.cj\ HUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z ddl mZddlmZddlmZddlmZmZmZmZmZmZmZ ddlZn #e$rdZYnwxYwejeZej dZ!d e"d e#fd Z$d ed efd Z%dee"efd ee"fdZ&d_de"d e"fdZ'de"d ee"ee"ffdZ(dZ)dZ*de)+ddZ,d`de"d e"fdZ-dee"d ee"fdZ.dee"d ee"fdZ/ed Z0ed!z Z1d"Z2d#Z3d$Z4d%Z5da6ee"e7d&<e j8Z9e:Z;e:e"e7d'<e j8Z<e:Z=e:e"e7d(<e j8Z>d)Z?d*ee"d dfd+Z@d ee"fd,ZAd-ZBd*ee"efd e#fd.ZCd/eee"efd eee"effd0ZDdad2e"d e"fd3ZEd4ejFd ee"fd5ZGd4ejFd dfd6ZHd4ejFd dfd7ZI dbd8eeJd e#fd9ZKd e"fd:ZLd!d;d4ejFdZNd``. A process killed during gateway shutdown cannot release its lease, so waiting for the full TTL makes every new turn repeatedly attempt compaction. Reclaim only when the kernel proves that PID no longer exists; legacy/unstructured holders, same-process holders, permission errors, and any probe doubt remain protected until normal TTL expiry (conservative: PID reuse must never steal a live lease, and a wrongly-kept lease self-heals via TTL). ntFNrT)osname_COMPRESSION_LOCK_HOLDER_PID_REsearchintgroup TypeError ValueErrorgetpidpsutil pid_exists ExceptionkillProcessLookupErrorPermissionErrorOSError OverflowError)rmatchpids ./home/ice/.hermes/hermes-agent/hermes_state.py(_compression_lock_holder_process_is_deadr(,s@  w$u + 2 26Replace lone surrogates when *value* is text; pass anything else through. sqlite3 encodes bound ``str`` parameters as UTF-8 and raises ``UnicodeEncodeError`` on lone surrogates (U+D800..U+DFFF), so a single such code point anywhere in a message aborts the whole write. No-op for well-formed text. ) isinstancestrrr)s r'_scrub_surrogatesr.^s'+5UC*@*@ K  & & &eKrowc|dpd}|r|S|dpd}|pdS)uvA session's workspace grouping key: its git repo root when known, else its cwd. Branch is deliberately excluded so checking out a new branch doesn't fragment a workspace's session history. Returns None for cwd-less (unbound) sessions. Both fields are already recorded on ``sessions`` — this just picks the coarser identity for grouping/filtering. git_repo_rootrcwdN)getstrip)r0rootr3s r' workspace_keyr7is] GGO $ $ * 1 1 3 3D  775>> R & & ( (C ;$r/ model_configcolcd|dS)Nzjson_extract(COALESCE(z, '{}'), '$._delegate_from'))r9s r'_delegate_from_jsonr<zs GC G G GGr/ cwd_prefixcJ|dp|}d||d|dgfS)Nz/\z+(s.cwd = ? OR s.cwd LIKE ? OR s.cwd LIKE ?)z/%\%)rstrip)r=prefixs r'_cwd_prefix_clauserB~s<   u % % 3F 86f===U[R`R`R`:a aar/zjson_extract(COALESCE({a}.model_config, '{{}}'), '$._branched_from') IS NOT NULL OR EXISTS (SELECT 1 FROM sessions p WHERE p.id = {a}.parent_session_id AND p.end_reason = 'branched' AND {a}.started_at >= p.ended_at)zsEXISTS (SELECT 1 FROM sessions p WHERE p.id = {a}.parent_session_id AND p.end_reason = 'compression')z (s.parent_session_id IS NULL OR sa)aliasct|}t|}d|d|d|dS)zISubagent runs (cascade-delete targets), not branches or compression tips.rD(z(.parent_session_id IS NOT NULL AND NOT (z ) AND NOT ()))_BRANCH_CHILD_SQLformat_COMPRESSION_CHILD_SQL)rGbranch compressions r'_ephemeral_child_sqlrPsc  % % % . .F(//%/88K %E % % % %  % % %r/ parent_idsc t}d|Dtt}|rddt |z}|d|d|d|d|d ||z}fd |D}||fd DS) ueDelegate-subagent ids to cascade-delete with *parent_ids*. Only rows carrying the ``_delegate_from`` marker (set at creation, and backfilled by the v16 migration) — generic untagged children keep the orphan-don't-delete contract. Walks marker chains recursively so an orchestrator subagent's own delegate children go too (FK safety). ch|]}||Sr;r;.0sids r' z._collect_delegate_child_ids..s . . .S# .S . . .r/,?zSELECT id FROM sessions WHERE z IN (z) OR (parent_session_id IN (z) AND z IS NOT NULL)c4g|]}|dv |dSidr;)rUr0founds r' z/_collect_delegate_child_ids..s+UUU#c$iu>T>TCI>T>T>Tr/cg|]}|v| Sr;r;)rUrVseedss r'r^z/_collect_delegate_child_ids..s# 5 5 5CCu$4$4C$4$4$4r/)r<setlistjoinlenexecutefetchallupdate)connrQdffrontierphcursorr]r`s @@r'_collect_delegate_child_idsrms   B . .J . . .E%jjEE{{H  XXcCMM) * * ER E Eb E E)+ E E35 E E E x    VUUU):):UUU X  6 5 5 55 5 5 55r/ct||}|rsddt|z}|d|d||d|d||d|d||S)NrXrY*DELETE FROM messages WHERE session_id IN (rFIUPDATE sessions SET parent_session_id = NULL WHERE parent_session_id IN ("DELETE FROM sessions WHERE id IN ()rmrcrdre)rhrQidsrks r'_delete_delegate_childrenrss %dJ 7 7C F XXcCHHn % % G"GGGMMM  1+- 1 1 1    ?"???EEE Jr/Tstate.dbri)zlocking protocolznot authorized_last_init_error_wal_fallback_warned_paths_wal_reset_bug_warned_paths)messages_fts_insertmessages_fts_deletemessages_fts_updatemessages_fts_trigram_insertmessages_fts_trigram_deletemessages_fts_trigram_updatemsgcJt5|addddS#1swxYwYdS)uoRecord (or clear) the most recent state.db init failure. Thread-safe via _last_init_error_lock. Callers pass a message to record a failure or None to clear. SessionDB.__init__ only calls this to SET on failure — it deliberately does NOT clear on success, because in a multi-threaded caller (e.g. gateway / web_server per- request SessionDB() instantiation), a concurrent successful open racing past a different thread's failure would erase the cause string that thread's /resume handler is about to format. Explicit clears (e.g. test fixtures) are still supported by passing None. N)_last_init_error_lockrw)rs r'_set_last_init_errorr"st s ctS)aKReturn the most recent state.db init failure, if any. Slash-command handlers (``/resume``, ``/title``, ``/history``, ``/branch``) call this to surface the underlying cause in their error messages when ``_session_db is None``. Returns ``None`` if SessionDB initialized successfully (or hasn't been attempted). )rwr;r/r'get_last_init_errorr3s  r/)z:Review the conversation above and update the skill libraryz;Review the conversation above and consider saving to memoryc$t|tsdS|ddvrdS|d}t|tsdS|t fdt DS)ayTrue when ``msg`` is a persisted background-review harness prompt. These are user/system turns the forked skill/memory review agent wrote into a real session in older builds (before the ``_persist_disabled`` isolation fix). They instruct the agent to act as the curator under a hard tool restriction, so replaying them as live history hijacks the session. Frole>usersystemcontentc3BK|]}|VdSN startswith)rUpheads r' z8_is_background_review_harness_message..Ws/DDatq!!DDDDDDr/)r+dictr4r,lstripany_REVIEW_HARNESS_PREFIXES)rrrs @r'%_is_background_review_harness_messagerGs c4 u wwv000uggi  G gs # #u >>  D DDDD+CDDD D DDr/messagesc|s|Sg}d}|D]\}t|rd}|r1d}t|tr|ddkrG||]|S)aSDrop background-review harness messages and the curator-mode assistant reply that immediately followed each one. Walk the list once; when a harness user/system message is found, skip it and also skip the next message if it is the assistant turn that answered it. Everything else passes through untouched and in order. FTr assistant)rr+rr4append)routskip_next_assistantrs r' _strip_background_review_harnessrZs  "C   0 5 5 "&    "' #t$$ K)G)G 3 Jr/Session database not availablerActs|dSd}tfdtDrd}|d|dS)u~Format a user-facing 'session DB unavailable' message with cause. When ``SessionDB()`` init fails, callers set ``_session_db = None`` and several slash commands (/resume, /title, /history, /branch) previously responded with a bare ``"Session database not available."`` — no indication of WHY. This helper includes the captured cause (typically ``"locking protocol"`` from NFS/SMB) and points users at the known culprit so they can fix it themselves. Example output: Session database not available: locking protocol (state.db may be on NFS/SMB — see https://www.sqlite.org/wal.html). .rc3DK|]}|vVdSrlower)rUmarkercauses r'rz0format_session_db_unavailable..s0 G Gv6U[[]] " G G G G G Gr/uJ (state.db may be on NFS/SMB/FUSE — see https://www.sqlite.org/wal.html): )rr_WAL_INCOMPAT_MARKERS)rAhintrs @r'format_session_db_unavailablerusq ! !E ||| D G G G G1F G G GGG\[ & & &t & & &&r/rhc |d}n#tj$rYdSwxYw|dS|d}t |t r( |d}n#t$rYdSwxYw|3t| ndS)zRead the journal mode from the SQLite DB header on disk. Returns the mode string (e.g. ``"wal"``, ``"delete"``), or ``None`` if the value cannot be determined (new DB, or PRAGMA read failed). PRAGMA journal_modeNrascii) refetchonesqlite3OperationalErrorr+bytesdecodeUnicodeDecodeErrorr,r5r)rhr0modes r'_on_disk_journal_moders ll011::<<  #tt {t q6D$ ;;w''DD!   44 (,(83t99??   " " $ $ $dBs'*=="A88 BBctjdkrdS |ddS#tj$rYdSwxYw)uEnable ``PRAGMA checkpoint_fullfsync`` on macOS (no-op elsewhere). On Darwin, ``synchronous=FULL`` (the WAL default) issues a plain ``fsync()``, which Apple documents does *not* guarantee that data has reached stable storage or that writes are not reordered — see the ``fsync(2)`` man page. SQLite's WAL corruption-safety guarantee assumes the OS honors the fsync write barrier; macOS does not unless the app uses ``F_FULLFSYNC``. During a launchd *system* shutdown/reboot the OS page cache is dropped (effectively a power-loss event for in-flight pages), so a WAL checkpoint whose ``fsync()`` "reported" durable may never have hit the platter — corrupting ``state.db`` with a malformed image. This is the trigger in issue #30636 ("SIGTERM during launchd shutdown under high load"), distinct from a plain in-session kill (which the page cache survives and SQLite recovers from). ``checkpoint_fullfsync=1`` forces an ``F_FULLFSYNC`` barrier only at checkpoint boundaries — where WAL frames land in the main DB — so the cost amortizes to roughly +0.1 ms/commit (vs ~+4 ms for the broader ``fullfsync=1`` that flushes on every commit's WAL sync). Guarded by ``sys.platform == "darwin"`` because ``F_FULLFSYNC`` is macOS-only; on other platforms the PRAGMA is a no-op, so we skip it entirely. Best-effort: never raises. darwinNzPRAGMA checkpoint_fullfsync=1sysplatformrerrrhs r'_apply_macos_checkpoint_barrierrsY6 |x  455555  #     +>>ctjdkrdS |ddS#tj$rYdSwxYw)uSEnforce ``PRAGMA synchronous=FULL`` on macOS to prevent btree corruption. On Darwin, the default ``synchronous=NORMAL`` only calls ``fsync()``, which Apple's fsync(2) man page explicitly states does *not* guarantee data-on-platter or write-ordering. During a WAL checkpoint race with process termination (e.g., launchd shutdown), this can leave the main DB with half-written btree pages → ``btreeInitPage error 11``. WAL mode's durability guarantee assumes the OS honors fsync barriers; macOS does not unless we explicitly set ``synchronous=FULL``, which issues a real ``fsync()`` on every transaction commit. The ``F_FULLFSYNC`` barrier at checkpoint boundaries is handled separately by :func:`_apply_macos_checkpoint_barrier`. This function is called after any successful WAL activation (either from ``apply_wal_with_fallback()`` setting a fresh WAL or when probing an existing WAL mode). It ensures macOS connections always use FULL synchronous mode, even if a prior connection set ``synchronous=NORMAL``. Best-effort: never raises. rNzPRAGMA synchronous=FULLrrs r'_enforce_macos_synchronous_fullrsY, |x  ./////  #     r version_infoc||n tj}|dkrdS|dkrdSd|cxkrdkrnndSd|cxkrdkrnndSd S) a:Return True when the linked SQLite library has the WAL-reset bug. Upstream documents the bug in versions 3.7.0 through 3.51.2, fixed in 3.51.3+, with backports 3.50.7 and 3.44.6: https://sqlite.org/wal.html#walresetbug Pre-WAL libraries (< 3.7.0) cannot hit the race and are treated as safe. N)rF)r3r)r2r)rrr)r,)r-rT)rsqlite_version_info)rinfos r'is_sqlite_wal_reset_vulnerablers(3<<9TD iu zuT&&&&J&&&&&uT&&&&J&&&&&u 4r/cH tjd} |d}|n#|wxYwn#tj$rYdSwxYw|r|ddSt |dS)zCReturn ``sqlite_source_id()``, or an empty string when unavailable.:memory:zSELECT sqlite_source_id()rr)rconnectrercloseErrorr,)rhr0s r'sqlite_source_idrsz** ,,:;;DDFFC JJLLLLDJJLLLLL =rr #a&.r s1v;;s'A-'AA-A))A--B?Bdb_labelrctrt||S |d}|r,|ddkr t |t |dSn#t j$rYnwxYw |dt |t |dS#t j$r}t| tfdtDst|}|dkrt|||dYd}~d Sd}~wwxYw) u,Set ``journal_mode=WAL`` on ``conn``, falling back to DELETE on failure. Returns the journal mode actually set (``"wal"`` or ``"delete"``). On WAL-incompatible filesystems (NFS, SMB, some FUSE), SQLite raises ``OperationalError("locking protocol")`` when setting WAL. We fall back to DELETE mode — the pre-WAL default, which works on NFS — and log one WARNING explaining why. On SQLite builds that still contain the WAL-reset corruption bug (issue #69784), refuse to enable WAL on fresh / non-WAL databases (prefer DELETE). If the on-disk DB is already WAL, keep WAL and warn — never live-downgrade under possible concurrent openers. The WARNING is deduplicated per ``db_label``: repeated connections to the same underlying DB (e.g. kanban_db.connect() which is called on every kanban operation) log once per process, not once per call. Different db_labels log independently, so state.db and kanban.db each get one warning on the same NFS mount. Shared by :class:`SessionDB` and ``hermes_cli.kanban_db.connect`` so both databases get identical fallback behavior. Never downgrades to DELETE if the on-disk DB header reports WAL — see _on_disk_journal_mode. That holds for both the NFS path and the WAL-reset vulnerability path. rrrwalzPRAGMA journal_mode=WALc3 K|]}|vV dSrr;)rUrrs r'rz*apply_wal_with_fallback..?s'EEV6S=EEEEEEr/PRAGMA journal_mode=DELETENdelete)r_apply_delete_for_wal_reset_bugrerrrrrr,rrrr_log_wal_fallback_once)rhr current_modeexcexistingrs @r'apply_wal_with_fallbackr sB&''H.thGGGG ||$9::CCEE  LOu44 +D 1 1 1 +D 1 1 15  #      .///'---'---u  #   #hhnnEEEE/DEEEEE  (.. u   x--- 1222xxxxx s+AA88B  B 3CEA=EEcd} |d}|rA|d9t|d}n#t j$rd}YnwxYw|dkr1t|dt|t|dS |dn#t j$rYnwxYwt|d d S) zAvoid enabling WAL when the linked SQLite has the WAL-reset bug. - Already-WAL on disk: leave WAL alone (no live downgrade) and warn. - Otherwise: set DELETE and warn. rrrNrT)kept_walrFr) rerr,r5rrr_log_wal_reset_bug_oncerr)rhrcurrentr0s r'rrKs'Gll011::<<  23q6%#a&kk''))//11G  #% 48888'---'---u  12222  #     Hu5555 8s$A*A//BB>CC&%C&rct5|tvr ddddSt|dddn #1swxYwY|rdnd}td|t j|dS)zHLog once per (process, db_label) about the WAL-reset vulnerability path.Nu\is already in WAL mode — leaving WAL in place (no live downgrade under concurrent openers)z1using journal_mode=DELETE instead of enabling WALuE%s: linked SQLite %s is vulnerable to the WAL-reset corruption bug (https://sqlite.org/wal.html#walresetbug) — %s. Upgrade to SQLite 3.51.3+ (or backports 3.50.7 / 3.44.6); `hermes update` alone may not change python-build-standalone's embedded SQLite. See `hermes doctor`. This warning fires once per process per database.)_wal_reset_bug_warned_lockryaddloggerwarningrsqlite_version)rractions r'rrns $22 2 2 2 22222222 $''111222222222222222  A . .A   NN $       AAA  A rct5|tvr ddddSt|dddn #1swxYwYtd||dS)uLog a single WARNING per (process, db_label) about WAL fallback. Without this dedup, NFS users running kanban (which opens a fresh connection on every operation — see hermes_cli/kanban_db.py) would fill errors.log with hundreds of identical warnings per hour. Nu%s: WAL journal_mode unsupported on this filesystem (%s) — falling back to journal_mode=DELETE (slower rollback-journal mode; reduces concurrency but works on NFS/SMB/FUSE). See https://www.sqlite.org/wal.html for details. This warning fires once per process per database.)_wal_fallback_warned_lockrxrrr)rrs r'rrs #11 1 1 1 11111111 #&&x000111111111111111 NN /  r)zmalformed database schemaz database disk image is malformed_repair_attempted_pathsc|ttjsdStfdtDS)zTrue if *exc* is a SQLite 'malformed schema / disk image' error. These are the corruption classes where the schema fails to parse, so targeted ``sqlite_master`` surgery (not an ordinary FTS rebuild) is the only recovery path. Fc3^K|]'}|tvV(dSrr,r)rUrrs r'rz(is_malformed_db_error..s8RRfvS)))RRRRRRr/)r+r DatabaseErrorr_MALFORMED_SCHEMA_MARKERS)rs`r'is_malformed_db_errorrsC c70 1 1u RRRR8QRRR R RRr/db_pathct|}t5|tvr ddddSt| ddddS#1swxYwYdS)aClaim the one-shot repair attempt for *db_path* in this process. Returns True for the first caller, False afterwards. Keeps a malformed DB from triggering an unbounded repair/reopen loop and stops concurrent callers from racing surgery on the same file. NFT)r,_repair_attempt_lockrr)rkeys r'_claim_repair_attemptrs g,,C  ) ) ) ##C((( s AAAAcddl}ddl}|jd}||jd|} |||dD]d}||j|z}|r1||||j|ze|S#t$r'}t d||Yd}~dSd}~wwxYw)a-Copy a (possibly malformed) DB file to a timestamped backup beside it. Raw file copy on purpose: the DB won't open cleanly, so we preserve the bytes exactly for forensics / manual restore. WAL and SHM sidecars are copied too when present. Returns the backup path, or None on failure. rNz %Y%m%d_%H%M%Sz.malformed-backup-)z-walz-shmz%Could not back up malformed DB %s: %s) datetimeshutilnowstrftime with_namercopy2existsrrr)rrrstamp backup_pathsuffixsidecarrs r'_backup_db_filers&OOOMMM   ! ! # # , ,_ = =E##w|$N$Nu$N$NOOK  Wk***& X XF'' v(=>>G~~ X Wk&;&;KMMMtttttsA>C DDDcTtjt|d} t||d|d}d|D}|r1d|dd|S|dd D]} |d |d |d 2#tj $ru}t |rYd}~`t| }d |vsd|vrYd}~d|d|cYd}~c|Sd}~wtj $r(}d|d|cYd}~c|Sd}~wwxYwdtj} |d|d|dtjf|d|ddtjf|dn#tj $r} |dn#tj$rYnwxYwt| }d |vsd|vrYd}~|dSd|vrYd}~|dSt|cYd}~|Sd}~wwxYw |dS#tj $r-}t|cYd}~|Sd}~wwxYw#|wxYw)u/Probe a DB on a fresh connection. Returns None if healthy, else a reason. Runs the same first-statement (``PRAGMA journal_mode``) that trips the malformed-schema parse, then ``PRAGMA integrity_check`` and a canonical ``sessions`` read, and finally a rolled-back ``messages`` write so that FTS5 index corruption — which leaves base-table reads and ``integrity_check`` passing while every ``INSERT INTO messages`` fails through the FTS triggers — is reported as unhealthy rather than slipping past as a false "ok" (#50502). Nisolation_levelrzPRAGMA integrity_checkcg|]D}|t|ddk/t|dES)rokrrUrs r'r^z%_db_opens_cleanly.. sEOOO!qOS1YY__5F5F$5N5NC!II5N5N5Nr/z; rzSELECT COUNT(*) FROM sessions messages_ftsmessages_fts_trigrammessages_fts_cjkSELECT 1 FROM  WHERE z MATCH '""' LIMIT 1 no such tablezno such columnzfts5 read probe failed on r_hermes_fts_health_probe_BEGIN IMMEDIATEz>INSERT INTO sessions (id, source, started_at) VALUES (?, ?, ?) _health_probezOINSERT INTO messages (session_id, role, content, timestamp) VALUES (?, ?, ?, ?)r_fts_health_probeROLLBACK no such tokenizer: cjk_unicode61)rrr,load_fts5_cjk_extensionrerrfrcrr SessionDB_is_fts5_unavailable_errorrrtimetime_nsr)rrhrowsproblems fts_tablerrprobe_session_ids r'_db_opens_cleanlyr"sG ?3w<< > > >Do %%% *++44666||455>>@@OOtOOO  +99Xbqb\**F E 455>>@@@ V) G) GI( G WYWWyWWW(****+ G G G77<<HHHH#hhnn&&"c))-=-D-DHHHHFIFFFFFFFFFFF^ ]( G G G GIFFFFFFFFFFFR ] GHt|~~GG  LL* + + + LLP!?DIKK@    LL&!6+> L    LL $ $ $ $'     Z((((=    c((..""C#%%)9S)@)@ttt 2S88 ttt s88OOOOO )     3xx  sBM+M-.DMG+FM )F3M8F?GMG-G4G5MGM/A?I/.M/L8?JL3J'$L3&J'',L3M-L31M L3L8M3L88MN!N /N0N NNN'T)backupr#c ddddd}t|}|s |d|d<|St| d|d<d|d <|S|r%t|}|rt |nd|d < t jt |d } t|d D]4} |d |d|d #t j $rY1wxYw | n#| wxYwt|'d|d<d|d <t d||Sn7#t j $r%}t d|Yd}~nd}~wwxYw t jt |d } |d|| n#| wxYwt|'d|d<d|d <t d||Sn7#t j $r%}t d|Yd}~nd}~wwxYw t jt |d } |d|d}|D] \}} } } |d|| | f!|d|| n#| wxYwt|'d|d<d|d <t d||Sn7#t j $r%}t d|Yd}~nd}~wwxYw t jt |d } |d|d|d||d| n#| wxYwt|} | 'd|d<d |d <t d!||S| |d<n.#t j $r}t ||d<Yd}~nd}~wwxYw|ds"td"||d |S)#aRepair a state.db whose ``sqlite_master`` schema is malformed or whose FTS indexes reject writes. Handles two corruption classes: the "duplicate object definition" / malformed-schema class where even ``PRAGMA`` statements fail, and the FTS write-corruption class (#50502) where base tables read fine and ``integrity_check`` passes but writes fail through the ``messages_fts*`` triggers. Tries least-destructive recovery first and escalates: 1. **Rebuild FTS indexes in place** via the FTS5 ``'rebuild'`` command, which rewrites the internal b-tree segments from the canonical ``messages`` rows without dropping or recreating anything. Fixes the FTS write-corruption class while preserving the schema intact. 2. **De-duplicate** ``sqlite_master`` (keep the lowest rowid per ``type``/``name``). Fixes the canonical "table X already exists" case and PRESERVES the existing FTS index intact. 3. **Drop the FTS schema** (every ``messages_fts*`` object) + ``VACUUM``. The next ``SessionDB()`` open rebuilds the FTS indexes from the canonical ``messages`` table. Canonical ``sessions`` / ``messages`` rows are never modified. A timestamped raw backup is taken first unless ``backup=False``. Returns a report dict: ``{repaired: bool, strategy: str|None, backup_path: str|None, error: str|None}``. FN)repairedstrategyrerrorz does not existr'Tr%already_healthyr&rrr  INSERT INTO rI) VALUES('rebuild') rebuild_ftsz 1zFDELETE FROM sqlite_master WHERE type IS ? AND name IS ? AND rowid <> ?zPRAGMA writable_schema=OFF dedup_schemazRstate.db schema repaired by de-duplicating sqlite_master (FTS index preserved): %sz%state.db dedup repair pass failed: %sz9DELETE FROM sqlite_master WHERE name LIKE 'messages_fts%'VACUUMdrop_fts_rebuildzdstate.db schema repaired by dropping FTS schema; indexes will rebuild from messages on next open: %szsstate.db schema repair could not recover %s automatically (backup: %s); manual restore from backup may be required.)rrr"rr,rrrrerrrrrcommitrfr') rr#reportbpathrh table_namerdupestype_r_countkeepreasons r'repair_state_db_schemar;ss8 F7mmG >>  $555w !!)!z.z  >((.3 =E } Ms7||TBBB  $D ) ) )   LLSzSSJSSS/H  JJLLLLDJJLLLL W % % -!%F: !.F:  NNN   M .  MMMFLLLLLLLLM@s7||TBBB  LL # # # KKMMM JJLLLLDJJLLLL W % % -!%F: !0F:  NNA7   M .  @@@93????????@Es7||TBBB  LL4 5 5 5LLFhjj .3  )tVT CD$' LL5 6 6 6 KKMMM JJLLLLDJJLLLL W % % -!%F: !/F:  NN,-4   M .  EEE>DDDDDDDDE#s7||TBBB  LL4 5 5 5 LLT U U U LL5 6 6 6 KKMMM LL " " " JJLLLLDJJLLLL"7++ >!%F: !3F:  NN>?F   M w  ###c((w# *    H VM*   Ms8#EC80C  C8 CC8CC8#E8D8EE<E77E<#H2$)G" H2"G888H22I&I!!I&*#M;BL+M;+M8M;;N/ N**N/3#R+A(Q?R+Q**:R+%R++S:SSar CREATE TABLE IF NOT EXISTS schema_version ( version INTEGER NOT NULL ); CREATE TABLE IF NOT EXISTS sessions ( id TEXT PRIMARY KEY, source TEXT NOT NULL, user_id TEXT, session_key TEXT, chat_id TEXT, chat_type TEXT, thread_id TEXT, display_name TEXT, origin_json TEXT, expiry_finalized INTEGER DEFAULT 0, model TEXT, model_config TEXT, system_prompt TEXT, parent_session_id TEXT, started_at REAL NOT NULL, ended_at REAL, end_reason TEXT, message_count INTEGER DEFAULT 0, tool_call_count INTEGER DEFAULT 0, input_tokens INTEGER DEFAULT 0, output_tokens INTEGER DEFAULT 0, cache_read_tokens INTEGER DEFAULT 0, cache_write_tokens INTEGER DEFAULT 0, reasoning_tokens INTEGER DEFAULT 0, cwd TEXT, git_branch TEXT, git_repo_root TEXT, billing_provider TEXT, billing_base_url TEXT, billing_mode TEXT, estimated_cost_usd REAL, actual_cost_usd REAL, cost_status TEXT, cost_source TEXT, pricing_version TEXT, title TEXT, api_call_count INTEGER DEFAULT 0, handoff_state TEXT, handoff_platform TEXT, handoff_error TEXT, compression_failure_cooldown_until REAL, compression_failure_error TEXT, compression_fallback_streak INTEGER NOT NULL DEFAULT 0, compression_ineffective_count INTEGER NOT NULL DEFAULT 0, profile_name TEXT, rewind_count INTEGER NOT NULL DEFAULT 0, archived INTEGER NOT NULL DEFAULT 0, FOREIGN KEY (parent_session_id) REFERENCES sessions(id) ); CREATE TABLE IF NOT EXISTS messages ( id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL REFERENCES sessions(id), role TEXT NOT NULL, content TEXT, tool_call_id TEXT, tool_calls TEXT, tool_name TEXT, effect_disposition TEXT, timestamp REAL NOT NULL, token_count INTEGER, finish_reason TEXT, reasoning TEXT, reasoning_content TEXT, reasoning_details TEXT, codex_reasoning_items TEXT, codex_message_items TEXT, platform_message_id TEXT, observed INTEGER DEFAULT 0, active INTEGER NOT NULL DEFAULT 1, compacted INTEGER NOT NULL DEFAULT 0, api_content TEXT, display_kind TEXT, display_metadata TEXT ); CREATE TABLE IF NOT EXISTS session_model_usage ( session_id TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE, model TEXT NOT NULL, billing_provider TEXT NOT NULL DEFAULT '', billing_base_url TEXT NOT NULL DEFAULT '', billing_mode TEXT NOT NULL DEFAULT '', task TEXT NOT NULL DEFAULT '', api_call_count INTEGER NOT NULL DEFAULT 0, input_tokens INTEGER NOT NULL DEFAULT 0, output_tokens INTEGER NOT NULL DEFAULT 0, cache_read_tokens INTEGER NOT NULL DEFAULT 0, cache_write_tokens INTEGER NOT NULL DEFAULT 0, reasoning_tokens INTEGER NOT NULL DEFAULT 0, estimated_cost_usd REAL NOT NULL DEFAULT 0, actual_cost_usd REAL NOT NULL DEFAULT 0, cost_status TEXT, cost_source TEXT, first_seen REAL, last_seen REAL, PRIMARY KEY (session_id, model, billing_provider, billing_base_url, billing_mode, task) ); CREATE TABLE IF NOT EXISTS state_meta ( key TEXT PRIMARY KEY, value TEXT ); CREATE TABLE IF NOT EXISTS gateway_routing ( scope TEXT NOT NULL DEFAULT '', session_key TEXT NOT NULL, entry_json TEXT NOT NULL, updated_at REAL NOT NULL, PRIMARY KEY (scope, session_key) ); CREATE TABLE IF NOT EXISTS compression_locks ( session_id TEXT PRIMARY KEY, holder TEXT NOT NULL, acquired_at REAL NOT NULL, expires_at REAL NOT NULL ); CREATE TABLE IF NOT EXISTS async_delegations ( delegation_id TEXT PRIMARY KEY, origin_session TEXT NOT NULL, origin_ui_session_id TEXT NOT NULL DEFAULT '', parent_session_id TEXT, state TEXT NOT NULL, dispatched_at REAL NOT NULL, completed_at REAL, updated_at REAL NOT NULL, event_json TEXT, result_json TEXT, delivery_state TEXT NOT NULL DEFAULT 'pending', delivery_attempts INTEGER NOT NULL DEFAULT 0, delivered_at REAL, owner_pid INTEGER, owner_started_at INTEGER, task_json TEXT, delivery_claim TEXT, delivery_claimed_at REAL ); CREATE INDEX IF NOT EXISTS idx_sessions_source ON sessions(source); CREATE INDEX IF NOT EXISTS idx_sessions_source_id ON sessions(source, id); CREATE INDEX IF NOT EXISTS idx_sessions_parent ON sessions(parent_session_id); CREATE INDEX IF NOT EXISTS idx_sessions_started ON sessions(started_at DESC); CREATE INDEX IF NOT EXISTS idx_messages_session ON messages(session_id, timestamp); CREATE INDEX IF NOT EXISTS idx_compression_locks_expires ON compression_locks(expires_at); CREATE INDEX IF NOT EXISTS idx_session_model_usage_session ON session_model_usage(session_id); CREATE INDEX IF NOT EXISTS idx_session_model_usage_model ON session_model_usage(model); CREATE INDEX IF NOT EXISTS idx_async_delegations_delivery ON async_delegations(delivery_state, completed_at); a CREATE INDEX IF NOT EXISTS idx_messages_session_active ON messages(session_id, active, timestamp); CREATE INDEX IF NOT EXISTS idx_messages_active_null ON messages(active) WHERE active IS NULL; CREATE INDEX IF NOT EXISTS idx_sessions_session_key ON sessions(session_key, started_at DESC); CREATE INDEX IF NOT EXISTS idx_sessions_gateway_peer ON sessions(source, user_id, chat_id, chat_type, thread_id, started_at DESC); CREATE INDEX IF NOT EXISTS idx_sessions_handoff_state ON sessions(handoff_state, started_at); a CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5( content, tool_name, tool_calls, content='messages', content_rowid='id' ); CREATE TRIGGER IF NOT EXISTS messages_fts_insert AFTER INSERT ON messages WHEN (new.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_high_water'), -1) OR new.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts(rowid, content, tool_name, tool_calls) VALUES (new.id, new.content, new.tool_name, new.tool_calls); END; CREATE TRIGGER IF NOT EXISTS messages_fts_delete AFTER DELETE ON messages WHEN (old.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_high_water'), -1) OR old.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts(messages_fts, rowid, content, tool_name, tool_calls) VALUES ('delete', old.id, old.content, old.tool_name, old.tool_calls); END; CREATE TRIGGER IF NOT EXISTS messages_fts_update AFTER UPDATE ON messages WHEN (old.content IS NOT new.content OR old.tool_name IS NOT new.tool_name OR old.tool_calls IS NOT new.tool_calls) AND (old.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_high_water'), -1) OR old.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts(messages_fts, rowid, content, tool_name, tool_calls) VALUES ('delete', old.id, old.content, old.tool_name, old.tool_calls); INSERT INTO messages_fts(rowid, content, tool_name, tool_calls) VALUES (new.id, new.content, new.tool_name, new.tool_calls); END; aO CREATE VIEW IF NOT EXISTS messages_fts_trigram_src AS SELECT id, role, content, tool_name, tool_calls FROM messages WHERE role <> 'tool'; CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts_trigram USING fts5( content, tool_name, tool_calls, content='messages_fts_trigram_src', content_rowid='id', tokenize='trigram' ); CREATE TRIGGER IF NOT EXISTS messages_fts_trigram_insert AFTER INSERT ON messages WHEN new.role <> 'tool' AND (new.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_high_water'), -1) OR new.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts_trigram(rowid, content, tool_name, tool_calls) VALUES (new.id, new.content, new.tool_name, new.tool_calls); END; CREATE TRIGGER IF NOT EXISTS messages_fts_trigram_delete AFTER DELETE ON messages WHEN old.role <> 'tool' AND (old.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_high_water'), -1) OR old.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts_trigram(messages_fts_trigram, rowid, content, tool_name, tool_calls) VALUES ('delete', old.id, old.content, old.tool_name, old.tool_calls); END; CREATE TRIGGER IF NOT EXISTS messages_fts_trigram_update AFTER UPDATE ON messages WHEN (old.content IS NOT new.content OR old.tool_name IS NOT new.tool_name OR old.tool_calls IS NOT new.tool_calls OR old.role IS NOT new.role) AND (old.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_high_water'), -1) OR old.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts_trigram(messages_fts_trigram, rowid, content, tool_name, tool_calls) SELECT 'delete', old.id, old.content, old.tool_name, old.tool_calls WHERE old.role <> 'tool'; INSERT INTO messages_fts_trigram(rowid, content, tool_name, tool_calls) SELECT new.id, new.content, new.tool_name, new.tool_calls WHERE new.role <> 'tool'; END; a\ CREATE VIEW IF NOT EXISTS messages_fts_cjk_src AS SELECT id, role, content, tool_name, tool_calls FROM messages WHERE role <> 'tool'; CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts_cjk USING fts5( content, tool_name, tool_calls, content='messages_fts_cjk_src', content_rowid='id', tokenize='cjk_unicode61' ); a CREATE TRIGGER IF NOT EXISTS messages_fts_cjk_insert AFTER INSERT ON messages WHEN new.role <> 'tool' AND (new.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_high_water'), -1) OR new.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts_cjk(rowid, content, tool_name, tool_calls) VALUES (new.id, new.content, new.tool_name, new.tool_calls); END; CREATE TRIGGER IF NOT EXISTS messages_fts_cjk_delete AFTER DELETE ON messages WHEN old.role <> 'tool' AND (old.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_high_water'), -1) OR old.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts_cjk(messages_fts_cjk, rowid, content, tool_name, tool_calls) VALUES ('delete', old.id, old.content, old.tool_name, old.tool_calls); END; CREATE TRIGGER IF NOT EXISTS messages_fts_cjk_update AFTER UPDATE ON messages WHEN (old.content IS NOT new.content OR old.tool_name IS NOT new.tool_name OR old.tool_calls IS NOT new.tool_calls OR old.role IS NOT new.role) AND (old.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_high_water'), -1) OR old.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts_cjk(messages_fts_cjk, rowid, content, tool_name, tool_calls) SELECT 'delete', old.id, old.content, old.tool_name, old.tool_calls WHERE old.role <> 'tool'; INSERT INTO messages_fts_cjk(rowid, content, tool_name, tool_calls) SELECT new.id, new.content, new.tool_name, new.tool_calls WHERE new.role <> 'tool'; END; )messages_fts_cjk_insertmessages_fts_cjk_deletemessages_fts_cjk_update fts_cjk_stalectjd}|r!t|St dz dz S)z1Location of the cjk_unicode61 loadable extension.HERMES_FTS5_CJK_SOlibzlibfts5_cjk.so)rgetenvr expanduserr)envs r'fts5_cjk_so_pathrFsI )( ) )C &Cyy##%%%   u $'7 77r/cxtjdddvS)zBconfig.yaml ``sessions.cjk_fts`` (default on), via its env bridge.HERMES_CJK_FTS1)0falseoffno)rrCr5rr;r/r'_cjk_fts_config_enabledrNs: 9%s + + 1 1 3 3 9 9 ; ;D r/ctsdSt}|sdS |d |t ||dn#|dwxYwdS#t $r!td|dYdSwxYw)uFBest-effort load of the cjk_unicode61 tokenizer into ``conn``. Returns False (never raises) when the .so is absent, the feature is disabled via ``sessions.cjk_fts``, or this Python build has extension loading compiled out — every caller treats False as "behave exactly as before the cjk index existed". FTz#fts5_cjk extension load failed (%s)exc_info) rNrFrenable_load_extensionload_extensionr,rrr)rhpaths r'rrs # $ $u   D ;;==u  ""4((( .   D * * *  & &u - - - -D & &u - - - -t defd:Z?d dd;dZ@ed?e!de2e!e2e!e!fffd@ZAdejdd fdAZBdBZC ddCe!dDe!dEe!dFe2e!e3fdGe!dHe!dIe!dJe!dKe!dLe!dMe!dNe!dOe!dPe!dd fdQZDdCe!dDe!de!fdRZEd d d d d d d dSdCe!dDe!dHe!dIe!dJe!dKe!dLe!dTe!dUe!dd fdVZFddCe!dWedd fdXZGdYdZdIe!d[e!d\e!dd fd]ZHdYdZd^e2e!e!fd\e!dd fd_ZIdYdZd\e!de2e!e!ffd`ZJdYdZdaeKe!d\e!dd fdbZLd ddcdde"e!deedeKe2e!e3ffdfZMd d dgdde!dJe!dLe"e!dHe"e!de"e!f dhZNdejdd fdiZOd d d d d djdDe!dHe"e!dIe"e!dJe"e!dKe"e!dLe"e!de"e2e!e3ffdkZPdCe!dle!dd fdmZQdCe!dd fdnZR ddCe!dpe!defdqZS ddCe!dNe!dre!dPe!dd f dsZTdte2e!e!fdd fduZU ddCe!dveVdwe"e!dd fdxZWdCe!de"e2e!e3ffdyZXdCe!dd fdzZYdCe!defd{ZZdCe!d|edd fd}Z[dCe!defd~Z\dCe!dedd fdZ] ddCe!de!deVdefdZ^ ddCe!de!deVdefdZ_dCe!de!dd fdZ`dCe!de"e!fdZa ddCe!de!dEe"e!dd fdZbdCe!dGe!dd fdZcdCe!dEe!dd fdZdd ddCe!de!de!de"e!dd f dZe ddCe!dededEe!dededede"eVde"eVde"e!de"e!de"e!de"e!de"e!de"e!dededd f$dZfdYddCe!dEe"e!de"e!de"e!de"e!dededededede"eVde"eVde"e!de"e!dede!dd f"dZg ddCe!dDe!dEe!de!fdZhd d d dddddd d dCe!de!dEe"e!de"e!de"e!dededededede"eVdd fdZiddddefdZjdefdZkdCe!de"e2e!e3ffdZlde!de"e!fdZmdZnede"e!de"e!fdZode!de!defdZpdCe!de!dedefdZqdCe!de!defdZrdCe!de!defdZsdCe!de"e!fdZtdCe!dedefdZude!de"e2e!e3ffdZvde!de"e!fdZwde!de!fdZxdCe!de"e!fdZyezdGhZ{d Z|e"e!e}d<e~de!fd„ZddedeKe2e!e3ffdĄZ ddDe!deKe!de!dedededededededede!de!dedeKe2e!e3ffd҄Z dde!dededeKe2e!e3ffdԄZddCe!dede"e2e!e3ffdՄZdZe~de3de3fd؄Ze~de3de3fdلZ ddCe!de!de!de!de3de!dede!de!de!de3de3de3de!dede"e!de3de"e!de"e!de"e2e!e3fdef*dZd ddCe!de!de!de!de"e2e!e3fdef dZdCe!deKe2e!e3fdeeeffdZ ddCe!deKe2e!e3fdeedd fdZdCe!defdZdCe!deKe2e!e3fdefdZdCe!de3de!defdZ ddCe!dede"ededeKe2e!e3ff dZ ddCe!dedede2e!e3ffdZ ddCe!dededede"ee!dfde2e!e3ff dZdCe!de!fdZ ddCe!dedededeKe2e!e3ff dZdZdCe!dededeKe2e!e3ffdZdCe!deeKe2e!e3feKe2e!e3fffdZdCe!deKe2e!e3ffd ZdCe!de!fd ZdCe!deKe!fd ZedeKe2e!e3fd e2e!e3fdefd ZdCe!dede2e!e3ffdZdCe!dedefdZ ddCe!dededeKe2e!e3ffdZede!de!fdZededefdZede!defdZe~de!defdZe~de!defdZede!defdZdd d d dddde!de!d e!ded!eKe!deKe!d"eKe!dedede"eKe2e!e3ffd#Z dde!d!eKe!deKe!d"eKe!deded$e!dedeKe2e!e3ffd%Zde!de!fd&Z dde!d!eKe!deKe!d"eKe!deded$e!dedeKe2e!e3ffd'Zd d d d d(d)e!deded!e"eKe!de"eKe!d"e"eKe!deKe2e!e3ffd*Z dde!dededeKe2e!e3ffd+Z ddDe!dededeKe2e!e3ffd,Z ddDe!de!dededed-edeKe!defd.ZddCe!defd/ZdCe!de!defd0Zd1e2e!e3fdefd2Zd3e2e!e3fdefd4ZdCe!deKe!fd5ZdCe!de"e2e!e3ffd6ZdCe!de"e2e!e3ffd7ZddDe!deKe2e!e3ffd8Zed9e3d:e!de"e!fd;Zed9e3d:e!de"e!fd<Zed9e3de"eVfd=Zed9e3d:e!de"efd>Zedd9e3d?edefd@Zed9e3de3fdAZedBedCe!dwe!de2e!e3ffdCZdDeKe2e!e3fde2e!e3ffdEZdCe!dd fdFZede"edCe!dd fdGZ ddCe!de"edefdHZ ddCe!de"edefdIZ ddJeKe!de"edefdKZdefdLZ dde"edefdMZed d d d d d d d d d d d d d d d d d d d d dNdOe"eVdPe"eVdDe"e!dQe"e!dle"e!de"e!dRe"edSe"ede"edTe"e!de"e!dHe"e!dJe"e!dKe"e!dUe"e!dVe"edWe"edXe"eVdYe"eVdZe"ed[e"edee!eff,d\Z dd]e"eVdDe!deKe2e!e3ffd^Z dd]e"eVdDe!defd_Z dd]e"eVdDe!de"edefdaZȐdbe!de"e!fdcZd dddbe!d9e!de"ejdd fdeZʐddfZd d dgdJe!dHe!dhe"edie"edd f djZddkdJe!dledd fdmZdJe!dHe!defdnZdJe!dLe!de"e2e!e3ffdoZdJe!deKe2e!e3ffdpZdCe!de"e2e!e3ffdqZdJe!dLe!defdrZҐdsdtdJe!dLe!dHe!dIe!dCe!due!dd fdvZdCe!defdwZԐdxdydJe!dHe!dedeKe2e!e3ffdzZՐd{Z֐d|e!defd}Zdefd~ZdefdZdefdZ ddeded=ede"ede2e!e3ff dZdCe!dde!defdZdCe!de"e2e!e3ffdZdeKe2e!e3ffdZdCe!defdZdCe!dd fdZdCe!dwe!dd fdZd S(rz SQLite-backed session storage with FTS5 search. Thread-safe for the common gateway pattern (multiple reader threads, single writer via WAL mode). Each method opens its own cursor. g{Gz?g333333?ri'iPiPiNFr read_onlyc|pt_|_tj_d_d_d_d_ d_ d_ d_ d_ |r?tjdjddddd_ tjj _dSjjddfd } |dS#tj$r}t+|rt-jst.d | j j n#t4$rYnwxYwt7j}|d s|Yd}~dSd}~wwxYw#t4$r,}t;t=|jd |d}~wwxYw) NrFzfile:z?mode=roT?)uricheck_same_threadtimeoutr)parentsexist_okcLtjtjddd_tjj_tjdjdtj_ dS)NFr[)r]r^rrurzPRAGMA foreign_keys=ON) rrr,r_connRow row_factoryrrer_fts_cjk_loaded _init_schemaselfsr'_connect_and_initz-SessionDB.__init__.._connect_and_initvs$_ %%&+ %)    *1 &' ZHHHH ""#;<<<'>tz'J'J$!!#####r/u`state.db schema is malformed (%s) — attempting automatic repair (a backup copy is made first).r%r) DEFAULT_DB_PATHrrY threadingLock_lock _write_count_fts_runtime_rebuild_attempted _fts_enabled_trigram_availablere_fts_cjk_available_fts_unavailable_warnedrbrrrcrdparentmkdirrrrrr'rrr;r4rtype__name__)rhrrYrirr3s` r'__init__zSessionDB.__init__JsK1/ "^%%  /4+!"' %"'',$ X  %_2DL222&+$(  *1 & L  % %dT % B B B $ $ $ $ $& $!!#####( $ $ $-S119Nt|9\9\ <=@z- ((*** D/ ==zz*--!!#########- $>    !DII$6!?!?#!?!? @ @ @  sf(?F)&F CF+?F+ E  F EFE7FFFF G('GGrrctt|}d|vrd|vrdSd|vrdSd|vrdSdS)Nzno such modulefts5Tno such tokenizer: trigramrFrrerrs r'rz$SessionDB._is_fts5_unavailable_errorsX#hhnn s " "v}}4 (3 . .4 . 4 44ur/cTt|}d|vpd|vS)uTrue when only an optional tokenizer is missing (FTS5 itself works). Covers the built-in trigram tokenizer (needs SQLite >= 3.34) and the loadable cjk_unicode61 tokenizer — both mean "this one index can't be served here", never "disable FTS". r{rrr|s r'_is_trigram_unavailable_errorz'SessionDB._is_trigram_unavailable_errors3#hhnn (C / 91S8 r/rlc|d}|dSt|tjs|dn|dpd}d|vS)uTrue when messages_fts exists in ANY pre-v23 shape. v23's messages_fts is external-content over THREE real columns (content, tool_name, tool_calls). Every pre-v23 shape lacks the tool_name/tool_calls columns — whether the old inline single-column form (v11..v22) or the even older external-content single-column form (v10-era, pre-#16751). We therefore detect "needs optimize" as "the stored CREATE lacks the tool_name column", which is the precise v23 marker and correctly catches BOTH legacy variants. Returns False when messages_fts doesn't exist yet (fresh DB mid-init): the post-migration FTS setup block will create it in the v23 shape. zLSELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'messages_fts'NFrsqlr tool_name)rerr+rrc)rlr0rs r'_db_has_legacy_inline_ftsz#SessionDB._db_has_legacy_inline_ftssjnn =   (**  ;5'W[99Is1vvs5zPb#%%r/ct|ddrdSd|_td|jt j|dS)zHLog once that the trigram tokenizer is missing; base FTS5 stays enabled._trigram_unavailable_warnedFNTzSQLite trigram tokenizer unavailable for %s (requires SQLite >= 3.34, this build is %s); CJK/substring search will fall back to LIKE: %s)getattrrrrrrrrhrs r'_warn_trigram_unavailablez#SessionDB._warn_trigram_unavailablesY 46 > >  F+/(  > L  "       r/cvd|_|jrdSd|_td|j|dS)NFTzSQLite FTS5 unavailable for %s; full-text session search disabled. Run `hermes update` to rebuild the venv with a current Python (managed uv guarantees FTS5). (underlying error: %s))rprsrrrrs r'_warn_fts5_unavailablez SessionDB._warn_fts5_unavailablesQ!  '  F'+$ % L       r/c |d|ddS#tj$r6}||s||Yd}~dSd}~wwxYw)Nz:CREATE VIRTUAL TABLE temp._hermes_fts5_probe USING fts5(x)z"DROP TABLE temp._hermes_fts5_probeTF)rerrrr)rhrlrs r'_sqlite_supports_fts5zSessionDB._sqlite_supports_fts5s  NNW X X X NN? @ @ @4'   22377   ' ' , , ,55555  s*.A3+A..A3ct|d}|js|rd|dddt Ddt D}|r`tdt|dtf|D]}|d |d |_ d S | t|s|d tf|d d}|dkr^|dd}dt|fdfD]\}}|d||f|dtf} | r d |_ d S| t|d} | |_ d S#t j$r'tddd |_ Yd SwxYw)uCreate / repair / self-heal the CJK-bigram index surface. ``cursor`` may be a Cursor or a Connection (both expose execute / executescript). Called only for v23-shape DBs with the base FTS surface healthy. Sets ``self._fts_cjk_available``. Never raises; every failure mode degrades to "no cjk index" (trigram/LIKE routing keeps working). Cases: tokenizer loaded, table absent → create. Empty DB: index is complete by construction (triggers cover everything). Populated DB: set the cjk backfill markers so the id-gated triggers stay correct and `optimize-storage` can backfill; the index is NOT served until the backfill completes. tokenizer loaded, table present → ensure triggers (recreates any dropped by a tokenizer-less process), honour the stale breadcrumb (serve only when absent and no backfill pending). tokenizer NOT loaded, table present with live triggers → drop the cjk triggers so message INSERTs don't fail at trigger time, and leave the stale breadcrumb (#self-heal). The table itself stays for a later capable open to rebuild. zNSELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'messages_fts_cjk'cg|] }|d Srr;r s r'r^z4SessionDB._ensure_fts_cjk_schema..9s)AaDr/zCSELECT name FROM sqlite_master WHERE type = 'trigger' AND name IN (rXc3K|]}dVdSrYNr;rU_s r'rz3SessionDB._ensure_fts_cjk_schema..<s"0P0P0P0P0P0P0P0Pr/rFu messages_fts_cjk triggers present but the cjk_unicode61 tokenizer is unavailable (%s) — dropping the cjk triggers so message writes keep working. CJK search falls back to trigram/LIKE; run `hermes sessions optimize-storage` on a host with the extension to rebuild.z^INSERT INTO state_meta (key, value) VALUES (?, '1') ON CONFLICT(key) DO UPDATE SET value = '1'DROP TRIGGER IF EXISTS FNz$DELETE FROM state_meta WHERE key = ?z2SELECT COUNT(*) FROM messages WHERE role <> 'tool'r)SELECT COALESCE(MAX(id), 0) FROM messagesfts_cjk_rebuild_high_water)fts_cjk_rebuild_progressrJgINSERT INTO state_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value&SELECT 1 FROM state_meta WHERE key = ?zISELECT 1 FROM state_meta WHERE key = 'fts_cjk_rebuild_high_water' LIMIT 1z@messages_fts_cjk ensure failed; CJK search stays on trigram/LIKETrP)boolrerrerc_FTS_CJK_TRIGGERSrfrrrFFTS_CJK_STALE_KEYrr executescriptFTS_CJK_TABLE_SQLr,FTS_CJK_TRIGGER_SQLrr) rhrl cjk_presentlivetrign_msgshwkvstalebackfill_pendings r'_ensure_fts_cjk_schemaz SessionDB._ensure_fts_cjk_schemas'.6>> ,   (** #  I"(..T(+0P0P>O0P0P0P(P(PTTT)##hjj I NN9 )**NNE*, !%II'G'G'GHHHH&+D # F7 ,  !2 3 3 3 :&( H(**Q A::Chjj$B6s2ww?9!1TF NN8"$hjj   +0'  !4 5 5 5%~~C  hjj +;&:D # # #' , , , NN)-    ',D # # # # ,sDI A I2J  J cvtD]0} |d|#tj$rY-wxYwdS)Nr) _FTS_TRIGGERSrerr)rltriggers r'_drop_fts_triggerszSessionDB._drop_fts_triggerssa$  G BBBCCCC+      s $66cddtD}|d|dt}t t |t js|dn|dS)NrXc3K|]}dVdSrr;rs r'rz/SessionDB._fts_trigger_count..s";;;;;;;;r/zGSELECT COUNT(*) FROM sqlite_master WHERE type = 'trigger' AND name IN (rFr)rcrrerrr+rrc)rl placeholdersr0s r'_fts_trigger_countzSessionDB._fts_trigger_countsxx;;];;;;; nn C3? C C C    (** C!=!=I3q663q6JJJr/Tinclude_trigramrc|d|r|d|ddS)Nz8INSERT INTO messages_fts(messages_fts) VALUES('rebuild')zHINSERT INTO messages_fts_trigram(messages_fts_trigram) VALUES('rebuild')VDELETE FROM state_meta WHERE key IN ('fts_rebuild_high_water', 'fts_rebuild_progress')rerlrs r'_rebuild_fts_indexeszSessionDB._rebuild_fts_indexess` QRRR   NNZ     A     r/c|d|d|sdS|d|ddS)agRebuild the LEGACY inline FTS indexes (pre-v23) from messages. Used only to repair a legacy DB whose triggers degraded under an earlier no-FTS5 runtime. Inline tables have no external-content 'rebuild' source, so we DELETE + reinsert the concatenated content the legacy triggers produced. Never touches the v23 shape. zDELETE FROM messages_ftszINSERT INTO messages_fts(rowid, content) SELECT id, COALESCE(content, '') || ' ' || COALESCE(tool_name, '') || ' ' || COALESCE(tool_calls, '') FROM messagesNz DELETE FROM messages_fts_trigramzINSERT INTO messages_fts_trigram(rowid, content) SELECT id, COALESCE(content, '') || ' ' || COALESCE(tool_name, '') || ' ' || COALESCE(tool_calls, '') FROM messagesrrs r'_rebuild_legacy_fts_indexesz%SessionDB._rebuild_legacy_fts_indexessy 1222      F9:::      r/r5cr |d|ddS#tj$r}||rF||r||n||Yd}~dSdt|vrYd}~dSd}~wwxYw)NzSELECT * FROM  LIMIT 0TrF) rerrrrrrr,r)rhrlr5rs r'_fts_table_probezSessionDB._fts_table_probes  NN@J@@@ A A A4'   ..s33 55c::52237777//444ttttt#c((.."2"222uuuuu  s!B6AB1#B10B11B6ddlcL|||}|dS ||dS#tj$ra}||s||r||n||Yd}~dSd}~wwxYw)NFT)rrrrrrrr)rhrlr5rstatusrs r'_ensure_fts_schemazSessionDB._ensure_fts_schemas &&vz:: >5    % % %4'   22377 11#66 1..s3333++C00055555 s3B#ABB#fncd}t|jD]} |j5|jd ||j}|jn:#t $r- |jn#t$rYnwxYwwxYw dddn #1swxYwY|xj dz c_ |j |j zdkr| |j |j zdkr| |cS#tj$rx}t!|}d|vsd|vrI|}||jdz kr9t%j|j|j}t-j|Yd}~d}~wtj$r!}||sYd}~d}~wwxYw|ptjd)uExecute a write transaction with BEGIN IMMEDIATE and jitter retry. *fn* receives the connection and should perform INSERT/UPDATE/DELETE statements. The caller must NOT call ``commit()`` — that's handled here after *fn* returns. BEGIN IMMEDIATE acquires the WAL write lock at transaction start (not at commit time), so lock contention surfaces immediately. On ``database is locked``, we release the Python lock, sleep a random 20-150ms, and retry — breaking the convoy pattern that SQLite's built-in deterministic backoff creates. Returns whatever *fn* returns. Nrrrlockedbusyz$database is locked after max retries)range_WRITE_MAX_RETRIESrmrbrer2 BaseExceptionrollbackrrn_CHECKPOINT_EVERY_N_WRITES_try_wal_checkpoint_OPTIMIZE_EVERY_N_WRITES_try_optimize_ftsrrr,rrandomuniform_WRITE_RETRY_MIN_S_WRITE_RETRY_MAX_Srsleepr_try_runtime_fts_rebuild)rhrlast_errattemptresultrerr_msgjitters r'_execute_writezSessionDB._execute_writes$)-T455- - G, Z  J&&'8999!#DJ ))++++(! J//1111(!!! D! ,               !!Q&!!$t'FF!KK,,...$t'DDII**,,, +   c((..**w&&&G*;*;"H!81!<<, "indexed": , "percent": <0-100 int>}. Consumed by search_messages() notes and by status surfaces (dashboard/desktop can poll this to render a progress indicator). fts_rebuild_high_waterNfts_rebuild_progressrdTpendingtotalindexedpercentget_metarminrh high_waterprogressrpcts r'fts_rebuild_statuszSessionDB.fts_rebuild_statuss]]#;<<  4t}}%;<<ABBJ A::4#s3>E12233%HQTUUUr/cjd}||tddS)aFinalize the deferred rebuild: boundary sweep + clear markers. The sweep is cheap insurance against any write that slipped through the migration-boundary instant (between high_water capture and trigger activation): re-index any row near the boundary that the index is missing. docsize has one row per indexed doc, so the anti-join is exact and runs on a narrow id range. c |d}|Ot|d}|dz |dz}}|d||f|d||f|ddS)NzASELECT value FROM state_meta WHERE key = 'fts_rebuild_high_water'rrWzINSERT INTO messages_fts(rowid, content, tool_name, tool_calls) SELECT m.id, m.content, m.tool_name, m.tool_calls FROM messages m WHERE m.id > ? AND m.id <= ? AND NOT EXISTS (SELECT 1 FROM messages_fts_docsize d WHERE d.id = m.id)a INSERT INTO messages_fts_trigram(rowid, content, tool_name, tool_calls) SELECT m.id, m.content, m.tool_name, m.tool_calls FROM messages m WHERE m.id > ? AND m.id <= ? AND m.role <> 'tool' AND NOT EXISTS (SELECT 1 FROM messages_fts_trigram_docsize d WHERE d.id = m.id)rrerrrhhw_rowrlohis r'_doz*SessionDB._fts_rebuild_finish.._do s\\Shjj !^^dBIB ^ H  f H  LLE     r/u7Deferred FTS rebuild complete — all messages indexed.N)rrrrhrs r'_fts_rebuild_finishzSessionDB._fts_rebuild_finish s@   8 C    MNNNNNr/fts_v22_trash_c j5djdjdddzfD}dddn #1swxYwY|sdS|dfd } t |S#tj $r&}t d |Yd}~d Sd}~wwxYw) a"Tear down one chunk of a demoted v22 FTS shadow table. The trash tables are PLAIN tables (their vtable parent was demoted away during the migration), so chunked DELETE + final DROP involve no FTS5 machinery at all. Returns True while teardown work remains. cg|] }|d Srr;r s r'r^z6SessionDB._fts_teardown_trash_step..7 s)!r/zNSELECT name FROM sqlite_master WHERE type = 'table' AND name LIKE ? ESCAPE '\'r\_%NFrc Pd|ddD}|rd|nd}|dd|d|d d jd }|jd kr3|d td dS)Nc6g|]}|ddk|dS)rrr;r s r'r^zCSessionDB._fts_teardown_trash_step.._do..D s1Q4!88!88r/zPRAGMA table_info(rF, rowidz DELETE FROM z WHERE (z ) IN (SELECT z FROM z LIMIT rzDROP TABLE IF EXISTS z"Old FTS shadow table %s torn down.T)rerc_FTS_REBUILD_CHUNK_ROWSrowcountrr)rhpk_colsrcurrhtbls r'rz/SessionDB._fts_teardown_trash_step.._doC s"ll+F+F+F+FGGG)0<$))G$$$WC,,RsRRCRRRR&)RR262NRRRC|q   :S::;;; @#FFF4r/z0FTS trash teardown chunk failed (will retry): %sT) rmrbre_FTS_TRASH_PREFIXreplacerfrrrrrr)rhtrashrrrs` @r'_fts_teardown_trash_stepz"SessionDB._fts_teardown_trash_step/ s\Z  "j002+33C??#EG(** E                5Ah        ++C0011 1'    LLKS Q Q Q44444 s*AA++A/2A/ !B++C :CC c|jsdS|d}|dSt||j|jfd} ||}n8#t j$r&}t d|Yd}~dSd}~wwxYw|dur>| }|&|d|dkr| dSt|S) a\Backfill one chunk of the deferred FTS rebuild. Returns True when more work remains, False when the rebuild is complete (or none is pending). Safe to call from any process at any time; chunks are claimed atomically inside the write transaction, so concurrent callers interleave instead of duplicating rows. FrNcr|d}|dSt|d}|krdSt|z}|d||fr|d||f|dt |f|kS)Nz?SELECT value FROM state_meta WHERE key = 'fts_rebuild_progress'FrzINSERT INTO messages_fts(rowid, content, tool_name, tool_calls) SELECT id, content, tool_name, tool_calls FROM messages WHERE id > ? AND id <= ?zINSERT INTO messages_fts_trigram(rowid, content, tool_name, tool_calls) SELECT id, content, tool_name, tool_calls FROM messages WHERE id > ? AND id <= ? AND role <> 'tool'zBUPDATE state_meta SET value = ? WHERE key = 'fts_rebuild_progress'rerrrr,)rhr0rupperchunkrrs r'rz'SessionDB.fts_rebuild_step.._doj s,,Qhjj {u3q6{{H:%%u5(*55E LL+5!       Bu%  LL5U     :% %r/z)FTS rebuild chunk failed (will retry): %sTrr) rprrrqr rrrrrrrr) rhhigh_water_rawrmorerrrrrs @@@r'fts_rebuild_stepzSessionDB.fts_rebuild_stepY s+  5'?@@  !5(( 1,% &% &% &% &% &% &% &N &&s++DD'    LLDc J J J44444  5==,,..F!fY&76'?&J&J((***5Dzzs A!!B0BBc|d}|dSt|dpd}t|}|dkrdStdtd|z|z }d|||dS)z:CJK-index backfill progress, or None when none is pending.rNrrrTrrrs r'fts_cjk_rebuild_statusz SessionDB.fts_cjk_rebuild_status s]]#?@@  4t}}%?@@EAFFJ A::4#s3>E12233%HQTUUUr/c|jr|jsdS|d}|dSt||jfd} ||}n8#t j$r&}t d|Yd}~dSd}~wwxYw|dur>| }|&|d|dkr| dSt|S) z=Backfill one chunk of the CJK index. True while work remains.FrNc>|d}|dSt|d}|krdSt|z}|d||f|dt |f|kS)NzCSELECT value FROM state_meta WHERE key = 'fts_cjk_rebuild_progress'FrzINSERT INTO messages_fts_cjk(rowid, content, tool_name, tool_calls) SELECT id, content, tool_name, tool_calls FROM messages WHERE id > ? AND id <= ? AND role <> 'tool'zFUPDATE state_meta SET value = ? WHERE key = 'fts_cjk_rebuild_progress'r)rhr0rrrrs r'rz+SessionDB.fts_cjk_rebuild_step.._do s,,9hjj {u3q6{{H:%%u5(*55E LL>5!     LL9U     :% %r/z-CJK FTS rebuild chunk failed (will retry): %sTrr) rprerrr rrrrrr_fts_cjk_rebuild_finishr)rhrrrrrrrs @@r'fts_cjk_rebuild_stepzSessionDB.fts_cjk_rebuild_step s$  (< 5'CDD  !5(( , & & & & & &0 &&s++DD'    LLH# N N N44444  5==0022F!fY&76'?&J&J,,...5Dzzs AB.BBcxd}||d|_tddS)z?Boundary sweep + clear the cjk markers; index becomes servable.c|d}|7t|d}|dz |dz}}|d||f|ddS)NzESELECT value FROM state_meta WHERE key = 'fts_cjk_rebuild_high_water'rrWaINSERT INTO messages_fts_cjk(rowid, content, tool_name, tool_calls) SELECT m.id, m.content, m.tool_name, m.tool_calls FROM messages m WHERE m.id > ? AND m.id <= ? AND m.role <> 'tool' AND NOT EXISTS (SELECT 1 FROM messages_fts_cjk_docsize d WHERE d.id = m.id)z^DELETE FROM state_meta WHERE key IN ('fts_cjk_rebuild_high_water', 'fts_cjk_rebuild_progress')rrs r'rz.SessionDB._fts_cjk_rebuild_finish.._do s\\;hjj !^^dBIB b H  LLM     r/Tu7CJK FTS index backfill complete — serving CJK search.N)rrrrrrs r'r!z!SessionDB._fts_cjk_rebuild_finish sH   ( C   "& MNNNNNr/c|jsdSd}||}|rU|j5||j|jddddS#1swxYwYdSdS)aRebuild path for a stale cjk index (triggers were dropped). The gap's extent is unknown, so the only safe recovery is a from- scratch rebuild: drop the table + triggers, clear the breadcrumb, recreate via ``_ensure_fts_cjk_schema`` (which sets fresh backfill markers on a populated DB). Called from ``optimize_fts_storage`` on a tokenizer-capable host; no-op when not stale. Nc>|dtf}|sdStD]}|d||d|d|dtddS) NrFrz%DROP TABLE IF EXISTS messages_fts_cjkz(DROP VIEW IF EXISTS messages_fts_cjk_srcz&DELETE FROM state_meta WHERE key IN ('z<', 'fts_cjk_rebuild_high_water', 'fts_cjk_rebuild_progress')T)rerrr)rhrrs r'rz.SessionDB._fts_cjk_reset_if_stale.._do sLL8"$hjj  u) ? ? =t==>>>> LL@ A A A LLC D D D LL.&...    4r/)rerrmrrbr2)rhr was_stales r'_fts_cjk_reset_if_stalez!SessionDB._fts_cjk_reset_if_stale s#  F   "'',,  $  $ $++DJ777 !!### $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $  $ $s4A,,A03A0c|jr|jrdS|j5||jr ddddS|jdr ddddS|jrC|jdtdr ddddS| |jcdddS#1swxYwYdS)a True when `optimize_fts_storage()` has work to do: either this DB is a legacy inline-FTS install that can be optimized to the v23 external-content schema, or a previous optimize run was interrupted (legacy vtables already demoted, but backfill markers and/or trash tables remain) and re-running would resume it, or the CJK-bigram index needs a backfill/rebuild on this tokenizer-capable host. False for fresh and fully-optimized installs (and when FTS5 is unavailable).FNTESELECT 1 FROM state_meta WHERE key = 'fts_rebuild_high_water' LIMIT 1zFSELECT 1 FROM state_meta WHERE key IN ('fts_cjk_rebuild_high_water', 'z ') LIMIT 1) rprYrmrrbrerrer_has_fts_trashrgs r'fts_optimize_availablez SessionDB.fts_optimize_available) s  DN 5 Z 3 3--dj99  3 3 3 3 3 3 3 3z!!?hjj  3 3 3 3 3 3 3 3 #  (:(:Q3DQQQ))hjj ) 3 3 3 3 3 3 3 3*&&tz22+ 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3s#C+-C+;=C+C++C/2C/c t|d|jdddzfS)zTrue when demoted v22 shadow tables are still awaiting teardown. Caller must hold ``self._lock`` (or pass a migration-time cursor).zSSELECT 1 FROM sqlite_master WHERE type = 'table' AND name LIKE ? ESCAPE '\' LIMIT 1rrr)rrerrr)rhrhs r'r+zSessionDB._has_fts_trashK sTDLL 2  # + +C 7 7# = ?   (**  r/cRfd}t|S)uDemote the legacy inline FTS vtables and stage their shadow tables for chunked teardown. Returns MAX(messages.id) as the rebuild high water. O(1) schema surgery — the heavy delete is deferred to the chunked teardown, exactly as the validated auto path did.c>||dt|d}|r|d|d|dd|dD}|D]}|d|d ||d t |d t|d d }dt|fdfD]\}}|d||f|d|S)Nz,DROP VIEW IF EXISTS messages_fts_trigram_srczSELECT 1 FROM sqlite_master WHERE type = 'table' AND name IN ('messages_fts', 'messages_fts_trigram') AND sql LIKE 'CREATE VIRTUAL TABLE%' LIMIT 1r.zDELETE FROM sqlite_master WHERE type = 'table' AND name IN ('messages_fts', 'messages_fts_trigram') AND sql LIKE 'CREATE VIRTUAL TABLE%'zPRAGMA writable_schema=RESETcg|] }|d Srr;r s r'r^zFSessionDB._demote_legacy_fts_to_trash.._do..i s)AaDr/zSELECT name FROM sqlite_master WHERE type = 'table' AND (name LIKE 'messages_fts_%' ESCAPE '\' OR name LIKE 'messages_fts_trigram_%' ESCAPE '\')z ALTER TABLE z RENAME TO fts_v22_trash_r rrrr)rrJr;DELETE FROM state_meta WHERE key = 'fts_optimize_available') rrerrrfrFTS_SQLFTS_TRIGRAM_SQLr,)rhhadshadowsshrrrrhs r'rz2SessionDB._demote_legacy_fts_to_trash.._doY s  # #D ) ) ) LLG H H Ht||?hjj C  S 8999 ;  ;<<<"&,,M##hjj "SSBLL!Q!Q!QR!Q!QRRRR  # #D.' B B B  # #D*@/ R R RIJJSSUUVWXB)3r773-  1 LF LLV W W WIr/)rrrs` r'_demote_legacy_fts_to_trashz%SessionDB._demote_legacy_fts_to_trashT s; ' ' ' ' ' P4&&s++,,,r/) progress_cbvacuumr8r9cjsdddSjrdddSj5j}dddn #1swxYwYddu}|r|sjrRj5 jj dddn #1swxYwYdtddffd }d tddffd }|d  tj}sn+|d |tj|z S|d  tj}sn+|d |tj|z S|d tj}sn+|d|tj|z Sd}|r|d j5jddddn #1swxYwYd }n9#t&j$r'} t*d| d}Yd} ~ nd} ~ wwxYwd} | |dt*dt2d |dS)uMigrate a legacy v22 inline-FTS DB to the v23 external-content schema, foreground and to completion. Safe to re-run: if a previous attempt was interrupted it resumes from the progress marker. ``progress_cb`` receives {"phase", "percent", "indexed", "total"} dicts for a CLI progress bar. Returns a summary dict. The trigram tokenizer being unavailable is not fatal — the base index is still rebuilt (CJK falls back to LIKE), mirroring normal startup. Ffts5_unavailable)r r:rYNrphasercdS}|}||r|dnd|r|dnd|r|dndddS)Nrrrrr)r<rrr)rr)r<str8rhs r'_emitz-SessionDB.optimize_fts_storage.._emit s"((**Bz0022 K,.72i==C,.52i==A(*1G      r/ chunk_secondscftjtj|jzdS)aInter-chunk throttle (see the chunk-engine note above). The chunk methods themselves never sleep, so this loop is the single place the duty cycle is enforced: without it, back-to-back BEGIN IMMEDIATE chunks starve any live gateway/CLI process sharing the DB out of its lock retries (the measured ~85% write-lock ownership that froze concurrent sessions). N)rrmax_FTS_REBUILD_MIN_PAUSE_FTS_REBUILD_DUTY_FACTOR)r@rhs r'_pausez.SessionDB.optimize_fts_storage.._pause s@ Js+ ==     r/backfillTteardownr9r0z$VACUUM after FTS optimize failed: %sc|dttf|d|dttfdS)Nz{INSERT INTO state_meta (key, value) VALUES ('fts_storage_version', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.valuer1z7UPDATE schema_version SET version = ? WHERE version < ?)rer,FTS_STORAGE_VERSIONSCHEMA_VERSIONrs r'_settlez/SessionDB.optimize_fts_storage.._settle sm LLH())+    LLV W W W LLI0     r/donez/FTS storage optimization complete (layout v%d).)r vacuumed)rprYrmrrbrr7r(rerr2r,floatr monotonicrr"rrerrrrrrrI) rhr8r9legacyrr?rE_t0 vacuum_okrrKs `` r'optimize_fts_storagezSessionDB.optimize_fts_storage s   ?+=>> > > 8;77 7 Z @ @33DJ??F @ @ @ @ @ @ @ @ @ @ @ @ @ @ @-- 899E  /' /  , , . . . $$&&&   $ $ $++DJ777 !!### $ $ $ $ $ $ $ $ $ $ $ $ $ $ $          % D       j +.""C((**  E*    F4>##c) * * *  + j +.""C,,..  E*    F4>##c) * * *  + j +.""C0022  E*    F4>##c) * * *  +  " E(OOO "Z11J&&x000111111111111111 + " " "EsKKK!  "    G$$$ f  =?R    222s_A  A A %4C%%C),C)<I8I* I8*I..I81I.2I88J.J))J. schema_sqlcrtjd} ||i}|dD]\}i}|d|dD]~}|d}|dpd}|d}|d } |d } |r|gng} |r| s| d | | d | d| ||<|||<||S#|wxYw)uExtract expected columns per table from SCHEMA_SQL. Uses an in-memory SQLite database to parse the SQL — SQLite itself handles all syntax (DEFAULT expressions with commas, inline REFERENCES, CHECK constraints, etc.) so there are zero regex edge cases. The in-memory DB is opened, the schema DDL is executed, and PRAGMA table_info extracts the column metadata. Adding a column to SCHEMA_SQL is all that's needed; the reconciliation loop picks it up automatically. rzNSELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'PRAGMA table_info("")rrrrr zNOT NULLNzDEFAULT  )rrrrerfrrcr) rTref table_columnsrcolsr0col_namecol_typenotnulldefaultpkpartss r'_parse_schema_columnszSessionDB._parse_schema_columns sgoj))    j ) ) )79M++Bhjj * *(*;;1#111(**55C #1vH"1v|H!!fG!!fGQB*2:XJJE1r1 Z000* %9%9%9:::%(XXe__DNN%) c"" IIKKKKCIIKKKKs C5D D6c |t}|D])\}} |d|d}n#t j$rYDwxYwt}|D]C}t|ttfr|dn|d}| |D|D]x\} } | |vro| dd} |d|d| d | ?#t j$r'} td || | Yd } ~ pd } ~ wwxYwy+d S) uZEnsure live tables have every column declared in SCHEMA_SQL. Follows the Beets/sqlite-utils pattern: the CREATE TABLE definition in SCHEMA_SQL is the single source of truth for the desired schema. On every startup this method diffs the live columns (via PRAGMA table_info) against the declared columns, and ADDs any that are missing. This makes column additions a declarative operation — just add the column to SCHEMA_SQL and it appears on the next startup. Version-gated migration blocks are no longer needed for ADD COLUMN. rVrWrr"""z ALTER TABLE "z" ADD COLUMN "z" zreconcile %s.%s: %sN)rc SCHEMA_SQLitemsrerfrrrar+tuplerbrrrr) rhrlexpectedr5 declared_colsr live_colsr0rr]r^ safe_namers r'_reconcile_columnszSessionDB._reconcile_columns7 s--j99)1)9)9   %J  ~~8*888(**+    I $ $!+C%!?!?Ps1vvS[ d####&3&9&9&;&;  "(9,, ( 0 0d ; ;I ]J]]i]]S[]]#3  1:x  -   s)+A""A43A4?DE-EEct |j}|t|| |dn7#t j$r%}t d|Yd}~nd}~wwxYw|t |dn#t j$rYnwxYw| |}d}|s| ||d| }||dtfnFt|t jr|dn|d }|d krctd krX|rT||d }|d ur5||d t&r|d n d }n|d }nd }|dkr tdkr |dkrQ |dt)d|dn#t j$rYnwxYw|dkrI ||n2#t,$r%}t d|Yd}~nd}~wwxYw|dkr, |dn#t j$rYnwxYw|dkr |d d }|s~|d|d|d|d|d|dn7#t j$r%}t d |Yd}~nd}~wwxYw|dkr/|r-||r|d!d"|#|r{||sf|d$ ?||s*|d%t5t6|#|tkr |r|r|d&tfd'} || n#t j$r~ |d(td)|j|| n/#t j$rt d*YnwxYwYnt j$rYnwxYw|rI||r|!|tEtFk} ||d+tH|_%|j%r<||d tL} | |_'| r|(|| ,n|!|tEtFk} ||d+tR|_%|j%rQ||d t&} | |_'| r|*|| ,|+||j,dS)-aCreate tables and FTS if they don't exist, reconcile columns. Schema management follows the declarative reconciliation pattern (Beets, sqlite-utils): SCHEMA_SQL is the single source of truth. On existing databases, _reconcile_columns() diffs live columns against SCHEMA_SQL and ADDs any missing ones. This eliminates the version-gated migration chain for column additions, making it impossible for reordered or inserted migrations to skip columns. The schema_version table is retained for future data migrations (transforming existing rows) which cannot be handled declaratively. zCREATE INDEX IF NOT EXISTS idx_messages_platform_msg_id ON messages(session_id, platform_message_id) WHERE platform_message_id IS NOT NULLz/idx_messages_platform_msg_id create skipped: %sNz3UPDATE messages SET active = 1 WHERE active IS NULLTz*SELECT version FROM schema_version LIMIT 1z/INSERT INTO schema_version (version) VALUES (?)versionr rFzkINSERT INTO messages_fts_trigram(rowid, content) SELECT id, content FROM messages WHERE content IS NOT NULL rvzUPDATE sessions SET model_config = json_set(COALESCE(model_config, '{}'), '$._delegate_from', parent_session_id) WHERE parent_session_id IS NOT NULL AND json_extract(COALESCE(model_config, '{}'), '$._delegate_from') IS NULL AND sessionsaUPDATE sessions SET model_config = json_set(COALESCE(model_config, '{}'), '$._delegate_from', '__orphaned__') WHERE parent_session_id IS NULL AND json_extract(COALESCE(model_config, '{}'), '$._delegate_from') IS NULL AND json_extract(COALESCE(model_config, '{}'), '$._branched_from') IS NULL AND title IS NULL AND message_count <= 25 AND EXISTS (SELECT 1 FROM messages m WHERE m.session_id = sessions.id AND m.role = 'tool') AND NOT EXISTS (SELECT 1 FROM sessions ch WHERE ch.parent_session_id = sessions.id)z)v18 gateway metadata backfill skipped: %saINSERT OR IGNORE INTO session_model_usage ( session_id, model, billing_provider, billing_base_url, billing_mode, api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen ) SELECT id, COALESCE(model, 'unknown'), COALESCE(billing_provider, ''), COALESCE(billing_base_url, ''), COALESCE(billing_mode, ''), COALESCE(api_call_count, 0), COALESCE(input_tokens, 0), COALESCE(output_tokens, 0), COALESCE(cache_read_tokens, 0), COALESCE(cache_write_tokens, 0), COALESCE(reasoning_tokens, 0), COALESCE(estimated_cost_usd, 0), COALESCE(actual_cost_usd, 0), cost_status, cost_source, started_at, COALESCE(ended_at, started_at) FROM sessions WHERE COALESCE(input_tokens, 0) + COALESCE(output_tokens, 0) + COALESCE(cache_read_tokens, 0) + COALESCE(cache_write_tokens, 0) + COALESCE(reasoning_tokens, 0) > 0z\SELECT COUNT(*) FROM pragma_table_info('session_model_usage') WHERE name = 'task' AND pk > 0zAALTER TABLE session_model_usage RENAME TO session_model_usage_v21aCREATE TABLE session_model_usage ( session_id TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE, model TEXT NOT NULL, billing_provider TEXT NOT NULL DEFAULT '', billing_base_url TEXT NOT NULL DEFAULT '', billing_mode TEXT NOT NULL DEFAULT '', task TEXT NOT NULL DEFAULT '', api_call_count INTEGER NOT NULL DEFAULT 0, input_tokens INTEGER NOT NULL DEFAULT 0, output_tokens INTEGER NOT NULL DEFAULT 0, cache_read_tokens INTEGER NOT NULL DEFAULT 0, cache_write_tokens INTEGER NOT NULL DEFAULT 0, reasoning_tokens INTEGER NOT NULL DEFAULT 0, estimated_cost_usd REAL NOT NULL DEFAULT 0, actual_cost_usd REAL NOT NULL DEFAULT 0, cost_status TEXT, cost_source TEXT, first_seen REAL, last_seen REAL, PRIMARY KEY (session_id, model, billing_provider, billing_base_url, billing_mode, task) )aINSERT INTO session_model_usage ( session_id, model, billing_provider, billing_base_url, billing_mode, task, api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen ) SELECT session_id, model, billing_provider, billing_base_url, billing_mode, '', api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen FROM session_model_usage_v21z"DROP TABLE session_model_usage_v21z]CREATE INDEX IF NOT EXISTS idx_session_model_usage_session ON session_model_usage(session_id)zVCREATE INDEX IF NOT EXISTS idx_session_model_usage_model ON session_model_usage(model)z+v22 session_model_usage rebuild skipped: %sr,rIrlr*fts_storage_versionz%UPDATE schema_version SET version = ?zfCREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_title_unique ON sessions(title) WHERE title IS NOT NULLagUPDATE sessions AS older SET title = NULL WHERE title IS NOT NULL AND EXISTS ( SELECT 1 FROM sessions AS newer WHERE newer.title = older.title AND newer.rowid > older.rowid )zFCleared %d duplicate session title(s) while restoring the unique indexzICould not repair duplicate session titles; unique title index not createdr r)-rbrlrrgrnrerrrrDEFERRED_INDEX_SQLrrrrJr+rcrrr3rP-_backfill_gateway_metadata_from_sessions_jsonrrset_metar+r,rIIntegrityErrorrr r exceptionrrdrLEGACY_FTS_SQLrpLEGACY_FTS_TRIGRAM_SQLrqrr2rrr2) rhrlrfts5_availablefts_migrations_completer0current_version_fts_trigram_exists legacy_pktitle_index_sqltriggers_need_repairtrigram_enableds r'rfzSessionDB._init_schemac s""$$Z((( '''  Q NN8     ' Q Q Q LLJC P P P P P P P P Q /000  NNE    '    D 33F;;"& ,  # #F + + + CDDDoo ; NNA!     1;3 0L0LXc)nnRUVWRXO ##"(<(<"4*.*?*? 6++'+e3322"$:O<#NN!] 7<33,427/.3+##(;(;##NNB 4J?? BBNN T    /D## SFFvNNNN SSS LL!LcRRRRRRRR S ##!NNH>/D##7U &9!!hjj!$I%0'jkkk$. ?'KLLLA</UUULL!NPSTTTTTTTTU##:"Pd&D&DV&L&LPMM":CMOOO 66v>> NNC(**%++F33 %  )3/B+C+CF .00+1"1;#% 9   NN? + + + +%       \O////=     5  '    D  4 8--f55' 8++F33c-6H6HH%%)$;$;NN%%!$&*&=&= 68N''O/>D++88"O9 ++F33c-6H6HH%%)$;$;NG%%!$ 8&*&=&= 6''O/>D++11",;2 //777 s A B/BB2CCC:H;;I  I I-- J7JJ&J<<K KB-NN:N55N:R33UA T U)T:7U9T::U?UU session_idsourcemodelr8 system_promptuser_id session_keychat_id chat_type thread_idparent_session_idr3 profile_namer2cp    fd}||dS)udInsert a session row, enriching NULL metadata on conflict. The gateway's ``get_or_create_session`` creates a bare row (source + user_id) *before* the agent exists; the agent's later ``create_session`` then carries the real ``model`` / ``model_config`` / ``system_prompt``. A plain ``INSERT OR IGNORE`` silently dropped that enrichment, leaving gateway sessions with NULL model/billing metadata. The ``ON CONFLICT`` upsert backfills those fields via ``COALESCE`` — only filling columns that are still NULL, never overwriting values an earlier writer already set (so a later bare call with source="unknown" can't clobber a real source/model). ``chat_id``/``thread_id`` record the messaging origin (the chat/room and thread the session was started in) so that gateway ``/resume`` can prove a persisted, now-inactive row belongs to the caller's chat/thread before switching to it (IDOR scoping — without them the ``sessions`` table has no chat/thread to compare). When ``parent_session_id`` is set (compression fork, delegate/subagent spawn, branch continuation) and this row's own ``cwd``/``git_repo_root``/ ``git_branch`` are still NULL after the insert, they are backfilled from the parent row. Callers of ``create_session`` for a child session historically didn't propagate these fields themselves (e.g. the compression-fork path), so a lineage could silently lose its working directory and drop out of the project sidebar every time it forked (#64709). This only fills NULLs — an explicit ``cwd``/``git_repo_root`` on the child is never overwritten. For compression forks specifically (parent ended with ``end_reason='compression'``), the gateway origin columns (``user_id``/``session_key``/``chat_id``/``chat_type``/ ``thread_id``/``display_name``/``origin_json``) are inherited too, so a crash before the gateway re-records the peer can't strand the child without a recoverable routing mapping (#59527). c|d   rtjnd tjfr0|d f|d fdSdS)NaIINSERT INTO sessions ( id, source, user_id, session_key, chat_id, chat_type, thread_id, model, model_config, system_prompt, parent_session_id, cwd, profile_name, git_repo_root, started_at ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET model = COALESCE(sessions.model, excluded.model), model_config = COALESCE(sessions.model_config, excluded.model_config), system_prompt = COALESCE(sessions.system_prompt, excluded.system_prompt), session_key = COALESCE(sessions.session_key, excluded.session_key), chat_id = COALESCE(sessions.chat_id, excluded.chat_id), chat_type = COALESCE(sessions.chat_type, excluded.chat_type), thread_id = COALESCE(sessions.thread_id, excluded.thread_id), parent_session_id = COALESCE(sessions.parent_session_id, excluded.parent_session_id), cwd = COALESCE(sessions.cwd, excluded.cwd), profile_name = COALESCE(sessions.profile_name, excluded.profile_name), git_repo_root = COALESCE(sessions.git_repo_root, excluded.git_repo_root)aUPDATE sessions SET cwd = COALESCE(sessions.cwd, (SELECT p.cwd FROM sessions p WHERE p.id = sessions.parent_session_id)), git_repo_root = COALESCE(sessions.git_repo_root, (SELECT p.git_repo_root FROM sessions p WHERE p.id = sessions.parent_session_id)), git_branch = COALESCE(sessions.git_branch, (SELECT p.git_branch FROM sessions p WHERE p.id = sessions.parent_session_id)) WHERE id = ? AND parent_session_id IS NOT NULLaUPDATE sessions SET user_id = COALESCE(sessions.user_id, (SELECT p.user_id FROM sessions p WHERE p.id = sessions.parent_session_id)), session_key = COALESCE(sessions.session_key, (SELECT p.session_key FROM sessions p WHERE p.id = sessions.parent_session_id)), chat_id = COALESCE(sessions.chat_id, (SELECT p.chat_id FROM sessions p WHERE p.id = sessions.parent_session_id)), chat_type = COALESCE(sessions.chat_type, (SELECT p.chat_type FROM sessions p WHERE p.id = sessions.parent_session_id)), thread_id = COALESCE(sessions.thread_id, (SELECT p.thread_id FROM sessions p WHERE p.id = sessions.parent_session_id)), display_name = COALESCE(sessions.display_name, (SELECT p.display_name FROM sessions p WHERE p.id = sessions.parent_session_id)), origin_json = COALESCE(sessions.origin_json, (SELECT p.origin_json FROM sessions p WHERE p.id = sessions.parent_session_id)) WHERE id = ? AND parent_session_id IS NOT NULL AND EXISTS ( SELECT 1 FROM sessions p WHERE p.id = sessions.parent_session_id AND p.end_reason = 'compression' ))rejsondumpsr)rhrrr3r2rr8rrrrrrrrs r'rz*SessionDB._insert_session_row.._doK s LLc&0<FDJ|,,,$!% !IKK'$ $ $ J!8   G M   2 8 M;58 8 r/Nr)rhrrrr8rrrrrrrr3rr2rs `````````````` r'_insert_session_rowzSessionDB._insert_session_row sd^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ~ C     r/c $|j||fi||S)z4Create a new session record. Returns the session_id.r)rhrrkwargss r'create_sessionzSessionDB.create_session s%  V>>v>>>r/)rrrrr display_name origin_jsonrrc h rsdS f d} || dS)aPersist the gateway routing peer for an existing session row. ``display_name`` / ``origin_json`` carry the gateway's presentation and full origin metadata (#9006) so consumers (mcp_serve, mirror, channel directory) can read routing data from state.db instead of sessions.json. They are COALESCE'd only in the sense that ``None`` leaves the existing value untouched. Nc F |d f dS)Na1UPDATE sessions SET session_key = ?, source = ?, user_id = ?, chat_id = ?, chat_type = ?, thread_id = ?, display_name = COALESCE(?, display_name), origin_json = COALESCE(?, origin_json) WHERE id = ?r) rhrrrrrrrrrs r'rz2SessionDB.record_gateway_session_peer.._do sJ LL#        r/r) rhrrrrrrrrrrs ````````` r'record_gateway_session_peerz%SessionDB.record_gateway_session_peer s~*   F             * C     r/ finalizedcHsdSfd}||dS)zMark a gateway session's expiry-finalization flag in state.db. Mirrors ``SessionEntry.expiry_finalized`` (sessions.json) so the flag survives even if the JSON index is pruned or lost (#9006). Nc@|drdndfdS)Nz5UPDATE sessions SET expiry_finalized = ? WHERE id = ?rrr)rhrrs r'rz+SessionDB.set_expiry_finalized.._do s7 LLG&Q 3     r/r)rhrrrs `` r'set_expiry_finalizedzSessionDB.set_expiry_finalized sM   F       C     r/r)scope entry_jsonrcPrsdSfd}||dS)u Upsert one gateway routing entry (session_key -> SessionEntry JSON). The gateway_routing table is the durable replacement for sessions.json: one row per routing key, holding the full serialized ``SessionEntry`` so the gateway can rehydrate exactly what it wrote. ``scope`` namespaces the index the way separate sessions.json files did (one per sessions_dir) — callers pass their sessions_dir path so two stores with different directories never share routing state. Nc^|dtjfdS)Na!INSERT INTO gateway_routing (scope, session_key, entry_json, updated_at) VALUES (?, ?, ?, ?) ON CONFLICT(scope, session_key) DO UPDATE SET entry_json = excluded.entry_json, updated_at = excluded.updated_atrer)rhrrrs r'rz1SessionDB.save_gateway_routing_entry.._dos< LL;  Z=      r/r)rhrrrrs ``` r'save_gateway_routing_entryz$SessionDB.save_gateway_routing_entry sZ *  F        C     r/entriescjtjfd}||dS)a7Atomically replace the routing index for *scope* with *entries*. Mirrors the sessions.json full-rewrite semantics: keys absent from *entries* are removed (pruned/reset sessions disappear from the index). Runs as a single write transaction. Other scopes are untouched. c|dfr7|dfdDdSdS)Nz+DELETE FROM gateway_routing WHERE scope = ?z\INSERT INTO gateway_routing (scope, session_key, entry_json, updated_at) VALUES (?, ?, ?, ?)c*g|]\}}|| ||fSr;r;)rUrrrrs r'r^zJSessionDB.replace_gateway_routing_entries.._do..!s0OOODAqqOQOeQ3'OOOr/)re executemanyrh)rhrrrs r'rz6SessionDB.replace_gateway_routing_entries.._dosu LLF Q Q Q   *OOOOOGMMOOOOO  r/Nrr)rhrrrrs `` @r'replace_gateway_routing_entriesz)SessionDB.replace_gateway_routing_entriessQikk        C     r/c|j5|jd|f}dddn #1swxYwYd|DS)z>Load routing entries for *scope* as {session_key: entry_json}.zCSELECT session_key, entry_json FROM gateway_routing WHERE scope = ?Nc,i|]}|d|dS)rrr;r s r' z:SessionDB.load_gateway_routing_entries..-s#@@@a- !L/@@@r/rmrbrerf)rhrrs r'load_gateway_routing_entriesz&SessionDB.load_gateway_routing_entries&s Z  :%%Uhjj                 A@4@@@@/AA A session_keyscHsdSfd}||dS)z=Remove routing entries for the given session keys in *scope*.NcL|dfdDdS)Nz?DELETE FROM gateway_routing WHERE scope = ? AND session_key = ?cg|]}|fSr;r;)rUrrs r'r^zISessionDB.delete_gateway_routing_entries.._do..9s222%222r/)r)rhrrs r'rz5SessionDB.delete_gateway_routing_entries.._do6s?   Q2222\222     r/r)rhrrrs `` r'delete_gateway_routing_entriesz(SessionDB.delete_gateway_routing_entries/sM  F       C     r/)r active_onlyrrc d}g}|r|dz }|||r|dz }|dz }|j5|j||}dddn #1swxYwYd|DS)uFList gateway sessions (rows with a session_key) from state.db. Returns the newest row per session_key — the same shape consumers got from sessions.json: one live mapping per routing key. ``platform`` filters on ``source``; ``active_only`` restricts to sessions that have not ended. a SELECT sessions.*, COALESCE( (SELECT MAX(m.timestamp) FROM messages m WHERE m.session_id = sessions.id), sessions.started_at ) AS last_active FROM sessions WHERE session_key IS NOT NULL AND started_at = ( SELECT MAX(s2.started_at) FROM sessions s2 WHERE s2.session_key = sessions.session_key ) z AND LOWER(source) = LOWER(?)z AND ended_at IS NULLz ORDER BY last_active DESCNc,g|]}t|Sr;rr s r'r^z3SessionDB.list_gateway_sessions..b&&&AQ&&&r/)rrmrbrerf)rhrrqueryparamsrs r'list_gateway_sessionszSessionDB.list_gateway_sessions>s    $ 4 4E MM( # # #  - , ,E -- Z @ @:%%eV44==??D @ @ @ @ @ @ @ @ @ @ @ @ @ @ @&&&&&&s.A..A25A2)rrcn|r|dvrdSd}|t|g}|'|dz }|t||dz }|j5d|j||D}dddn #1swxYwY|sdSrAfd|D}|rt|dd St |d krdSn4t |d kr!d |D} t | d krdSt|dd S) aFind the most recent live session_id for a platform + chat origin. Equivalent of gateway/mirror's sessions.json scan: matches on source + chat_id (+ thread_id when provided). When ``user_id`` is provided, exact sender matches are preferred; if multiple distinct users share the chat and none matches, returns None rather than contaminating another participant's session. )NrNz SELECT id, user_id, started_at FROM sessions WHERE LOWER(source) = LOWER(?) AND session_key IS NOT NULL AND chat_id = ? AND ended_at IS NULL z AND COALESCE(thread_id, '') = ?z ORDER BY started_at DESCc,g|]}t|Sr;rr s r'r^z4SessionDB.find_session_by_origin..sRRRDGGRRRr/c~g|]9}t|dpdtk7|:Srr)r,r4)rUr rs r'r^z4SessionDB.find_session_by_origin..sBTTT1AEE),<,<,B(C(Cs7||(S(SQ(S(S(Sr/rr\rch|]n}t|dpd8t|dpdoSr)r,r4r5r s r'rWz3SessionDB.find_session_by_origin..sxquuY''-2..4466AEE)$$*++1133r/)r,rrmrbrerfrd) rhrrrrrrrexactdistinct_userss ` r'find_session_by_originz SessionDB.find_session_by_originds  7j004 !#g,,/  7 7E MM#i.. ) ) ) ,, Z S SRRTZ%7%7v%F%F%O%O%Q%QRRRD S S S S S S S S S S S S S S S 4  TTTTTTTE +58D>***4yy1}}t YY]]N >""Q&&t474=!!!s8BBBc,tdz dz }|sdSt|dd5}tj|}dddn #1swxYwYt |t sdS|D]~\}}t| dst |t s>| d}|sV| d }| d | d p|t |t r|pi d nd| d t |t r|pi dnd| dt |t rtj |nd| ds| drdndt|fdS)uvOne-time v18 backfill of gateway metadata from sessions.json. Existing gateway sessions predate the display_name / origin_json / expiry_finalized columns; copy what sessions.json knows so consumers can switch to state.db without losing pre-migration sessions. Only fills NULL columns — never overwrites data written by newer code. rtz sessions.jsonNr utf-8)encodingrroriginaiUPDATE sessions SET session_key = COALESCE(session_key, ?), chat_id = COALESCE(chat_id, ?), chat_type = COALESCE(chat_type, ?), thread_id = COALESCE(thread_id, ?), display_name = COALESCE(display_name, ?), origin_json = COALESCE(origin_json, ?), expiry_finalized = CASE WHEN COALESCE(expiry_finalized, 0) = 0 AND ? = 1 THEN 1 ELSE expiry_finalized END WHERE id = ?rrrrrexpiry_finalizedmemory_flushedrr) rropenrloadr+rrhr,rr4rer) rhrl sessions_filefdatarentryrrs r'r{z7SessionDB._backfill_gateway_metadata_from_sessions_jsonsB())J6H ##%%  F -w 7 7 7 19Q< 0 OR EXISTS ( SELECT 1 FROM messages WHERE messages.session_id = sessions.id LIMIT 1 )) ORDER BY started_at DESC LIMIT 1 a SELECT * FROM sessions WHERE source = ? AND COALESCE(user_id, '') = COALESCE(?, '') AND COALESCE(chat_id, '') = COALESCE(?, '') AND COALESCE(chat_type, '') = COALESCE(?, '') AND COALESCE(thread_id, '') = COALESCE(?, '') AND (ended_at IS NULL OR end_reason IN ('agent_close', 'ws_orphan_reap')) AND (COALESCE(message_count, 0) > 0 OR EXISTS ( SELECT 1 FROM messages WHERE messages.session_id = sessions.id LIMIT 1 )) ORDER BY started_at DESC LIMIT 1 rmrbrerr)rhrrrrrrr0s r'$find_latest_gateway_session_for_peerz.SessionDB.find_latest_gateway_session_for_peerse* 4 Z' ' *$$ f%  hjj Cyy!' ' ' ' ' ' ' ' *)"3-' ' ' ' ' ' ' ' .*$$ '9i@ hjj! /' ' ' ' ' ' ' ' ' ' ' ' ' ' ' P )tCyyyT)sAB)B)+2B))B-0B- end_reasonc@fd}||dS)aMark a session as ended. No-ops when the session is already ended. The first end_reason wins: compression-split sessions must keep their ``end_reason = 'compression'`` record even if a later stale ``end_session()`` call (e.g. from a desynced CLI session_id after ``/resume`` or ``/branch``) targets them with a different reason. Use ``reopen_session()`` first if you intentionally need to re-end a closed session with a new reason. c\|dtjfdS)NzRUPDATE sessions SET ended_at = ?, end_reason = ? WHERE id = ? AND ended_at IS NULLr)rhrrs r'rz"SessionDB.end_session.._dos8 LL4j*5     r/Nr)rhrrrs `` r' end_sessionzSessionDB.end_sessions>       C     r/c<fd}||dS)z6Clear ended_at/end_reason so a session can be resumed.c6|dfdS)NzCUPDATE sessions SET ended_at = NULL, end_reason = NULL WHERE id = ?rrhrs r'rz%SessionDB.reopen_session.._dos+ LLU      r/Nrrhrrs ` r'reopen_sessionzSessionDB.reopen_sessions8      C     r/ session_resetr:csdStjfd} ||}t|S#t$rYdSwxYw)uDurably mark a session as ended by an intentional reset boundary. Promotes *only* live rows (``ended_at IS NULL``) or rows carrying an accidental end_reason that the recovery query (``find_latest_gateway_session_for_peer``) treats as recoverable: ``agent_close`` (older gateway cleanup bug) and ``ws_orphan_reap`` (mistaken TUI reaper). Explicit conversation boundaries such as ``compression``, ``session_reset``, ``session_switch``, etc. are preserved — the first writer wins for those, and a later expiry finalization must not silently overwrite them. Plain ``end_session()`` is NOT sufficient for reset boundaries: it no-ops on an already-ended row, so a row that agent cleanup already closed as ``agent_close`` would stay recoverable and stale-route recovery would resurrect the reset session with its full history (#61220, #61993, #63539). Keep this promotion set in sync with the recoverable set in ``find_latest_gateway_session_for_peer`` — any reason recovery would reopen must be promotable here. ``reason`` lets reset paths keep their auditable specific reasons (``idle``, ``daily``, ``suspended``, ``resume_pending_expired``). Returns ``True`` when the row was promoted, ``False`` when skipped (already has a different explicit end_reason, or row not found). FcD|df}|jS)NzUPDATE sessions SET ended_at = ?, end_reason = ? WHERE id = ? AND (ended_at IS NULL OR end_reason IN ('agent_close', 'ws_orphan_reap'))rer )rhrlrr:rs r'rz/SessionDB.promote_to_session_reset.._doEs2\\Ffj) F ? "r/)rrrr)rhrr:rrrs `` @r'promote_to_session_resetz"SessionDB.promote_to_session_reset#s< 5ikk # # # # # # # &&s++D::    55 s#A AA git_branchc |r|sdS|pd}|pd}dg |g|r* d||r* d|| fd}||dS)u!Persist the session working directory when a frontend knows it. ``git_branch`` records the git branch checked out in ``cwd`` at the time the session started/resumed. The sidebar groups main-checkout sessions by this so feature-branch work doesn't pile under a single "main" row (the main checkout's *current* branch is transient and would misattribute past sessions). ``git_repo_root`` records the git repo this cwd belongs to — the authoritative project key. Resolving it here, at the lowest level, means every surface reads the same membership instead of re-probing git in the GUI over a partial page. Each field is only written when non-empty so a probe failure never clobbers a previously-captured value. Nrzcwd = ?zgit_branch = ?zgit_repo_root = ?cb|ddddS)NzUPDATE sessions SET r z WHERE id = ?)rerc)rhrsetss r'rz)SessionDB.update_session_cwd.._dous4 LLN $NNNPV W W W W Wr/)r5rr) rhrr3rr2rN repo_rootrrrs @@r'update_session_cwdzSessionDB.update_session_cwdTs"   F"))++"(b//11 { E  " KK( ) ) ) MM& ! ! !  % KK+ , , , MM) $ $ $ j!!! X X X X X X C     r/ cwd_to_rootcd|DsdSfd}||dS)a$Persist resolved git repo roots for cwds that don't have one yet. Backfills history so projects light up for sessions created before the column existed, without clobbering an already-recorded root. Only non-empty roots are written (a non-git cwd stays NULL). c$g|] \}}|| ||fSr;r;)rUr3r6s r'r^z1SessionDB.backfill_repo_roots..s*RRRdTRcR$RRRr/NcHD]\}}|d||fdS)NzXUPDATE sessions SET git_repo_root = ? WHERE cwd = ? AND COALESCE(git_repo_root, '') = ''r)rhr6r3pairss r'rz*SessionDB.backfill_repo_roots.._dosH"   c I3K  r/)rhr)rhrrrs @r'backfill_repo_rootszSessionDB.backfill_repo_rootszsgSRk.?.?.A.ARRR  F      C     r/cooldown_untilr'csdSfd} ||dS#tj$r'}td|Yd}~dSd}~wwxYw)z>Persist the active compression-failure cooldown for a session.Nc:|dfdS)NzfUPDATE sessions SET compression_failure_cooldown_until = ?, compression_failure_error = ? WHERE id = ?r)rhrr'rs r'rz:SessionDB.record_compression_failure_cooldown.._dos2 LL= 3     r/z2record_compression_failure_cooldown(%s) failed: %srrrrr)rhrrr'rrs ``` r'#record_compression_failure_cooldownz-SessionDB.record_compression_failure_cooldowns  F            $ $ $ $ $}    NNDC          s'AAAc|sdStj}|j5|jd|f}dddn #1swxYwY|dSt |t jr|dn|d}|dSt|}||krdSt |t jr|dn|d}|||z |dS)zBReturn the active compression-failure cooldown for ``session_id``.Nz_SELECT compression_failure_cooldown_until, compression_failure_error FROM sessions WHERE id = ?"compression_failure_cooldown_untilrcompression_failure_errorr)rremaining_secondsr') rrmrbrerr+rrcrN)rhrrr0rr's r' get_compression_failure_cooldownz*SessionDB.get_compression_failure_cooldownsW  4ikk Z  *$$- hjj                 ;4#w{++ C4 5 5Q   !4~.. S 4#w{++ C+ , ,Q  -!/#!5   s/AA!AcsdSfd} ||dS#tj$r'}td|Yd}~dSd}~wwxYw)z?Clear any persisted compression-failure cooldown for a session.Nc6|dfdS)NzlUPDATE sessions SET compression_failure_cooldown_until = NULL, compression_failure_error = NULL WHERE id = ?rrs r'rz9SessionDB.clear_compression_failure_cooldown.._dos. LL@      r/z1clear_compression_failure_cooldown(%s) failed: %sr)rhrrrs ` r'"clear_compression_failure_cooldownz,SessionDB.clear_compression_failure_cooldowns  F          $ $ $ $ $}    NNCC          s#AAAc|sdS|j5|j}| ddddS|d|f}dddn #1swxYwY|dSt |t jr|dn|d} tdt|pdS#ttf$rYdSwxYw)z3Return the persisted deterministic-fallback streak.rNz=SELECT compression_fallback_streak FROM sessions WHERE id = ?compression_fallback_streak rmrbrerr+rrcrBrrrrhrrhr0r)s r'get_compression_fallback_streakz)SessionDB.get_compression_fallback_streaksM 1 Z  :D|        ,,O hjj                  ;1#w{++ C- . .Q   q#ejq//** *:&   11 ( A)AA AB22CCstreakcsdStdt|fd}||dS)z:Persist the deterministic-fallback streak for one session.Nrc8|dfdS)Nz@UPDATE sessions SET compression_fallback_streak = ? WHERE id = ?rrh normalizedrs r'rz6SessionDB.set_compression_fallback_streak.._dos. LLRZ(     r/rBrr)rhrr rrs ` @r'set_compression_fallback_streakz)SessionDB.set_compression_fallback_streaks`  FCKK((        C     r/c|sdS|j5|j}| ddddS|d|f}dddn #1swxYwY|dSt |t jr|dn|d} tdt|pdS#ttf$rYdSwxYw)aReturn the persisted ineffective-compaction strike count. Mirrors ``get_compression_fallback_streak``: this is the durable half of the anti-thrash guard (``_ineffective_compression_count`` on the built-in compressor), persisted so that a fresh compressor bound to a resumed session inherits an armed/tripped guard instead of starting from zero across process restarts (#54923). rNz?SELECT compression_ineffective_count FROM sessions WHERE id = ?compression_ineffective_countrrs r'!get_compression_ineffective_countz+SessionDB.get_compression_ineffective_countsO 1 Z  :D|        ,,Q hjj                  ;1#w{++ C/ 0 0Q   q#ejq//** *:&   11 r countcsdStdt|fd}||dS)z@Persist the ineffective-compaction strike count for one session.Nrc8|dfdS)NzBUPDATE sessions SET compression_ineffective_count = ? WHERE id = ?rrs r'rz8SessionDB.set_compression_ineffective_count.._do,s. LLTZ(     r/r)rhrrrrs ` @r'!set_compression_ineffective_countz+SessionDB.set_compression_ineffective_count&s`  FCJJ''        C     r/r@r ttl_secondscrsdStj|zfd} t||S#tj$r'}t d|Yd}~dSd}~wwxYw)z>Extend the compression lock lease if ``holder`` still owns it.FcN|df}|jdkS)NzcUPDATE compression_locks SET expires_at = ? WHERE session_id = ? AND holder = ? AND expires_at >= ?rr)rhr expires_atrrrs r'rz/SessionDB.refresh_compression_lock.._doUs7,,JZ5C ._doso# ,,' hjj  %/W[%A%AMCMMs1v*4C)E)EQC %%3q6#',,?OO-LL>#^4 (6$ LL&VS*5     ,,K hjj $!+C!=!=IH 3q6,H-- -r/z;Reclaimed stale compression lock for session=%s (holder=%s)z+try_acquire_compression_lock(%s) failed: %sN)rrrrrrr) rhrrrrr%r"rrrs `` @@r'try_acquire_compression_lockz&SessionDB.try_acquire_compression_lockfs. 5ikk;& ' .' .' .' .' .' .' .' .R )-)<)> !}    NN=C    55555 sAA//B%>B  B%csdSfd} ||dS#tj$r'}td|Yd}~dSd}~wwxYw)aKRelease the compression lock for ``session_id`` iff we own it. Idempotent: no-op when the lock has already expired and been reclaimed by a different holder, or when no lock exists. The ``holder`` check prevents a late-returning compressor from clobbering a fresh lock held by someone else. Nc8|dfdS)Nr!r)rhrrs r'rz/SessionDB.release_compression_lock.._dos0 LL6V$     r/z'release_compression_lock(%s) failed: %sr)rhrrrrs `` r'release_compression_lockz"SessionDB.release_compression_locks  F           $ $ $ $ $}    NN9C          s%AAAc|sdStj}|jd||f}|dSt |t jr|dn|dS)uReturn the current (non-expired) holder for ``session_id``, or None. Diagnostic helper — not used by the locking protocol itself. NzMSELECT holder FROM compression_locks WHERE session_id = ? AND expires_at >= ?rr)rrbrerr+rrc)rhrrr0s r'get_compression_lock_holderz%SessionDB.get_compression_lock_holders}  4ikkj   7     (** ;4 *3 < <Hs8}}#a&Hr/model_config_jsoncDfd}||dS)aUpdate model_config and optionally model for an existing session. Uses COALESCE so that passing model=None leaves the stored model column unchanged. Routes through _execute_write for the standard BEGIN IMMEDIATE + jitter-retry + lock guarantee. c:|dfdS)NzMUPDATE sessions SET model_config = ?, model = COALESCE(?, model) WHERE id = ?r)rhrr,rs r'rz*SessionDB.update_session_meta.._dos0 LL_"E:6     r/Nr)rhrr,rrs ``` r'update_session_metazSessionDB.update_session_metasD        C     r/c@fd}||dS)z0Store the full assembled system prompt snapshot.c8|dfdS)Nz2UPDATE sessions SET system_prompt = ? WHERE id = ?r)rhrrs r'rz+SessionDB.update_system_prompt.._dos. LLD +     r/Nr)rhrrrs `` r'update_system_promptzSessionDB.update_system_prompts>       C     r/c@fd}||dS)a Update the model for a session after a mid-session switch. Unlike ``update_token_counts`` which uses ``COALESCE(model, ?)`` (only filling in NULL), this unconditionally sets the model column so that the dashboard reflects the user's latest /model choice. c8|dfdS)Nz*UPDATE sessions SET model = ? WHERE id = ?r)rhrrs r'rz+SessionDB.update_session_model.._do s. LL< #     r/Nr)rhrrrs `` r'update_session_modelzSessionDB.update_session_models>       C     r/) billing_modeproviderbase_urlr6cHfd}||dS)uUnconditionally update the billing provider/base_url for a session. Unlike ``update_token_counts`` which uses ``COALESCE(billing_provider, ?)`` (only filling in NULL), this unconditionally sets the billing fields so that the dashboard reflects the user's latest /model switch. Also nulls ``system_prompt`` so the cached snapshot (which embeds a stale ``Model:`` / ``Provider:`` header) is rebuilt — matching the behavior of ``update_session_model`` (see #48173, #48248). c<|dfdS)NzUPDATE sessions SET billing_provider = ?, billing_base_url = ?, billing_mode = COALESCE(?, billing_mode), system_prompt = NULL WHERE id = ?r)rhr8r6r7rs r'rz3SessionDB.update_session_billing_route.._do%s6 LL# 8\:>     r/Nr)rhrr7r8r6rs ```` r'update_session_billing_routez&SessionDB.update_session_billing_routesJ$         C     r/r input_tokens output_tokenscache_read_tokenscache_write_tokensreasoning_tokensestimated_cost_usdactual_cost_usd cost_status cost_sourcepricing_versionbilling_providerbilling_base_urlapi_call_countabsolutech d|rdndtp p p pppp  | r ndrndrndrndf| o p p pppp   fd}|dS)uUpdate token counters and backfill model if not already set. When *absolute* is False (default), values are **incremented** — use this for per-API-call deltas (CLI path). When *absolute* is True, values are **set directly** — use this when the caller already holds cumulative totals (gateway path, where the cached agent accumulates across messages). unknown)raUPDATE sessions SET input_tokens = ?, output_tokens = ?, cache_read_tokens = ?, cache_write_tokens = ?, reasoning_tokens = ?, estimated_cost_usd = COALESCE(?, 0), actual_cost_usd = CASE WHEN ? IS NULL THEN actual_cost_usd ELSE ? END, cost_status = COALESCE(?, cost_status), cost_source = COALESCE(?, cost_source), pricing_version = COALESCE(?, pricing_version), billing_provider = COALESCE(billing_provider, ?), billing_base_url = COALESCE(billing_base_url, ?), billing_mode = COALESCE(billing_mode, ?), model = COALESCE(model, ?), api_call_count = ? WHERE id = ?a^UPDATE sessions SET input_tokens = input_tokens + ?, output_tokens = output_tokens + ?, cache_read_tokens = cache_read_tokens + ?, cache_write_tokens = cache_write_tokens + ?, reasoning_tokens = reasoning_tokens + ?, estimated_cost_usd = COALESCE(estimated_cost_usd, 0) + COALESCE(?, 0), actual_cost_usd = CASE WHEN ? IS NULL THEN actual_cost_usd ELSE COALESCE(actual_cost_usd, 0) + ? END, cost_status = COALESCE(?, cost_status), cost_source = COALESCE(?, cost_source), pricing_version = COALESCE(?, pricing_version), billing_provider = COALESCE(billing_provider, ?), billing_base_url = COALESCE(billing_base_url, ?), billing_mode = COALESCE(billing_mode, ?), model = COALESCE(model, ?), api_call_count = COALESCE(api_call_count, 0) + ? WHERE id = ?Nc|df}||dnd}||dnd}t||dndpd}|dko+o)tot o |kp| k}|r|d  f|r'|    dSdS)NzISELECT model, billing_provider, api_call_count FROM sessions WHERE id = ?rrFrHrzUPDATE sessions SET model = ?, billing_provider = ?, billing_base_url = ?, billing_mode = ? WHERE id = ?)rrFrGr6r<r=r>r?r@rArBrCrDrH)rerrr_record_model_usage)rhr0existing_modelexisting_providerexisting_api_callsfirst_accounted_routerBrHrGr6rFr>r?rDrCrAhas_accounted_usager<rr=rr@record_model_usagerhrrs r'rz*SessionDB.update_token_counts.._dos,,[ hjj .1_S\\$N;>?$6 7 7PT !$sc*:&;&;TU%[Z[!\!\ #a'W'WKKW)**W$u,U0AEU0U "%  ',.> jY  LLf % % %! ((%5%5!-!-"/&7'9%5'9$3 + +#1!)  r/)rrr)rhrr<r=rr>r?r@rArBrCrDrErFrGr6rHrIrrRrrSrs```````````` ```` @@@@r'update_token_countszSessionDB.update_token_counts1sB   Ye DDD ) ##CC*#C(#  5M 5-> 5! 5%5 59G 5! 5%4              3 =   3 =  / 9LLT( 2EEd  # @#+l  "M "-> "! "%5 "9G "!  / / / / / / / / / / / / / / / / / / / / / / / / ` C     r/)taskrUc|d|f}||dnd}||dnd}||dnd}||dnd}|r|pd}|pd}|pd}|pd}n|p|pd}|p|pd}|p|pd}|p|pd}tj}|d ||||||pd|pd |pd |pd | pd | pd | pd t| pd t| pd ||||fdS) uAccumulate a per-API-call usage delta into session_model_usage. Runs inside the caller's write transaction (after the ``sessions`` UPDATE) so the per-model rows stay consistent with the summary row. When the caller omits the model/provider (some paths only pass token deltas), fall back to the values already recorded on the session row — the same COALESCE-from-session behaviour the summary update uses. ``task`` distinguishes what kind of work consumed the tokens: ``''`` (empty) is the main agent loop; auxiliary calls record their task name (``vision``, ``compression``, ``title_generation``, ...) via :meth:`record_auxiliary_usage` (issue #23270). zYSELECT model, billing_provider, billing_base_url, billing_mode FROM sessions WHERE id = ?NrrFrGr6rKraINSERT INTO session_model_usage ( session_id, model, billing_provider, billing_base_url, billing_mode, task, api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(session_id, model, billing_provider, billing_base_url, billing_mode, task) DO UPDATE SET api_call_count = api_call_count + excluded.api_call_count, input_tokens = input_tokens + excluded.input_tokens, output_tokens = output_tokens + excluded.output_tokens, cache_read_tokens = cache_read_tokens + excluded.cache_read_tokens, cache_write_tokens = cache_write_tokens + excluded.cache_write_tokens, reasoning_tokens = reasoning_tokens + excluded.reasoning_tokens, estimated_cost_usd = estimated_cost_usd + excluded.estimated_cost_usd, actual_cost_usd = actual_cost_usd + excluded.actual_cost_usd, cost_status = COALESCE(excluded.cost_status, cost_status), cost_source = COALESCE(excluded.cost_source, cost_source), last_seen = excluded.last_seenrg)rerrrN)rhrhrrrFrGr6r<r=r>r?r@rArBrCrDrHrUr0 sess_model sess_provider sess_base_urlsess_billing_mode eff_model eff_provider eff_base_urleff_billing_moders r'rMzSessionDB._record_model_usagesDll ) M   (** &)_S\\$ 36?.// 36?.// 36?C//  G*I+1rL+1rL+1r  88yI+B}BL+B}BL+F/@FB ikk  5*  #!!"!&Q"'a %A(/C00o,--% +) ) ) ) ) r/rKc (|j||fd|i||S)zHEnsure a session row exists (INSERT OR IGNORE). Accepts optional kwargs.rr)rhrrrrs r'ensure_sessionzSessionDB.ensure_session@s, ! VKK5KFKKKr/) rrFrGr<r=r>r?r@rAc  rsdSd  f d} | dS)usRecord an auxiliary LLM call's usage against *session_id* (issue #23270). Auxiliary calls (vision, compression, title_generation, web_extract, session_search, ...) historically discarded their usage, leaving the dashboard's per-model analytics blind to aux model spend. This writes a per-(model, provider, task) delta into ``session_model_usage`` — the same table the main loop's ``update_token_counts`` feeds — WITHOUT touching the ``sessions`` summary row. That separation is deliberate: the gateway overwrites session counters with absolute main-loop totals, so folding aux tokens into the summary row would either be clobbered or double-counted. Insights/analytics read the union of both. Best-effort by contract: callers must never fail an aux call because accounting failed. NrKch | dpdpdpdpd pddddd dS)Nrr)rrFrGr6r<r=r>r?r@rArBrCrDrHrU)rM) rhrGrFr>r?rAr<rr=r@rhrrUs r'rz-SessionDB.record_auxiliary_usage.._dopsv  $ $!1!1!).Q+0q"3"8q#5#:!1!6Q#5 $   # %     r/)rr) rhrrUrrFrGr<r=r>r?r@rArs ```````````` r'record_auxiliary_usagez SessionDB.record_auxiliary_usageKs<   F   Y777                ( C     r/ sessions_dirzOptional[Path]ctjdz fd}||pg}|r|r|D]}|||t|S)zCRemove empty TUI ghost sessions (no messages, no title, >24hr old).Qc|df}d|D}|r?ddt|z}|d|d||S)NaZ SELECT id FROM sessions WHERE source = 'tui' AND title IS NULL AND ended_at IS NOT NULL AND started_at < ? AND NOT EXISTS ( SELECT 1 FROM messages WHERE messages.session_id = sessions.id ) cfg|].}t|ttfr|dn|d/S)rr\)r+rirbr s r'r^zESessionDB.prune_empty_ghost_sessions.._do..s7SSS:a%77D1Q44QtWSSSr/rXrYrqrFrerfrcrd)rhrrrrcutoffs r'rz1SessionDB.prune_empty_ghost_sessions.._dos<< !  %HJJ TSdSSSC "xxc#hh77  HHHH#Jr/)rr_remove_session_filesrd)rhrdr removed_idsrVrjs @r'prune_empty_ghost_sessionsz$SessionDB.prune_empty_ghost_sessionssu$     &))#..4"  >K >" > >**<====;r/chtjdz fd}||pdS)ajMark orphaned compression continuation sessions as ended. Targets child sessions that were never finalized: parent is ended with reason='compression', child has messages but no end_reason/ended_at and api_call_count=0. Non-destructive: preserves all messages and sets end_reason='orphaned_compression'. Fix for #20001. i: chtj}|d|f}|jS)Na UPDATE sessions SET ended_at = ?, end_reason = 'orphaned_compression' WHERE api_call_count = 0 AND end_reason IS NULL AND ended_at IS NULL AND started_at < ? AND parent_session_id IS NOT NULL AND EXISTS ( SELECT 1 FROM sessions p WHERE p.id = sessions.parent_session_id AND p.end_reason = 'compression' AND p.ended_at IS NOT NULL ) AND EXISTS ( SELECT 1 FROM messages m WHERE m.session_id = sessions.id ) )rrer )rhrrrjs r'rz=SessionDB.finalize_orphaned_compression_sessions.._dos9)++C\\(f +F.? "r/rr)rhrrjs @r'&finalize_orphaned_compression_sessionsz0SessionDB.finalize_orphaned_compression_sessionssIv% # # # # #6""3'',1,r/c|j5|jd|f}|}dddn #1swxYwY|rt |ndS)zGet a session by ID.z#SELECT * FROM sessions WHERE id = ?Nrrhrrlr0s r' get_sessionzSessionDB.get_sessions Z $ $Z''5 }F//##C  $ $ $ $ $ $ $ $ $ $ $ $ $ $ $  )tCyyyT)1AA  A session_id_or_prefixc||}|r|dS|dddddd}|j5|jd|df}d |D}d d d n #1swxYwYt |d kr|d Sd S) a*Resolve an exact or uniquely prefixed session ID to the full ID. Returns the exact ID when it exists. Otherwise treats the input as a prefix and returns the single matching session ID if the prefix is unambiguous. Returns None for no matches or ambiguous prefixes. r\\\\rr?rrzSSELECT id FROM sessions WHERE id LIKE ? ESCAPE '\' ORDER BY started_at DESC LIMIT 2cg|] }|d Sr[r;rUr0s r'r^z0SessionDB.resolve_session_id..s>>>Ss4y>>>r/Nrr)rsrrmrbrerfrd)rhrurescapedrlmatchess r'resolve_session_idzSessionDB.resolve_session_ids'  !566  ;  ! WT6 " " WS% WS%  Z ? ?Z''f F?>FOO,=,=>>>G  ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? w<<1  1: ts%>B//B36B3rtitlecp|sdSt|}tjdd|}tjdd|}tjdd|}|sdSt |t jkr-tdt |dt jd |S) aValidate and sanitize a session title. - Strips leading/trailing whitespace - Removes ASCII control characters (0x00-0x1F, 0x7F) and problematic Unicode control chars (zero-width, RTL/LTR overrides, etc.) - Collapses internal whitespace runs to single spaces - Normalizes empty/whitespace-only strings to None - Enforces MAX_TITLE_LENGTH Returns the cleaned title string or None. Raises ValueError if the title exceeds MAX_TITLE_LENGTH after cleaning. Nz [\x00-\x08\x0b\x0c\x0e-\x1f\x7f]rzB[\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff\ufffc\ufff9-\ufffb]z\s+rYzTitle too long (z chars, max rF)rresubr5rdrMAX_TITLE_LENGTHr)r~cleaneds r'sanitize_titlezSessionDB.sanitize_titles 4%U++ &._doPsF ,,=M(**?gg&6&B1 IJ'"??,,"*4.K44+Z5  K(N )YeYYKYY1>E,,2I\\HYHH #F? "r/r)rr)rhrr~rrr s```` r'_set_session_titlezSessionDB._set_session_titleGsc##E**- #- #- #- #- #- #- #- #^&&s++!|r/c2|||dS)aLSet or update a session's title. Returns True if session was found and title was set. Raises ValueError if title is already in use by another session, or if the title fails validation (too long, invalid characters). Empty/whitespace-only strings are normalized to None (clearing the title). Frrrhrr~s r'set_session_titlezSessionDB.set_session_titles&&z5&NNNr/c2|||dS)a Set an auto-generated title only when the current title is NULL. The predicate and write run in one transaction so a concurrent manual rename cannot be overwritten. Validation and uniqueness behavior match :meth:`set_session_title`. Trrrs r'set_auto_title_if_emptyz!SessionDB.set_auto_title_if_emptys&&z5&MMMr/c|j5|jd|f}|}dddn #1swxYwY|r|dndS)z%Get the title for a session, or None.rNr~rmrbrerrrs r'get_session_titlezSessionDB.get_session_titles Z $ $Z''9J=F//##C  $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ #,s7||,rtarchivedcHfd}||}|dkS)uArchive or unarchive a session. Archived sessions are hidden from the default session list but keep all their messages — this is a soft hide, not a delete. For compression chains, archive the whole logical conversation. Desktop lists compression roots projected forward to their latest continuation; updating only the displayed tip lets the still-unarchived root resurrect it on refresh. Returns True when at least one row was updated. c|drdndf}|j}||dkr-|dd}|S)Na[ WITH RECURSIVE ancestors(id) AS ( SELECT ? UNION SELECT parent.id FROM ancestors a JOIN sessions child ON child.id = a.id JOIN sessions parent ON parent.id = child.parent_session_id WHERE parent.end_reason = 'compression' ), descendants(id) AS ( SELECT ? UNION SELECT child.id FROM descendants d JOIN sessions parent ON parent.id = d.id JOIN sessions child ON child.parent_session_id = parent.id WHERE parent.end_reason = 'compression' ), lineage(id) AS ( SELECT id FROM ancestors UNION SELECT id FROM descendants ) UPDATE sessions SET archived = ? WHERE id IN (SELECT id FROM lineage) rrzSELECT changes())rer r)rhrlr rrs r'rz+SessionDB.set_session_archived.._dosp\\:Zh)=A>=F@H8a<<<<(:;;DDFFqIOr/rr)rhrrrr s `` r'set_session_archivedzSessionDB.set_session_archivedsB$ $ $ $ $ $ J&&s++!|r/c|j5|jd|f}|}dddn #1swxYwY|rt |ndS)z?Look up a session by exact title. Returns session dict or None.z&SELECT * FROM sessions WHERE title = ?Nr)rhr~rlr0s r'get_session_by_titlezSessionDB.get_session_by_titles Z $ $Z''85(F//##C  $ $ $ $ $ $ $ $ $ $ $ $ $ $ $  )tCyyyT)rtc||}|dddddd}|j5|jd|df}|}d d d n #1swxYwY|r|d d S|r|d Sd S) adResolve a title to a session ID, preferring the latest in a lineage. If the exact title exists, returns that session's ID. If not, searches for "title #N" variants and returns the latest one. If the exact title exists AND numbered variants exist, returns the latest numbered variant (the most recent continuation). rwrxrr?rrzaSELECT id, title, started_at FROM sessions WHERE title LIKE ? ESCAPE '\' ORDER BY started_at DESC #%Nrr\)rrrmrbrerf)rhr~rr{rlnumbereds r'resolve_session_by_titlez"SessionDB.resolve_session_by_titles))%00--f--55c5AAII#uUU Z ) )Z''J"F ((H  ) ) ) ) ) ) ) ) ) ) ) ) ) ) )  A;t$ $  ; ts4BB"B base_titlec Ntjd|}|r|d}n|}|dddddd}|j5|jd ||d f}d |D}d d d n #1swxYwY|s|Sd}|D]I}tjd |} | r0t|t| d}J|d|dzS)uGenerate the next title in a lineage (e.g., "my session" → "my session #2"). Strips any existing " #N" suffix to find the base name, then finds the highest existing number and increments. z^(.*?) #(\d+)$rrwrxrr?rrzESELECT title FROM sessions WHERE title = ? OR title LIKE ? ESCAPE '\'rcg|] }|d S)r~r;rzs r'r^z7SessionDB.get_next_title_in_lineage.. sBBBG BBBr/Nz ^.* #(\d+)$z #) rr%rrrmrbrerfrBr) rhrr%baser{rlrmax_numtms r'get_next_title_in_lineagez#SessionDB.get_next_title_in_lineages*J77  ;;q>>DDD,,tV,,44S%@@HHeTT Z C CZ''X''FCB0A0ABBBH  C C C C C C C C C C C C C C C K 8 8A++A 8gs1771::77'''A+'''s5?CCCcP|}|r|hn t}tdD]}|j5|jd|f}|}dddn #1swxYwY||cS|d}|r||vr|cS|||}|S)aWalk the compression-continuation chain forward and return the tip. A compression continuation is a child of a session whose ``end_reason = 'compression'``. Older builds tried to distinguish continuations from branches/subagents by requiring ``child.started_at >= parent.ended_at``. That ordering is too brittle: gateway + compression races can insert the real continuation row before the parent row's ``ended_at`` is written, while a stale websocket later creates/reuses a sibling that *does* satisfy the timestamp test. The visible symptom is brutal: desktop resume follows the stale sibling and the user's latest messages look "lost" even though they are persisted in the real continuation chain. Instead, only follow children of compression-ended parents, exclude explicit branch/delegate/tool children, and prefer children that are themselves continuing the compression chain (``end_reason='compression'``) or still live over stale closed siblings such as ``ws_orphan_reap``. Returns the latest continuation tip, or the input id when no continuation exists. raI SELECT child.id FROM sessions parent JOIN sessions child ON child.parent_session_id = parent.id WHERE parent.id = ? AND parent.end_reason = 'compression' AND json_extract(COALESCE(child.model_config, '{}'), '$._branched_from') IS NULL AND json_extract(COALESCE(child.model_config, '{}'), '$._delegate_from') IS NULL AND COALESCE(child.source, '') != 'tool' ORDER BY CASE WHEN child.end_reason = 'compression' THEN 0 WHEN child.ended_at IS NULL THEN 1 ELSE 2 END, COALESCE( (SELECT MAX(m.timestamp) FROM messages m WHERE m.session_id = child.id), child.started_at ) DESC, child.started_at DESC, child.id DESC LIMIT 1 Nr\)rarrmrbrerr)rhrrseenrrlr0child_ids r'get_compression_tipzSessionDB.get_compression_tips*#.yys# # A ( (++.J14oo''7 ( ( ( ( ( ( ( ( ( ( ( ( ( ( (8{4yH x4// HHX   GGs1A++A/ 2A/ _session_compact_cols_sqlcjFtd}dfd|D_jS)zSELECT list for compact_rows: every ``sessions`` column declared in SCHEMA_SQL except the ``system_prompt`` blob, aliased with the ``s`` prefix used by list_sessions_rich/_get_session_rich_row queries.Nrtr c34K|]}|jv d|VdS)zs.N)_SESSION_COMPACT_EXCLUDED)rUrclss r'rz2SessionDB._compact_session_cols..hsC66 $s<<<T <<<<66r/)rrcrgrc)rdeclareds` r'_compact_session_colszSessionDB._compact_session_colsasm  ( 000<.sa    x* 233$Q}%5%:;;     r/r)rhrwherers r'distinct_session_cwdszSessionDB.distinct_session_cwdsns6 ) ( (E Z  :%%<',<<<hjj                        s1AAArvexclude_sourcesr=limitoffsetinclude_childrenmin_message_countproject_compression_tipsorder_by_last_active archived_onlyid_query search_query compact_rowsc g}g}|s?|t|tdd|r*|d|||rMdd|D}|d|d|||r."#A#AAC#A#A#A#A#A#Ar/s.source NOT IN (rFrs.message_count >= ?s.archived = 1s.archived = 0zWHERE  AND rneedlerc|dddddd}d|dS)Nrwrxrr?rr)r)rr{s r' _like_patternz3SessionDB.list_sessions_rich.._like_patternsINN40088eDDLLSRWXX&7~~~%r/znEXISTS (SELECT 1 FROM chain cq WHERE cq.root_id = s.id AND LOWER(cq.cur_id) LIKE ? ESCAPE '\')z[\W_]+z`REPLACE(REPLACE(REPLACE(REPLACE(LOWER(COALESCE({0}, '')), '-', ''), '_', ''), '.', ''), ' ', '')zEXISTS (SELECT 1 FROM chain cq JOIN sessions cs ON cs.id = cq.cur_id WHERE cq.root_id = s.id AND (LOWER(COALESCE(cs.title, '')) LIKE ? ESCAPE '\' OR LOWER(cq.cur_id) LIKE ? ESCAPE '\'r OR zcs.titlez LIKE ? ESCAPE '\'rJs.*zr WITH RECURSIVE chain(root_id, cur_id) AS ( SELECT s.id, s.id FROM sessions s a5 UNION ALL SELECT c.root_id, child.id FROM chain c JOIN sessions parent ON parent.id = c.cur_id JOIN sessions child ON child.parent_session_id = c.cur_id WHERE parent.end_reason = 'compression' AND json_extract(COALESCE(child.model_config, '{}'), '$._branched_from') IS NULL AND json_extract(COALESCE(child.model_config, '{}'), '$._delegate_from') IS NULL AND COALESCE(child.source, '') != 'tool' ), chain_max AS ( SELECT root_id, MAX(COALESCE( (SELECT MAX(m.timestamp) FROM messages m WHERE m.session_id = cur_id), (SELECT started_at FROM sessions ss WHERE ss.id = cur_id) )) AS effective_last_active FROM chain GROUP BY root_id ) SELECT a!, COALESCE( (SELECT SUBSTR(REPLACE(REPLACE(m.content, X'0A', ' '), X'0D', ' '), 1, 63) FROM messages m WHERE m.session_id = s.id AND m.role = 'user' AND m.content IS NOT NULL ORDER BY m.timestamp, m.id LIMIT 1), '' ) AS _preview_raw, COALESCE( (SELECT MAX(m2.timestamp) FROM messages m2 WHERE m2.session_id = s.id), s.started_at ) AS last_active, COALESCE(cm.effective_last_active, s.started_at) AS _effective_last_active FROM sessions s LEFT JOIN chain_max cm ON cm.root_id = s.id z ORDER BY _effective_last_active DESC, s.started_at DESC, s.id DESC LIMIT ? OFFSET ? z SELECT a, COALESCE( (SELECT SUBSTR(REPLACE(REPLACE(m.content, X'0A', ' '), X'0D', ' '), 1, 63) FROM messages m WHERE m.session_id = s.id AND m.role = 'user' AND m.content IS NOT NULL ORDER BY m.timestamp, m.id LIMIT 1), '' ) AS _preview_raw, COALESCE( (SELECT MAX(m2.timestamp) FROM messages m2 WHERE m2.session_id = s.id), s.started_at ) AS last_active FROM sessions s zY ORDER BY s.started_at DESC LIMIT ? OFFSET ? N _preview_raw<...preview_effective_last_activerrOr\)r) r\ended_atr message_counttool_call_countr~rrrrr3rr2_lineage_root_id)r_LISTABLE_CHILD_SQLr<rcextendrBr5rr,rrrLrrmrbrerfrpoprdr4r_get_session_rich_row)-rhrrr=rrrrrrrrrrr where_clausesrrclause clause_params where_sql id_needle search_needle outer_where id_paramsfilter_clausesrcompact_needle compact_sql search_clausecombined_selrrlrrtr0rCrawtext projectedtip_idtip_rowmergedrs- r'list_sessions_richzSessionDB.list_sessions_richsp  U  !4 5 5 5  $78H$I$I!S!S!S T T T  "   0 0 0 MM& ! ! !  +88#A#A#A#A#AAAL  !D\!D!D!D E E E MM/ * * *  )$6z$B$B !FM   ( ( ( MM- ( ( ( q  !7 8 8 8 MM+ , , ,  3  !1 2 2 2 2! 3  !1 2 2 2>KS:W\\-88:::QS ^**,,2244 %+2244::<< B +$K#%I(*N &c &c & & & &  ; %%I   y!9!9::: <"$ 2}!E!E> >  -- ">">!?!!CDDD!D!R{11*==RRRM$$]]>%B%BCCC%%md&:;;; "<<775>Wy11x111DWXDWDW4@J4--///UD)7@))./))LM)))EXf_y0E6?BFF3?J4--///UDE$ MM5&/ * * * Z % %Z''v66F??$$D % % % % % % % % % % % % % % %  CS A%%++1133C "3B3x#C2 uu2F) !) EE*D 1 1 1 OOA     $ !,< !I ) )55&&-77$$Q'''11!D'::QtW$$$$Q'''44V,4WW$$Q'''a33C g~~&-cls -.tW)*  (((( Hs0M>>NNjob_idcd|d}|ddtt|ddzz}d}|j5|j|||||f}|}dddn #1swxYwYg} |D]}} t | } | dd} | r(| dd } | t| d krd ndz| d <nd| d <| | ~| S) u[List the run sessions produced by a single cron job, newest first. Cron runs are flat, independent sessions whose id is ``cron_{job_id}_{timestamp}`` (see ``cron/scheduler.run_job``). They are never compression roots and never branch, so this deliberately skips the ``list_sessions_rich`` recursive compression-chain CTE / leading-wildcard ``id_query`` path — that path seeds from *every* ``source='cron'`` row in the DB and only filters to one job's runs after the scan, so it scales with the whole cron pile (a heavy history makes the desktop run-history endpoint time out before it eventually populates). Instead this binds to one job with a ``[prefix, prefix_hi)`` range over the id (an index range scan, not a ``%...%`` substring), filters ``source='cron'``, and orders by ``started_at DESC``. Work scales with the requested window, not the total cron history. Returns the same enriched row shape as ``list_sessions_rich`` (adds ``preview`` + ``last_active``) so callers can reuse it. cron_rNra SELECT s.*, COALESCE( (SELECT SUBSTR(REPLACE(REPLACE(m.content, X'0A', ' '), X'0D', ' '), 1, 63) FROM messages m WHERE m.session_id = s.id AND m.role = 'user' AND m.content IS NOT NULL ORDER BY m.timestamp, m.id LIMIT 1), '' ) AS _preview_raw, COALESCE( (SELECT MAX(m2.timestamp) FROM messages m2 WHERE m2.session_id = s.id), s.started_at ) AS last_active FROM sessions s WHERE s.source = 'cron' AND s.id >= ? AND s.id < ? ORDER BY s.started_at DESC, s.id DESC LIMIT ? OFFSET ? rrrrr) chrordrmrbrerfrrr5rdr)rhrrrrA prefix_hirrlrrunsr0rCrrs r'list_cron_job_runszSessionDB.list_cron_job_runssj2#""" 3B3K#c&*oo&9":"::  $Z % %Z'' 5&/QRRF??$$D % % % % % % % % % % % % % % %&(  CS A%%++1133C "3B3x#C2 uu2F) !) KKNNNN s4BBBc|r|nd}d|d}|j5|j||f}|}dddn #1swxYwY|sdSt |}|dd}|r(|dd} | t|dkrdndz|d <nd|d <|S) a%Fetch a single session with the same enriched columns as ``list_sessions_rich`` (preview + last_active). Returns None if the session doesn't exist. Pass ``compact_rows=True`` to omit the ``system_prompt`` blob (see ``list_sessions_rich`` for details). rz SELECT ah, COALESCE( (SELECT SUBSTR(REPLACE(REPLACE(m.content, X'0A', ' '), X'0D', ' '), 1, 63) FROM messages m WHERE m.session_id = s.id AND m.role = 'user' AND m.content IS NOT NULL ORDER BY m.timestamp, m.id LIMIT 1), '' ) AS _preview_raw, COALESCE( (SELECT MAX(m2.timestamp) FROM messages m2 WHERE m2.session_id = s.id), s.started_at ) AS last_active FROM sessions s WHERE s.id = ? Nrrrrr) rrmrbrerrrr5rd) rhrrrrrlr0rCrrs r'rzSessionDB._get_session_rich_rows=0<Ft))+++     Z $ $Z'' }==F//##C $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ 4 IIeeNB''--//  ss8DCHHrMM55rBAiLLAiLs1A##A'*A'zjson:rc6t|trt|S|"t|ttt fr|S |jtj|zS#ttf$rtt|cYSwxYw)ahSerialize structured (list/dict) message content for sqlite. sqlite3 can only bind ``str``, ``bytes``, ``int``, ``float``, and ``None`` to query parameters. Multimodal messages have ``content`` as a list of parts (``[{"type": "text", ...}, {"type": "image_url", ...}]``), which raises ``ProgrammingError: Error binding parameter N: type 'list' is not supported`` when bound directly. Returns the value unchanged when it's already a safe scalar, or a sentinel-prefixed JSON string for lists/dicts. Paired with :meth:`_decode_content` on read. ) r+r,rrrrN_CONTENT_JSON_PREFIXrrrrrrs r'_encode_contentzSessionDB._encode_contents gs # # 1(00 0 ?j5#u2EFF?N 6+dj.A.AA A:& 6 6 6'G 55 5 5 5 6s A((-BBc2t|tr||jrg t j|t |jdS#tjtf$rt d|cYSwxYw|S)z;Reverse :meth:`_encode_content`; returns scalars unchanged.NzCFailed to decode JSON-encoded message content; returning raw string) r+r,rrrloadsrdJSONDecodeErrorrrrr s r'_decode_contentzSessionDB._decode_contentBs gs # # (:(:3;S(T(T  z'#c.F*G*G*H*H"IJJJ()4   +   s-A2BBrr tool_calls tool_call_id token_count finish_reason reasoningreasoning_contentreasoning_detailscodex_reasoning_itemscodex_message_itemsplatform_message_idobservedeffect_disposition timestamp api_content display_kinddisplay_metadatac |rtj|nd| rtj| nd| rtj| nd| rtj| ndt|tr4 tj|}n#tjt f$rg}YnwxYw|rtj|nd||tj|u t|dr"t| nt|n2#t tf$rtd|YnwxYwd|&t|trt!|nd fd}||S)u Append a message to a session. Returns the message row ID. Also increments the session's message_count (and tool_call_count if role is 'tool' or tool_calls is present). ``platform_message_id`` is the external messaging platform's own message ID (e.g. Telegram update_id, Yuanbao msg_id). It is independent of the SQLite autoincrement primary key and is used by platform-specific flows like yuanbao's recall guard to redact a message by its platform-side identifier. ``api_content`` is the exact content string sent to the API for this message when it differs from ``content`` (ephemeral memory/plugin injections, persist overrides). It is a byte-fidelity sidecar for prompt-cache-stable replay — stored as sent, except lone surrogates (which sqlite3 cannot bind and which the conversation loop scrubs from every outgoing payload anyway, so the scrubbed form IS the wire bytes). Nr/Ignoring invalid explicit message timestamp: %rrrc|dt  tt rdnddttrtndttrtndf}|j} dkr|d fn|df|S)NINSERT INTO messages (session_id, role, content, tool_call_id, tool_calls, tool_name, effect_disposition, timestamp, token_count, finish_reason, reasoning, reasoning_content, reasoning_details, codex_reasoning_items, codex_message_items, platform_message_id, observed, active, api_content, display_kind, display_metadata) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)rrzUPDATE sessions SET message_count = message_count + 1, tool_call_count = tool_call_count + ? WHERE id = ?zBUPDATE sessions SET message_count = message_count + 1 WHERE id = ?)rer.r+r, lastrowid)rhrlmsg_idrcodex_items_jsoncodex_message_items_jsonrdisplay_metadata_jsonrrmessage_timestampnum_tool_callsrrrrreasoning_details_jsonrrstored_contentrrtool_calls_jsonrs r'rz%SessionDB.append_message.._dos(\\] " #%i00&%!%i00%&788*$,'!(AAq6@c6R6R\%k222X\7A,PS7T7T^%l333Z^)+ F<%F!! M#Z0  XMMr/)rrr+r,r r rr rhasattrrNrrrrrbrdr)rhrrrrrrrrrrrrrrrrrrrrrr%r&r'r(r)r*r+r,s `` ` ````` ``` `` @@@@@@@@r'append_messagezSessionDB.append_messagePsxZAQ Z +; < < H$*Z000D--g66 IKK   [9k229(-i.A.A.C.C(D(D%%(-i(8(8%z* [ [ [ NPYZZZZZ [  !0::t0L0LSS___RSN- - - - - - - - - - - - - - - - - - - - - - - - - ^""3'''s% B!!B<;B<AE,E32E3)rcvrrsdSfd}t|S)a_Stamp presentation metadata on this turn's freshly persisted row. The model still receives ``role`` and ``content`` unchanged. Gateway and CLI synthetic inputs call this immediately after their serial turn has flushed, preserving producer provenance without classifying by content during transcript rendering. Fc|df}|dS|dtrt jnd|dfdS)NzqSELECT id FROM messages WHERE session_id = ? AND role = ? AND content = ? AND active = 1 ORDER BY id DESC LIMIT 1FzGUPDATE messages SET display_kind = ?, display_metadata = ? WHERE id = ?rT)rer rr.rr)rhr0rrrrrhrs r'rz?SessionDB.set_latest_matching_message_display_kind.._dos,,JT4#7#7#@#@Ahjj  {u LLY%l334DNDJ/000$F   4r/)rr)rhrrrrrrs`````` r'(set_latest_matching_message_display_kindz2SessionDB.set_latest_matching_message_display_kindsu    5          $D'',,---r/rctj}d}d}|D](}|dd}|d} |} |d |d} t| dr"t| } nt| } nE#t t f$r1td|dYnwxYw|dkr|d nd} |dkr|d nd} |dkr|d nd}| rtj | nd}| rtj | nd}|rtj |nd}t| tr4 tj | } n#tjt f$rg} YnwxYw| rtj | nd}|d p|d }|d}|d||||d|d|t#|d|d| |d|d|dkr"t#|dnd|dkr"t#|dnd|||||drdnddt|trt#|ndt|dtr"t#|dnd|drtj |dndf|dz }| )|t| t$rt'| ndz }t)|dz| dz}*||fS)uInsert *messages* as fresh active rows for *session_id*. Shared by :meth:`replace_messages` (delete-then-insert) and :meth:`archive_and_compact` (soft-archive-then-insert). Runs inside the caller's write transaction (takes the live ``conn``). Returns ``(inserted_count, tool_call_count)``. Does NOT touch sessions.* counters — the caller owns that, since the two flows reconcile counts differently. rrrKrrNr rrrrr message_idrr"rrrrrrrrrrrrgư>)rr4r-rNrrrrrrrr+r,r r rer r.rbrdrB)rhrhrrnow_tsinsertedtool_calls_totalrrrr(ts_valuerrrr*r%r&r,platform_msg_idrs r'_insert_message_rowszSessionDB._insert_message_rowssR BR BC7769--D..J & ww{##/j"ww{33Hx55<,1(2D2D2F2F,G,G)),1(OO)!:.jjjLL!RTWT[T[\gThThiiiiij@D @S@S(; < < >>pt;>77CU;V;V`DJs#56777\`+    < MH% '1*d'C'CJC OOO $(9D(@AAFF)))s% AB77?C98C91GG! G!cT|rdndfd}|dS)uyAtomically replace the stored messages for a session. Used by transcript-rewrite flows such as /retry, /undo, and /compress. The delete + reinsert sequence must commit as one transaction so a mid-rewrite failure does not leave SQLite with a partial transcript. DESTRUCTIVE by default: every row for the session is DELETEd (and drops out of the FTS index). For compaction that must preserve the pre-compaction transcript under the same id, use :meth:`archive_and_compact` instead. Pass ``active_only=True`` to replace ONLY the live (``active = 1``) rows, leaving soft-archived rows (``active = 0`` — e.g. the ``compacted = 1`` turns that :meth:`archive_and_compact` keeps on disk for #38763 durability, or rewind/undo rows) untouched. Callers that share a session id with an agent already running in-place compaction must use this so a full-history rewrite doesn't wipe the rows the agent deliberately archived. ``message_count``/``tool_call_count`` then track the live set, matching :meth:`archive_and_compact`.  AND active = 1rc|df|df|\}}|d||fdS)N)DELETE FROM messages WHERE session_id = ?GUPDATE sessions SET message_count = 0, tool_call_count = 0 WHERE id = ?GUPDATE sessions SET message_count = ?, tool_call_count = ? WHERE id = ?rer9)rhtotal_messagestotal_tool_calls active_clauserrhrs r'rz'SessionDB.replace_messages.._doxs LLKMKK     LLY    04/H/Hj(00 ,N, LLY!1:>     r/Nr)rhrrrrrCs``` @r'replace_messageszSessionDB.replace_messages[s\6.9@))b         " C     r/c|j5|jd|f}|ducdddS#1swxYwYdS)u?Return True if the session has any soft-archived (``active = 0``) rows. Used by callers (e.g. the ACP adapter's ``_persist``) that must decide whether a full-history :meth:`replace_messages` would destroy durable compaction-archived turns. Cheap existence probe — does not load rows. zBSELECT 1 FROM messages WHERE session_id = ? AND active = 0 LIMIT 1Nrrhrrls r'has_archived_messageszSessionDB.has_archived_messagessZ 1 1Z''T F??$$D0  1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s2AA A compacted_messagesc@fd}|S)ujNon-destructive in-place compaction for a single durable session id. Soft-archives every currently-active message (``active = 0``) and inserts *compacted_messages* as fresh active rows — atomically, in one write transaction. The conversation keeps ONE session id for life (#38763) WITHOUT destroying history: - The live-context load (:meth:`get_messages_as_conversation`, :meth:`get_messages`) filters ``active = 1`` by default, so the model reloads ONLY the compacted set. - The archived pre-compaction turns stay on disk (active=0) and stay DISCOVERABLE: they are marked compacted=1, and search_messages() includes compacted=1 rows by default — so session_search still finds them, unlike rewind/undo rows (active=0, compacted=0) which stay hidden. They remain in the FTS index (the messages_fts* triggers index on INSERT / drop on DELETE and don't key on active/compacted; flipping to active=0 is a content-preserving UPDATE) and are recoverable via get_messages(..., include_inactive=True). This is the durability-preserving alternative to :meth:`replace_messages` for compaction. ``message_count`` is set to the ACTIVE (compacted) count, matching what the live load returns. Returns the new active count. c|df|\}}|d||f|S)NzQUPDATE messages SET active = 0, compacted = 1 WHERE session_id = ? AND active = 1r?r@)rhr5r6rHrhrs r'rz*SessionDB.archive_and_compact.._dosw LL6     *.)B)Bj"4** &H& LLY+Z8   Or/r)rhrrHrs``` r'archive_and_compactzSessionDB.archive_and_compacts>6       .""3'''r/cj||fd}||S)uBackfill the ``api_content`` sidecar onto the newest ACTIVE user row. In-place preflight compaction (:meth:`archive_and_compact`) inserts the current turn's user row BEFORE the turn prologue composes the prefetch/plugin sidecar, and the subsequent crash persist identity-skips every compacted dict — without this backfill the stamped sidecar would never land in the DB and any reload would replay clean content, re-introducing the prompt-cache divergence the sidecar exists to close. The ``content`` match is a defensive guard: if the newest active user row is not the message the caller stamped (racing rewrite, unexpected tail shape), nothing is written. Returns the number of rows updated (0 or 1). c^|dtf}|jS)NzUPDATE messages SET api_content = ? WHERE id = (SELECT id FROM messages WHERE session_id = ? AND role = 'user' AND active = 1 ORDER BY id DESC LIMIT 1) AND content IS ?)rer.r )rhrlrencodedrs r'rz2SessionDB.set_latest_user_api_content.._dos9\\% #;//WE F? "r/)r r)rhrrrrrNs ` ` @r'set_latest_user_api_contentz%SessionDB.set_latest_user_api_contentsS"&&w// # # # # # # #""3'''r/include_inactivec|rdnd}d|d}|g}||r |dz }||dn||g|j5|j||}|} dddn #1swxYwYg} | D]} t | } d| vr|| d| d<| d rZ tj | d | d <n;#tj tf$r"t d g| d <YnwxYw| | | S) u=Load messages for a session in insertion order. By default only active messages are returned. Pass ``include_inactive=True`` to load soft-deleted rows (e.g. for audit / debug views of rewound history). See :meth:`rewind_to_message` for the soft-delete mechanic. Ordered by AUTOINCREMENT id (true insertion order) rather than timestamp — see c03acca50 for the WSL2 clock-regression rationale. When ``limit`` is provided, returns at most ``limit`` messages starting from ``offset`` (0-based, in insertion order). Enables pagination for the API endpoint to avoid loading entire transcripts. ``offset`` alone (without ``limit``) also pages — SQLite requires a LIMIT clause for OFFSET, so it's emitted as ``LIMIT -1`` (unbounded). rr;z+SELECT * FROM messages WHERE session_id = ? ORDER BY idNz LIMIT ? OFFSET ?rrrzDFailed to deserialize tool_calls in get_messages, falling back to [])rrmrbrerfrrr4rr r rrrr) rhrrPrrrCrrrlrrr0rs r' get_messageszSessionDB.get_messagess./E4E  + + + + #|    & &C MM22E6B C C C Z % %Z''V44F??$$D % % % % % % % % % % % % % % %  Cs))CC!%!5!5c)n!E!EIww|$$ ++(, 3|3D(E(EC %%,i8+++NN#ijjj(*C %%%+ MM#     s#0A77A;>A;C--5D%$D%r around_message_idwindowc|dkrd}|j5|jd||f}|sgdddcdddS|jd|||dzf}|jd|||f}dddn #1swxYwYt t |t |z}g}|D]} t| } d| vr|| d| d<| d rZ tj | d | d <n;#tj tf$r"td g| d <YnwxYw|| t#dt%|dz } t%|} || | dS) uLoad a window of messages anchored on a specific message id. Returns a dict with: - ``window``: up to ``window`` messages before the anchor, the anchor itself, and up to ``window`` messages after, ordered by id ascending. - ``messages_before``: count of messages strictly before the anchor still in the session (== window unless we hit the start). - ``messages_after``: count of messages strictly after the anchor still in the session (== window unless we hit the end). Used by ``session_search`` for both the discovery shape (anchored on the FTS5 match) and the scroll shape (anchored on any message id). The ``messages_before`` / ``messages_after`` counts let the caller detect session boundaries: when either is less than ``window``, the agent has reached one end of the session. Returns an empty window when ``around_message_id`` is not a real id in ``session_id`` — callers decide how to surface that. rz>SELECT 1 FROM messages WHERE id = ? AND session_id = ? LIMIT 1)rUmessages_beforemessages_afterNzPSELECT * FROM messages WHERE session_id = ? AND id <= ? ORDER BY id DESC LIMIT ?rzNSELECT * FROM messages WHERE session_id = ? AND id > ? ORDER BY id ASC LIMIT ?rrzKFailed to deserialize tool_calls in get_messages_around, falling back to [])rmrbrerrfrbreversedrrr4rr r rrrrrBrd) rhrrTrU anchor_exists before_rows after_rowsrrr0rrWrXs r'get_messages_aroundzSessionDB.get_messages_arounds2 A::F Z   J..P"J/hjj ! Q"$aPP        *,,+. ;  hjj  ++*.7  hjj #               2H[))**T*-=-==  Cs))CC!%!5!5c)n!E!EIww|$$ ++(, 3|3D(E(EC %%,i8+++NNe)+C %%% + MM#    a[!1!1A!566Z.,   s*7CA#CC CE%%5FFrrrbookend keep_roles.c`|dkrd}||}|d}|sgddggdS|t|fd|D}n|}|dd} |dd} g} g} |dkrj5d } g}|4d d |D}d |d } t |}jd| d|| g||R} jd| d|| g||R} t t| } dddn #1swxYwYdtttfffd ||d|dfd| Dfd| DdS)u)Return an anchored window plus session bookends. Built on top of ``get_messages_around``. Three slices: - ``window``: messages immediately surrounding the anchor. Filtered to ``keep_roles`` (tool-response noise dropped by default), EXCEPT the anchor itself is always preserved regardless of role. - ``bookend_start``: first ``bookend`` user/assistant messages of the session — but only those whose id is strictly before the window's first message id. Empty when the window already overlaps the session head. Empty-content messages (tool-call-only assistant turns) are skipped so they don't crowd out actual prose openings. - ``bookend_end``: last ``bookend`` user/assistant messages of the session, same non-overlap rule at the tail. Bookends let an FTS5 hit anywhere in a long session yield the goal (opening) and the resolution (closing) on a single call — without loading the whole transcript. Returns ``{"window": [], "messages_before": 0, "messages_after": 0, "bookend_start": [], "bookend_end": []}`` when the anchor isn't in the session. ``keep_roles=None`` disables role filtering (raw window + raw bookends). r)rUrU)rUrWrX bookend_start bookend_endNctg|]4}|dks|dv2|5S)r\rr4)rUrrTkeep_sets r'r^z/SessionDB.get_anchored_view..sM55;;"333quuV}}7P7P7P7P7Pr/r\rrrXc3K|]}dVdSrr;rs r'rz.SessionDB.get_anchored_view..s"0I0I0I0I0I0I0I0Ir/z AND role IN (rFz6SELECT * FROM messages WHERE session_id = ? AND id < ?z0 AND length(content) > 0 ORDER BY id ASC LIMIT ?z6SELECT * FROM messages WHERE session_id = ? AND id > ?z1 AND length(content) > 0 ORDER BY id DESC LIMIT ?rcHt|}d|vr|d|d<|drZ tj|d|d<n;#tjt f$r"tdg|d<YnwxYw|S)NrrzIFailed to deserialize tool_calls in get_anchored_view, falling back to []) rrr4rr r rrr)r0rrhs r'_hydratez-SessionDB.get_anchored_view.._hydratess))CC!%!5!5c)n!E!EIww|$$ ++(, 3|3D(E(EC %%,i8+++NNc)+C %%% + Js A''5BBrWrXc&g|] }|Sr;r;rUr ris r'r^z/SessionDB.get_anchored_view..s!FFFahhqkkFFFr/c&g|] }|Sr;r;rks r'r^z/SessionDB.get_anchored_view..s!BBBAHHQKKBBBr/) r]rarmrcrbrbrerfrYr r,r)rhrrTrUr_r` primitive window_rowsfiltered_window window_min_id window_max_idbookend_start_rowsbookend_end_rows role_clause role_paramsrole_placeholdersrirfs` ` @@r'get_anchored_viewzSessionDB.get_anchored_viewmsD Q;;G,, )&-   )  #$"#!#!    !:H&OO *O#At, #B- )+&( Q;; D D $& )(+0I0Ij0I0I0I(I(I%"G3D"G"G"GK"&z"2"2K%)Z%7%7/6A/// FFgFF && (** #$(:#5#506A000 FFgFF $$ (** !$(1A(B(B#C#C 1 D D D D D D D D D D D D D D D4 T#s(^      &():;'(89FFFF3EFFFBBBB1ABBB    sCEE!Ec|s|S ||}n#t$r|}YnwxYw|r||kr|}|j5|}|h}d}tdD]} |jd|f}n #t$r|cYccdddSwxYw||} |jd|f}n #t$r|cYccdddSwxYw|n@t|dr|dn|d} | r| |vrn|| | }||n|cdddS#1swxYwYdS)uRedirect a resume target to the descendant session that holds the messages. Context compression ends the current session and forks a new child session (linked via ``parent_session_id``). The flush cursor is reset, so the child is where new messages actually land — the parent ends up with ``message_count = 0`` rows unless messages had already been flushed to it before compression. See #15000. This helper walks ``parent_session_id`` forward from ``session_id`` and returns the descendant in the chain that has the **most recent** messages. Unlike the original logic, it does NOT short-circuit when the starting session already has messages — a descendant that was created by compression may hold the continuation content and should be preferred by the WebUI and gateway for ``--resume`` and session loading. If no descendant (including the starting session) has any messages, the original ``session_id`` is returned unchanged. The chain is always walked via the child whose ``started_at`` is latest; that matches the single-chain shape that compression creates. A depth cap (32) guards against accidental loops in malformed data. N z3SELECT 1 FROM messages WHERE session_id = ? LIMIT 1aSELECT id FROM sessions WHERE parent_session_id = ? AND json_extract(COALESCE(model_config, '{}'), '$._branched_from') IS NULL AND json_extract(COALESCE(model_config, '{}'), '$._delegate_from') IS NULL AND COALESCE(source, '') != 'tool' ORDER BY started_at DESC, id DESC LIMIT 1keysr\r) rrrmrrbrerr-r) rhrtiprrbestrr0 child_rowrs r'resolve_resume_session_idz#SessionDB.resolve_resume_session_ids.   **:66CC   CCC   3*$$J Z+ <+ < G9DD2YY$ #$ #&*,,M hjjC!&&&%%%%%+ <+ <+ <+ <+ <+ <+ <+ <&?"D & $ 2 2D ! !!hjjI!&&&%%%%%E+ <+ <+ <+ <+ <+ <+ <+ .]"#=#=AC#=#=#=#=#=#=r/a4SELECT role, content, tool_call_id, tool_calls, tool_name, effect_disposition, finish_reason, reasoning, reasoning_content, reasoning_details, codex_reasoning_items, codex_message_items, platform_message_id, observed, timestamp, api_content, display_kind, display_metadata FROM messages WHERE session_id IN (rFrRNrrr)_session_lineage_root_to_tiprmrcrbrerirf_rows_to_conversation) rhrrrPr session_idsrCrrs r'get_messages_as_conversationz&SessionDB.get_messages_as_conversation>s92"l  H;;JGGK.E4E Z  88#=#=#=#=#===L:%% /7C / /! / / /k"" hjj!                ()) !/1 *   sA!BBBa role, content, tool_call_id, tool_calls, tool_name, effect_disposition, finish_reason, reasoning, reasoning_content, reasoning_details, codex_reasoning_items, codex_message_items, platform_message_id, observed, timestamp, api_content, display_kind, display_metadatacBg}|D]U}||d}|ddvr6t|tr!t|}|d|d}|dr |d|d<|dr |d|d<|drU t j|d|d<n6#tt jf$rt dYnwxYw|d r |d |d <|d r |d |d <|d r |d |d <|d r |d |d <|d rZ t j|d |d <n;#t jtf$r"t dg|d <YnwxYw|dr |d|d<|drd|d<|ddkr_|dr |d|d<|dr |d|d<|d |d|d<|drZ t j|d|d<n;#t jtf$r"t dd|d<YnwxYw|drZ t j|d|d<n;#t jtf$r"t dd|d<YnwxYw|drZ t j|d|d<n;#t jtf$r"t dd|d<YnwxYw|r| ||r@| |Wt|}|r2|r0ddlm} | d|} | rtd | ||S)!apDecode fetched message rows into the OpenAI conversation format. Extracted from get_messages_as_conversation so get_resume_conversations can build the model-fed and display views from one SELECT. ``rows`` must already be ordered by ``id`` (insertion order) and filtered to the desired session set / active state by the caller. rr>rrrrrrrz0Ignoring invalid display metadata on message rowrrrrrzKFailed to deserialize tool_calls in conversation replay, falling back to []rr3rTrrrrNrz=Failed to deserialize reasoning_details, falling back to NonerzAFailed to deserialize codex_reasoning_items, falling back to Nonerz?Failed to deserialize codex_message_items, falling back to Noner)repair_message_sequenceuRepaired %d message-alternation violation(s) while restoring session %s — durable transcript kept them, see repair_message_sequence)rr+r,rr5rr rr rr#_is_duplicate_replayed_user_messagerragent.agent_runtime_helpersrr) rhrrrrrr0rrrr%s r'rzSessionDB._rows_to_conversationsI !I !C**3y>::G6{333 7C8P8P3*73399;;v;7;;C=! 8%(%7M">" :&).&9N#%& WW.2j=O9P.Q.QC*++!4#78WWWNN#UVVVVVW; 4#&{#3K >" :&).&9N#; 4#&{#3K '( F,/0D,E()<  ++(, 3|3D(E(EC %%,i8+++NN#pqqq(*C %%%+() ?$'(=$>L!: '"&J6{k))'@+.+?C({#8'*;'7C $*+7/23F/GC+,*+8837:cBU>V3W3W/00 0)<888'fggg37/0008./<<7;z#F]B^7_7_344 0)<<<<'jkkk7;3444<,-::59ZDY@Z5[5[122 0)<:::'hiii591222:! T%M%MhX[%\%\  OOC 4H==  (  L K K K K K..tX>>H  2 sZB;;0C.-C.E$$5FFH,,5I$#I$0J5KKK005L('L(c|}|j5dd|D}|jd|jd|dt |}dddn #1swxYwYfd|D}||dd }||d d }||fS) uReturn ``(model_history, display_history)`` for a session resume in ONE SELECT. ``session.resume`` needs two projections of the same lineage: - ``model_history`` — the tip session's active rows, alternation-repaired (the live-replay working conversation). Equivalent to ``get_messages_as_conversation(session_id, repair_alternation=True)``. - ``display_history`` — the full lineage (ancestors → tip), verbatim, with replayed-user dedup. Equivalent to ``get_messages_as_conversation(session_id, include_ancestors=True)``. The display fetch already reads a superset of the model fetch (the tip rows are part of the lineage), so serving both from one lineage SELECT halves the resume's DB work versus two separate calls, with byte-identical output (see test_get_resume_conversations_matches_separate_reads). rXc3K|]}dVdSrr;rs r'rz5SessionDB.get_resume_conversations.. rr/SELECT session_id, $ FROM messages WHERE session_id IN () AND active = 1 ORDER BY idNc,g|]}|dk|Srr;rUr rs r'r^z6SessionDB.get_resume_conversations..s'EEE!q*'D'DA'D'D'Dr/FTr) rrmrcrbre_CONVERSATION_ROW_COLUMNSrirfr)rhrrrrtip_rows model_historydisplay_historys ` r'get_resume_conversationsz"SessionDB.get_resume_conversationssd&77 CC Z  88#=#=#=#=#===L:%%d&D6B k"" hjj                FEEEtEEE22 !## 3  44 !"$ 5   o--sA&BBBc|}t|dkrgS|j5dd|D}|jd|jd|dt|}dddn #1swxYwYfd|D}|sgS| |d d S) uGReturn the ancestor-only display messages for a session lineage. These are messages from parent/grandparent sessions (compression ancestors) that appear in the display transcript but NOT in the tip session's model-fed history. Used by ``session.resume`` to build the ``display_history_prefix`` that ``_live_session_payload`` prepends to the live model history. Previously the prefix was calculated as ``display_history[:len(display) - len(raw)]``, but that overcounts when ``repair_message_sequence`` removes messages from the MIDDLE of the tip history (e.g. verification candidates collapsed by the consecutive-assistant merge) — the length difference includes both ancestor messages AND repair-removed tip messages, but the slice only captures the first N display messages (which are tip messages when there are no ancestors), causing duplication. This method returns ONLY the genuine ancestor messages, identified by ``session_id != tip_session_id``. (#65919) rrXc3K|]}dVdSrr;rs r'rz8SessionDB.get_ancestor_display_prefix..@rr/rrrNc,g|]}|dk|Srr;rs r'r^z9SessionDB.get_ancestor_display_prefix..Gs'JJJqAlOz,I,I,I,I,Ir/TFr) rrdrmrcrbrerrirfr)rhrrrr ancestor_rowss ` r'get_ancestor_display_prefixz%SessionDB.get_ancestor_display_prefix(sW(77 CC {  q I Z  88#=#=#=#=#===L:%%d&D6Bk""  hjj                KJJJDJJJ  I)) !"$ *   sA&B%%B),B)cT||}|r|dr|dn|S)u'Return the ROOT id of *session_id*'s lineage chain. The root is the stable "conversation id": context compression rotates ``session_id`` to a new segment linked via ``parent_session_id``, and delegate subagents hang off their parent the same way. Walking to the root gives every segment of one user-facing conversation (and its delegation tree) a single identifier — used for Nous Portal ``conversation=`` usage tagging. Returns *session_id* unchanged when it has no recorded parent. r)r)rhrchains r'get_conversation_rootzSessionDB.get_conversation_rootQs311*==!>eAh>aJ?r/c|s|gSg}|}t}|j5tdD]}|r||vrn}|||||jd|f}|n!t|dr|dn|d}dddn #1swxYwYtt|p|gS)Nrz3SELECT parent_session_id FROM sessions WHERE id = ?rzrr) rarmrrrrbrerr-rbrY)rhrrrrrr0s r'rz&SessionDB._session_lineage_root_to_tip_sa < uu Z W W3ZZ W W'T//E!!! W%%%j((IJ(**;E6=c66J6JV#122PSTUPV W W W W W W W W W W W W W W WHUOO$$4 4sBCC Crc|ddkrdS|d}t|tr|sdSt|D]}}|ddkr|d|krdS|ddkr-|ds|drdS~dS)NrrFrTrr)r4r+r,rY)rrrprevs r'rz-SessionDB._is_duplicate_replayed_user_messageus 776??f $ $5'')$$'3'' w 5X&&  Dxx6))dhhy.A.AW.L.Lttxx;..DHHY4G4G.488T`KaKa.uuur/target_message_idc|j5|jdf}dddn #1swxYwY|t ddt |}|ddkr)t d|ddd ||d |d <g}fd }||}|j5|jd f}dddn #1swxYwY|r|d |d nd}t|||dS)uSoft-delete all messages with id >= ``target_message_id`` in *session_id*. The target message itself becomes inactive as well so the caller can pre-fill it as the next user prompt without it appearing twice in the replayed transcript. Rewound rows are kept on disk with ``active=0`` for audit / forensic inspection — use :meth:`get_messages` with ``include_inactive=True`` to see them. Returns a dict:: { "rewound_count": int, # number of rows newly flipped to active=0 "target_message": dict, # full row dict of the target "new_head_id": int|None # id of the last still-active row, or None } Raises ``ValueError`` if the target message does not exist in *session_id* or if its role is not ``"user"``. Always increments ``sessions.rewind_count`` — even when the target is already inactive — so the counter accurately reflects the number of rewind operations performed against the session. Idempotent on the ``active`` flag: re-rewinding past the same target is a no-op on row state but still bumps the counter. z6SELECT * FROM messages WHERE id = ? AND session_id = ?Nzmessage z not found in session rrz1rewind target must be a 'user' message (got role=z, id=rFrc|df}d|D}|r9dd|D}|d|d||df|S)NzGSELECT id FROM messages WHERE session_id = ? AND id >= ? AND active = 1cg|] }|d Srr;r s r'r^z._do..333A1Q4333r/rXc3K|]}dVdSrr;rs r'rz;SessionDB.rewind_to_message.._do.."'9'9'9'9'9'9'9'9r/z,UPDATE messages SET active = 0 WHERE id IN (rFzMUPDATE sessions SET rewind_count = COALESCE(rewind_count, 0) + 1 WHERE id = ?)rerfrc)rhrlrrrrrs r'rz(SessionDB.rewind_to_message.._dos\\B./F 43!2!2333C "xx'9'9S'9'9'999  R<RRR LL     Jr/z@SELECT MAX(id) FROM messages WHERE session_id = ? AND active = 1r) rewound_counttarget_message new_head_id) rmrbrerrrr4rrrd) rhrrr0 target_rowrewoundrhead_rowrs `` r'rewind_to_messagezSessionDB.rewind_to_messagesS<Z  *$$H"J/hjj                 ;P,PPJPP #YY >>& ! !V + +G>>&))GG2CGGG  !% 4 4Z^^I5N5N O O 9      (%%c**Z  z))R hjj                 &.S(1+2Ihqkkt !\\(&   s#0AA  A /EE Esince_message_idc<fd}||S)zMark inactive messages with id >= *since_message_id* active again. Returns the number of rows flipped back to ``active=1``. Intended for undo-of-rewind and test cleanup; not wired to a slash command in v1. c|df}d|D}|r9dd|D}|d|d|t|S)NzGSELECT id FROM messages WHERE session_id = ? AND id >= ? AND active = 0cg|] }|d Srr;r s r'r^z:SessionDB.restore_rewound.._do..rr/rXc3K|]}dVdSrr;rs r'rz9SessionDB.restore_rewound.._do..rr/z,UPDATE messages SET active = 1 WHERE id IN (rFri)rhrlrrrrrs r'rz&SessionDB.restore_rewound.._dos\\B-.F 43!2!2333C "xx'9'9S'9'9'999  R<RRRs88Or/r)rhrrrs `` r'restore_rewoundzSessionDB.restore_rewounds8      ""3'''r/c|rdnd}|j5|jd|d|t|f}|}dddn #1swxYwYg}|D]}||d} t | trBd| D} dd | D } | sd } nt | tr| } nd} d| } t| d kr | dd d z} | |d|d| d|S)aoReturn the *limit* most-recent user messages, newest first. Each entry is a dict with keys ``id``, ``timestamp``, ``preview``. ``preview`` is the first 80 characters of the message content (with line breaks collapsed to spaces). Used by the /rewind slash command picker. By default only active messages are returned. rr;zRSELECT id, timestamp, content FROM messages WHERE session_id = ? AND role = 'user'z ORDER BY id DESC LIMIT ?Nrcg|]F}t|tr/|ddk0|ddGSrvrrr+rr4rUrs r'r^z7SessionDB.list_recent_user_messages..sW*+!!T**/0uuV}}/F/FEE&"%%/F/F/Fr/rYc3K|]}||V dSrr;rUrs r'rz6SessionDB.list_recent_user_messages..s'">">A">1">">">">">">r/[multimodal content]PMrr\r)r\rr)rmrbrerrfrr+rbrcr5r,splitrdr) rhrrrPrCrlrrr0decoded text_partsrs r'list_recent_user_messagesz#SessionDB.list_recent_user_messagess/E4E Z % %Z''+ +++SZZ( F??$$D % % % % % % % % % % % % % % %(*  C**3y>::G'4(( /6 ((">">j">">">>>DDFF54GGS)) !hhw}}//G7||b  !#2#,. MMd)!$[!1&     sAAA!$A!rc|dt}g}g}d}|t|kr||}|dkr|||dz }<|d|dz}|dkr|d|dz }v||||dz|dt|dz d|dz}|t|kd |}t jd d|}t jd d |}t jd d|}t jdd |}t jdd |}t jdd|}t|D]\}}| d|d|} |S)aSanitize user input for safe use in FTS5 MATCH queries. FTS5 has its own query syntax where characters like ``"``, ``(``, ``)``, ``+``, ``*``, ``{``, ``}``, the column-filter operator ``:`` and bare boolean operators (``AND``, ``OR``, ``NOT``) have special meaning. Passing raw user input directly to MATCH can cause ``sqlite3.OperationalError``. Strategy: - Preserve properly paired quoted phrases (``"exact phrase"``) - Strip unmatched FTS5-special characters that would cause errors - Wrap unquoted hyphenated and dotted terms in quotes so FTS5 matches them as exact phrases instead of splitting on the hyphen/dot (e.g. ``chat-send``, ``P2.2``, ``my-app.config.ts``) NrrerrrYzQrz [+{}():\"^]z\*+*z(^|\s)\*z\1z(?i)^(AND|OR|NOT)\b\s*z(?i)\s+(AND|OR|NOT)\s*$z\b(\w+(?:[._-]\w+)+)\bz"\1") MAX_FTS5_QUERY_CHARSrdrfindrcrrr5 enumerater)r _quoted_partspiecesichend sanitizedquoteds r'_sanitize_fts5_queryzSessionDB._sanitize_fts5_query0s(+++, !  #e**nnqBSyy b!!!Q**S!a%((Cbyy c"""Q  qqy!1 2 2 2 MM>#m"4"4q"8>>> ? ? ?aA#e**nn"GGFOO F>3 :: F63 22 F;y99 F4b)//:K:KLL F5r9??;L;LMM F4gyII #=11 C CIAv!))/!///6BBII   r/cpcd|cxkodkncp_d|cxkodkncpOd|cxkodkncp?d|cxkodkncp/d |cxkod kncpd |cxkod kncpd |cxkodkncS)NN4Mߦ0?0@0000r;)rs r'_is_cjk_codepointzSessionDB._is_cjk_codepoints"&&&&&&&&'"&&&&&&&&'2(((((((('"&&&&&&&&'"&&&&&&&& ' "&&&&&&&& ' "&&&&&&&&  (r/rc|D]~}t|}d|cxkrdks]nd|cxkrdksNnd|cxkrdks?nd|cxkrdks0nd |cxkrd ks!nd |cxkrd ksnd |cxkrdkrn{dSdS)zBCheck if text contains CJK (Chinese, Japanese, Korean) characters.rrrrrrrrrrrrrrTF)r)rrrs r' _contains_cjkzSessionDB._contains_cjks   BRB"&&&&&&&&"&&&&&&&&2(((((((("&&&&&&&&"&&&&&&&&"&&&&&&&&"&&&&&&&&&tt'ur/c:tfd|DS)zCount CJK characters in text.c3`K|](}t|$dV)dS)rNrr)rUrrs r'rz'SessionDB._count_cjk..s<FFs'<'=2 chars and unigrams only for isolated chars, so a 1-char CJK term can't match inside longer runs there — those queries keep the LIKE substring route. rrTr)rrrunrs r'_has_lone_cjk_runzSessionDB._has_lone_cjk_runs_  B$$SWW-- q!8844axr/cd|dD}t|otd|DS)aTrue when every non-operator token is long enough for the trigram tokenizer to match (>=3 chars). The trigram tokenizer indexes overlapping 3-character sequences, so a token shorter than 3 chars produces no trigrams and can never match. With FTS5's implicit-AND between tokens, a single short token makes the whole MATCH return nothing, so the trigram path is only worth taking when every searchable token qualifies. c>g|]}|dv|S>ORANDNOTrrs r'r^z6SessionDB._trigram_eligible_tokens..s6   wwyy 444 444r/rec3<K|]}t|dkVdSrN)rdrs r'rz5SessionDB._trigram_eligible_tokens..s,#@#@ACFFaK#@#@#@#@#@#@r/)r5rrall)rtokenss r'_trigram_eligible_tokensz"SessionDB._trigram_eligible_tokenssn  {{3''--//5577   F||@#@#@#@#@#@ @ @@r/r)table source_filterr role_filterrr raw_queryr order_by_sqlrrc |} g} | D]]} | dvr| | .| d| ddzdz^d| } |dg}| g}|s|d|K|dd d |Dd |||K|d d d |Dd |||rK|dd d|Dd ||d|d|d|dd|d|d }||| g|j5 |j||}n!#tj $rYddddSwxYwd| DcdddS#1swxYwYdS)uRun a search against a substring-capable FTS index. ``table`` is ``messages_fts_trigram`` (default) or ``messages_fts_cjk``. The trigram tokenizer indexes overlapping 3-byte sequences, so it matches substrings regardless of word boundaries — both CJK phrases the unicode61 tokenizer splits into single characters and Latin runs the unicode61 tokenizer fuses onto adjacent CJK (e.g. ``修改youer服务端``). The cjk-bigram tokenizer splits Latin runs off adjacent CJK, giving the same recovery as an exact ranked token match. Each non-operator token is quoted to neutralise FTS5 special characters while boolean operators (AND/OR/NOT) are preserved. Returns the matching rows, or ``None`` when the query cannot be executed (e.g. the tokenizer is unavailable at runtime) so the caller can fall back to another strategy. >rrrrerfrYz MATCH ?!(m.active = 1 OR m.compacted = 1)N s.source IN (rXc3K|]}dVdSrr;rs r'rz0SessionDB._run_trigram_search..s"5Q5Qac5Q5Q5Q5Q5Q5Qr/rFrc3K|]}dVdSrr;rs r'rz0SessionDB._run_trigram_search..s"9W9W!#9W9W9W9W9W9Wr/ m.role IN (c3K|]}dVdSrr;rs r'rz0SessionDB._run_trigram_search..s"3M3MAC3M3M3M3M3M3Mr/zx SELECT m.id, m.session_id, m.role, snippet(z, -1, '>>>', '<<<', '...', 40) AS snippet, m.content, m.timestamp, m.tool_name, s.source, s.model, s.started_at AS session_started FROM z' JOIN messages m ON m.id = zL.rowid JOIN sessions s ON s.id = m.session_id WHERE r & LIMIT ? OFFSET ? c,g|]}t|Sr;rrzs r'r^z1SessionDB._run_trigram_search..s???#DII???r/) rrrrrcrrmrbrerrrf)rhrrrrPrrrrrrrbtok trigram_query tri_where tri_paramstri_sql tri_cursors r'_run_trigram_searchzSessionDB._run_trigram_searchsQ<"" A ACyy{{222 S!!!! S3;;sD#9#99C?@@@@ '''( )?  B   @ A A A  $   TSXX5Q5Q=5Q5Q5Q-Q-QTTT U U U   m , , ,  &   Z9W9W9W9W9W1W1WZZZ [ [ [   o . . .  +   P3883M3M3M3M3M+M+MPPP Q Q Q   k * * *      (-  << **  !   & 5&/*** Z @ @ !Z//DD +     @ @ @ @ @ @ @ @ @?)<)<)>)>???  @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @s6H?G43H?4HH?H H??IIsortc tj} d} |||||||||} | ttjdd} n#t t f$rd} YnwxYwtj| z dz} | | krKtd| || | t| nd|ddSS# ttjdd} n#t t f$rd} YnwxYwtj| z dz} | | krKtd| || | t| nd|ddwwxYw) aInstrumented wrapper around :meth:`_search_messages_impl`. Logs one line per slow search with the routing path taken, so production latency stays attributable per query shape (the 2026-07 session_search investigation needed trace archaeology to discover the LIKE full scans; this makes the next regression a grep). Threshold: HERMES_SEARCH_SLOW_MS (default 1000; 0 logs every call). N)rrrrrrrPHERMES_SEARCH_SLOW_MS1000g@@zBest-effort name of the routing path a query takes (log-only).remptyrzrefts_cjkcjg|]/}|dv|-|0SrrrrUrrhs r'r^z3SessionDB._describe_search_path..KsK7799$888T=O=OPQ=R=R8888r/c3JK|]}|dkVdSrrr#s r'rz2SessionDB._describe_search_path..Os4??1**Q.??????r/rtrigram like_scanrK) rrr5rrrrrrrqr)rhrrrrshorts` r'rzSessionDB._describe_search_path@s- 11%+2>>I w%%i00 v//#&&,,..C& !t/E/Ec/J/J ! y99;;F?????????Es##q(((4;R( y;   99 s#CCAC:AC C)(C)c >jsgS|r|sgS|}|sgSt|tr-|} | dvrd} nd} | dkrd} n | dkrd} nd} dg} |g} |s| d |Md d |D} | d | d | ||Md d|D}| d|d | ||rMd d|D}| d|d | |d| }| ||gd|d| d} |}| r-|d} |}fd| D}tfd|D}d}t|od|v}jr;|s8|s"| }g}|D]]}|dvr||.|d|ddzdz^d|}dg}|g}|s|d |K|d d d|Dd |||K|dd d |Dd |||rK|dd d!|Dd ||d"d|d#| d$}|||g j5j||} d%| D}!d&}dddn #1swxYwYn#t,j$rt0d'd&(Ynt,j$r}"|"r j5j||} d)| D}!d&}dddn #1swxYwYnJ#t,j$rt0d*YnwxYwt0d+|"Yd}"~"nd}"~"wwxYw|s|d,kr|sjr|s| }g}|D]]}|dvr||.|d|ddzdz^d|}#d-g}$|#g}%|s|$d |K|$d d d.|Dd |%||K|$dd d/|Dd |%||rK|$dd d0|Dd |%|d1d|$d#| d$}&|%||g j5j|&|%}'d2|'D}!d&}dddn #1swxYwYn#t,j$rYnt,j$r}"|"r j5j|&|%}'d3|'D}!d&}dddn #1swxYwYnJ#t,j$rt0d4YnwxYwt0d5|"Yd}"~"nd}"~"wwxYw|s=d6| Dp|g}(g})g}*|(D]i}|d7d8d9d:d;d<}+|)d=|*d9|+d9d9|+d9d9|+d9gz }*jd>d?|)d g},|s|,d |K|,d d d@|Dd |*||K|,dd dA|Dd |*||rK|,dd dB|Dd |*|dCd|,dD}-|*||g|(dEg|*z}*j5j|-|*}.dF|.D}!dddn #1swxYwYn j5j|| }/dG|/D}!dddn #1swxYwYn#t,j$rgcYSt,j$rx}"|"sj5j|| }/dH|/D}!dddn #1swxYwYYd}"~"nd}"~"wwxYw}0|0t?|!|kr ||t?|!z ||||I}1dJ|!D>|!>fdK|1Dn7#t,j$r%}"t0dL|"Yd}"~"nd}"~"wwxYw|!s|st|rd|vs|d}2jr"!|2dM| ||||||N }3|3r|3}!|!s=jr6"|r!!|2| ||||||O}4|4r|4}!|!D]5}5 j5jdP|5dQ|5dQf}6g}7|6D]}8|8dR}9#|9}:t|:tHrBdS|:D};ddT|;D}<|.s"*F*F13*F*F*F*F*F*Fr/rrFc3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl..s"+I+IAC+I+I+I+I+I+Ir/rc3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl..s"(B(B(B(B(B(B(B(Br/rra SELECT m.id, m.session_id, m.role, snippet(messages_fts, -1, '>>>', '<<<', '...', 40) AS snippet, m.content, m.timestamp, m.tool_name, s.source, s.model, s.started_at AS session_started FROM messages_fts JOIN messages m ON m.id = messages_fts.rowid JOIN sessions s ON s.id = m.session_id WHERE r r recjg|]/}|dv|-|0Srr"r#s r'r^z3SessionDB._search_messages_impl..sK!!!7799$888T=O=OPQ=R=R8888r/c3JK|]}|dkVdSrr%r#s r'rz2SessionDB._search_messages_impl..sE!!+,""Q&!!!!!!r/Ftool>rrrrfrYzmessages_fts_cjk MATCH ?c3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl.."=Y=Yac=Y=Y=Y=Y=Y=Yr/c3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl.. "A_A_!#A_A_A_A_A_A_r/c3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl.. ";U;UAC;U;U;U;U;U;Ur/a SELECT m.id, m.session_id, m.role, snippet(messages_fts_cjk, -1, '>>>', '<<<', '...', 40) AS snippet, m.content, m.timestamp, m.tool_name, s.source, s.model, s.started_at AS session_started FROM messages_fts_cjk JOIN messages m ON m.id = messages_fts_cjk.rowid JOIN sessions s ON s.id = m.session_id WHERE z z6 LIMIT ? OFFSET ? c,g|]}t|Sr;rrzs r'r^z3SessionDB._search_messages_impl..%"N"N"N499"N"N"Nr/Tz;messages_fts_cjk query failed; falling back to trigram/LIKErPc,g|]}t|Sr;rrzs r'r^z3SessionDB._search_messages_impl..7++"+"+"25DII+"+"+"r/zYCJK-bigram FTS search still failing after in-place rebuild; falling back to trigram/LIKE.zuCJK-bigram FTS search hit a corruption error (%s) and no in-place rebuild was possible; falling back to trigram/LIKE.rzmessages_fts_trigram MATCH ?c3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl.._r3r/c3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl..br5r/c3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl..er7r/a SELECT m.id, m.session_id, m.role, snippet(messages_fts_trigram, -1, '>>>', '<<<', '...', 40) AS snippet, m.content, m.timestamp, m.tool_name, s.source, s.model, s.started_at AS session_started FROM messages_fts_trigram JOIN messages m ON m.id = messages_fts_trigram.rowid JOIN sessions s ON s.id = m.session_id WHERE c,g|]}t|Sr;rrzs r'r^z3SessionDB._search_messages_impl..~r9r/c,g|]}t|Sr;rrzs r'r^z3SessionDB._search_messages_impl..r;r/zNTrigram FTS search still failing after in-place rebuild; falling back to LIKE.zjTrigram FTS search hit a corruption error (%s) and no in-place rebuild was possible; falling back to LIKE.c>g|]}|dv|Srrrs r'r^z3SessionDB._search_messages_impl..s6!!!wwyy(<<<<<.s">Z>Zqs>Z>Z>Z>Z>Z>Zr/c3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl..s"B`B`13B`B`B`B`B`B`r/c3K|]}dVdSrr;rs r'rz2SessionDB._search_messages_impl..s".sKKKStCyyKKKr/c,g|]}t|Sr;rrzs r'r^z3SessionDB._search_messages_impl..FFFStCyyFFFr/c,g|]}t|Sr;rrzs r'r^z3SessionDB._search_messages_impl..rHr/rPrrrch|] }|d Sr[r;)rUrs r'rWz2SessionDB._search_messages_impl..s555AdG555r/c30K|]}|dv |VdS)r\Nr;)rUrseen_idss r'rz2SessionDB._search_messages_impl..s1QQQ49P9Pq9P9P9P9PQQr/z$Unindexed-gap supplement skipped: %sr)rrrPrrrrr)rrPrrrrraWITH target AS ( SELECT session_id, timestamp, id FROM messages WHERE id = ? ) SELECT role, content FROM ( SELECT m.id, m.timestamp, m.role, m.content FROM messages m JOIN target t ON t.session_id = m.session_id WHERE (m.timestamp < t.timestamp) OR (m.timestamp = t.timestamp AND m.id < t.id) ORDER BY m.timestamp DESC, m.id DESC LIMIT 1 ) UNION ALL SELECT role, content FROM messages WHERE id = ? UNION ALL SELECT role, content FROM ( SELECT m.id, m.timestamp, m.role, m.content FROM messages m JOIN target t ON t.session_id = m.session_id WHERE (m.timestamp > t.timestamp) OR (m.timestamp = t.timestamp AND m.id > t.id) ORDER BY m.timestamp ASC, m.id ASC LIMIT 1 )r\rcg|]F}t|tr/|ddk0|ddGSrrrs r'r^z3SessionDB._search_messages_impl..jsW***67#-a#6#6*;<55==F;R;R!"fb 1 1;R;R;Rr/c3K|]}||V dSrr;rs r'rz2SessionDB._search_messages_impl..ns'+G+G!Q+GA+G+G+G+G+G+Gr/rrrrrcontext)'rpr5rr+r,rrrcrrrrrrrrrrrrmrbrerfrrrrrrrrqrrd_search_unindexed_gaprrrrbrr)?rhrrrrrrrrP sort_normrrrsource_placeholdersexclude_placeholdersrvrris_cjkr cjk_count_tokens_for_check_any_short_cjk_trigram_succeeded_wants_tool_rowsrrbr  cjk_query cjk_where cjk_paramscjk_sql cjk_cursorr|rr rrrr non_op_tokens token_clauses like_paramsesc like_wherelike_sql like_cursorrlrebuild_status gap_matches _fb_querycjk_fb tri_matchesr% ctx_cursor context_msgsr rrrrrrMs?` @r'rzSessionDB._search_messages_implVsN  I EKKMM I))%00 I dC   **,,I 444 I  Z>ZM>Z>Z>Z6Z6Z&]&]&]^^^&&}555".%%&c#((B`B`P_B`B`B`:`:`&c&c&cddd&&7774%%&YCHH ZLL"&*"4"4X{"K"KKKKK4H4H4J4JKKKGLLLLLLLLLLLLLLL GZGG!Z//V<*> J"88CLL(%5"/$3 + 9 65W555QQQQ+QQQQQQQ+ J J J CSIIIIIIII J*$ *$ *+&&$ *,2[+@+@ C((..00I& %11,!-%5"/$3 +!2  %$G *+ *11%88 * #66!-%5"/$3 +!7   *)G: &: &E9 &Z55!%!3!3 <teDk2? " "JB$&L'0022 l"&"6"6s";";>44 )**;B***J$'88+G+Gz+G+G+G#G#G#M#M#O#OD&*&D.DGG'55)&-GG&(G$++%&vY74C4=II!G555555555555555l$0i   & & &#%i    & ' 'E IIi & & & &sR8#o; ?pp 9Ars!ss5zrrrNEARzm.id > ? AND m.id <= ?rwrxrr?rrrBrrrrXc3K|]}dVdSrr;rs r'rz2SessionDB._search_unindexed_gap..s"1M1M!#1M1M1M1M1M1Mr/rFrc3K|]}dVdSrr;rs r'rz2SessionDB._search_unindexed_gap..s"5S5Sac5S5S5S5S5S5Sr/rc3K|]}dVdSrr;rs r'rz2SessionDB._search_unindexed_gap..s"/I/I/I/I/I/I/I/Ir/a SELECT m.id, m.session_id, m.role, substr(m.content, max(1, instr(m.content, ?) - 40), 120) AS snippet, m.content, m.timestamp, m.tool_name, s.source, s.model, s.started_at AS session_started FROM messages m JOIN sessions s ON s.id = m.session_id WHERE rzC ORDER BY m.timestamp DESC LIMIT ? c,g|]}t|Sr;rr s r'r^z3SessionDB._search_unindexed_gap..rr/) rrfindallr5rrrrcrrmrbrerf)rhrnrrPrrrrrrtermsraw_tokr rrtermrcrrs r'rQzSessionDB._search_unindexed_gaps6$((** >UaZZI%i0&/*z.)<<  G--$$**3//5577C #))++)EEE LL     I)* *- ' 'D,,tV,,44S%@@HHeTTC LL6    z3zzzlQ& &FF > LL< = = =  $ LLP1M1M}1M1M1M)M)MPPP Q Q Q MM- ( ( (  & LLVSXX5S5S?5S5S5S-S-SVVV W W W MM/ * * *  ' LLLsxx/I/I[/I/I/I'I'ILLL M M M MM+ & & &  <<&&    (f$w. Z > >:%%c622;;==D > > > > > > > > > > > > > > >&&&&&&s.J  J J cv|pdr|dkrgS|t|dz|d|d}dtt t fdtffd tt|fd  }d |d |DS) aSearch surfaced sessions by exact/prefix/substring session id. Desktop search uses this alongside FTS message search so users can paste a session id from logs, CLI output, or another Hermes surface and jump straight to that conversation. Matching also checks ``_lineage_root_id`` for projected compression-chain tips, so an old root id still resolves to the live continuation row. rrrXT)rrrrrr0rc$t|dpdt|dpdg}d|D}tfd|DrdStfd|DrdSd S) Nr\rrc:g|]}||Sr;r)rUr)s r'r^zBSessionDB.search_sessions_by_id..score..s%BBBEEB%++--BBBr/c3$K|] }|kV dSrr;rUr)rs r'rzASessionDB.search_sessions_by_id..score..s';;u5F?;;;;;;r/rc3BK|]}|VdSrrr}s r'rzASessionDB.search_sessions_by_id..score..s1DD5##F++DDDDDDr/rr)r,r4r)r0rrrrs r'scorez.SessionDB.search_sessions_by_id..scoresswwt}}*++S9K1L1L1RPR-S-STCBBSBBBJ;;;; ;;;;; qDDDDDDDDD q1r/c6|d|dfSNrrr;)itemrs r'z1SessionDB.search_sessions_by_id..seeDGnnd1g6r/)rcg|]\}}|Sr;r;)rUrr0s r'r^z3SessionDB.search_sessions_by_id..s1113111r/N) r5rrrBr r,rrsortedr)rhrrr candidatesrankedrrs @@r'search_sessions_by_idzSessionDB.search_sessions_by_ids+2$$&&,,.. !I,,eai''-!% -   tCH~ #       j ! !6666   21&%.1111r/c d}|j5|r"|j|d|||f}n |j|d||f}d|DcdddS#1swxYwYdS)zList sessions, optionally filtered by source. Returns rows enriched with a computed ``last_active`` column (latest message timestamp for the session, falling back to ``started_at``), ordered by most-recently-used first. zSELECT s.*, COALESCE(m.last_active, s.started_at) AS last_active FROM sessions s LEFT JOIN (SELECT session_id, MAX(timestamp) AS last_active FROM messages GROUP BY session_id) m ON m.session_id = s.id z[WHERE s.source = ? ORDER BY last_active DESC, s.started_at DESC, s.id DESC LIMIT ? OFFSET ?zHORDER BY last_active DESC, s.started_at DESC, s.id DESC LIMIT ? OFFSET ?c,g|]}t|Sr;rrzs r'r^z-SessionDB.search_sessions..;;;#DII;;;r/Nr)rhrrrselect_with_last_activerls r'search_sessionszSessionDB.search_sessionss * Z < < ++.___UF+ ++.___FO <;):):;;; < < < < < < < < < < < < < < < < < .Frr/rrFrrrrrrrzSELECT COUNT(*) FROM sessions sN) rrr<rcrrBrmrbrer)rhrr=rrrrrrrrrrrrls r' session_countzSessionDB.session_count!sQ0   U  !4 5 5 5  $78H$I$I!S!S!S T T T  "   0 0 0 MM& ! ! !  +88#A#A#A#A#AAAL  !D\!D!D!D E E E MM/ * * *  )$6z$B$B !FM   ( ( ( MM- ( ( ( q  !7 8 8 8 MM+ , , ,  3  !1 2 2 2 2! 3  !1 2 2 2?LT;gll=99;;;RT Z ( (Z''(U)(U(UW]^^F??$$Q' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s8GG  G c|j5|r|jd|f}n|jd}|dcdddS#1swxYwYdS)z2Count messages, optionally for a specific session.z2SELECT COUNT(*) FROM messages WHERE session_id = ?zSELECT COUNT(*) FROM messagesrNrrFs r'rzSessionDB.message_count[s Z ( ( M++H:-++,KLL??$$Q' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (sAA((A,/A,c|j5|jd||f}|ducdddS#1swxYwYdS)abCheck if a message with the given platform_message_id exists. Uses the idx_messages_platform_msg_id partial index for efficient lookup. Used by the gateway's transient-failure dedupe guard (#47237) to skip re-persisting a user message that was already saved on a prior retry of the same inbound platform message. zOSELECT 1 FROM messages WHERE session_id = ? AND platform_message_id = ? LIMIT 1Nr)rhrrrls r'has_platform_message_idz!SessionDB.has_platform_message_idfsZ 1 1Z''K01F ??$$D0  1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s3AA A sessionc |d}|sdS t|trtj|n|}n#t tjf$rYdSwxYwt|to|dduS)Nr8F_branched_from)r4r+r,rr rr r)rhrrcfgs r'_is_branch_child_rowzSessionDB._is_branch_child_row|skk.)) 5 %/S%9%9B$*S///sCC4/0   55 #t$$N1A)B)B$)NNs+AA! A!rc|d}|r||rdS||}t|o|ddkS)NrFrrO)r4rrsr)rhr parent_idrts r'_is_compression_child_rowz#SessionDB._is_compression_child_rowsmII122  D55e<< 5!!),,FHvzz,77=HIIIr/c||}|r||r|r|gngS|}|dh}||rZ||d}|r |d|vrn2|}||d||Z|dg}|dh}|}|ddkr|j5|jd|df} dddn #1swxYwYd} | D]*} t| } || s| } n+| r | d|vrn^| | d|| d| }|d|kr|ddk||vr|n|gS)z@Return compression ancestors through tip in chronological order.r\rrrOz SELECT * FROM sessions WHERE parent_session_id = ? ORDER BY started_at ASC N) rsrrrr4rmrbrerfrr) rhrrr6 ancestorsrtlineagerrr next_childr0 candidates r'get_compression_lineagez!SessionDB.get_compression_lineageso"":.. 3$33G<< 3#*2J<< 2$ZL ,,T22 &%%d+>&?@@F VD\Y66D MM$t* % % % ,,T22 &:,T |kk,''=88  z)) T]$ (**               J   II 00;;!*JE D!1T!9!9 NN:d+ , , , HHZ% & & & Gt} **1kk,''=882%//wwj\As"5D##D'*D'cn||}|sdS||}i|d|iS)z8Export a single session with all its messages as a dict.Nr)rsrS)rhrrrs r'export_sessionzSessionDB.export_sessionsJ"":.. 4$$Z000'0:x000r/cR||}|sdSg}|D].}||}|r||/|sdSt|d}t d|D}||d<d|D|d<||d<d|D|d <|S) z9Export a compression lineage as one logical session dict.Nrc3^K|](}t|dpgV)dS)rN)rdr4rUsegs r'rz3SessionDB.export_session_lineage..s;PPS!4!4!:;;PPPPPPr/segmentscg|] }|d Sr[r;rs r'r^z4SessionDB.export_session_lineage..s&E&E&ESs4y&E&E&Er/lineage_session_idsrcFg|]}|dpgD]}|S)rre)rUrrs r'r^z4SessionDB.export_session_lineage..s7[[ @S@S@YWY[[C[[[/r)rrrrr)rhr lineage_idsrrVsegmentrrAs r'export_session_lineagez SessionDB.export_session_lineages22:>>  4 ) )C))#..G )((( 4HRL!!PPxPPPPP#Z&E&EH&E&E&E "# ._[[8[[[Z r/c||d}g}|D]8}||d}|i|d|i9|S)z Export all sessions (with messages) as a list of dicts. Suitable for writing to a JSONL file for backup/analysis. i)rrr\r)rrSr)rhrrtresultsrrs r' export_allzSessionDB.export_allsq ''vV'DD > >G((77H NN!>!>??SH Ifd++ C E!A!A!ABBBL%&& ?===>> > L:e$$ $:& L L LAAABB K Ls,0AAA+B??C(C##C(cZ|dS t|S#ttf$rYdSwxYwr)rNrrr-s r'_float_or_nonezSessionDB._float_or_nonesD =4 << :&   44 s **c|dS t|S#ttf$r}t|d|d}~wwxYw)Nz must be an integerrrr)r)rrs r'_import_int_or_nonezSessionDB._import_int_or_none s_ =4 Eu:: :& E E E:::;; D Es>9>r`c\||S t|S#ttf$r|cYSwxYwrr)r)r`s r'_int_or_defaultzSessionDB._int_or_default sF =N u:: :&   NNN s ++ct|ts|S tj|S#tjt f$r|cYSwxYwr)r+r,rr r rr-s r'_reasoning_json_valuezSessionDB._reasoning_json_value sZ%%% L :e$$ $$i0   LLL s-AAindexc||d}|r||d<|S)N)rr'rr;)rrr'rs r' _import_errorzSessionDB._import_error! s&).??  ,!+D  r/rtc " t|tstdt|jkrtdjdgg}t }d}d}d}d}t |D]\}} t| ts+| |ddFt| d pd } | s+| |dd | |vr+| || d | d pg} t| ts,| || d 0t| j kr,| || dttd| Dr,| || d ttj| ddd} nB#t$tf$r.| || dY0wxYw| jkr,| || dk|| z }|jkr,| || d t| } | | d <| dd| d<| dd| d<|D].}| ||| |</g}t | D]\}}t|}| d}t|tr|std|d|D]5}|dkr | ||||<6| dd|d<||nO#t$rB}| || t|Yd}~kd}~wwxYw|t|z }|jkr,| || d|| || |d |rdddd|d!Sfd"}|S)#aImport sessions exported by :meth:`export_session` or ``export_all``. Existing session IDs are skipped. Imported child sessions keep their parent only when that parent already exists or is included in the same import payload; otherwise the child is detached so partial imports don't fail foreign-key validation. Gateway routing, handoff, rewind, and other live runtime state are intentionally reset: this restores conversation history, not ownership of a live channel or process. zsessions must be a listzsessions must contain at most z entriesr)rrrrrr3rr2rFrGr6rCrDrEr~) rrrrrrrrr3rzsession must be an objectr\zsession id is requiredzduplicate session idrzmessages must be a listz-messages exceeds the per-session import limitc3BK|]}t|t VdSr)r+r)rUrs r'rz,SessionDB.import_sessions..s s/AAz#t,,,AAAAAAr/z"messages must contain only objectsF)rX:) ensure_ascii separatorsrz!session must be JSON serializablez%session exceeds the import size limitz#import exceeds the total size limitr8rrz messages[z!].role must be a non-empty stringrNz'messages exceeds the total import limit)rrr)r importedskippeddetachederrorsc g}g}g}d}D]}|d}|d}t|dpd}d|f} | r|||d} | tj} |drd nd} d id|d t|d pd d |d d|dd|dd|dd| d|dd|dd|dd|dd|dd|dd|dd|dd|dd|d|d|d|d|d|d|d |d!|d"|d#|d$| d% g} |D]V} t| }d&D]-} ||||<.| |W || \}}d'|||ft|d(pd}|r|||f||t|d)td*td+tffd, }|D]p\}}d|f}|r%|||sd-||fU |d|d z }qd.t|t||||gd/S)0Nrrrr\rz+SELECT 1 FROM sessions WHERE id = ? LIMIT 1 started_atrratINSERT INTO sessions ( id, source, user_id, model, model_config, system_prompt, parent_session_id, started_at, ended_at, end_reason, message_count, tool_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, cwd, git_branch, git_repo_root, billing_provider, billing_base_url, billing_mode, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, pricing_version, title, api_call_count, archived ) VALUES ( :id, :source, :user_id, :model, :model_config, :system_prompt, NULL, :started_at, :ended_at, :end_reason, 0, 0, :input_tokens, :output_tokens, :cache_read_tokens, :cache_write_tokens, :reasoning_tokens, :cwd, :git_branch, :git_repo_root, :billing_provider, :billing_base_url, :billing_mode, :estimated_cost_usd, :actual_cost_usd, :cost_status, :cost_source, :pricing_version, :title, :api_call_count, :archived )rimportrrr8rrrr<r=r>r?r@r3rr2rFrGr6rArBrCrDrEr~rH) rFrGr6rArBrCrDrEr~rHr)rrrr?rrrrc|h}|}|r_||vrdS|||vr |}*d|f}|dS|d}|_dS)NTz;SELECT parent_session_id FROM sessions WHERE id = ? LIMIT 1Fr)rrer)rrrrr0rhparent_by_childs r'_would_create_cyclezCSessionDB.import_sessions.._do.._would_create_cycle?!s"|# 7$#tHHW%%%/11"1'": ,,U hjj{$u!"56G 7ur/z6UPDATE sessions SET parent_session_id = ? WHERE id = ?T)r rrr imported_ids skipped_idsr)r,r4r5rerrrrrrrr9rrrd)rhrrparent_updatesrrrrrrrrsanitized_messagesrcleanrrArBrr parent_existsrrrhs` @r'rz&SessionDB.import_sessions.._do s3&(L%'K46NH"i 0i 09o + !4"55;;== AM(**&&z222!001F1FGG %!%J # 3 3:11 *'j' #cggh&7&7&C8"D"D'"3779#5#5' !1!1 ' '(?(? ' ()A)A '%j'#D$7$7 8K8K$L$L'%cggl&;&;''(<(V>V)W)W',T-A-AGG$788..'-d.B.BGG$899//'$+D,@,@GG$677--%'*swwu~~+',%cggl&;&;-'.()A)A/'0-0GG4F,G,G,/GG4F,G,G(+(?(?.2.A.AGG$899//,0+>+>GG$566,,(+ww}'='='*ww}'='=+.773D+E+E!$!1!1*.*>*>swwGW?X?X*Y*Y$,M'''->>>@<>"#55C IIE PP &*%?%? #%O%Oc &--e4444373L3L&440 0  ]#%5zB  (; < < BCCIIKK C")):y*ABBB##J////">22O          &*8 " "% I $ AL!!(**! ")<)rrs r'rz%SessionDB.clear_messages.._doq!sJ LL;j]    LLY      r/Nrrs ` r'clear_messageszSessionDB.clear_messageso!s8      C     r/c"|dSdD]2}|||z } |d##t$rY/wxYw |d|dD])} |d#t$rY&wxYwdS#t$rYdSwxYw)aHRemove on-disk transcript files for a session. Cleans up ``{session_id}.json``, ``{session_id}.jsonl``, and any ``request_dump_{session_id}_*.json`` files left by the gateway. Silently skips files that don't exist and swallows OSError so a filesystem hiccup never blocks a DB operation. N)z.jsonz.jsonlT) missing_ok request_dump_z_*.json)unlinkr#glob)rdrrrs r'rkzSessionDB._remove_session_files{!s   F)  F*6f666A D))))     !&&'Jz'J'J'JKK  HHH----D       DD sA* 77BA.-B. A;8B:A;;B B Bcgfd}||}|r1D]}|||||t|S)u>Delete a session and all its messages. Delegate subagent children (``model_config._delegate_from``) are cascade-deleted with the parent so they never resurface in session pickers as orphaned rows. Branch / compression children are orphaned (``parent_session_id → NULL``) so they remain accessible independently. When *sessions_dir* is provided, also removes on-disk transcript files (``.json`` / ``.jsonl`` / ``request_dump_*``) for every deleted session. Returns True if the session was found and deleted. cH|df}|ddkrdSt|g|df|df|dfdS)Nz*SELECT COUNT(*) FROM sessions WHERE id = ?rFzHUPDATE sessions SET parent_session_id = NULL WHERE parent_session_id = ?r=!DELETE FROM sessions WHERE id = ?T)rerrrs)rhrlremoved_delegate_idsrs r'rz%SessionDB.delete_session.._do!s\\._do!s1\\  F?Q& &r/r)rhrrdrrs ` r'delete_session_if_emptyz!SessionDB.delete_session_if_empty!s\& ' ' ' ' '$%%c**  A  & &|Z @ @ @G}}r/rc|sdStd|DsdSggfd}||}D]}|||D]}||||S)uDelete every session in *session_ids* in a single transaction. Backs the dashboard's bulk-select-then-delete flow on the sessions page (``POST /api/sessions/bulk-delete``). Mirrors the single-session :meth:`delete_session` contract per row: * Unknown IDs are silently skipped (no 404) — selection state in the UI can race against another tab's delete, and we'd rather succeed-on-the-rest than fail-the-whole-batch. * Delegate subagent children (``model_config._delegate_from``) are cascade-deleted with their parent; branch children are orphaned (``parent_session_id → NULL``) so they stay accessible. * Messages and the session row both go in one ``_execute_write`` call so a partial failure can't leave the DB in a "messages gone but session row still there" state. * On-disk transcript / ``request_dump_*`` files are cleaned up outside the DB transaction when *sessions_dir* is provided, matching :meth:`prune_sessions` and :meth:`delete_empty_sessions`. Returns the count of sessions that actually existed and were deleted (may be less than ``len(session_ids)`` if some IDs were already gone). rc@h|]}t|t||Sr;)r+r,rTs r'rWz,SessionDB.delete_sessions.. "s-VVV3C9M9MVRUV3VVVr/c:ddtz}|d|d}d|D}|sdSddt|z}t |||d|d||d|d||d |d||t|S) NrXrYz%SELECT id FROM sessions WHERE id IN (rFcg|] }|d Sr[r;rzs r'r^z:SessionDB.delete_sessions.._do.."s???cD ???r/rrprorq)rcrdrerfrrs)rhrrlrexisting_placeholdersrrl unique_idss r'rz&SessionDB.delete_sessions.._do"sZ88C#j//$9::L\\G GGGF@?V__->->???H q$'HHS3x==-@$A$A ! ' '(A$(Q(Q R R R LLH/DHHH    LLU=RUUU    LLM5JMMM      x ( ( (x== r/)rbrrk) rhrrdrrrVrrlrs @@@r'delete_sessionszSessionDB.delete_sessions!s: 1VV+VVVWW  1!# *,! !! !! !! !! !! !! !F##C((' : :C  & &|S 9 9 9 9 : :C  & &|S 9 9 9 9 r/c|j5|jd}|dcdddS#1swxYwYdS)uReturn the count of empty, non-active, non-archived sessions. "Empty" = ``message_count = 0`` AND the session has ended (``ended_at IS NOT NULL``) AND is not archived. The ``ended_at`` guard matches the safety contract used by :meth:`prune_sessions`: only ended sessions are candidates for bulk deletion, so a freshly spawned session whose first message hasn't landed yet — or one held open by the live agent — is never sniped out from under the runtime. Backs the ``GET /api/sessions/empty/count`` endpoint that lets the web dashboard hide its "Delete empty" button when there's nothing to clean up, and pre-populate the confirm dialog with the actual count. z_SELECT COUNT(*) FROM sessions WHERE message_count = 0 AND ended_at IS NOT NULL AND archived = 0rNr)rhrls r'count_empty_sessionszSessionDB.count_empty_sessions<"s Z ( (Z''#F ??$$Q' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s4A  A A cvgfd}||}D]}||||S)uJDelete every empty, ended, non-archived session. Mirrors :meth:`prune_sessions`' transactional shape: * Selects candidate IDs first (``message_count = 0`` AND ``ended_at IS NOT NULL`` AND ``archived = 0``) so we never touch a live session or one the user deliberately archived. * Orphans any child whose parent is in the kill list — children of an empty parent are kept and re-parented to ``NULL`` rather than cascade-deleted, matching ``delete_session`` / ``prune_sessions`` semantics so branch/subagent transcripts survive an inadvertent parent cleanup. * Deletes the rows in a single ``_execute_write`` callback so the operation is atomic — a partial failure (e.g. SIGKILL mid-loop) doesn't leave the DB in a "messages-deleted but session-row-still-there" half-state. * Cleans up on-disk transcript files (``.json`` / ``.jsonl`` / ``request_dump_*``) outside the DB transaction when ``sessions_dir`` is provided. Empty sessions don't typically have transcript files, but the gateway can leave a stub ``request_dump_*`` if it crashed before the first reply — so we still sweep, matching ``prune_sessions``. Returns the number of sessions deleted. c|d}d|D}|sdSddt|z}|d|dt ||D]E}|d|f|d |f|Ft|S) NzYSELECT id FROM sessions WHERE message_count = 0 AND ended_at IS NOT NULL AND archived = 0ch|] }|d Sr[r;rzs r'rWz?SessionDB.delete_empty_sessions.._do..{"BBB3t9BBBr/rrXrYrprFr=rrerfrcrdrbr)rhrlrrrVrls r'rz,SessionDB.delete_empty_sessions.._dot"s \\#F CB0A0ABBBK q88C#k*:*:$:;;L LL?/;???[!!    # ( (  ?# @3&III""3''''{## #r/)rrk)rhrdrrrVrls @r'delete_empty_sessionszSessionDB.delete_empty_sessionsU"se:"$  $ $ $ $ $>##C(( : :C  & &|S 9 9 9 9 r/)started_before started_afterr title_likerr= min_messages max_messagesr model_liker7rrr branch_like min_tokens max_tokensmin_costmax_costmin_tool_callsmax_tool_callsr r rrrrrrrrrrrcLdg}g}|*|d|||*|d|||r*|d|||r@|d|d|d|r*|d|||r= ?rz#LOWER(COALESCE(s.title, '')) LIKE ?rzs.end_reason = ?rzs.message_count <= ?z#LOWER(COALESCE(s.model, '')) LIKE ?z+LOWER(COALESCE(s.billing_provider, '')) = ?z s.user_id = ?z s.chat_id = ?zs.chat_type = ?z(LOWER(COALESCE(s.git_branch, '')) LIKE ?zA(COALESCE(s.input_tokens, 0) + COALESCE(s.output_tokens, 0)) >= ?zA(COALESCE(s.input_tokens, 0) + COALESCE(s.output_tokens, 0)) <= ?z9COALESCE(s.actual_cost_usd, s.estimated_cost_usd, 0) >= ?z9COALESCE(s.actual_cost_usd, s.estimated_cost_usd, 0) <= ?z#COALESCE(s.tool_call_count, 0) >= ?z#COALESCE(s.tool_call_count, 0) <= ?TrFrr)rrrBrrc)r r rrrr=rrrrr7rrrrrrrrrrclausesrrrs r'_prune_filter_wherezSessionDB._prune_filter_where"sXV,,  % NN- . . . MM. ) ) )  $ NN. / / / MM- ( ( (  " NN> * * * MM& ! ! !  5 NN@ A A A MM3j..00333 4 4 4  & NN- . . . MM* % % %  )$6z$B$B !FM NN6 " " " MM- ( ( (  # NN1 2 2 2 MM, ' ' '  # NN1 2 2 2 MM, ' ' '  5 NN@ A A A MM3j..00333 4 4 4  , NNH I I I MM(..** + + +  # NN? + + + MM' " " "  # NN? + + + MM' " " "  % NN, - - - MM) $ $ $  6 NNE F F F MM4k//11444 5 5 5  ! NNS    MM* % % %  ! NNS    MM* % % %   NNK    MM( # # #   NNK    MM( # # #  % NN@ A A A MM. ) ) )  % NN@ A A A MM. ) ) ) t   NN+ , , , ,    NN+ , , ,||G$$f,,r/older_than_daysc H|d|tj|dzz |d<|jdd|i|\}}|j5|jd|d|}d|DcdddS#1swxYwYdS) aReturn the sessions a matching :meth:`prune_sessions` / :meth:`archive_sessions` call would touch, without modifying anything. Backs ``--dry-run`` and pre-confirmation counts. Accepts the same keyword filters as :meth:`_prune_filter_where` (unknown names raise ``TypeError`` there). Rows are ordered oldest-first and carry ``id, source, title, model, started_at, ended_at, message_count, archived``. r NrfrzSELECT s.id, s.source, s.title, s.model, s.started_at, s.ended_at, s.message_count, s.archived FROM sessions s WHERE z. ORDER BY s.started_at ASCc,g|]}t|Sr;rrzs r'r^z3SessionDB.list_prune_candidates..*#rr/r;)r4rrrmrbrerf)rhrrfiltersrrrls r'list_prune_candidateszSessionDB.list_prune_candidates#s ;;' ( ( 0_5P(, 7N(OG$ %00JJJ'JJ v Z < <Z''1+0111 F<;):):;;; < < < < < < < < < < < < < < < < < E   7 7C  % %c$i 6 6 6 64yyr/Zc  |d|tj|dzz |d<|jdd|i|\ g fd}||}D]}||||S)u,Delete sessions matching the filters. Returns count deleted. Default behavior (no keyword filters) is unchanged: delete ended sessions older than ``older_than_days`` days, optionally restricted to ``source``. Additional keyword filters AND together — the full set is defined by :meth:`_prune_filter_where`: * ``started_before`` / ``started_after`` — epoch bounds on ``started_at``. ``started_before`` overrides ``older_than_days``; pass ``older_than_days=None`` for no upper age bound (e.g. when only pruning a recent window via ``started_after``). * ``title_like`` / ``model_like`` / ``branch_like`` — case-insensitive substring matches. * ``end_reason`` / ``provider`` / ``user_id`` / ``chat_id`` / ``chat_type`` — exact matches (provider case-insensitive, against ``billing_provider``). * ``cwd_prefix`` — session cwd equals or is under this path. * ``min_messages`` / ``max_messages`` — bounds on message_count. * ``min_tokens`` / ``max_tokens`` — bounds on input+output tokens. * ``min_cost`` / ``max_cost`` — bounds on USD cost (actual, falling back to estimated). * ``min_tool_calls`` / ``max_tool_calls`` — bounds on tool_call_count. * ``archived`` — tri-state: None = both (default), True = only archived, False = only unarchived. Only prunes ended sessions (not active ones). Child sessions outside the prune window are orphaned (parent_session_id set to NULL) rather than cascade-deleted. When *sessions_dir* is provided, also removes on-disk transcript files (``.json`` / ``.jsonl`` / ``request_dump_*``) for every pruned session, outside the DB transaction. r Nrfrc|d}d|D}|sdSddt|z}|d|dt ||D]E}|d|f|d |f|Ft|S) Nz"SELECT s.id FROM sessions s WHERE ch|] }|d Sr[r;rzs r'rWz8SessionDB.prune_sessions.._do..v#r r/rrXrYrprFr=rr )rhrlrrrVrlr where_paramss r'rz%SessionDB.prune_sessions.._dor#s \\._do#s0 LLHe      r/)rer)rhrr)rlrs `` r'r|zSessionDB.set_meta#sp   NNHe     F       C     r/c6d}||dS)uFCreate Telegram DM topic-mode tables on explicit /topic opt-in. This migration is deliberately not part of automatic SessionDB startup reconciliation. Operators must be able to upgrade Hermes, keep the old Telegram bot behavior running, and only mutate topic-mode state when the user executes /topic to opt into the feature. Schema versions: v1 — initial shape (no ON DELETE CASCADE on session_id FK) v2 — session_id FK gets ON DELETE CASCADE so session pruning automatically clears bindings. c|d|dd}|r._do..#sQ$$Fj(Hc!fly-H$$$$$$r/a CREATE TABLE telegram_dm_topic_bindings_new ( chat_id TEXT NOT NULL, thread_id TEXT NOT NULL, user_id TEXT NOT NULL, session_key TEXT NOT NULL, session_id TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE, managed_mode TEXT NOT NULL DEFAULT 'auto', linked_at REAL NOT NULL, updated_at REAL NOT NULL, PRIMARY KEY (chat_id, thread_id) ); INSERT INTO telegram_dm_topic_bindings_new SELECT chat_id, thread_id, user_id, session_key, session_id, managed_mode, linked_at, updated_at FROM telegram_dm_topic_bindings; DROP TABLE telegram_dm_topic_bindings; ALTER TABLE telegram_dm_topic_bindings_new RENAME TO telegram_dm_topic_bindings; CREATE UNIQUE INDEX idx_telegram_dm_topic_bindings_session ON telegram_dm_topic_bindings(session_id); CREATE INDEX idx_telegram_dm_topic_bindings_user ON telegram_dm_topic_bindings(user_id, chat_id); r)r02)rrerr,isdigitrrfr)rhrrfk_rows needs_rebuilds r'rz5SessionDB.apply_telegram_topic_migration.._do#s+   ! ! ! Lll<5hjj 29]S__=T=T=V=V]c'!*ooo\]O"",,K(**!$$$&$$$!! !&&6 LLH9     r/Nrrs r'apply_telegram_topic_migrationz(SessionDB.apply_telegram_topic_migration#s1T T T j C     r/)has_topics_enabledallows_users_to_create_topicsr8r9c|tjdttdttfdfd}||dS)zEnable Telegram DM topic mode for one private chat/user. This method intentionally owns the explicit topic migration. Ordinary SessionDB startup must not create these side tables. r)rc|dS|rdndSrr;r-s r'_to_intz5SessionDB.enable_telegram_topic_mode.._to_int*$s}t$111 $r/c |dttfdS)Na INSERT INTO telegram_dm_topic_mode ( chat_id, user_id, enabled, activated_at, updated_at, has_topics_enabled, allows_users_to_create_topics, capability_checked_at ) VALUES (?, ?, 1, ?, ?, ?, ?, ?) ON CONFLICT(chat_id) DO UPDATE SET user_id = excluded.user_id, enabled = 1, updated_at = excluded.updated_at, has_topics_enabled = excluded.has_topics_enabled, allows_users_to_create_topics = excluded.allows_users_to_create_topics, capability_checked_at = excluded.capability_checked_at )rer,)rhr<r9rr8rrs r'rz1SessionDB.enable_telegram_topic_mode.._do/$sf LL LLLLG.//G9::     r/N)r7rr rrr)rhrrr8r9rr<rs ```` @@r'enable_telegram_topic_modez$SessionDB.enable_telegram_topic_mode$s ++---ikk %8D> %hsm % % % %           4 C     r/)clear_bindingsr?c@fd}||dS)aDisable Telegram DM topic mode for one private chat. When ``clear_bindings`` is True (default) the (chat_id, thread_id) bindings for this chat are also cleared so re-enabling later starts from a clean slate. Set to False if the operator wants to preserve bindings for a later re-enable. Never creates the topic-mode tables from scratch; if they don't exist there is nothing to disable and the call is a no-op. c |dtjtfr&|dtfdSdS#tj$rYdSwxYw)NOUPDATE telegram_dm_topic_mode SET enabled = 0, updated_at = ? WHERE chat_id = ?z8DELETE FROM telegram_dm_topic_bindings WHERE chat_id = ?)rerr,rr)rhrr?s r'rz2SessionDB.disable_telegram_topic_mode.._do[$s  (Y[[#g,,/ "LLRW +    sAA##A65A6Nr)rhrr?rs `` r'disable_telegram_topic_modez%SessionDB.disable_telegram_topic_modeK$s>        C     r/c|j5 |jdt|t|f}n!#t j$rYddddSwxYw dddn #1swxYwY|dSt|t jr|dn|d}t|S)zDReturn whether Telegram DM topic mode is enabled for this chat/user.z SELECT enabled FROM telegram_dm_topic_mode WHERE chat_id = ? AND user_id = ? NFenabledr) rmrbrer,rrrr+rcr)rhrrr0rEs r'is_telegram_topic_mode_enabledz(SessionDB.is_telegram_topic_mode_enabledl$s0 Z   j((\\3w<<0  (** +                            ;5$.sGK$@$@L#i..c!fG}}5BA ABA2#B1A22BB Bc@|j5 |jdt|t|f}n!#t j$rYddddSwxYw dddn #1swxYwY|rt|ndS)z?Return the session binding for a Telegram DM topic, if present.z SELECT * FROM telegram_dm_topic_bindings WHERE chat_id = ? AND thread_id = ? Nrmrbrer,rrrr)rhrrr0s r'get_telegram_topic_bindingz$SessionDB.get_telegram_topic_binding~$sZ   j((\\3y>>2  (** +                            )tCyyyT)rGc|j5 |jdt|f}n##t j$rgcYcdddSwxYw dddn #1swxYwYd|DS)zAll Telegram DM topic bindings for one chat, newest first. Read-only; returns [] if the bindings table doesn't exist yet (does not trigger the topic-mode migration). zSSELECT * FROM telegram_dm_topic_bindings WHERE chat_id = ? ORDER BY updated_at DESCNc,g|]}t|Sr;rrzs r'r^zCSessionDB.list_telegram_topic_bindings_for_chat..$s***cS ***r/)rmrbrer,rfrr)rhrrs r'%list_telegram_topic_bindings_for_chatz/SessionDB.list_telegram_topic_bindings_for_chat$sZ   z))A\\O(**  +                             +*T****s4A6;AA6A&A6%A&&A66A:=A:c$|j5 |jdt|f}n!#t j$rYddddSwxYw dddn #1swxYwY|rt|ndS)aReturn the Telegram DM topic binding for a given session_id, if present. Uses the UNIQUE INDEX on telegram_dm_topic_bindings(session_id) for an efficient reverse lookup. Returns None when the session has no binding or the table does not exist yet. z{ SELECT * FROM telegram_dm_topic_bindings WHERE session_id = ? NrIrhrr0s r'%get_telegram_topic_binding_by_sessionz/SessionDB.get_telegram_topic_binding_by_session$sZ   j((__&  (** +                            )tCyyyT)4A4;AA4A$A4#A$$A44A8;A8cttddifd}||dS)uRemove the binding row for a single (chat, thread) pair. Called when the Telegram Bot API confirms a topic was deleted externally (``Thread not found`` after the same-thread retry already failed). Without this prune, the stale row keeps living in ``telegram_dm_topic_bindings`` and the recovery logic in ``gateway.run._recover_telegram_topic_thread_id`` cheerfully redirects future inbound messages to the deleted topic, causing tool progress, approvals, and replies to land in the wrong place. Issue #31501. When this prune removes the chat's *last* remaining binding, the chat's row in ``telegram_dm_topic_mode`` is also flipped to ``enabled = 0`` in the same transaction. Otherwise the chat would be left in topic mode with zero lanes — and ``gateway.run._recover_telegram_topic_thread_id`` keeps treating the chat as topic-enabled, lobby messages keep hunting for a binding that no longer exists, and a user who disabled topics in the Telegram client (rather than via ``/topic off``) stays stuck until the next send happens to fail. Clearing the flag makes recovery fully stand down once the dead topics are gone. Returns the number of binding rows deleted (0 when the binding was already absent or the topic-mode tables haven't been migrated yet — both are silent no-ops; we never raise from a cleanup hot path). rrcx |df}|jpdd<n#tj$r dd<YdSwxYwdsdS |df}|+|dt jfdSdS#tj$rYdSwxYw)Nz DELETE FROM telegram_dm_topic_bindings WHERE chat_id = ? AND thread_id = ? rrz SELECT 1 FROM telegram_dm_topic_bindings WHERE chat_id = ? LIMIT 1 rB)rer rrrr)rhrl remainingrrrs r'rz4SessionDB.delete_telegram_topic_binding.._do$s  i( $*?#7a  +   #$  7#   LLJ  (** $LLLg.%$ +    s!$(AAAB&&B98B9)r,r)rhrrrrs `` @r'delete_telegram_topic_bindingz'SessionDB.delete_telegram_topic_binding$slBg,, NN A,# # # # # # # J C   wr/auto) managed_moderWc8|tjtttttfd}||dS)a Bind one Telegram DM topic thread to one Hermes session. A Hermes session may only be linked to one Telegram topic in MVP. Rebinding the same topic to the same session is idempotent; trying to link the same session to a different topic raises ValueError. c |df}|t|tjr|dn|d}t|tjr|dn|d}t |kst | krt d|d fdS)Nz SELECT chat_id, thread_id FROM telegram_dm_topic_bindings WHERE session_id = ? rrrrz3session is already linked to another Telegram topicaI INSERT INTO telegram_dm_topic_bindings ( chat_id, thread_id, user_id, session_key, session_id, managed_mode, linked_at, updated_at ) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(chat_id, thread_id) DO UPDATE SET user_id = excluded.user_id, session_key = excluded.session_key, session_id = excluded.session_id, managed_mode = excluded.managed_mode, updated_at = excluded.updated_at )rerr+rrcr,r) rhexisting_session linked_chat linked_threadrrWrrrrrs r'rz*SessionDB.bind_telegram_topic.._do$%s#||    hjj  +=GHXZaZe=f=f.y99l|}~l AKL\^e^iAjAj!D 0 = =qABCqD {##w..#m2D2D 2Q2Q$%Z[[[ LL        r/N)r7rr,r) rhrrrrrrWrrs `````` @r'bind_telegram_topiczSessionDB.bind_telegram_topic %s ++---ikkg,, NN g,,+&& __ % % % % % % % % % % % L C     r/c|j5 |jdt|f}n!#t j$rYddddSwxYw dddn #1swxYwY|duS)aMReturn True if a Hermes session is already bound to any Telegram DM topic. Read-only: does NOT trigger the telegram-topic migration. If the topic-mode tables have not been created yet (i.e. nobody has run ``/topic`` in this profile), the session is by definition unbound and we return False. z SELECT 1 FROM telegram_dm_topic_bindings WHERE session_id = ? LIMIT 1 NF)rmrbrer,rrrrOs r'#is_telegram_session_linked_to_topicz-SessionDB.is_telegram_session_linked_to_topicL%sZ   j(( __& (**+                           $rQrq)rc |j5 |jdt|t |f}n^#t j$rL|jdt|t |f}YnwxYwdddn #1swxYwYg}|D]}t|}t| ddpd }|r"|ddt|dkrdndznd|d<| ||S) uGList previous Telegram sessions for this user that are not bound to a topic. Read-only: does NOT trigger the telegram-topic migration. If the topic-mode tables are absent, fall back to a simpler query that just returns this user's Telegram sessions — there can't be any bindings yet. aE SELECT s.*, COALESCE( (SELECT SUBSTR(REPLACE(REPLACE(m.content, X'0A', ' '), X'0D', ' '), 1, 63) FROM messages m WHERE m.session_id = s.id AND m.role = 'user' AND m.content IS NOT NULL ORDER BY m.timestamp, m.id LIMIT 1), '' ) AS _preview_raw, COALESCE( (SELECT MAX(m2.timestamp) FROM messages m2 WHERE m2.session_id = s.id), s.started_at ) AS last_active FROM sessions s WHERE s.source = 'telegram' AND s.user_id = ? AND NOT EXISTS ( SELECT 1 FROM telegram_dm_topic_bindings b WHERE b.session_id = s.id ) ORDER BY last_active DESC, s.started_at DESC LIMIT ? a SELECT s.*, COALESCE( (SELECT SUBSTR(REPLACE(REPLACE(m.content, X'0A', ' '), X'0D', ' '), 1, 63) FROM messages m WHERE m.session_id = s.id AND m.role = 'user' AND m.content IS NOT NULL ORDER BY m.timestamp, m.id LIMIT 1), '' ) AS _preview_raw, COALESCE( (SELECT MAX(m2.timestamp) FROM messages m2 WHERE m2.session_id = s.id), s.started_at ) AS last_active FROM sessions s WHERE s.source = 'telegram' AND s.user_id = ? ORDER BY last_active DESC, s.started_at DESC LIMIT ? Nrrrrr) rmrbrer,rrfrrrrr5rdr) rhrrrrrtr0rrs r'(list_unlinked_telegram_sessions_for_userz2SessionDB.list_unlinked_telegram_sessions_for_userb%sZ4 4 3 z)).\\3u::.12(**34+   z))&\\3u::.)*(**+ 94 4 4 4 4 4 4 4 4 4 4 4 4 4 4 l*, % %C3iiGgkk."55;<<BBDDCPS![SbSc#hhmmUU!L!LY[GI  OOG $ $ $ $s6B>A AB>AB/,B>.B//B>>CCr rcp |jd|ddS#tj$rYdSwxYw)z6True if an FTS5 virtual table is queryable in this DB.rrTF)rbrerr)rhrs r'_fts_table_existszSessionDB._fts_table_exists%sU  J  >>>> ? ? ?4$    55  s "55c Hd}|j5|jD]w}||s |jd|d|d|dz }@#t j$r&}td||Yd}~pd}~wwxYw dddn #1swxYwY|S)uMerge fragmented FTS5 b-tree segments into one per index. FTS5 indexes grow as a series of incremental segments — one per ``INSERT`` batch driven by the message triggers. Over tens of thousands of messages these segments accumulate, which both bloats the ``*_data`` shadow tables and slows ``MATCH`` queries that must scan every segment. The special ``'optimize'`` command rewrites each index as a single merged segment. This is purely a maintenance operation — it changes neither search results nor ``snippet()`` output, only on-disk layout and query speed. It is complementary to VACUUM: ``optimize`` compacts the FTS index internally, then VACUUM returns the freed pages to the OS. Skips any FTS table that does not exist (e.g. the trigram index when disabled via ``HERMES_DISABLE_FTS_TRIGRAM`` or not yet created), so it is safe to call unconditionally. Returns the number of FTS indexes that were optimized. rr)rIz) VALUES('optimize')rzFTS optimize failed for %s: %sN) rm _FTS_TABLESrcrbrerrrr)rh optimizedrrs r'rzSessionDB.optimize_fts%s:* Z  '  --c22 J&&FsFFSFFFNII/NN8#s                s: B&ABB!B=BBBBBc d}|j5|jD]}||s |jd|d|d|j|dz }Y#t j$r?}|jt d||Yd}~d}~wwxYw dddn #1swxYwY|S)aNRebuild FTS5 indexes from the canonical ``messages`` table. Uses the FTS5 ``'rebuild'`` command, which rewrites the internal b-tree segments from the content rows. This is the documented recovery for a corrupt FTS index that rejects message writes while reads still succeed (issue #50502). Unlike ``optimize_fts`` (which merges existing segments), ``rebuild`` discards and recreates the index data entirely. Safe to call when FTS tables don't exist (skips them). Returns the number of FTS indexes that were rebuilt. rr)rIr*rzFTS rebuild failed for %s: %sN) rmrercrbrer2rrrrr)rhrrrs r'r+zSessionDB.rebuild_fts%s_ Z  '  --c22 J&&EsEESEEEJ%%'''qLGG/J'')))NN7c                s: C ?A+*C +B9:5B4/C 4B99C  C C cd} |}n2#t$r%}td|Yd}~nd}~wwxYw|j5 |jdn2#t$r%}td|Yd}~nd}~wwxYw|jddddn #1swxYwY|S)uRun VACUUM to reclaim disk space after large deletes. SQLite does not shrink the database file when rows are deleted — freed pages just get reused on the next insert. After a prune that removed hundreds of sessions, the file stays bloated unless we explicitly VACUUM. VACUUM rewrites the entire DB, so it's expensive (seconds per 100MB) and cannot run inside a transaction. It also acquires an exclusive lock, so callers must ensure no other writers are active. Safe to call at startup before the gateway/CLI starts serving traffic. FTS5 segments are merged first via :meth:`optimize_fts` so the subsequent VACUUM reclaims the pages freed by the merge. This is a layout-only optimization — search results are unchanged. Returns the number of FTS indexes that were optimized (0 if the merge step failed or no FTS tables exist). rz%FTS optimize before VACUUM failed: %sNrz2WAL checkpoint (TRUNCATE) before VACUUM failed: %sr0)rrrrrmrbrer)rhrfrs r'r9zSessionDB.vacuum&sN.  I))++II I I I NNBC H H H H H H H H IZ ) ) X ""#DEEEE X X X QSVWWWWWWWW X J  x ( ( (  ) ) ) ) ) ) ) ) ) ) ) ) ) ) )sP AAACA/.C/ B9BCBCC C retention_daysmin_interval_hourscdddd} |d}tj}|r; t|}||z |dzkrd|d<|Sn#ttf$rYnwxYw|||} | |d <|rS| dkrM |d|d <n2#t$r%} t d | Yd } ~ nd } ~ wwxYw| dt|| dkr't d | ||d rdndnD#t$r7} t d| t| |d<Yd } ~ nd } ~ wwxYw|S)uIdempotent auto-maintenance: prune old sessions + optional VACUUM. Records the last run timestamp in state_meta so subsequent calls within ``min_interval_hours`` no-op. Designed to be called once at startup from long-lived entrypoints (CLI, gateway, cron scheduler). When *sessions_dir* is provided, on-disk transcript files (``.json`` / ``.jsonl`` / ``request_dump_*``) for pruned sessions are removed as part of the same sweep (issue #3015). Never raises. On any failure, logs a warning and returns a dict with ``"error"`` set. Returns a dict with keys: - ``"skipped"`` (bool) — true if within min_interval_hours of last run - ``"pruned"`` (int) — number of sessions deleted - ``"vacuumed"`` (bool) — true if VACUUM ran - ``"error"`` (str, optional) — present only on failure Fr)rprunedrMlast_auto_pruneiTr)rrdrmrMzstate.db VACUUM failed: %sNzDstate.db auto-maintenance: pruned %d session(s) older than %d days%sz + VACUUMrz$state.db auto-maintenance failed: %sr') rrrNrrr)r9rrrr|r,r) rhrjrkr9rdrlast_rawrlast_tsrmrs r'maybe_auto_prune_and_vacuumz%SessionDB.maybe_auto_prune_and_vacuum.&s4.3aU!S!S* '}}%677H)++C #HooGW}'9D'@@@,0y)% A":.D(( .))F &F8  F&1**FKKMMM)-F:&& FFFNN#?EEEEEEEEF MM+SXX 6 6 6zz Z"#)*#5=KK2   ' ' ' NNA3 G G G!#hhF7OOOOOO '  se*D/!AD/A*'D/)A**'D/B,+D/, C6CD/CAD// E09-E++E0c<fd}||S)zMark a session as pending handoff to the given platform. Returns True if the row was found and not already in flight; False if the session is already in a non-terminal handoff state. cJ|df}|jdkS)NzUPDATE sessions SET handoff_state = 'pending', handoff_platform = ?, handoff_error = NULL WHERE id = ? AND (handoff_state IS NULL OR handoff_state IN ('completed', 'failed'))rr)rhrrrs r'rz&SessionDB.request_handoff.._do&s5,,Q :&C.&s444DGG444r/)rbrerfr)rhrs r'list_pending_handoffszSessionDB.list_pending_handoffs&se  *$$*C 54S\\^^444 4   III s7: A A c8fd}||S)uCAtomically transition pending → running. Returns True if claimed.cH|df}|jdkS)NzXUPDATE sessions SET handoff_state = 'running' WHERE id = ? AND handoff_state = 'pending'rr)rhrrs r'rz$SessionDB.claim_handoff.._do&s/,,= C ._do&s- LL4      r/Nrrs ` r'complete_handoffzSessionDB.complete_handoff&s8      C     r/c@fd}||dS)z/Mark a handoff as failed and record the reason.cH|dddfdS)NzLUPDATE sessions SET handoff_state = 'failed', handoff_error = ? WHERE id = ?rXr)rhr'rs r'rz#SessionDB.fail_handoff.._do&s8 LL1ttj)     r/Nr)rhrr'rs `` r' fail_handoffzSessionDB.fail_handoff&s>       C     r/)NF)rN) NNNNNNNNNNNN)T)r)NNr)r)rrNrrrNNNNNNNNrF)rKN)F)NNNrvrFrTFFFNNF)rvr)NNNNNNNNNNNNFNNNNN)FNr)r )r rr^)FFF)rvF)NNNrvrNF)rvT)Nrvr)NNrFFFNr)r$NN)r$riTN)rw __module__ __qualname____doc__rrrrrrrrrrrrrx staticmethodrrrrCursorrrrrrrrrrrr,r rrr Connectionrtrrrrrrrr rDrCr rrrrrrrr"r!r(r,r+r7rSrcrnrfrrrrrrrr rrrr{rrrrrrrNrrrr rrrrr&r)r+r/r2r5r;rTrMr`rcrmrprsr}rrrrrrrrrrrr frozensetrr__annotations__ classmethodrrrrrrr rr.r1rir9rDrGrKrOrSr]r rwr~rrrrrrrrrrrrrrrrrrrrrrQrrrrrrrrrrrrrrrrrrrrrkrrrrr rbrr r#r)rr|r7r>rCrFrJrMrPrUr]r_rarercrr+r9rqrtrzr}rrrr;r/r'rr s/ !# $ '-$!' /.nnnnnnnd (@ T   \   7+C      \  &'.&T&&&\&2  W-E  $       '*B  t      GN t    t,t,t,t,l7>d\K7>KcKKK\K!%          \ ,!%          \ Bw~38TX>"   6D g()1, -D  D D D D L 2G,A 2d 2 2 2\ 2/G,A/d////bGGGG< " " "Z"" VHT#s(^$<VVVV$&O&O&O&OZ)($((((TB$BBBBV Vc3h(@ V V V V,d,,,,\OOOO4%$%$%$%$b 3 3 3 3 3Dd--S--------dCG G3G3G3hS#X'7'=>?G3 G3 c3h G3G3G3G3R(#($sDcN7J2K(((\(T**D****Xpppt '+!!% !Q!Q!Q!Q! Q! 38n Q!  Q!Q!Q!Q!Q!Q!Q!Q!Q!Q! !Q!Q!Q!Q!fc -!-!-!-! -!  -!  -!-!-!-!-!-! -!-!-!-!^!!s!t!t!!!!(BD!!!!,/!;>! !!!!:8:!!!CH~!14! !!!!.<>AAASA$sCx.AAAA8: ! ! ! I !14 !  ! ! ! !$#' $'$'$'3-$' $' d38n  $'$'$'$'V$(!% 0"0"0"0" 0" C= 0" # 0" #0"0"0"0"d/n/ ////j"&%)!%#'#'?*?*?*?*# ?* c] ?* # ?*C=?*C=?* $sCx. !?*?*?*?*B!c!s!t!!!!$!!!!!!.=///'*/ ////dW[$!$!$!$'$!58$!PS$! $!$!$!$!L!tCH~!$!!!!2 $ }   2# #  $sCx. !# # # # JST(##0 !# !s !t ! ! ! !CC> !C ! !PT ! ! ! !N#    B# VVVV V  VVVVp34IcIhsmIIII* $ !!!!} !  !!!!&!s!3!4!!!! !s !3 !4 ! ! ! !('+ !!!! !  ! sm ! !!!!B!""# !.2+/%)%))-*.*.&*%g!g!g!g! g!  g!  g! g!g!%UOg!"%g!c]g!c]g!"#g!#3-g!#3-g! sm!g!"#g!$%g!& 'g!g!g!g!x'd d d d } d #3- d #3-d smd d d d  d d %UOd "%d c]!d "c]#d $%d &'d ( )d d d d R           $*.*.!""# !.29!9!9!9!9! } 9! #3- 9!#3-9!9!9!9! 9!9!%UO9! 9!9!9!9!v  7G SV    <%-%-%-%-%-N*c*htCH~.F****sx}8-hsm- ---\-^#$'#8;# ####J999  9  9999vOCOOOOOON#NcNdNNNN-C-HSM----0s0d0t0000d*#*(4S>2J****chsm:!(C!(C!(!(!(!(F=c=hsm====J!* ?*; < </3x}333 -c - - -[ -  d tDQTVYQYNG[    8%)!&!")-%*!&# "bbbcb b  b  bbb#'b#bbbbbb d38n !bbbbN  @@@@ @ d38n  @@@@D%%%4%T\]abegjbj]kTl%%%%^' 6c 6c 6 6 6[ 6D c c   [ " !!%!%%)#'#',0%)&*59+F(F(F(F( F(  F(  F(F(F(F(F(F(F( #F(!F(!F( !F("%SM#F($%F(&c]'F((sm)F(*#4S>2+F(, -F(F(F(F(T6: . . . .(+ .69 .IL ."4S>2 .  . . . .D_*S_*DcSVhDX_*]bcfhkck]l_*_*_*_*J" .!.!.!tCH~&.! .!  .!.!.!.!` 1 1 1 1 1 12(2(37S#X3G2( 2(2(2(2(h(((+(:=( ((((F"'# 0000} 0  0 d38n  0000l L L L L  L c3h L L L L d0E v v v v  v  v U38_- v  c3hv v v v pW>R' ' ' ' R @ @ @ @ @ @5s5tCy5555, d4S>6J QUVY[^V^Q_ dh   \ "U U 25U c3hU U U U n(#((((((6!& 4444 4 d38n  4444tL!CL!CL!L!L!\L!^(c(d(((\( C D   \ GcGcGGG[Gcd["AAAAA\A(,$(%)!%M@M@M@M@ M@  M@  M@CyM@cM@#YM@M@M@ $tCH~& 'M@M@M@M@d$(%)!%!&...Cy.c . #Y .  .... d38n ....`332$(%)!%!&iiiCyic i #Y i  iiii d38n iiii`"'-1/3+/G'G'G'G'G'  G'  S * G'"$s),G'd3i(G' d38n G'G'G'G'X!% -2-2-2-2 -2 d38n  -2-2-2-2b "<"<"<"< "< d38n  "<"<"<"!>!>!>! >!  >!  >!>!>! >!>!>!>!@6 JJJJ J  J d38n  JJJJdOK c d    %c%%%%NS>$$$$$P!"$'+ GGG G G tn G c3h GGGGj(#((((((&CHT#s(^4L. tDcN';     ( ( ( ( ( (!3!4!!!!!s!3!4!!!!!!r/rc&eZdZdZd dZdefdZdS) AsyncSessionDBuAsync door onto SessionDB: offloads each call via asyncio.to_thread so a blocking SQLite call never freezes the event loop. Generic forwarder — the audit confirms no method returns a live cursor/generator.dbrrNc||_dSr)_db)rhrs r'rxzAsyncSessionDB.__init__&s r/rc^t|j|tsSfd}|S)Nc>Ktjg|Ri|d{VSr)asyncio to_thread)argsrattrs r' _offloadedz.AsyncSessionDB.__getattr__.._offloaded&s: *4A$AAA&AAAAAAAA Ar/)rrcallable)rhrrrs @r' __getattr__zAsyncSessionDB.__getattr__&sMtx&&~~ K B B B B Br/)rrrN)rwrrrrxr,rr;r/r'rr&sOZZr/r)r8)rC)rr)jrrrloggingrrrrrrkrpathlibragent.memory_managerragent.message_sanitizationrhermes_constantsrtypingrrr r r r r r ImportError getLoggerrwrcompilerr,rr(r.r7r<rBrKrMrLrrPrmrsrtrjrJrIrrrwrrlrrarxrryrrrrrrrrrrrrrirrrrrrrrrrrrrrr"r;rgrzr2r3rrrrrFrNrrrrrr;r/r'rsW       111111;;;;;;,,,,,,FFFFFFFFFFFFFFFFFFMMMM FFF  8 $ $","*-G"H"H/S/T////dLSLSLLLLtCH~(3-"HHSHcHHHHb3b5d3i+@bbbb40\9J9Q9QTW9Q9X9X[[[c6$s)6S 6666@ S d3i     GCLL!/##j0 6#'(3-&&&& (( (+suuCH,,,*IN,,),SX---+Y^-- hsm"Xc] EtCH~E$EEEE&4S>" $sCx.6''#'UX''''.C 2Cx}CCCC*  '*<       F '*<     >%)5/ 0 #    $???  ?? ????D         F :SyTV%(CEES)))%y~'' S} S S S S S 4 D    Thtn0{t{ {{{{|=AeeeDeTeT#s(^eeeeP[ B @+ v6t (T$8$8888'"4J26yB!yB!yB!yB!yB!yB!yB!yB!xEsAA&%A&