunner._enrich_async_delegation_routing#Ys 77:    F#CGGM2$>$>$D"EE  F **Z44J!::k266KIr22I ::k " " 3%k2C    3 3rMcKtjdd{Vddlm}|jr g}g}|js |j}n#t$rYnawxYw| ddkr| |n| ||j|D]}|j ||D]}| |t|}|s) |||d{V}|dur|j |e#t$r?}|j |td|Yd}~d}~wwxYwn2#t$r%}td |Yd}~nd}~wwxYwtj|d{V|jdSdS) uDrain async-delegation completions and inject them as new turns. Background subagents (``delegate_task(background=true)``) run on the async-delegation daemon executor — they have no per-process watcher task, so their completion events would only be seen by the post-turn queue drain. This watcher covers the IDLE case: when a background subagent finishes while no agent turn is running, its result still re-enters the originating session promptly. Mirrors the CLI's idle ``process_loop`` drain. Stays silent when the queue has nothing for us; ignores non-async event types (those are handled by ``_run_process_watcher`` / the post-turn drain). r)Nrr*rrFz$Async delegation injection error: %sz"Async delegation watcher error: %s)rrr-r+rrrrr2rvrrrrrr3rPr4) rr r'r async_eventsrr)rrs r>r z'GatewayRunner._async_delegation_watcher8YsmABBBBBBm * F! .4466,!2==??$wwv*<<<$++C0000s+++.4466,#22C(,,S1111' P PC99#>>>!Ec!J!JJ%! P*.*O*OPZ\_*`*`$`$`$`$`$`$` $--044S999$PPP,00555 %KQOOOOOOOOP P F F F A1EEEEEEEE F-)) ) ) ) ) ) ) )Am * * * * *sfF$ A$#F$$ A1.F$0A11B*F$:EF$ F !5FF$F  F$$ G.GGr c. Kddlm}|d}|d}|dd}|dd}|dd}|d d}|d d} |d d} t|d pdpd } |dd} |} t d||| | | dkrZ| sX tj |d {V||}||j rn:t d|d Sd} tj |d {V||}|nt|j }||k}|}|j rddlm }m}| rv||s`ddlm}ddlm}t'|ddpd}|j r||j nd}|||}t)|}d}t||krK|| d }|d}|dkr ||dzd n|}dt|d|}n|}iddd|d|d|d |d dd|d |d | d | d | d!t'|d!d d|d"|jd#t'|d#d$d%t'|d%dd&|}||}|snF|||d {V}|durאn"||rt d'|n| d(vp| d)ko|jd*v}|r|j r|j d+d nd} | r#ddlm}|| t'|ddpd} d,|d-|jd.| d/}!d }"|jD]\}#}$|#j|kr|$}"n|"rk|ri |rd |ind }%|"||!t9|%|01d {Vn2#t:$r%}&t d2|&Yd }&~&nd }&~&wwxYwn|r| d3kr| s|j r|j d4d nd} | r#ddlm}|| t'|ddpd} d,|d5| d/}!d }"|jD]\}#}$|#j|kr|$}"n|"rk|ri |rd |ind }%|"||!t9|%|01d {Vn2#t:$r%}&t d2|&Yd }&~&nd }&~&wwxYwt d6|d S)7u Periodically check a background process and push updates to the user. Runs as an asyncio task. Stays silent when nothing changed. Auto-removes when the process exits or is killed. Notification mode (from ``display.background_process_notifications``): - ``all`` — running-output updates + final message - ``result`` — final completion message only - ``error`` — final message only when exit code != 0 - ``off`` — no messages at all rr*rNcheck_intervalr+rrr2rrr)rjNnotify_on_completeFzCProcess watcher started: %s (every %ss, notify=%s, agent_notify=%s)rTz"Process watcher ended (silent): %s)rr+)redact_terminal_outputrrrrr r(u'[… output truncated — showing last z chars] rrrrr8completion_reasonexitedtermination_sourcerugProcess watcher: completion for %s already consumed via wait/log — skipping raw notification (#65379)>rrrP>Nriz[Background process z finished with exit code z~ Here's the final output: rrr.zWatcher delivery error: %sri z is still running~ New output: zProcess watcher ended: %s)r-r+rvrwrxr r3r4rrrr7 output_bufferris_completion_consumedrrrrrVrr"r8rrrrr0rr2rP)'rr r+rNr r+r_r2rrr)rj agent_notify notify_moder last_output_lencurrent_output_lenhas_new_outputr _pr_checkrr_command_raw_LIMIT_tail_nlrcompletion_evtr)rr new_outputrr1r;r send_metars' r>rt z"GatewayRunner._run_process_watcherjYs <;;;;;\* +,kk-44  J33 ++i,,KK R00 ++i,,KK R00 \228b99??AAIT {{#7?? >>@@  Z (K G G G %    mH---------*..z::?gn?   LL=z J J J FP F-)) ) ) ) ) ) ) )&**:66G!$W%:!;!; //AN0O~E F nmmmmmmm/ (H(H(T(T/CCCCCC;;;;;;&w 2>>D"H@G@U]::g&;<<<[]D11$AADB8LLH "F4yy6)) $fWXX#jj..36"99cAghh%eUee^cee#& &$j&&{&#M & $W[[b%A%A & "7 &$Y&"7&$Y&%j&%gg|T&J&J&"8&$W%6&,WW>QS[-\-\&-gg?SUW.X.X& !$!&N$"=!<^!L!LJ%&*&K&K"N''!!!!!!I!E))!33J??LLN"  #44W#w.U73DI3U!JBIBW!_!6uvv!>!>]_J!GGGGGG%;%;&B(G(G(M2&& CzCCT[TeCC5?CCC!#G $ 3 3 5 5""17m33&'G!E4 J7 JJDM(Wi(@(@SWI"),, ' ,)EiZg)h)h)h#/## )JJJ"LL)EqIIIIIIIIJ FK5$8$8$8>E=RZW245599XZ CCCCCC!7!7"GGY$C$C$Ir""J2:22$.222 M//11DAqw-//"#0 Fw FF@I$S[)$<$rzDGatewayRunner._empty_honcho_cache_busting_config..UZsDDDcTDDDrM)_HONCHO_CACHE_BUSTING_KEYS)clss r>"_empty_honcho_cache_busting_configz0GatewayRunner._empty_honcho_cache_busting_configSZsDDS%CDDDDrMcr ddlm}m}|} |j}n#t $rd}YnwxYwt ||f}|j|}|t|S| |}|j pi}|j |j t|j|jpdt#|tr!t%|ngd} || i|_t| S#t($r|cYSwxYw)z$_extract_honcho_cache_busting_configz2GatewayRunner._extract_honcho_cache_busting_configWZsj < \ \ \ \ \ \ \ \&&((D 99;;2    D 8,H377AAF!F||#%88T8JJD,2G$(N"&,(,T-?(@(@.2.F.L"GQRY[_G`G`,hF7==??,C,C,Cfh F/7-?C *<<  < < <99;; ; ; ; D>>D=BDD65D6ci}t|tr|ni}|jD]\}}||}|dkr(t|tr|dkr|nd||d|<Ht|tr||||d|<{d||d|< ddlm}t|dd|d<n#t$rd|d<YnwxYwt|d d }t|tr@| d kr(| | n'| ||S) alPull values that must bust the cached agent. Returns a flat dict keyed by 'section.key'. Missing config keys and non-dict sections yield None values, which still contribute to the signature (so 'absent' vs 'present-and-null' differ). The live tool registry generation is included too. MCP reloads and dynamic MCP tool-list changes mutate the registry without necessarily changing config.yaml. Cached AIAgent instances freeze their tool schemas at construction time, so a registry generation change must rebuild the agent before the next turn. rrNr r)registry _generationztools.registry_generationr rhoncho)rtrurrvrtools.registryrrVr2r!rwryrIrr) rrAr rsectionr section_valrrs r>rz+GatewayRunner._extract_cache_busting_configuZs!' T::Bkk: / /LGS'''**K-''J{D,I,I':= 9I9I++tw&&&&''K.. /*5//#*>*>w&&&&''*.w&&&&'' 4 / / / / / //6xPT/U/UC+ , , 4 4 4/3C+ , , , 4 3*55 h $ $ A)9)9X)E)E JJs??AA B B B B JJs==?? @ @ @ s*CCCrrephemeral_promptr r rc ddl}ddl} t|ddpd} | r9|| nd} t|pi} | || |dd|dd|dd|dd|rt|ng|pd| t|pdt|pdt|g d t } || dd S) u:Compute a stable string key from agent config values. When this signature changes between messages, the cached AIAgent is discarded and rebuilt. When it stays the same, the cached agent is reused — preserving the frozen system prompt and tool schemas for prompt cache hits. ``cache_keys`` is an optional flat dict of additional config values that should invalidate the cache when they change. Callers pass the output of ``_extract_cache_busting_config(user_config)`` so edits to model.context_length / compression.* in config.yaml are picked up on the next gateway message without a manual restart. ``user_id`` and ``user_id_alt`` are the runtime user identities carried by the current message's gateway source. They participate in the cache key because the Honcho memory provider freezes them into ``HonchoSessionManager`` at first-message init (see ``plugins/memory/honcho/__init__.py::_do_session_init``). Without them in the signature, a shared-thread session_key (one in which ``build_session_key`` intentionally omits the participant ID, e.g. ``thread_sessions_per_user=False``) would reuse the cached AIAgent across distinct users, causing the second user's messages to be attributed to the first user's resolved Honcho peer. This broke #27371's per-user-peer contract in multi-user gateways. Per-user agent rebuilds in shared threads trade prompt-cache warmth for correct memory attribution. rNrrrrrrT) sort_keysrJr ) r r3rwrvr r r r rrBr)rrrrr rr rr _j_api_key_api_key_fingerprint_cache_keys_sortedblobs r>rz%GatewayRunner._agent_config_signatureZsL #""""""" w{{9b117R88PX`w~~hoo.?.?@@JJLLL^`#Z%52$<$<$>$>??xx$ J++ J++ 0"55 J++,<D'((("!&B"GMr""K%2&&'((# &+  .~~dkkmm,,6688"==rMc||}||jjdSt|dd}|dS ||}n-#t $r t ddYdSwxYw|sdS|d|d|dd }|d}|r t|}|d |d <|d |d <|d |d <|ds|d|d<n-#t $r t d |dYnwxYw|| |j_t d||d|pddS)uLazily restore a persisted /model override after a gateway restart. ``_session_model_overrides`` is in-memory only, so before persistence a restart silently reverted every session to the global default model. The non-secret parts (model/provider/base_url) are written through to the session store when /model runs (and cleared on /new); here we read them back on first use and re-resolve credentials via the normal runtime provider resolution — api_key is never persisted to disk. No-op when an in-memory override already exists (live state wins) or when the store has nothing persisted (e.g. the user ran /new, which clears both the in-memory dict and the persisted field). Nrz/Failed to read persisted session model overrideTrrrr)rrrrrrzdCredential re-resolution failed for persisted override (provider=%s); using credential-less overridezIRehydrated persisted /model override for session=%s: model=%s provider=%sr) rArmrnrVget_model_overrider2r3r4rvrr/rz)rr+_rehydrate_staterrr|rrs r>rrz/GatewayRunner._rehydrate_session_model_overrideZs/ 33K@@  ( -<H Fot44 = F 00==II    LLAD     FF     F]]7++! j11! j11$ $  ==,,   DXNN&-kk)&<&<#'.{{:'>'>$.5kk:K.L.L*+||J//C+2;;z+B+BHZ(    Dt  HPK((5D W g..B     s$A&A<;A<BE'F F c||}|r |jjnd}|s||fS|d|}dD]}||}||||<|drO|d:|dr%t |d|d<||fS)aApply /model session overrides if present, returning (model, runtime_kwargs). The gateway /model command stores per-session overrides in ``_session_model_overrides``. These must take precedence over config.yaml defaults so the switched model is actually used for subsequent messages. Fields with ``None`` values are skipped so partial overrides don't clobber valid config defaults. Nr)rrrrrrrr)rArmrnrvr)rr+rr _apply_stater|rr s r>rsz+GatewayRunner._apply_session_model_override([s// << ?KU<,;;QU ).( ( We,,U * *C,,s##C&)s#   y ) ) ""#455= Z((>1N Z((11N, -n$$rMc|||}|r |jjnd}|du|t|nddS)z _snapshot_session_model_overridez.GatewayRunner._snapshot_session_model_overrideF[sS..{;; >IS;+::t$D0*2*>XD   rMr* c,|sdS|drBt|dpi||j_n#||}| d|j_||dS)z?Restore the session override captured before a one-turn switch.Nrr|)rvrur/rmrnrAr )rr+r* _rst_states r>rz-GatewayRunner._restore_session_model_overrideO[s  F << ' ' >KO Z((.BLLD   , , 9 H H11+>>J%9= '6   -----rM agent_modelc||}|r |jjnd}|duo|d|kS)zGReturn True if *agent_model* matches an active /model session override.Nr)rArmrnrv)rr+r _ims_stater|s r>_is_intentional_model_switchz*GatewayRunner._is_intentional_model_switch][sK--k:: =GQ:*99Tt#L W(=(=(LLrMrcj|sdS||||sdS||}|i|jj}|B |n,#t $rt ddYnwxYw|j| dS)uPop ALL per-running-agent state entries for ``session_key``. Replaces ad-hoc ``del self._running_agents[key]`` calls scattered across the gateway. Those sites had drifted: some popped only ``_running_agents``; some also ``_running_agents_ts``; only one path also cleared ``_busy_ack_ts``. Each missed entry was a small, persistent leak — a (str_key → float) tuple per session per gateway lifetime. Use this at every site that ends a running turn, regardless of cause (normal completion, /stop, /reset, /resume, sentinel cleanup, stale-eviction). Per-session state that PERSISTS across turns (``_session_model_overrides``, ``_voice_mode``, ``_pending_approvals``, ``_update_prompt_pending``) is NOT touched here — those have their own lifecycles. When ``run_generation`` is provided, only clear the slot if that generation is still current for the session. This prevents an older async run whose generation was bumped by /stop or /new from clobbering a newer run's state during its own unwind. Returns True when the slot was cleared, False when an ownership guard blocked it. FNz%Failed to release active session slotTr) rrArJr releaser2r3r4r4r= )rr+rr;r s r>r z*GatewayRunner._release_running_agent_statec[s: 5  %d.J.J / / %5((55  J$E MMOOOO LL?$! J      ##%%%tsA&BBcH|sdSt|dd}||}||dS|j}|j |j|krdS|j}d|_d|_ ||S#t $r tddYdSwxYw)uIRelease the turn lease acquired by (``session_key``, ``run_generation``). Companion to the acquisition in ``_handle_message_with_agent`` (#64934). The token map is keyed by (routing key, run generation), so this can only ever free the lease its own turn acquired — a stale unwind whose generation was bumped by /stop or /new pops ITS token, and the registry's identity check refuses it if a newer turn already holds the lease. Idempotent and safe for bare test runners built via ``object.__new__`` (getattr defaults). FrNzFailed to release turn leaseTr) rVrArJr}r~rr2r3r4)rr+rrr;rJrs r>r&z!GatewayRunner._release_turn_lease[s 5466((55 =H,5z   #t'<'N'N5  $ ##E** *    LL7$L G G G55 s"A77&B! B!new_session_idc.|r|sdSt|dd}||}||dS|j}|j |j|krdS ||j|S#t $r tddYdSwxYw)uFollow a mid-turn session_id rotation with the held turn lease. Compression (session-hygiene pre-compression or the agent's own compressor) can rotate ``session_entry.session_id`` while this turn is in flight. The turn's flush targets the NEW id, so the serialization boundary must follow it — otherwise an alias routing key resolving the new id (topic tip-walk onto the fresh child) could start a concurrent turn the lease never sees (#64934 rotation-alias window). Call at every site that reassigns session_entry.session_id mid-turn. Fail-open no-op when there is no held token. FrNzFailed to rebind turn leaseTr) rVrArJr}r~rebindr2r3r4)rr+rrrr;rJs r>rz GatewayRunner._rebind_turn_lease[s . 5466((55 =H,5z   #t'<'N'N5 ??4#3^DD D    LL6L F F F55 sA**&BBc\|sdS||}||jtD]>}t ||d}t |t r||d?||t d||dS)uClear ALL conversation-scoped per-session state for ``session_key``. THE single conversation-boundary funnel. Call this — and nothing else — whenever a session_key crosses a conversation boundary: /new, /resume, auto-reset (idle/daily/suspended), expiry finalization, and the compression-exhausted auto-reset. Why a funnel: these boundaries used to each carry a hand-copied pop-list of the per-session dicts, and the lists drifted every time a new dict was added (#48031, #58403, #10702, #35809 were all "boundary X forgot dict Y" bugs — e.g. /new cleared the /model override but not the /model --once restore snapshot). Adding a new conversation-scoped dict now means adding its attribute name to _CONVERSATION_SCOPED_STATE below; every boundary picks it up automatically. Scope rules: - Conversation-scoped (cleared here): model/reasoning overrides, one-turn restore snapshots, pending model notes, last-resolved model cache, queued follow-up events, and the boundary security state (approvals, /yolo, slash-confirm, update prompts). - Turn-scoped (NOT cleared here): _running_agents/_ts, slot leases, turn-lease tokens — owned by _release_running_agent_state and the dispatch finally. - Idle agent-cache eviction is NOT a conversation boundary: the session is still alive and a resumed turn rebuilds from these overrides. Only true boundaries call this. Safe on bare test runners built via ``object.__new__`` (every access is getattr-guarded). Nz&Cleared conversation scope for %s (%s)) rArmr4rrVrtrurU&_clear_session_boundary_security_stater3r4)rr+rr;r rs r>r z'GatewayRunner._clear_conversation_scope[s@  F((55     $ $ & & & / - -DD$--E%&& - +t,,, 33K@@@ 4k6     rMcb|sdSt|dd}t|tr||d||}|d|j_d|j_ ddlm }n#t$rd}YnwxYw|J | |n3#t$r&}t d||Yd}~nd}~wwxYw ddlm}n#t$rYdSwxYw ||dS#t$r'}t d||Yd}~dSd}~wwxYw) zHClear per-session control state that must not survive a boundary switch.NrnFrr z?Failed to clear slash-confirm state for session boundary %s: %srwz:Failed to clear approval state for session boundary %s: %s)rVrtrurUrAr0rer rr r2r4r3r4rrR)rr+pending_skills_reload_notes _sec_staterIr_clear_approval_sessions r>rz4GatewayRunner._clear_session_boundary_security_state \s  F&- 0$' ' # 14 8 8 ? ' + +K > > >--k::  !.2J ! +:?J ! 7 & A A A A A A A & & &!%    &  ) "((5555    U   O O O O O O O    FF   # #K 0 0 0 0 0    LLL          sT1A88 BB B## C-CCC C,+C,0 C== D.D))D.c|sdS||j}t|jdz|_|jS)aeClaim a fresh run generation token for ``session_key``. Every top-level gateway turn gets a monotonically increasing token. If a later command like /stop or /new invalidates that token while the old worker is still unwinding, the late result can be recognized and dropped instead of bleeding into the fresh session. rr()r/r0rhr)rr+r0s r>r!z+GatewayRunner._begin_session_run_generation7\sH 1((55@ $' (A$B$BQ$F !((rMcn||}|rtd||||S)z7Invalidate any in-flight run token for ``session_key``.u-Invalidated run generation for %s → %d (%s))r!r3rz)rr+rr?s r>r z0GatewayRunner._invalidate_session_run_generationF\sG77 DD   KK?     rMr?c|sdS||}| |jjnd}t|t|kS)zEReturn True when ``generation`` is still current for ``session_key``.TNr)rAr0rrh)rr+r?r;rs r>rz%GatewayRunner._is_session_run_currentR\sN 4((555:5F%"11A7||s:..rMc|r|r|dS t|di|}| t|dt|dSdS#t$rYdSwxYw)zDBind a gateway run generation to the adapter's active-session event.Nrr)rVrvr rhr2)rr1r+r?interrupt_events r>rz*GatewayRunner._bind_adapter_run_generationZ\s k Z-? F %g/A2FFJJ;WWO*)A3z??SSSSS+*    DD sAA A A )release_running_staterq rr rc pKsdS}|r |jjnd}d}d} |r;|tur2t ||t |dd}t |dd} ||rG| Etjt|| fdfddd |dd d   |} t t| d d} | rt| r|} tj| j} d| vp*t%d| D}n#t(t*f$rd}YnwxYw|r$| |j| d{Vn!| |jd{V| r%t1| dr| | d|j_|r,dSdS)zFInterrupt the current run and clear queued session state consistently.Nrrrrgateway_turn_interruptc0Sr^r)_generation_at_interruptrr+sr>rz.\s0L0L#%=11rMr7gateway-turn-reaper-rT)rrrFrrinterrupt_session_activityrc3FK|]}|jtjjuVdSr^rcrhs r>rdz=GatewayRunner._interrupt_and_clear_session..\sC??J'"3"????????rMFr.r$)rArJrrrrVr rrr1rr@rr/r rerrr rrwrjrr2rr$r0pending_command_textr r )rr+r(rq rr r _iac_stater _process_task_id_process_baseliner1rrparamsaccepts_metadatars`` @r>rs z*GatewayRunner._interrupt_and_clear_sessionj\s2  F--k:: 1;E --    ]2III "=2B C C C&>   !(?!! $(#J#J  3$K$ $     1 =  3&(9:6)))))) D,> 5  ' ' 4 4 4  !9=J ! 6 2  - -k : : :  $ $[ 1 1 1 1 1 2 2s*AE33F F cK|j|sdSt|dd}t|dd}|r|dS |j|d{V}|r|ddnd}n#t$rYdSwxYw|dS|5||}t |t rt|dkrz|dturkt|dkr|dnd}|||kr ddddS|d|kr,||d|d|f||<n|d|d||f||<ddddS#1swxYwYdS) uRe-baseline a cached agent's stored message_count after THIS turn. The cross-process coherence guard (#45966) compares the session's on-disk ``message_count`` against the count snapshotted next to the cached agent, and rebuilds the agent on a mismatch. But the snapshot is taken at agent-BUILD time — before this turn writes its own user + assistant (+ tool) rows — and the cache entry is never rewritten on a reuse. So without this re-baseline, THIS process's own turn would grow ``message_count`` and the very next turn would see a mismatch and rebuild the agent — every turn, for every conversation — silently destroying the per-conversation prompt caching the cache exists to protect. Call this once a turn has completed and the agent has flushed its rows to the SessionDB. It snapshots the now-current count (which includes this process's own writes) so the guard only fires when a DIFFERENT process changes the transcript out from under us. The ``_sig`` is left untouched; only the count element is refreshed, and only when the same agent is still cached (no rebuild/eviction raced in between). Fail-safe: any DB error leaves the snapshot as-is, which at worst costs one unnecessary rebuild on the next turn. When the cache entry records a ``session_id`` (4-tuple form, #54947) that differs from the current ``session_id`` — meaning the cache was built for a DIFFERENT conversation under the same ``session_key`` — the snapshot is intentionally left untouched. Overwriting it with the current session's count would corrupt the original conversation's baseline and cause the next switch back to fire the cross-process guard spuriously. Fail-safe: the legacy 3-tuple shape (no ``session_id``) is still re-baselined as before. Nr r r rr|r)r() rRrVrrvr2rtrr7r) rr+rNrrr_liver _snapshot_sids r>rz0GatewayRunner._refresh_agent_cache_message_count\s"D   #: # Fd$7>> ~t44 fn F ".:::FFFFFFFFI9BLIMM/1555EE    FF  = F   ZZ ,,F 65)) KK!OO1I%<<< .1[[1__q $  ,*1L1L!        "!9%%$,06ay&)U.K{++#1Ivay%/{+1                  s*:A22 B?B A3E 8EEErIcj|r|sdSt|||j_dS)zDStage per-turn must-deliver notes for the next agent run (one-shot).N)rr/rm sidecar_notes)rr+rIs r>rz-GatewayRunner._set_pending_turn_sidecar_notes ]s; %  FFJ5kkK((5CCCrMc|sgS||}|gS|jj}g|j_t|trt |ngSr^)rArmrrtr)rr+r;stageds r>rz1GatewayRunner._consume_pending_turn_sidecar_notes]sa I((55 =I#1+-()&$77?tF|||R?rMc|jtjkrdS|jtj}||}|r|rt |dsdS ||pd}n-#t$r t ddYdSwxYwd}|r-| |}|j j }||j _ |||ndkrdS|sdSd|d S) ayReturn a ``[Voice channel now: ...]`` note when VC state changed. Compares the live Discord voice-channel context against the last value delivered for this session and returns a note only on change (including leaving the channel). Unchanged state returns ``None`` so the per-turn member/speaking serialization cannot churn the prompt. Nget_voice_channel_contextrz!voice-channel context read failedTrz5[Voice channel now: not connected to a voice channel]z[Voice channel now: r)rrrrrvrrr r2r3r4r/rmvc_last) rrr(r+r1rvc_nowvc_prev _vc_states r>rz)GatewayRunner._voice_channel_sidecar_note]s3 ?h. . .4-##H$455%%e,, W :U)V)V 4 66x@@FBFF    LLrtz,GatewayRunner._pinned_session_context_prompt7]s--gzBB  U11+>>J@JTz.<rdz6GatewayRunner._ephemeral_change_key..]s$??a!'??????rMc 3K|]M\}}|jtt|ddpdtt|ddpdfVNdS)rrr2N)rrwrV)rbr;hcs r>rdz6GatewayRunner._ephemeral_change_key..]s{ Ar GFB//5266Ir228b99rMrQ)#r r(rrrrrrrrwrrrr2rjrrrrr2rr* chat_topicr)rrVrshared_multi_user_sessionrconnected_platforms home_channelsrr rr r ) rr!r srcr discord_ids discord_toolsr slack_toolsrr home_display key_tuples r>rz#GatewayRunner._ephemeral_change_keyP]s n),=3<%%2  <8+ + + = = = = = =#8#8#:#:CCCMCL&B''C&,"--CM'R((CK%2&&~.3 K  <8> ) ) ; ; ; ; ; ;!4!4!6!6?##CK  < < < < < <224455LL   LLL    !r " "  # $ $  # $ $  # $ $ $" % %  # $ $  !r " " Y--3 4 4 2 3 3    ??7#>??? ? ?  %288::       1 4~~d9oo44W==>>HHJJJsC88 DDc ||}|d|j_d|j_t |dd}d}|r6|5|j|d}dddn #1swxYwYn)t |dd}|||d}t|tr |r|dn|}| |turdSd| D}t||vrdS tj |j|fddt|dd dS#t"$r, ||YdS#t"$rYYdSwxYwwxYw) uRemove a cached agent for a session (called on /new, /model, etc). Pops the entry AND soft-releases the evicted agent's LLM client pool so the httpx connection (sockets + held buffers) is freed promptly rather than waiting on CPython GC — AIAgent holds reference cycles (callbacks, tool state) that delay refcount collection, so a manual release is required to keep gateway RSS flat across many /new, /model, undo and reset operations (#29298, same leak class as #25315). The release is soft (``release_clients()``): it frees the client pool and per-turn child subagents but PRESERVES the session's terminal sandbox, browser daemon, and tracked bg processes (keyed on task_id), because the session may resume with a freshly-built agent. Call sites that want a hard teardown (true conversation boundaries like /new) already call ``_cleanup_agent_resources`` before evicting; ``release_clients`` is idempotent and safe to run again after that (the client is already None). Cleanup runs on a daemon thread so we never block holding ``_agent_cache_lock`` on slow socket teardown — mirrors the cap-enforcer and idle-sweeper paths. Nr r rcHh|]\}}||tut| Sr^rrrbrKr s r>rQz4GatewayRunner._evict_cached_agent..]<   1}*A!A!A qEE!A!A!ArMTz agent-evict-rr)rArmrr rVr rUrtrrrOrrrrrwrr2)rr+ _evict_stater rrr running_idss r>r z!GatewayRunner._evict_cached_agent]s16// <<  #6:L % 304L % -1488  8 C C+// TBB C C C C C C C C C C C C C C CT>488F! **[$77(%88QWQ ' =E%<<< F  1133   e99 # # F   7X;C $4$4SbS$9;;     eggggg    00777777      s=A//A36A3AE FE11 F;F?FFinterrupt_depthc|dkrHddlm}tj|_d|_|j|_t|drd|_d|_ dS)aReset per-turn state on a cached agent before a new turn starts. ``_last_activity_ts``, ``_last_activity_desc``, and ``_last_activity_provenance`` are only reset for fresh external turns (depth 0); they are a semantic triple - description and provenance describe the activity *at* ts, so updating one without the others would make get_activity_summary() misleading. For interrupt-recursive turns all three are preserved so the inactivity watchdog can accumulate stuck-turn idle time and fire the 30-min timeout (#15654). The depth-0 reset is still needed: a session idle for 29 min would otherwise trip the watchdog before the new turn makes its first API call (#9051). rrEzstarting new turn (cached)_last_flushed_db_idxN) rrrU_last_activity_ts_last_activity_descUNKNOWN_last_activity_provenancerr/_api_call_count)rr-rs r>rz)GatewayRunner._init_cached_agent_for_turn]sm a   A A A A A A&*ikkE #(DE %.@.HE +u455 /-.* !rMrcX|t|dsdSt|dddS t|dd}|dS||j|}|dS||sdS||rdSt|dd}|t|tr|ndt d|dS#t$r'}t d||Yd}~dSd}~wwxYw)uFire on_session_end extraction before soft-evicting a live agent. Soft eviction (``_release_evicted_agent_soft``) deliberately keeps the session resumable and does NOT fire ``on_session_end`` — that hook is reserved for the true session boundary, tear-down done by ``_session_expiry_watcher`` when the session finally expires. But the watcher tears down whatever agent it finds in ``_agent_cache`` at expiry time. If cache pressure (the LRU cap) soft-evicts a finalizable session's agent BEFORE it expires, the watcher later finds no cached agent and ``on_session_end`` is silently skipped — memory providers never see the transcript (#11205, LRU-cap variant). We hold the live, fully-scoped agent right now, so commit its end-of-session memory extraction here using the agent's own memory manager (correct per-user/chat scoping, no reconstruction). This uses ``commit_memory_session`` — extraction WITHOUT provider teardown — so the eviction stays soft and a resumed turn keeps working. Only fires for sessions the expiry watcher will eventually finalize (finite reset policy). For ``mode == "none"`` sessions the watcher never runs, so there is no missed-boundary to compensate for and we skip the commit (the agent is simply released). Best-effort: any failure is swallowed so eviction still proceeds. Ncommit_memory_sessionri rr[zlCommitted on_session_end extraction before soft-evicting finalizable session=%s (cache pressure, pre-expiry)z)Pre-evict memory commit failed for %s: %s) rrVr9 rrvis_session_finalizabler r6rtrr3r4r2)rrrr rr(rs r> _commit_memory_before_soft_evictz.GatewayRunner._commit_memory_before_soft_evict^sp4 =/F G G= F 5+T 2 2 : F OT?D99F~  ! ! # # #O'',,E} 0077 ))%00 u&94@@H  ' 'Jx4N4N(XTX Y Y Y LLFGJ      O O O LLDc2 N N N N N N N N N Os/C80C80C8C8AC88 D)D$$D)c\|||||dS)aZCommit end-of-session memory (if warranted), then soft-release. Runs on the daemon eviction thread so the memory-provider call and the client teardown never block the caller's held cache lock. Order matters: commit uses the live agent's memory manager before ``release_clients`` drops the message buffer. N)r8r)rrrs r>_commit_then_release_softz'GatewayRunner._commit_then_release_soft9^s4 --eS999 ((/////rMc|dS t|dr|n||n#t$rYnwxYwt|drg|_t|dr d|_dSdS)uSoft cleanup for cache-evicted agents — preserves session tool state. Called from _enforce_agent_cache_cap and _sweep_idle_cached_agents. Distinct from _cleanup_agent_resources (full teardown) because a cache-evicted session may resume at any time — its terminal sandbox, browser daemon, and tracked bg processes must outlive the Python AIAgent instance so the next agent built for the same task_id inherits them. Nrelease_clientsr[_db_flush_scan_prefix)rr<rd r2r[r=)rrs r>rz)GatewayRunner._release_evicted_agent_softD^s = F u/00 5%%''''--e444    D  5- . . )&(E # 51 2 2 /*.E ' ' ' / /s:A A Act|dd}|cddlm} |t}n=#t$r0}t d||i}Yd}~nd}~wwxYw||_|S)zOperator-configured agent-cache bounds, resolved once per process. Resolved lazily rather than in ``__init__`` so it also works for the ``__new__``-constructed runners used by tests and by the slash-command mixin. _agent_cache_bounds_cacheNr)resolve_agent_cache_boundsz)Agent cache bounds config read failed: %s)rVgateway.agent_cache_pressurer@rsr2r3r4r?)rboundsr@rs r>_agent_cache_boundsz!GatewayRunner._agent_cache_boundsi^s:DAA > O O O O O O 8334H4J4JKK 8 8 8 H"MMM43B77 8.4D * s3 A-&A((A-cJ|j}|r|ntS)u@Effective LRU cap — the configured override, else the default.)rCr _AGENT_CACHE_MAX_SIZEr configureds r>_agent_cache_capzGatewayRunner._agent_cache_cap^s&--//8 'Bzz-BBrMcJ|j}|r|ntS)uDEffective idle TTL in seconds — configured override, else default.)rC idle_ttl_secs_AGENT_CACHE_IDLE_TTL_SECSrFs r>_agent_cache_idle_ttlz#GatewayRunner._agent_cache_idle_ttl^s&--//= 'Gzz-GGrMc `ddlm}m}m|}|jsdSt |dd}t |dd}|r|dS|}| ||jkrdSd|Ddtdtd tffd }|5d | D}||||j |j } | D]\} } || d dddn #1swxYwY| sqtfd |D} tfd|D} t d||jt%|| | | r| sdnddSt%| }t d||j|dd| D t)j|j| fddn%#t0$r|| YnwxYw|S)uShed cached transcripts once the gateway's own heap nears its budget. The LRU cap counts entries and the idle sweep counts seconds; neither knows that one cached agent pins a full ``_session_messages`` transcript — tens of MB on a session with 100+ tool calls. A gateway serving many chats therefore holds every warm transcript indefinitely: agents that took a turn within the TTL are never idle-swept, and the sweep additionally defers finalizable sessions until they expire. RSS climbs until the cgroup throttles and SIGTERM can no longer flush inside systemd's stop timeout (#80764). This is the missing valve. Above the configured anonymous-RSS budget it evicts LRU agents through the same soft path the cap enforcer uses, so the transcript is dropped and rebuilt from the persisted session on the next turn. Three things are never touched: agents mid-turn (their clients and sandboxes are in use), the most recently used sessions (whose prompt cache is worth the most), and any session whose live transcript has not finished reaching disk. Returns the number of entries evicted (0 when memory is fine). r)plan_pressure_evictionsread_anon_rss_mb transcript_persistence_caught_upr Nr cHh|]\}}||tut| Sr^r(r)s r>rQzBGatewayRunner._sweep_agent_cache_under_pressure..^r*rMrrr-cZ| |turdSt|vrdS|Srlr()rrr,rPs r> _is_evictablezFGatewayRunner._sweep_agent_cache_under_pressure.._is_evictable^s?})@ @ @u%yyK''u33E:: :rMcZg|](\}}|t|tr |r|dn|f)Srrtr)rbrrs r>rzCGatewayRunner._sweep_agent_cache_under_pressure..^sMC*UE":":OuOeAhh%PrM) is_evictable max_evictionsprotect_recentc3HK|]\}}|t|vdVdSNr()r)rbrKr r,s r>rdzBGatewayRunner._sweep_agent_cache_under_pressure..^s<\\$!QQ]r!uuP[G[G[AG[G[G[G[\\rMc3pK|]0\}}|)|tur t|v!|,dV1dSr[r()rbrKr r,rPs r>rdzBGatewayRunner._sweep_agent_cache_under_pressure..^sjAq=444qEE,,88;;- -,,, rMzAgent cache pressure: anon RSS %dMB over budget %dMB but no evictable session (%d cached, %d mid-turn, %d blocked on un-flushed persistence)%su — transcripts are not reaching the session DB (session persistence disabled or failing?); the memory valve cannot shed sessions until they persist.u8 — memory will keep climbing until those turns finish.uWAgent cache pressure: anon RSS %dMB over budget %dMB — evicting %d LRU session(s): %src3 K|] \}}|V dSr^rN)rbrrKs r>rdzBGatewayRunner._sweep_agent_cache_under_pressure..^s&--fc1c------rMTzagent-cache-pressurer)rArNrOrPrCmemory_high_mbrVrOrwr rrmax_evictions_per_passrYrUr r3rr7rfrr_release_pressure_batchrr2)rrNrOrBrr rss_mbrSorderedplanrrK _mid_turn _unflushed evicted_countr,rPs @@r>r z/GatewayRunner._sweep_agent_cache_under_pressure^s,          ))++$ 1~t441488 1!!## >Vf&;;;1  1133    ;s ;3 ;4 ; ; ; ; ; ; ; & &"(,,..G+**$;%4 D  & &Q 3%%%% & & & & & & & & & & & & & & & & \\\\'\\\\\I#J NN,-s7||Y "T+4TEET   1D  $ F)= II----- - -     /  3W+     egggg / / /  ( ( . . . . . / s%'AD  DD0H H+*H+rcc |rf|d\}} |||n3#t$r&}td||Yd}~nd}~wwxYw~|f ddlm}|dddS#t$rYdSwxYw)u9Release a pressure-evicted batch, then return the heap to the OS. Sequential on one daemon thread rather than a thread per agent: the batch is already capped, and the point of the pass is to reclaim memory, not to race N teardowns. The trailing ``malloc_trim`` is what turns "Python dropped the transcript" into "RSS actually fell" — without it glibc keeps the freed arenas and the cgroup never notices. The plan is drained (``pop`` + ``del``) rather than iterated so that no local reference pins the evicted agents when ``gc.collect`` + ``malloc_trim`` run — otherwise the trim frees almost nothing in this pass, the next tick re-reads a still-high RSS, and the valve over-evicts an extra batch of warm prompt caches every cycle. rz"Pressure release failed for %s: %sN trim_memoryTagent_cache_pressure)rr)rUr:r2r3r4hermes_cli.mem_trimri)rrcrrrris r>r`z%GatewayRunner._release_pressure_batch^s !JC L..uc:::: L L L A3KKKKKKKK L    7 7 7 7 7 7 Kd+A B B B B B B    DD s&3 A#AA#*A?? B  B c t|dd}|dSt|dsdSd|D}|}t dt ||z }g}|dkrt |}|d|D]c}||}t|tr |r|dnd} | t| |vrL| || fd|D]\}} | |dt ||z } | dkr*tdt ||| |D]l\}} td|t || rQz9GatewayRunner._enforce_agent_cache_cap..6_r*rMrukAgent cache over cap (%d > %d); %d excess slot(s) held by mid-turn agents — will re-check on next insert.z;Agent cache at cap; evicting LRU session=%s (cache_size=%d)Tzagent-cache-evict-rr)rVrrOrHrCr7rrrvrtrrrrUr3rrzrrr:r) rrr,capexcess evict_plan ordered_keysrrrrKremaining_over_caps r>rz&GatewayRunner._enforce_agent_cache_cap_s1~t44 > Fv}--  F   1133   ##%%QF c)**"$ A:: ..L#GVG, 0 0 3$.ue$<$<PPaD$Ek)A)A!!3,////  " "FC JJsD ! ! ! ! [[3.  ! ! NNDF S"4    %  JC KKMS[[     98c#2#h88  %'''#  rMc t|dd}t|dd}||dStj}|}g}d|D}|5t |D]\}}t |tr |r|dnd} | )t| |vr;t| dd} | O|| z |krd} t|dd} | .| | j |} n#t$rd} YnwxYw| -| +| | r| | s||| f|D]\}} ||d dddn #1swxYwY|D]n\}} t"d||t| d|z t'j|j| fd d |dd  ot/|S) uEvict cached agents whose AIAgent has been idle past the idle TTL. Safe to call from the session expiry watcher without holding the cache lock — acquires it internally. Returns the number of entries evicted. Resource cleanup is scheduled on daemon threads. Agents currently in _running_agents are SKIPPED for the same reason as _enforce_agent_cache_cap: tearing down an active turn's clients mid-flight would crash the request. r Nr rcHh|]\}}||tut| Sr^r(r)s r>rQz:GatewayRunner._sweep_idle_cached_agents.._r*rMr0rz3Agent cache idle-TTL evict: session=%s (idle=%.0fs)Tzagent-cache-idle-rr)rVrUrLrOrrrtrrr9 rrvr2r7r rrUr3rzrrrrr7)rrr ridle_ttlto_evictr,rrr last_activityr\r rKs r>r z'GatewayRunner._sweep_idle_cached_agentso_s~t441488 >U]1ikk--// "  1133   4 &4 &"6<<>>221 21 2 U$.ue$<$<PPaD=e99 ++ '/BD I I  (-'8332%)M$T?DAAF-!-"11333,2O,?,?,D,DM$---(, -&1"."99-HH/ & : := I I/!OOS%L111" & &Q 3%%%% &g4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &j#  JC KKES75*=sCCC     7X3SbS33     egggg8}}s82B F50D10F51 E=F5?EA(F55F9<F9cLtjdd}|r|dSt }|dpid}|pd}|r|dSdS)zReturn the proxy URL if proxy mode is configured, else None. Checks GATEWAY_PROXY_URL env var first (convenient for Docker), then ``gateway.proxy_url`` in config.yaml. GATEWAY_PROXY_URLrr]r9 proxy_urlN)rrrxrrsrv)rrrs r>_get_proxy_urlzGatewayRunner._get_proxy_url_s i+R006688  #::c?? ""$$wwy!!'R,,[99yb!!  #::c?? "trMscfgrz(tuple[Any, Optional[Callable[[], None]]]c ddlm}d}|jtjkrt |dr ||jf dd}t|dd}|s|d krtd |r|j nd }d } |jtj krd }d} |jtjkr tt|d dpdnd} ||j |j || | |jpdt|dd pd } | |fS)uqBuild the shared ``StreamConsumerConfig`` and the optional Telegram pause-typing closure used by both agent-run paths. ``on_missing_cursor`` controls how platforms whose adapter sets ``SUPPORTS_MESSAGE_EDITING = False`` are handled — both semantics are preserved verbatim from the pre-refactor call sites: - ``"fallback"`` (proxy path): stream anyway with an empty cursor. - ``"raise"`` (in-process agent path): raise ``RuntimeError`` so the caller's ``except`` skips streaming entirely. Returns ``(consumer_cfg, pause_typing_before_finalize)``. r)StreamConsumerConfigNrOr-c0||dSr^)rO)r_chat_ids r>rzRGatewayRunner._build_stream_consumer_config.._pause_typing_before_finalize_s..x88888rMSUPPORTS_MESSAGE_EDITINGTrz(skip streaming for non-editable platformrFfresh_final_after_secondsr@editr) edit_intervalbuffer_thresholdcursor buffer_onlyrrrr)rr~rrrrr2rVrrMATRIXrirrr) rr(r|r1rr~r_adapter_supports_edit_effective_cursor _buffer_only_fresh_final_secsrs r>rz+GatewayRunner._build_stream_consumer_config_sc* A@@@@@(,% ?h/ / /GGE\4]4] /  9 9 9 9 9")2Ld!S!S% K*;w*F*FIJJ J+AIDKKr ?ho - - " L("333 '$ ;SAAHS I I I  -,,!2$$&7n.fk266<"   ;;;rMrc K ddlm} m} n#t$r dgdgdcYSwxYw} | sdgdgdS ddlm} m}  | dpd}n2#| $r*tj dd}YnwxYwn7#t$r*tj dd}YnwxYwd tffd }g}|r| d |d |D]J}|d }|d}|dvr|r| ||d K| d|d ddi}|rd||d<|r||d<d|dd}d}ttdddd}|ddlm}|}t%|j}t)}ddlm}|||d}||jo |jdknt|}||}|r ddlm}|} | r3||| d !\}!}"|| |j|!||"||"}n2#t$r%}#t> d#|#Yd}#~#nd}#~#wwxYwd}$|r&tCj"|#}$|} | r4 | $|j|$d{Vn#t$rYnwxYwd}%tKj%}& | dd%&}'| |''4d{V}(|(&| d(||)4d{V })|)j'd*kr|)(d{V}*t>)d+|)j'| |*dd,d-|)j'd.|*dd/gdgdcdddd{Vcdddd{V|r|*|$rS tCj+|$d0'd{VS#tBj,tBj-f$r|$.YSwxYwSd}+|)j/023d{V},|st>1d1pd2pddgdgte||d3d4ccdddd{Vcdddd{V|r|*|$rS tCj+|$d0'd{VS#tBj,tBj-f$r|$.YSwxYwS|,3d5d67}-|+|-z }+d8|+vr|+4d8d9\}.}+|.}.|.s4|.5d:r|.d;d}/|/di}2|2dd}|r|%|z }%|r|8|n#tlj9$rYnwxYwd8|+vte|+ttkrtwd?!6 dddd{Vn#1d{VswxYwYdddd{Vn#1d{VswxYwYn#tBj-$rt$r}3t><d@| |3|%szdA|3gdgdcYd}3~3|r|*|$rS tCj+|$d0'd{VS#tBj,tBj-f$r|$.YSwxYwSYd}3~3nd}3~3wwxYw|r|*|$rS tCj+|$d0'd{Vn#tBj,tBj-f$r|$.YnuwxYwnp#|r|*|$rS tCj+|$d0'd{Vw#tBj,tBj-f$r|$.YwwxYwwxYwtKj%|&z }4|s7t>1dBpd2pddgdgte||d3d4St>1dC| |pdddD|4te|%|%pdEd|d dF|%d gd9gte|||duot|%d4S)GaTForward the message to a remote Hermes API server instead of running a local AIAgent. When ``GATEWAY_PROXY_URL`` (or ``gateway.proxy_url`` in config.yaml) is set, the gateway becomes a thin relay: it handles platform I/O (encryption, threading, media) and delegates all agent work to the remote server via ``POST /v1/chat/completions`` with SSE streaming. This lets a Docker container handle Matrix E2EE while the actual agent runs on the host with full access to local files, memory, skills, and a unified session store. r) ClientSession ClientTimeoutuE⚠️ Proxy mode requires aiohttp. Install with: pip install aiohttpruH⚠️ Proxy URL not configured (GATEWAY_PROXY_URL or gateway.proxy_url))UnscopedSecretErrorrOGATEWAY_PROXY_KEYrr-c<sdSSrrrrr+sr>r3z>GatewayRunner._run_agent_via_proxy.._run_still_currentX`)%[%t// ^LL LrMrrrr4>rrrz Content-Typezapplication/jsonzBearer AuthorizationzX-Hermes-Session-Idz hermes-agentT)rr(streamNrzrrrRrrr.r)r1r2rzrrrrz+Proxy: could not set up stream consumer: %sr.r )r sock_readrz/v1/chat/completions)r3headersrzProxy error (%d) from %s: %sru⚠️ Proxy error (z): rr&uKDiscarding stale proxy stream for %s — generation %d is no longer currentrF)rr(rrr)rNrrQrlrrr(zdata: r z[DONE]r deltazAProxy SSE stream exceeded max buffer size without a line boundaryz Proxy connection error to %s: %su⚠️ Proxy connection error: uKDiscarding stale proxy result for %s — generation %d is no longer currentz>proxy response: url=%s session=%s time=%.1fs response=%d charsr z(No response from remote agent)r)=aiohttprrr\r{rrrOrxrrr2rrrvrVrrrurrsrTrSrrr rrr@rr2r3r4rrr rrUpostr5 rrrrr,rrr4iter_anyrzr7rrer!r3r4rr#_GATEWAY_PROXY_SSE_BUFFER_MAX_CHARSrjrP)5rr$rrr(rNr+rr:_AioClientSessionrrzrrO proxy_keyr3 api_messagesrrr4rrrrrr?rArSrrr0rrrrr stream_task full_response_start_timeoutr resprrrrr[robjr rr_elapseds5` `` r>_run_agent_via_proxyz"GatewayRunner._run_agent_via_proxy!`s.  Q Q Q Q Q Q Q Q Q   "i     ''))  "l   C J J J J J J J J G'Z(;<<BIIKK & G G GI&92>>DDFF  G C C C "5r::@@BBIII C MD M M M M M M M M .0  O   n M M N N N H HC776??Dggi((G,,,,##Tg$F$FGGGV@@AAA$23E"F  ='<'<''>,,,,,,,e1133"KK m + 2s . 3! 35,.-.)+25g,,.86;$$7@@@@@@@@@@@@@A A A A A A A A A A A A A b  * ''))) ))!*;DDDDDDDDDDD,g.DE)))&&((((() )] %||GI|FF$#fnn+1<<a+@+@LD&#'::<)@@@@@@@@@@@@@@@@@@@@@@@@@@@A A A A A A A A A A A A A A A A A A A A A A A A A A A F%        LL;Y J J J  &K&K&K "!"   * ''))) ))!*;DDDDDDDDDDD,g.DE)))&&((((() )        * ''))) ))!*;DDDDDDDDDDD,g.DE)))&&((((() )  * ''))) ))!*;DDDDDDDDDDD,g.DE)))&&((((() ) 9;;'!!##  KK]"s#!    #%"%g,,(&+   L  (b#2#.#m:L:L   ,P/PG44$??!'ll$"2$">"V4 CVCV   s$$B!A.-B!.,BB!BB!!1CC(AI99 J(J##J(-"L LL6[6"[$8A)[![$3[6P;;/Q-,Q-1[ Z-A[[$'[6T///U! U!%B[.ArzGatewayRunner._run_agent>asi4wtXt446JERR ..&*'!1DT-*%9'=)/ <_profile_name_for_sourcez&GatewayRunner._profile_name_for_sourceoash"x..v3U;; 4!1488 4?????? )). T::!&+t<<&v/?FF GG    NNR$    44    #? " ] O !6> FK . .@PRV0W0W   tsA B2CCc ,ddlm}m}m}ddlm}d} |jpd}|r|}|s||}|r|}|s |pd}||}|rQ||sFt d||j j |j t|dd|S|S#t$rMt d |j j |j t|dd|pd d |cYSwxYw) uResolve which profile's HERMES_HOME should serve this inbound source. Resolution order: 1. ``source.profile`` — set by /p// URL prefix, per-credential adapter ownership, OR profile_routes matching at ``build_source`` time. 2. ``_profile_name_for_source`` — re-run routing here as a defensive fallback for sources that bypass ``build_source``. 3. The active profile (the multiplexer's own home). r)r;r profile_exists)rxNrrJz\Profile %r does not exist for source %s/%s (guild_id=%s), falling back to global HERMES_HOMErzjFailed to resolve profile directory for source %s/%s (guild_id=%s), falling back to global HERMES_HOME: %sz (no profile)Tr)r?r;r rrrxrrxrr3rrrr2rVr2) rr(r;r rrxexplicit_profiler profile_dirs r>rz.GatewayRunner._resolve_profile_home_for_sourceas          544444 # %N(b//11D (#'  ,44V<<,'+$ >..00=I)/$//K )t(<(< )9$O)NFJ55 '(((  % % % NN9% D11 2N    #?$$ $ $ $ %sB%B<:B<tadid5d6|d7|(d8|'d9|-d:|!d;|"d<|&d=|/d>ړd?|1d@|0dA|3dB|2dC|=dD|>dE˓dFʓdG|dH|dIݓdJdK|d |dL|)dM|+dN|.dO|4dP|5dQ|:dR|dS|dT| dU|dVdWdX|dY| dZ| d[| d\| }?tc|?}@|@j2|?_2|@j3|?_3d}Aj|%j4kr!}B|By tE|Bd]d}Ctk|Crt |C}An-t |Bj6j7 d^d}An#t($rd}AYnwxYwtqjj9| |A_}Dj|%j%krGtEd`dr6tEdadr%j9st7tEdadnd}E|DrT|Dj9kr:| n4;jj)|DtEdbd| cnd}F|F|Erdd| i}Fty|Fje}Fj|%j=|%j$fvr j9r| s|Er| nd}Gڈfdf}H|F|?_>|G|?_?|@j@}Idg؉|?_Adg}Jdg}Kdgdg|J|?_B|K|?_C|?_D|?_EtWj,}LjF}M|L|?_G|M|?_H|@jI|?_I|@jJ|?_J!}Nj)}Oj|%j=krj9r| r|D| dgn`|DrT|Dj9kr:| n4;jj)|DtEdbd| cndՉՀ|Erdd| i|N|?_K|O|?_L|?_M|@jN|?_N!}P|duo3t7tE|dh|Odik}Q|P|Qr|PPj)r ddjlQmR}RddklSmT}S|S}TjUptWjV}U|R|Pj)|T|Uլl}V|VjWr|Vd<|VXn2#t($r%}WtZdm|WYd}W~Wnd}W~WwwxYw|@j[d}X|.rtWj\|I}Xd}Y|)rtWj\|H}Yd}Zfdn}[tWj\|[}Z؈fdo}\tWj\|\}]tWj]шш؈fdp}^tWj\|^}_tdqdr}`|`dkr|`nd|$dsddt҉d+krdtj_ԈLjʈˈ̈Έ҈ԈՈ؈ۈ݈fdu}atWj\|a}bddvdwt6dxt dt fdy}c tdzd{}d|ddkr|dnd}etd|d}}f|fdkr|fnd}gd}hdd~l`ma}i|pd}j|ib|j}k|j|?_c|k|?_dtj]tj]}ltjf}m։ցֈfdnd}n׈؈fd}o|eDtjgt|j|k|e|l|md|nd d|jdddXtWjij|od}pd}q|ed}r tWjkh|qd{V\}s}t|sr̠l}rnwѠms`r]!}ud}v|ur=|vr:tO|udr)|unr|ujo }w|wr|wjpnd}x|wrtE|wddpg}yq|wr7r|w|u|xpddj9r dj9indd{V\}x}tn|xs|yrt|w}xttd|_urdnd|vv|xѠd}z|z|zwdnd}r tWjkh|qd{V\}s}t|sr̠l}rn|lmrd}pnljd}{d}||{rLtO|{dr< |{x}}|} dd}|n#t($rYnwxYw|hs|g|||gkrd}h!}~|~rt'|gdzpd}t'|e|gz dzpd} |~yj)d|d|dլd{Vn2#t($r%}tZd|Yd}~nd}~wwxYw|||ekrFd}ptjgt|j|k|l|m|ndd|jdddXnwѠms`r]!}ud}v|ur=|vr:tO|udr)|unr|ujo }w|wr|wjpnd}x|wrtE|wddpg}yq|wr7r|w|u|xpddj9r dj9indd{V\}x}tn|xs|yrt|w}xttd|_urdnd|vv|xѠd}z|z|zwd|prd}i}|r6tO|dr& |x}n#t($rYnwxYw| dd}| dd}| d}| dd}| dd}t{d||e||||pd|rt|tt'|edzpd}d|dg}|r$|~d|d|dd|d|d n#|~d|d|dd|d|d |~dd||Jdr|Jd dgng||Kdpgddd}rd}|Jd}|r| dnd}|tO|dr|st} ddlm}m}tE|ddpd}|r||vr |||}n#t($rYnwxYw|j|kr0|js|Jd}!}d}z|z|z |zdd{Vn2#t($r%}tZd|Yd}~nd}~wwxYw|zjus1|zwd|zdd{V|zjr.|,tE|dd}tk|r |d}d}|rP|rMrJt|}||}| dr^|s\| drG| d}t|rttdpd|n|}n|r|jppd}tE|ddpg}q|rFr|||d‰j9r dj9indd{V\}}t|st|}n|pt|}|r#tZd|ddą|r@|s>|s<| dŦ}|r%|}tZd|ddą|r|dr|dd}|r"|dddOnd}|rB ddlm}||rttd|d}d}n#t($rYnwxYwjr8|s|r4ttdɉpdd}d}|s| rntZd|ddą|r:tO|d˦r*r(|jvr|j|jkrTtd|!}|r|rt1|jo|n(|r&tO|dͦr|||Jdp|r|dΜ |Xr|X|Yr|Y|_|b|Zro ddu}|s3|Z |Zd{Vn#tVj$rYnvwxYw tWj|Zdd{VnT#tVjtVjf$r6|Z |Zd{Vn#tVj$rYnwxYwYnwxYwd}|J|jusC|wdϦ |dd{Vn#t($rYnwxYw|]rЦjrdѦ|X|Y|_|]|bfD]#}|r |d{V#tVj$rYwxYw$S| d}|sd}|r|Zr tWj|Zdd{Vn#tVjtVjf$r6|Z |Zd{Vn#tVj$rYnwxYwYn1t($r%}tZd|Yd}~nd}~wwxYwt|rtr|rn|pi}t | dӦ}| dd}|c|||v} ddlm}|||}n#t($rd}YnwxYw|rttd։pdn|r |rttd׉pdnttd؉pd||| || d ٦d{Vn2#t($r%}td|Yd}~nd}~wwxYwtEt[|dd`|ܦ}tk|r9 |}tIj|r|d{Vn#t($rYnzwxYwnu|rstO|dݦrc|jd}tk|r9 |}tIj|r|d{Vn#t($rYnwxYw| d|}}|}d}d}}d}|tE|d5dp}|r|sttdމpd||Xr|X|Yr|Y|_|b|Zro ddu}|s3|Z |Zd{Vn#tVj$rYnvwxYw tWj|Zdd{VnT#tVjtVjf$r6|Z |Zd{Vn#tVj$rYnwxYwYnwxYwd}|J|jusC|wdϦ |dd{Vn#t($rYnwxYw|]rЦjrdѦ|X|Y|_|]|bfD]#}|r |d{V#tVj$rYwxYw$S |}n/#t($r"tZd߉pddYnwxYw||||d{V}|||Xr|X|Yr|Y|_|b|Zro ddu}|s3|Z |Zd{Vn#tVj$rYnvwxYw tWj|Zdd{VnT#tVjtVjf$r6|Z |Zd{Vn#tVj$rYnwxYwYnwxYwd}|J|jusC|wdϦ |dd{Vn#t($rYnwxYw|]rЦjrdѦ|X|Y|_|]|bfD]#}|r |d{V#tVj$rYwxYw$S|}tE|dTd}tE|dd}!}|ZrXVtE|dd}|CtE|dd}tk|r#|}|r||!}|r4 |j)լd{Vn#t($rYnwxYw|d{V|||||||dz||| d{V}tc|||Xr|X|Yr|Y|_|b|Zro ddu}|s3|Z |Zd{Vn#tVj$rYnvwxYw tWj|Zdd{VnT#tVjtVjf$r6|Z |Zd{Vn#tVj$rYnwxYwYnwxYwd}|J|jusC|wdϦ |dd{Vn#t($rYnwxYw|]rЦjrdѦ|X|Y|_|]|bfD]#}|r |d{V#tVj$rYwxYw$S |Xr|X|Yr|Y|_|b|Zro ddu}|s3|Z |Zd{Vn#tVj$rYnvwxYw tWj|Zdd{VnT#tVjtVjf$r6|Z |Zd{Vn#tVj$rYnwxYwYnwxYwd}|J|jusC|wdϦ |dd{Vn#t($rYnwxYw|]rЦjrdѦ|X|Y|_|]|bfD]#}|r |d{V#tVj$rYwxYw$n#|Xr|X|Yr|Y|_|b|Zro ddu}|s3|Z |Zd{Vn#tVj$rYnvwxYw tWj|Zdd{VnT#tVjtVjf$r6|Z |Zd{Vn#tVj$rYnwxYwYnwxYwd}|J|jusC|wdϦ |dd{Vn#t($rYnwxYw|]rЦjrdѦ|X|Y|_|]|bfD]#}|r |d{V#tVj$rYwxYw$wxYwd}t|rtr|r ds|r dԦpd}| p|dk}t |r dӦ}t |otE|dd}d}|rG|sEtE|dd}tk|r! ||du}n#t($rd}YnwxYw|rd}t |r d}|c|||v}|s-|s+|s|r'ttdpd|||d|rd<n|s6|s3|r0|-|j}tE|dd}tE|ddrttdpdn}|r|dkr| | j)||dd{V}tE|ddr$d|rd<ttdpd|n-tdpdtE|ddn#t($r(}tdpd|ĦYd}~nd}~wwxYwttdpdn|s|r||j}|r |jj)||rddd{Vd|rd<ttd|pdn5#t($r(}tdpd|ĦYd}~nd}~wwxYwr|;rrt|rtr|r dstO|;drtkʦЉj)|;tWj,dȈɈЈfd } |;|ʼnܦn2#t($r%}tZd|ƦYd}~nd}~wwxYw|rS)a Run the agent with the given message and context. Returns the full result dict from run_conversation, including: - "final_response": str (the text to send back) - "messages": list (full conversation including tool calls) - "api_calls": int - "completed": bool This is run in a thread pool to not block the event loop. Supports interruption via new messages. )r$rrr(rNr+rr:Nrr8r-c<sdSSrrrsr>r3z:GatewayRunner._run_agent_inner.._run_still_currentbrrMr'rrrDrR)set_tool_preview_max_lentool_preview_length)set_friendly_tool_labelsfriendly_tool_labelsT tool_progressHERMES_TOOL_PROGRESS_MODErEtool_progress_overridesrtool_progress_grouping accumulate)choose_status_phraseresolve_status_phrase_catalogF)rJrK allow_genericrBrJrKrcB|r7t j}d|D}||vrt |sdS ||}t|tr0|dkr|rdndSt|rdndS)z8Return off|raw|generic for a gateway visibility surface.c,h|]}t|SrNrO)rbitems r>rQzPGatewayRunner._run_agent_inner.._display_surface_mode..Qbs0!!!,D11!!!rMrgenericrx)rrrHrtrwrxryr) rBrJrKrrUrVrr?rSr(rAs r>_display_surface_modez=GatewayRunner._run_agent_inner.._display_surface_modeGbs- !#:6?#K#K !! =!!! % 55:; V]^^6!5++KwPWXXE%%% =%++--*=*=*?*?9*L*L$1r5 waitingr; long_runningz still on itzone sec)r2r3r4)rdr?rr _phrase_err_generic_status_catalog_generic_status_recentrs r>_generic_status_phrasez>GatewayRunner._run_agent_inner.._generic_status_phrase_bs r++'#13  r r r I;WWW(,0b(b(b}}hqqqqqqq rs A "AA A r >logr live_statusrsupports_status_textrrinterim_assistant_messages)rJrKrrvoice_mixer_activecleanup_progressdelete_messager%r(r3r1r2r=r;rr>r8r6rDr?rArEr9r:r{r|r$rrSrArrrrrrrrrrrNr+rrr:rurtrv_effective_reply_in_threadr8r7rTrVrrr5 rcTKdSddlm}ddlm}tdz }|dd||dz d d d }||d tjdt}| tj d|_ | | |dnq#j$rt#jdd{VYnKt&$r?}t(d|t#jdd{VYd}~nd}~wwxYw#t"j$rYnwxYw |dn#j$rYnt&$rYnwxYwF|| ||dS#t&$rYdSwxYw# |dn#j$rYnt&$rYnwxYwF|| ||w#t&$rYwwxYwxYw)uHDrain log_queue and append tool-call lines to tool_calls.log. Only active when ``display.tool_progress`` is ``log``. Uses a RotatingFileHandler (5MB × 3 backups) so the audit log can't grow unbounded, and the shared RedactingFormatter so secrets never land on disk. Nr)RotatingFileHandlerRedactingFormatterr Trztool_calls.logiPr)rQ)maxBytes backupCountrRz %(message)szhermes.tool_calls.Fr) rzwrite_tool_log error: %sr()logging.handlersrrrrlr setFormatterrSrTrsetLevelINFO propagate addHandlerrzrrrrr2r3rPr removeHandlerflushrk )rrr file_handler tool_loggerrr6rs r>write_tool_logz6GatewayRunner._run_agent_inner..write_tool_logacs  < < < < < < 7 7 7 7 7 7"V+G MM$M 6 6 6..**( L  % %&8&8&G&G H H H!+,PI,P,PQQK   . . .$)K !  " "< 0 0 0 //#((y/C/C/E/EFFFF ;111%mC00000000000$/// %?CCC%mA............../ /)    #((y/C/C/E/EFFFF ;$ )),777 &&((( &&((((( DD#((y/C/C/E/EFFFF ;$ )),777 &&((( &&(((( DsE"(C0/E"0$EE" E5EE"EE""E41H3E44H:(F## F;/ F;:F;(G?? H  H J'(H<;J'< IJ' IJ'IJ'.(JJ' J$!J'#J$$J')rr5 rr)StreamingTTSConsumer)_load_tts_config)r1r2 tts_configrrz+Could not set up streaming TTS consumer: %scKtdD]G}d#dd{VdStjdd{VHdS)z8Wait for the stream consumer to be created, then run it.rrNr)r r rr)rKrPs r>_start_stream_consumerz>GatewayRunner._run_agent_inner.._start_stream_consumer$ds3ZZ * *)!,80377999999999FFmD))))))))))  * *rMc^Kd"tjdd{Vd"sdS6s tdpddSdj_jr ddSdS)NrruLSkipping stale agent promotion for %s — generation %s is no longer currentrr ) rrrr3rzr/rJrr*r )r:rrr+sr> track_agentz3GatewayRunner._run_agent_inner..track_agent0dsq/)mD)))))))))q/)  )$2N2N^33) b%2" :Fq/D   , , 1 7~ 8++J77777 8 8rMc XK sdS tjdd{V  }|s4t|dr| r d}|r|j }d}|y|jpd}t|ddpg} |r5 || |d j r d j ind d{V\}}n|s|rt|}td || d}||d dSnA#tj$rt&$r%}td |Yd}~nd}~wwxYw) NTg?has_pending_interruptrrrzVoice-interruptrr rz3Interrupt detected from adapter, signaling agent...barge-inz,monitor_for_interrupt error (will retry): %s)rrr@rrr<rvrrVr r rrr3r4r$rabortrr2)rr _peek_event pending_textr rK_stts_mon_err_interrupt_detectedr:rr+r(rs r>monitor_for_interruptz=GatewayRunner._run_agent_inner..monitor_for_interruptQdsL 8 [mC(((((((((6[ $77??H#! x)@AA("hFdFdepFqFq(" ,Q &"+3*D*H*H*U*UK+/L*6/:/?/E2 /6kr r r]rr r@ r2 rrr5 u⏳ Working — z minzHeartbeat edit failed: %sr/Frr.rjz#Long-running notification error: %s)r@rr NameErrorrZ rhrUrrr>rrvrwrfr2r^r2r3r4rVr0rrrj)_notify_adapter_heartbeat_msg_id _exec_ref _elapsed_mins _agent_ref_status_detail_want_iteration_detailrmr r-_heartbeat_text _notify_res_ee_ne_NOTIFY_INTERVALr|r{_executor_taskr_long_running_mode _notify_startrr:r?rSrr+r(rAs r>_notify_long_runningz._notify_long_runningds '"66v>>O"  04 L Mm$4555555555% .II %%% $III%BBa)E #TY[[=%@R$G H H *!_ !#)-++#$) **&'*6L"M"M '<<>>!#1"MM ZR0@-A Z ZBGWDX Z Z#%&&"8"8"XBFFCWReturn True only when the actual final reply reached the user.NFfinal_response_sentdelivered_final_matchesThas_delivered_text)rVr/r2r)consumerrrmatcherrs r> _stream_confirmed_final_deliveryzHGatewayRunner._run_agent_inner.._stream_confirmed_final_deliverydsux!6>> "(,EtLLG$$"7:..%77#(58$t %%,X7KT%R%R".//%%#$6$6z$B$BCCC$%%%$uu%5s# A AA<B B"!B"rr rir*rc0Sr^r)_turn_run_generationrr+sr>rz0GatewayRunner._run_agent_inner..Hes55kCWXXrMcdSrrNrNrMr>rz0GatewayRunner._run_agent_inner..JesdrMc rdnd}|d|_t|_SS#rdnd}|d|_t|_wxYw)Nrr)rr frozensetr)_finished_agent_turn_worker_doner:r!s r> _run_sync_with_timeout_lifecyclezHGatewayRunner._run_agent_inner.._run_sync_with_timeout_lifecycleMesU#8::%))+++:F&Ol1oo4O&2HJEIRFF3&))+++:F&Ol1oo4O&2HJEIRFTTTTs A >Br&) r:r'r/rr2r3r4r<r&zgateway-turn-watchdog-r)rrFrrrrrzVoice-backup-interruptrrzABackup interrupt detected for session %s (monitor task state: %s)rr rr@r>r?rr(u⚠️ No activity for zB min. If the agent does not respond soon, it will be timed out in z- min. You can continue waiting or use /reset.r.z!Inactivity warning send error: %srArr@ rr r rzaAgent idle for %.0fs (timeout %.0fs) in session %s | last_activity=%s | iteration=%s/%s | tool=%sru⏱️ Agent inactive for u( min — no tool calls or API responses.z!The agent appears stuck on tool `z` (r z!s since last activity, iteration r]z).zLast activity: r zs ago, iteration z6). The agent may have been waiting on an API response.zTo increase the limit, set agent.gateway_timeout in config.yaml (value in seconds, 0 = no limit) and restart the gateway. Try again, or use /reset to start fresh.rr()rr(rrr)rrr)_AGGREGATOR_PROVIDERSnormalize_model_for_providerrg$@z%streaming TTS wait_complete error: %sz"streaming TTS finalisation timeoutr"_mark_streaming_tts_completed_turnrrz5Ignoring control interrupt message for session %s: %srz Voice-drainz9Processing queued message after agent completion: '%s...'r& pending_steerz0Delivering leftover /steer as next turn: '%s...'r uZDiscarding command '/%s' from pending queue — commands must not be passed as agent inputz=Discarding pending follow-up for session %s during gateway %sz#Processing pending message: '%s...'ru^Interrupt recursion depth %d reached for session %s — queueing message instead of recursing. queue_message)rr(r rr z5Stream consumer wait before queued message failed: %srrrVzZQueued follow-up for session %s: suppressing intentional silence marker before continuing.zlQueued follow-up for session %s: final text delivery confirmed; delivering explicit media before continuing.zoQueued follow-up for session %s: final stream delivery not confirmed; sending first response before continuing.)r(r1rr:rrz7Failed to send first response before queued message: %srUr>r@uNDiscarding stale goal continuation for session %s — goal is no longer activez:Queued follow-up session-key resolution failed; reusing %srrr_streaming_tts_completed_turns_streaming_tts_turn_key) r$rrr(rNr+rrr:rrrXfinal_content_deliveredrrzSuppressing normal final send for session %s: final delivery already confirmed (streamed=%s previewed=%s content_delivered=%s).rdr1_turn_split_deliveryzStale streamed finalize detected for session %s on a multi-message split; skipping the in-place reconciliation edit and delivering the complete response via normal final send (#78541). __no_edit__)r2rjr4rmr/ziReconciled stale streamed finalize for session %s: edited message %s with the complete response (#71643).zoStale-finalize reconciliation edit failed for session %s (%s); sending complete response via normal final send.rPznStale-finalize reconciliation edit failed for session %s: %s; sending complete response via normal final send.zStale streamed finalize detected for session %s with no editable message; delivering complete response via normal final send (#71643).zPEdited streamed message %s for session %s to include plugin-transformed content.z2Failed to edit streamed message for session %s: %sr=c|dfd } t|tddS#t$rYdSwxYw)Nr-cpKD]/} |d{V #t$rY,wxYwdSr^)rr2)_mid_adapter_snapshot_chat_id_snapshot _ids_snapshots r> _delete_allzRGatewayRunner._run_agent_inner.._cleanup_temp_bubbles.._delete_allhs -!!!"3"B"B 14## )!!! D! !!s & 33z$Temp bubble cleanup scheduling errorrr)rr3r2)r1r.r/r0_loop_snapshots r>_cleanup_temp_bubblesz=GatewayRunner._run_agent_inner.._cleanup_temp_bubbleshs!!!!!!!!,# ~%$J !DDs - ;;z-Post-delivery cleanup registration failed: %srNr)r{rr rrrrsrurr-r(r rvrtrurTrSr4rrhr2rrrgateway.status_phrasesrrrwrr rrrr@rVQueuerrrrrr2rrr! rrGrrprr\rrr/rzrr@rr r< rFEISHUrnrrr:rrrPrrrrrrrrrrryrgateway.streaming_tts_consumerrrrrget_event_looprrr3r4r!rrrrUr-r+snapshot_running_idsrr/rrrrErrc rBrr8rr<rr r rrzrr$rr>r0r;rPrr9rrfrhermes_cli.model_normalizer!r"rrr r wait_completesuppress_whole_filer%r% rIrxr!rer`r r*r rr4_MAX_INTERRUPT_DEPTHrrwr%rrrr,r r rrWr"rUre isawaitabler@rUr* r4 rArrurrrrrrjr^r1rr=)rr$rrr(rNr+rrr:rrurtrvrrr3r(ragent_cfg_localrdisplay_configr_tplr_ftl _resolved_tp_env_tp _display_cfg_platforms_cfg _platform_cfg_legacy_tp_overrides_tool_progress_configuredr;rrrrr>r2r1rinterim_assistant_messages_moder_thinking_moder=rr8r?rDrErArr_va_vtc_gid_tcr_cleanup_adapter_cleanup_deleter9r:turn_ctx turn_runner_progress_reply_in_thread_slack_adapter_for_progress_mode_fn_progress_thread_id_relay_prospective_thread_idrnrrrrrrrrrr4_is_voice_inputrr_tts_cfgr_stts_consumer _stts_err progress_tasklog_taskrrr tracking_taskrinterrupt_monitor_NOTIFY_INTERVAL_RAWr _notify_taskr_agent_timeout_raw_agent_timeout_agent_warning_raw_agent_warning_warning_firedr+ _turn_task_id_turn_process_baseline_turn_timeout_fired_turn_cleanup_lock_turn_is_currentr _inactivity_timeout_POLL_INTERVALrJrrK_backup_adapter _backup_agent _bp_event_bp_text_bp_media_urlsrr _idle_secs_act _warn_adapter _elapsed_warn_remaining_mins _warn_err_timed_out_agent _activity _last_desc _secs_ago _cur_tool_iter_n _iter_max _timeout_mins _diag_linesr_result_for_fb _run_failed _cfg_modelr!r"_agent_providerrr1_stts_done_err _mark_turnr r5rrr _leftover_steer_pending_parts_pending_cmd_word _rc_pending_has_stream_consumer _stts_finallyrwas_interruptedrWr_delivery_result _previewedfirst_response_already_streamedrWr_bg_cb _bg_resultupdated_history next_source next_messagenext_message_idnext_channel_promptnext_session_keynext_message_type_clear_adapter_completed_turns _prior_key_pk_followup_adapterr_final_is_empty_sentinel_content_delivered_stale_finalized_matcher _transformed _streamed _sc_msg_id _sc_adapter_reconcile_res _edit_errr3_rper r.r/r|r{r rrrr0rr r2rrrrr:rr6r?rrSr!rPrrAs` ` `` @@@@@@@@@@@@@@@@@@@@@@@@@@@r>rzGatewayRunner._run_agent_innerasqC<    22-%'-!13          &%%%%%  MD M M M M M M M M +,, +FO<< ??????!"5"5k<"P"PQQ%//'228b+//0CDDL$B77.$// N CBBBBB  > > > > > >**; F[]^__D $ $$%=SYYYA > > > >    D   > > > > > >**; F\^bccD $ $T$ZZ 0 0 0 0    D /.{L/ZZ )788)3ND)I)IQ~~r %))+66<"&**<88>B +//0IJJPb | + =$//5#}4  /669 $88 " 48 4GG2'2U  43KOghhxlx^^^^^^^^,."?"? \"Z"Z "=A"'  3 3 3 3 3,/s8d?  3   3   3 3 3 3 3 3 3 3 30JNeiw{ r r r rC$J rX[^bXb rqt rAD r r r r r r r r ,+++++ -^ C k[c[kHk43 }f   $77??+-CUKK (#'  % %#' )E1YfoIY6Y;K*U+%+---QU +@*? (+3+>*?+ + + ' Ox/ / 9/58 +/. +3+>*?    +e34I8I+?HDF !Fs $)'"715 ?h. . .-##H$455C3 6==D$%% '#7K*L*L !%ID#3xx3v~#6#6663;Q;QRV;W;W6.2(+!244! # #K?Q R R  @QZ433F;;;VZVfUq'$'7"8"8:JDQQQw{  '  #"5"DDD!& # &(!&w!%* * * 6* 11* "6!5* 0/ * 0/ * (- * 0/* #8"7* *>*  i* 0/*  i* %<$;* &* "6!5* $:#9!* "0/#* $.-%* &G'* (G)* *%<$;+* ,$ -* ..-/* 00/1* 2.-3* 40R/Q5* 6"6!57* 8.-9* :.-;* <,O=* >G?* @*>A* B*>C* D"zE* F$ G* H*>I* J.-K* L.-M* N"zO* P"6!5Q* R$:#9S* V!x00 &1%B"&1&D#$%)! ?hn , ,*.*B*B6*J*J '*65 '34  H  ))484D4D11487>DHH 14551 !55504---59 OV-/?5   ("222 >FF3 7>>3$3  7>> ? ? ?  %$! +"f&666  , ,V5E F F F11#!&+t<<$4 2'+   %*F %#89I!J 9:LW]WfgggHOX5H#III$J$J, J   5 5 5 5 5 5 t'9#&8#!,!Cv , v "& 04f%!. ,*@'1N.!133Z #1('2'F$ )4(H%226:: . ?ho - -&2B -GW - 1'7AA # #% '/&&*:::009IJJJ55ON'%fk4@@(8 6+/ $'.3O. *+;+'$3 #2 +B()4)J&0088  $ UGL'<@@AAGGIIWT   % &77GG & WOOOOOO;;;;;;++-- $ 2 Ng6L6N6N !5!5)"N'&4 """"(+7E1!4"((*** W W W JIVVVVVVVV W '  J#/0F0F0H0HIIM  =*>>+;+;<H % ) 1 1 "+/"3"3 !*!1!1  $2 (3YXXXXXX"l   U U U U U U U*) 9(4#0,B#1'8)<(:),,<  G-2DFF%'''$2223STTN#(  N% )8$+L'(.%%%GD!#1#8#8#:#:/5577 8K 8*.*B*B6*J*J(4Q +8 8$+O=T$U$U8$3$I$I+$V$V8)8(I(M(Mk(Z(ZI9B'Ly~~H(418LRV1W1W1][]#'#B#B9#M#M !S8<8_8_(1(7(.(0B4LTZTd1n+v?O1P1Pjn 9`9&9&3&3&3&3&3&3&KHaa*2!Sn!S/G /R/RH"KK!; +*;*@*@*B*B Q  *33H===/33555$A!$DE$0 % J 7 7 7S)8 R _8$+L'(.%%%GD! $2#8#8#:#:*1133.2+!-aJ!$J!!gj:P&Q&Q!!#-#B#B#D#DD)-2JC)P)PJJ(!!! D!+]~/I *n < <)-(,(@(@(H(H ( ],/"0D,E,E,JM.1>N3RWY2Y.Z.Z._^_O ]&3&8&8$*N%Om%O%O7F%O%O%O.E '9'"'"!"!"!"!"!"!"!"!"$-]]] & -PR[ \ \ \ \ \ \ \ \]!^33.2+!(#B0<+84J/@1D0B4D$$"M crc8J!L!L#'    %'''.5577 8K 8*.*B*B6*J*J(4Q +8 8$+O=T$U$U8$3$I$I+$V$V8)8(I(M(Mk(Z(ZI9B'Ly~~H(418LRV1W1W1][]#'#B#B9#M#M !S8<8_8_(1(7(.(0B4LTZTd1n+v?O1P1Pjn 9`9&9&3&3&3&3&3&3&KHaa*2!Sn!S/G /R/RH"KK!; +*;*@*@*B*B Q  *33H===/33555$A!$DE$0 % J 7 7 7_8B#= #/?  #0@BX(Y(Y$4$I$I$K$K $']]+?KK %MM*BAFF %MM.99 #--(8!<<%MM*:A>>  E~{' $X*+;=VWWW #Nb$8 9 9 >Q ))))  &&=I==%B==%,==/8===  &&N*NN NNN%,NN/8NNN ""?'+ii &<&&>!{!355  '.fj"&E&E&KO&_?BW+W+W%A%A*o%^%^  D<:--d6W6WXcekeq6r6r-,,[999#1%F..v66G2!4E  Z--d-;;;;;;;;;; ZZZLL!H.YYYYYYYYZz;KK DEEE--c-:::::::::,@1D!(2VX\!]!]J ++@" ;???!MG* p'* pk* p 6w L L !% : :;Q^ _ _ ::m,,!p]!pvzzReGfGf!p(. 3F(G(G%45FGG4 S'.3- #4"p%2$6$<"M")-t"L"L"RPRK66}EE [+/+R+R)#")(5HNHX%bk63C%D%D^b ,S,,&&&&&&  'N&>}&M&MG"/"Z3KM3Z3Zp %`bijmkmjmbnooo  cg cm c"(**_"="="c-GLL!SU\]`^`]`Uabbb 7==??55c:: !(!6!6tQ!?!?ES$[N1$5abb$9$?$?$A$A$AY[!$  VVVVVV&;'899+"KK!M 1 -1M&*G$~ = G  S&3--// !% [ Y[ Y BGCRCLQQQ Bww0BCCB BXcgngXX,[9??AAA$t'@@@NNA(+ #66v>>GD=D3G4M{\ijjjj DWWo%F%FD--k7CCC(+`(X_/`/``P '$$&&& "!!!  $ $ & & &    ! ! ! !+>.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !:!h3M3M'axxTZT`^`$!%&6&:&:;O&P&P!Q!QJ%5%9%9:JB%O%ON(H(H&",)))%5``````/R/R,n00,,%555/4,,,5+i x'.3(ii0 " & %S$/$63!"!"!"!" !' %V$/$63!"!"!"#'"E"E .'-(/)@1A7H2B2F2Fx2P2P.P#F## )iii"NN+dfghhhhhhhhi tG}}.JDQQ]!(!C!C''5"D""$F++%%-3VXX #*#6z#B#B!5*4$4$4$4$4$4$4$4#,%%% $% %!%WW6P%Q%Q%!(!A!E!EkSW!X!X#F++%%-3VXX #*#6z#B#B!5*4$4$4$4$4$4$4$4#,%%% $% #)**Z"A"A$ & "&&*##. %)! ,")-4"H"H"RFK77 FF&tOrOrs}O~O~& l'.3 &h '$$&&& "!!!  $ $ & & &    ! ! ! !+>.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !:!.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !:!",*[."I"IC"> 0 8 8 = = = %)$<$.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !:!.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !:!.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !:!FF""  % ! /*< /"3(A4HHH%%11+38F+;+;u+D(($111+0(((1#/).&  -C D DEEL98$I &P lP  P M_P  V&3& ,0(('G  G AQG VYVe!^ %c9d;; 3 6>>"KKS#*s J-$?$?KD[/:/G/G$*N'1$*%) 0H00****** #>9dCC 7;H^4"KK!L + 2sJ #NN!R + 2s ' F F %M'.3  KKa#*s( L S_!^ !k66$*N'1$,-=$>%) 7 480 n& (:s%P'.3  ' T , --8T**-LL** - (*KLL -!!122M &  0 $577N         $ T @@)-A  T T T LdSSSSSSSS Tsu0E EE,F FF9A%Y Y.-Y.6A%f g &gg $MBY-*zBY z%"BY$z%%ABY7*|"!BY" },} BY }G%BYD7AE E BYE AEEBYEAEEF7BYL-AL?L>BYL? AM M BYM AM M A9BYOAO#O"BYO# APO-AP PBYP APPJBYZ0A[[BY[ A[[BY[A[[D3BYbAb b AbbAbbAb<bAhhBYh/Aji AiiAjiAi&i#Aji%Ai&i&Aji)BYi+ Aji4AjjBYjAjjA$BYk>AllBYl Al lBYlAl l %BYmA3An:n9BYn: Ao)oAo$oBYo$Ao)o)ABYp1'AqqBYq Aq&q#BYq%Aq&q&ABYr''AssBYs AssBYsAssBBYwAw#w#Aw5w4Aw5w9Axx/Ay'yAyyAy'yAy!yAy'y Ay!y!Ay'y&Ay'zAz.z. Az;z:Az;|A||A|.|-A|.|4A} } BY} )A}6}3BY}5A}6}6&BY@B@@B@0@/B@0@4BAA/BB"BBB B BB"B BBBBB"BBBBBB"B!BB"C BC)C) BC6C5BC6EBEEBE)E(BE)E.B?BYH."BIIBYI BIIBYIBIIABYL/BL8L8BM M BM MBM+M+/BN<NBN$N#BN<N$BN6N3BN<N5BN6N6BN<N;BN<O&BPP BPPBPQ(BQ1Q1BRRBRTBT T BTTBTT!BT>T>/BVU.BU7U6BVU7BV VBVVBV V BVVBVV9BWW BW#W"BW#X;BYYBYYBYYA9B`/[B[[B`/[B[1[.B`/[0B[1[1B`/[5B\\B`/\/B]#]B] ] B]#] B] ]B]#]B] ]B]#] B`/]"B]#]#)B`/^ B^*^)B`/^* B^7^4B`/^6B^7^7AB`/`B``B`/`B`* `'B`/`)B`* `*B`/c/ Bc=c= Bd d Bd gBBii Bj i"BjjBj j;ABll BmlBl;l;Bmn;Boo BpoBo>o>Bpr^r)r%rT)rB rr)rrPr-N)r)r)rrr)NNFTr")rrr)NNNF) NNrNNNNNN(rrrrr%rw__annotations__r&rr'rirr(r)r rhr*rr+r,r-r.r/r0r1r[r2rrU r3r4r rr5r r6rkr7r8r9r:rl_turn_lease_tokensr;rrrrrrrr<r=r>r?r@rArFr/rArKr rrOrQrRrSrTrUrVrWrrrr~rrlrrrrrrr rrrrrr&r-r0propertyr2r4r6r8rArErrHrKrrOrRrTrVrYr]rrfrjrurrrrrGrrrrrrrrrrrrrrrrr r r r r r r r% r' staticmethodr* r. r4 r r= r? rA rF rrL rN rrr] rrrg rrm rrs rrrrrrr rrrrrr r r r r r r r rrr r r r- r0 rH rV rZ re Futurer_ rS rd rx rr rru r{ r} r r r r r r r r r r r r r r AbstractEventLoopr r r r rr r r r r r r1 r5 r7 rM r rrr rX r_ ra rr r r r r r r r r r r r rrr r r r/rYr) r, r_ rK rA rF rB rC rD rE rG r r#r$rrr rr rXr8 rr%r: r"rzrDr rbrgrrrtryrrrrrrr'rrrrrr rrrrr"r%r$r?rGrJrOrrrrZr_rbrmrrr|rrrrrrrrrr rrr r< rru_APPROVAL_TIMEOUT_SECONDSrrWHATSAPPr rEMAILSMSDINGTALKr6WECOMWECOM_CALLBACKr r r rt_UPDATE_ALLOWED_PLATFORMSr rr r r r\rsr|rc r%r&r'rr rrrr rr\r^r rfrobjectrsrxrrr rt r=rrr classmethodrrrrrrrsrrrr r&rr rr!r rrrs rrrrrtrr rr8r:rrCrHrLr r`rr r{rrrrrrrNrMr>r r s<@(c'''&OS&&&$IEIII)SSSS $J $$$It#(D((($$$$"'4'''#t###!&$&&&-2$d2227;Xm4;;;)-J&---,0M8GL)000SWxS$x7M2N-N(OPWWW'+x}+++). $...+*+<==O--.BCC112JKK''77L4466223LMM334NOO';';*(($$8#78V#W#W &:&:)''#0/0FGG))*:;;N"6"67T"U"U,,-@AA-A-A0..*212JKK++,>??--.BCC112JKKtC$78#.)s)x7O))))BsBtBBBB  d5k    6:(>2999.2hsm222-1Xc]111!$$$$;?X&78???-2$d2228<Xn5<<<~8~8x 6~8~8~8~8B >- - - - f$$&??-8-c-c----4S>4@@@@ ,s ,d ,W[ , , , ,+c+D+UY++++$****X"327 :<>B222-5c]2 2222h 8% 8 8 8 866u6666$:?$ $ $ 26$ $ $ $ $ L+/%)&* f%f%f%'f%c] f% d^ f% sDy  f%f%f%f%P-s-3-X\-ae----^.Y.YS.YT.Y.Y.Y.Y`OS#XO4OOOO #9L#QU####87JtBN"*N" N"N"N"N"`X>QXVZXXXXt###$#### )c)))) C    ( s    .8 /U / / / /=E====B" 4" " " " H,Z,Z,Z,Z\     5555"1117U7UU7Ud7U7U7U7UrDcDDDDLsLLLLWTWWWW" 5 5N 5UX 5]a 5 5 5 5 /  . ! >@DU3U4UUU\US3SV6        HSM W_`cWd pt    @0000(////0**U*T****H)-$('+ !  SM   }  0AC$ $ $ #$ t$ $ $ $ L44Dc3h$8\B @3 @ @ @\ @&'+#'#'# # # # # d^ # C= # C=#  # # # # T$(#' EEEEE C= E C= E EEEE844c44$;444\4 FFc4i8HFFF\F8+/%) 222'2c] 2  2  2222:    #4.        "%)))c]) # ))))@           *d \$ $   \  3   \ A#AAA\A.\$e\,\6 D   \ $+\$-$-$-$-$-$^!$c!$$+!$$!$!$!$\!$F $sCx.    hsm H H# H H H H sHSM! " :#3#4###\#J4C4D4444lQQQQ\Q!%83%8|%8X\%8%8%8%8N#/L#/S#/#/#/#/Jx|xZ]xbfxxxxt 9#%9#E$sCx.RVBV$sCx.K>TK>K>K>K>Z{'{'c{'{'{'{'z?????*>s>x~>>>>"v5vSvvvvp''U''''0c    0Q'Q'Q'Q'f@ !& % ^^^^ ^  ^  ^^^^@****VVVVVp@@/5@@DUCZ@P@ @@@@D7$77 7  7777,`<`<+3`< `<`<`<`Q9 99992+3 &'48 9   %       F#8$$$ ''%(' %'''\'B(BSBXe_BBB\B*.X.X#.X.X.X\.X`AAA % & AAAAL'+$$$sm$ 3 x}5t; < $$$$V(Gc(Gd(G(G(G(GTT#TT ,  TTTTHQ,I ))tCH~I !I 7:I I I I V     <|$ $$$$$ 9l 9s 9 9 9 97\7c7777&&=|&=&=&=&=&=P/F|/F/F/F/F/Fb{l{s{{{{*hB<hBHSMhBhBhBhBT/>cd$ UC UD U U U U*&* VVVV V d38n% V c] V #VVVV| &*       d38n%  c]   #    0  #     stCy*%6X  .)n)))))V c    s9#s9_bs9s9s9s9j?++3++++(v cv v v v v(D#(D47(D #(D(D(D(D`%}%s%t%%%%TO,O4OOOOr6|66666* % #3- % !%% %  % % % % X+/*.+/   #3-  T#Y' d3i( @+/*.+/LLL L L #3- L T#Y' Ld3i(L LLLLh ] t    8'U-'UD'U'U'U'URU]UtUUUU$ C C     = T      ]  t     -#- %S/ "----^# %S/ "6 C C    &15 UlUlUlUl Ul U38_- Ul  UlUlUlUln262626 26  26262626hSdSdSd Sd  SdSdSdSdj=T.#6#6#6 #6  #6#6#6#6J,1(Md& 3    ," -" TW" " " " J, , RU, , , , \4<4Y\4ad4444xi;|i;i;i;i;i;zn n  n  n  n  s$d* +n n n n `BB B  B  B #BBBBH 4S>     .2&c] $sCx. ! 4$(-1!%"""8$"#"C= " C= "&c]"#" $sCx. !""""H $(!% 8$#C= C=  #  \>.|. ...\.!$!* 8>8+< h&7)@(/S[SgiqiwzBzH +!! X X X X #!$ |K|K|K|K |K  |K|K|K|K|uuuuunM0(5c8TW=AX;Y2ZM0M0M0M0dGKQQQs5c8C=)@#ABCQ U3Xc]* + , QQQQf# # 4# # # # J##$####    z1D&****,+/%)&*"&#GGG'Gc] G d^ G 3- G}G GGGGREE#YE EEEENJ1J1#YJ1 sDI~  J1J1J1J1X49$(55C=5 sTz49$ % 5555J''V'V'V #Y 'V'V 'V'V'V'Vb+++  ++ sDI~ ++++ZL tL L L L \oo$(o $oooob4HU3VCS=T4U\(33333333j@^@^$(@^ $@^@^@^@^D3D3T3333*0*0*0*0*0*0*0*d|>$|>4|>|>|>|>|)0"PRU3d ?%;T#s(^%K LQQQE4S>EEE[EG>G>G>G> G> 4K G> t G>4ZG>!G> G>G>G>\G>R< S< T< < < < |%%'*%<@% %%%%< C D     .3 .$ .SW . . . .MM#MRVMMMM)- 7777! 7  7777rsCD:03EH :3 S3 S3 T3 3 3 3 j*#*$****X ) ) ) ) ) )UW   c c [^    /3/C/D////$J   .'+R2R2R2R2R2  R2 ! R2 $R2 R2R2R2R2hII,4SMI IIIIVR3RtCyRUYRRRR @s@tCy@@@@00UX0]efi]j0000<#'6>sm 2LK4LKCLKLKLK\LK\EsEtEEEEN"3"""""\"65Oc5O5O5O5O5O5On 0s 0 0 0 0 0 0#/#/#/#/#/#/J2C#CCCC HuHHHH q3qqqqfDKD:QQQQfW3WWWWz  C<C<C< C<  C< 4C<C<C<C_run_planned_stop_watcherrhs^Z0/11K!!$'" D""$$  U;; FJ66 ,8799OOM222 ))*:DAAA D D D LL> C C C C C C C C D &&&I!!$'$'$'$'$'sAB>B C!CCrr c ddlm}m}m}m}m}ddlm} d} d} d} d} d}d}d|fd|fd |fd |fd |ff}t d |d}| s|dz }|| zdkrw|ru dd l m }|9t|||td}||dn2#t$r%}td|Yd}~nd}~wwxYw|| zdkrf|D]c\}} |d}|rt d||1#t$r&}td||Yd}~\d}~wwxYw|| zdkr_ | \}}|rt d||n2#t$r%}td|Yd}~nd}~wwxYw|| zdkr ddlm}|t'ddn2#t$r%}td|Yd}~nd}~wwxYw ddlm}|n2#t$r%}td |Yd}~nd}~wwxYw dd!lm}|n2#t$r%}td"|Yd}~nd}~wwxYw||zdkr dd#lm}dd$lm}|d%pi}|d&d'r|} | t'|d(d)t;|d*d+| n#| wxYwn2#t$r%}td,|Yd}~nd}~wwxYw||zdkrY dd-lm }!|!d./nE#t$r8}"td0tC|"j"|"Yd}"~"nd}"~"wwxYw|#|| t d1dS)2uBackground thread for gateway-only periodic chores (NOT cron). Split out of the historical ``_start_cron_ticker`` so the cron *trigger* can live behind the ``CronScheduler`` provider (built-in or external) while these gateway-specific chores keep running independently of which provider fires cron. An external scale-to-zero provider has no 60s loop at all, but this housekeeping still wants its hourly cadence — so it owns its own loop. Refreshes the channel directory every 5 minutes and prunes the image/audio/video/document/screenshot caches + expired ``hermes debug share`` pastes once per hour, and polls the curator hourly (its inner gate enforces the real weekly cadence). r)cleanup_audio_cachecleanup_document_cachecleanup_image_cachecleanup_screenshot_cachecleanup_video_cache)_sweep_expired_pastesrrr(ImageDocumentAudioVideo Screenshotz+Gateway housekeeping started (interval=%ds)ri Nz*Channel directory refresh scheduling errorrrrz#Channel directory refresh error: %sr) max_age_hoursz*%s cache cleanup: removed %d stale file(s)z%s cache cleanup error: %sz4Paste sweep: deleted %d expired paste(s), %d pendingzPaste sweep error: %s)maybe_run_curatorrK c8td|S)Nz curator: %srh )rs r>rz-_start_gateway_housekeeping..is6;;}c+J+JrM)idle_for_seconds on_summaryzCurator tick error: %s)maybe_pull_skillszSync pull tick error: %s)maybe_pull_org_skillszOrg sync pull tick error: %src)rjrrkFrlr)rmrnzAuto-archive tick error: %srhzmessaging gateway housekeepingrz/gateway housekeeping memory trim failed: %s: %szGateway housekeeping stopped)$r rrrrrhermes_cli.debugrr3rzr8r rj rrr2r4 agent.curatorrritools.skills_sync_clientrrrrdrrjrvrrhrk rkrirrrB)#rrrr rrrrrrIMAGE_CACHE_EVERYCHANNEL_DIR_EVERYPASTE_SWEEP_EVERY CURATOR_EVERYAUTO_ARCHIVE_EVERYMEMORY_TRIM_EVERYMEDIA_CACHE_CLEANUPS tick_countrj rr cache_name cleanup_fnr, deleted remainingrrrrrjr_adbrir<s# r>_start_gateway_housekeepingr&is766666M %& +, %& %& /0  KK=xHHHJ!!r*a ) )Q . .8 . GMMMMMM# 3//994%$PC  2 ... G G G BAFFFFFFFF G ) )Q . .*> N N& JN(jr:::Gg $PR\^efff NNNLL!=z1MMMMMMMMN ) )Q . . 9%:%:%<%<"KKN 9 9 9 4a88888888 9  % * * :;;;;;;!!%*5\\JJ : : : 5q99999999 :  <FFFFFF!!#### < < < 7;;;;;;;; <  @JJJJJJ%%'''' @ @ @ ;Q???????? @ * *a / / ?NNNNNN222222..0044Z@@FB ==77%$9;;D%//&+IMM:Mq,Q,Q&R&R/29==AUWY3Z3Z/[/[0    ? ? ? :A>>>>>>>> ? ) )Q . . ;;;;;; #CDDDDD     EII&  )))e!!r*f KK./////s5AB77 C&C!!C&:*D%% E/EE"+F F=F88F= !G,, H6HHH00 I:II#I44 J#>JJ#1A N=AM+N+NN N4N//N4O P.PPcTddlm}|||||dS)uDEPRECATED shim — preserved for backward compatibility. The cron trigger now lives behind the ``CronScheduler`` provider (``cron.scheduler_provider``); the gateway resolves a provider and runs its ``start()`` directly (see ``start_gateway``). This shim runs ONLY the built-in in-process tick loop, exactly as before, for any external caller or test that still references this symbol (e.g. hermes_cli/debug.py). It no longer runs gateway housekeeping — that moved to ``_start_gateway_housekeeping``. r)InProcessCronScheduler)rrr N)cron.scheduler_providerrr)rrrr rs r>_start_cron_tickerrisC?>>>>>"":tV^"_____rMg@P@gA@r) rpollcK|dStjtd|z}|rtj|krWtj|d{V|r)tj|kW| S)uWait for a daemon thread to exit WITHOUT blocking the event loop. A synchronous ``thread.join()`` here would freeze the event loop — fatal for the cron ticker, whose in-flight delivery is a coroutine scheduled onto *this* loop via ``safe_schedule_threadsafe``. Blocking the loop deadlocks that delivery (the loop can never run it), so ``join(timeout=5)`` always times out and the message is silently dropped on restart (#58818). Polling ``is_alive()`` with ``await asyncio.sleep`` keeps the loop running so the pending delivery completes, then the ticker sees ``stop_event`` and exits. Returns True if the thread exited within ``timeout``. NTr@)rr! rUrCr r)rrrr+ s r>_await_thread_exitris~t'))..003sG3D3DDH //  " 8 : : ? ? A AH L LmD!!!!!!!!! //  " 8 : : ? ? A AH L L   rMr ct|dd}|dSd|_ |dS#t$r tddYdSwxYw)z9Idempotently drain and detach Gateway Health OTLP export.r Nz*gateway health OTLP export shutdown failedTr)rVr r r2r3r4)r rs r>r r isf>EEG,0F)R RRR AD QQQQQQRs4&AArl verbositych@AKddlm}|ddlm}m}m}m}m}m} |} | P| tj kr8|r|| } t d|  ddlm } | | n2#t$r%} td| Yd} ~ nd} ~ wwxYw ddlm}|| }n#t$rg}YnwxYw | | d n`#t"$rYnTt$t&f$rAtd |  dd lm}|n#t$rYnwxYwYd SwxYwdd lm}d }t/dD]%}|| sd}nt1jd&td|  | | d n$#t"$rd}Ynt$t&f$rYnwxYw|s5t/dD]%}|| sd}nt1jd&|s?td|  dd lm}|n#t$rYnwxYwd S ddlm}||| n-#t$r td| dYnwxYw| t9dz dn#t$rYnwxYw dd lm}|n#t$rYnwxYw ddlm}|| | }|rt d|n\#t$rYnPwxYwt?t9}td| |tAd| dd S dd l!m"}|d!n#t$rYnwxYwdd"l#m$}m%}|tLd#$ dd%l'm(}d} dd&l)m*}|}n#t$rd}YnwxYw|tL|'n2#t$r%}td(|Yd}~nd}~wwxYw|dd)l+m,}tZj.tZj/d*0|tZj1} t[j2|}!|!3| |!4|d+t[j56|!| t[j5j7kr&t[j53| tq|Ats|A_:d @dX@Afd, }"Afd-}#twj<}$|$=t|tj@tjAurtjCtjDfD]*}% |$E|%|"|%#t$rY'wxYwttd.r2 |$EtjH|#n+#t$rYnwxYwnt d/tjI}&tjJt|&A|$|"fdd01}'|'LddlM}(dd2lmN})m}m}|}*|*4|*tj krtd3|*d S|std4d S |)n5#t$r(|td5Yd SwxYw|(P||(P| dd6lQmR}+|+n2#t$r%},td7|,Yd},~,nd},~,wwxYw dd8lSmT}-|-n2#t$r%}.td9|.Yd}.~.nd}.~.wwxYwt dd:lVmW}/twj<}0|0Xd|/d{Vn2#t$r%} td;| Yd} ~ nd} ~ wwxYw ALd{V}1n#t$rtAwxYw|1stAd S ddAj^Aj_tAj_dSAjas Abd{VAjcr9Aj^r td?Aj^ tAd S dd@lVmd}4|4n#t$rYnwxYwAj_tAj_ tAdS#tAwxYwddAlemf}5mg}6tjI}7|6}8Ajhtwj<dB}9t|8|5rtAjkdCd r ddDllmm}:t|:dE};|;r8|;|9dF<t dGt|;dH|;Dn2#t$r%}.tdI|.Yd}.~.nd}.~.wwxYwt|8|5rAfdJ|9dK<tjJ|8jL|7f|9ddLM}<|t|>r |>Abd{V ddPlSmr}?|?n#t$rYnwxYwAjcr)Aj^r td?Aj^d S|7s |8tn2#t$r%} tdQ| Yd} ~ nd} ~ wwxYwt|shutdown_signal_handlerz.start_gateway..shutdown_signal_handlerjs! @ G G G G G G??AA   @ @ @ LL;Q ? ? ? ? ? ? ? ? @ fm + +LL! H HOOOOOOCCEE  H H H CQGGGGGGGG H E           65oFFMM E E E M LL? D D D D D D D D E   KKQ+8G h''i      KKK+8N h''>N     *. &15F - KK5+8N h''>N     $ F*,B,B=,Q,Q F F F @"EEEEEEEE F F(614OO &&}X6 F F F @"EEEEEEEE FFKKMM*****st AAA A11 B ;BB $B:: C+C&&C+/$F GF>>G!G)) H3HHc6dddS)NFTr )r r sr>restart_signal_handlerz-start_gateway..restart_signal_handler^ks"4@@@@@rMSIGUSR1z6Skipping signal handlers (not running in main thread).zplanned-stop-watcherr)write_pid_filer rz^Another gateway instance (PID %d) started during our startup. Exiting to avoid double-running.zBGateway runtime lock is already held by another instance. Exiting.z8PID file race lost to another gateway instance. Exiting.)record_startupz*Lifecycle ledger startup record failed: %s)start_nous_auth_keepalivez%Nous auth keepalive did not start: %s)rzMCP tool discovery failed: %s)recover_pending_to_dbz3Recovered %d pending message(s) from shutdown flushzGateway exiting cleanly: %sz Gateway exiting with failure: %s)r)rresolve_cron_scheduler)rrr)r r profile_homesz:Cron scheduler will tick %d profile(s) under multiplex: %scLg|]!}t|tr|dn|"SrUrVr:s r>rz!start_gateway..&ls/PPPQZ5118QqTTqPPPrMz6Could not resolve profile homes for multiplex cron: %sc"jpj Sr^)r*r+rsr>rzstart_gateway..2ls   = =5 rM can_dispatchzcron-scheduler)rrrFrrzgateway-housekeepingr_ )stop_nous_auth_keepalivezCron provider stop() error: %srubCron ticker did not exit within %.0fs of shutdown — an in-flight delivery may have been dropped.r|z}Exiting with code 1 (signal-initiated shutdown without restart request) so systemd Restart=on-failure can revive the gateway.z_Exiting with code 75 (service-restart requested) so the service manager relaunches the gateway.Kr^){gateway.code_skewrr; rrrr r rrr r3rzrr2r4rProcessLookupErrorPermissionErrorrrPrrr rUrrrrxrurrwprinttools.skills_syncrhermes_loggingrrrl!hermes_cli.security_audit_startuprrrrrrSWARNINGrrvDEBUG StreamHandlerrrrTrlevelr rrVrr! set_exception_handlerrrcurrent_thread main_threadr rradd_signal_handlerNotImplementedErrorrrrrrratexitrFileExistsErrorrNgateway.lifecycle_ledgerrhermes_cli.nous_auth_keepaliverrrrrrr rQ rr2r6r8 SystemExitrr r4rrrrrrtrVrzr?r rr7rr/r#rrr_CRON_SHUTDOWN_DRAIN_TIMEOUT$_HOUSEKEEPING_SHUTDOWN_DRAIN_TIMEOUTrfr,r/)Brzrlrrrrrr r r existing_pidexisting_start_timerrr_old_gateway_childrenrrold_gateway_exitedrKrr _releasedrrrrr _audit_cfgr _audit_excr _stderr_level_stderr_handlerrrrsig_planned_stop_watcher_stop_planned_stop_watcher_threadr5r _current_pid_lifecycle_record_startup_lc_excrr<r_loopr/rrerrr cron_stop cron_providercron_start_kwargsr r cron_threadhousekeeping_threadstart_watchdogr#rr sB @@r> start_gatewayrR js$:99999#?$$LLBIKK$?$? Q "8"8"F"F  KKN    G@@@@@@%%l3333 G G G BAFFFFFFFF G +EEEEEE(B(B<(P(P%% + + +(*%%% +  l%88888%   #W-    G  DDDDDD))++++ Duu  3 2 2 2 2 2!& 2YY( !( !"{<00)-&E 3W !M,d;;;;;)...)-&&&'1D*)"2YY))*{<88"15.!E 4(((() !LLM$ HHHHHH--////$ 5 @@@@@@%%)l    C !  O     ""]2::d:KKKK     @@@@@@%%''''     CCCCCC44*%8 aKK TV_```    o//00K LL^k    OlOOO    5 111111 $      ;:::::::Ml;;;; RSSSSSS   9 9 9 9 9 9(**JJ   JJJ %%,zRRRRR RRR DjQQQQQQQQR333333#O ==AA)W][[ !/ ??  ///$$%7%78]%^%^___&&777 7,..4 4 4     ( ( 7 7 7 6 " "F/37mmF+ "']+]+]+]+]+]+]+~AAAAA  # % %D >???!!Y%:%<%<<<M6>2  C ''-DcJJJJ&     69 % %  ''8NOOOO&       LMMM"+!2!2#,#3((&$8O P # $$$ !&&(((MMMOOOOOOOOOO"?$$LLBIKK$?$?  /0<   u ' ' ) ) P   u $$&&& F   uu   OOO$$$ OO0111LXXXXXX!!#### LLL A7KKKKKKKKLCLLLLLL!!#### CCC EEN  " " $ $$$$$$$$ KKKKKK  """"      &   Q LL;V=O P P PuMMOOO: ::: 5q99999999:#K9UVVV V V V V V V  ./K    %I    ""$$$ %%a%000 777777      #)***"&*C  M   u"  .   nn 4sH4B B5B00B59C CC C,, E 8+E $D54E 5 E?E EE E % F33 GGG,H== I  I I$$'J J%K KKK$$ K10K150L&& L32L3N N#"N#P OP O*'P)O**P P/ P**P/W W,+W, X&& X32X3 \.]  ] 9^ ^9^44^9=_ _=_88_=5a a4a//a48bb.-c33 d?d%Ahgh ghghh Ak## l-l  l1p ppq,, r6rr!t22 t?>t?c ddlm}|n#t$rYnwxYwddl}|d}|ddd |d d d d |}d}|jr]ddl}t|jd5}| |pi}tj |}dddn #1swxYwY tjt|}|rdnd} nE#t $r8} | jd} n$t%| jt&r| j} nd} Yd} ~ nd} ~ wwxYwt)| dS)z CLI entry point for the gateway.r)configure_windows_stdioNz)Hermes Gateway - Multi-platform messaging)rz--configr zPath to gateway config file)r> z --verboser store_truezVerbose output)r? r> rQrr()hermes_cli.stdiorTr2argparseArgumentParser add_argument parse_argsrzrrrrrrr rRr9r/rtrh_exit_after_graceful_shutdown) rTrWparserrrzrrrr/r8rs r>rrls <<<<<<!!!!      OOO  $ $1\ $ ] ]F  D/LMMM  T,EUVVV     D F {3 $+ 0 0 0 3A>>!$$*D",T22F 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3$ +mF3344 'AAa  6>II  $ $ III"),,,,,s6  %,CC!$C!)'D E.EEr8ctjtjfD]'} |#t$rY$wxYw ddlm}m}||n#t$rYnwxYw ddlm }||dn#t$rYnwxYw ddl m }|dn#t$rYnwxYwtj |d S) uFlush stdio, release the PID file + runtime lock, then hard-exit. Graceful teardown is already complete by the time this runs, so there is nothing left that needs a clean interpreter shutdown. We deliberately use ``os._exit`` (not ``sys.exit``): ``sys.exit`` raises ``SystemExit``, which triggers ``Py_FinalizeEx`` → ``wait_for_thread_shutdown`` and joins every non-daemon thread — exactly the hang (#53107) a wedged tool-worker causes. ``os._exit`` bypasses ``atexit`` handlers, so we cannot rely on the ``atexit``-registered ``remove_pid_file`` / ``release_gateway_runtime_lock`` (registered in ``start_gateway``) to run. The full-shutdown path releases both explicitly in ``_stop_impl``, but the EARLY exit paths — clean-fatal-config (#51228) and startup-aborted-before-running — raise ``SystemExit`` right after ``runner.start()`` without going through ``_stop_impl``, so on those paths ``atexit`` was the only thing releasing them. Now that those paths are routed through this backstop (#53107), release both here explicitly. Both calls are idempotent — ``remove_pid_file`` only unlinks a PID file that belongs to this process, and ``release_gateway_runtime_lock`` no-ops when the lock is already released — so this is a no-op on the normal shutdown path and the actual cleanup on the early-exit paths. Logging IS drained here: the rotating file handlers are driven by an async ``QueueListener`` on a dedicated thread (see ``hermes_logging._register_queued_handler``), so records emitted right before shutdown may still be sitting in the in-memory queue. ``os._exit`` below bypasses ``atexit``, so the ``atexit``-registered listener drain never runs on this path — we drain explicitly (bounded, via ``drain_log_queue``) or lose the last log lines (including the shutdown reason on the early-exit paths). Stdio is flushed too. rr ) mark_exitedgraceful_shutdownr)drain_log_queuerB rN)rrrrr2r; r r r7r^r*r`r_exit)r8rr r r^r`s r>r[r[lsa@:sz*  LLNNNN    D   PPPPPPPP$$&&&&       888888 I&9:::::       222222$$$$$      HYsB1 >>A A,+A,0B BBB(( B54B5__main__r^rrr)rN)rrr-N)rr)r-r)r-r)r1rr-N)NNr)r) )NFr(rhermes_bootstraprHrconcurrent.futuresr%rir rer3rSrrr_rc rrr rrU collectionsr contextvarsrrrrtypingrr r r r r rrragent.async_utilsrrrrrrrrrrragent.conversation_loopr agent.i18nragent.interrupt_compatragent.turn_contextrrr r!rr"rErKr%r$r!rD rcompilerbr IGNORECASEDOTALLr&r5r8rwrir?rBrrhrLrZrhrfr'r|rrr_GATEWAY_PROVIDER_ERROR_RErrrrrrrrrrrrrrrrrr"r(r+r6r@rurHrrWrcrrvrnrsryrrrrrrrrrrrrrrrrrrrr rrr2agent.replay_cleanuprrrrrr rr5r6rBrPr^rfrirmrorqrvrrrrrrrxryutilsrzr{rldotenvr|rr} _env_pathrrrrr contextlibr_contextmanagerrr_PORT_BINDING_PLATFORM_VALUESrr rrrrrrrrhermes_cli.config_defaultsr_DEFAULT_CONFIG _config_pathrrrrFrtrrrr2rro_valrv _terminal_cfgrxry_terminal_backend_terminal_env_map_cfg_key_env_varrR rrB_auxiliary_cfg_aux_bridged_keysr rr r _task_key _task_cfg_prov_model _base_urlrrd_upper _agent_cfg _sessions_cfgrE_tz_cfg _security_cfg_redact _gateway_cfg_strict _allow_dirs_allow_dirs_strr _trust_recent_trust_recent_seconds _bridge_errr(rrrrEdir _network_cfg_bootstrap_excrIrJgateway.cwd_placeholderrMrN_configured_cwdrr _resolved_cwdrUrUrrVrrrWrrrrXrYrZr[r\r]r^r_r`rarbgateway.deliveryrcrdregateway.turn_leaserfrgrhgateway.session_staterirp rjrkrlgateway.authz_mixinrmgateway.kanban_watchersrngateway.slash_commandsrogateway.turn_contextrpr rGrqrrrsrtrurvrwrxgateway.shutdown_watchdogryrzr{r|r}r~gateway.restartrrrrrrgateway.whatsapp_identityr_canonical_whatsapp_identifierr_expand_whatsapp_auth_aliasesr_normalize_whatsapp_identifierrTr3rr r r rrrrrrr^rrrrrrrrrrrrr"r%rt rw r9 _INTERRUPT_REASON_SSE_DISCONNECTr r r1rrr;rErGrIrNr^rqrurzr}rsrrrrrrrrrweakrefrrrrrrrrrrrr rrrrr:r;rrr rRrr[rNrMr>rs/   "     D     ######$$$$$$UUUUUUUUUUUUUUUUUUUUUUTTTTTTTT                    GFFFFF999999@???????999999#)-&*/&+.(&*"&6#)rz*TUU-&BJ >MBIA!!H(1$ !'#R#R!#R #R#R#R#RL E E E E E E) )) )  )  ))) ))))` IIII C= I  IIIIB = = = = = =,#-"*HH    / 1 + 7 6 4 =       M##$t:(i999 LsLtLLLL (RZ  M  )bj  M  $]M $>M BJ788BJ122BJ122BJ344BJ)**BJ/00BJ9::3333lKcKcKKKK *.    tCH~&  d38n     $sCx.) 0)])t))))X, %,04S#X, ,,,,Dcc: =, =3 = = = =*!      :($.2:  M $ $ ?S?T????.$s$#$#$$$$NcsSU]^aUb< :# : : : : C C C$!    c] @ F FC FRU FZ^ F F F F"59$$$$$$  $  $$'s8d?$ $$$$N<B BBB SMB B B  BBBBB-%S/ % ?? ? ? c3h? ?  #s(^ ????D,M(!a%O! _(3- _D _ _ _ _ CS CSX C C C C$$C$$$$*)c)c))))JcJCJDJJJJXd^.%)# f+f+f+ $sCx. !f+SMf+ f+  4S#X # ./ f+f+f+f+RDcN+ $sCx.DPXY\P]be4d38n1E(F3:!!!@!>ST. NM )-N+N+4S>"N+N+"#N+ 49d? N+N+N+N+b=T#s(^0D=====F1111f 3 3 3 3 3 3>>>>>> $ IHHHHH*-#G9:++ &' m+ @   MLLLLLLL##L11%%z$%% D  0 0 0 0 0 06=6t< !!9 !~ !- ! 1 ! #$? ! 7 !%&C !$%A !5 ! !9 !!"; !/ !/ !/ ! -! !" !9# !$%@";(G";3%A#=1Y";+M3](G5$?? ! ! ! B'8&=&=&?&? 9 9"(},,(2D  5((SSYY:N-N-N  5((ZZc-B-B(778I4::<<XX<#%7#5#5d#;#;D!z$t 559/9tz$/?/? 8,,/2s4yy 8,+r22  Ijj>> I!F E E  IIIIII88::99F%))&-88889     / I I *..y"== !z)T22IMM*b99::@@BBY]]7B7788>>@@C j" = =>>DDFF 3y}}Y;;<<BBDD"**GUf__AFBJ=F===>E>DBJ:F:::;KAJBJ=F===>I@HBJ> 9:'*44=@SLcAd=e=e 9:0J>>?Bs@A@@ ;<7*DDEHSFGFF AB R00  ZZ t<< M))/2s=3K/L/L +,=0069c!"2377 23xx 2..  JJ|T::  L00?BsAc,O_B`>a>a :;!\11@CLQcDd@e@e <= )L88;2:MMFIc !9:GG BC((:r**  ?+l:: 'PRTUU[[]];IL !;<II DE      ;tK  ) ; ;-8 ; ;     L          (_666666"cceeOODD88BGGLz,%%*,*:*:<*H*H*D))))___ E LN L LSVS]^^^^^^^^^_U777777UUU E B. B BTTTTTTTTTUU>>>>>>  """"UUU E B. B BTTTTTTTTTU! >!$ WVVVVVVV*..443/-===44&;;bi00&/bi 4g' ' %'' ' c)$)++&&   M ~t,,,,%2 >"                             :99999>>>>>><<<<<<,,,,,,                        8 $ $ NV OZ ^ N6 b (3-J!&((2%E$ DtDDDDN,HSM"-t ----`BsBsBBBB E E E E E EZZZZZZCDEEEEEEs,sCTW6#e#####'c'hsm''''T449L4444*3>#< %<"$8!6: DDD D  D xD12 D  DDDD^6:$$$$  $ ? $.$xD12$ $$$$`59""""  "  "?".""xD12" """"J(i$$&&%%''!''))(..00*0022)//11   58C=5T5555#3"040E#*cDj:P4Q0000f=3=3:====@C:C#CCCC FFFFFd;d;;;;|TD[T::d::::(  4$; #    & $#  }}   #Y : $#   }  } o:Xd3i06CM4d|@>$0LX\000 kkkkk k  kkkk\>t>>>>>0$4( @3 3 3 3 pBBBBBB e  e  e  e  e  e  e  e  RAfGfGfGfGfG-/IKdfGfGfG^O  V'V'V'V'  #V'  V' V'V'V'V'r]0]0IO]0ad]0]0]0]0@ ` `9? `X[ ` ` ` `( $(,$GJ!! Y% &!16!>C! !!!!. RC RD R R R RR R  7R R bjknboR x|R R R R j2-2-2-jDSDTDDDDN zDFFFFFs #,}/]'&}/']/,}/.]//H}/0f54}/5f=:}/<f==V1}//5A A#A@0@0AA@6AAAAAA"AA7A7AB%A=ABBAB%B)AB>B>AC,CAC%C%AC,