.cj2+UdZ ddlZn #e$rYnwxYwddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlZddlZddlmZddlmZddlmZddlmZddlmZmZmZmZm Z m!Z!m"Z"m#Z#ddl$m%Z%m&Z&dd l'm(Z(m)Z)dd l*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2dd l3m4Z4dd l5m6Z6dd l7m8Z8ddl9m:Z:dZ;dZdZ?e j@dZAe j@de jBe jCzZDdeEdeEfdZFe j@dGde+e1e2e0e/e-e.e,fDe jBZHdeIfdZJeKhdZLde deIfdZMe j@de jBZNe j@d e jBZOe j@d!e jBZPe j@d"e jBZQe j@d#e j@d$e j@d%e j@d&e j@d'e j@d(e j@d)fZRdd*ZSde deEfd+ZT ddd,d-eeeEe fde deeeEe ffd.ZUd/eVdeIfd0ZWd1d2d3eeEe fddfd4ZXd5eEdeEfd6ZYd7d8deEfd9ZZd:d:d;d<d=eEd>eEd?eEd@eIdAeIdBeIdeEfdCZ[d5eEdeEfdDZ\e j@dEe jBZ]d5eEdeIfdFZ^de d5eEdeEfdGZ_de dHeEdIeEdeeEfdJZ`deEfdKZadLZbd:dMde dNe dOe dPeIdeeEf dQZcdReddSeEdTeEdeIfdUZed;dddVdReddSeEdTeEdWeIde dXefe dzdeIfdYZgd5eEde deEfdZZhd[Zid\e deejfd]Zkdejfd^Zld_eEdWejdejfd`Zmdddad\e dbeejdceejdeIfddZn dd:dfdgeeEdIeEdheIdeEfdiZodjZpeqeEdkferdl< ddmeEdne doeeEe fdpeIdeeEe ff dqZsdrZtdsZudtZvdueeEdeIfdvZwdwe defeEfdxZxdye defeEfdzZyd{e deEfd|Zzdye d{e deIfd}Z{dReeddeIfd~Z|dd;dde!eeEe fdueeEdeIdeqe!eeEe feeEffdZ}de!eeEe fde de!eeEe ffdZ~dIe deeEde fdZdee!eeEe fde fdZhdZddlmZmZmZmZmZdZdZdne deIfdZdne de fdZdZe j@de jBZ dde!eeEe fdedeefdeqe!eEeIffdZde!eeEe fdeffdZddZdeEdeEfdZdeEdeEfdZdeIfdZdefdZdeIfdZddZde jd<eejdeEeejjddlmZmZddlmZmZmZmZeZddlmZddlmZedz Zeeeejddz ddZddZdefdZddlmZddlmZmZGddeZGddeZeddZddZdddddeIfdZe j@dZddhZedz ZeŠr8 ddlZeed5ZejeʦpiZdddn #1swxYwYddl7mZee̦Z ddlmZeje̦Zn #e$rYnwxYwe̠D]1\ZZeeeEeejeIfree jvreEeԦe je<2e̠diZeאrreeedreeEeנdĦpe jdŦpdeZiddœddǓddɓdd˓dd͓ddϓddѓddӓddՓddדddٓddۓddݓddߓdddddddddddddddddd Ze۠D]\ZZeevreeZedkreEeԦdvr%edkrJeeeEr>ddlmZeeeԠse jeԦZeeeedfrejeԦe je<eEeԦe je<e̠diZereeedrhdZ ddlmZeD]Zeedn #e$rYnwxYweD]FZeeiZeeeds&eEeddeZeEeddeZeEeddeZeEeddeZeZeredkree jded<eree jded<eree jded<eree jded<He̠diZereeedrdevreEede jd<devreEede jd<devreEede jd<d evreEed e jd <d evreEed e jd <d evreEed e jd<e̠diZerLeeedr@devreEede jd<devreEede jd<e̠diZereeedrdevreEede jd<devreEede jd<devreEede jd<devr%de jvreEede jd<e̠ddeZer)eeeEree jd<e̠diZeeedr>ed Ze&eEee jd!<e̠d"iZeeedr4ed#Zeerdnd$e jd%<ed&ZerReeeEreZn6eeeeqfr&e jGd'eDZndeZer ee jd(<ed)Zeerdnd$e jd*<ed+ZeeEee jd,<d-evrIe jd.deseEed-e jd.<nS#e$rKZed/eejd0eej1ed2ej1YdZ[ndZ[wwxYw dd3lmZd4evrenid5iZeՐeedr%ed6red:7n0#e$r(Zed8eej1YdZ[n dZ[wwxYw dd9l7mZen0#e$r(Zed:eej1YdZ[n dZ[wwxYw dd;l7mZen0#e$r(Zed<eej1YdZ[n dZ[wwxYwde jd=<de jd><dd?l m Z m Z e jddeZ e re e vre e e jddee j d@e j ddAdBveEejCZee jddn ee jd<ddDlmZmZmZmZmZmZmZddElmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#ddFl$m%Z%m&Z&ddGl'm(Z(ddHl)m*Z*ddIl+m,Z,ddJl-m.Z.ddKl/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7ddLl8m9Z9m:Z:m;Z;m<Z<ddMl=m>Z>m?Z?m@Z@mAZAddNlBmCZDmEZFmGZHe jIeZJejKdOejLdPejMdQejNdRejOdSiZPdeeEfdTZQeRZSdUZTeqerdV<eRZUdedfdWZVdeEdedfdXZWdeeEfdYZXdeddzfdZZYd[edeEfd\ZZd[edeIfd]Z[d[edeIfd^Z\d[edeIfd_Z]d[edeIfd`Z^deEfdaZ_dbeEdceEddeEdeEfdeZ`dfejdeEfdgZadheEdeeEfdiZbdjeEde2dzfdkZcdlZddmZednZfdoZgdpZhdqZieKedeeefegeheihZjdIeeEdeIfdrZkdsedeqeEdzeEdzffdtZldueEdeEdzfdvZmdddeEfdwZndeIfdxZodefdyZpdedfdzZqdyeddzdedfd{Zrdedfd|ZsddyeddzdeEfd}Ztddd~d{eEdeeEdeeEdeeEfdZuddd~dyeded{eEdeeEdeeEdeef dZvdeeeEfdZwdjeEddfdZxdeddd8fdZyddZzddl{Z|da}e|j~erd<dddeddeEdedeEfdZdeddeIfdZdeddeIfdZdeddeddedfdZddZdZdedefdZGdde*e,e.Zdddejd1ejdejddfdZddejdefdZddejdefdZdZdZ ddeejdejdejdeIfdZddyeedeIdeedeIfdZdZdeddfdZedkr edSdS(a< Gateway runner - entry point for messaging platform integrations. This module provides: - start_gateway(): Start all configured platform adapters - GatewayRunner: Main class managing the gateway lifecycle Usage: # Start the gateway python -m gateway.run # Or from CLI python cli.py --gateway N) OrderedDict) copy_contextPath)datetime) AwaitableCallableDictOptionalAnyListUnioncast)fetch_account_usagerender_account_usage_lines)consume_detached_task_resultsafe_schedule_threadsafe)COMPACTION_STATUS1COMPRESSION_RETRY_CONTEXT_REDUCED_STATUS_TEMPLATE*COMPRESSION_RETRY_MESSAGES_STATUS_TEMPLATE(COMPRESSION_RETRY_TOKENS_STATUS_TEMPLATE+COMPRESSION_RETRY_TOO_LARGE_STATUS_TEMPLATEIDLE_COMPACTION_STATUS_TEMPLATE#PRE_API_COMPRESSION_STATUS_TEMPLATE%PREFLIGHT_COMPRESSION_STATUS_TEMPLATE)"INTERRUPT_WAITING_FOR_MODEL_PREFIX)t)cfg_get)get_fallback_chain @>@@iz'(?)\s+\d[\d,]*\s+messages,\s+retrying|compressed\s+~[\d,]+\s+(?:→|->)\s+~[\d,]+\s+tokens,\s+retrying|context\s+reduced\s+to\s+[\d,]+\s+tokens\s+\(was\s+[\d,]+\),\s+retrying|session\s+compressed\s+\d+\s+times|rate\s+limited\.\s+waiting\s+\d|retrying\s+in\s+\d|max\s+retries\s+\(\d+\).*(?:trying\s+fallback|exhausted|invalid\s+responses)|stream\s+(?:drop|drop\s+mid\s+tool-call).+retry\s+\d|stale\s+connections\s+from\s+a\s+previous\s+provider\s+issue)templatereturncjtjd|}dd|DS)uCompile a compression status template constant into a regex source. Literal text is escaped verbatim (so wording drift in agent/conversation_compression.py cannot silently diverge from this matcher — the constants ARE the wording) and each ``{field}`` format placeholder is replaced with a numeric-ish pattern covering every value the emit sites format in (ints, ``{:,}`` thousands separators). z \{[^{}]*\}z[\d,]+c3>K|]}tj|VdSN)reescape.0parts -/home/ice/.hermes/hermes-agent/gateway/run.py z,_status_template_to_regex..s*<><    "),,      r0cZ t}t|tr|dnd}t|trIt |dddvSn#t$rYnwxYwdS)uTrue when the user opted into routine compression progress notices. Reads ``compression.progress_notices`` from the gateway's raw YAML config (#52995). Default False — routine compression stays silent-by-design on chat platforms unless explicitly enabled. Read live (mtime-cached) so a config edit on a running gateway takes effect on the next status. Fail-closed: any config read error keeps the silent default. compressionNprogress_noticesF>1onyestrue)_load_gateway_config isinstancedictgetstrstriplower Exception)configcompression_cfgs r.-_gateway_compression_progress_notices_enabledrIs  %''7A&$7O7OY&**]333UY ot , , **+=uEEFFLLNNTTVV[        5sBB B('B(>localwebhook api_servermsgraph_webhookplatformc.t|tvS)zBTrue only for programmatic/local surfaces that must keep raw text.)_gateway_platform_value_GATEWAY_RAW_TEXT_PLATFORMSrNs r. _gateway_surface_passes_raw_textrSs "8 , ,0K KKr0z(api\s+(?:call\s+)?failed|provider\s+authentication\s+failed|non-retryable\s+error|rate\s+limited\s+after\s+\d+\s+retries|error\s+code\s*:|\bhttp\s*\d{3}\b|incorrect\s+api\s+key|invalid\s+api\s+key)z(cybersecurity\s+risk|security\s+policy|safety\s+policy|policy\s+violation|violat(?:e|es|ed|ion)|blocked\s+(?:because|by|under)|request\s+(?:was\s+)?(?:blocked|rejected)|disallowed|moderation)zV(provider\s+authentication\s+failed|incorrect\s+api\s+key|invalid\s+api\s+key|\b401\b)z7(rate\s+limit|rate-limited|\b429\b|quota|usage\s+limit)z%\bsk-[A-Za-z0-9][A-Za-z0-9_\-]{12,}\bz\bgh[pousr]_[A-Za-z0-9_]{20,}\bz\bxapp-\d+-[A-Za-z0-9\-]{20,}\bz!\bxox[baprs]-[A-Za-z0-9\-]{20,}\bz\bhf_[A-Za-z0-9]{20,}\bz\bglpat-[A-Za-z0-9_\-]{20,}\bz'(?i)\b(Bearer\s+)[A-Za-z0-9._\-]{20,}\bctjdkrdSttjj}g}t jdr2| tt jd| |dz t}|D]} |}n#t$r|}YnwxYwt| }||vrQ|||dz dz }|st|}t|}|tjvr tjd|t%j||tjvrtj|tjrtjd|krdnd} tj| |t|t jd<||g} t jd r%| t jd t jt.| t jd <dSdS) a Make detached Windows gateway runs see the Hermes venv packages. Some Windows restart paths run the gateway under uv's base ``pythonw.exe`` to avoid the venv launcher respawning a visible console interpreter. That mode can import the source tree via cwd/PYTHONPATH but still miss optional packages installed only in ``venv/Lib/site-packages`` (notably the MCP SDK). Patch the live process before MCP discovery so tool injection does not depend on every launcher preserving PYTHONPATH perfectly. win32N VIRTUAL_ENVvenvLib site-packagesr PYTHONPATH)sysrNr__file__resolveparentosenvironrBappendsetOSErrorrCrEaddexistspathinsertsite addsitedirremovepathsepr2rAfromkeys) project_root candidatesseenvenv_dir resolved_venvvenv_key site_packages project_entry site_entry insert_at pythonpaths r.$_ensure_windows_gateway_venv_importsrysi |w>>))++29LJ z~~m$$;$rz-899:::lV+,,,UUD %$,,..MM % % %$MMM %}%%++-- t    %-? ##%%  L)) ''  ( ( HOOA} - - -  ###  ! ! HOOJ ' ' 'Ichqk]&B&BAA   :...$' $6$6 =!#Z0 :>>, ' ' 8   bj6 7 7 7#%:??4==3L3L#M#M < ?sC C&%C&ctt|d|pdS)zDReturn a normalized gateway platform value for enums or raw strings.value)rCgetattrrDrErRs r.rPrP/s9 wx(339r : : @ @ B B H H J JJr0rRmetadatac\t|dkr|St|pi}d|d<|S)zEMark Discord lifecycle/status sends without changing other platforms.discordTnon_conversational)rPrA)r~rNmergeds r._non_conversational_metadatar4s= x((I55 (.b ! !F#'F  Mr0excct}|}d}hd}|d|dkr^t|}||vrnJ|||dz }t|j}||vrdS|jp|j}||dk^dS)uhReturn True for transient network errors safe to log + swallow. The crash class targeted by #31066 / #31110: an unhandled Telegram ``TimedOut`` (or peer ``NetworkError`` / ``httpx`` connection error) propagating to the event loop and killing the entire gateway process. These are by definition transient — the next poll cycle or user action recovers — so they must never crash the process. Walk the exception cause chain so wrapped errors (e.g. PTB's ``NetworkError`` wrapping ``httpx.ConnectError``) are still classified. The chain is bounded to avoid pathological cycles. r> TimedOut ReadError WriteError PoolTimeout ReadTimeout ConnectError NetworkError WriteTimeout ClientOSErrorConnectTimeoutRemoteProtocolErrorClientConnectorErrorServerDisconnectedErrorN rZTF)rcidretype__name__ __cause__ __context__)rrpcurdepthtransient_class_namesidentnames r._is_transient_network_errorrAsUUD#&C E /ebjj3 D==    Cyy! ( ( (4m.s /ebjj 5r0loopzasyncio.AbstractEventLoopcontextc B|d}|t|r|dpd}|dp|d}d}|T t|dr|nt |}n#t $rt |}YnwxYwt d |pd t|j |t|||j f dS| |dS) aLoop-level safety net for transient network errors. Installed once during :func:`start_gateway`. Catches the ``telegram.error.TimedOut`` crash class (issues #31066 / #31110) and any peer transient network error before it can kill the gateway process. Logs at WARNING with full traceback so the originating call site stays diagnosable; non-transient errors are forwarded to the default loop handler so real bugs still surface. exceptionNmessageztransient network errorfuturetaskr|get_namez9Gateway swallowed transient network error from %s: %s: %szexc_info) rBrhasattrrreprrFloggerwarningrr __traceback__default_exception_handler)rrrrr task_names r._gateway_loop_exception_handlerrms- ++k " "C 6s;;++i((E,E{{8$$; F(;(;   '/6tZ/H/HXDMMOOOdSWjj  ' ' ' JJ  ' G  )) II  3iic&78     ""7+++++s-3B!!B=<B=textct|pd} ddlm}||d}n#t$rYnwxYwtD]}|d|}|S)uSecret redaction before text can leave the gateway. Delegates to the authoritative ``agent.redact.redact_sensitive_text`` — the same Tirith-grade redactor already applied to logs, tool output, and approval-command prompts — so the outbound chat path masks the full credential set the startup banner promises ("chat responses are scrubbed before delivery"), not a divergent subset. ``force=True`` honors redaction even when ``security.redact_secrets`` is off, matching the ``_redact_approval_command`` reasoning (#23810). The narrow ``_GATEWAY_SECRET_PATTERNS`` set runs as a belt-and-suspenders second pass so nothing the gateway historically caught can regress, and so redaction still degrades gracefully if the import ever fails. r|rredact_sensitive_textTforcecD|jr|dnddzS)NrZr|z [REDACTED]) lastindexgroup)ms r.z5_redact_gateway_user_facing_secrets..s  *K!''!***|)[r0)rC agent.redactrrF_GATEWAY_SECRET_PATTERNSsub)rredactedrpatterns r.#_redact_gateway_user_facing_secretsrs4:2H 666666((>>>      ,gg;;[[]eff Os ' 44cmdz str | NonecFddlm}|t|pddS)ugRedact credentials from a command before it goes into an approval prompt. Tirith's *findings* are already redacted, but the gateway approval prompt is built from the raw command string, so a credential-shaped value Tirith flagged would otherwise be echoed verbatim to the chat platform (#48456). Uses ``redact_sensitive_text(force=True)`` — the same Tirith-grade redactor — so the prompt honors redaction even when ``security.redact_secrets`` is off. Module-level so the wiring is unit-testable (the call site is a deeply nested gateway closure that cannot be driven directly). rrr|Tr)rrrC)rrs r._redact_approval_commandrs6322222 SYBt < < < >>r0c|s|St|r|St|trdSt t|}t |rt|S|S)aSanitize final gateway replies before sending them to chat surfaces. Every human-facing chat surface (Telegram, WhatsApp, Discord, Slack, Signal, Matrix, plugin platforms, etc.) should receive concise, safe provider failure categories with secrets redacted instead of raw HTTP bodies, request IDs, leaked credentials, or policy text. Only programmatic surfaces in ``_GATEWAY_RAW_TEXT_PLATFORMS`` (CLI/TUI ``local`` diagnostics, API JSON, webhook payloads) keep the raw text unchanged. r|)rSrCrD startswithrrrr)rNrrs r. _sanitize_gateway_final_responsers  '11  4yy##$FGGr23t99==H)(337,X666 Or0 event_typercXt|pd}|sdSt|r|St|}t|r*t rt|sdSt|rt|S|S)zFilter/sanitize agent status callbacks before platform delivery. Local/CLI sessions keep the raw diagnostic stream. Messaging gateway surfaces should not receive transient auxiliary/compression chatter. r|N) rCrDrSr_TELEGRAM_NOISY_STATUS_RErrI_COMPRESSION_PROGRESS_STATUS_RErr)rNrrrs r._prepare_gateway_status_messager.s w}"   # # % %D t'11 .t 4 4D ''--  : ; ; /66t<< 4)$//3,T222 Kr0cftt|ddpdS)uRender an AgentNotice to a single plaintext line for messaging platforms. Messaging has no persistent status bar (unlike the TUI), so a notice is a one-shot standalone push. The notice policy already bakes the level glyph (⚠ / • / ✕ / ✓) into the text, and the TUI + CLI REPL render that text verbatim — so we emit it as-is here too. Prepending a per-level glyph would DOUBLE it ("⚠ ⚠ Credits 90% used", "⛔ ✕ Credit access paused"). Plaintext only — no markdown — so it renders uniformly across Telegram/Discord/Slack/ SMS without per-platform escaping. Fail-soft: a malformed/empty notice degrades to "" rather than raising on the agent's callback path. rr|)rCr}rD)notices r.render_notice_linerLs/ wvvr**0b 1 1 7 7 9 99r0cKt|dd}t|r|||||d{VS||||d{VS)a5Route a status message through adapter.send_or_update_status when supported. Issue #30045: adapters that implement send_or_update_status (currently Telegram) edit the previous bubble for the same status_key instead of appending a new one. Adapters without the method fall back to plain send. send_or_update_statusNr~)r}callablesend)adapterchat_id status_keycontentr~senders r._send_or_update_status_coror[sW5t < slack mattermost)r}rCrE)rNrrrplatform_value platform_keys r._resolve_progress_thread_idrhsXw99N~+,,2244L C    $%%-=)>)>>>4(8Bs#$$$dB%#$$$...3C.#$$$ 4r0 user_configrsettingc<t|tr|dnd}t|tsdS|d}t|tsdS||}t|to||vS)zFReturn True when display.platforms. explicitly sets setting.displayNF platformsr@rArB)r rr r r  platform_cfgs r._has_platform_display_overriders,6{D,I,ISkooi(((tG gt $ $u K((I i & &u==..L lD ) ) Eg.EEr0defaultrNrequire_platform_override_forrrct|p|}d|p tD}||vrt|||sdSddlm}|||||} t | t r| St | tr(|  dvS| t |St | S)ajResolve a boolean display setting with optional platform-only opt-in. Some display features expose assistant scratch text rather than deliberate user-facing output. For high-noise threaded chat surfaces such as Mattermost, a global opt-in is too broad: they must be enabled with an explicit display.platforms.. override. c,h|]}t|SrP)r, candidates r. z0_resolve_gateway_display_bool..s0  **r0Frresolve_display_setting>r;r<r=r>) rPrcrgateway.display_configrr@rrCrDrE) r rr rrNrcurrent_platform platform_onlyrr{s r._resolve_gateway_display_boolrs /x/G<HH7@355M M)).{L'RR *u>>>>>> # #Kw P PE% %C{{}}""$$(BBB }G}} ;;r0ct|d|}|dkr|Sddlmdtjt dt ffd }t ||S)a%Rewrite slash-command mentions to Telegram-valid command names. Telegram Bot API command names allow only lowercase letters, digits, and underscores. Keep other platform renderings unchanged, but normalize Telegram help text so command mentions remain clickable/valid there. r{telegramr)_sanitize_telegram_namematchr%cx|d}|rd|n|dS)NrZ/r)r)r# sanitizedr"s r._replacez/_telegramize_command_mentions.._replaces<++EKKNN;; "+?9Q?r0)r}hermes_cli.commandsr"r)MatchrC_TELEGRAM_COMMAND_MENTION_REr)rrNrr'r"s @r._telegramize_command_mentionsr+sXw99N## ;;;;;;@ @#@@@@@@ ( + +Hd ; ;;r0r{cz|dSt|tr|St|trdSt|tt fr4t |dkrt |dz nt |St|t r|}|sdS t |}|dkr|dz n|S#t$rYnwxYw tj | ddS#t$rYdSwxYwdS)aBest-effort conversion of stored gateway timestamps to epoch seconds. Missing/unparseable timestamps return None so legacy transcripts keep the historical auto-continue behaviour instead of being silently dropped. Accepts: datetime, epoch seconds (int/float), epoch milliseconds (when the magnitude exceeds year-2286), ISO-8601 strings (with or without a trailing ``Z``), and numeric strings. Nld( g@@Zz+00:00) r@r timestamprintfloatrCrD ValueError fromisoformatreplace)r{rnumerics r._coerce_gateway_timestampr6sX }t%""!   %t%#u&&X(-e ~(E(EuU||f$$5QV<<W% {{}} 4 DkkG'.'?'?7V##W L    D  )$,,sH*E*EFFPPRR R   44  4s$C C,+C,09D** D87D8c"ddlm}|S)aReturn the configured auto-continue freshness window in seconds. Thin wrapper that delegates to the canonical implementation in ``gateway.session`` (the single source of truth shared with the routing-time zombie gate in ``get_or_create_session``). Reads ``HERMES_AUTO_CONTINUE_FRESHNESS`` (bridged from ``config.yaml`` ``agent.gateway_auto_continue_freshness`` at gateway startup, same pattern as ``HERMES_AGENT_TIMEOUT``). Falls back to the module default when unset or malformed. Non-positive values disable the freshness gate (restores the pre-fix "always fresh" behaviour for users who want to opt out). Kept here so existing call sites and test patches importing it from ``gateway.run`` continue to work. rauto_continue_freshness_window)gateway.sessionr9r8s r._auto_continue_freshness_windowr;s%?>>>>> ) ) + ++r0rctj|}||dkrt|S t|S#tt f$rt|cYSwxYw)zRead an env var as float, falling back to ``default`` on typos/empty. A misconfigured env var (e.g. ``HERMES_AGENT_TIMEOUT=abc``) must not crash the gateway or an agent turn. Unset/empty also falls back. Nr|)r`rarBr1 TypeErrorr2)rrraws r. _float_envr?ss *..  C {cRiiW~~Szz z "W~~sA A*)A*)now window_secsr@rAc|t|ntt}|dkrdSt|}|dS|tjn|}||z |kS)aReturn True when an interruption marker is fresh enough to auto-continue. Unknown timestamps are treated as fresh for backward compatibility with legacy transcripts (pre-dating timestamp persistence) and with in-memory test scaffolding that constructs history entries without timestamps. A non-positive ``window_secs`` disables the gate (always fresh), which restores the pre-fix behaviour for users who opt out via config. NrT)r1%_AUTO_CONTINUE_FRESHNESS_SECS_DEFAULTr6time)r{r@rAwindowr/currents r._is_fresh_gateway_interruptionrG'sv"  " k 8 9 9 {{t)%00It [dikkkcG Y & ((r0r| interactivereasonrIcv|dkrdn |dkrdnd}|rd}d}n |rd}d}nd }d }d |d |d |d|rd|ndzS)upBuild the resume-pending recovery system note for an interrupted turn. ``reason`` is the session's ``resume_reason`` (``restart_timeout``, ``shutdown_timeout``, or anything else → generic interruption phrasing). ``message`` is the user's NEW message text; empty means this is the startup auto-resume turn synthesized by ``_schedule_resume_pending_sessions`` with no human message attached. ``interactive`` selects the empty-message guidance: on interactive platforms a human is present, so "report the restore and ask what next" is right. On non-interactive event platforms (webhook, API server — adapters with ``interactive_resume = False``) nobody can answer; the resumed turn must instead complete the interrupted work, or the task is silently abandoned behind a "restored" acknowledgement that goes nowhere (#57056). restart_timeoutza gateway restartshutdown_timeoutza gateway shutdownza gateway interruptionzTAddress the user's NEW message below FIRST and focus on what the user is asking now.u\Do NOT re-execute old tool calls — skip any unfinished work from the conversation history.zfReport to the user that the session was restored successfully and ask what they would like to do next.zNo user is present on this non-interactive platform, so do NOT emit a 'session restored' acknowledgement or ask questions. Review the conversation history and CONTINUE the interrupted task to completion.uDo NOT re-run tool calls whose results already appear in the history — resume from the first step that has no recorded result.z3[System note: The previous turn was interrupted by u; the gateway is now back online. Any restart/shutdown command in the history has already run — do NOT re-execute or verify it.  ]rr|r)rJrrI reason_phraseresume_guidance tail_guidances r.build_resume_recovery_noterSDs0 & & &  ' ' '" ! %   .   =     D   =   ;  +      4C        ' . '   B  0r0) reasoningreasoning_contentreasoning_detailscodex_reasoning_itemscodex_message_items finish_reason._ASSISTANT_REPLAY_FIELDSrolermsgpreserve_timestampc`||d}|d}|dvr5t|tr |r||dkr||d<|dkr6tD].}||vr||}|dkr|%n|s)|||</|r|d}|r||d<|S) u Build a replay entry for a non-tool-calling message, preserving the assistant fields the agent's API builders rely on for multi-turn fidelity. Lifted out of the inline ``run_sync`` closure so the field whitelist can be unit-tested in isolation. Mirrors the ``_ASSISTANT_REPLAY_FIELDS`` contract above. ``preserve_timestamp``: when True, copy the source row's ``timestamp`` onto the replay entry. Currently only user messages need this — the stale-dangerous-confirmation stripper in ``agent/replay_cleanup.py`` reads the timestamp to decide whether a confirmation is too old to replay safely. Assistant/tool messages are not timestamp-stripped in the same way, so we keep the existing default of dropping it. Empty values: most fields are dropped when falsy (matching the original PR #2974 behaviour) since an empty list/string for those carries no information. The exception is ``reasoning_content``: DeepSeek/Kimi thinking-mode replay treats an empty string as a meaningful sentinel that ``_copy_reasoning_content_for_api`` upgrades to a single space. Dropping it here would make the gateway send no ``reasoning_content`` at all on the next turn, which can cause HTTP 400 from strict thinking providers. r[r api_content)user assistantrrbrUNr/)rBr@rCrZ) r[rr\r]entry_sidecar_rkey_rvaltss r._build_replay_entryrhs:&*g>>Eww}%%H %%% x % % &  & swwy)) ) )'m {- ! !ECGGENNE+++=!  E%LL$ WW[ ! !  $!#E+  Lr0zobserved Telegram group contextz>[Observed Telegram group context - context only, not requests]zh[Current addressed message - answer only this unless it explicitly asks you to use the observed context]channel_promptc2t|ot|vS)aReturn True for Telegram group turns that may include observed chatter. Telegram's observe-unmentioned mode persists skipped group chatter so a later @mention can see it. Those rows must not replay as ordinary user turns: a weak wake word like ``@bot cambio`` should not make the model treat old unmentioned chatter as pending work. The Telegram adapter marks these turns with a channel prompt; this helper keeps the run-path check explicit and unit-testable. )r(_TELEGRAM_OBSERVED_CONTEXT_PROMPT_MARKER)ris r.%_uses_telegram_observed_group_contextrls ]#K~#] ^ ^^r0r>c|tSt|tr d|DSt|}|stSd|dDS)zDNormalize a config list or comma-separated scalar into a string set.Nch|]D}t|#t|ESr)rCrDr+s r.rz&_csv_or_list_to_set.. s=GGGdSYY__5F5FGD !!GGGr0c^h|]*}||+Sr)rDr+s r.rz&_csv_or_list_to_set.. s- B B BTTZZ\\ BDJJLL B B Br0,)rcr@listrCrDr1)r>ss r._csv_or_list_to_setrss{ {uu #tHGGcGGGG CA uu B BQWWS\\ B B BBr0rGct|ditj}d}|$t|did}|t jdpd}t |S)aReturn Slack channels that the generic gateway must never dispatch. The Slack adapter has the first-line drop, but this runner-level guard is intentionally duplicated as a fail-safe. If a future Slack code path, test hook, malformed event, or stale adapter instance bypasses the Slack plugin adapter, ignored channels still cannot reach auth, pairing, sessions, or the agent/home-channel prompt pipeline. r Nextraignored_channelsSLACK_IGNORED_CHANNELS)r}rBPlatformSLACKr`getenvrs)rGrr>s r.+_slack_ignored_channels_from_gateway_configr{sz6;3377GGL ClGR00445GHH {i0119T s # ##r0rc\|sdSt|dddS)zFReturn the parent Slack channel from a possibly thread-scoped chat ID.r|:rZr)rCr1rs r._slack_parent_channel_idr%s0 r w<<  c1 % %a ((r0clt|}t|}t|od|vp||vS)zDCheck the generic Slack gateway blacklist for channel or thread IDs.*)rr{r)rGr channel_idignoreds r._is_slack_ignored_channelr,s=)'22J9&AAG  Hw G*2G I IIr0c@t|tsdS|d}t|tsdS|d}t|tr#t|ddSt|S)a;True when gateway.message_timestamps.enabled is opted in. Default OFF: injecting a ``[Tue 2026-04-28 13:40:53 CEST]`` prefix onto every user message changes what the model sees for all gateway users, so it must be explicitly enabled in config.yaml under ``gateway.message_timestamps.enabled``. Fgatewaymessage_timestampsenabled)r@rArBr)r gwmts r._message_timestamps_enabledr3s k4 ( (u  # #B b$  u $ % %B"d.BFF9e,,--- 88Or0riinject_timestampshistoryrc\ddlm}ddlm}|}g}g}t |}|pgD]} | d} | s| dvr | dkr'| d} |r<| dkr6t | tr!|| | d | } |rR| d r=| dkr7| r5|t|  d | v} d | v} | dk}| s| s|r5d| D}||| rx| dkrt| } | s2| dr| dd}d|d| } t| | | | dk}||t|}t|}t|t!j}d| pd}||fS)aConvert stored gateway transcript rows into agent replay messages. Observed Telegram group rows are returned as API-only context for the current addressed message instead of being replayed as normal prior user turns. Keeping that context out of ``conversation_history`` avoids consecutive-user repair merging it with the live user turn and then hiding the current message behind ``history_offset`` during persistence. When ``inject_timestamps`` is True (gateway.message_timestamps.enabled), each replayed user message is rendered with a single human-readable timestamp prefix from its stored metadata. r get_timezone)"render_user_content_with_timestampr[> session_metasystemrrar/tzobserved tool_calls tool_call_idtoolc"i|] \}}|dv || S)>rr/rr,kvs r. z0_build_gateway_agent_history..s)\\\$!QB[9[9[A9[9[9[r0mirror mirror_sourcezanother sessionz[Delivered from ] )r]r@rN) hermes_timergateway.message_timestampsrrlrBr@rCrbrDitems_strip_auto_continue_noiserh_strip_interrupted_tool_tails_strip_dangling_tool_call_tail$_strip_stale_dangerous_confirmationsrDr2)rrir _get_msg_tz_render_msg_ts_msg_tz agent_historyobserved_group_contextseparate_observed_contextr\r[rhas_tool_callshas_tool_call_idis_tool_message clean_msg mirror_srcrcobserved_contexts r._build_gateway_agent_historyrGs&877777kmmG*,M(* En U U}"2(2(wwv   $ $ $  8   '')$$  PJw4L4L$nWcggk.B.BwOOOG $ )<)< T[ " ) )#g,,*<*<*>*> ? ? ? &,)S0&.  (- ( (\\#))++\\\I   + + + +  ( v~~4W==wwx   E WW_6GHH DZDD7DD (gsPTX^P^```E   ' ' '2-@@M3=AAM949;;Myy!788>>@@HD * **r0persisted_history live_historyct|tr/t|t|krt|S|S)aPrefer a cached agent's live in-memory transcript over a shorter persisted one. Guards the FTS write-corruption case (#50502): when message writes fail silently through corrupt FTS triggers, the next turn reloads a stale/empty ``conversation_history`` from disk even though the same cached ``AIAgent`` still holds the full live ``_session_messages``. Replacing the live transcript with that shorter persisted copy causes immediate same-session amnesia. When the live transcript is strictly longer, keep it. Returns ``persisted_history`` unchanged unless the live copy is a longer list, in which case a copy of the live transcript is returned. )r@rqr)rrs r._select_cached_agent_historyrsE",%%"#l*;*;cBS>T>T*T*TL!!! r0rc|s|Std|dtd}t|tr||St|tr{d|D}|D]Q}t|t r:|ddkr!||dd|d<|cSRd|dg|zS|S)zDPrepend observed Telegram context to the API-only current user turn.rrcZg|](}t|trt|n|)Sr)r@rAr+s r. z?_wrap_current_message_with_observed_context..s1VVVdD$!7!7A4:::TVVVr0rrr|)rr)_OBSERVED_GROUP_CONTEXT_HEADER!_CURRENT_ADDRESSED_MESSAGE_HEADERr@rCrqrArBrstrip)rrprefixwrappedr-s r.+_wrap_current_message_with_observed_contextrs  * 1 1  1 1 , 1 1 1 '3$#'###'4  EVVgVVV  D$%% $((6*:*:f*D*D"(@$((62*>*>@@V 99:WDD Nr0c|sdSt|D]Q}t|ts|d}|r|dvr4|d}||cSdSdS)uIReturn the ``timestamp`` of the last usable transcript row, if any. Skips metadata-only rows (``session_meta``, system injections) that are dropped before being handed to the agent. Returns ``None`` when no usable row carries a timestamp — callers should treat that as "fresh" for backward compatibility. Nr[>rrr/)reversedr@rArB)rr\r[rgs r._last_transcript_timestamprs t   #t$$  wwv t999  WW[ ! ! >IIItt 4r0>image_generatetext_to_speechtext_to_speech_tool)is_interrupted_tool_resultstrip_interrupted_tool_tailsstrip_dangling_tool_call_tail#strip_stale_dangerous_confirmationsis_dangerous_confirmationz [System note: Your previous turnzystem note: A new messagect|tsdS|tp|tS)zReturn True if this user-message content is a gateway-injected auto-continue note that should NOT be replayed as a real user turn.F)r@rCr_AUTO_CONTINUE_NOTE_PREFIX_AUTO_CONTINUE_FALLBACK_PREFIX)rs r._is_auto_continue_noisersI gs # #u566 >   < = =r0ct|s|St|}t|rK|d}|dkrdS||dzd}t|K|S)aWRemove persisted gateway auto-continue note prefix from user text. Older gateway builds prepended the recovery note directly to the user message, so the transcript row can contain both the synthetic note and the user's real question. Strip one or more leading synthetic notes while preserving any real text that follows. rOrr|rZN)rrCfindlstrip)rrends r.rr!s #7 + + w<990  +-:: 776??k ) ) GGL))/R : :Dhhtnn;(;(;G*%%+Brvvf~~?&)9)9?R@@D :4 :59$S\\2  :J ' ' 776??"6 6 6 cggn--I1C1CIrJJ  # #G , ,4Q Q Q cggi((.B//(,,W55  ( ( (XW-D-D *W--    '4(( W[[-C-C 9E";;u--D"4-- . 8 8$ I I $,? ? ?"))/4//:::  7 " " #,,W55 3 3E;;q>>''))0077D 3$777!!/4//222 7 * *"&  * **s9G GGrct}i}|D]}|ddkr|dpgD]}|dp|d}|dpi}t|dp|dpd}|r|r||t|<|D]}|dd vrt|d dpd}d |vrot|D]S} | d d } | r|| Tt|dp|dpd}||dkr tj |} n#t$rd} YnwxYwt| trb| drMtD]E} | | } t| tr| r|| nF|S)aCollect every media path already delivered in prior tool results. Used to dedup auto-appended MEDIA tags so the same file is not re-sent on later turns. Must cover BOTH delivery shapes: * ``MEDIA:`` text tags in tool results, and * ``image_generate`` JSON-payload paths (``host_image`` / ``image`` / ``agent_visible_image``), which carry no MEDIA: tag. Missing the JSON-payload shape caused #46627: after a compression boundary the auto-append fallback rescans full history, re-discovers an earlier ``image_generate`` result whose path was never in the dedup set, and re-emits the MEDIA tag every turn. r[rbrrrrrr|>rrrrrZrrrNr)rcrBrCrrrrDrrerrrFr@rAr)rpathsrr\rcidrrrr#prrjps r._collect_history_media_pathsrsE+-:: 776??k ) ) --3 : :hhtnn;(;(;XXj))/R266&>>CTXXf-=-=CDD:4:59(S2 776??"6 6 6 cggi,,233 w  '0099 ! !KKNN((**11%88!IIaLLL #''.))ESWWY-?-?E2FF  # #C ( (,< < < *W--    '4(( W[[-C-C 9E U++B!"c**r "  Ls!G66 HHctjd}|rntj|rdSt jtd|tj ddddl }| }|j |j fD]5}|r1tj|r|tjd<dS6 ddl}|tjd<dS#t $rYnwxYwdD]3}tj|r|tjd<dS4dS)aSet SSL_CERT_FILE if the system doesn't expose CA certs to Python. Windows startup paths (Desktop, Scheduled Tasks, installer children) can occasionally inherit a stale SSL_CERT_FILE. Returning just because the variable is present makes every later httpx/OpenAI client construction fail with FileNotFoundError from ssl.load_verify_locations(). Treat a missing path as unset and fall back to certifi instead. SSL_CERT_FILENz?Ignoring stale SSL_CERT_FILE=%r because the path does not existr)z"/etc/ssl/certs/ca-certificates.crtz /etc/pki/tls/certs/ca-bundle.crtz1/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pemz/etc/ssl/ca-bundle.pemz/etc/ssl/cert.pemz/etc/pki/tls/cert.pemz#/usr/local/etc/openssl@1.1/cert.pemz&/opt/homebrew/etc/openssl@1.1/cert.pem)r`rarBrgrflogging getLoggerrrpopsslget_default_verify_pathscafileopenssl_cafilecertifiwhere ImportError)configured_certrrrrs r._ensure_ssl_certsr ssjnn_55O. 7>>/ * *  F(##++ M     ---JJJ  ( ( * *ElE$89   22 *3BJ ' FF &-mmoo ?#           7>>) $ $ *3BJ ' FF   s-%D D! D! platform_namecZddlm}||}|r|S|dS)aReturn the configured home-target env var for a platform. Consults built-in ``_HOME_TARGET_ENV_VARS`` first, then the plugin registry via ``cron.scheduler._resolve_home_env_var``, then falls back to ``_HOME_CHANNEL`` for unknown names. r)_resolve_home_env_var _HOME_CHANNEL)cron.schedulerr upper)r r resolveds r._home_target_env_varrsN544444$$]33H!!## 2 2 22r0c&t|dS)zDReturn the optional thread/topic env var for a platform home target. _THREAD_ID)r)r s r._home_thread_env_varrs"=11 = = ==r0c:tdz S)zIReturn True when a /restart completion marker is waiting to be delivered..restart_notify.json) _hermes_homerfrr0r._restart_notification_pendingrs 1 1 9 9 ; ;;r0ctdz S)Nz.restart_pending.json)rrr0r."_planned_restart_notification_pathrs 1 11r0cBtS)zHReturn True when a non-chat planned restart should notify home channels.)rrfrr0r.%_planned_restart_notification_pendingrs - / / 6 6 8 88r0cJtddS)NT missing_ok)runlinkrr0r.#_clear_planned_restart_notificationr!"s%&((//4/@@@@@r0r;_HERMES_GATEWAY)get_hermes_homeget_hermes_home_override)atomic_json_writeatomic_yaml_writebase_url_host_matchesis_truthy_value) load_dotenv)load_hermes_dotenv.envrZ hermes_home project_envc ddlm}|rttdSt tt t jddz ttdS)a Reload .env for fresh credentials without letting stale .env override config. Gateway processes are long-lived, so per-turn code reloads ~/.hermes/.env to pick up rotated API keys. config.yaml remains authoritative for agent budget settings such as agent.max_turns; otherwise a stale HERMES_MAX_ITERATIONS in .env can replace the startup bridge on later turns. In multiplex mode this is a NO-OP for the credential reload: secrets come from the per-turn ``set_secret_scope`` (installed by ``_profile_runtime_scope``) which loads the routed profile's ``.env`` into an isolated mapping. Mutating the process-global ``os.environ`` here would defeat that isolation and leak the default profile's keys to every profile's turns and subprocesses. ris_multiplex_activeNrZr+r,) agent.secret_scoper1_bridge_max_turns_from_configrr*rr]r^parentsr0s r./_reload_runtime_env_preserving_config_authorityr5<s766666 &l333 NN**,,4Q7&@",/////r0homerc|dz }|sdS ddl}t|d5}|j|pi}dddn #1swxYwYddlm}||} ddlm}|j|}n#t$rYnwxYwn#t$rYdSwxYw| di}t|tr&d |vr"t|d tjd <| d i}t|trNd |vr"t|d tjd <d|vr&t|dtjd<dSdSdS)zIBridge config.yaml agent.max_turns into HERMES_MAX_ITERATIONS (a global). config.yamlNrutf-8encoding_expand_env_vars managed_scopeagent max_turnsHERMES_MAX_ITERATIONSsessionscjk_ftsHERMES_CJK_FTSsearch_slow_msHERMES_SEARCH_SLOW_MS)rfyamlopen safe_loadhermes_cli.configr= hermes_clir?apply_managed_overlayrFrBr@rArCr`ra) r6 config_path_yamlfcfgr=r? agent_cfg sessions_cfgs r.r3r3Ys&K      + 0 0 0 +A!%/!$$*C + + + + + + + + + + + + + + +666666s##   0 0 0 0 0 05-5c::CC    D  $$I)T""J{i'?'?.1)K2H.I.I *+77:r**L,%%V  $ $+.|I/F+G+GBJ' ( | + +25lCS6T2U2UBJ. / / / VV , +sXBA BABAB.BB BBBB B$#B$ct ttjddS#tt f$rYdSwxYw)zGReturn the current per-turn iteration budget after runtime env refresh.rB90Z)r5r0r`rzr=r2rr0r._current_max_iterationsrW}sU3555294d;;<<< z "rrs!2AA)contextmanager)PORT_BINDING_PLATFORM_VALUESplatform_binds_portceZdZdZdS)MultiplexConfigErroraA profile multiplexer config is invalid. Distinct from a transient adapter-connect failure: a config error means the operator must fix config.yaml. Fatal configuration errors propagate to the startup guard instead of being treated as retryable adapter noise. Nr __module__ __qualname____doc__rr0r.r\r\sr0r\ceZdZdZdS)SecondaryPortBindingConfigErrorzEA secondary profile conflicts with the multiplexer's shared listener.Nr]rr0r.rbrbsOOOOr0rb profile_homec# Kddlm}m}ddlm}m}m}|t|}||t|} dV||||dS#||||wxYw)uScope config/skills/memory AND credentials to a profile for one turn. Combines the two seams the multiplexer needs: 1. ``set_hermes_home_override`` — redirects ``get_hermes_home()`` (config, skills, memory, SOUL, sessions) to the profile's home. Contextvar, so it propagates into the agent worker thread via ``copy_context()``. 2. ``set_secret_scope`` — installs the profile's ``.env`` secrets as the authoritative credential source, so ``get_secret`` reads this profile's keys and never the process-global ``os.environ`` (which in a multiplexer may hold another profile's values). Only used on the multiplexed inbound path. Single-profile gateways never enter this scope, so their behavior is unchanged. Loading the profile's ``.env`` here does NOT mutate ``os.environ`` — ``build_profile_secret_scope`` returns an isolated dict — which is what keeps subprocesses (MCP, kanban) from inheriting cross-profile secrets. r)set_hermes_home_overridereset_hermes_home_override)build_profile_secret_scopeset_secret_scopereset_secret_scopeN) hermes_constantsrerfr2rgrhrirCr)rcrerfrgrhri home_token secret_tokens r._profile_runtime_scoperms&VUUUUUUU *)#l*;*;<$>tL?Q?Q$R$RSSL/ <((("":..... <((("":....s A++B GatewayConfigcnt}t|dds|S t}n#t$r|cYSwxYw t t |5tcdddS#1swxYwYdS#t$r!t dd|cYSwxYw)u.Load gateway config for the process-level GatewayRunner. When ``gateway.multiplex_profiles`` is off, this is identical to ``load_gateway_config()`` (legacy single-profile path). When multiplexing is on, reload under the default/active profile's ``_profile_runtime_scope`` so platform tokens in that profile's ``.env`` resolve through the secret scope — the same path secondary profiles use in ``_start_one_profile_adapters``. Without this, primary startup calls ``load_gateway_config()`` unscoped: ``_getenv`` falls through to ``os.environ``, which often has no ``TELEGRAM_BOT_TOKEN`` once the token lives only under ``profiles//.env`` (#64674). Single-profile gateways never set ``multiplex_profiles``, so they keep the unscoped load and are unaffected. multiplex_profilesFNzAmultiplex default-scope config reload failed; using unscoped loadTr)load_gateway_configr}r#rFrmrrdebug)rQr6s r.load_gateway_config_for_runnerrss,"   C 3,e 4 4      #DJJ / / ) )&(( ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )  O     sE2 AAB !A</ B <BB BB (B43B4rxplatform_configPlatformConfigcddlm}||vrdSt|ddpd}t|tr|rdSt|ddpd}t|tr|rdSdS) zReturn True when a token-authenticated platform has a usable bot credential. Platforms that do not use ``PlatformConfig.token`` always return True so we never skip them here (Signal session paths, port-binding HTTP adapters, etc.). r)PLATFORM_TOKEN_ENV_NAMESTtokenNr|api_keyF)gateway.configrwr}r@rCrD)rNrtrwrxrys r._platform_has_bot_credentialr{s 877777///t OWd 3 3 9rE%%++--toy$77=2G'3GMMOOt 5r0z=^(?P.+):(?P/[^:]+?)(?::(?P[^:]+))?$z/outputz/outputsr8r9r:r<r>terminalbackend TERMINAL_ENVcwd TERMINAL_CWDtimeoutTERMINAL_TIMEOUT home_modeTERMINAL_HOME_MODElifetime_secondsTERMINAL_LIFETIME_SECONDS docker_imageTERMINAL_DOCKER_IMAGEdocker_forward_envTERMINAL_DOCKER_FORWARD_ENVsingularity_imageTERMINAL_SINGULARITY_IMAGE modal_imageTERMINAL_MODAL_IMAGE daytona_imageTERMINAL_DAYTONA_IMAGEssh_hostTERMINAL_SSH_HOSTssh_userTERMINAL_SSH_USERssh_portTERMINAL_SSH_PORTssh_keyTERMINAL_SSH_KEY container_cpuTERMINAL_CONTAINER_CPUcontainer_memoryTERMINAL_CONTAINER_MEMORYcontainer_diskTERMINAL_CONTAINER_DISKTERMINAL_CONTAINER_PERSISTENTTERMINAL_DOCKER_VOLUMESTERMINAL_DOCKER_ENVTERMINAL_DOCKER_EXTRA_ARGS&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACETERMINAL_DOCKER_NETWORK TERMINAL_DOCKER_RUN_AS_HOST_USER(TERMINAL_DOCKER_PERSIST_ACROSS_PROCESSESTERMINAL_DOCKER_ORPHAN_REAPERTERMINAL_SANDBOX_DIRTERMINAL_PERSISTENT_SHELL) container_persistentdocker_volumes docker_envdocker_extra_argsdocker_mount_cwd_to_workspacedocker_networkdocker_run_as_host_userdocker_persist_across_processesdocker_orphan_reaper sandbox_dirpersistent_shell>rautor)_is_ssh_remote_tilde_cwd auxiliary>visionapproval web_extract)get_plugin_auxiliary_taskskeyprovidermodelbase_urlryr AUXILIARY_ _PROVIDER_MODEL _BASE_URL_API_KEYr@rArBgateway_timeoutHERMES_AGENT_TIMEOUTgateway_timeout_warningHERMES_AGENT_TIMEOUT_WARNINGgateway_notify_intervalHERMES_AGENT_NOTIFY_INTERVALrestart_drain_timeoutHERMES_RESTART_DRAIN_TIMEOUTgateway_auto_continue_freshnessHERMES_AUTO_CONTINUE_FRESHNESSrCrDrErFrGr busy_input_modeHERMES_GATEWAY_BUSY_INPUT_MODEbusy_text_modeHERMES_GATEWAY_BUSY_TEXT_MODEbusy_ack_enabledHERMES_GATEWAY_BUSY_ACK_ENABLEDbusy_steer_ack_enabled%HERMES_GATEWAY_BUSY_STEER_ACK_ENABLEDtimezoneHERMES_TIMEZONEsecurityredact_secretsHERMES_REDACT_SECRETSrstrict0HERMES_MEDIA_DELIVERY_STRICTmedia_delivery_allow_dirsc#8K|]}|t|VdSr(rCr,rs r.r/r/s.5W5WUV5Wc!ff5W5W5W5W5W5Wr0HERMES_MEDIA_ALLOW_DIRStrust_recent_filesHERMES_MEDIA_TRUST_RECENT_FILEStrust_recent_files_seconds!HERMES_MEDIA_TRUST_RECENT_SECONDSplatform_connect_timeout'HERMES_GATEWAY_PLATFORM_CONNECT_TIMEOUTu. Warning: config.yaml → env bridge failed: : )filezz Gateway will fall back to .env values, which may not match your current config.yaml. Run `hermes doctor` to investigate.)apply_ipv4_preference_cfgnetwork force_ipv4rz/ Warning: IPv4 preference application failed: )print_config_warningsz% Warning: config validation failed: )warn_deprecated_cwd_env_varsz% Warning: deprecation check failed: HERMES_QUIETHERMES_EXEC_ASK)CWD_PLACEHOLDERS resolve_placeholder_terminal_cwd MESSAGING_CWDfalse>r;r=r>)configured_cwdterminal_backend messaging_cwdr home_fallback)ChannelOverriderx_BUILTIN_PLATFORM_VALUESrn HomeChannelrurq) AsyncSessionStore SessionEntry SessionStore SessionSourceSessionContextbuild_session_contextbuild_session_context_promptbuild_channel_continuity_notebuild_session_keyis_shared_multi_user_session neutralize_untrusted_inline_text)DeliveryRouter#looks_like_telegram_private_chat_id)SessionTurnLeaseRegistry)GatewayAuthorizationMixin)GatewayKanbanWatchersMixin)GatewaySlashCommandsMixin)BasePlatformAdapterEphemeralReply MessageEvent MessageType_prefix_within_utf16_limit_reply_anchor_for_eventmerge_pending_message_event utf16_len)DEFAULT_HEARTBEAT_INTERVAL_Sarm_shutdown_watchdogloop_heartbeat_foreverresolve_shutdown_watchdog_delay)%DEFAULT_GATEWAY_RESTART_DRAIN_TIMEOUTGATEWAY_FATAL_CONFIG_EXIT_CODE!GATEWAY_SERVICE_RESTART_EXIT_CODEparse_restart_drain_timeout)canonical_whatsapp_identifierexpand_whatsapp_aliasesnormalize_whatsapp_identifier)WECOM_DM_POLICYWECOM_GROUP_POLICYWECOM_ALLOW_ALL_USERS)WEIXIN_DM_POLICYWEIXIN_GROUP_POLICYWEIXIN_ALLOW_ALL_USERS)YUANBAO_DM_POLICYYUANBAO_GROUP_POLICYYUANBAO_ALLOW_ALL_USERS)NNQQ_ALLOW_ALL_USERS)WHATSAPP_DM_POLICYWHATSAPP_GROUP_POLICYWHATSAPP_ALLOW_ALL_USERScLt|diD]~\}}t|ddst|}|s5|\}}}t|ddpi}t |dp|rt j|dnd}t |dp|rt j|dnd} |d kr| d krt jd d d v} | p*|o(t j|d d v} | rt|j d cSdS)zFReturn a startup-abort reason when open policy lacks allow-all opt-in.r rFruN dm_policypairing group_policyrIGATEWAY_ALLOW_ALL_USERSr|>r;r=r>z&: open policy without allow-all opt-in) r}r_OWN_POLICY_OPEN_ENVrBrCr`rzrDrEr{) rGrNrtopen_envdm_env group_env allow_all_envrur1r3gateway_allow_allplatform_opted_ins r."_own_policy_open_startup_violationr<os%,V["%E%E%K%K%M%MII!/ 599  '++H55  +3( =$77=2 IIk " " G06E &),,,I   %''%%''  IIn % % M3<K )Y///)   %''%%''    <6#9#9 I %r  %'')*.  M -,,22448LL    .HHHHHH 4r0)_session_model_overrides _pending_one_turn_model_restores_session_reasoning_overrides_session_service_tier_overrides_pending_model_notes_last_resolved_model_queued_events_pending_turn_sidecar_notes_CONVERSATION_SCOPED_STATEc ddlm}m}m}ddlm}m} |}n#|$rw}||rtd|ntd|t}||cYd}~St|||d}~wt$r}t|||d}~wwxYw|} d} tj d} | r* t| } nZ#t t"f$rd} YnEwxYwt%| t&r,| d} t%| tr| } | 2|d } t%| tr| dkr| } |d |d |d |d |d|dt)|dpg|d| d S)u5Resolve provider credentials for gateway-created AIAgent instances. Provider is read from ``config.yaml`` ``model.provider`` (the single source of truth). ``resolve_runtime_provider()`` falls through to env var lookups internally for legacy compatibility, but the gateway does not consult environment variables for behavioral config — config.yaml is authoritative. If the primary provider fails with an authentication error, attempt to resolve credentials using the fallback provider chain from config.yaml before giving up. r)resolve_runtime_providerformat_runtime_provider_error_get_model_config) AuthErroris_rate_limited_auth_erroru;Primary provider rate-limited (429): %s — trying fallbacku4Primary provider auth failed: %s — trying fallbackNHERMES_MAX_TOKENS max_tokensmax_output_tokensryrrrequested_providerapi_moderargscredential_pool ryrrrOrPrrQrRrM)hermes_cli.runtime_providerrGrHrIhermes_cli.authrJrKrr_try_resolve_fallback_provider RuntimeErrorrFr`rarBr0r2r=r@rArq)rGrHrIrJrKruntimeauth_exc fb_configr model_cfgrM_env_mtr _runtime_mots r._resolve_runtime_agent_kwargsr^s FEEEEEEEH**,,  R R R & %h / / ] NNXZb c c c c NNQS[ \ \ \244        88BBCCQ HHH88==>>CGH"!##IJjnn011G WJJI&   JJJ  It $ $ ]]< ( ( b#   J{{#677 lC ( ( &\A-=-=%J;;y))KK ++KK ++%kk*>??KK ++;;y))W[[((.B//";;'899    s? CAB7C=B C#B<<C2DDDc ddlm}m} ||}n+#t$r}t |||d}~wwxYw|d|d|d|d|d |d t |d pg|d d S)zQResolve runtime credentials for a specific provider (e.g. from channel override).r)rGrH) requestedNryrrrOrPrrQrR)ryrrrOrPrrQrR)rTrGrHrFrWrBrq)rrGrHrXrs r.*_resolve_runtime_agent_kwargs_for_providerra sH**X>>> HHH88==>>CGH;;y))KK ++KK ++%kk*>??KK ++;;y))W[[((.B//";;'899   s  ?:?c,|r!t|sdS tt|dS#t$r!t d|dYdSwxYw)zJReturn the live credential pool for a provider id (e.g. ``custom:hyper``).NrRz1Failed to resolve credential pool for provider=%sTr)rCrDrarBrFrrr)rs r._credential_pool_for_providerrc s 3x==..00t 9#h--:M:M:O:OPPTT      ?     tt sAA(('BBc ddlm} ddl}tdz }|sdSt |d5}||pi}dddn #1swxYwYt|}|sdS|D]} ddlm }|| d| d || }t d | dp| d| d | d | d | d| d| d| dt| dpg| d| d d cS#t$r:} td| d| Yd} ~ d} ~ wwxYwn#t$rYnwxYwdS)zQAttempt to resolve credentials from the fallback_model/fallback_providers config.r)rGNr8r9r:)resolve_entry_api_keyrr)r`explicit_base_urlexplicit_api_keyz'Fallback provider resolved: %s model=%srryrOrPrrQrR) ryrrrOrPrrQrRrzFallback entry %s failed: %s)rTrGrHrrfrIrJrhermes_cli.fallback_configrerBrinforqrFrr) rG_ycfg_path_frQfb_listrcrerXfb_excs r.rVrV* sDDDDDD+ -/   4 (W - - - ),,r""(bC ) ) ) ) ) ) ) ) ) ) ) ) ) ) )$S)) 4  E LLLLLL22#ii 33&+ii &;&;%:%:5%A%A =IIj))DW[[-D-DIIg&& '{{955 ' J 7 7 ' J 7 7*1++6J*K*K ' J 7 7&{{955 V!4!4!:;;'.{{3D'E'E"YYw//         ;UYYz=R=RTZ[[[ ; @      4sj"H/H/A! H/!A%%H/(A%)H/?H/EG'$H/' H+1/H& H/&H++H// H<;H<indexcbt|ddpg}|t|kr||ndS)zReturn the per-attachment MIME for the attachment at *index*. Empty string when the platform didn't populate a per-file MIME for that slot (some adapters only set a message-level type). media_typesNr|)r}r)eventrorqs r._event_media_type_atrs\ s< %55;K!&[)9)9!9!9;u  rAr0ct||}|r|dSt|ddtjkS)aTrue if the attachment at *index* is an image. Trust the per-attachment MIME when present. Only fall back to the message-level ``PHOTO`` type when this attachment's MIME is unknown -- otherwise a document (or any non-image) uploaded alongside an image in the same message gets mis-routed as an image, base64'd into a vision content part, and the provider 400s ("Could not process image"). image/ message_typeN)rsrr}rPHOTOrrromtypes r._event_media_is_imagerzf sI ! . .E *))) 5.$ / /;3D DDr0ct||}|r|dSt|ddtjtjhvS)zGTrue if the attachment at *index* is audio (per-attachment MIME first).audio/rvN)rsrr}rVOICEAUDIOrxs r._event_media_is_audioru sO  . .E *))) 5.$ / /K4E{GX3Y YYr0ct|dd}|tjtjhvrdS|tjkp"t ||dS)zFTrue when an audio attachment should enter the automatic STT pipeline.rvNFr|)r}rr~DOCUMENTr}rsr)rrrorvs r._event_media_is_stt_inputr} s_5.$77L );+?@@@u )) C u - - 8 8 B Br0ct||}|r|dSt|ddtjkS)zGTrue if the attachment at *index* is video (per-attachment MIME first).video/rvN)rsrr}rVIDEOrxs r._event_media_is_videor sG  . .E *))) 5.$ / /;3D DDr0cg}t|ddpg}t|D]\}}t||r|d|d/t ||r|d|dYt ||r|d|d|d|dd|S) agBuild a text placeholder for media-only events so they aren't dropped. When a photo/document is queued during active processing and later dequeued, only .text is extracted. If the event has no caption, the media would be silently lost. This builds a placeholder that the vision enrichment pipeline will replace with a real description. media_urlsNz[User sent an image: rOz[User sent audio: z[User sent a video: z[User sent a file: r)r} enumeraterzrbrrr2)rrr3riurls r._build_media_placeholderr s E d339rJJ''773  * * 7 LL7777 8 8 8 8 "5! , , 7 LL4c444 5 5 5 5 "5! , , 7 LL6666 7 7 7 7 LL5s555 6 6 6 6 99U  r0 display_name agent_pathrycP|dr d|d|dSd|d|dS)ufContext note prepended to a user turn when they attach a document. Text documents (``text/*``) have their content inlined upstream by the platform adapter, so the note just confirms that and records the path. Binary documents (PDF, DOCX, XLSX, …) cannot be inlined as text. The note must tell the agent to *extract* the text itself before answering — earlier wording ("Ask the user what they'd like you to do with it") steered the model into punting back to the user, which is why attached PDFs/DOCX looked "unreadable" to the agent even though it has the tools to read them. ztext/z![The user sent a text document: 'zC'. Its content has been included below. The file is also saved at: rOz[The user sent a document: ''. It is saved at: u . Its text is not inlined here (it's a binary format such as PDF or DOCX). To read it, extract the document's text yourself — for example with the terminal tool or the ocr-and-documents skill — before answering, instead of asking the user to paste the contents.])r)rrrys r._build_document_context_noter si     8  8 8*4 8 8 8  6| 6 6  6 6 6r0secondsctt|}|dkrd}t|d\}}t|d\}}|r |d|dd|dS|d|dS)Nrr,<r}02d)r0rounddivmod)rtotalhoursremminutessecss r._format_durationr s g  E qyyt$$JE33OOMGT 322'2222222 " " " " ""r0rgc JKtjd}|dkrG dtffd }t j|d{V}t|S#t$rYnwxYw|dvrG dtffd }t j|d{V}t|S#t$rYnwxYw t j dd d d d d dt j j t j j  d{V}t j | dd{V\}}|jdkr@tt |Sn#t$rYnwxYwdS)zSBest-effort duration probe. Returns formatted MM:SS / HH:MM:SS, or None on failure.rZz.wavr%cddl}|d5}|}|pd}|t |z cdddS#1swxYwYdS)NrrbrZ)waverI getnframes getframerater1)rwfframesratergs r. _wav_durationz,_probe_audio_duration.._wav_duration s YYtT**0b]]__F??,,1D!E$KK/000000000000000000s._ogg_duration s1333333WWT]]/6777r0ffprobe-verrorz -show_entrieszformat=durationz-ofz"default=noprint_wrappers=1:nokey=1)stdoutstderrr#rr)r`rgsplitextrEr1asyncio to_threadrrFcreate_subprocess_exec subprocessPIPEwait_for communicate returncodedecoderD)rgextrrrprocr_s` r._probe_audio_durationr s7 '  4  # ) ) + +C f}}  05 0 0 0 0 0 0 !*=99999999D#D)) )    D  '''  85 8 8 8 8 8 8!*=99999999D#D)) )    D   3 tWo7H 7%*73E3J          "*4+;+;+=+=sKKKKKKKKK  ?a  #E&--//*?*?*A*A$B$BCC C       4s75A88 BB 5C CCB=F F F  session_keyc,||S)zConsume and return the full pending event for a session. Queued follow-ups must preserve their media metadata so they can re-enter the normal image/STT/document preprocessing path instead of being reduced to a placeholder string. )get_pending_message)rrs r._dequeue_pending_eventr s  & &{ 3 33r0zStop requestedzSession reset requestedz Execution timed out (inactivity)zSSE client disconnectedzGateway shutting downzGateway restartingc|sdSdt|}|t vS)z?Return True when an interrupt message is internal control flow.FrN)r2rCrDr1rE_CONTROL_INTERRUPT_MESSAGES)r normalizeds r._is_control_interrupt_messager sV u#g,,,,..446677==??J 4 44r0skill_mdc |dd}n#t$rYdSwxYw|d}|dsdS|dd}|d krdSd }|d|D]}|}|d r}|d d d }t|dkr&|d |dkr|d dvr |d d}|}n|sdS| dd dd}d d l }| dd|}| dd|d}|sd |fS||fS)uDerive the /command slug and declared frontmatter name from a SKILL.md. Matches the exact normalization used by :func:`agent.skill_commands.scan_skill_commands` so the slug here is the same string a user types after the leading ``/`` (e.g. a skill with frontmatter ``name: Stable Diffusion Image Generation`` resolves to ``stable-diffusion-image-generation`` — NOT the parent directory name, which is commonly shorter/different, e.g. ``stable-diffusion``). Using the directory name silently broke :func:`_check_unavailable_skill` for every skill whose directory name drifted from its frontmatter name (19 such skills on a standard install as of 2026-05), causing a generic "unknown command" response where a "disabled — enable with …" or "not installed — install with …" hint was expected. Returns ``(slug, declared_name)`` or ``(None, None)`` when the file can't be read or lacks a ``name:`` in its frontmatter. r9r4)r;errorsNNuz---z ---rNzname:r}rZr>"'rN-rz [^a-z0-9-]r|z-{2,}) read_textrFrrr splitlinesrDr1rrEr4r)r)rrr declared_nameliner>slug_res r._skill_slug_from_frontmatterr s&$$gi$HH zznnX&&G   e $ $z ,,w " "C Qwwz $M#))++zz|| ??7 # # **S!$$Q'--//C3xx1}}Q3r7!2!2s1v7K7K!B$iIIKKM E   z    ( (c 2 2 : :3 D DD 77="d + +D 778S$ ' ' - -c 2 2D #]""  s  (( command_namec\|dd} ddlm}ddlm}m}|}|D]f}|s|dD]9}||rt|\}} |r| s%||kr| |vr d|dccS:gdd l m } ttjj} | | d z } | r| dD]z}||rt|\}} |s#||krQ|j| }t#|j}d d |}d|d |dcS{n#t($rYnwxYwdS)uCheck if a command matches a known-but-inactive skill. Returns a helpful message if the skill exists but is disabled or only available as an optional install. Returns None if no match found. The slug for each on-disk skill is derived from its frontmatter ``name:`` (via :func:`_skill_slug_from_frontmatter`), NOT from its containing directory name — because the two can differ (e.g. directory ``stable-diffusion`` + frontmatter ``Stable Diffusion Image Generation`` yields slug ``stable-diffusion-image-generation``). Matching on directory name would miss that slug entirely and fall through to the generic "unknown command" path. rrr)_get_disabled_skill_names)get_all_skills_dirsis_excluded_skill_pathzSKILL.mdThe **zJ** skill is installed but disabled. Enable it with: `hermes skills config`)get_optional_skills_dirzoptional-skillsz official/r%zQ** skill is available but not installed. Install it with: `hermes skills install rN)rEr4tools.skills_toolragent.skill_utilsrrrfrglobrrjrrr]r^r_ relative_torqr3r2rF)rrrrrdisabled skills_dirrrrr repo_root optional_dir _declaredrelr3 install_paths r._check_unavailable_skillrN s##%%--c377J, ??????QQQQQQQQ,,...-//  J$$&& &,,Z88  ))(33&B8&L&L#m=:%%-8*C*CBBBB  =<<<<<NN**,,3: ..y;L/LMM     (..z::  ))(33">x"H"Hi:%%"/55lCCC OOE#@sxx#@#@LSSSCOSSS &      4sBF1C(FF F)(F)c4|tjkrdn|jS)uNMap a Platform enum to its config.yaml key (LOCAL→"cli", rest→enum value).cli)rxLOCALr{rRs r._platform_config_keyr s..55HNBr0ct}t|ddg}t|tsdSd|vpd|vS)zAReturn True when the standalone Teams pipeline plugin is enabled.pluginsrrFteams_pipelinezteams-pipeline)r?rr@rq)rGrs r._teams_pipeline_plugin_enabledr sP ! # #FfiB???G gt $ $u w & E*:g*EEr0cNt}|rt|StS)z)_normalize_root_model_keys)rrKrrrFrfrHrIrJrrrrLr?rMr@rAr) config_homerNr>used_canonicalrrrHrPr?rs r.r?r? s/'((K -KCN  FFFFFFFF //++ + +!/##C!N        !!## 2 +sW===2..++1rC222222222222222    LL@+ N N NCCC  ,,,,,,1m1C9N9N2V##TVWW      c4   @@@@@@((--      Jsi"< A A *B)9B B)B!!B)$B!%B))'CC-D DD-D?? E  E ct|tr|dini}t|trd|i}nt|tsi}ddlm}|d}|d|d|d|d|d|d|d|ddS) a,Translate gateway checkpoint config into ``AIAgent`` constructor args. The gateway reads raw YAML instead of ``load_config()``, so checkpoint defaults must be supplied here. Keep legacy ``checkpoints: true`` configs working while giving every gateway-created agent the same limits. checkpointsrr)DEFAULT_CONFIG max_snapshotsmax_total_size_mbmax_file_size_mb)checkpoints_enabledcheckpoint_max_snapshotscheckpoint_max_total_size_mbcheckpoint_max_file_size_mb)r@rArBrrKr)rGcp_cfgrdefaultss r._checkpoint_agent_kwargsr  s/9.F.F NVZZ r * * *BF&$V$  % %000000m,H%zz)Xi5HII$*JJ Xo6% % )/ *=!>) ) (.zz ); <( (    r0ct}t|tr|siSddlm}||}t|tr|niS)uLoad gateway config for runtime reads, expanding supported ``${VAR}`` refs. Runtime helpers should honor the same env-template expansion documented for ``config.yaml`` while still respecting tests that monkeypatch ``gateway.run._hermes_home``. Build on ``_load_gateway_config()`` rather than calling the canonical loader directly so both behaviors stay aligned. Expansion failures are intentionally NOT swallowed — silently returning the unexpanded dict would mask the very bug this helper exists to fix. rr<)r?r@rArKr=)rQr=expandeds r._load_gateway_runtime_configr sh  C c4  222222$$H!(D11 988r9r0c||n t}|di}t|tr|St|tr,|dp|dpdSdS)uRead model from config.yaml — single source of truth. Without this, temporary AIAgent instances (e.g. /compress) fall back to the hardcoded default which fails when the active provider is openai-codex. Nrrr|)r?rBr@rCrA)rGrQr[s r._resolve_gateway_modelr s&&&,@,B,BC$$I)S!!H It $ $H}}Y''G9==+A+AGRG 2r0 thread_id parent_idrrcg}t}|||fD]C}|st|}||vr||||D|S)zOrdered, de-duplicated keys for ``channel_overrides`` lookup. Matches ``resolve_channel_prompt`` semantics: exact thread/channel id first, then parent channel/forum id (Discord threads inherit parent overrides). )rcrCrerb)rrrkeysrprsks r._channel_override_lookup_keysr# soDUUDI.   XX ::    B Kr0ct|dd}|sdS||}|r|jsdS|j}t|||D]}||} | | cSdS)zReturn per-channel override for this platform/chat_id, or None. Looks up ``channel_overrides`` by ``chat_id``, then ``thread_id``, then ``parent_id`` (forum threads / child channels inherit the parent entry). r Nr)r}rBchannel_overridesr) rGrNrrrr rt overridesrovs r._get_channel_overrider; s T22I tmmH--O /"Ct1I,9 ]]3   >III  4r0cddl}|d}|r|gS ddl}|jdt jddgSn#t$rYnwxYwdS)usResolve the Hermes update command as argv parts. Tries in order: 1. ``shutil.which("hermes")`` — standard PATH lookup 2. ``sys.executable -m hermes_cli.main`` — fallback when Hermes is running from a venv/module invocation and the ``hermes`` shim is not on PATH Returns argv parts ready for quoting/joining, or ``None`` if neither works. rNhermesrLz-mzhermes_cli.main)shutilwhichimportlib.utilutil find_specr\ executablerF)r hermes_bin importlibs r._resolve_hermes_binr'X sMMMh''J|  > # #L 1 1 =ND*;< < >       4s,A AAz dict | Nonec |d}t|dkrZ|ddkrN|ddkrB|d|d|d d }t|dkr|dd vr |d|d <|Sd S)a@Parse a session key into its component parts. Session keys follow the format ``agent:main:{platform}:{chat_type}:{chat_id}[:{extra}...]``. Returns a dict with ``platform``, ``chat_type``, ``chat_id``, and optionally ``thread_id`` keys, or None if the key doesn't match. The 6th element is only returned as ``thread_id`` for chat types where it is unambiguous (``dm`` and ``thread``). For group/channel sessions the suffix may be a user_id (per-user isolation) rather than a thread_id, so we leave ``thread_id`` out to avoid mis-routing. r}rr@rZmainrrr)rN chat_typer>dmthreadrN)r1r)rr3results r._parse_session_keyr/s s   c " "E 5zzQ58w..58v3E3EaqQx   u::>>eAh*:::"'(F;  4r0evtc|dd}|dd}|dd}|dkrd|dd d S|d krb|d d }|dd }|dd}d|d|d|d|}|r |d|dz }|d z }|S|dkrddlm}||SdS)zOFormat a watch pattern event from completion_queue into a [IMPORTANT:] message.r completion session_idunknownrwatch_disabledz [IMPORTANT: rr|rO watch_matchr?output suppressedrz[IMPORTANT: Background process z matched watch pattern "z ". Command: z Matched output: z (z/ earlier matches were suppressed by rate limit)async_delegation)format_process_notificationN)rBtools.process_registryr;) r0evt_type_sid_cmd_pat_out_suprr;s r.$_format_gateway_process_notificationrC sLwwv|,,H 77< + +D 779i ( (D###7cggi447777=  wwy#&&wwx$$ww|Q'' 'd ' '# ' ' ' '!% ' '  P O$OOO OD   %%%FFFFFF**3/// 4r0 list[dict]ctg}g}|s |}n#t$rYncwxYw|dd}|dvr||n|dkr||||D]}|||S)aDrain gateway-owned watch events without spinning on requeued events. Watch events are handled by the post-turn gateway drain. Process completions are owned by their per-process watcher task, and async delegation completions are owned by ``_async_delegation_watcher``. Requeueing async events inside ``while not queue.empty()`` would make the loop non-terminating, so detach the current batch first, then requeue any events this drain does not own after the queue is empty. rr2>r6r5r:)empty get_nowaitrFrBrbput)completion_queue watch_eventsrequeuer0r=s r._drain_gateway_watch_eventsrL s "LG$$&&   "--//CC    E 776<00 8 8 8    $ $ $ $ + + + NN3   $$&&  ""S!!!! s / <<cdSr(rrr0r.rr sDr0_gateway_runner_ref history_len agent_resultresponserPc |r|S|dr||dd}t|tfddDp dvo|dk}|r dSd t|d d d St |d dpd}|dr |dkr dS|S|dkrZt |rdS|dr1|dd}dt|d ddS dS|dkrB|ds-|ds|ds dS|S)a>Normalize empty/None agent responses into user-facing messages. Consolidates the existing ``failed`` handler and adds a catch-all for the case where the agent did work (api_calls > 0) but returned no text. Fix for #18765. Also surfaces a retry hint when the agent never ran at all (api_calls == 0) for a non-interrupted, non-failed turn -- this is the silent-drop pattern observed after ``/stop`` where the next user message hits a stale generation token and returns an empty result, leaving the platform with nothing to send. (#31884) failedr unknown errorc3 K|]}|vV dSr(r)r,r error_strs r.r/z2_normalize_empty_agent_response.. s;! !  N! ! ! ! ! ! r0)rrxz too largeztoo longexceedr4002}⚠️ Session too large for the model's context window. Use /compact to compress the conversation, or /reset to start fresh.zThe request failed: N,2 Try again or use /reset to start a fresh session. api_callsr interrupteduo⚠️ Your message was interrupted before processing started (likely by a recent /stop). Please send it again.r|partialprocessing incompleteu⚠️ Processing stopped: rz . Try again.u|⚠️ Processing completed but no response was generated. This may be a transient error — try sending your message again.uj⚠️ Your message wasn't processed (the previous turn was still being cleaned up). Please send it again.)rBrCrEanyr0,_is_gateway_hidden_reasoning_incomplete_turn)rQrRrP error_detailis_context_failurer^errrWs @r._normalize_empty_agent_responserg s+$!! #''AA  %%++--  ! ! ! ! W! ! !   7y 5[2%5   )    @3|#4#4TcT#: @ @ @ L$$[!449::I && >>D  1}} 7 E E 2   I & & N""7,CDDCMS$3$MMM M P   Q  //   **   ++   7  Or0ct|tsdS|ds|drdS|dsdSt|ddpd}d|vrdSt|dpd}| p||kS) uJDetect retry-exhausted turns with hidden reasoning but no visible answer. The conversation loop returns the retry-exhaustion sentinel as BOTH ``final_response`` and ``error`` ("Codex response remained incomplete after 3 continuation attempts"), so ``final_response`` being non-empty does not mean the model produced a visible answer. Treat the turn as hidden when the error sentinel is present and ``final_response`` is either empty or merely echoes that sentinel — any genuinely different final text means the model DID answer and must be delivered. FrTr_r`rr|zremained incomplete afterfinal_response)r@rArBrCrDrE)rQ error_textris r.rcrc% s lD ) )u!!\%5%5m%D%Du   I & &u\%%gr228b99??AAJ"**:*:*<*<<<u))*:;;ArBBHHJJN  =:!==r0ct|tsdS|drdS|ds*|ds|drdS|ddurdSdS)aReturn True only when a gateway turn really completed successfully. Restart recovery uses ``resume_pending`` as a durable marker for sessions interrupted during gateway drain. A soft interrupt can still bubble out as a syntactically normal agent result with an empty final response; clearing the marker in that case loses the recovery signal and startup auto-resume has nothing to schedule. Fr_rTr`r completedTr)rQs r.'_should_clear_resume_pending_after_turnrm= s lD ) )u &&u!!\%5%5i%@%@LDTDTU\D]D]u $$--u 4r0current_resultfollowup_resultcFt|ts|St|ts|S|d}|d}t|ts|St|tr||kr|St|}||d<|S)aeCarry the outer history offset through queued follow-up drains. ``_process_message_background()`` persists transcript rows only once, after the entire in-band queued-follow-up chain returns. Each recursive ``_run_agent()`` call advances ``history_offset`` to the history it received, so without correction the outermost persistence step sees only the *last* queued turn as "new" and silently drops earlier turns from the same drain chain. Preserve the earliest (outermost) history offset so the final transcript slice still includes every queued turn that ran during the chain. r)r@rArBr0)rnrocurrent_offsetfollowup_offsetrs r.(_preserve_queued_followup_history_offsetrsQ s ot , , nd + +#''(899N%))*:;;O nc * */3''O~,M,M / " "F-F  Mr0rBasePlatformAdapter | Nonec K|dS |d{VdS#t$rBtdt |dt |jdYdSwxYw)uTBest-effort dispose for an adapter that never made it onto ``self.adapters``. The reconnect watcher in ``GatewayRunner._platform_reconnect_watcher`` constructs a fresh adapter on every retry attempt. When the connect call fails — for any of the three reasons (non-retryable error, retryable error, exception during connect) — the adapter is dropped without ever being installed, so nothing else will call its ``disconnect()``. Any resources the adapter opened in ``__init__`` (e.g. ``APIServerAdapter`` opens a SQLite ``ResponseStore`` that holds 2 fds — the db file and its WAL sidecar) stay open until garbage collection sweeps the unreachable object, which Python's cyclic GC does not do promptly for asyncio-bound objects with native handles. The cumulative leak is 2 fds × every retry at the 300s backoff cap ≈ 12 fds/hour, and the default 2560-fd ulimit is exhausted in ~12h of continuous failure, after which every open() call on the gateway raises ``OSError: [Errno 24] Too many open files`` and the gateway becomes a zombie (#37011). This helper centralises the dispose-with-suppression so the three failure paths in the reconnect watcher can all call it without each one having to know that ``disconnect()`` may itself raise on a half-constructed adapter. ``adapter`` may be ``None``: the reconnect watcher initialises ``adapter = None`` before the ``try`` so the ``except Exception`` arm can dispose a half-constructed object, and also early-returns here when ``_create_adapter()`` returned ``None``. Nz,Adapter dispose raised on unowned adapter %rrTr) disconnectrFrrrr}rrrs r._dispose_unused_adapterrxq s:   """""""""""      : GVT']]%; < <        s$AA0/A0r\attemptc>tdd|dz zztS)zCExponential reconnect backoff: 30s, 60s, 120s, ... capped at 5 min.rrZ)min_RECONNECT_BACKOFF_CAP)rys r._reconnect_backoffr~ s! rQ7Q;'(*@ A AAr0c%eZdZUdZiZeeefed<dZ eed<dZ eed<e Z eed<dZ eeed<d Zeed <d Zeed <d Zeed <d Zeed <d Zeed<d Zeed<d Zeed<dZeeed<dZeejed<dZeejed<dZeeeeeejffed<dZ ee!ed<iZ"eeeeeffed<iZ#eeeee!ffed<iZ$eeeee!ffed<iZ%eeeefed<iZ&eee'efed<iZ(eee)fed<iZ*eeefed<d Z+eed<dZ,eded<d Z-eed!<dZ.ed"ed#<d Z/eed$<dd%ee0fd&Z1dd(Z2dd)Z3d'efd*Z4e5d+z Z6d,ed-ed'efd.Z7d'eeeffd/Z8dd0Z9d-ed1ed'dfd2Z:d-ed3ed'dfd4Z;dd5Zdd9Z?dd:d;eed'dfd<Z@d'efd=ZAd'efd>ZBd d?d@ed'efdAZCd'efdBZDeEd'efdCZFeEd'efdDZGeEd'eefdEZHeEd'eefdFZIdGed'efdHZJdGed'efdIZKeLdJdKhZMdGed'efdLZNdGed'efdMZOdNZPdGed'efdOZQd'efdPZRd'efdQZSdGed'eefdRZTdGed'dfdSZUdGedTed'dfdUZVdGed'eefdVZWdGed'efdWZXddddXdGeedYeedZeeYd'e)eeYffd[ZZd\ed]ed^eYd'eYfd_Z[d`edae!d'dfdbZ\dceee!fd'dfddZ]dee^d'dfdfZ_dee^d'dfdgZ`dee^d'dfdhZadTed'dfdiZbd'efdjZcd'efdkZdd'efdlZed'efdmZfd'efdnZgd'efdoZhd'e)fdpZid'efdqZjddrZkd'efdsZlddtZmduZnddved'dfdwZod'efdxZpd'efdyZqd'efdzZrdYed{d|dee!d'dfd}ZsdYedee!d~ed|d'ed|fdZtdddYedee!d'efdZuevde!d'efdZwdYedee!d'efdZxd`ed'efdZyddeedeed'dfdZzddZ{ddZ|ddZ}ddved'dfdZ~ddddd,edeedeedeed'df dZdJddTed'dfdZd'efdZevd'e'eee!ffdZevd'efdZddddd,ed-edZeeYdeedeed'ef dZdddd,ed-edeedeed'ef dZevdd]ed'eYdzfdZevded'e)eeffdZdddJddGeedYeed]ed'eYdzfdZdYedeeYd'dfdZ ddYeed'eefdZ ddYeded'dfdZevd'edzfdZevd'efdZevd'efdZevd'efdZevd'efdZevd'efdZevd'eYfdZevd'edzfdZd'edzfdZevdae!dedzd'dfdZd'eee!ffdZd'eefdZdYed'eefdZdYedGed'e)e!eeffdZevde!d'efdZdYed'efdZevdYefdZdZdYeded'dfdZdedYed'efdZd7ed'e)eee!feffdZdTed'dfdZddZdeee!fd'dfdÄZdYeedae!dee!d'efdńZdNZdejdae!ded'dfdȄZdJdɜdae!ded'dfdʄZdae!d'dfd˄ZdZdZded'dfdτZd'efdЄZdYed'dfdфZdd҄ZddӄZd d dԜdeded'efdׄZeLhdأZdee^dedYed'dfdلZded'dfdڄZd'efdۄZdd܄Zd'efd݄Zdd'efdބZd'efd߄Z ddeee^d,eed'efdZd'efdZdZdZddddZddved'dfdZdeee!fd'dfdZÐddvefdZd'efdZŐddZƐddZd'efdZȐddZd d d ddededed'dfdZʐddZd'efdZdedddee)efd'efdZdee^ded,ed'dfdZded,ed'dfdZded,edee^d'dfdZded,ed'ee^ge=dffdZded,edee^d'dfdZdefdZevdee!d'eefdZd,ed%e!d'ee^fdZ dd,edeed'eeeeeegeffdZאded'dfdZؐd eِd ed'eefd Zded'eefd Zdd|d ed'dfdZdYed'dfdZdddedGede'eee!fdYeed'eef dZdddedGede'eee!fdYeed'eef dZdYed'e'efdZdYed'dfdZeEd'efdZdYefdZdedefdZdGed'efdZd'efdZdGeded'eefdZdGeded'efd Zded'efd!Zded'efd"Zdefd#Zd'efd$Zdߐd%ZdGe!d&ed'dfd'ZdGe!d&ed'dfd(Zd e!dGe!d)ed'dfd*Zevded'eefd+Zded'efd,Zded'efd-Zd-ed'dfd.Zd/ed0ed1ed'efd2Zd/ed0ed1efd3Z dded4ed5ed6ed'ef d7Zd'efd8Zded9ed'dfd:Zd4eded'dfd;Z dded?eed@ee'edAee'ed'dfdBZ dded?eed@ee'edAee'ed'dfdCZdGed'eYfdDZdGed'dfdEZdGed'dfdFZdGed'efdHZdGed'efdIZdGed'efdJZdGed`edGed'dfdKZdGed`edGed'dfdLZdGed`edGed'dfdMZdGed'efdNZdGed`edGed'dfdOZdPZ dGed'efdQZ d'efdRZ dGed'efdSZ dGed'efdTZ dedUed'efdVZded'efdWZdedXedGedYed'eedZdff d[ZdedXedGed&ed'eef d\Zd'eee!ffd]Z d֐d^eed'eeee!ffd_Zdddd`d,eed-eedeedaeed^eedeee!d'eeee!ffdbZevdddcd,eed-eedeedaeedeee!d'ef ddZevded'eefdeZdZeLejejejejejejejej ej!ej"ej#ej$ej%ej&ej'hZ(dאdfZ) ddiedjed7ed'dfdkZ*d'efdlZ+d'ee)eeeeffdmZ,ddndoeee)eeeefd'ee)eeeeffdpZ-dǐe.d'efdqZ/dred'dfdsZ0dtZ1d'e2j3j4fduZ5dאdvZ6ddddddwdGeedYeedZeeYdxeed]eed'ef dyZ7dzed{e'ed'efd|Z8dzed}e'ed'e)ee'effd~Z9d'e'efdZ: d֐dzeed'e)edze'effdZ;dddde'eded'dfdZ<e=dd9eded'e)ee'effdZ>deYfdZ?dedeYd'eefdZ@evdeYd'ee)eeeAffdZBded'efdZCdedeYd'eefdZDdeYd'dfdZEddved'dfdZFdeYd'dfdZGd̐ZHdZIe)ed<dZJiZKeYe)eedzfeYee!ffed<eLd'eYee!ffdZMeLd'eYee!ffdZNeLdZeYdzd'eYfdZOev dd]edeYdededeYdzd0edzdedzd'efdZPdYed'dfdZQdYed]ed^eYd'e)fdZRdYed'eYfdZSdYedeYd'dfdZTdYeded'efdZUdddYedeed'efdZVdYeded'efdZWdYededed'efdZXdYedTed'dfdZYdYed'dfdZZdYed'efdZ[dJddYedTed'efdZ\dYeded'efdZ]dee!dYededzd'dfdZ^dddYedGedededed'df dZ_dYed`eed'dfdZ`dYede'ed'dfdZadYed'e'efdZbdGedYed'eefdZcdedYeed'efdZdevded'efdZedYed'dfdZfevdae!ded'dfdÄZgdae!ded'dfdńZhdae!ded'dfdƄZidae!d'dfdDŽZjdאdȄZkd'efdɄZld'eefdʄZm dd&edede'eee!fdGd=d`edYedeed?eed'eee!ffd̄Zn dd&edede'eee!fdGed`edYedeeded?eedeedeeYdee!deed'eee!ffd҄ZodGed'eefdӄZpdGed'dfdԄZq dd&edede'eee!fdGed`edYedeeded?eedeedeeYdee!deed'eee!ffdՄZrdS( GatewayRunnerz Main gateway controller. Manages the lifecycle of all platform adapters and routes messages to/from the agent. _running_agents_ts interrupt_busy_input_mode_busy_text_mode_restart_drain_timeoutN _exit_codeF _draining_external_drain_active_restart_requested_restart_task_started_restart_detached_restart_via_service _detached_restart_helper_started_restart_command_source _stop_task _restart_task_profile_failed_platforms_systemd_watchdogr=r>r?r@rD_session_ephemeral_pin_session_vc_last_startup_restore_in_progressz asyncio.Task_loop_heartbeat_task_gateway_started_atzthreading.Event_shutdown_watchdog_done _platform_lock_takeover_on_startrGc ||n t|_ ddlm}|t t |jddn,#t $rtddYnwxYwi|_ i|_ | tj |a||_||_||_||_||_||_||_||_||_ |!|_"ddl#m$t |jj%d d }|r |dkr|d zndtM|jj'|jfd  |_(tS|j(|_*tW|j|_,d|_-d|_.t_j0|_1d|_2d|_3d|_4d|_5d|_6i|_7d|_8d|_9d|_:d|_;d|_<d|_=d|_>d|_?d|_@tjA|_Bd|_Cd|_Dd|_EtjG|_Hd|_Id|_Ji|_Ki|_Li|_Mt|_Oi|_Pi|_Qi|_Ri|_Si|_Ti|_Ui|_Vd|_Wd|_Xg|_Yg|_Zt|_\d|_]tjG|_^t|_`t|_ad|_bddlF}t|_c|G|_di|_ei|_fi|_gi|_hi|_ii|_ji|_k|l|_md|_nd|_oi|_pi|_qt|_ri|_sddlt}|ud|_v ddlwmx}|dn#t $rYnwxYw ddlymz}|}tt|dddpd}~} t t|ddd} t|ddd} | dkr| s| stdn,#t $rtddYnwxYwd|_ ddlm} m} | | |_n2#t $r%}td|Yd}~nd}~wwxYw|j ddlymz}|d pi}|d!dr|jjt|d"d#t|d$d t |d%d|jj'&n2#t $r%}td'|Yd}~nd}~wwxYw ddlymz}|d(pi}|d!drdd)lm}|t|d"d*t|d$d t |d+dt|d,d-.n2#t $r%}td/|Yd}~nd}~wwxYwdd0lm}||_i|_dd1lm}||_||_i|_t|_tjA|_d|_tjA|_d2|_dS)3Nr)set_multiplex_activerpFz#could not set multiplex-active flagTrprocess_registrybg_process_max_age_hoursr,c2|S)N)max_active_age)has_active_for_session)r_bg_max_age_secondsrs r.rz(GatewayRunner.__init__.. s$0@0W0W$71X11r0)has_active_processes_fnirZ)ensure_installed) log_failures load_config approvalsmodemanualrrtirith_enabledrra6Gateway approvals.mode=manual with no automated risk assessor (security.tirith_enabled is false and auxiliary.approval is unset): dangerous commands and execute_code scripts will BLOCK until a human approves them in chat. Enable security.tirith_enabled or configure auxiliary.approval for unattended operation.z$approvals.mode startup check skipped)AsyncSessionDB SessionDBz&SQLite session store not available: %srC auto_pruneretention_daysrVmin_interval_hoursvacuum_after_prune)rrvacuum sessions_dirz%state.db auto-maintenance skipped: %sr)maybe_auto_prune_checkpointsdelete_orphansr)rrrrz'checkpoint auto-maintenance skipped: %s PairingStore) HookRegistryr)rsrGr2rrr}rFrrradapters_profile_adapters'_warn_if_docker_media_delivery_is_risky_weakrefrefrN_load_prefill_messages_prefill_messages_load_ephemeral_system_prompt_ephemeral_system_prompt_load_reasoning_config_reasoning_config_load_service_tier _service_tier_load_show_reasoning_show_reasoning_load_busy_input_moder_load_busy_text_moder_load_restart_drain_timeoutr_load_provider_routing_provider_routing_load_fallback_model_fallback_modelr<rdefault_reset_policyrr session_storer_async_session_storer delivery_router_running _gateway_looprEvent_shutdown_event _exit_cleanly_exit_with_failure _exit_reasonrrrrrr_signal_initiated_shutdownrrrrrrD _startup_time_booted_from_restartrr threadingLock_executor_lock _executor_executor_closing_running_agentsr_active_session_leasesr  _turn_leases_turn_lease_tokens_pending_messagesrBrC&_pending_native_image_paths_by_session _busy_ack_ts_session_run_generationrr_startup_restore_queue_startup_restore_tasksr_session_sources_session_sources_max_completion_delivery_lockrc_completion_deliveries_inflight _completion_deliveries_delivered_completion_delivery_retention _agent_cache_agent_cache_lockr=r>r?r@rDrr_active_profile_name_kanban_notifier_profile_teams_pipeline_runtime_teams_pipeline_runtime_error_pending_approvals_failed_platforms_fatal_handler_tasks_update_prompt_pending itertoolsr_slash_confirm_countertools.tirith_securityrrKrrCrrDrEr _session_db hermes_staterrrB_dbmaybe_auto_prune_and_vacuumr0tools.checkpoint_managerrgateway.pairingr pairing_storepairing_stores gateway.hooksrhooks_load_voice_modes _voice_mode_recent_voice_transcripts_background_tasksrr_last_inbound_at_scale_to_zero_cooldown_until)selfrGr_bg_max_age_hours _threading _itertoolsr_load_full_config _appr_cfg _appr_mode _tirith_on _aux_approvalrre _sess_cfgr _ckpt_cfgrrrrrs @@r.__init__zGatewayRunner.__init__ s !' 2ff8V8X8X  O ? ? ? ? ? ? gdk;OQV&W&W!X!X Y Y Y Y O O O LL>L N N N N N O=? RT 44666&l400"&!!>(,(J(J(L(L%!%!!>!4466#88:: $ : : < <#88::&*&F&F&H&H#!%!!>#88:: <;;;;;# K ,.H"  ): ]>ORS>S>S  $ $Y] * K $dk%%%%%   %6d6H$I$I!-dk:: BF&}""'+/)-RT&!%',#"'+0'%*"!&$)!05-@D$%)IKK +0!2659'n..JN"'024668#566571357!>@LN3.079$ -2)16-:<#:<# DO==$'! *3)9)9&MPUU,^i^k^k-.2+ '&&&7B}}!+!2!2DF%KM-HJ)JL, BD(9;#13(,(A(A(C(C%'+$<@*>@BD*-!8:# '&&&&0&6&6q&9&9#  > > > > > >  % 0 0 0 0 0    D  P J J J J J J))++I ;IIIUXeggeegg gi=MW[\\\]]J#I{JPTUUUMX%%j%%C P P P LL?$L O O O O O P  H > > > > > > > >-~iikk::D   H H H NNCQ G G G G G G G G H   ' KNNNNNN..0044Z@@FB ==u55$(DD'*9==9I2+N+N'O'O+.y}}=QSU/V/V+W+W#IMM2F$M$MNN%)[%= E  K K K DcJJJJJJJJ K I J J J J J J**,,00??E2I}}\511 QQQQQQ,,#&y}}5Eq'I'I#J#J'*9==9Mr+R+R'S'S#' 6F(M(M#N#N&))--8KS*Q*Q&R&R   I I I LLBC H H H H H H H H I 100000)\^^9; /.....!\^^ ,0+A+A+C+CZ\&'*ee +/)++ <@!(,y{{58***s2A&A76A7;S SSB-V &V65V6 W"" X,X  XC [++ \5\\C_66 `%`  `%r%ctj|jvrdStstddS ddlm}n3#t$r&}t d|Yd}~dSd}~wwxYw ||}n3#t$r&}t d|Yd}~dSd}~wwxYw|rt ddS|j r"t d|j dSdS) uBind the Teams meeting pipeline runtime to Graph webhook ingress. No-op when the msgraph_webhook adapter isn't running or the teams_pipeline plugin isn't enabled — lets the gateway start cleanly whether or not the user has opted into the pipeline. Nz:Teams pipeline plugin is disabled; skipping runtime wiringr)bind_gateway_runtimez(Teams pipeline runtime import failed: %sz(Teams pipeline runtime wiring failed: %sz7Teams pipeline runtime bound to msgraph webhook ingressz&Teams pipeline runtime unavailable: %s) rxMSGRAPH_WEBHOOKrrrrrplugins.teams_pipeline.runtimer"rFrrir)rr"rbounds r._wire_teams_pipeline_runtimez*GatewayRunner._wire_teams_pipeline_runtimeWsS  #4= 8 8 F-//  LLU V V V F  K K K K K K K    NNEs K K K FFFFF  ((..EE    NNEs K K K FFFFF    KKQ R R R R R  /  NN82       s0A A8A33A8< B B8B33B8ctjdddkrdS|j}d|D}|sdStjdd}g}|rc t j|}t|tr d|D}n,#t$rt dd YnwxYwd }|D]A}t|}|s|d } | t vrd }nB|rdStd dS)aWarn when Docker-backed gateways lack an explicit export mount. MEDIA delivery happens in the gateway process, so paths emitted by the model must be readable from the host. A plain container-local path like `/workspace/report.txt` or `/output/report.txt` often exists only inside Docker, so users commonly need a dedicated export mount such as `host-dir:/output`. r~r|dockerNc\g|])}|tjtjtjhv'|*Sr)rxr API_SERVERWEBHOOKrs r.rzIGatewayRunner._warn_if_docker_media_delivery_is_risky..s3xxxQqQYQdfnfv@w7w7wq7w7w7wr0rcVg|]&}t|tt|'Sr)r@rCr,rs r.rzIGatewayRunner._warn_if_docker_media_delivery_is_risky..s-LLL!As9K9KLs1vvLLLr0zACould not parse TERMINAL_DOCKER_VOLUMES for gateway media warningTrF containeraFDocker backend is enabled for the messaging gateway but no explicit host-visible output mount (for example '/home/user/.hermes/cache/documents:/output') is configured. This is fine if the model already emits host-visible paths, but MEDIA file delivery can fail for container-local paths like '/workspace/...' or '/output/...'.)r`rzrDrErGget_connected_platformsrrr@rqrFrrr_DOCKER_VOLUME_SPEC_REr#r$_DOCKER_MEDIA_OUTPUT_CONTAINER_PATHSr) r connectedmessaging_platforms raw_volumesvolumesparsedhas_explicit_output_mountspecr#container_paths r.rz5GatewayRunner._warn_if_docker_media_delivery_is_riskyvs 9^R ( ( . . 0 0 6 6 8 8H D D FK7799 xx)xxx"  Fi 92>>DDFF   q qK00fd++MLLvLLLG q q q `ko ppppp q%*!  D*0066E "[[55N!EEE,0)F %  F P     s5C &C43C4cL ddlm}|dduS#t$rYdSwxYw)z3Check if the hermes-agent-setup skill is installed.r) _find_skillzhermes-agent-setupNF)tools.skill_manager_toolr;rF)rr;s r._has_setup_skillzGatewayRunner._has_setup_skillsQ  < < < < < <;344D@ @   55 s  ##zgateway_voice_mode.jsonrNrc|jd|S)z6Return a platform-namespaced key for voice mode state.r}r{)rrNrs r. _voice_keyzGatewayRunner._voice_keys.,,7,,,r0c tj|j}n$#ttjt f$ricYSwxYwt|tsiShd}i}| D]>\}}||vr t|}d|vrt d|9|||<?|S)N>alloff voice_onlyr}z}Skipping legacy unprefixed voice mode key %r during migration. Re-enable voice mode on that chat to rebuild the prefixed key.) rr_VOICE_MODE_PATHrFileNotFoundErrorJSONDecodeErrorrdr@rArrCrr)rdata valid_modesr.rrrs r.rzGatewayRunner._load_voice_modess :d3==??@@DD!4#7A   III $%% I222 !ZZ\\  MGT;&&g,,C#~~U F3KK s+.AAc |jjdd|jt j|jddS#t$r&}t d|Yd}~dSd}~wwxYw)NTr4exist_okrindentzFailed to save voice modes: %s) rEr_mkdir write_textrdumpsrrdrr)rrs r._save_voice_modeszGatewayRunner._save_voice_modess @  ! ( . .td . K K K  ! , , 4+A666      @ @ @ NN;Q ? ? ? ? ? ? ? ? ? @sAA B"BBrc,t|dd}t|tsdS|rT||t|dd}t|tr||dSdS||dS)zBUpdate an adapter's in-memory auto-TTS suppression set if present._auto_tts_disabled_chatsN_auto_tts_enabled_chatsr}r@rcrediscard)rrrrdisabled_chats enabled_chatss r._set_adapter_auto_tts_disabledz,GatewayRunner._set_adapter_auto_tts_disableds *DdKK.#..  F  ,   w ' ' '#G-FMMM--- /%%g..... / /  " "7 + + + + +r0rc,t|dd}t|tsdS|rT||t|dd}t|tr||dSdS||dS)zUpdate an adapter's per-chat auto-TTS opt-in set if present. Used for ``/voice on``/``/voice tts`` where the user explicitly wants auto-TTS even when ``voice.auto_tts`` is False globally. rUNrTrV)rrrrrYrXs r._set_adapter_auto_tts_enabledz+GatewayRunner._set_adapter_auto_tts_enableds  )BDII ---  F  +   g & & &$W.H$OON.#.. 0&&w///// 0 0  ! !' * * * * *r0cvt|dd}t|tsdSt|dd}t|dd}t|tst|tsdS ddlm}|}t |dpidd }n#t$rd }YnwxYwt|d r||_ |j d t|trL| | fd |jDt|trN| | fd |jDdSdS)aeRestore persisted /voice state into a live platform adapter. Populates three fields from config + ``self._voice_mode``: - ``_auto_tts_default``: global default from ``voice.auto_tts`` - ``_auto_tts_enabled_chats``: chats with mode ``voice_only``/``all`` - ``_auto_tts_disabled_chats``: chats with mode ``off`` rNNrTrUrrvoiceauto_ttsF_auto_tts_defaultr}c3K|]9\}}|dk | |tdV:dS)rCNrrr,rrrs r.r/zBGatewayRunner._sync_voice_mode_state_to_adapter..sX""&/c45==S^^F%;%;=CKKLL! ===""r0c3~K|]7\}}|dv ||tdV8dS)>rBrDNrbrcs r.r/zBGatewayRunner._sync_voice_mode_state_to_adapter..#s_!!&/c4000S^^F5K5K0CKKLL!0000!!r0)r}r@rxrcrKrrrBrFrr`r{clearupdaterr) rrrNrXrYr _full_cfgr`rs @r.!_sync_voice_mode_state_to_adapterz/GatewayRunner._sync_voice_mode_state_to_adapters"7J55(H--  F *DdKK)BDII .#.. z-QT7U7U  F & J J J J J J))++I $w''-222:uEE!!   & & & %    & 7/ 0 0 :(9G %N%%% nc * *   " " "  ! !""""373C3I3I3K3K"""    mS ) )     ! ! !  !!!!373C3I3I3K3K!!!       s9AC CC awaitablercK|dkr |d{VdStj|} tj|h|d{V\}}nB#tj$r0||t wxYw||vr |d{VdS||t dS)a~Wait for adapter cleanup without letting cancellation swallowing hang us. ``asyncio.wait_for`` cancels an overdue child but then waits for it to exit. An adapter close path that catches ``CancelledError`` can therefore block recovery forever. Keep ownership of the old task through its done callback, but release the runner at the deadline. rNTrF)r ensure_futurewaitCancelledErrorcanceladd_done_callbackr)rrirrdone_pendings r.#_await_adapter_cleanup_with_timeoutz1GatewayRunner._await_adapter_cleanup_with_timeout(s a<<OOOOOOO4$Y// #*<#H#H#HHHHHHHND((%    KKMMM  " "#? @ @ @   4<<JJJJJJJ4  ;<<<us A ?Bc\K|} |||d{V}|s'td|||jnddSdS#t $r0}td||jnd|Yd}~dSd}~wwxYw)uCall adapter.disconnect() defensively, swallowing any error. Used when adapter.connect() failed or raised — the adapter may have allocated partial resources (aiohttp.ClientSession, poll tasks, child subprocesses) that would otherwise leak and surface as "Unclosed client session" warnings at process exit. Must tolerate partial-init state and never raise, since callers use it inside error-handling blocks. NzITimed out after %.1fs while disconnecting %s adapter; continuing shutdownrz7Defensive %s disconnect after failed connect raised: %s) _adapter_disconnect_timeout_secsrrrvrrr{rFrr)rrrNrrlrs r._safe_adapter_disconnectz&GatewayRunner._safe_adapter_disconnectEs7799 "FF""$$gI _&.&:HNN        LLI"*"6I          sAA11 B+;%B&&B+profilerwc:K|}|rd|dnd}tj} |||d{V}|s"t d|j||n9#t$r,}t d|j||Yd}~nd}~wwxYw || |d{V} | r8t d|jtj|z |dSt d|j||dS#t$rB}t d |jtj|z ||Yd}~dSd}~wwxYw) a>Tear down one adapter on the shutdown path with bounded awaits. Both ``cancel_background_tasks()`` and ``disconnect()`` can block indefinitely when a platform's network state is half-dead (e.g. a wedged Feishu/Lark WebSocket thread waiting on I/O). An unbounded await here stalls the entire shutdown sequence past systemd's ``TimeoutStopSec``; the resulting SIGKILL skips ``atexit`` PID-file cleanup, so the next start dies with "PID file race lost" (#14128). Each await uses the existing per-adapter timeout budget (``HERMES_GATEWAY_ADAPTER_DISCONNECT_TIMEOUT``). On timeout the old task is cancelled and detached, then teardown forces forward progress; the loop never hangs even if an adapter swallows cancellation. Never raises. z (profile: )r|NuH✗ %s background-task cancel timed out after %.1fs - forcing continue%su)✗ %s background-task cancel error%s: %su✓ %s disconnected (%.2fs)%su<✗ %s disconnect timed out after %.1fs - forcing continue%su)✗ %s disconnect error after %.2fs%s: %s) rtrD monotonicrrcancel_background_tasksrrr{rFrrrvrir) rrrNrwrsuffix started_at cancelledr disconnecteds r._bounded_adapter_teardownz'GatewayRunner._bounded_adapter_teardownbs3$7799-4<)w))))"^%%  a"FF//117I ^NGV a a a LLDhnV\^_ ` ` ` ` ` ` ` ` a !%!I!I""$$g""L  3NDN$4$4z$A6 RNGV    LL; 0 0: =vq          s7AB B>"B99B>A&E*"E F7FFctjdd}|rK t|}t d|S#t $rt d|YnwxYwtS)z?Return the per-adapter disconnect timeout used during shutdown.)HERMES_GATEWAY_ADAPTER_DISCONNECT_TIMEOUTr|rz=Ignoring invalid HERMES_GATEWAY_ADAPTER_DISCONNECT_TIMEOUT=%r) r`rzrDr1maxr2rr(_ADAPTER_DISCONNECT_TIMEOUT_SECS_DEFAULTrr>rs r.rtz.GatewayRunner._adapter_disconnect_timeout_secssiCRHHNNPP  ) )**3(((    S 87A %A21A2ctjdd}|rK t|}t d|S#t $rt d|YnwxYwtS)zBReturn the per-platform connect timeout used during startup/retry.rr|rz;Ignoring invalid HERMES_GATEWAY_PLATFORM_CONNECT_TIMEOUT=%r) r`rzrDr1rr2rr&_PLATFORM_CONNECT_TIMEOUT_SECS_DEFAULTrs r._platform_connect_timeout_secsz,GatewayRunner._platform_connect_timeout_secssiA2FFLLNN  ) )**3(((    Q 65r is_reconnectrc:K|}|dkr||d{VS tj|||d{VS#tj$r!}t |jd|dd|d}~wwxYw)uConnect an adapter without allowing one platform to block others. ``is_reconnect`` is forwarded to ``adapter.connect()`` so platform adapters can distinguish a cold first boot (drop any stale server-side queue) from a watcher reconnect after a prolonged outage (preserve the queue so messages sent during the outage are delivered rather than silently dropped — #46621). rrNrz connect timed out after grr)rconnectrr TimeoutErrorr{)rrrNrrrs r._connect_adapter_with_timeoutz+GatewayRunner._connect_adapter_with_timeouts5577 a<< lCCCCCCCC C  )\::G #   >HHGHHHH  s/A**B9BBcKt|j|_ |||d{V d|_S#d|_wxYw)aTConnect one cold-start adapter with tightly scoped replace intent. The capability is visible only while this initial connect is awaited. Reconnects call ``_connect_adapter_with_timeout`` directly and adapters also default to deny, so a later network recovery can never evict a healthy token holder. NF)rr_platform_lock_takeover_allowedr)rrrNs r.%_connect_initial_adapter_with_timeoutz3GatewayRunner._connect_initial_adapter_with_timeoutsl37  13 3 / <;;GXNNNNNNNN N6;G 3 3eG 3 ; ; ; ;s A A c|jSr()rrs r.should_exit_cleanlyz!GatewayRunner.should_exit_cleanlys !!r0c|jSr()rrs r.should_exit_with_failurez&GatewayRunner.should_exit_with_failures &&r0c|jSr()rrs r. exit_reasonzGatewayRunner.exit_reasons   r0c|jSr()rrs r. exit_codezGatewayRunner.exit_codes r0sourcec t|drL|jE |j|}t|tr|r|Sn#t $rYnwxYwt |dd}d}t |ddr5|jr|j}n& ddlm }|pd}n#t $rd}YnwxYwt|t |d d t |d d| S) zUResolve the current session key for a source, honoring gateway config when available.rNrGrpFrget_active_profile_namergroup_sessions_per_userTthread_sessions_per_user)rrrw) rr_generate_session_keyr@rCrFr}rwhermes_cli.profilesrr)rrrrG_profilers r._session_key_for_sourcez%GatewayRunner._session_key_for_sourcesE 4 ) ) d.@.L "0FFvNN k3//'K'&&    x.. 6/ 7 7 $~ $!>$KKKKKK6688EIHH $$$#HHH$ $+F4Mt$T$T%,V5OQV%W%W     s#2A AAB$$ B32B3cn|jtjks |jdkrdSt |dd}|dSt |d|} |t |jt |j}n-#t$r t dd YdSwxYw|duS) z>Return whether Telegram DM topic mode is active for this chat.r,FrNrruser_idz(Failed to read Telegram topic mode stateTr) rNrxTELEGRAMr+r}is_telegram_topic_mode_enabledrCrrrFrrr)rr session_dbr>s r._telegram_topic_mode_enabledz*GatewayRunner._telegram_topic_mode_enabled s ?h/ / /63Ct3K3K5T=$77  5Z ;;  ;;FN++FN++<CC    LLCdL S S S55  d{s ;B&B0/B0r|r;c|jtjks |jdkrdS||sdSt |jpd}||jvS)zUTrue for the main Telegram DM (or General topic) when topic mode has made it a lobby.r,Fr|rNrxrr+rrCr_TELEGRAM_GENERAL_TOPIC_IDSrrtids r._is_telegram_topic_root_lobbyz+GatewayRunner._is_telegram_topic_root_lobby$sb ?h/ / /63Ct3K3K50088 5&"(b))d666r0c|jtjks |jdkrdS||sdSt |jpd}|r ||jvrdSdS)z9True for a user-created Telegram private-chat topic lane.r,Fr|Trrs r._is_telegram_topic_lanez%GatewayRunner._is_telegram_topic_lane-ss ?h/ / /63Ct3K3K50088 5&"(b)) cT===5tr0r"ct|dsi|_t|jpd}|sdSddl}|}|j|d}||z |jkrdS||j|<dS)a+Rate-limit root-DM lobby reminders to one message per cooldown window. A user who forgets multi-session mode is enabled and types several prompts in the root DM would otherwise get a reminder for every message. Cap it so the first one lands and the rest stay quiet. _telegram_lobby_reminder_tsr|TrNrF)rrrCrrDrzrB#_TELEGRAM_LOBBY_REMINDER_COOLDOWN_Srrr_timer@lasts r.$_should_send_telegram_lobby_reminderz2GatewayRunner._should_send_telegram_lobby_reminder:st:;; 2/1D ,fn*++ 4oo/33GSAA :@ @ @547(1tr0c dS)Na This main chat is reserved for system commands. To start a new Hermes chat, open the All Messages topic at the top of this bot interface and send any message there. Telegram will create a new topic for that message; each topic works as an independent Hermes session.rrs r."_telegram_topic_root_lobby_messagez0GatewayRunner._telegram_topic_root_lobby_messageNs *  r0c dS)Na0To start a new parallel Hermes chat, open the All Messages topic at the top of this bot interface and send any message there. Telegram will create a new topic for it. Each topic is an independent Hermes session. Use /new inside an existing topic only if you want to replace that topic's current session.rrs r. _telegram_topic_root_new_messagez.GatewayRunner._telegram_topic_root_new_messageWs W  r0c6||sdS dS)NzStarted a new Hermes session in this topic. Tip: for parallel work, open All Messages and send a message there to create a separate topic instead of using /new here. /new replaces the session attached to the current topic.)rrrs r._telegram_topic_new_headerz(GatewayRunner._telegram_topic_new_header`s,++F33 4 9  r0c&t|dd}||jr|jsdSt|d|}|t |jt |jt |jpd|j|jdS)zEPersist the Telegram topic -> Hermes session binding for topic lanes.rNrr|)rrrrr3)r}rrbind_telegram_topicrCrrr3)rr session_entryrs r._record_telegram_topic_bindingz,GatewayRunner._record_telegram_topic_bindingjs T=$77  V^ 6;K  FZ ;; &&''&*++,"--%1$/ '     r0rJc||sdS |||dS#t$r!td|dYdSwxYw)u4Update the topic binding to point at ``session_entry.session_id``. Telegram topic lanes persist a (chat_id, thread_id) -> session_id row so reopening a topic in a fresh process resumes the right Hermes session. When compression rotates ``session_entry.session_id`` mid-turn, the binding goes stale and the next inbound message in that topic reloads the oversized parent transcript instead of the compressed child, retriggering preflight compression — sometimes in a loop (#20470, #29712, #33414). Nz*telegram topic binding refresh failed (%s)Tr)rrrFrrr)rrrrJs r._sync_telegram_topic_bindingz*GatewayRunner._sync_telegram_topic_binding}s"++F33  F   / / F F F F F    LL(>(44V<<( 4f&,"--;M'T-M"M  4T=$77  4Z ;;  !GGFN++HHH    LL5L E E E44  4fn%%  A155##)r**g55k 2 2 8b99 %g!5!5$$$$tt 6 ts(B<<&C&%C&c ||}n#t$r|cYSwxYw||Stj||S)uApply Telegram DM topic recovery to a source for session-key purposes. ``_handle_message_with_agent`` rewrites ``source.thread_id`` via ``_recover_telegram_topic_thread_id`` *before* deriving the session key for a normal message turn (a lobby/stripped reply gets pinned to the user's last-active topic). Session-scoped command handlers like ``/model`` and ``/reasoning`` derive their override key from the raw inbound ``event.source``, which skips that recovery — so the override is stored under a different key than the next message turn reads, and the override is silently dropped on Telegram forum topics and after compression session splits (#30479). Returns a recovery-normalized copy when a rewrite applies, otherwise the original source unchanged. Always derive the override storage key from the result so storage and read use an identical key. Nr)rrF dataclassesr4)rrrs r.!_normalize_source_for_session_keyz/GatewayRunner._normalize_source_for_session_keysa( >>vFFII   MMM   M"6Y????s  ''rrr rr c F|}|s+|) ||}n#t$rd}YnwxYwt|}|r|||r|j|nd}|r7|d|}|d|d|d|d|d|dd }|drq|d%t |d|d<td |pd |||d||fStd |pd ||nTtd |pd ||jr.t|j ddndt} | dd} | rt d|| | }t|dd} | r||jrt!|jnd } t|ddrt!|jnd} t|ddrt!|jnd}t'| |j| | |}|rJ|jr|j}|jr5t/|j} | dd}|r |js|}|r|r|||| \}} |sb| drM ddlm}|| d}|r"t d|| dn#t$rYnwxYwt|dd}|_|sO||pd p|d}|r td|pd ||}n|r |r|||<||d<|| fS)uResolve model/runtime for a session. Priority (highest first): session ``/model`` → ``channel_overrides`` → global config/env (``_resolve_gateway_model(user_config)`` and default provider resolution). NrrryrrPrMrR)rryrrPrMrRzZSession model override (fast): session=%s config_model=%s -> override_model=%s provider=%sr|z[Session model override (no api_key, fallback): session=%s config_model=%s override_model=%szFNo session model override: session=%s config_model=%s override_keys=%sr)z[]z;Runtime provider supplied explicit model override: %s -> %srGrparent_chat_idrr)get_default_model_for_provideru8No model configured — defaulting to %s for provider %srBru{Empty model resolved for session=%s — recovering last-known-good model %s (config read likely returned empty; see #35314))rrFr!_rehydrate_session_model_overrider=rBrcrrrrqrr^rrir}rrCrrrrNrrra_apply_session_model_overridehermes_cli.modelsrr)rrrr resolved_session_keyrroverride_modeloverride_runtimeruntime_kwargs runtime_modelrQrrrchch_runtime_modelr _last_good _recovereds r._resolve_session_agent_runtimez,GatewayRunner._resolve_session_agent_runtimes3 +# ,(: ,'+'C'CF'K'K$$ , , ,'+$$$ ,'{33  I  2 23G H H HNbl40445IJJJhl  %\\'599N$LL44#<< 22$LL44$LL44&ll<88#+<<0A#B#B     ##I.. 8#''(9::B:W Z00;;$%67 p(.B~$((44 &'777 LLm$*E>     LLX$*EBFB_iT27799::2A2>>ei    788&**7D99  " KKM    "EdHd++  16%-3^Cc&.)))G)0d)K)KUF$%%%QU  6#3T::F)***  '## B 18%HE;1%O &&N(6'9'9'4'H'H$(11 0  , $($F$F$e^%% !E> ++J77  LLLLLL66~j7QRRKKR~j9    T#94@@  ! ('^^,@,FBGG^:>>Z]K^K^ 'NN--2J  'E ('=7.s(KKKDAqq 7J7J1a7J7J7Jr0 model_configgateway_runtimec3PK|] \}}||kV!dSr(rB)r,rrrs r.r/z?GatewayRunner._sync_session_model_from_agent..sK..041##A&&!+......r0)rz-Failed to sync gateway session model metadataTr)rr}rrr get_sessionrBrrrFr@rArBupdate_session_metarQrrr) rr3r@rrXdbrow current_model raw_configrGrs @r._sync_session_model_from_agentz,GatewayRunner._sync_session_model_from_agents; U]d.>.F Fw--  Fz488z488z488#GE3H%$P$PQQ    LKGMMOOKKK Y!%B..,,C GGG,,M00J 3=EJ///2    fd++ "6::.?#@#@#FBGGO%%#....8? ...++%(/F$ %  " ":tz&/A/A " O O O O O Y Y Y LLHSWL X X X X X X YsC#F/8*F/#C<;F/< D F/ D  A1F/>/F//&GGctxcKt|dpd} |j||d{VdS#t$r t ddYdSwxYw)uFan a normalised platform reaction event out to the HookRegistry. Adapters call this via ``set_reaction_handler`` for every platform-native reaction event they surface. The adapter-supplied ``event_name`` ("reaction:added" / "reaction:removed") becomes the hook event so user hooks subscribe with the same name scheme as the existing ``agent:*`` family. Errors never block the adapter's event loop — the hook contract is non-blocking. event_namezreaction:addedNz#[Gateway] reaction hook emit failedTr)rCrBr emitrFrrr)rrrs r._handle_reaction_eventz$GatewayRunner._handle_reaction_events..B2BCC  O*//*c22 2 2 2 2 2 2 2 2 2 O O O LL>L N N N N N N Os!A &A54A5rc:Kt|dd}|tx}|_tj||}||||jtj |d{VdS)a#React to an adapter failure after startup. If the error is retryable (e.g. network blip, DNS failure), queue the platform for background reconnection instead of giving up permanently. The notification arrives on the failing adapter's own polling task, and the disconnect inside the handler can cancel that task mid-flight: disconnect()'s current-task guard misses it because _safe_adapter_disconnect runs the close in a wrapper task. A cancelled handler dies between the fatal log and the reconnect queue, silently stranding the platform (observed 2026-07-21: telegram popped from adapters but never queued after a travel network outage). Run the real work in a detached task that adapter teardown cannot cancel. rN) r}rcrr create_task$_handle_adapter_fatal_error_detachedrerorWshield)rrtasksrs r._handle_adapter_fatal_errorz)GatewayRunner._handle_adapter_fatal_errors4d;; =03 5ED-"4#L#LW#U#UVV $ u}--- nT"""""""""""r0cVK ||d{Vn5#t$r(td|jjYnwxYw|j}t |dd}|jo4||jvo+|t |divo|duo| }|rRt d|j|jd|_ d|_ | d{VdSdS#|j}t |dd}|jo4||jvo+|t |divo|duo| }|rQt d|j|jd|_ d|_ | d{VwwxYw)zRun the fatal handler; if the platform still ends up stranded (not reconnected, not queued, not intentionally disabled), exit the gateway with failure so the service manager restarts it instead of leaving a silent partial outage.Nz/Fatal-error handling for %s raised unexpectedlyrrzp%s adapter was lost without entering the reconnection queue; exiting gateway so the service manager restarts it.z( adapter lost without reconnection queueT) _handle_adapter_fatal_error_implrFrrrNr{r}fatal_error_retryableris_setrrrstop)rrrNshutdown_eventstrandeds r.rz2GatewayRunner._handle_adapter_fatal_error_detacheds_ "77@@ @ @ @ @ @ @ @ @      A &       'H$T+All agent work the gateway must expose and drain as one total.)r$_active_cron_job_count_active_api_run_countrs r._active_work_countz GatewayRunner._active_work_counts@  % % ' '))++ ,((** + r0c` ddlm}t|S#t$rYdSwxYw)u9Count of cron jobs currently executing, from the cron scheduler's own in-flight tracking (``cron.scheduler._running_job_ids``). Cron jobs run through a standalone ``AIAgent`` on the scheduler's own thread pool (``cron/scheduler.py::run_job``), entirely outside ``self._running_agents`` — the dict every OTHER active-work check on this class (``_running_agent_count``, ``_drain_active_agents``) reads. Without this, the shutdown drain is structurally blind to in-flight cron work: it can report ``active_at_start=0`` and proceed straight to killing tool subprocesses while a cron job's terminal command is still running (#60432). Best-effort: returns 0 if the cron module can't be imported (e.g. a minimal test double for this class). r)get_running_job_ids)rr*rrF)rr*s r.r&z$GatewayRunner._active_cron_job_countsS  : : : : : :**,,-- -   11 s  --c t|ditj}t|dd}t |r%t dt |ndS#t$rYdSwxYw)a/Count API-server work that is outside ``_running_agents``. The primary API server owns the sole HTTP listener. Secondary multiplex profiles cannot create an ``api_server`` adapter because it binds a port, so only the primary registry is a supported source of this work. ractive_agent_work_countNr)r}rBrxr*rrr0rF)rrhelpers r.r'z#GatewayRunner._active_api_run_counts dJ33778KLLGW&?FFF,4V,<,<C3q#ffhh--(((! C   11 sA4A77 BBcttd|jDrdS ddlm}|dkrdSn,#t$rt ddYnwxYw ddlm}| rdS|j rdSn,#t$rt ddYnwxYwd S) anLive background work that must block a suspend (D3/F7). Backgrounded delegate_task / kanban / terminal(background=true) are NOT counted by _running_agent_count(), but suspending mid-flight loses them. Checks the runner's own tracked tasks + the process registry's running processes + any pending process-completion watchers. c36K|]}|j VdSr()rp)r,rs r.r/zHGatewayRunner._scale_to_zero_has_live_background_work..s,<<61688|<<<<<user_cfgrstzs r.#_scale_to_zero_idle_timeout_secondsz1GatewayRunner._scale_to_zero_idle_timeout_secondssDDDDDD +--H,6x,F,FPi(((DB-7D-A-AK"&&)))tC#t$$ 6gg455   CCC ))#...sBB B*)B*c$ddlm}|j}|j} t }t |t r|dnd}t |t r|dnd}t |t rlt |dtr|d}t |dtr|ddkr|d}n#t$rYnwxYw||fS)aReturn ``(max_restarts, window_seconds)`` for the auto-resume restart-loop breaker (#30719, defense-3), read from ``gateway.restart_loop_guard`` in config.yaml with the module defaults as fallback. ``max_restarts <= 0`` disables the breaker. rrestart_loop_guardrNr? max_restartswindow_seconds) rr?DEFAULT_MAX_RESTARTSDEFAULT_WINDOW_SECONDSr?r@rArBr0rF)r_rlgr@rAr:rrlgs r._restart_loop_guard_configz(GatewayRunner._restart_loop_guard_configs" 7666660 4 +--H,6x,F,FPi(((DB2> D  D c&ddlm}ddlm}m}m} |jr(d|jjDng}n#t$rg}YnwxYw |}n#t$rd}YnwxYw|||||S)u4Whether to start the idle watcher (D1/D11/§3.4(1)).rrelay_wake_url)!messaging_is_relay_only_or_absentscale_to_zero_enabled should_armc:g|]\}}t|dd|S)rFr}r,rpcs r.rz;GatewayRunner._scale_to_zero_should_arm..s.___uq"YX]A^A^____r0N)rrelay_only_or_absentwake_url) gateway.relayrIr9rJrKrLrGr rrF)rrIrJrKrLr rRs r._scale_to_zero_should_armz'GatewayRunner._scale_to_zero_should_arms000000           ;__ 5 ; ; = =____ I    III  %~''HH   HHH z))++!B!B9!M!M    s#1A AA A"" A10A1cddlm}ddlm}m} |}|sdS |jr(d|jjDng}n#t$rg}YnwxYw||} |}n#t$rd}YnwxYwt d||pd|rdnd dS#t$r t d d YdSwxYw) uLog why the idle watcher did NOT arm — but only for an OPTED-IN instance. A non-opted instance (no HERMES_SCALE_TO_ZERO stamp) not arming is the normal case and must stay silent. When the Labs stamp IS set but the watcher still didn't arm, that's the surprising case worth one INFO line so "why won't it suspend/wake?" is a log grep, not a box-dive. rrH)rJrKNcXg|]'\}}t|ddt|d|(S)rFr{rNrOs r.rzEGatewayRunner._log_scale_to_zero_not_armed_reason..:sJ!Ar"2y%887A..r0uscale-to-zero: NOT armed despite opt-in — relay_only_or_absent=%s (enabled platforms=%s), wake_url=%s. Need relay-only messaging + a registered wake URL.nonercMISSINGz.scale-to-zero: not-armed reason logging failedTr) rSrIr9rJrKrGr rrFrrirr)rrIrJrKractive relay_onlyrRs r.#_log_scale_to_zero_not_armed_reasonz1GatewayRunner._log_scale_to_zero_not_armed_reason&s 100000         Z++--G  { %)[%:%@%@%B%B     ::6BBJ )>++    KKE &!0y       Z Z Z LLITXL Y Y Y Y Y Y ZsX B11AB1 A B1A  B1/ A:9B1: B B1B  &B11&CCcddlm}||tj|jz ||S)Nr)is_idle)running_agent_countseconds_since_last_inboundidle_timeout_secondshas_live_background_work)r9r]r$rDrr<r4)rr]s r._scale_to_zero_is_idlez$GatewayRunner._scale_to_zero_is_idleTsk111111w $ 9 9 ; ;'+y{{T5J'J!%!I!I!K!K%)%Q%Q%S%S     r0ctj|_t|dddkrL |dn,#t$rt ddYnwxYwd|_dSdS) aStamp real inbound and restore lifecycle after a dormant wake. The watcher marks runtime status `draining` as it quiesces the relay, but dormancy is not the stop/restart drain path: the process remains alive and should present as running once real traffic wakes it and re-enters the gateway. Internal completion/replay events intentionally do not call this helper, so they do not keep an otherwise idle gateway awake. rrrrunningz$scale-to-zero: status restore failedTrN)rDrr}_update_runtime_statusrFrrrrrs r. _scale_to_zero_note_real_inboundz.GatewayRunner._scale_to_zero_note_real_inbound^s!%  48# > > B B T++I6666 T T T Cd SSSSS T14D . . . C BsA&A.-A.cr ddlm}n#t$rYdSwxYw|j|jS)zHReturn the connected RELAY adapter, if any (the one go_dormant targets).rrxN)gateway.platforms.baserxrFrrBRELAY)rrxs r._relay_adapter_for_dormancyz)GatewayRunner._relay_adapter_for_dormancyosV  7 7 7 7 7 7 7   44 }  000s  intervalcKtjt|dd{V|jr tj|d{V|jsdSt j|jkrI|s^|}|ut|dd}t|st d|  | dn,#t$rtddYnwxYw |}tj|r|d{Vn,#t$rtd dYnwxYwt jt#|d z|_n;#tj$rt$rtd dYnwxYw|jdSdS) u>Watch for idle and drive the relay dormant so the platform can suspend. Started ONLY when _scale_to_zero_should_arm() (opted in via the Labs HERMES_SCALE_TO_ZERO stamp + relay-only/absent messaging + a wakeUrl). On a sustained idle window it runs the DORMANT sequence (D12/F12/F14): - mark runtime status `draining` (composes with the existing state machine, §3.4(6); does NOT set _running=False), - relay adapter.go_dormant() — going_idle->ack + supervisor-preserving socket close (NOT disconnect(), NOT the run.py stop path), - deliberately NO mark_resume_pending (D13 — suspend preserves RAM). The process stays alive; the platform (Fly autostop:"suspend") suspends the now-traffic-idle machine and autostart wakes it on the wakeUrl poke, at which point the preserved reconnect supervisor re-dials and the connector drains the buffered backlog. After driving dormant we set a re-arm cooldown so a wake's drained backlog isn't immediately re-quiesced. r"N go_dormantuuscale-to-zero: gateway idle for >= %.0fs — going dormant (relay buffered, socket closed, awaiting platform suspend)drainingz!scale-to-zero: status mark failedTrz scale-to-zero: go_dormant failedgN@z%scale-to-zero watcher iteration error)rsleepr|rrDrrbrkr}rrrir<rerFrr iscoroutinerrm)rrlrrnr.s r._scale_to_zero_watcherz$GatewayRunner._scale_to_zero_watcherwst"mC$//000000000m% U$ UmH---------}F9;;!CCC2244::<<?$WlDAA  ++ Q<<>> U// ;;;; UUULL!DtLTTTTTUT'Z\\F*622%$  TTTLL!CdLSSSSST 6:Y[[3xQUCVCV5V22)    U U U Dt TTTTT UIm% U% U% U% U% Usw!F/F/4F/ F/ F/-F//DF/&D.+F/-D..F/2&EF/&F?F/F,F//5G'&G'c|jrdndS)Nrestartshutdownrrs r._status_action_labelz"GatewayRunner._status_action_labels 3CyyCr0c|jrdndS)N restarting shutting downrvrs r._status_action_gerundz#GatewayRunner._status_action_gerunds#6K||OKr0c"|jo|jdvS)N>queuesteer)rrrs r._queue_during_drain_enabledz)GatewayRunner._queue_during_drain_enableds&V4+@DV+VVr0 queued_eventrc|dSt|dd}|dSt|dd}| i}||_||vr+||g|dS|||<dS)z6Append a /queue event to the FIFO chain for a session.NrrC)r}rC setdefaultrb)rrrr pending_slot queued_eventss r. _enqueue_fifozGatewayRunner._enqueue_fifos ? Fw(;TBB   F&6==  M"/D  , & &  $ $[" 5 5 < <\ J J J J J(4L % % %r0 pending_eventcRt|dd}|s|S||}|s|S|d}|s||d||S|t|dr ||j|<n*||gd||S)aYPromote the next overflow item after the slot was drained. Called at the drain site after _dequeue_pending_event consumed (or failed to consume) the slot. If there's an overflow item: - When pending_event is None (slot was empty), return the overflow head as the new pending_event. - When pending_event already exists (slot was populated by an interrupt follow-up or similar), stage the overflow head in the slot so the NEXT recursion picks it up. Returns the (possibly updated) pending_event for drain to use. rCNrr)r}rBrrrrrh)rrrrroverflow next_queueds r._promote_queued_eventz#GatewayRunner._promote_queued_events" &6==  !  $$[11 ! ll1oo  1   k4 0 0 0     774G#H#H 5@G %k 2 2  $ $[" 5 5 < FMFYww(;TBBB_c lD ) ) (,,[99M// >>   d3331 &6== mT * * 9$((55;H 9$,22L77 EE21  L1111915M+..!%%k4888r0c|sdS ddlm}||S#t$r&}td|Yd}~dSd}~wwxYw)z@Best-effort fresh DB check before running a queued continuation.Fr GoalManagerr3z2goal continuation: active-state recheck failed: %sN)hermes_cli.goalsr is_activerFrrr)rr3rrs r._goal_still_active_for_sessionz,GatewayRunner._goal_still_active_for_session,s 5  4 4 4 4 4 4;*555??AA A    LLMs S S S55555 s#* AAA gateway_staterc ddlm}||||j|dS#t$rYdSwxYw)Nrwrite_runtime_status)rrrestart_requested active_agents)gateway.statusrrr(rF)rrrrs r.rez$GatewayRunner._update_runtime_status7s|  ; ; ; ; ; ; +'"&"9"5577            DD s ,0 >>cr ddlm}||dS#t$rYdSwxYw)u]Persist the live in-flight agent count to ``gateway_state.json``. Called at every turn boundary (a running-agent slot is claimed or released) so the dashboard ``/api/status`` readout reflects in-flight gateway turns in near-real-time. Without this the file is only rewritten on lifecycle transitions, so any ``active_agents`` read between transitions is stale (a turn could start and finish without the file ever moving). Deliberately passes ONLY ``active_agents`` — ``gateway_state`` and the other fields stay ``_UNSET`` so ``write_runtime_status``'s read-merge-write preserves the current lifecycle state (``running`` / ``draining`` / …). Passing ``gateway_state=None`` here would clobber it. Best-effort: a failed status write must never disrupt a turn. rr)rN)rrr(rF)rrs r._persist_active_agentsz$GatewayRunner._persist_active_agentsCsa   ; ; ; ; ; ; t/F/F/H/H I I I I I I    DD s $( 66c|jrdSd|_td||ddS)u)Begin external drain: stop accepting new turns, flip state. Idempotent — re-entering while already draining is a no-op beyond a best-effort status re-write. In-flight turns are NOT interrupted (the whole point is to let them finish); only NEW turns are refused. NTuExternal drain ENGAGED (.drain_request.json present) — refusing new turns; %d in-flight turn(s) will finish. Process stays up.ro)rrrir(rers r._enter_external_drainz#GatewayRunner._enter_external_draincsc  &  F&*#  M  # # % %    ##J/////r0c|jsdSd|_|js|jstddStd|ddS)uCancel external drain: revert state, re-accept new turns. Idempotent. Only reverts to ``running`` when we are actually mid-drain AND not also shutting down (a real shutdown ``_draining`` must win — never resurrect a stopping gateway to ``running``). NFugExternal drain marker cleared during shutdown — not reverting to running (shutdown takes precedence).ukExternal drain RELEASED (.drain_request.json removed) — re-accepting new turns; gateway_state -> running.rd)rrrrrirers r._exit_external_drainz"GatewayRunner._exit_external_drainws*  F&+# >   KK:    F  @    ##I.....r0?cKddlm}|jr |r)||n|nC#t j$rt$r'}t d|dYd}~nd}~wwxYwt j |d{V|jdSdS)uNBackground task: reconcile gateway accept-state with the drain marker. Polls ``.drain_request.json`` (presence-based contract, gateway/drain_control.py). Marker present -> ``_enter_external_drain``; marker absent -> ``_exit_external_drain``. The 1s cadence bounds the observe-the-marker latency the live-validation gate checks (point a). Reconciles once at startup. A marker stamped with a PRIOR instantiation epoch (one that survived a machine restart on the durable HERMES_HOME volume — NS-570) is treated as absent by ``drain_requested`` and is NOT honoured; only a marker from the current instantiation flips the gateway into drain. Best-effort: any tick error is logged and the loop continues (a transient stat() failure must not wedge the gateway). r)drain_requestedz$Drain-control watcher tick error: %sTrN) gateway.drain_controlrrrrrrrmrFrrrrp)rrlrrs r._drain_control_watcherz$GatewayRunner._drain_control_watchers :99999m * Y"?$$0..000//1111--///)    Y Y Y CSSW XXXXXXXX Y-)) ) ) ) ) ) ) )m * * * * *sAAB2BBrrrrcT ddlm}|||||dS#t$rYdSwxYw)Nrr)rNrrr)rrrF)rrNrrrrs r.rz-GatewayRunner._update_platform_runtime_statussm  ; ; ; ; ; ; !-%+            DD s  ''rJct|di|}|dS|drdSd|d<|pd|d<td|d< ||jdd|d n#t $rYnwxYwt d |j|d d |d|jdS) u"Mark a queued platform as paused — keep it in ``_failed_platforms`` but stop the reconnect watcher from hammering it. Used by ``/platform pause `` for manual operator intervention. Paused platforms are surfaced in ``/platform list`` and resumed with ``/platform resume ``. Note: the reconnect watcher does NOT auto-pause — retryable (network/DNS) failures keep retrying at the backoff cap indefinitely so a transient outage self-heals without manual intervention. rNpausedTz#auto-paused after repeated failures pause_reasoninfrru%s paused after %d consecutive failures (%s) — fix the underlying issue then run `/platform resume %s` to retry, or `hermes gateway restart` to restart the gateway.rr)r}rBr1rr{rFrr)rrNrJris r._pause_failed_platformz$GatewayRunner._pause_failed_platformst0"5599(CC < F 88H    FX%N)N^#5\\\   0 0'">2 1         D  L NDHHZ33  (.      s$B BBct|di|}|dS|dsdSd|d<|ddd|d<tj|d< ||jd dd n#t$rYnwxYwt d |jd S) uUnpause a platform — reset its attempt counter and schedule an immediate retry. Returns True if the platform was paused and is now queued; False if it wasn't paused (or wasn't in the queue). rNFrrrrrrru,%s resumed — retrying on next watcher tickT) r}rBrrDrzrr{rFrri)rrNris r._resume_paused_platformz%GatewayRunner._resume_paused_platforms t0"5599(CC <5xx!! 5X &&&Z!^--\   0 0)" 1         D  BHNSSSts7B B#"B#ctjdd}|sWt}t|ddpd}|s"tt |dddpd}|sgSt |}|s t|z }| st d|gS t|dd 5}tj|}d d d n #1swxYwYt!|t"st d |gS|S#t$$r(}t d ||gcYd }~Sd }~wwxYw) a\Load ephemeral prefill messages from config or env var. Checks HERMES_PREFILL_MESSAGES_FILE env var first, then falls back to the top-level prefill_messages_file key in ~/.hermes/config.yaml. agent.prefill_messages_file is accepted as a legacy fallback. Relative paths are resolved from ~/.hermes/. HERMES_PREFILL_MESSAGES_FILEr|prefill_messages_filer@rz#Prefill messages file not found: %srr9r:Nz3Prefill messages file must contain a JSON array: %sz+Failed to load prefill messages from %s: %s)r`rzrrCrBrr expanduser is_absoluterrfrrrIrloadr@rqrF) file_pathrQrgrPrHrs r.rz$GatewayRunner._load_prefill_messagessI,## H >H2 > .4";;===t7>>D"Dr0cBddlm}t}|||S)aLoad reasoning effort from config.yaml, respecting per-model overrides. Thin wrapper over the shared chokepoint :func:`hermes_constants.resolve_reasoning_config` (per-model override > global ``agent.reasoning_effort``; YAML boolean False = disabled). Closes #21256. Args: model: The effective model for the calling session. When empty, the config's ``model.default`` is used. r)resolve_reasoning_config)rjrr)rrrQs r.rz$GatewayRunner._load_reasoning_configis4 >=====*,,''U333r0raw_argscddl}t|pddd}|sdS |j|}n$#t $r|}YnwxYwd}g}|D] }|dkrd } ||!d ||fS) zParse `/reasoning` args into `(value, persist_global)`. `/reasoning ` is session-scoped by default. `--global` may be supplied in any position to persist the change to config.yaml. rNr|u—z--)r|FFz--globalTrN) shlexrCrDr4r1r2rbr2rE)rrrtokenspersist_global value_tokensrxs r._parse_reasoning_command_argsz+GatewayRunner._parse_reasoning_command_argszs  8>r""((**225$?? 9 " U[&&FF " " "ZZ\\FFF "  + +E ""!%##E****xx %%++--3355~EEsAA32A3rrrc|}|s+|) ||}n#t$rd}YnwxYwt|dipi}|r ||vr||S||S)uResolve reasoning effort for a session, honoring session overrides. Priority: session-scoped ``/reasoning --session`` override > per-model override (``agent.reasoning_overrides``) > global ``agent.reasoning_effort``. ``model`` should be the session's *effective* model (session ``/model`` override included) so per-model overrides track what the session actually runs — when empty, the config's ``model.default`` is used. Nr?)rrFr}r)rrrrrrs r.!_resolve_session_reasoning_configz/GatewayRunner._resolve_session_reasoning_configs +# ,(: ,'+'C'CF'K'K$$ , , ,'+$$$ ,D"@"EEK  3$8I$E$E12 2**5111  --reasoning_configc|sdSt|dsi|_||j|ddSt||j|<dS)z3Set or clear the session-scoped reasoning override.Nr?)rr?rrA)rrrs r._set_session_reasoning_overridez-GatewayRunner._set_session_reasoning_overridesm   Ft;<< 302D -  #  - 1 1+t D D D D D=ABR=S=SD -k : : :r0c|}|s+|) ||}n#t$rd}YnwxYwt|dipi}|r ||vr||S|S)uResolve the effective service tier for a session. A session-scoped /fast override wins over the config default. The override dict stores "priority" or None (explicit normal), so key presence — not value truthiness — decides whether it applies. Nr@)rrFr}r)rrrrrs r._resolve_session_service_tierz+GatewayRunner._resolve_session_service_tiers +# ,(: ,'+'C'CF'K'K$$ , , ,'+$$$ ,D"CRHHNB  3$8I$E$E12 2&&(((rrec|sdSd|jvri|_|r|j|ddS||j|<dS)zSet or clear the session-scoped /fast override. ``service_tier`` is "priority" or None (explicit normal). Pass ``clear=True`` to remove the override entirely (fall back to config). Nr@)__dict__r@r)rrrres r."_set_session_service_tier_overridez0GatewayRunner._set_session_service_tier_overridesc  F ,DM A A46D 0  M  0 4 4[$ G G G G G@LD 0 = = =r0ct}tt|dddpd}|}|r|dvrdS|dvrdSt d |dS) aLoad Priority Processing setting from config.yaml. Reads agent.service_tier from config.yaml. Accepted values mirror the CLI: "fast"/"priority"/"on" => "priority", while "normal"/"off" disables it. Returns None when unset or unsupported. r@rr|r>rCrWnormalrstandardN>r<fastpriorityrz#Unknown service_tier '%s', ignoring)rrCrrDrErr)rQr>r{s r.rz GatewayRunner._load_service_tiers+,,'#wCCCIrJJPPRR  !QQQ4 . . .:>DDFFLLNN e.00CwsI/@"MMMSQSTTZZ\\bbddD 7??7 7??7{r0ctjdd}|sTt }t t |dddpd}|dkrdS|dkrdSt}|dkrdndS)aResolve normal busy TEXT follow-up behavior. ``busy_input_mode`` is the single source of truth (default ``interrupt``). The legacy ``busy_text_mode`` knob is honored only when a user explicitly set it, so existing queue setups keep working; new installs follow ``busy_input_mode``. Returns one of ``interrupt`` | ``queue`` (``steer`` is handled upstream by ``busy_input_mode`` and maps to non-queue text handling here). rr|r rrrr}) r`rzrDrErrCrrr)legacyrQ input_modes r.rz"GatewayRunner._load_busy_text_modes:B??EEGGMMOO f.00Ci1A2NNNTRTUU[[]]cceeF [ ; W  7"88:: $//ww[@r0ctjdd}|sBt}t t |dddpd}t |}|rT|tkrI t|n8#ttf$r$t d|tYnwxYw|S)zrQr{s r.rz)GatewayRunner._load_restart_drain_timeout.si6;;AACC `.00Cgc7,CRPPPVTVWW]]__C+C00  5AAA c z*   M9   s B2C Cc@tjdd}|s9t}t|dd}|durd}n|dvrt |}|pd}hd }||vrtd |dS|S) uLoad background process notification mode from config or env var. Modes: - ``all`` — push running-output updates *and* the final message (default) - ``result`` — only the final completion message (regardless of exit code) - ``error`` — only the final message when exit code is non-zero - ``off`` — no watcher messages at all HERMES_BACKGROUND_NOTIFICATIONSr|r  background_process_notificationsFrC>Nr|rB>rBrCrr.zBUnknown background_process_notifications '%s', defaulting to 'all') r`rzrrrCrDrErr)rrQr>valids r.#_load_background_notifications_modez1GatewayRunner._load_background_notifications_modeAsy:B?? .00C#y*LMMCe||J&&3xx $$&&,,..111 u   NNT   5 r0c ddl}tdz }|rXt|d5}||pi}dddn #1swxYwY|dipiSn#t $rYnwxYwiS)z>Load OpenRouter provider routing preferences from config.yaml.rNr8r9r:provider_routing)rHrrfrIrJrBrF)rjrkrlrQs r.rz$GatewayRunner._load_provider_routing]s     #m3H   =(W5551,,r**0bC111111111111111ww1266<"< =    D  s43A=A A=AA= A!A== B  B c ddl}tdz }|rSt|d5}||pi}dddn #1swxYwYt |}|r|Sn#t $rYnwxYwdS)zLoad fallback provider chain from config.yaml. Returns the merged effective chain from ``fallback_providers`` plus any legacy ``fallback_model`` entries. ``fallback_providers`` stays first when both keys are present. rNr8r9r:)rHrrfrIrJrrF)rjrkrlrQfbs r.rz"GatewayRunner._load_fallback_modelks     #m3H   (W5551,,r**0bC111111111111111',,I    D ts43A8A A8AA8 A!A88 BBc ddl}tdz }|sd|_|jSt |d5}||pi}dddn #1swxYwYn3#t $r&tdd|jcYSwxYwt|pd|_|jS) aRe-read fallback_providers from disk for the next agent create/reuse. Cron already does this per job via ``get_fallback_chain``; the gateway previously froze ``self._fallback_model`` at process start, so a chain configured (or changed) after ``hermes gateway`` was running never reached messaging sessions even though the same process's cron jobs fell back correctly. Fixes #60955. A TRANSIENT read/parse failure (user mid-edit of config.yaml with a non-atomic write) keeps the last known-good chain instead of wiping a cached agent's working fallback for that turn. Only a successful read that genuinely lacks the key clears the chain. rNr8r9r:zRfallback_providers refresh: config.yaml read failed; keeping last known-good chainTr) rHrrfrrIrJrFrrrr)rrjrkrlrQs r._refresh_fallback_modelz%GatewayRunner._refresh_fallback_models+ (    #m3H??$$ ,'+$++h111 -Rll2&&," - - - - - - - - - - - - - - - ( ( ( LL0:>    ' ' ' '  ( 2#66>$##s:/A3A3A' A3'A++A3.A+/A33-B#"B#chainc|dSt|pg}t|ddpd}t|ddr|tjkrdStt|dgpg}||_|r|dnd|_t|ddsd|_||kr)t|dd}|r|dSdSdS)uKeep a cached agent's fallback chain aligned with current config. Skips rewrite while a cooldown is holding the agent on an already- activated fallback provider — ``restore_primary_runtime`` owns that turn-scoped lifecycle. When primary is active (or cooldown expired), replace the chain so mid-uptime ``fallback_providers`` edits take effect without requiring a gateway restart (#60955). N_rate_limited_untilrrF_fallback_chain_unavailable_fallback_keys)rqr}rDrzrr_fallback_indexre)r@r new_chainrate_limited_until old_chain unavailables r._apply_fallback_chain_to_agentz,GatewayRunner._apply_fallback_chain_to_agents = F"%% $U,A1EEJ E0% 8 8 "T^%5%555 F(92>>D"EE )09 C ! tu3U;; &$%E !  ! !!%)EtLLK $!!##### " ! $ $r0cHd|jDS)Nc,i|]\}}|tu||Sr)_AGENT_PENDING_SENTINEL)r,rr@s r.rz:GatewayRunner._snapshot_running_agents..s4   " U333 333r0)rrrs r._snapshot_running_agentsz&GatewayRunner._snapshot_running_agentss2  &*&:&@&@&B&B    r0cf ddlm}|t|ddS#t$rYdSwxYw)z:Return the configured active chat session cap, if enabled.r)resolve_max_concurrent_sessionsrGN)hermes_cli.active_sessionsrr}rF)rrs r._get_max_concurrent_sessionsz*GatewayRunner._get_max_concurrent_sessionssX  R R R R R R227443P3PQQ Q   44 s " 00c|}|dS|t|divrdStt|di}||krdSd|d|dS)zKReturn a user-facing rejection when starting a new session exceeds the cap.Nrz'Hermes is at the active session limit (r%z+). Try again when another session finishes.)rr}r)rr max_sessionsr0s r._active_session_limit_messagez+GatewayRunner._active_session_limit_messages88::  4 '$(92>> > >474):B??@@ , & &4 7l 7 7\ 7 7 7 r0c |t|divrdS||}|d|fS ddlm}|r|jr |jjnd}||d|t|dd|t|d d pd t|d d pd d  S#t $r&}td|Yd}~dSd}~wwxYw)zAClaim a cross-process active-session slot for a new gateway turn.rrNr)try_acquire_active_sessionrgateway:rGrr|r)rNrr)r3surfacerGr~z'Failed to claim active session slot: %s) r}rrrrNr{rFrr)rrrlocal_limit_messagerrNrs r._claim_active_session_slotz(GatewayRunner._claim_active_session_slots) '$(92>> > >:"@@MM  *,, ,  M M M M M M06Y6?Yv,,PYH--&-8--tXt44 (&vy"==C&vy"==C        NNDc J J J::::: sA#B C CC running_agentcH| |turdSt|dd}t|ttt fsdS|sdSt|dd} |)|5t |cdddS#1swxYwYt |S#t$rYdSwxYw)aLReturn True when *running_agent* is currently driving subagents via the ``delegate_task`` tool. Background (#30170): ``AIAgent.interrupt()`` cascades through the parent's ``_active_children`` list and calls ``interrupt()`` on every child synchronously, which aborts in-flight subagent work and produces a fallback cascade with no actionable signal. Demoting ``busy_input_mode='interrupt'`` to ``queue`` semantics whenever this helper returns True protects subagent work from conversational follow-ups while leaving the explicit ``/stop`` path (which goes through ``_interrupt_and_clear_session``) untouched. Safe-by-default: returns False on any attribute or lock error so a missing/broken parent never blocks the existing interrupt path. NF_active_children_active_children_lock)rr}r@rqrrcrrF)r childrenlocks r._agent_has_active_subagentsz)GatewayRunner._agent_has_active_subagentss "  M5L$L$L5=*>****************>> !   55 s6BA9, B9A==BA=B B! B!cLKt|dd}|r|dS tj|j||d{V}nA#tt f$rYdSt $r!td|dYdSwxYw|sdSt|dd}|dSt|d|} tj|j t|d{V}t|S#tt f$rYdSt $r!td |dYdSwxYw) uReturn True when a compression lock is held for this session's id. Context compression is interrupt-protected (#23975) but gateway ``interrupt`` busy-input mode can still start a follow-up turn against the pre-rotation parent while compression is mid-flight, producing orphaned compression siblings (#56391). Callers demote interrupt to queue when this returns True. Both blocking sources — the ``session_store`` lock + JSON load, and the SQLite ``get_compression_lock_holder`` SELECT — are offloaded to a worker thread so a large state.db never freezes the event loop (#5). rNFzCompression in-flight check failed while reading session %s; treating compression as active to avoid interrupting a possible parent-session rotationTrrrzCompression in-flight check failed while reading lock holder for session %s; treating compression as active to avoid interrupting a possible parent-session rotation) r}rr#_lookup_session_id_under_store_lockAttributeErrorr=rFrrget_compression_lock_holderrCr)rrrr3rraw_dbholders r."_session_has_compression_in_flightz0GatewayRunner._session_has_compression_in_flight&s ot<<  m35 &08-  JJ *   55    NN*    44  5T=$77  5UJ77 ",2C OOF<<  *   55    NNB    44 s-!=A;&A;:A;);C%%D#9&D#"D#c|j5||j|}dddn #1swxYwY|t |ddndS)zISync helper run in the thread pool: read session_id under the store lock.Nr3)_lock_ensure_loaded_locked_entriesrBr})rrrcs r.rz1GatewayRunner._lookup_session_id_under_store_lock\s  < <  / / 1 1 1!*..{;;E < < < < < < < < < < < < < < <6;5FwulD111DPs/AA A rrc||j}|sdSt|dd}t|tr||nd}|t|ddt jksQ|jt jks|T4R4R\<##K000X\   Hnd 3 3{7H H H![%666GHlD99::7GE<66777 () -1AA      F   ['  : :d>Z Z Z NN\,    F ;w77777r0c K||jsQtd|jj|jj|jjr|jjjnd|dS|jr9| |j}|sdS| |}| |j|}| r/| ||d|d}nd|d}||jj||jjt"jkr|jjdkr|jjr|n.|jjt"jkr|jjrdn|j| d{VdS d d lm}||rO|jpd }hd } hd} d} d } || vr|j} n'|| vr|j} n|dvr |j} d} n |dvr |j} d} | | |jurdnd} d| }| r|d| }||_| |d{V}td|| | | |j}|rs|rq||\}}|rW| |}||jj||| |j| d{VdSn-#t>$r td|dYnwxYw| |j}|sdStA|ddrdS|j!"|}|j#}tA|dd}|j$tJj&kr|dkr|dkrdS|dko|'|}|rtd |d}|dko|(|d{V}|rtd!|d}d}d}|dkr|jpd }|oA|j$tJj&ko,|j) o$|j* o|duo|tVuotY|d}|rY t[|.|}n5#t>$r(}td"||d}Yd}~nd}~wwxYw|sd}n|dkr|j$tJj&kr|j)s|j*s||tVurtA|d#ddurtY|d$rr t[|/|jpd }n5#t>$r(}td%||d}Yd}~nd}~wwxYw|s|s| |||dk}|dk}|dko|} |dkr|s|r|tVur |j}!tA|d&dpg}"|0|r0|1|||j|jpd d'(d{V\}!}#n|!s|"rte|}!|3|!n#t>$rYnwxYwthj5"d)d*d*k}$|$st6d+|dSd,}%toj7}&|j8"|d }'|&|'z |%krdSd d-l9m:}(tw|jj})|rthj5"d.}*|*)|*d/v}+n't[|(ty|)d0d}+|+st6d1|dS|&|j8|<g},t[|(tytw|jjd2d}-|-r|r|tVur |=}.|."d3d }/|."d4d }0|."d5}1|j>"|d }2|2r3t|&|2z d6z }3|3d kr|,@|3d7|0r|,@d8|/d|0|1r|,@d9|1n#t>$rYnwxYw|,rd:d;A|,d<nd }4|rd=|4d>}n.| rd?|4d@}n%|r |rdA|4dB}n|r |rdC|4dB}n|rdD|4dE}ndF|4dG} d dHlBmC}5mD}6mE}7mF}8ty}9|7|9|5s5|rd}:n |rd}:n| rd$}:nd}:|dI|6|:}|8tdJz |5n2#t>$r%};t6dK|;Yd};~;nd};~;wwxYw| |}| |j|} ||jj||jjt"jkr|jjdkr|jjr|n.|jjt"jkr|jjrdn|j| d{Vn2#t>$r%}👍yokr=okayapproveconfirm>👎nnodenyrnreject>approve alwaysalwaysalways approver<>approve sessionsession approvesessionr@r4r9r%rNzz"Busy ack suppressed for session %sr{rr>r;r<r=r>rz(Busy steer ack suppressed for session %sbusy_ack_detailapi_call_countmax_iterations current_toolrz min elapsed iteration z running:  (rryu⏩ Steered into current runz0. Your message arrives after the next tool call.u↪ Redirected current runz$. I'll adjust using your correction.u⏳ Subagent workinguR — your message is queued for when it finishes (use /stop to cancel everything).u⏳ Compressing contextu⏳ Queued for the next turnz.. I'll respond once the current task finishes.u⚡ Interrupting current taskz'. I'll respond to your message shortly.)BUSY_INPUT_FLAGbusy_input_hint_gatewayis_seen mark_seenrr8z.Failed to apply busy-input onboarding hint: %szFailed to send busy-ack: %s)H_is_user_authorizedrrrr user_namerNr{rr#r_thread_metadata_for_sourcerr&r{_send_with_retryrrxrr+r message_idtools.approvalr/rrDrE_handle_approve_command_handle_deny_commandri_unwrap_ephemeralrFr}rrBrrvrr$rrrrqrrrr~rC_pending_event_audio_paths"_transcribe_and_echo_pending_voicerrr`rarrrDrrrrr?get_activity_summaryrr0rbr2agent.onboardingrLrMrNrOr)=rrrrr reply_anchor thread_metarr/ _raw_text_approve_words _deny_words_approval_handler_normalized_args_verb_synth_reply_adapter_text_eph_ttl_anchorr effective_moderdemoted_for_subagentsdemoted_for_compressionsteered redirected steer_text can_steerr is_queue_mode is_steer_modeis_redirect_mode_interrupt_text _media_urlsrr_BUSY_ACK_COOLDOWNr@last_ackrr steer_ack_envsteer_ack_enabled status_partsbusy_ack_detail_enabledsummary iterationmax_iterrIstart_ts elapsed_min status_detailrLrMrNrO _user_cfg _hint_mode_onb_errrs= r.#_handle_active_session_busy_messagez1GatewayRunner._handle_active_session_busy_messagesh '' 55  NN8 $ &/4|/DS %++)    4 > ..u|<>L::5<VVK//11 x44[%HHHy)C)C)E)EyyywD,F,F,H,Hwww** ,|,0AAA .$66 .7!L#(,"78;L"L"LQVQ]Qg"L$$mrm}$+         4.4  < < < < < <$$[11, "Z-24466<<>> !Y!Y!YMMM $(!#% ..(,(D%%+--(,(A%%"PPP(,(D%'/$$"SSS(,(D%'0$$0*;d>Z)Z)ZII`fE([[F'@$*!?!?-=!?!?!'EJ#4#4U#;#;;;;;;;FKKV#U,< $77 EEH F *2*D*DV*L*Lx &*&B&B5&I&IG"*";";(- (<(-)0)-)I)I%,X_)`)` #<##  4    NN3d       **5<88 5 5*e , , 5,00== . '8+FF  +"2 2 2'))'))5 k ) @00??  ! % KKJ    %N k ) K==kJJJJJJJJ  # % KKD    %N W $ $**1133J4&+*::4((4))4"- 4 ")@@ 4 M733  $$"=#6#6z#B#BCCGG $$$NN#Lk[^___#GGGGGG$ )!( k ) )"k&666$7%7)%<<< 'GOOSWWW z22X #!-"8"8%*:J9Q9Q9S9S"T"TUU  # # #K[Z]^^^"  #& Ez E  0 0e D D D&'1 &'1 )[8GZ k ) ) * *%<<< "'*%e\4@@FB 22599 F/3/V/V  (b$: 0W00******&OQQ)F[F&>u&E&EO''8888     :>>*KVTTZZ\\`ff  LL={ K K K4  ikk$((a88 >. . .4BBBBBB+EL,ABB  JNN+RSSM($1$7$7$9$9$?$?$A$AE_$_!!$(++,..$0 %%!%  GUUUt),+&  "& # #$&&$U\%:;;!   # #  # } Ne9e9e '<<>>#KK(8!<< ";;'7;;&{{>:: 266{AFFJ"%sX~&;"<">lc K}d d dtddf fd }jsdkrdkr|d|dfS|d|dkr|dfSt j|z}js(srt j|kr||t j d d{Vjs(sr)t j|k|t jpAt p t }|d||fS) NrFrr%cBtj} } } }|s|ks|ks|ks |z dkr d||||dSdS)Nrro)rget_running_looprDr$r&r're) rr@r0 cron_count api_countlast_active_countlast_api_countlast_cron_countlast_status_atrs r._maybe_update_statusz@GatewayRunner._drain_active_agents.._maybe_update_statusGs*,,1133C4466L4466J2244I %#44400...(S00++J777$0!",!*!$ 10r0rTr皙?F) rr$r&r'rrrrrDrp) rrsnapshotrdeadline timed_outrrrrs ` @@@@r._drain_active_agentsz"GatewayRunner._drain_active_agents@su0022 557755773355 % % % % % % % % % % % % %2# #1(<(<STATAT t , , , ,U? "4(((( a<<T> !+--2244w>$ %..00 %--// % (**//11H<< " " "-$$ $ $ $ $ $ $ $$ %..00 %--// % (**//11H<< % & & 2D//1122 2D..0011  4((((""r0c8t|jD]r\}}|tur ||t d|A#t$r%}t d|Yd}~kd}~wwxYwdS)Nz8Interrupted running agent for session %s during shutdownz-Failed interrupting agent during shutdown: %s)rqrrrrrrrrF)rrJrr@rs r._interrupt_running_agentsz'GatewayRunner._interrupt_running_agents{s"&t';'A'A'C'C"D"D Q Q K/// Q''' WYdeeee Q Q Q LaPPPPPPPP Q  Q Qs0A(( B2BBc : K|}|jr|jnd}|jrdnd}|jrdnd}d|d|}t}|D]}d} t |ddS|jd{V|jj |} | rt | d dnd}n3#t$r&} t d || Yd} ~ nd} ~ wwxYw|| |}|(|jj} t!|j} |j} n7t'|}|s|d } |d } | d } | | | rt!| ndf}||vr2 t)| }|j |}|s`|jj |}|$|jstd| |t |ddnd}|k|i |jj}t!|j}|jrt!|jnd}|||f|krt |dd}n#t$rYnwxYw||| | |t |ddnd||}|| ||d{V}|At |dddur.t d| | t |dd||td| | #t$r(} t d| | | Yd} ~ d} ~ wwxYw|jr|t ddS ddlm}|rtddSn2#t$r%} t d| Yd} ~ nd} ~ wwxYwt?|j D]\}}|j!|}|r|js*|jj |}|(|js!td|js|jt!|j|jrt!|jndf}||vr |||j|j| }|r1|t!|j||d{V}n.|t!|j|d{V}|Kt |dddur8t d!|j|jt |dd||td"|j|j#t$r2} t d!|j|j| Yd} ~ d} ~ wwxYwdS)#u4Send shutdown/restart notifications to active chats and home channels. Called at the very start of stop() — adapters are still connected so messages can be delivered. Best-effort: individual send failures are logged and swallowed so they never block the shutdown sequence. NryrzzpYour current task will be interrupted. Send any message after restart and I'll try to resume where you left off.z&Your current task will be interrupted.u⚠️ Gateway  — roriginz>Failed to load session origin for shutdown notification %s: %srNrrz^Shutdown notification suppressed for active session: %s has gateway_restart_notification=falserTr+r+reply_to_message_idrrrTFz1Failed to send shutdown notification to %s:%s: %srsend returned success=Falsez/Sent shutdown notification to active chat %s:%sz@Skipping home-channel shutdown notifications for in-chat restartr)drain_notification_suppressedzWHome-channel shutdown broadcast suppressed by drain marker (suppress_notification=true)z.drain_notification_suppressed check failed: %sz\Shutdown notification suppressed for home channel: %s has gateway_restart_notification=falserwz>Failed to send shutdown notification to home channel %s:%s: %sz0Sent shutdown notification to home channel %s:%s)"rrrrcr}async_session_store_ensure_loadedrrrBrFrrr_get_cached_session_sourcerNr{rCrrr/rxrrGr gateway_restart_notificationri_thread_metadata_for_targetrrerrrqrget_home_channel)rrYrestart_sourceactionhintr\notifiedrrrcr platform_strrr_parsed dedup_keyrNrrrrestart_platformrestart_chat_idrestart_thread_idr~r.rr6s r.#_notify_active_sessions_of_shutdownz1GatewayRunner._notify_active_sessions_of_shutdowns..009=9PZ55VZ!%!8Mo& : X X: 433T338;![ [ KF 4$77C2AACCCCCCCCC .7;;KHHE?DNWUHd;;;$F    T ~88EE!%4 fn--", -[99&z2 !),#KK 44 &w)0UIQUVIH$$5 #L11-++H55#{488BB +L4]+KKx$MSM_gflD&I&I&Iei#&.>3M+9+B+H(*-n.D*E*EM[Me,oC0H,I,I,Iko),o?PQU^^^29.,X\2]2]/$ ;;DJDVgfk4@@@\`(;# < '||GS8|LLLLLLLL%'&)T*J*Je*S*SLLK$1NOO   Y''' E '    G '1   " ~'A LL[ \ \ \ F N K K K K K K,,..  3    N N N LLI1 M M M M M M M M N"&dm&9&9&;&;!>L' 0Y' rN!T\):):SWSa5AL>:L>AI,+L>, I96L>8I99BL> 1L>> M0M++M0*O O5O00O5CW;W X&'XXrc jK|D]} t|dd}t|dd}t|r_t|trJ|rHt|dd}t|r ||n#t $rYnwxYw||n2#t $r%}t d|Yd}~nd}~wwxYw ddlm }|dt|ddd d n#t $rYnwxYw| |d d{VdS)N_flush_messages_to_session_db_session_messages)_drop_trailing_empty_response_scaffoldingz$Shutdown transcript flush failed: %sr invoke_hookon_session_finalizer3rrur3rNrJzshutdown finalizer) valuesr}rr@rqrFrrrhermes_cli.pluginsr!_cleanup_agent_resources_off_loop)rrr@_flushr_strip_e _invoke_hooks r._finalize_shutdown_agentsz'GatewayRunner._finalize_shutdown_agentsLs"))++1 1 E  I (GNN$+E3F$M$M!F## . 3Dd(K(K .Pa . %JDF ''!!"F#45555(!!! D!F,--- I I I CRHHHHHHHH I JJJJJJ )&ulDAA&%      8829        _1 1 sNA(B, BB, BB,BB,, C6CC$D DD executor_taskc~|dS||rdS|r|j||urdSdS)aOnly emit the heartbeat while this task still owns the live run. Guards against a stale ``running: delegate_task`` heartbeat outliving the run that started it: stop once the executor finishes, the agent is gone, or the session key has been rebound to a different live agent (e.g. the user sent ``/new`` and a fresh agent took the slot mid-run, #12029). NFT)rprrB)rrr@rs r.&_should_emit_long_running_notificationz4GatewayRunner._should_emit_long_running_notificationsW =5  $););)=)= $5  4/33K@@MM5tr0rrcdfd }tj|}tdd}|t}|_||||jdS)a}Clean up ``agent`` only after its executor future has finished. A timed-out executor call keeps running in its worker thread. Closing the agent before that thread exits can tear down clients or providers it is still using. Keep a strong task reference and wait for the real future before invoking the normal bounded, off-loop cleanup path. r%NcK tjd{VnL#tj$rYdSt$r.}tdrddnd|Yd}~nd}~wwxYwd{VdS)Nz2Deferred agent worker%s finished with an error: %srKryr|r)rrrmrFrrrr)rr@rrrs r._cleanup_when_donezPGatewayRunner._defer_agent_cleanup_until_future_done.._cleanup_when_dones nV,,,,,,,,,,)       H'.6OOOOOB  888PP P P P P P P P P Ps A) A)$A$$A)_deferred_agent_cleanup_tasksr%N)rrr}rcrrerorW)rrr@rrrrs```` r.&_defer_agent_cleanup_until_future_donez4GatewayRunner._defer_agent_cleanup_until_future_dones Q Q Q Q Q Q Q Q Q"#5#5#7#788=tDD =EEE16D . $ u}-----r0rcK|dS|ds|dkr d|_n#t$rYnwxYw tj||j||jd{VdS#tj$r-t d|rd|dnd |jYdSt$r/}t d |rd|dnd |Yd}~dSd}~wwxYw) uRun _cleanup_agent_resources in a worker thread with a bounded wait. Safe to await from coroutines on the gateway event loop: a slow or wedged teardown (memory provider IO, subprocess close) can no longer block message processing. On timeout the await is cancelled and the worker thread is left to finish (or leak) on its own — the caller proceeds regardless, exactly as the /new reset path does (#35994). Nrusession expiryFrzAgent resource cleanup%s exceeded %ss; proceeding without blocking the event loop (the worker thread is left to finish on its own). (#53175)rKryr|z,Agent resource cleanup%s failed: %s (#53175)) r_end_session_on_closerFrr_run_in_executor_with_context_cleanup_agent_resources_CLEANUP_TIMEOUT_Srrr)rr@r cleanup_excs r.rz/GatewayRunner._cleanup_agent_resources_off_loops = F   j ) ) W8H-H-H .3++     "2215/           #    NN($+2W'           NN>#*2W          s)+ 88:A888C+3 C+<$C&&C+c|dS t|drPt|dd}t|tr||n|n#t $rYnwxYw t|dr|n#t $rYnwxYw ddlm}|dS#t $rYdSwxYw)zGatewayRunner._suspend_stuck_loop_sessions..Hs*VVVDAqa4;U6U6Ua6U6U6Ur0TrZu_Auto-suspended stuck session %s (active across %d consecutive restarts — likely a stuck loop)r)rrrrfrrrFrrrrB suspendedrr_saver )rrrgrr stuck_keysrrcs` r._suspend_stuck_loop_sessionsz*GatewayRunner._suspend_stuck_loop_sessions5s  d33{{}} 1 TZ 0 011FF   11  VVVVFLLNNVVV %  K *377 DD&*EONINNH#VK%8        "((****      KK4K ( ( ( (    D sH"A AAAC C+*C+1D DDD33 E?Ec*ddl}t|jz }|sdS |j|}||vr1||=|rt ||ddS|ddSdS#t$rYdSwxYw)zClear the restart-failure counter for a session that completed OK. Called after a successful agent turn to signal the loop is broken. rNrMTr) rrrrfrrr%r rF)rrrrgrs r._clear_restart_failure_countz*GatewayRunner._clear_restart_failure_countfs  d33{{}}  F TZ 0 011Ff$$;'1%dF4@@@@@@KK4K00000 %$     DD s=B*B BBc Kddl}ddl}t}|stddS|jrdSd|_t j}ttt|ddpddzd}tj dkrddl }ddlm}m}g|d d } |d } t j} | d dt-t.jj} tj} t-| d p| dz }|dz dz }|rt;|| d <t;| t;|g}| dr|| dt j tB"|| d<| d| t;|t;|g| } |j#|f|j$|j$| d|n#tJ$r |#||j$|j$| |ns#tJ$rf}t|dd}||n|j&}|dnd}t'dt j()| ||Yd}~nd}~wwxYwYnwxYwdSd d|D}dtU|d|d|d}t j} | d d|+d}|r*|#|dd |g|j$|j$| d!dS|#dd |g|j$|j$| d!dS)"Nrz4Could not locate hermes binary for detached /restartTrrr#rU)&windows_detach_flags_without_breakawaywindows_detach_popen_kwargsrrtu import os, subprocess, sys, time from hermes_cli._subprocess_compat import windows_detach_flags_without_breakaway pid = int(sys.argv[1]) restart_after_s = float(sys.argv[2]) cmd = sys.argv[3:] deadline = time.monotonic() + restart_after_s def _alive(p): # On Windows, os.kill(pid, 0) is NOT a no-op — it maps to # GenerateConsoleCtrlEvent(0, pid) (bpo-14484). Use the # Win32 handle-based existence check instead. if os.name == 'nt': import ctypes k32 = ctypes.windll.kernel32 k32.OpenProcess.restype = ctypes.c_void_p k32.WaitForSingleObject.restype = ctypes.c_uint k32.GetLastError.restype = ctypes.c_uint h = k32.OpenProcess(0x1000 | 0x100000, False, int(p)) if not h: return k32.GetLastError() != 87 try: return k32.WaitForSingleObject(h, 0) == 0x102 finally: k32.CloseHandle(h) try: os.kill(int(p), 0) return True except ProcessLookupError: return False except PermissionError: return True except OSError: return False while time.monotonic() < deadline: if not _alive(pid): break time.sleep(0.2) subprocess.Popen( cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, creationflags=windows_detach_flags_without_breakaway(), ) r"rVrWrXrYr[-crrenv)rrr creationflagswinerrorerrnozDetached restart watcher was not started after the no-breakaway retry (%s; %s=%r). The gateway will not be respawned by this restart attempt.rNc3>K|]}tj|VdSr()rquoter+s r.r/zAGatewayRunner._launch_detached_restart_command..s,@@Tu{4((@@@@@@r0zdeadline=$(( $(date +%s) + z )); while kill -0 zC 2>/dev/null && [ $(date +%s) -lt $deadline ]; do sleep 0.2; done; z gateway restartsetsidbash-lc)rrrstart_new_session),rrr'rrrr`getpidrr1r}r\rNtextwraphermes_cli._subprocess_compatrrdedentrDracopyrrr]r^r_r$rBrfrCrbrlr2rArmPopenDEVNULLrdrrrgbasenamer0r )rrr hermes_cmd current_pidrestart_after_srrrcmd_argvwatcher watcher_envrnwatcher_pythonrqrtrx watcher_argvrrr error_fieldr shell_cmd setsid_bins r. _launch_detached_restart_commandz.GatewayRunner._launch_detached_restart_command{s (**   LLO P P P F  0  F04-ikk eGD2JC$P$P$WTWXX[^^`cdd <7 " " OOO         ;:Y: :Hoo-//^egg_ `*//++K OO-t 4 4 4>>1133:AL!^NKOOM::SlV>STTH$u,>M##%% W-0]] M*!,//]1C1CD ??<00A%%k,&?@@@,.JOODMM**> % %( % % % % % joo'' )4000\\(++     VUI6!)!)"&          *!)!)"&      s=$I-- L8,J%$L% L/AL LLLLc |tjdkstjdsdS ddl}ddl|d}|d|rsdS ddlm }|n#t$rdYnwxYwtj }fd }|g}|d g}t||krg}d} nt||krd g}d } ndStj} d |d | d| d| d| } d|dd} |g|dd| dd| jjdt$d||rdnddS#t$r&} t$d| Yd} ~ dSd} ~ wwxYw)aBest-effort helper to bypass systemd's automatic restart delay. For planned in-chat restarts, the gateway exits cleanly so systemd does not record a failure. However, units with RestartSteps still count automatic restarts and can delay repeated /restart tests. A transient user service survives our cgroup teardown and explicitly starts the gateway as soon as this PID exits, while the unit keeps its normal backoff for real crash loops. linux INVOCATION_IDNrz systemd-run systemctl)get_service_namehermes-gatewayc g|dddddd}|jpdS#t$rYdSwxYw)Nshowz--property=MainPIDz--valueTr)capture_outputrrr|)runrrDrF) scope_flagsout service_namerr s r. _query_pidzBGatewayRunner._launch_systemd_restart_shortcut.._query_pid[s$..":[:&:,:-:/8:'+$)C  J,"33555 22s>A AAz--userzsystemctl --userzwhile kill -0 z" 2>/dev/null; do sleep 0.2; done; z reset-failed ; z restart z-planned-restart-rrz --collectz--unitz/bin/shrT)rrrzALaunched systemd planned-restart helper for %s (pid=%s, scope=%s)rarz3Failed to launch systemd planned-restart helper: %s)r\rNr`rarBrrr hermes_cli.gatewayrrFrrCrrr4rrrrirr)rr systemd_runrrr system_piduser_pidrsystemctl_scope service_argr unit_namerrrr s @@@r. _launch_systemd_restart_shortcutz.GatewayRunner._launch_systemd_restart_shortcut4s <7 " ""*..*I*I " FP S MMM     ,,}55K [11I i  0??????//11  0 0 0/  0)++K       $BJ!z8*--H;:-- "-[!!X--'j "4 +l33K;;;";;2=;;";;-8;;  (GG+GGOOPSUXYYI               ")!)"&     KKS%38        S S S LLNPQ R R R R R R R R R SsC6F /B?F B F BA%F 6BF F;F66F;detached via_servicer"r#cjrdSd___d_dfd }t j|_dS)NFTr%cKrN d{Vn2#t$r%}td|Yd}~nd}~wwxYwt jdd{Vdd{VdS)Nz4Failed to launch detached gateway restart helper: %s皙?Trtdetached_restartservice_restart)r rFrrrrpr)rr"rr#s r. _run_restartz3GatewayRunner.request_restart.._run_restarts \\??AAAAAAAAAA \\\LL!WYZ[[[[[[[[\-%% % % % % % % %))D8U`)aa a a a a a a a a as" AA  Ar)rrrrrrr)rr"r#r*s``` r.request_restartzGatewayRunner.request_restarts  % 5"&!)$/!%)" b b b b b b b b*%0@@tr0>rLrMrestart_interruptedcK ||d{Vt|di}t|tr||nd}|t j|d{V|j|tur| |dSdS#|j|tur| |wwxYw)aDispatch one synthetic startup resume and wait for its agent turn. ``BasePlatformAdapter.handle_message()`` returns after it installs the adapter-level guard and spawns the background processing task. Startup restore needs a stronger boundary: inbound messages must stay queued until the resumed agent turn itself has finished, otherwise a user message can race the restore turn immediately after ``handle_message`` returns. N_session_tasks) handle_messager}r@rArBrrrr_release_running_agent_state)rrrrr session_tasksrs r._run_startup_resume_eventz'GatewayRunner._run_startup_resume_events ?((// / / / / / / /#G-=rBBM5? t5T5T^=$$[111Z^DnT********* #'' 448OOO11+>>>>>POt#'' 448OOO11+>>>>Ps A4B229C+ct|dd}| g}||_|| |j}td|r|jr |jjnd|r|jnddS#t$rYdSwxYw)NrzJQueued inbound message during gateway startup restore: platform=%s chat=%sr4) r}rrbrrrirNr{rrF)rrrr}rs r._queue_startup_restore_eventz*GatewayRunner._queue_startup_restore_events6== =E*/D ' U \F KK\)/RFOR%%"(7i          DD sAA66 BBc Kd}t|dd}|dS|r|d}t|dd}||}|:tdtt|ddddy t |dd n#t $rYnwxYw||d{V|d z }||S) z=Replay inbound messages queued while startup auto-resume ran.rrNrzCDropping startup-restore queued message: adapter unavailable for %srNr{_hermes_startup_restore_replayTrZ)r}rr#rrrsetattrrFr/)rdrainedr}rrrrs r._drain_startup_restore_queuez*GatewayRunner._drain_startup_restore_queues6== =1 IIaLLEUHd33F..v66G YGFJ==wMM ?FFFF    ((// / / / / / / / qLG# $sB&& B32B3cKtt|dgpg}|rbtj|ddid{V}|D]H}t |t r1t dt|||j fIg|_ | d{V}d|_ |rt d|dSdS) zCWait for startup auto-resume, then release and drain inbound queue.rreturn_exceptionsTNzstartup auto-resume task failedrFz;Drained %d inbound message(s) queued during startup restore)rqr}rgatherr@rFrrrrrrr9rri)rrresultsr.r8s r._finish_startup_restorez%GatewayRunner._finish_startup_restores WT#;R@@FBGG  #NEJTJJJJJJJJG!  fi00LL9"&v,,8L!M!')#99;;;;;;;;,1)  ` KKUW^ _ _ _ _ _ ` `r0c K ddlm}m}m}m}m}|sdSd|jD}tj|d|d{V}n-#t$r t ddYdSwxYw|sdSd}|D]H} t| d } nE#t$r8t d | d | d Y[wxYw|j | } | || d } | d r|| z} | dr d| dind} | | d| | d{V}n;#t$r.}td| d |d}Yd}~nd}~wwxYw |^t!|ddrM|| d |dz }td| d | d| d | dn0|| d t%t!|ddpdn,#t$rt ddYnwxYw| dpd}|rQ |j|d{V#t$r!t d|dYDwxYwJ|S)uRedeliver final responses recorded in the delivery ledger by a previous (now dead) gateway process. Runs at startup BEFORE ``_schedule_resume_pending_sessions``. A session with a recoverable obligation already produced its answer — the turn completed and only delivery is owed — so this method sends the stored text and clears ``resume_pending`` for that session, preventing the resume path from re-running (and re-paying for) a turn whose output we hold. Crash-ambiguity contract (see gateway/delivery_ledger.py): rows that were mid-send or previously rejected carry a visible recovered-reply marker so a possible duplicate is labeled, never silent. Returns the number of redeliveries attempted. r)RECOVERED_MARKERledger_enabledmark_delivered mark_failedsweep_recoverablec Jh|] }t|dt|!Sr?)r}rCrs r.rz?GatewayRunner._redeliver_pending_obligations..2s7017CFF++r0N)deliverable_platformszdelivery ledger sweep failedTrrNz"obligation %s: unknown platform %r obligation_idr needs_markerrrrrr~z)obligation %s: redelivery send raised: %srFrZzIRedelivered recovered final response to %s:%s (obligation %s, attempt %d)rrr|z send failedzdelivery ledger update failedrz"clear_resume_pending failed for %s)gateway.delivery_ledgerr@rArBrCrDrrrrFrrrrxrBrrr}rirCrclear_resume_pending)rr@rArBrCrD _deliverableclaimed redeliveredrrNrrr~r.send_errrs r._redeliver_pending_obligationsz,GatewayRunner._redeliver_pending_obligationss4                ">## q59]L$-!4|GG    LL7$L G G G11  1 < < C #C O44    8(#''**=*=   m''11G)nGww~&& 5*W43677;3G3GQc+.//T  &|| N#% ,      ?((    M%'&)U*K*K%"N3#78881$KKK6JYO,c*o  KO,GFGR88IMJJ M M M | j} | } | ;t d| jt/| jd| j | s!td | jn8#t $r+}td | j|Yd}~d}~wwxYwt4j| j<t7jj| j<t=d t>j | d }tCj"#| || j}j$%||&j$j't/ddr1t/dd}| g}|_(|)|| dz } | rt*d| | S)uAuto-continue fresh restart-interrupted sessions after startup. ``resume_pending`` already preserves the transcript AND the existing ``_is_resume_pending`` branch in ``_handle_message_with_agent`` injects a reason-aware recovery system note on the next turn. This method closes the UX gap by synthesizing that next turn once adapters are back online — the event text is empty so the existing injection path owns the wording and we never double up. Adapters that are not yet ready (adapter missing from ``self.adapters``) are skipped silently; their sessions stay ``resume_pending`` and will auto-resume on the next real user message, or when the platform reconnects — the reconnect watcher calls this again scoped to that ``platform``. ``platform`` (a ``Platform``) restricts the pass to sessions that originated on that platform. The reconnect path passes it so a platform coming back online retries only its own sessions and never re-touches another platform's in-flight recoveries. Sessions whose agent is already running are skipped regardless, so a session scheduled at startup is never resumed a second time. c~g|]9}|jr0|js)|j"|jjvr|jjk7|:Sr()resume_pendingrr resume_reason_AUTO_RESUME_REASONSrN)r,rcrNrs r.rzCGatewayRunner._schedule_resume_pending_sessions..sm#+"O 0+t/HHH!)U\-Bh-N-N  .O-N-Nr0Nz/Failed to enumerate resume-pending sessions: %srr>z$Restart-loop guard check skipped: %sz5Skipping auto-resume for %s: adapter not ready for %sr{z^Skipping auto-resume for %s: session owner is no longer authorized under the current allowlistz;Skipping auto-resume for %s: authorization check failed: %sr|T)rrvrrArFrrZz;Scheduled auto-resume for %d restart-interrupted session(s))+r;rrrrrrFrrrr?rFcheck_and_recordrrrr@last_resume_marked_at updated_at total_secondsrrrr#r}rNrPrrDrrrrr$rrr2rrerorWrrbri)rrNrErorrD _max_restarts_windowr@ scheduledrcmarkerrrrrrrs`` r.!_schedule_resume_pending_sessionsz/GatewayRunner._schedule_resume_pending_sessions~sJ.122 #)  "88:::'+'9'B'I'I'K'K                    NNLc R R R11111   J J>>>>>>)-)H)H)J)J& w((@@1 J J J CSIIIIIIII Jlnn F F E0DE4DF!sV|&B&B&D&Dv&M&M D$888\F..v66G K%FOWfoFF  //77NNH)     Q%s  7ND !2 39=D #E$5 6  ' ' ) ) ) !(- E &..wu?PQQD  " & &t , , ,  " "4#9#A B B Bt;UCC #&>EE=E27D/ T""" NII   KKM   sk A;AA/# A;/A33A;6A37A;; B+B&&B+13C'' D1DD5G?? H4 !H//H4cP|jp|jp|jSr()rrrr rs r._startup_should_abortz#GatewayRunner._startup_should_abort s.  # -~ -#**,, r0cK|sdS|r|p |d{Vn8#t$r+}td|j|Yd}~nd}~wwxYw|||d{V|j}tj }| ||ur |d{VnF|j s-| |j |j|jd{VdS)zCClean up and exit startup when restart/shutdown begins mid-startup.FNu'✗ %s background-task cancel error: %sr'T)r`r{rFrrrr{rurr current_taskrr rrrr)rrrNr stop_taskrbs r.$_abort_startup_if_shutdown_requestedz2GatewayRunner._abort_startup_if_shutdown_requestedsn ))++ 5  8#7 [557777777777 [ [ [ FXYZZZZZZZZ [//BB B B B B B B BO +--  Yl%B%BOOOOOOOO%,,.. ))/!%!7 $ 9        ts9 A.!A))A.c >+BKtd tj_n#t $r d_YnwxYwtdjj ddlm }|j }|Y| drDt d| dd |d |d |d n2#t$r%}td |Yd}~nd}~wwxYw tt!jdd}td|n#t$rYnwxYw t!jdd}|dv}|rtdnt d|n#t$rYnwxYw ddlm}|}|r!|dkrtd|n#t$rYnwxYw ddlm} | ddn#t$rYnwxYw ddlm} m} | } | | } | r5t d| t dn,#t$rtdd !YnwxYwd{Vrd Sd"}d#}d$}d$} dd%lm}t;d&|D}t;d'|D}n#t$rYnwxYwt?d(||zD}t!jd)d*d+vpt?d,||zD}|s|st d-tAj}|r|!d.d/d}d}tD#D]\}}|j$|kr |d0}nt%d1||pd2 ddlm} | d3|n#t$rYnwxYw&|d S dd4l'm(}|n,#t$rt d5d !YnwxYw dd6l)m*}m+}m,}m-}||r-td7||n,#t$rt d8d !YnwxYw dd9l.m/}dd:l0m1} | |d;<n,#t$rtd=d !YnwxYwj23 dd>l4m5}!|!6}"|"rtd?|"n2#t$r%}#t d@|#Yd}#~#nd}#~#wwxYwtndAz }$|$8r@tdB |$9n#t$rYntwxYw j:;d{V}%|%rtdC|%n2#t$r%}#t dD|#Yd}#~#nd}#~#wwxYw <}&|&rt dE|&n2#t$r%}#tdF|#Yd}#~#nd}#~#wwxYwd _=g_>g_?d}'d}(g})g}*ttjdGd;}+g},jjB#D]\}}-d{Vrd S|-jCs+|+rFt||-s6tdH|j$|,E|s|(d/z }(F||-}.|.sk|j$}/dItjHID}0|/|0vrt dJ|/nt dK|/|.JjK|.LjM|.NjO|.PjQt|.dLd}1t|1r|1jS|.TjU|.VW|.jXjY|._YtdM|j$Z|j$dNddO [|.|d{V}2|.|d{Vrd S|2rd|.j\|<]|.|'d/z }'Z|j$dPddOtdQ|j$n*t dR|j$^|.|d{V|.j_rZ|j$|.j`rdSndT|.ja|.jbO|.j`r|*n|)}3|3E|j$dU|.jb|.j`r"|-d/tjddVzdWje|<n]Z|j$dSddXO|*E|j$dY|-d/tjddVzdWje|<n#t$r}#t%dZ|j$|#^|.|d{VZ|j$dSdt|#O|*E|j$dU|#|-d/tjddVzdWje|<Yd}#~#nd}#~#wwxYwd{Vrd S gd{V}4|'|4z }'n#t$r}#t|#}t%d[| ddlm} | d3|n#t$rYnwxYwt_j&|d;_=Yd}#~#d;_kd Sd}#~#wt$r'}#t%d\|#d !Yd}#~#nd}#~#wwxYwd;_kn #d;_kwxYw|,D]VBt?Bfd]jlID}5|5s t d^Bj$W|'dkrA|)rd_m|)}t%d`| ddlm} | d3|n#t$rYnwxYwt_j&|d;_=d S|(dkr|*rhd_m|*}t datje| ddlm} | dbdn#t$rYnwxYwt dc|(n4t ddtded{Vrd Sj\jo_\pd _qrdf tdgd}6|6|6srtjttttdhdij_wtdkd}7|79|7xjwjwy|7jzn,#t$rtdld !YnwxYwtj2j{}8|8rtdm|8j2|dndodpj\}Did{V|'dkrtdq|' ddrl~m}9|9j\d{V}:tds|: doiID};tdt|;n2#t$r%}#t du|#Yd}#~#nd}#~#wwxYwd{V}<||=rd _d{V|>rA dzd{Vtn#twxYwd{Vd{V dd>l4m5}!|!j}?g|!_t|?D]\}@}A|Affd{ d||A d}d;~td|A d}|@dzdkrtjdd{Vn2#t$r%}#t%d|#Yd}#~#nd}#~#wwxYwjdjdjdjerPtdtjedmdjeDjdjdjd rItdjdnn,#t$rtdd !YnwxYwjdtdd S)z Start the gateway and all configured platform adapters. Returns True if at least one adapter connected successfully. zStarting Hermes Gateway...NzSession storage: %sr)check_systemd_timing_alignmentmismatchzStale systemd unit detected: %s has TimeoutStopSec=%.0fs but drain_timeout=%.0fs (expected >=%.0fs). systemd may SIGKILL the gateway mid-drain. Run `hermes gateway install --force` to regenerate the unit, or shorten agent.restart_drain_timeout.unitz (unknown)timeout_stop_sec drain_timeout expected_minz)check_systemd_timing_alignment failed: %srBrUzuAgent budget: max_iterations=%d (agent.max_turns from config.yaml, or HERMES_MAX_ITERATIONS from .env, or default 90)rr>>r;r<r=r>z^Secret redaction: ENABLED (tool output, logs, and chat responses are scrubbed before delivery)zSecret redaction: DISABLED (HERMES_REDACT_SECRETS=%s). API keys and tokens may appear verbatim in chat output, session JSONs, and logs. Set security.redact_secrets: true in config.yaml to re-enable.rrzActive profile: %srstarting)rr)detect_compromisedgateway_log_message%szCRun `hermes doctor` on the gateway host for full remediation steps.z1security advisory check failed at gateway startupTr)TELEGRAM_ALLOWED_USERSDISCORD_ALLOWED_USERSWHATSAPP_ALLOWED_USERSWHATSAPP_CLOUD_ALLOWED_USERSSLACK_ALLOWED_USERSSIGNAL_ALLOWED_USERSSIGNAL_GROUP_ALLOWED_USERSTELEGRAM_GROUP_ALLOWED_USERSTELEGRAM_GROUP_ALLOWED_CHATSEMAIL_ALLOWED_USERSSMS_ALLOWED_USERSMATTERMOST_ALLOWED_USERSMATRIX_ALLOWED_USERSDINGTALK_ALLOWED_USERSFEISHU_ALLOWED_USERSWECOM_ALLOWED_USERSWECOM_CALLBACK_ALLOWED_USERSWEIXIN_ALLOWED_USERSBLUEBUBBLES_ALLOWED_USERSQQ_ALLOWED_USERSYUANBAO_ALLOWED_USERSGATEWAY_ALLOWED_USERS)TELEGRAM_ALLOW_ALL_USERSDISCORD_ALLOW_ALL_USERSr/WHATSAPP_CLOUD_ALLOW_ALL_USERSSLACK_ALLOW_ALL_USERSSIGNAL_ALLOW_ALL_USERSEMAIL_ALLOW_ALL_USERSSMS_ALLOW_ALL_USERSMATTERMOST_ALLOW_ALL_USERSMATRIX_ALLOW_ALL_USERSDINGTALK_ALLOW_ALL_USERSFEISHU_ALLOW_ALL_USERSr%WECOM_CALLBACK_ALLOW_ALL_USERSr(BLUEBUBBLES_ALLOW_ALL_USERSr,r+rplatform_registryc32K|]}|j |jVdSr()allowed_users_envr,rs r.r/z&GatewayRunner.start..sB))()&)#))))))r0c32K|]}|j |jVdSr()r9rs r.r/z&GatewayRunner.start..s@++$%?+++++++r0c3>K|]}tj|VdSr()r`rzr-s r.r/z&GatewayRunner.start..s;  BIaLL      r0r4r|>r;r=r>c3hK|]-}tj|ddvV.dS)r|>r;r=r>N)r`rzrEr-s r.r/z&GatewayRunner.start..s\e e  Ia   " " $ $(< <e e e e e e r0a4No env user allowlists configured. Messaging platforms default to pairing/allowlist policies and will deny unknown senders unless you configure platform allowlists (e.g., TELEGRAM_ALLOWED_USERS=your_id) or explicitly opt in with GATEWAY_ALLOW_ALL_USERS=true plus dm_policy/group_policy: open on the platform.r}rZrzuRefusing to start: %s has dm_policy/group_policy set to 'open' but neither GATEWAY_ALLOW_ALL_USERS nor %s is enabled.za platform allow-all flagstartup_failed)discover_pluginsz*plugin discovery failed at gateway startup)register_relay_adapter relay_urlself_provision_relaysend_relay_policyz*relay adapter registered (connector at %s)z4relay adapter registration failed at gateway startupr)register_from_configF) accept_hooksz1shell-hook registration failed at gateway startuprz5Recovered %s background process(es) from previous runzProcess checkpoint recovery: %s.clean_shutdownu?Previous gateway exited cleanly — skipping session suspensionz=Marked %d in-flight session(s) as resumable from previous runz(Session suspension on startup failed: %sz'Auto-suspended %d stuck-loop session(s)zStuck-loop detection failed: %srpzSkipping %s on default profile: no bot credential in this profile's secrets. Secondary multiplexed profiles that provide the token will still connect.ch|] }|j Srr?r,rs r.rz&GatewayRunner.start..s!Q!Q!Qa!'!Q!Q!Qr0uqNo adapter for '%s' — is the plugin installed? (platform is enabled in config.yaml but no plugin registered it)zNo adapter available for %sset_reaction_handlerzConnecting to %s... connectingrr2u✓ %s connectedu✗ %s failed to connectrrrr{rzfailed to connectz: failed to connectu✗ %s error: %sz$Gateway multiplexer config error: %sz,Secondary-profile adapter startup failed: %sc3 K|]}|vV dSr(r)r, _profile_map_skippeds r.r/z&GatewayRunner.start..& s<'' L(''''''r0u%s is enabled but no profile (default or secondary) provided a bot credential for it — the platform is not being served. Add its token to the profile that should own it, or disable the platform.rz0Gateway hit a non-retryable startup conflict: %suSGateway started with no connected platforms — %d platform(s) queued for retry: %sdegradedzNo adapter could be created for any of the %d configured platform(s). Check that required dependencies are installed and credentials are set. Gateway will continue for cron job execution.zNo messaging platforms enabled.z5Gateway will continue running for cron job execution.rdrrr) interval_s start_timerz&Failed to start gateway loop heartbeatz%s hook(s) loadedzgateway:startupr cg|] }|j Srr?rs r.rz'GatewayRunner.start.. s@@@a!'@@@r0z#Gateway running with %s platform(s)build_channel_directoryc34K|]}t|VdSr()r)r,chss r.r/z&GatewayRunner.start.. s(WW3s88WWWWWWr0z%Channel directory built: %d target(s)z"Channel directory build failed: %sc3>K|]}|VdSr()rf)r,rgs r.r/z&GatewayRunner.start.. s>   KKMM      r0.update_pending.json.update_pending.claimed.jsonr skip_targetsc.|Sr()_run_process_watcher)wrs r.rz%GatewayRunner.start.. sd&?&?&B&Br0zprocess_watcher:r3)rtz(Resumed watcher for recovered process %sdcz!Recovered watcher setup error: %ssession_expiry_watcherkanban_notifier_watcherkanban_dispatcher_watcherz;Starting reconnection watcher for %d failed platform(s): %src3$K|] }|jV dSr(r?rs r.r/z&GatewayRunner.start.. s$BBa!'BBBBBBr0platform_reconnect_watcherhandoff_watcherasync_delegation_watcheru?scale-to-zero: armed (idle timeout %.0fs) — watching for idlescale_to_zero_watcherz*scale-to-zero: arm check failed at startupdrain_control_watcherzPress Ctrl+C to stop)rrirrrrWrGrgateway.shutdown_forensicsrfrrBrrFrrr0r`rzrErrrrhermes_cli.security_advisoriesrmrnrdgateway.platform_registryrrplugin_entriesrbr<r1r5rr{rr"rrrSrrrrrKragent.shell_hooksrr discover_and_loadr<rrecover_from_checkpointrrfr rsuspend_recently_activerrrrrr}r rr{rb_create_adapterrx __members__rset_message_handler_handle_messageset_fatal_error_handlerr set_session_storerset_busy_session_handlerrrrset_topic_recovery_fnrset_authorization_check_make_adapter_auth_checkrNrrrrrhruhas_fatal_errorr rrrDrzrrC!_start_secondary_profile_adaptersr\rrrrr2rrr&rrerprrrrrerorW loaded_hooksrrgateway.channel_directoryrsum_send_update_notification#_schedule_update_notification_watchrprrr_send_restart_notification(_send_home_channel_startup_notificationsr!rPr^r>r3r_spawn_supervised_session_expiry_watcher_kanban_notifier_watcher_kanban_dispatcher_watcher_platform_reconnect_watcher_handoff_watcher_async_delegation_watcherrTr<rrr[r)Crrf _alignmentr_effective_max_iter _redact_raw _redact_onrrrrmrn _adv_hits_adv_msg_builtin_allowed_vars_builtin_allow_all_vars_plugin_allowed_vars_plugin_allow_all_varsr_any_allowlist _allow_allrJrr9rNr6rrrrrrrrrr _clean_markerrstuckconnected_countenabled_platform_countstartup_nonretryable_errorsstartup_retryable_errors _multiplex_on_multiplex_skipped_platformsrtr_pval_builtin_names _set_reactionrtarget_secondary_connected_served_by_secondary _existing_hb_bg hook_countr directorych_countr!chat_restart_notification_pending$planned_restart_notification_pendingwatchersrrrsC` @r.startzGatewayRunner.start*s\  0111 &!(!9!;!;D   & & &!%D    & )4;+CDDD J Q Q Q Q Q Q778STTJ%*..*D*D%VNN6;7712/~.    J J J LLDb I I I I I I I I J  "%bi0G&N&N"O"O  KKE#         D  )$;VDDK$**,,0JJJ  > 3     D   C C C C C C..00H -M-M-O-O)))$$ &+++):)I)I)K)K+++&& " "    D   "7:N"N     Y8"==CCEEI]] ade e ,/EEe e e b b  j  NN@   4DK@@  #\\#q11!4N M&:&@&@&B&B  "(>^33$,QKME4 LLI > > > > > U C C C C C    LLC        $$&&& A ? ? ? ? ? ?(@@BBI ` SU^___ A A A NN > > > > > > > ?-1)&(#&(#!"13#.0 WT[2FNNOO 79$)-)>)D)D)F)FP P  %Ho>>@@@@@@@@ tt"*  %A(O%\%\  <N  -33H=== "a ' "**8_EEG  !Q!Q83G3N3N3P3P!Q!Q!Q..NN[ NN#@%HHH  ' '(< = = =  + +D,L M M M  % %d&8 9 9 9  , ,T-U V V V#G-CTJJM && ; d9:::  ) )$*P Q Q Q  + +D,I,I'JZ,[,[ \ \ \&*&:G # KK-x~ > > >  0 0+" 1    T  $ J JX!!BB7HUUUUUUUU 44;.5DM(+::7CCC#q(O88 '2#'&* 9 KK 2HNCCCCNN#=x~NNN77JJJJJJJJJ.%<<$N9@9V+c::\c'.'?*1*E = '<=44!<  '~NN1LNN#8*9,-.2n.>.>.C@@D28< <<$N+5'+*= = 177'~BBB '6()*..*:*:R*?<<.x8     /CCC33GXFFFFFFFFF44N#-#"%a&& 5 )//8>0H0HQ0H0HIII. !"&."2"2R"744&x000000 &>>@@@@@@@@ tt  :)-)O)O)Q)Q#Q#Q#Q#Q#Q#Q 3 3OO#   VVF LL? H H H ??????$$3CQWXXXXX    ?? OQWXXXCCCCCC((7GU[\\\\\ D"@((000491t%))+"YY'?@@FNN>D233V GGGGGG,,*4(,%D+ @AAA STTT::<< < < < < < < 4(, % ))+++  ##I...  R"4)?FFL#|'8'8':':#,3,?*#?#*41F#L#L--) d$7>>?GGD5666-?? LLL R R R LLADL Q Q Q Q Q R011  9 KK+Z 8 8 8joo/ @@4=+=+=+?+?@@@2           Q   KK= O O O D I I I I I I55dmDDDDDDDDIWWy}}["/M/M/T/T/V/VWWWWWH KK? J J J J D D D NN? C C C C C C C C D 7799999999 7C  55==      7  4 4 6 6 6 Q  -$$ $ $ $ $ $ $ $-J,K,K)/T/V/V, - -(,D %--///////// 0 6 6CC!%D455553555511333333333 ..000**,,,,,,,,, A ? ? ? ? ? ? (8H02  -(11 + + 7&&$BBBBBBw{{<'@'@BB!'  F T`HaHabbbs7b==!-********* + A A A LLWXXX t>@[\\\  !  KKMD*++ BB4+ABBBBB    t?A]^^^ t46GHHH t=?YZZZ V--// ; U<<>>&&t'BD[\\\\ 88::: V V V LLEPTL U U U U U V t:._done.._respawnv!su!-000000000}..( $+%6%: /r0)rrWr~rrrrrDrz_SUPERVISED_HEALTHY_SECS_MAX_SUPERVISED_RESTARTSr|rrrero) rrran_forr respawn_taskr r r _startedr rrtrs @@r._donez.GatewayRunner._spawn_supervised.._doneV!s  " * *1 - - -q{}} !+--C{ LL6cCL P P P! O4=! O.**X5d;;; )*%%(0%$(EEELLN)5 Fb!s+> &**<888..t/E/MNNNNNC! O! O! O! Or0) r}rcrrDrzrrrero)rr rrtr rr r s````` @r.rzGatewayRunner._spawn_supervised:!s 4,d 3 3 ;%(UUD ">##"<<>>22 ""4(((, O, O, O, O, O, O, O, O, O, O\ u%%% r0@c\Ktjdd{V|jr |jtj|d{V+|jd{V}|D]}|d}|s|j|d{Vs; ||d{V|j|d{Vx#t$rV}t d||d|j |t|d{VYd}~d}~wwxYwnC#tj$rt$r'}td|dYd}~nd}~wwxYwtj|d{V|jdSdS)uBackground task that processes pending CLI→gateway session handoffs. Polls ``state.db`` for sessions in ``handoff_state='pending'`` and, for each one: 1. Atomically claims it (pending → running). 2. Resolves the destination platform's configured home channel. 3. Re-binds the gateway's session_key for that home channel to the CLI's existing session_id via ``session_store.switch_session`` so the full role-aware transcript replays on the next agent turn. 4. Forges a synthetic ``MessageEvent`` (``internal=True``) with a handoff-notice text and dispatches through the normal gateway message pipeline so the agent runs and replies on the platform. 5. Marks the row ``completed`` (or ``failed`` with ``handoff_error``). The CLI process is poll-blocked on the row's terminal state and prints the result to the user. r)Nrz!Handoff for session %s failed: %sTrzHandoff watcher tick error: %s)rrprrlist_pending_handoffsrB claim_handoff_process_handoffcomplete_handoffrFrr fail_handoffrCrmrr)rrlpendingrr3rs r.rzGatewayRunner._handoff_watcher!sv*mAm * S#+!-111111111 $ 0 F F H HHHHHHH"RRC!$J%! !%!1!?!? !K!KKKKKKK! R"33C888888888".?? KKKKKKKKKK$RRR?&d'#.;;JCQQQQQQQQQQQQQQ RR )    S S S =sT RRRRRRRR S-)) ) ) ) ) ) ) )5m * * * * *sI!EAE%;C! E! E+A D<7E<EEFFFrc Kddlm}ddlm}m}ddlm}|d}|dpd }|std ||}n(#ttf$rtd |d wxYw|j |} | std |d |j|} | r| jstd |d|dp |dd} d| } | t%| j| d{V} n7#t&$r*}t(d||dd} Yd}~nd}~wwxYw| p| jrt%| jnd}t%| j}||jkot1|}| r|sd}d}nd}|r|nd}|||| j||d|}|jj|}|r|jni}|||dd|dd}|j|d{V|j||d{V}|td|d |||| |d!| d"}|||d#}t(!d$||| j|||"|d{V}|sdSi}|r||d%< | #t%| j||pd&d{V}n%#t&$r}td'||d}~wwxYwtI|d(ds#tI|d)d*}td'|dS)+zAExecute one handoff row. Raises on failure (caller marks failed).rrh)rr)rrhandoff_platformr|zhandoff_platform is emptyzunknown platform 'rz platform 'z' is not active in this gatewayzno home channel configured for z(; run /sethome on the desired chat firsttitleNu Hermes — z/Handoff: create_handoff_thread raised on %s: %sTrr-zsystem:handoffr,Handoff)rNr chat_namer+rrQrrrFrrzcould not switch session key u → z([Session was just handed off from CLI ("z") to this channel. The full prior conversation history is loaded above. Briefly confirm you're working here and summarize what we were working on, so the user can continue from this device.])rrrAubHandoff: dispatching synthetic turn for CLI session %s → %s (home=%s, thread=%s, session_key=%s)rrIzadapter.send failed: rrr)%rzrxr:rrrirrBrDrErWr2KeyErrorrrGrrcreate_handoff_threadrCrFrrrrrr rr rurget_or_create_sessionswitch_session_evict_cached_agentr0rirrr})rrrxrrrcli_session_idr rNrr6 cli_title thread_name new_thread_idreffective_thread_id home_chat_idis_telegram_private_chatdest_chat_type dest_user_id dest_sourcerrurswitchedsynthetic_textsynthetic_event response_text send_metadatar.rfs r.r zGatewayRunner._process_handoff!s++++++DDDDDDDD777777T!344:AACCIIKK  <:;; ; Fx ..HHH% F F FDMDDDEE E F-##H-- K]KKK  {++H55 4< :-:::  GGG$$:rr(: 0I//  !")"?"?DL!!;##MM ! ! ! LLAsT    !MMMMMM  !, #'> ;C   t 4<(( ) ) B3LAA !  Z!9 Z%N+LL "N+CY<&'+HIIC >s<, A88%B*.E F # FF 2M;; NNNc  Ktjdd{Vi}d}|jr |jd{Vg}t |jjD]E\}}|j r |j |d{Vs.| ||fF|ri}|D]S\}} | d} t| dkr| dnd} || ddz|| <Td d t!|D} t"d t|| |D]e\}} dd lm} | d} t| dkr| dnd }| d|j|dn#t,$rYnwxYwd}t/|dd}|W|5|j|}t3|t4r|dn|r|nd}dddn #1swxYwY||j|}|r&|t8ur||dd{V||||d|j |d{Vt"!d|j|"|jd#t,$r}||jddz}|||j<||kr`t"#d||j||j |dd{V|"|jdn#t"!d|||j|Yd}~_d}~wwxYw|retId|D}t||z }|rt"d||nt"d| |%}|rt"d|n2#t,$r%} t"!d| Yd} ~ nd} ~ wwxYwt/|d d!}d"}tMj&|z |kr tOt/|j(d#dpd}|dkr=|j)|d{V}|rt"d$|n2#t,$r%} t"!d%| Yd} ~ nd} ~ wwxYwtMj&|_*n2#t,$r%}t"!d&|Yd}~nd}~wwxYwtW|D]%}|jsntjdd{V&|jdSdS)'aBackground task that finalizes expired sessions. Runs every ``interval`` seconds (default 5 min). For each session whose reset policy has expired, invokes ``on_session_finalize`` hooks, cleans up the cached AIAgent's tool resources, evicts the cache entry so it can be garbage-collected, and marks the session so it won't be finalized again. rNrr}rr4rrZrc3*K|]\}}|d|VdS)r}Nr)r,rcs r.r/z8GatewayRunner._session_expiry_watcher.."sA..'+q!1 q ......r0z,Session expiry: %d sessions to finalize (%s)rr|rsession_expiredrrrrexpiry_finalizedrzSession expiry finalized for %szkSession finalize gave up after %d attempts for %s: %s. Marking as finalized to prevent infinite retry loop.F)clear_model_overridez*Session finalize failed (%d/%d) for %s: %sc3.K|]\}}|j dVdS)rZN)rB )r,rrs r.r/z8GatewayRunner._session_expiry_watcher.."sB  "a!:L       r0z3Session expiry done: %d finalized, %d pending retryz!Session expiry done: %d finalizedz+Agent cache idle sweep: evicted %d agent(s)zIdle agent sweep failed: %s_last_session_store_prune_tsrr!session_store_max_age_daysz,SessionStore prune: dropped %d stale entrieszSessionStore prune failed: %sz Session expiry watcher error: %s),rrprrrrqrrrrB _is_session_expiredrbr1rrBr2sortedrrirrr3rFr}rr@rrrrr. _clear_conversation_scopeset_expiry_finalizedrrrrr_sweep_idle_cached_agentsrDr0rGprune_old_entriesrE range)rrl_finalize_failures_MAX_FINALIZE_RETRIES_expired_entriesrrc _platforms_kr_parts_plat _plat_summaryr _platform _cached_agent _cache_lock_cachedrfailuresr _failed _idle_evicted_last_prune_ts_prune_interval_max_age_prunedrs r.rz%GatewayRunner._session_expiry_watcherl"sJmB-/ !md '^ D.==?????????#% "&t'9'B'H'H'J'J"K"K::JC-! !%!9!M!Me!T!TTTTTTT! $++S%L9999#24J"2IIB!##-0[[1__q ),6NN5!,D,Dq,H 5))$(II../5j6F6F6H6H/I/I...%%MKKF,--} #3LLJCK !VVVVVV%(YYs^^F58[[1__q "I(L 5+0+;)2'8  )!!! D! )- &-d4G&N&N &2!,{{*.*;*?*?*D*D>HRW>X>X0z ip^z^e^evz {{{{{{{{{{{{{{{ )0,0,@,D,DS,I,IM(]BY-Y-Y"&"H"H -7G#I##0055566(:7#6KKERRRRRRRRR =!,+..u/?FFFF$#5#9#9%:JA#N#NQR#R?G*5+;<#'<<<"NN!W (%*:A #'":"O"O %E#P##/2253CTJJJJ"LL L (*?AQST&$   &6   E""233e;G Q!7  ?D$($B$B$D$DM$ I)!DDDLL!>CCCCCCCCD")/Ms!S!S"(9;;//AA J#&#DK1MqQQVUV$$$a<<,0,D,V,VW_,`,`&`&`&`&`&`&`G&" & $R$+!"!"!"%JJJ %DbIIIIIIIIJ8< D5 D D D ?CCCCCCCC D8__ ' '}EmA&&&&&&&&&&Imd 'd 'd 'd 'd 'sEVA GL G!L G!!L;>I9 LI L I CLV O#'B1OVO##A*V1R?V R/ R*%V*R//0V A(U V U8U3.V3U88V WV>>WcJ ddlm}|pdS#t$rYdSwxYw)z0Return the profile name this gateway represents.rrr)rrrF)rrs r.rz"GatewayRunner._active_profile_name#sO  C C C C C C**,,9 9   99 s  ""c  Ktjdd{V|jr[|js@t dD]/}|jsdS|jrntjdd{V0Ot j}t|jD]}|jsdS|j|}| dr0||dkr=|d}|ddz}t||s)t d |j |j|=td |j |d} |||}|s)t d |j |j|=||j||j||j||jt1|d d}t3|r||j||j|||j|j |_ |!||d d{V} | r||j"|<|#||j"|j$_"|j|=|%|j dddtd|j  ddl&m'} | |j"d{Vn#tP$rYnwxYw |)|n:#tP$r&t*d|j d Yn wxYw|j+rs|j,sl|%|j d|j-|j.t d|j |j.t_|d{V|j|=n|%|j d|j-|j.pdta|} ||d<t j| z|d<td|j | t_|d{V#tP$r} |t_|d{V|%|j ddtc| ta|} ||d<t j| z|d<t d|j | | Yd} ~ d} ~ wwxYwt dD]&}|jsdStjdd{V'|jYdSdS)u7Background task that periodically retries connecting failed platforms. Uses exponential backoff: 30s → 60s → 120s → 240s → 300s (cap). Retryable failures (network/DNS blips) keep retrying at the backoff cap indefinitely — they self-heal once connectivity returns, so a transient outage never requires manual intervention. Non-retryable failures (bad auth, etc.) drop out of the queue immediately. The circuit breaker (``_pause_failed_platform`` / ``/platform pause``) remains available for manual operator control via ``/platform list`` and ``/platform resume ``, but is no longer triggered automatically — auto-pausing a recovered platform was the cause of bots silently staying dead after a transient DNS failure. Nr{rZrrrGrzKReconnect %s: no bot credential on queued config, removing from retry queuezReconnecting %s (attempt %d)...zGReconnect %s: adapter creation returned None, removing from retry queuerTrr2ru✓ %s reconnected successfullyrrrRz3resume-pending reschedule after %s reconnect failedrrzAReconnect %s: non-retryable error (%s), removing from retry queuerzfailed to reconnectz&Reconnect %s failed, next retry in %dsz)Reconnect %s error: %s, next retry in %ds)2rrprrrM rDrzrqrrBr{rrr{rirrrrr rrrrr}rrrrrrrNrrrrhrrrrrFr^rrrr rrrxr~rC) rrr@rNrirtryrrrrr rs r.rz)GatewayRunner._platform_reconnect_watcher,#smBmy ') r++A=-!-**********.""C !7!!>??d d }FF-h788H%%l+++"&x.z*Q.4HoNNNN4  .x8 5NG F"228_MMG"!e$N!28< //0DEEE33D4TUUU--d.@AAA44T5]^^^$+G5KT$R$RM ..C% d&ABBB11$2XYYY33D4Q4QRYRb4c4cddd.2.BG+ %)$F$F%G%%GM?29 h/>>wGGG8< ,5 28<<<$N+6'+*. =  $Ex~VVV!YYYYYY"9"9$-"H"HHHHHHHHH(!!! D! BBHBUUUU("LL U ()-)!0*?9V*?<<$N+2'.'?*1*E = _$NG,G6g>>>>>>>>> 28<<<<$N+5'.'?*1*E*^I^ = #5W"="=+2Z(-1^-=-=-G\* D$NG6g>>>>>>>>>!*6g>>>>>>>>>88 '1#'&)!ff 9 199G'.D$)-)9)9G)CD&NNC 7%62YY ' '}FFmA&&&&&&&&&&smy 'y 'y 'y 'y 'sjARFRL21R2 L?<R>L??RMR,N R N  D R T=!BT88T=cK|j}t|tsdStj}g}|D]v}t|ts|D]I}t|tjr-||ur)|s||Jw|D]}| | }|rO|dkrItj ||d{V\}}|r(t dt||dS)aCancel profile-scoped reconnects before tearing down their registry. A reconnect can be waiting in adapter setup while shutdown begins. It must not republish an adapter after the secondary registry is drained. Waiting is bounded by the same adapter-cleanup budget; if a task does not finish in time, the stopped runner state still prevents it from installing an adapter when it eventually resumes. NrrzLTimed out waiting for %d secondary profile reconnect task(s) during shutdown)rr@rArrbrTaskrprbrnrtrlrrrre) rr" rFrprofile_pendingrrr unfinisheds r.)_cancel_secondary_profile_reconnect_tasksz7GatewayRunner._cancel_secondary_profile_reconnect_tasks#st0'4((  F&(($&&~~// ' 'Oot44 '..00 ' 'dGL11'd'6I6IRVR[R[R]R]6ILL&&& '  D KKMMMM7799  Wq[[&-l5'&J&J&J J J J J J J E: b OO  r0c|jr|jjdkrdS|jdSddlm}|d}|sdS||_|ddS)zAStart sd_notify only after a configured gateway is truly running.rFNT)SystemdWatchdog)config_enabledzHermes Gateway running)rrGsystemd_watchdog_secondsrgateway.systemd_notifyrj r ready)rrj watchdogs r._start_systemd_watchdogz%GatewayRunner._start_systemd_watchdog$s}  D I I5  ! -4::::::"?$777~~ 5!)/000tr0cbK|j}|dSd|_|d{VdS)z;Stop heartbeats before any potentially long shutdown drain.N)rr)rro s r._stop_systemd_watchdogz$GatewayRunner._stop_systemd_watchdog&$sG)   F!%mmoor0r'rtr(r)cK|rd_|_|_jjd{VdSdfd }dfd t j|_jd{VdS)z-Stop the gateway and disconnect all adapters.TNr%cKdtddfd}tj}|_idtffd }t jds%ttj ||d |d{V| dS#| wxYw)Nphaser%c ddlm}|}|rtd||n3#t $r&}td||Yd}~nd}~wwxYw ddlm}|d|d}|r=t d |t|d |n3#t $r&}td ||Yd}~nd}~wwxYw dd l m }|d |d}|rtd||n3#t $r&}td||Yd}~nd}~wwxYw ddlm}|n3#t $r&}td||Yd}~nd}~wwxYw ddlm} | dS#t $r'}td||Yd}~dSd}~wwxYw)uwKill tool subprocesses + tear down terminal envs + browsers. Called twice in the shutdown path: once eagerly after a drain timeout forces agent interrupt (so we reclaim bash/ sleep children before systemd TimeoutStopSec escalates to SIGKILL on the cgroup — #8202), and once as a final catch-all at the end of _stop_impl() for the graceful path or anything respawned mid-teardown. All steps are best-effort; exceptions are swallowed so one subsystem's failure doesn't block the rest. rrz,Shutdown (%s): killed %d tool subprocess(es)z(process_registry.kill_all (%s) error: %sN)mark_running_jobs_interruptedzGateway shutdown (z;) killed the job's tool subprocess before the run finished.z>Shutdown (%s): marked %d in-flight cron job(s) interrupted: %srz,mark_running_jobs_interrupted (%s) error: %s) interrupt_allzgateway shutdown (ryrz6Shutdown (%s): interrupted %d background delegation(s)z"async interrupt_all (%s) error: %s)cleanup_all_environmentsz'cleanup_all_environments (%s) error: %s)cleanup_all_browsersz#cleanup_all_browsers (%s) error: %s)r<rkill_allrrirFrrrrw rrr2r1rx tools.terminal_toolry tools.browser_toolrz ) ru r_killedrrw _interrupted_interrupt_async_async_nry rz s r._kill_tool_subprocesseszGGatewayRunner.stop.._stop_impl.._kill_tool_subprocesses?$s XGGGGGG.7799G J!7!XXXLL!KUTVWWWWWWWWX\MLLLLL#@#@>U>>>$$L$\!3|#4#4dii 6M6M!\\\LL!OQVXZ[[[[[[[[\ RXXXXXX//7TE7T7T7TUUUH T!8!RRRLL!EubQQQQQQQQRWLLLLLL,,.... WWWLL!JESUVVVVVVVVWSGGGGGG((***** SSSLL!FrRRRRRRRRRSsv8; A+A&&A+/AC C4C//C484D-- E7EE!E22 F"<FF"&F88 G)G$$G)c |d}tjtjtjjtj|tj |z ndd S)Nr) rrordractive_cron_jobsactive_api_runsrwatchdog_delay_sphase_elapsed_s) rBrrrrr$r&r'rrrDrz)started_stop_started_at_boxrs r._shutdown_watchdog_snapshotzKGatewayRunner.stop.._stop_impl.._shutdown_watchdog_snapshot$s.22377)-d.E)F)F $T^ 4 4#DM22%)%>%>%@%@(,(C(C(E(E'+'A'A'C'C-1-H(G3))7>6I((722tr0PYTEST_CURRENT_TESTrZ) done_event snapshot_fnr) rCrrrrAr`rarBrrrrc)r _watchdog_doner r _stop_impl_bodyrs @r. _stop_implz&GatewayRunner.stop.._stop_impl>$s.? Ss? St? S? S? S? SN'_..N+9D (57         $:>>"788 %3D4OPP- ;  %%o+( ""$$$$$""$$$$s B))B?c  Ktd!jrdndtj |d<dt f fd }d!_d!_t!d d}t|r|d{V! d{V! d{Vtd |!j }g}t!jD]\}}|t ur !j|!jrd nd d{V||P#t($r&}td ||Yd}~{d}~wwxYw!} !} tj} !|d{V\} } td|tj| z | t3| !| !| ! | sc|D]`}|!jvrU !j|d{V-#t($r&}td||Yd}~Xd}~wwxYwa| rtd|!!!!jrd nd }t!jD]d\}}|t ur !j||d{V2#t($r&}td||Yd}~]d}~wwxYw!!jrt<nt>tAj!dz}!jrtAj!|kr_!"dtAj#dd{V!jr)tAj!|k_|dtd|!jrU!j$rN !%d{Vn2#t($r%}t&d|Yd}~nd}~wwxYw!'| d{Vt!dd}t!dd}|||5t|(}|)dddn #1swxYwY|D]>}tU|tVr|dn|}!,|dd{V?t!j-D]!\}}!.||d{V"tt!diD]^\}}t|D]#\}}!.|||d{V$|)_t_!dr!j0)td|t!j1D]*}|!j2ur |!j3ur|4+!j1)!j-)t!jD]}!5|!j)!j6)t_!d r!j7)!j8)!j9)t_!d!r!j:)!j;<|d"td#| dd$l=m>}|n2#t($r%}td%|Yd}~nd}~wwxYwt!d&d}t|d'|}|tt!d(dd'dfD]\}|t_|d)s |?+#t($r%}td*|Yd}~Ud}~wwxYwtA!td+|dd,lBmC}mD}||| s. td-z Fn*#t($rYnwxYwtd.| r4!Gty| H!jr!jI tttjt!jMt!j$d/d0n2#t($r%}td1|Yd}~nd}~wwxYw!jr5!jMr.!Nt!_P!jQpd2!_Qd!_t!d3dr=!js6td4!"d5!jQn!"d6!jQtd7|dS)8NzStopping gateway%s...z for restartr|rr%c0tjz Sr()rDrz)_stop_started_atsr._phase_elapsedzCGatewayRunner.stop.._stop_impl_body.._phase_elapsed$s~''*:::r0FTrr z5Shutdown phase: notify_active_sessions done at +%.2fsrLrMz/pre-drain mark_resume_pending failed for %s: %szShutdown phase: drain done at +%.2fs (drain took %.2fs, timed_out=%s, active_at_start=%d, active_now=%d, cron_at_start=%d, cron_now=%d, api_at_start=%d, api_now=%d)z2clear_resume_pending after drain failed for %s: %szGateway drain timed out after %.1fs with %d active agent(s), %d in-flight cron job(s), and %d api_server run(s); interrupting remaining work.z%mark_resume_pending failed for %s: %sr#rorzpost-interruptz7Shutdown phase: post-interrupt tool kill done at +%.2fsz-Failed to launch detached gateway restart: %srrrzshutdown idle-cacherrrvz3Shutdown phase: all adapters disconnected at +%.2fsrrz final-cleanupz6Shutdown phase: final-cleanup tool kill done at +%.2fs)shutdown_cached_clientsz!shutdown_cached_clients error: %srrrrzSessionDB close error: %sz.Shutdown phase: SessionDB close done at +%.2fsremove_pid_filerelease_gateway_runtime_lockruSkipping .clean_shutdown marker — drain timed out with interrupted agents; next startup will suspend recently active sessions.) requested_atr#r"rMz7Failed to write planned restart notification marker: %szGateway restart requestedruGateway stopped by an unexpected signal — persisting gateway_state=running so container_boot auto-starts on the next boot (issue #42675)rdstoppedz&Gateway stopped (total teardown %.2fs))RrrirrDrzr1rrr}rrh rrrqrrrrmark_resume_pendingrbrFrrr&r'rrr$rKrr!_INTERRUPT_REASON_GATEWAY_RESTART"_INTERRUPT_REASON_GATEWAY_SHUTDOWNrrrerprr rrrrer@rrrrrrrrrrnr0rrrrrrrcrr rr_shutdown_executorrr r rtouchrrrr%rrrr rrr)"r r r stop_watchdogr_pre_drain_keys_sk_agentr_cron_at_start _api_at_start_drain_started_atrr_resume_reasoninterrupt_deadlinerrX _cache _idle_agents_entryrNr_prof_amap_task _session_keyr _self_dbrr r r rs" @r.r z+GatewayRunner.stop.._stop_impl_body$s KK'"&"9Ar    $~// (8  % ;E ; ; ; ; ; ;"DM!DN#D*BDIIM && &#moo%%%%%%%@@BB B B B B B B B::<< < < < < < < < KKG      1G *,O#D$8$>$>$@$@AA ] ] V444]2FF-1-D\))J\$**3//// ]]]LL!RTWY[\\\\\\\\]"88::N 6688M $ 0 0 -1-F-Fw-O-O'O'O'O'O'O'O $M9 KK/    #44M""))++++--**,,     +C$"666"&":"O"OPS"T"TTTTTTTTT("LL T #R7@ 3--////11..00>*.)@X%%FX$((<(B(B(D(D#E#E  KC!888 "6JJ3P^__________$ C ..9=9Px55Vx&-%=%?%?%D%D%F%F%L"*-w/G/I/I/N/N/P/PSe/e/e// ;;;!-,,,,,,,,,*-w/G/I/I/N/N/P/PSe/e/e('(8999 M"N$$ & U4+A UU??AAAAAAAAAA UUULL!PRSTTTTTTTTU00?? ? ? ? ? ? ? ?"$(;TBBKT>488F&6+= ###' #8#8LLLNNN###############+  F%/%>%>Jq F @@(=A&*$-*=*=*?*?%@%@ H H!'44WhGGGGGGGGGG!%WT3F%K%K%Q%Q%S%S T T   u)-ekkmm)<)<%Hg8859 t011 /&,,... KKE      d455  DO++D...    " ( ( * * * M   ! ! ! $T%9 : : @ @ 11,????  & & ( ( (  # ) ) + + +t566 4+11333  " ( ( * * *  # ) ) + + +t^,, *!'')))  $ $ & & & $ #O 4 4 4 KKH      FJJJJJJ'')))) F F F @"EEEEEEEE Ft]D99Hx99H ''$*N*NPUW["\"\] B B;gc7&;&;;BIIKKKK BBBLL!>>> D ' R66s=;M;M;O;O7P7PQQQ& _4+G+O _%:<<,0IKK+/0I+J+J(,T-C(D(D $!___LL!Z\]^^^^^^^^_& U4+D U55777&#D$($5$T9T!"DN,t95AA J$Ja J 3 ++It7HIIII++It7HIII KK@..BRBR S S S S Ss"?E"" F,F  F J!! K+K  K-!N N?N::N?S99 T(T##T(.6V00V47V4:c c:c55c:e,, f6ff:h h$#h$Ak l (ll r)rrrrrr)rrtr(r)r r s` @r.rzGatewayRunner.stop.$s  8&*D #%5D "(7D % ? &/ ! ! ! ! ! ! ! Fl %l %l %l %l %l %l %\o To To To To To Tb "-jjll;;or0cHK|jd{VdS)zWait for shutdown signal.N)rrlrs r.wait_for_shutdownzGatewayRunner.wait_for_shutdown &s3"'')))))))))))r0cKt|jddsdS ddlm}m}n#t $rYdSwxYw|pd}d}i}|jD]#\}}||}|||||f<$|dD]\} } | |kr || | | |d{Vz }.#t$r&} t d | | Yd} ~ Yd} ~ wt$rt $r(} td | | d Yd} ~ d} ~ wwxYw dd lm} dd lm} |gt'|jz}|D]!}|r||jvr| ||j|<"| |n,#t $rtdd YnwxYw|S)u8Bring up adapters for every non-active profile this gateway serves. Returns the number of secondary adapters that connected. No-op (returns 0) unless ``gateway.multiplex_profiles`` is on. Each profile's adapters are created and connected under that profile's HERMES_HOME + secret scope (``_profile_runtime_scope``), stored in ``self._profile_adapters[profile]``, and given a message handler that stamps ``source.profile`` before delegating to the shared ``_handle_message`` — so the agent turn resolves that profile's config, skills, and credentials. Same-platform credential collisions (two profiles polling the same bot token) are detected and refused here, the only point that sees every profile's resolved credentials together. rpFr)profiles_to_serverrNT multiplexzDSkipping secondary profile '%s' due to port-binding config error: %sz-Failed to start adapters for profile '%s': %srrrrv)served_profilesz could not record served_profiles)r}rGrr rrFrr_adapter_credential_fingerprint_start_one_profile_adaptersrbrrr\rrrr rrH rrr rr)rr rrYr2rMrT _adfp profile_namercrrrservedrs r.rz/GatewayRunner._start_secondary_profile_adapters$&st{$8%@@ 1  V V V V V V V V V   11 )(**7i %'---// . .JE355c::B~'- $*;*;d*K*K*K   &L,v%% 4#C#C ,$$ 3   Z  (       C !d  L ; ; ; ; ; ; 4 4 4 4 4 4Xt'='B'B'D'D E EEF  K KKD(;;;0< T0J0J0JD'-  8 8 8 8 8 L L L LL;dL K K K K K LsC% 33 B== D'C((D'?D""D'+A&F&F;:F;r rcrrMc Kddlm}t|5|}t|}dddn #1swxYwY|rt d|d|dt d|jD}|r1d|}td|d |d |d |d |j |i} d} |jD]j\} } | j st|jd dr| tjur3 t|5|| | } dddn #1swxYwYn;#t$$r.}t&d|| j|dYd}~d}~wwxYw| s"t&d|| j|| }|f|| |f}|Ft&d||| j| j|| | d{VG||| |f<|| ||  t|5|| | d{V}dddn #1swxYwY|r,| | | <| dz } t&d| j|n=t&d| j||| | d{V#t$$rI}t&d| j|||| | d{VYd}~dd}~wwxYw| S)z>Create+connect one profile's adapters under its runtime scope.rrqNz Profile 'z ' enables z. Enable GATEWAY_ALLOW_ALL_USERS or the platform allow-all flag for that profile, or change dm_policy/group_policy away from 'open'.c3lK|]/\}}|j t|j|j&|jV0dSr()r_platform_binds_portr{ru)r,rNrts r.r/z.~&s^( ( )/&( %X^_5JKK ( N( ( ( ( ( ( r0rz#' enables port-binding platform(s) z, but gateway.multiplex_profiles is on. The default profile owns the single shared HTTP listener and serves every profile through the /p/z:/ URL prefix. Remove these platform entries from profile 'z='s config.yaml or configure them only on the default profile.rpFz9[MULTIPLEX] Profile '%s': _create_adapter('%s') raised %sTrzQ[MULTIPLEX] Profile '%s': skipping platform '%s' - adapter creation returned NoneuProfile '%s' and '%s' both configure %s with the same credential — refusing to start the duplicate (a single bot token cannot be polled twice). Give each profile its own %s credential.rZu✓ %s connected (profile: %s)u&✗ %s failed to connect (profile: %s)u✗ %s error (profile: %s): %s)rzrqrmr<r\rH r rr2rbrrrr}rGrxrjrrFrrr{rr rBru_configure_profile_adapterrri)rr rcrMrq profile_cfg violationport_binding_platformsjoined profile_mapr2rNrtrrr ownerrs r.r z)GatewayRunner._start_one_profile_adaptersm&s 766666 #L 1 1 H H--//K:;GGI H H H H H H H H H H H H H H H  &LI "(( ( -8-B-H-H-J-J( ( ( " "  " YY566F1BLBBBB+7BB9E BBB ,77 bII  )4)>)D)D)F)F? G? G %Ho"*   %95AA .. +L99NN"228_MMGNNNNNNNNNNNNNNN    O N!   g N 55g>>B~ XrN33$LL-|X^X^ 77JJJJJJJJJ*62'  + +G\8 L L L G+L99$($N$N%%GK,3K)NIKK @(.R^____NN#KX^]ijjj77JJJJJJJJJ G G G =x~|]^___33GXFFFFFFFFFFFFFF Gs>AA.E,=E  E, E$ $E,'E$ (E,, F$6$FF$ L/J LJ LJ A.L M#>MM#c|||||||||j||jt|dd}t|r||j | |j | ||||j|_dS)zDInstall the profile-scoped handlers shared by startup and reconnect.rN)r )r_make_profile_message_handlerr!_make_profile_fatal_error_handlerrrrrr}rrrrrrr)rrr rNrs r.r z(GatewayRunner._configure_profile_adapter&s ##D$F$F|$T$TUUU''  2 2< J J    !!$"4555(()QRRR)?FF M " " 7 M$5 6 6 6%%d&LMMM''  ) )( ) N N   #'"6r0cKd}tj} |jr+d} ddlm}ddlm}||}t|5|j |} | | j s ddd|j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS||| }|t"d|j| ddd|j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS|||||||dd{V} dddn #1swxYwY| r|jr |j|i}||vr|||<||t"d|j| |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS|||d{V |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS| r|||d{V |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS|||d{Vt7|d d rt7|d ds |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdSn~#tj$r ||||d{Vt:$rD||||d{Vt"d |j|d YnwxYw|js |j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS|dz }t?|}t"d|j||tj |d{V|j+|j } t| tr| |} t| tr| |nd} t| tjr| |urIt| tr2| |d| s| |ddSdSdSdSdS#|j } t| tr| |} t| tr| |nd} t| tjr| |urFt| tr0| |d| s| |dwwwwwxYw)zDReconnect a retryable secondary adapter under its own profile scope.rNget_profile_dirr zASecondary %s reconnect skipped: adapter unavailable (profile: %s)Tru ✓ %s reconnected (profile: %s)rFr z3Secondary %s reconnect attempt failed (profile: %s)rrZz1Secondary %s reconnect retry in %ds (profile: %s))!rrbrrr rzrqrmr rBrrr@rAre rrrrr{r rrrrhrirur}rmrFrrr~rp)rr rNrrbrr rqrcprofile_configr" rf rrr r s r. _run_secondary_profile_reconnectz.GatewayRunner._run_secondary_profile_reconnect&s^ +-- Z <-O -ACCCCCCBBBBBB#2?<#@#@L/ ==)<)<)>)>)H)L)LX)V)V)19O1"T4G'4(( <")++l";";8B?TX8Y8Yc**8444_c!$ 55<9M9M!/488<'++Hd;;;.<#KK d;;;;; < <<<:N9M<<[#'"6"6x"P"P"?"NN c ( , #T4G'4(( <")++l";";8B?TX8Y8Yc**8444_c!$ 55<9M9M!/488<'++Hd;;;.<#KK d;;;;; < <<<:N9M<Z&%d&A8\!d \!! d4AdCgc|jr|jsdS|j}t|ts i}||_||i}||vrdSt j|||d|d|j }|||<t|dd}t|tst}||_ | |||jdS)zDSchedule one runner-owned reconnect without sharing primary secrets.Nzsecondary-reconnect:r})rr)rr rr@rArrrr r{r}rcrrerorW)rr rNrr" rf rbackground_taskss r.%_schedule_secondary_profile_reconnectz3GatewayRunner._schedule_secondary_profile_reconnectK's} G$A  F0'4(( 5G-4D *!,,\2>>  & & F"  1 1, I IG GGx~GG   %)!"4)._handlerh's8::<SZ[[ [ [ [ [ [ [ [ [ [r0r)rr rNr s``` r.r z/GatewayRunner._make_profile_fatal_error_handlerd'sM \$7 \D \ \ \ \ \ \ \ \r0cKt|di|}t|tr|||ur#td|j|dS||d|||d{V|j sdS| |||t d|j||j pddS)amRemove a failed multiplexed adapter without touching the primary slot. Secondary adapters are owned by ``_profile_adapters`` rather than ``self.adapters``. The primary-only fatal handler intentionally ignores them; without this route, a fatal secondary Discord client stayed live forever after its liveness sampler stopped. rzBIgnoring stale fatal error from secondary %s adapter (profile: %s)Nz6Fatal %s adapter error for multiplexed profile %s (%s)r4) r}rBr@rArrrr{rrurr rr)rr rNrr s r.r z1GatewayRunner._handle_profile_adapter_fatal_errorm'sd$7<<@@NN +t,,  0I0IQX0X0X LLT    F$'''++GX>>>>>>>>>}  F 22<7SSS D N   $ 1      r0cdddlm} |n#t$rdYnwxYwfd}|S)atReturn a message handler that stamps source.profile then delegates. Auth runs inside ``_handle_message`` *before* the agent-turn scope is installed. For secondary profiles under multiplex, wrap the whole handler in ``_profile_runtime_scope`` so allowlists/tokens from that profile's ``.env`` are visible to ``get_secret`` / authz. rr Nc<K t|dd|jjs |j_n#t$rYnwxYwBt 5|d{VcdddS#1swxYwY|d{VS)Nr)r}rrwrFrmr)rrrcr rs r.r z=GatewayRunner._make_profile_message_handler.._handler's  5(D11=elFZ=+7EL(    '+L99==!%!5!5e!Yuanbao: websockets not installed. Run: pip install websockets)9rr@rurArrGrr}rr is_registeredr{create_adaptergateway_runnerrrrFrrrxWHATSAPP_CLOUD gateway.platforms.whatsapp_cloudr r rSIGNALgateway.platforms.signalr r r WEIXINgateway.platforms.weixinr r r*gateway.platforms.api_serverr r r+gateway.platforms.webhookr r r#!gateway.platforms.msgraph_webhookr r BLUEBUBBLESgateway.platforms.bluebubblesr r QQBOTgateway.platforms.qqbotr r YUANBAOgateway.platforms.yuanbaor r )rrNrGrrrr r r r r r r r r r r r r r r r r r r s r.rzGatewayRunner._create_adapter'sD 67 # #  6<(F(F  L # #) 3    L # #* %?GG     \ C C C C C C ..x~>> +::8>6RR&.2G*"N 6N t' ( \ \ \ LLGYZ [ [ [ [ [ [ [ [ \ x. . .        5466 Vt''// /  ( (           -,.. EFFFt))&11 YZZZt =(( (  ( ( Y Y Y Y Y Y Y Y,,.. KLLLt =(( ( , , , d d d d d d d d0022 BCCCt&&v..G%)G "N ) ) ) \ \ \ \ \ \ \ \--// ?@@@t$nV,,G%)G "N 1 1 1        6577 GHHHt((00 0 - - - h h h h h h h h1133  BCCCt%%f-- -  ' ' P P P P P P P P((** jkkkt9V$$ $ ) ) ) V V V V V V V V' _```t!>&)) )tsAC) C)) D3!DDc  ddtdttdttdtffd }|S)u@Build a platform-bound auth callback for adapter use. Adapters that fetch external context (e.g. Slack ``conversations.replies``) call this through ``BasePlatformAdapter._is_sender_authorized`` to mark non-allowlisted senders as unverified in LLM context, mitigating indirect prompt injection from third parties in shared threads/channels. The returned callback delegates to :meth:`_is_user_authorized` so the full auth chain — platform allowlists, group allowlists, pairing store, allow-all flags — stays the single source of truth. ``profile_name`` binds the callback to the secondary adapter's own multiplex profile, so its ``SessionSource`` resolves that profile's secret scope instead of falling back to the active profile. Nrr+rr%cf|sdSt|pd|pd|}|S)NFr|r)rNrr+rrw)rrP)rr+rrrNr rs r.checkz5GatewayRunner._make_adapter_auth_check..checkk(sT  u"! 2#.w$ F++F33 3r0r)rCr r)rrNr r s``` r.rz&GatewayRunner._make_adapter_auth_checkV(sm.(,%) 4 4 4} 4c] 4  4 4 4 4 4 4 4 4 r0rc $K||}|sdSt|dd}|rjt|ddtjkrKt |t|ddr,t dt|dddSd}|r*t|dr||j }| |}|dkrt|d drz | |j |j || d{V}t|d d rdSn<#t$r/t d t|dddYnwxYw||j || d{VdS)zIDeliver a setup/operational notice using platform-specific privacy rules.NrGrNrz@Skipping Slack platform notice for configured ignored channel %spublicget_notice_deliveryprivaterrrFz7[%s] send_private_notice failed, falling back to publicr7Tr)r#r}rxryrrrirr rNrRsend_private_noticerrrFrrr)rrrrrGnotice_deliveryr~r.s r._deliver_platform_noticez&GatewayRunner._deliver_platform_notice(s**622  Fx..   D11X^CC)&'&)T2R2RSSD KKR 400    F"  Jgf&;<< J$88IIO33F;; i ' 'GFIt,L,L ' &::NN% ;   69e44F    MFJ44! ll6>7XlFFFFFFFFFFFs4:D116E*)E*rpinned_session_idcKtt|j}|tddSd} ||d{V}n-#t $r td|dYnwxYw|td|dS|}d}|dr|d d kr1td ||d dSd} | |d{V}n/#t $r"td |dd}YnwxYw|r||krtd |dS ||d{V}n#t $rd}YnwxYw||dr"td||dnddS|j ||hv}|s ||j d{V} | N| dr9| d d kr | |j d{Vnd} n#t $rd} YnwxYw| |k}|s$td|||j dS||j kr|S|j } |r(|j |j | |d{V} n&|j |j |d{V} | #td|j |dStd|| |j | S)aResolve an async completion to its verified owning gateway session. A compression rotation ends the physical parent row while continuing the same logical conversation in a child. Follow that lineage, but never let a late completion override an unrelated /new or restored route. Unknown ownership remains fail-closed; the result is still available in the delegation records. Nz]Async-delegation completion has no session database; dropping injection (#55578 fail-closed).z,Async-delegation parent lookup failed for %sTrzeAsync-delegation completion has unknown spawning session %s; dropping injection (#55578 fail-closed).Fended_at end_reasonr9zAsync-delegation completion pinned to ended session %s (end_reason=%r); dropping injection instead of resurrecting it (#55578 fail-closed).z5Async-delegation compression-tip lookup failed for %szgAsync-delegation completion pinned to compressed session %s without a continuation; dropping injection.zGAsync-delegation compression continuation %s is %s; dropping injection.r4endedzoAsync-delegation completion for compression lineage %s -> %s does not own current route %s; dropping injection.zcAsync-delegation completion could not bind routing key %s to owning session %s; dropping injection.z\Pinned async-delegation completion to owning session %s (was %s) for routing key %s (#57498))rr rrrrrFrrrBget_compression_tipr3radvance_compression_sessionrr- ri) rrr r pinned_rowtarget_session_idfollows_compressiontip_rowroute_owns_lineage route_row route_tipprior_session_idr9 s r.!_resolve_async_delegation_sessionz/GatewayRunner._resolve_async_delegation_session(s#t/00   NN;   4  )556GHHHHHHHHJJ    LL>!          NN;!    4-# >>* % %J ~~l++}<<,&NN<00 t"&  )*4*H*H%++%%%%%%!! ) ) ) K%! %)!!!  )% (9=N(N(NB% t  * 6 67H I IIIIIII    '++j"9"9*%!(IIg  t!.!9!!>" & D %&0&<&<]=U&V&V V V V V V VI%0%MM*551%MM,77=HH)<<]=UVVVVVVVVV" I!%%% $III%%.2C%C"% I%%!, t  8 8 8 (3  !5QQ) !HH "5DD)!H   NN9)!     4  3    %    sHA'BB D)))EE>F F)(F)3A2I&& I54I5c `Kj} ddlm}|n,#t$rtddYnwxYwt tdd}|syt|dd tj krZttd d t|d d r,t d t|d d d Std dr*|s(tdds d S|s |s* ddlm}|dj}n4#t$r'}td|g}Yd }~nd }~wwxYw|D]}t%|t&s|d} | dkrMt d|d|jr |jjnd|jpdd S| dkrI|d} t%| t0rt3j| j}n | dkrn|rn|j>|s'td|jjd Snv|s`td|j|j|jj|jdkr!|j|j d kr|jr |jjnd} j!"| |jrd Sj!#| |j|jpd!} | rC$|} | r+| %|jd"| d#| d$| d%d {VnX$|} | r!| %|jd&d {Vj!&| |jd S'|}td'i}||rAj(pd!)}*}|d(vrd)}nX|d*vrd+}nQd }|rF dd,l+m,}n#t$rd }YnwxYw|* ||}|r|j-nd }n#t$rd }YnwxYw|rd!}n|}|rt\d-z }t\d.z } |/d/}|0||||1d0n7#td$r*}td1|d2|cYd }~Sd }~wwxYw|3|d ti|d3kr|n |d d3d4z}d5|d6S|rt\d-z }t\d.z } |/d/}|0d!|||1d0t d7||n2#td$r%}td8|Yd }~nd }~wwxYw|3|d d } dd9l5m6}|7|d:}n#t$rd }YnwxYw||̉j(pd!)}|r|8d;s|9||}|rt d<||j:$|}|rH |;|jn,#t$rtd=dYnwxYwd!Sdd>l5m<} | =|}!d}" dd?l>m?}#|#|}"n#t$rd}"YnwxYw|!r|"s̉j(pd!)}$|$@d@A}%*}&d }'|&dAvrdB}'n"|&dCvrdD}'n|&dEvrdF}'n|%dGvrdB}'n |%dHvrdD}'n|%dIvrdF}'|'4| B||!dJ|'d {V}|pd!S| C|tdKdL}(jE|d})|jFvrz|)rwtjG|)z }*jF|}+tdM},d!}-|+rt|+dNr |+J}.|.dOtdM},dP|.dQddR|,dSdT|.dUdd;|.dVd}-n#t$rYnwxYw|(dkrt|(dWzdXntdM}/|+tuo|(dkr|,|(kp|*|/k}0|0rKtdY||*|,|(|-M|dZ[N||jFv r*d\krOd {VSdd]l+mP}1m,}2*}3|3r |2|3nd }4|3r!|4Q||4j-}5|5|5S|4r(|4j-d^krt d_|d!S|4r&|4j-d`krRd {VS|4rf|4j-dakr[S||tdbcd {Vt dd|ttdeS|4rJ|4j-dfkr?S||tdgcd {VXd {VS*dhvr~Y)}6t tdid }7|6s|7sdjS$|} | rtd7id|6dk|7rj[n tj]dljdmj^dnj_dittdigpgdottdogpgdpjadqjbdrjcdsjddtjedujfdvjgdwjhdjidxjj}8k||8| l|$|y}9|9dzkrd{Sd||9d}S|4r|4j-d~krY)}:|:sdSjF|};|;turV$|} | r=t|:tj]jj_jgjh}8|8| jm|<dS|;rt|;d~r{ |;n|:}d|>dSdS$|} | r=t|:tj]jj_jgjh}8|8| jm|<dS|4r |4j-dkrdS|4r |4j-dkrdS|4rJ|4j-dvrA|4j-dkrod {VSpd {VS|4r&|4j-dkrqd {VS|4r&|4j-dkrrd {VS|4r&|4j-dkrsd {VS|4r|4j-dkrYpd!)A}?|?r|?td dzdnd!}@|? p |?dvp|@dk}A|Arud {VSdS|4r |4j-dkrdS|4r&|4j-dkrvd {VS|4r{|4j-dvrr|4j-dkrwd {VS|4j-dkrxd {VS|4j-dkryd {VS|4r|4j-|1vr|4j-dkrzd {VS|4j-dkr{d {VS|4j-dkr|d {VS|4j-dkr}d {VS|4j-dkr~d {VS|4r d|4j-dSj[tjkrKtd|$|} | rt| jm|d Sttjdd}BjE|d}C|jtjkrj[tj]kr|Bdkr|CrtjG|Cz |BkrtdtjG|Cz |$|} | r<jdkrk|| nt| jm|dd SjF|};|;tur*dakr?N|t d|tdS$|} | rt| jm|dd Sjrnr|rddnddSjdkr3td||d Sjd~krj(pd!)}:d}Dj[tj]kryjsrjsk|:rit|;d~rY t |;n|:}Dn5#t$r(}=td||=d}DYd }=~=nd }=~=wwxYw|Drtd|d Std||d S|;r3t d||d S|d {Vr3t d||d Sj[tj]krjsjst|;dddurt|;dr |;j(pd!)rtd|d Sn3#t$r&}=td||=Yd }=~=nd }=~=wwxYwtd|j(}Etdid pg}Fr>$||j(pd!dd {V\}E}Gn|Es|Frt!}E|;|Ed S*}Hddl+m}Im}Jm,}K|Hr |K|Hnd }|r|j-n|H}L|Hre|bt%jt&rjdipi}Mntjdipi}Mt%|Mt&r|H|Mvr|M|H}N|Nddkr|Nd¦pd!)}O|Or|O8d;r|Ond;|O}O|O@d;}PY)}Q|Od$|Q)_(|Pr|Ptdn|P}H|Hr |K|Hnd }|r|j-n|H}L|Hr'|Lr%|J|LrQ||L}5|5|5S|Hrg|J|Lr[Y)}R|jr |jjnd!|j|L|H|R|RdÜ}S jd|L|Sd {V}Tn5#t$r(}Utd|L|Ug}TYd }U~Und }U~UwwxYw|TD]}Vt%|Vt&st1|Vdd!)A}W|Wr|Wdkri|Wdkr8|VdȦ}Xt%|Xt0r|Xr|XcSd|HdʝcS|Wdkr2|VdȦ}Xt%|Xt0r|Xr|Xnd cS|Wdkrt1|Vdd!)@d;}Y|Ys1t1|Vdd!)}Zd;|Yd$|Z)_(*}H|Hr |K|Hnd }|r|j-n|H}Ln|Ldfkr[t/jj|d {VrSfd΄}[dfdd|[Ѧd {VS|Ldkrd {VS|Ldkrzd {VS|Ld^krt d|d!S|Ldkr{d {VS|Ldkr|d {VS|Ldkrd {VS|Ld\krOd {VS|Ldkrqd {VS|Ldkrd {VS|Ld`krRd {VS|Ldakrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrddlm}\Y)}]|]rdnd}^ $|} | rE|}_| %t1|j|^|_ܦd {Vn,#t$rtddYnwxYw |\|]_(n#t$rYdSwxYw|Ldkrd {VS|Ldkrxd {VS|Ldkryd {VS|Ldkrwd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrsd {VS|Ldkrd {VS|Ldkr d {V}`t|`dd }a|art|`dd!pd!}^|^r $|} | rE|}_| %t1|j|^|_ܦd {Vn,#t$rtddYnwxYw |a_(n6#t$rt|`dd!pd cYSwxYwt|`dd!pd S|Ldkrd {VS|Ldkrfd}bdz}cY)}d|drS tdzt[|dtd}cn#t\t^f$rdz}cYnwxYw|cdzkrdnd|cd}edd|e|bѦd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrod {VS|Ldkrpd {VS|Ldkr}d {VS|Ldkr~d {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrd {VS|Ldkrrd {VS|LdkrCY)}f|fsdjS |f_(n#t$rYnwxYw|Ld~krCY)}g|gsdS |g_(n#t$rYnwxYw|Ldkrud {VS|Ldkr ddlm}hm}iddlm}jY)}k|ks |hS |j}l|it%|lt&r|ldni}mn#t$r|ii}mYnwxYw|md}n |k_(j|_d|nddddj|<|d_n#t$rYdSwxYw|Ldkrvd {VS|Ldkrd {VSjrddS|Hrt%jt&rjdipi}Mntjdipi}Mt%|Mt&si}M|H|Mvr^Q||H}5|5|5S|M|H}N|Nddkr9|Ndd!}o|or ddlm}p|ptj}qt/j|ot.jjt.jj|qd {V}rt/j|rd  d {V\}s}t|sp|t)}u|urdd lm}v|v|u}u|ur|und S#t.j$rYd St$r}d|cYd }~Sd }~wwxYwd|HdS|Nddkr|Nd¦pd!)}O|Or|O8d;r|Ond;|O}O|O@d;}PY)}Q|Od$|Q)_(|Pr|Ptdn|P}Hnd|HdSd|HdS|Hr ddlm}w|w|Hdd}x|xraY)}Q|x|Q}yt/j|yr|yd {V}y|yrt1|ynd Sn3#t$r&}td|Yd }~nd }~wwxYw|Hrd}z ddlm}{m}||||H}}|}Y)}~|jr |jjnd }|{|}|~||}|rB|\}}}|_(d}z|r1t d|}d|n3#t$r&}=td|=Yd }=~=nd }=~=wwxYw|Hr"tdds ddlm}m}m}|||H}|>|dd!}|jr |jjnd }|r$|r"ddlm}||| vr d!|d"|d#SY)}~ dd$lm}m}||~\}}n#t$r d }g|~}}YnwxYw|rH|rFddlm}|| fd%|D}|r d!d|d&|d'S|r,|*||g|||(}|r|\}}}|_(nd)|Hd*S|||~|(}|r|_(ngt|H}|r|S|Hdd|Ivr9td+|H|jr |jjnd,d-|Hd.Sn3#t$r&}td/|Yd }~nd }~wwxYwt/jj|d {Vr+|rSd Sjr"|s t d0| d1S||\}}|t d2||S|"td3si_|j|<tjF|<tjGjE|<|} |||d {V} d!}t%|t&r&t1|d4pd!}nt%|t0r|}|)rU j|d {V}n#t$rd }YnwxYw||||5d {Vn3#t$r&}td6|Yd }~nd }~wwxYw|||N|||S#||N|||wxYw(8a Handle an incoming message from any platform. This is the core message processing pipeline: 1. Check user authorization 2. Check for commands (/new, /reset, etc.) 3. Check for running agent and interrupt if needed 4. Get or create session 5. Build context for agent 6. Run agent conversation 7. Return response r)reset_session_varsz*reset_session_vars failed at handler entryTrrAFrNNrGrz9Dropping Slack message from configured ignored channel %srr6rpre_gateway_dispatch)rrrrz*pre_gateway_dispatch invocation failed: %srskipz8pre_gateway_dispatch skip: reason=%s platform=%s chat=%srJr4rewriterrallowz(Ignoring message with no user_id from %sz Unauthorized user: %s (%s) on %sr,rvpairr|z;Hi~ I don't recognize you yet! Here's your pairing code: `z5` Ask the bot owner to run: `hermes pairing approve rNrzr=r4r1>r8r9r7resolve_command.update_response.update_prompt.jsonz.tmprz#Failed to write update response: %su/✗ Failed to send response to update process: …u ✓ Sent `z` to the update process.ziRecognized /%s during pending update prompt for %s; cancelled prompt with default and dispatching commandz=Failed to write cancel response for pending update prompt: %sclarify_gateway)include_choice_promptsr%z=Gateway intercepted clarify text response (session=%s, id=%s)z.Failed to resume typing after clarify response slash_confirmr.z!/>r2r=r4r5once>r<rememberr<>r8r9rn nevermindrn> approve oncer: r4>r<r=>r8rnr< confirm_idrrr[seconds_since_activityz | last_activity=last_activity_descrK.0fzs ago) | iteration=rGrHrc i zWEvicting stale _running_agents entry for %s (age: %.0fs, idle: %.0fs, timeout: %.0fs)%sstale_running_agent_evictionrstatus)ACTIVE_SESSION_BYPASS_COMMANDSr0 r z3Ignoring /start platform ping for active session %srtr stop_command)interrupt_reasoninvalidation_reasonu@STOP for session %s — agent interrupted, session lock releasedzgateway.stop.stoppednew new_command>qr}rzUsage: /queue rvr raw_messagerTrqr reply_to_textreply_to_author_idreply_to_author_namereply_to_is_own_message auto_skillrichannel_contextr/rwrZzQueued for the next turn.zQueued for the next turn. (z queued)r~zUsage: /steer )rrvrrTrirR u9Agent still starting — /steer queued for the next turn.zSteer failed for session %s: %su⚠️ Steer failed: rru8⏩ Steer queued — arrives after the next tool call: 'rzSteer rejected (empty payload).u4No active agent — /steer queued for the next turn.ru=Agent is running — wait or /stop first, then switch models.z codex-runtimeu>Agent is running — wait or /stop first, then change runtime.>r9r4r4agents backgroundkanbangoal>rprrepauseresumerD unwaitrluiAgent is running — use /goal status / pause / clear / wait mid-run, or /stop before setting a new goal.moau8Agent is running — wait or /stop first, then run /moa.subgoal>yolofooterverboser\ r^ r] helpcommandsrwrfversionu⏳ Agent is running — `/zE` can't run mid-turn. Wait for the current response or `/stop` first.uFPRIORITY photo follow-up for session %s — queueing without interrupt&HERMES_TELEGRAM_FOLLOWUP_GRACE_SECONDSz3.0uVTelegram follow-up arrived %.2fs after run start for %s — queueing without interruptr}r!u7HARD STOP (pending) for session %s — sentinel cleareduE⚡ Force-stopped. The agent was still starting — session unlocked.r(r)r*r+z'PRIORITY queue follow-up for session %sz(PRIORITY steer failed for session %s: %szPRIORITY steer for session %sz/PRIORITY steer-fallback-to-queue for session %szjPRIORITY interrupt demoted to queue for session %s because the running agent has active subagents (#30170)zdPRIORITY interrupt demoted to queue for session %s because context compression is in flight (#56391)rBrCz PRIORITY redirect for session %sz+PRIORITY redirect failed for session %s: %sz!PRIORITY interrupt for session %szVoice-priority-interruptrD)GATEWAY_KNOWN_COMMANDSis_gateway_known_commandr0 quick_commandsraliasr)rNrr raw_commandrQrzcommand:z/command:%s hook dispatch failed (non-fatal): %sdecisionr9rz Command `/z` was blocked by a hook.handledrrc>Kd{VSr()_handle_reset_commandrrrsr. _do_resetz0GatewayRunner._handle_message.._do_reset,s-!77>>>>>>>>>r0z/newzJThis starts a fresh session and discards the current conversation history.)rrrr% detailexecutetopicz,Ignoring /start platform ping for session %swhoamirTmemoryskillslearn)build_learn_promptu+Learning a skill from what you described…u*Learning a skill from this conversation…rzlearn ack send failedu,Could not start /learn — please try again.r personality suggestions blueprint agent_seedzblueprint ack send failedretryundoc>Kd{VSr()_handle_undo_commandrl sr._do_undoz/GatewayRunner._handle_message.._do_undov-s-!66u=========r0z;This removes the last user/assistant exchange from history.zThis removes the last z user turns from history.z/undosethomecompressusagetopupinsightsz reload-mcpz reload-skillsbundlesrrr% rX rCbranchrollbackzJUsage: /steer (no agent is running; sending as a normal message)) moa_usagenormalize_moa_configrdefault_presetz moa://localzmoa-virtual-providerchat_completions)rrrryrPzFailed to prepare MoA turn.r^z) and is not accepting new work right now.execr)_sanitize_subprocess_envrr{rrzCommand returned no output.zQuick command timed out (30s).zQuick command error: zQuick command '/z' has no command defined.z' has no target defined.z4' has unsupported type (supported: 'exec', 'alias').)get_plugin_command_handlerrrz"Plugin command dispatch failed: %s)build_bundle_invocation_messageresolve_bundle_command_key)task_idrNz$Bundle %s skipped missing skills: %srzBundle dispatch failed: %s_bundle_handled)get_skill_commandsbuild_skill_invocation_messageresolve_skill_command_keyr)get_disabled_skill_namesrRrz** skill is disabled for z(. Enable it with: `hermes skills config`)&build_stacked_skill_invocation_messagesplit_stacked_skill_commandscg|]X}|iddv.|iddYS)rr|r)r,r_plat_disabled skill_cmdss r.rz1GatewayRunner._handle_message...sj+++ !)~~a4488DDVV'NN1b1155fbAAVVVr0z8** skill(s) in this stacked invocation are disabled for z*. Enable them with: `hermes skills config`r z#Failed to load stacked skills for /ruOUnrecognized slash command /%s from %s — replying with unknown-command noticer7zUnknown command `/zl`. Type /commands to see what's available, or resend without the leading slash to send as a regular message.z*Skill command check failed (non-fatal): %su;Refusing new turn for session %s — external drain active.u⏳ This agent is draining for a maintenance action and isn't accepting new turns right now. It'll be back in a moment — please resend shortly.z@Rejecting new active session %s: max_concurrent_sessions reachedrri)rrriz!goal continuation hook failed: %sr)rgateway.session_contextr) rFrrrrr}rxryrrir4rfrrrrr@rArBrNr{rrCrr4rrPrQr+_get_unauthorized_dm_behaviorrwr _is_rate_limited generate_coder#r_record_rate_limitrrrD get_commandr(r0 rr with_suffixrPr rdrrtoolsr6 get_pending_for_sessionr!resolve_text_response_for_session clarify_idresume_typing_for_chatr9 get_pendingrUr/rrEr^clear_if_staler?rrrDr1rr[rr"_invalidate_session_run_generationr0_handle_status_commandrE _check_slash_access_handle_restart_command_interrupt_and_clear_session_INTERRUPT_REASON_STOPrr_INTERRUPT_REASON_RESETrk get_command_argsrrvrr$rL rTrqrrM rN rO rP rQ rirR rAr/rrrr~rVrW_handle_agents_command_handle_background_command_handle_kanban_commandr1_handle_goal_command_handle_subgoal_command_handle_yolo_command_handle_verbose_command_handle_footer_command_handle_help_command_handle_commands_command_handle_profile_command_handle_update_command_handle_version_commandrwrr`rzrrrrr&r{rrqrrrCrYrZrrrc rd rGr  emit_collectrrrr _maybe_confirm_destructive_slash_handle_topic_command_handle_whoami_command_handle_platform_command_handle_stop_command_handle_reasoning_command_handle_memory_command_handle_skills_commandagent.learn_promptru rR_handle_fast_command_handle_model_command_handle_codex_runtime_command_handle_personality_command_handle_suggestions_command_handle_blueprint_command_handle_retry_commandr0r2 IndexError_handle_set_home_command_handle_compress_command_handle_usage_command_handle_topup_command_handle_insights_command_handle_reload_mcp_command_handle_reload_skills_command_handle_bundles_command_handle_debug_command_handle_title_command_handle_resume_command_handle_sessions_command_handle_branch_command_handle_rollback_commandhermes_cli.moa_configr r rKrr=_moa_restore_overrider. _moa_disable_after_turn_handle_voice_commandtools.environments.localr rarcreate_subprocess_shellrrrrrrrrr rqagent.skill_bundlesr r r2localsagent.skill_commandsr r r rr r r rrrrr rr_begin_session_run_generation_handle_message_with_agentrr, _post_turn_goal_continuation_restore_moa_one_shot(_restore_pending_one_turn_model_override_release_turn_lease)rrrrr) is_internalr _hook_results _hook_exc_result_action _new_textr coder _quick_key_update_promptsr>rr< _recognized_cmd_resolve_update_cmd_cmd_def response_path prompt_pathtmprlabel _clarify_mod_pending_clarify_raw_clarify_reply _resolved_clarify_adapter_slash_confirm_mod_pending_confirm_tool_approval_liver/ _raw_reply _norm_reply _cmd_reply_confirm_choice_raw_stale_timeout _stale_ts _stale_age _stale_agent _stale_idle _stale_detail_sa _wall_ttl _should_evict_DEDICATED_HANDLERS_resolve_cmd_inner_evt_cmd_cmd_def_inner_denied queued_text has_mediarrrpr acceptedrpreview _goal_arg _goal_verb _is_control_telegram_followup_grace _started_atrnrurvrrrc rd _resolve_cmd canonicalre qcmdrtarget_command user_argsrhook_ctx hook_results _hook_err hook_resultrh rrJ new_argsrm ru _learn_req_ack _ack_meta_blueprint_result_blueprint_seedr~ _undo_n _undo_raw _undo_detail queue_payload steer_payloadr r r moa_payloadrQmoa_cfgpresetexec_cmdr sanitized_envrrrr8rr plugin_handlerr.r r r bundle_keyuser_instruction _bundle_plat bundle_resultr\_loadedmissingr r r cmd_key _skill_namerT _get_plat_disabled_build_stackedr extra_keysstacked_instruction_disabled_extrastacked_result_missing _unavail_msg_active_session_lease_limit_message_run_generation _agent_result _final_textr _goal_excr r s`` @@r.rzGatewayRunner._handle_messageA)s-B V B B B B B B    V V V LLEPTL U U U U U V 75*e<<==   D11X^CC)h--wvy$/O/OD KKK 400   4 D8% @ @  E#CUKK   - -e 4 4 44 4  1 1 3 3 3  #JJJJJJ , * "&"4 !!!  # # #KYWWW "  #)  !'400!++h//f$$KKR H--17O--i3)   44i'' ' F 3 3I!)S11. + 3E J J J!&Eg%%E& 4   ^ #++F33  GI^___t ))&11(  NN=v~vO_agapav w w w D((66O"N7  :@ W 5 5i %66}fnUU 4)77!6>63C3IrY"66v>>G%ll"NO:>OO8EOOHLOOO#66v>>G%ll"N6 &99-XXX411&99 !$(@"EE   z * *@ 6:#**,,C##%%C((( # && # "& 33^^^^^^^$333.2+++3*63':':3'?'?H?G.QhmmTOO(333.2OOO3"($&MM$'M D ,/A A *-BB Q'33F;;CNN=111KK ...&&$&7777QQQNN#H!LLLPQPPPPPPPPQ ##J555),]););r)A)A }UXVXUXGY\aGaCECCCC 6 ,/A A *-BB '33F;;CNN2&&&KK ...&&$&777KKP'"  NNW  ##J555  $ = = = = = =+CC4 D     $ $ $#    $  'L,D"'*"2!9!9!;!;  " *<*G*G*L*L (JJ 2 KKW"$4$?(,'?'?'G'G$',CCFNSSSS("LL P)-)2 >=====-99*EE# ( < < < < < <"7"7 "C"C   ( ( ("'    (  :$7 :**1133J %++D117799K**,,J"O@@@"(555"*DDD"* CCC"( <<<"* ==="**"4"<"< 0 4 4\ B BO## !B&  - -j 9 9 9((>EE+// A>> - - -) -y0J/33J??L  ,,KM  6L M M  &;;==C"%''*BE%LL"Q"QKeCGG4H),T,Tee'4ee'*ww/?'C'CeeFIggN^`aFbFbee"M !D ?QST>T>T.3T:::Z_`eZfZfI$;;'!+Q ?Q0Q.!I-  >B K&  779811*=== - - -  ""h..!88?????????        ((**H=EO//9994N #N6226>;NOO&"N  ."5"@"@ QS]^^^r A."5"B"B!99%@@@@@@@@@ A."5"?"?77%;(6 8  ^`jkkk%a(>&?&?@@@ ?."5">">77%<(5 8"77>>>>>>>>>   ""n44#4466<<>> ! d!C!CDD "49433226::J#/$$$([$;D%ZU%7%7+JZ$ %||$%*$5$5 $ $)#3#3 $ $(|R(H(H(NB#O#O#O $%) r)J)J)Pb$Q$Q$Q$-2,E,E$',&9&9$,1+C+C$.3-G-G$160M0M$$)#3#3$(-';';$).(=(=$ "'!$"#(//#$L&&&z<III))*d>V>VW]>^>^)__A::66DUDDDD) N."5"@"@"3355;;== !433 $ 4 8 8 D D  $;;;"66v>>G M'3!+)4)9#(<','7+0+?,1,A ((( AM1*=VV =W]G%D%D ==#0#6#6z#B#B$==='H*VYZZZR>RUUXZ"[dZadddd<<226:: I#/'%0%5$|#(#3',';(-(= $$$L=IG-j9MM W."5"@"@VV +."5"H"H** >."59L"L"L!&)33!%!=!=e!D!DDDDDDDD!66u========= @."5"A"A!88?????????  D."5"E"E!<">QQ  A."5"B"B!99%@@@@@@@@@ D."59V"V"V!&&00!%!:!:5!A!AAAAAAAA!&)33!%!=!=e!D!DDDDDDDD!&(22!%!!>u!E!EEEEEEEE!&)33!%!=!=e!D!DDDDDDDD!&(22!%!>  N 44ZGGGt<$& $ H "%)Z%<%<*y**H&&        " " " Ey "  " ,   !+t44{z2>>??EEGGMMOO8w#6#6v%%)ooi88G!'3//'G'&IIIIIIIy(()ooi88G&0#&>&>T7T77PTTTTy(("%#;;##eggffSkk '! ";??:r#B#BCCIIKKH!=[!=!=8!=!=!C!C!E!EEJ#//11G8?I||G444TH19 F wIE)   &t'I6RRRRRRRR ?<<>>> ? ? ? ? ? ?>>,"?            33E:::::::: :   22599999999 9    KKF S S S2  " "66u======== =  ! !55e<<<<<<<< <  44U;;;;;;;; ;  44U;;;;;;;; ;  44U;;;;;;;; ;  " "66u======== =  ! !55e<<<<<<<< <   22599999999 9  # #77>>>>>>>> >  44U;;;;;;;; ;  44U;;;;;;;; ;    > = = = = =//117799JB==A   E226::V $ @ @ H HI!,,s6>':':D9,UUUUUUUUU E E E 4t DDDDD E F// ;;  F F FEEE F   22599999999 9  ! !55e<<<<<<<< <  44U;;;;;;;; ;   22599999999 9   33E:::::::: :  ' ';;EBBBBBBBB B  % %99%@@@@@@@@ @  44U;;;;;;;; ;  % %99%@@@@@@@@ @  # #&*&D&DU&K&K K K K K K K %&7tLLO F0&"==CQQ"&":":6"B"B"^(,(H(H(P(PI"),,s6>/B/BDS\,"]"]]]]]]]]$QQQ %@4 PPPPPQJ!0EJJ JJJ"#4fbAAITIIIJ0&"==EE   33E:::::::: :    > > > > > >G..006688I  !!S):):1)=%>%>??GG"J/   GGG a<<NMPgPPP  >># ?   ! !66u======== =  " "66u======== =   33E:::::::: :   33E:::::::: :  " "66u======== =  $ $88???????? ?  ' ';;EBBBBBBBB B  ! !55e<<<<<<<< <  ! !55e<<<<<<<< <   22599999999 9  44U;;;;;;;; ;  ! !55e<<<<<<<< <   33E:::::::: :   33E:::::::: :  44U;;;;;;;; ;  " "66u======== =  44U;;;;;;;; ;  " "66u======== =  $ $88???????? ?   !2244::< mlT%?%?%A%Alll l ; l$+t,, R!%1A2!F!F!L"!(6F!K!K!Qrnd33 $!#.((2267CC&"N%g.88F##v--#xx 266HU?ZYYYYY,D,DRZ__EVEV,W,WM)0)H ('.'9'>'.'9'>$1 ***$$$$$$D 4;3CDDTDTDVDV`b3c3c3c-c-c-c-c-c-cNFF&,&6%>%>%@%@%F%F%H%HF%G N N N N N N)>)>v)F)F-3#V669VV&3DDD#C#C#C(???#>1#>#>>>>>>>? U'TTTTXXf%%00"hhx006B==??FT+1+<+ > @ @I+^I66F*622.'-*0:3v;;;d: ;  H H HCQGGGGGGGG H ! B$O B87@@ )','='='?'?'E'E'G'G$ =CO#U6?#8#8QUL$C$C"$4j!-%%%M%0=-Wg%( *.""KK F *DIIg,>,>  B B B;SAAAAAAAA B j N688<<(95AAj Ni N 0/11 33G<<& #-W"5"9"9&""E"EK5;_NFO11$Edddddd&*<*N$7 O"eeddddd););U)K)K)K+++++%/+++ +!L?)C)C!L!LGL!L!L!L "-n&@)7$2z2/$.*** *T5C2C(),EJJ$T#S#S#SS<<#%5z-),EJ $>@@@4  & {  KKM    )  150O0O  1 1 -~  % KKR   " ! ,4!9:: 1.0+6KD ' 3+BZ(.2ikk + ##%%%<`` one-shot model override after its turn. Called from the ``finally`` of the message-handling path so the revert fires whether the turn succeeded, raised, or was interrupted. A no-op unless ``event._moa_disable_after_turn`` is set. ``_moa_restore_override`` carries the prior per-session override (``None`` means the user had no override, so the MoA override is cleared outright). r FNr )r}r=rr. rF)rrrrQ _restores r.r z#GatewayRunner._restore_moa_one_shot_/su7??  F u&=tDDH-11)TBBBB;C-i8  $ $Y / / / / /    DD sAA%% A32A3c|sdS |j|d}|sdS|||dS#t$r tddYdSwxYw)zBRestore a per-session model override after ``/model --once`` runs.Nz)Failed to restore one-turn model overrideTr)r>r_restore_session_model_overriderFrrrrrrs r.r z6GatewayRunner._restore_pending_one_turn_model_overridet/s  F U<@@dSSH   0 0h G G G G G U U U LLDtL T T T T T T Us==&A'&A')rrc 8K|pg}t|d}|rt|ddn|jpd}t|jdd}t|jdd}|p||}||t |||} | rL|jrEt|j} |j tj kr|j r | d |j d } d | d |}t|d dr |j d|}g} g} |jr#g} g}t|jD]\}}|t!|jkr |j|nd}t%||r| ||jt*jkr| |n'|s%t/||r|||ds|s*|jt*jkr| || rMt5j|j||d{V}|dkrWt|dd}| i}||_t=| ||<t> dt!| nt> d|t!| d} |!||\}}tE|pi}||d<n,#tF$rt>$ddYnwxYwddl%m&}||5|'|| d{V}dddn #1swxYwY|r|(||d{V\}}|r|)r|*|}|+||,|}|r_|D]\} |-|j.d|d|d{V+#tF$r%}t>$d|Yd}~Ud}~wwxYw| rddl/m0}| D]}tbj23|}|4dd } t!| d!kr| d n|}!tkj6d"d|!}!||}"d#|!d$|"d%}#|#d&|}| rddl/m0}| D]}$tbj23|$}|4dd } t!| d!kr| d n|}!tkj6d"d|!}!||$}"d'|!d$|"d(}#|#d&|}|jrnddl7}%ddl/m0}&hd)}'t|jD]J\}}t%||s tq||sts||r7|t!|jkr |j|nd}|d*vr]tbj2:|d+;}(|(|'vrd,}n|%<|\})}*|)r|)}nd-}tbj23|}+|+4dd },t!|,d!kr|,d n|+}-tkj6d"d|-}-|&|}.t{|-|.|}/|/d&|}L|Mt|d.dtj>kr.t|d/drdd0l?m@}0|0r d1|jAd2|}t|d3dr8|jBr1|jCdd4}1t|d5dr d6|1d7|}nd8|1d7|}d9|vr0 dd:lDmE}2dd;lFmG}3tbjHId}9|9t|9}5 dd?lNmO}:|:|6}8n'#tF$r|6Id@pg}8YnwxYwn#tF$rYnwxYw|!|||6A\};}<||;|>krd}5|5zt|7tDre ddDlPmQ}?|?dd|7IdB|=|7IdE|XdM|Et>$dNdYd}E~End}E~EwwxYw|S)OaPrepare inbound event text for the agent. Keep the normal inbound path and the queued follow-up path on the same preprocessing pipeline so sender attribution, image enrichment, STT, document notes, reply context, and @ references all behave the same. Side effect: buffers per-session native image paths when the active model supports native vision AND the user has images attached. The caller consumes and clears that session-scoped buffer at the ``run_conversation`` site to build a multimodal user turn. When the list is empty, the ``_enrich_message_with_vision`` text path has already run and images are represented in-text. _gateway_pending_stt_textNr|rTrFr) z | Slack user <@>[rrR z [New message] rrrnativerzSImage routing: native (model supports vision). %d image(s) will be attached inline.zLImage routing: text (mode=%s). Pre-analyzing %d image(s) via vision_analyze.rz4vision enrichment: session runtime resolution failedrr)scoped_runtime_main 🎙️ "rrz&Transcript echo failed (non-fatal): %s)to_agent_visible_cache_pathrrrz [^\w.\- ]z*[The user sent an audio file attachment: 'ru3. Its content is not inlined here. If the user's request involves what the audio contains, transcribe or process it yourself — for example by passing the path to a transcription or media tool — instead of asking the user to describe it. Only ask what to do with it if their intent is genuinely unclear.]rz$[The user sent a video attachment: 'u1. Its content is not inlined here. If the user's request involves what the video contains, inspect or process it yourself — for example by passing the path to a video analysis or media tool — instead of asking the user to describe it. Only ask what to do with it if their intent is genuinely unclear.]> .md.cfg.csv.ini.log.txt.xml.yml.json.toml.yaml>r|application/octet-streamrZz text/plainrk rNrT_discord_tools_loadedz[Triggering message id: `uG` — use as `message_id` for reply/react/pin via the discord tools.] rM rrP z%[Replying to your previous message: "z"] z[Replying to: "@)#preprocess_context_references_async)get_model_context_length_asyncr~context_lengthget_compatible_custom_providerscustom_providersrrrshould_clear_context_pinr"get_custom_provider_context_lengthrrru ryrryconfig_context_lengthrru )rrr allowed_rootrzContext injection refused.z(@ context reference expansion failed: %sz,@ context reference expansion failure detail)Yrr}rrGr#_consume_pending_native_image_pathsrrQr rNrxryrrR rrrrqrzrbrvrr~rrrrr_decide_image_input_moderrqrrirrArFrrrr] _enrich_message_with_vision"_enrich_message_with_transcription_should_echo_stt_transcriptsr#rRrrrtools.credential_filesr_ r`rgrr1r)r mimetypesrrrrE guess_typerDISCORDr:rm rTrrM agent.context_referencesro agent.model_metadatarp rarBrr?r@r0rKrt hermes_cli.route_identityrw ry blockedr2warningsr rr)Frrrrrr_pending_stt_prepared message_text_group_sessions_per_user_thread_sessions_per_user_is_shared_multi_user_safe_user_nameaudio_file_paths video_paths image_paths audio_pathsrrgry _img_modepending_nativevision_runtime turn_modelrr] _successful_transcripts _echo_adapter _echo_meta_tx _echo_exc_to_agent_path_apath _basenamerS _display _agent_path_note_vpath _mimetypesr_ _TEXT_EXTENSIONS_extguessedrrr3rr context_note_disc_tools_loaded reply_snippetro rp _msg_cwd_msg_config_ctx_msg_cfg_msg_model_cfg_msg_custom_providers _msg_raw_ctxrt _msg_model _msg_runtime _msg_base_url_msg_configured_modelrw ry _msg_custom_ctx _msg_ctx_len _ctx_resultrgrsF r._prepare_inbound_message_textz+GatewayRunner._prepare_inbound_message_text/s_*-R '/J K K% GE6 = = =  $+4;8QSW#X#X $+DK9SUZ$[$[!"IT%A%A&%I%I  00=== < $<%>! ! !  ! AV%5 A?v?OPPO(.00V^0&IIIII A@@,@@L 5+T 2 2 W#3VV VVL')!#  b "KK$U%566 - -401C8I4J4J0J0J)!,,PR )22-&&t,,,%):::$++D1111.-3LUTU3V3V-&&t,,,##H---e-@RVaVg@g@g&&t,,,4 #*"31! +### ((%,T3[]a%b%bN%-)+FTC26{2C2CN;/KKmK(( KKf!3{#3#3&*N 595X5X#)(36Y662 N*.n.B)C)C2<w//$ R%)% KJJJJJ,,^<<-1-M-M('..((((((   ">B>e>e ??9999995 5+"t/P/P/R/R"$($<$>,nV44 FFF'2FFF#(;;\;;  < \ \ \ \ \ \% < <G,,V44 "a00(+F q(8(86!99i6,X>>,nV44 F8FF'2FFF#(;;\;;  - C * * * * J J J J J Jyyy $U%566( C( C4*%33,UA66-UA66 01C8I4J4J0J0J)!,,PR<<<7++D11!4::<E 7++D11 sA..+.u::??uQxx !vlCFF 98>> ;L*V[\\ ".BBLBB    D11X5EEE|T22F T S S S S S!!## &0@&&#&& 5/4 0 0 UU5N U"/5Mu7?? U&M&&#&& UTTlTT ,  e \XXXXXXOOOOOO:>>."':L:LS:Q:QRR"&!#(*%355H%-\\'2%>%>N!.$77@'5'9'9:J'K'K '3.1,.?.?OWUUUUUU0O0OPX0Y0Y--$WWW08 =O0P0P0VTV---W D,0+N+N! + (,O,,( L !- 0 0 < < B ".$77(N&&y11P^5G5G5P5P'& !666&*O".:nd3S3S. /VVVVVV33  *..z::)*..z::(,,Z88 3/3O$///*./( ]  XXXXXX*L*L",%2-B+++ +>.=O$%C%C*(,,Y77=2*9)--j99?R%: &&&       %H$G  #/!) %%% & #77??H&mm"N IIk&:;;[?[ 4'7#.#6L \ \ \I3OOO KVZ [[[[[[[[ \s?0K00&LL-MMM'P P4P//P4+Ai =Aa`/.a/!aaaai  a$!i #a$$Bi :Ae i ei ei #e<;i < f i f  B2i =i j7jjc6Ktt|ddddrYt||5|||||d{VcdddS#1swxYwY|||||d{VS)zDRun inbound preprocessing under the routed profile when multiplexed.rGNrpFrrrrr)r}rm _resolve_profile_home_for_sourcer )rrrrrrs r.,_prepare_profile_scoped_inbound_message_textz:GatewayRunner._prepare_profile_scoped_inbound_message_text1s+ 744002F N N '(M(Mf(U(UVV  !??!# + @                77# 8         sA11A58A5cvt|dd}|sgSt||gpgS)Nr)r}rqr)rrr s r.r~ z1GatewayRunner._consume_pending_native_image_paths21sE 'OQUVV IN&&{B77=2>>>r0c|r|dSt|dd}|t}||_ tj|||<n.#t $r!t d|dYdSwxYw ||t|dd}t||kr+| dt||k)dSdS#t $rYdSwxYw) Nrz*Failed to cache live session source for %sTrrrFr) r}rrrr4rFrrr move_to_endrpopitem)rrrcached_sourcesmax_sizes r._cache_session_sourcez#GatewayRunner._cache_session_source81s- fn F '94@@  !(]]N$2D ! *5*=f*E*EN; ' '    LLE{]aL b b b FF    & &{ 3 3 3t%;SAAHn%%00&&E&222n%%000000    DD s$A'A32A37A"C C+*C+c~t|dd}||j|jurt|j}||_|S)z>Return the single async facade for this runner's SessionStore.rN)r}_storerrr)rfacades r.rz!GatewayRunner.async_session_storeM1sG5t<< >V]$2DDD&t'9::F(.D % r0c|sdSt|dd}|sdS||}|' ||n#t$rYnwxYw|S)Nr)r}rBr rF)rrr rs r.rz(GatewayRunner._get_cached_session_sourceV1s 4 '94@@ 4##K00   **;7777     sA AAr run_generationc [ڇۇ܇݇Ktj}t|jdr |jjnt |j}|jpddddd}t|dd}t|ddpddddd} t d ||j p|j pd |j pd ||| tj|j|d{V} | \t d |j |j |j| t#j|| } ||_n#t&$rYnwxYw|j|d{V} | j} t t|d dpidpd} | r"|| | d{V}|dS|} || |tj|j|d{Vr |jrF|jt |j t |jd{Vnd}n.#t&$r!tddd}YnwxYw|rt |dpd}|rb|j[ |j|d{V}n/#t&$r"td|d|}YnwxYw|r||kr|}|r0|| j kr%|j!| |d{V}||} |rK|t |dpdkr#tj|j"|| dd{VnO tj|j#|| d{Vn,#t&$rtddYnwxYwt| dd}|r3|$| d|%| d| _&| j'| j(kp|pt| dd}t| ddrd| _)|rC|j*+d|jr |jjnd|j | j | dd{VtY||j-| }|.|}d}d}d} t_}ta|dpidd}n#t&$rYnwxYw|1||| }g}|rt| d dpd!}|d"krd#}n|d$krd%}n |d&krd'}nd(} te| |}n#t&$rd}YnwxYw|r|d)z|z}|3| |j4j-5|jt|d*d+,} |jr |jjnd}!t| d-d}"|d.vp| j6o |"o|!| j7v}#|#r|8|}$|$r|d"krd/}%nJ|d&krd0}%nA|d$kr d1| j9d2}%n/| j:d3z}&| j:d3z}'|'s|&d4n|&r|&d5|'d6n|'d6}(d7|(}%d8|%d9}) tj|j;|d{V}*|*r|)d)|*})n#t&$rYnwxYw|$<|j |)|=|:d{Vn2#t&$r%}+td;|+Yd}+~+nd}+~+wwxYwd| _>t|dlAmB}.mC}/g}0g}1|-D]r}2|.|2|?}3|3rF|3\}4}5}6d@|6dA}7|/|4|5|7}8|8r*|03|8|13|2WtDdB|2s|0rP|03|jd)E|0|_t dC|1| n3#t&$r&}+tDdD|-|+Yd}+~+nd}+~+wwxYwt|dEd}9|9W|9F| j ||tdFdGHd{V}:|:#t|dIsi|_H|:|jH||f<|jI| j d{V};|; rt|;dJk rd=dKlKmL}dM}?d}@dN}AdO}BdP}Cd}Dd}Ed}Fd}Gd}Hd}Id}Ji}K t_}K|Kr|KdQi}Lt|Ltr|L}>nt|Ltr|LdRp|LdQp|>}>|LdS}M|M( t|M}Dn#ttf$rYnwxYw|LdTpd}E|LdUpd}F|KdVi}Nt|Ntr t |NdWdRdXv}@|NdY}O|O0 t|O}P|Pd=kr|P}An#ttf$rYnwxYw|NdZ}Q|Q0 t|Q}P|Pd=kr|P}Bn#ttf$rYnwxYw|Nd[}R|R0 t|R}P|Pd=kr|P}Cn#ttf$rYnwxYw|>}H|E}I|F}J |T|| t|Ktr|Knd\\}>}S|SdTp|E}E|SdUp|F}F|Sd]p|G}Gn#t&$rYnwxYw|D, d=d^lUmV}T|T|H|>|J|F|I|Erd}Dn#t&$rd}DYnwxYw|D|Fr d=d_lWmX}UmY}V|U|K}Wn<#t&$r/|Kd`}Wt|Wtsg}WYnwxYw|V|>|F|Wa}X|Xrt|X}Dn#ttf$rYnwxYwn#t&$rYnwxYw|@r|=|>|Fpd|Gpd|D|Epdbd{V}Yt|Y|?z}Zt|Ydcz}[t|;}\| jZ}]|]d=kr|]dd}^n |<|;de}^|A}_|Zkp|\|_k}`|`rt|dfd}a|a i}a|a|_[| j }bt|a|bpdg}c|ctjkr@t dh|btdg|ctjz d}`|`rt di|\dj|^t|?dkz|Ydj|Zdj|=||]|}d d=dll^m_}ed=dml`ma}f|T|| t|Ktr|Knd\\}>}S|Sd]rdn|;DtަdJkrt|jdo|j}g|fdi|S|>dJdddpg| j |gdqd}h d_bttdrddsd}it|ir|i|g| j d_ddt_etjf}j|e|jgdڈ܈݈fdu}k tjhtji|k|Bvd{V\}l}mn;#tjj$r(d}n|n2ݠk}n|ntjldwd{V|n2|ns |kd{V\}l}mn|m|kdxyd}h|Cd=kr#tj|Cz|j[| j <tDdz| j |Bd{|Bd|d}}o |8|}p|pr*|j r#|p<|j |o|d:d{Vn2#t&$r%}qtDd~|qYd}q~qnd}q~qwwxYwYnwxYwj }r|r| j k}statdd}t|sr`|r| _ |n|||r|jod{Vtj|j"|| dd{V|srJ|jp| j |ld{Vd=| _Z|l};t|l}u|<|l}vnJ|tr$d=| _Z|l};t|l}u|<|l}vn$|\}u}vtDd| j t d|\|udj|vdj|v|[krtDd|vdjtdrd}w|wt|wddr|Cd=kr#tj|Cz|j[| j <t|wddpd}xd=dlqmr}y|y|xd}xd|xd}z |8|}p|pr*|j r#|p<|j |z|d:d{Vn#t&$r%}qtDd|qYd}q~qnd}q~qwwxYw|wt|wddrt|wdd}{t|wddpd}|d|{d||d}} |8|}p|pr*|j r#|p<|j |}|d:d{Vn2#t&$r%}qtDd|qYd}q~qnd}q~qwwxYw|%| |hs|sdyd{Vn:#|%| |hs|sdyd{VwwxYwn2#t&$r%}+tDd|+Yd}+~+nd}+~+wwxYw|;s|jtd{Vsd}~ d=dlumv}mw}mx}my}mz}t_}||dkrP|||sD|3||tdz |n|3|~nG#t&$r:}td||3|~Yd}~nd}~wwxYw|;s|jr|jtj}kr|jtj~kr|jj}!t|!}d} d=dlm}|r||pdnd}n#t&$rd}YnwxYw|s-|r)tj|pdnd} |s!|j-|jrd}n#t&$rYnwxYw|sq d=dlm}d=dlm}t|ddpd}|r,|dRkr&|}||jrd}n#t&$rYnwxYw|sP|jtjkrdnd}d|!d|d})|||)d{V|||| }|r|3|||||;| d{V}|dS d=dlm}d=dlm}m}m}|}t|dd}|rgt|trR|||\}}|}|||}||n|}t)t_r||||}n|}n2#t&$r%}td|Yd}~nd}~wwxYw|r| r|| |||8|| | |jr |jjnd|j |j pdt|ddrt t|ddndt|d*dpd| j |ddd}|j*+d|d{V| j }||||;||| ||]||jt|dd|| d{V} |8|}tt3|dd}tt3|dd}|rXt|rI||j |=||]|d{Vn1|r/t|r ||j d{Vn#t&$rYnwxYw|||st d|pd||8|}tt3|dd|||n-|r+t|dr|j|d ||dS|dpd}tC|rd} d=dlm}|||}n#t&$rd}YnwxYw|dkr|sd}|dg}tj|z }|dd=}t|}t d||j pd |||| rztI|rj||  |j| d{Vn3#t&$r&}td| |Yd}~nd}~wwxYw|s6tO||t|;}tQ|j|}|dr|d| j kr| j |kr|d| _ |n||| j |jod{V|j| j | |d{Vtj|j"|| dd{Vn$t d| pd|| j  tUt_tW|jdtat|dd|jtjhæ}n8#t&$r+|jtjkrdnt|dd}YnwxYw|r|r|s||dĦ}|rdd=dlm}|}t|dkr7dE|ddƅ}|dt|dz dȝz }n|} d=dlm}|t_tW|jdd˦}n#t&$rd}YnwxYw|dkr:dEd̈́|D}d|d)|}nS|dkr:dEdЄ|D}d|d)|}n||}d|d|}d} d=dlm}|t_tW|j|dQ|dd=pd=|dSpdtjddצ}n4#t&$r'}td|d}Yd}~nd}~wwxYw|r |r|d٦s |s|d)|}|j*+di|d|pdddid{V d=dlm}|j}g|_tq|D]O\}}tj|||dkzdkrtjld=d{VPn2#t&$r%}+td|+Yd}+~+nd}+~+wwxYw d=dlm}ty|j}|D]d}t}|}|rP |||d{V2#t&$r%}td|Yd}~\d}~wwxYwen2#t&$r%}+td|+Yd}+~+nd}+~+wwxYwta|d}tC|}t |ddR|oTta|dp2tfddDpdvot|;dk}|r!t d| j nZ|r!t d| j n7|r5tDd| j |dd|dr%t d| r| j ndn|dr| r| rt d| j |j| d{V}|%| |$| d|%|} tj|j"|| dd{V|pddz}tj}|rnf|;sd|dg}|j| j d|pgt|jr |jjnd|dd{V|d|jdu}|rn|s|rd||n|||n|d}|jrt |j|d<|jo7|j| j t |jd{V}|r(t d|j| j n|j| j ||¬d{VnW|dt|;}t||kr ||dng}|sd||n|||n|d}|jrt |j|d<|j| j ||¬d{V|r,|j| j d||d|¬d{Vnd}|D]}|Ƞddkri|ȥd|i}|s=|Ƞddkr$|jrd|vrt |j|d<d}|j| j ||¬d{V|j| j|dd=d{V|| | j d{V|r#t d| j d}ta|d٦}|||||ʐr|||d{V|d٦r|ds|r4|8|}|r||||˦d{V|r |8|}|rJ|̠<|j ||=||]|:d{Vn3#t&$r&}td|Yd}~nd}~wwxYw ||dS|||S#t&$r}+ |8|}tt3|ͦdd}tt3|ͦdd}|rXt|rI|͠|j |=||]|d{Vn1|r/t|r |͠|j d{Vn#t&$rYnwxYwtd|  dtvr|| d} |jI| j d{V}n#t&$rg}YnwxYwt|ϐddD]=}|Рddkr"||n|}|Рd|k}n>|smd||n|||ntjd}t|ddrt |j|d<|j| j |æd{Vn-#t&$r tddYnwxYwd}t|+dd}Ӑd tvrt|;nd=}|Ӑd krd }Ґn|Ӑd krd }Ґn|Ӑdkrt|+dd}i} |Ձ?|ՠdi}t|tsi}n#t&$rYnwxYw|֠ddkrH|֠d}|r,|d=kr&d=dl}|ؠ|אdz }ِd|ٛd}nEd}nAd}n=|Ӑdkrd}n2|Ӑdvr-|dkr Yd}+~+||dS|Ӑdkrd}Ґd|қdcYd}+~+||Sd}+~+wwxYw#||wxYw( zAInner handler that runs under the _running_agents sentinel guard.r{r|NPrrNrrM zSinbound message: platform=%s user=%s chat=%s msg=%r reply_to_id=%s reply_to_text=%rr4z1telegram topic recovery: chat=%s user=%s %r -> %srr~gateway_session_idrrz%Failed to read Telegram topic bindingTrr3z$compression-tip lookup failed for %szcompression-tip-walkrz'Failed to record Telegram topic bindingwas_auto_resetF auto_resetis_fresh_resetz session:start)rNrr3rprivacy redact_piiauto_reset_reasonidlerzy[System note: The user's previous session was stopped and suspended. This is a fresh conversation with no prior context.]dailyz[System note: The user's session was automatically reset by the daily schedule. This is a fresh conversation with no prior context.]resume_pending_expiredu[System note: The previous gateway session could not be recovered after a restart (API recovery timed out). This is a fresh conversation — use /resume to restore history if needed.]zy[System note: The user's previous session expired due to inactivity. This is a fresh conversation with no prior context.]rr+r,)rN session_typereset_had_activity>rr z+previous session was stopped or interruptedz"gateway restart recovery timed outzdaily schedule at z:00rhzh rz inactive for u!◐ Session automatically reset (z). Conversation history cleared. Use /resume to browse and restore a previous session. Adjust reset timing in config.yaml under session_reset.rz.Auto-reset notification failed (non-fatal): %srQ r)_load_skill_payload_build_skill_messager z[IMPORTANT: The "zB" skill is auto-loaded. Follow its instructions for this session.]z#[Gateway] Auto-skill '%s' not foundz0[Gateway] Auto-loaded skill(s) %s for session %sz-[Gateway] Failed to auto-load skill(s) %s: %srrr? ) owner_key generationrrr)estimate_messages_tokens_roughrp zanthropic/claude-sonnet-4.6g333333?ir"r@rrrr rrr9r>r;r=r>hygiene_hard_message_limithygiene_timeout_seconds hygiene_failure_cooldown_secondsrryrv )rt ry ru rz )rryr| rffffff?actual estimated&_hygiene_compression_failure_cooldownsrzXSession hygiene: skipping compression for %s; previous failure cooldown active for %.1fsufSession hygiene: %s messages, ~%s tokens (%s) — auto-compressing (threshold: %s%% of %s = %s tokens)rpr)CompressionCommitFenceAIAgentc@g|]}|ddv|S)r[>rrarbrrs r.rz.3s8)))&'#$55==4Q#Q#Q!"#Q#Q#Qr0rrr )rrH quiet_mode skip_memoryenabled_toolsetsr3rcontext_compressorbind_session_statecdSr(r)akws r.rz:GatewayRunner._handle_message_with_agent..3sDr0c6dS)Nr|) approx_tokens commit_fence)_compress_context)_approx_tokens _hyg_agent_hyg_commit_fence _hyg_msgssr.rz:GatewayRunner._handle_message_with_agent..3s( 0L0L,5r:H9J1M1*1*r0rgMbP?zsession hygiene timeoutrz`Session hygiene compression for session %s timed out after %.1fs; continuing without compressionu+⚠️ Context compression timed out after .1fus. No messages were dropped — continuing without compression. Run /compress to retry, /reset for a clean session, or check your auxiliary.compression model configuration.z9Failed to deliver compression-timeout warning to user: %s_last_compaction_in_placezhygiene-compressionuGateway hygiene compression for session %s did not rotate or compact in place (no session_db on the hygiene agent) — preserving the original transcript instead of overwriting it with the summary (#21301).u>Session hygiene: compressed %s → %s msgs, ~%s → ~%s tokensz3Session hygiene: still ~%s tokens after compression_last_compress_aborted_last_summary_errorrUrru$⚠️ Context compression aborted (u). No messages were dropped — conversation is unchanged. Run /compress to retry, /reset for a clean session, or check your auxiliary.compression model configuration.z9Failed to deliver compression-failure warning to user: %s_last_aux_model_failure_model_last_aux_model_failure_erroru%ℹ️ Configured compression model `z ` failed (u). Recovered using your main model — context is intact — but you may want to check `auxiliary.compression.model` in config.yaml.z7Failed to deliver aux-model-fallback notice to user: %szsession hygienez(Session hygiene auto-compress failed: %sz[System note: This is the user's very first message ever. Briefly introduce yourself and mention that /help shows available commands. Keep the introduction concise -- one or two sentences max.])PROFILE_BUILD_FLAGrNrOprofile_build_directiveprofile_build_modeaskr8z@Profile-build onboarding directive failed, using plain intro: %s) get_secretrcr r rwz/hermes sethomez/sethomeu 📬 No home channel is set for z^. A home channel is where Hermes delivers cron job results and cross-platform messages. Type z8 to make this chat your home channel, or ignore to skip.r r)coerce_message_timestampr strip_leading_message_timestampsr/rz2Message timestamp injection failed (non-fatal): %srr)rNrrrr+r3rz agent:start _moa_config) rcontext_promptrrr3rr rri moa_configpersist_user_messagepersist_user_timestamp_stop_typing_with_metadata stop_typinguKDiscarding stale agent result for %s — generation %d is no longer currentr7pop_post_delivery_callbackr _post_delivery_callbacksri#is_intentional_silence_agent_result(empty)u⚠️ The model returned no response after processing tool results. This can happen with some models — try again or rephrase your question.rr^zMresponse ready: platform=%s chat=%s time=%.1fs api_calls=%d response=%d charsz&clear_resume_pending failed for %s: %srOzagent-result-compressionz{Skipping agent-result session split sync for %s because the session binding moved from %s to %s before compression finishedrrrlast_reasoning)escape_code_fences_for_displayz _... (z more lines)_rreasoning_styler subtextc3(K|] }|rd|ndVdS)z-# z-#Nrr,lns r.r/z;GatewayRunner._handle_message_with_agent..T6sB,,;="6J"JJJ$,,,,,,r0u-# 💭 Reasoning blockquotec3(K|] }|rd|ndVdS)z> rY Nrr s r.r/z;GatewayRunner._handle_message_with_agent..Y6sB,,9;4IIII,,,,,,r0u> 💭 **Reasoning:** u💭 **Reasoning:** ``` z ``` )build_footer_linelast_prompt_tokensr)r rrcontext_tokensrr rzruntime_footer build failed: %s already_sentz agent:endrRrrzProcess watcher setup error: %s&Watch notification injection error: %szWatch queue drain error: %srTrcompression_exhaustedc3 K|]}|vV dSr(r)r,r_err_str_for_classifys r.r/z;GatewayRunner._handle_message_with_agent..6s9aq11r0) zcontext lengthz context sizezcontext windowzmaximum contextz token limitztoo many tokenszreduce the lengthzexceeds the limitzrequest entity too largezprompt is too longzpayload too largezinput is too longrYrZzjSkipping transcript persistence for context-overflow failure in session %s to prevent session growth loop.upTransient agent failure in session %s — persisting user message so conversation context is preserved on retry.zLSuppressing hidden-reasoning-only incomplete gateway turn for session %s: %sracompression_deferreduCompression deferred for session %s — the compression lock is held by a concurrent compressor. Keeping the session intact; the next message retries normally.z7Auto-resetting session %s after compression exhaustion.compression_exhausted_resetzcompression-exhausted-resetu 🔄 Session auto-reset — the conversation exceeded the maximum context size and could not be compressed further. Your next message will start a fresh session.r r)r[r rrNr/agent_persistedra)r[rr/rTz:Skipping duplicate user turn (message_id=%s) in session %s)skip_dbrrbr[r)r" z5Suppressing intentional silence marker for session %s)r$ ztrailing footer send failed: %szAgent error in session %sr irzrrr[rz% The request was rejected by the API.z)Sorry, I encountered an unexpected error.r]r)rDrrNr{rCrr4r}rrirQrrrrrrrrrFrr, rrBrDr' r rrget_telegram_topic_bindingrrr r3r- rrrI r. r created_atrXr r rrrG_set_session_envr?r_pinned_session_context_promptrrbrget_reset_policynotifynotify_exclude_platformsr#at_hour idle_minutes_reset_notice_session_inforrRr r@rqr r r rr2acquirer?rload_transcriptrr r rp rAr0r=r2rEr1rr rw rKrt ry r" r rragent.conversation_compressionr run_agentr compression_in_placerr _print_fnrrun_in_executorrrrtry_cancel_before_commitrpr_rebind_turn_leaserrewrite_transcriptrrrhas_any_sessionsr\r rNrOr r rrxrr+rr2r r`rzrrr rzrqryr% r _voice_channel_sidecar_noter rrrr rr r_set_pending_turn_sidecar_notes_bind_adapter_run_generation _run_agentrirr r _is_session_run_currentr r r_clear_session_envrcgateway.response_filtersr rmrrKrgr_record_gateway_session_peerrr MATTERMOSTgateway.stream_consumerr rrrgateway.runtime_footerr! rar<rr3rrrrrLrIrC_inject_watch_notificationrb reset_sessionappend_to_transcriptrrThas_platform_message_idupdate_session"_refresh_agent_cache_message_count_should_send_voice_reply_send_voice_reply_deliver_media_from_responserr rrmathceil)rrrrr r _msg_start_time_platform_name _msg_preview _reply_id _reply_txtrrrr resolved_entrybindingbound_session_idcanonical_session_idr9 _was_auto_reset_is_new_sessionr_session_env_tokens _redact_piir r _pcfgr turn_sidecar_notes reset_reasonr continuity_notepolicyr  had_activity should_notifyr reason_textrminsdurationr session_infor_auto _skill_namesr r _combined_parts _loaded_names_snamer? _loaded_skill _skill_dir _display_namer _part_lease_registry _lease_tokenrr rp _hyg_model_hyg_threshold_pct_hyg_compression_enabled_hyg_hard_msg_limit_hyg_timeout_seconds_hyg_failure_cooldown_seconds_hyg_config_context_length _hyg_provider _hyg_base_url _hyg_api_key_hyg_configured_model_hyg_configured_provider_hyg_configured_base_url _hyg_data _model_cfg_raw_ctx _comp_cfg_raw_hard_limitr _raw_timeout _raw_cooldown _hyg_runtimerw _gw_gcp_gw_gccl_hyg_custom_providers_hyg_custom_ctx_hyg_context_length_compress_token_threshold_warn_token_threshold _msg_count_stored_tokens _token_source_HARD_MSG_LIMIT_needs_compress _cooldowns _cooldown_key_cooldown_until _hyg_metar r _hyg_session_db_hyg_cleanup_deferred_bind_hyg_stater _hyg_future _compressedr _cancelled _timeout_msgrg_werr _hyg_new_sid _hyg_rotated _hyg_in_place _new_count _new_tokens_comp_errr _warn_msg _aux_model_aux_err_aux_msg _intro_noter rNrOr r _onb_cfg_pb_errenv_keyhome_envr r _lgcprof sethome_cmd_vc_noter _get_evt_tz_coerce_msg_tsr _strip_msg_ts_evt_tz_evt_ts_clean_message_text _embedded_ts _event_epoch_ts_errr& _run_start_session_idrQ_typing_adapter_stop_with_metadata _stop_typing_stale_adapterrRr _intentional_silenceagent_messages_response_time _api_calls _resp_lenr_show_reasoning_effectiver r linesdisplay_reasoningr_reasoning_style_quoted _footer_line_bfl _footer_errrr rr_pr _watch_eventsr0 synth_texte2agent_failed_earlyhidden_reasoning_incompleteis_context_overflow_failure new_entryrg tool_defsr+ _user_entry _skip_persistrPr_user_msg_id_attachedr\rc _already_sent_media_adapter _foot_adapter _err_adapter_already_persisted_recent_transcript_msg_expected_user_content status_hintr- _hist_len _err_body _err_json _resets_inrY _hoursr r( r r r s @@@@@r.r z(GatewayRunner._handle_message_with_agentd1sA)++29&/72S2Sm..Y\]c]lYmYm (b#2#.66tSAA E#8$?? e_d;;Ar3B3GOOPTVYZZ  a F,KK) N 'iy*   "+D,RTZ[[[[[[[[  KKC0@)   !(9EEEF %     #6LLVTTTTTTTT #/  UJ - - 3 8 89M N N TRT  %''   +#'#I#I!$$N%*M "";777"4#?HH H H H H H H8 [ &1!1!L!L//!&"233"M""-1    Dt TTT / [#&w{{<'@'@'FB#G#G $@(8(D @595E5Y5Y,66000000,,%@@@ B,t%0@,,, @-@04DDD+?(#1(8M>  ="2E : : 1+0M (  *///5;_LFO11"!>+6* 44       ( ]KK#33G<< #!% (**E ) 4 4 :?? eTTUUKK    D << [+  )+ P 3"=2EtLLVPVL{** [ (( f !999 Y  [  '"? v"V"V ' ' '"& ' G+f4F  % %l 3 3 3 1 R+2CC#_!(d!C!CD:@ P 5 5b &}6JERR !-0W W!MM$M%V-LL !"66v>>G';66*WKK)-EEE*NKK)W44*Rv~*R*R*RKK$*$72$=E#)#6#;D:>'p%{{{{[`DpuDWDWPTDWDWDWDWimfpfpfpH*D(*D*DKW WWW !181B $ ?22,,,,,,L ,G,2)F)F )F)F(!!! D!%ll"NF%)%E%Ef%M%M+ R R R MqQQQQQQQQ R /3M + |T22  au a&0&<&<ME77$u++L aZZZZZZZZ-/+- * V VF11&*MMMG VCJ@ z=J JJJ!5 4]JPU V V 9+225999)00888'LfUUUU"#**5:666!'_!=!=EJKKJ%{ a a aNP\^_```````` a""$==  &!0!8!8($)"#94@@ "9""L 't%9::1.0D+HT'^(DE0@@AYZZZZZZZZ" L s7||q((        7J!% '+ $"& #' ,1 ))- & M ML$( !'+ $'+ $Io 022 2%!*w!;!;J!*c22K%/ #J55 K%/^^I%>%>%g*..QXBYBY%g]g $.>>2B#C#C#/%=@]] : :$-z#:%%% $%)3z(B(B(Jd (2z(B(B(Jd !* mR @ @I!)T22%36%MM)T::44%''%94:0+4--8T*U*U*6%*-o*>*>#*Q;;:A$7$-z#:%%% $%'0}}5N'O'O '3%*/ *=*=#*Q;;;B$8$-z#:%%% $%(1 6X(Y(Y (4%*/ *>*>#*a<#>#N,LL D.9 :VVVVVV331&4)4) >:>6$:::59222: .5-5 ;5"~$9$9=.455.22488 !% @ @IeIefkIlIl m mIqYYYYYY555555373V3V#)(35? 45P5P(Z VZ4W440 L (++I66c*))+2)))I #9~~2229$:JESWSc2d2d-4W ." ."&2 ."*434/3046>Z/ ." ." ." ." 9> 5G!*GKJ$C6=(/ 1>0H0D -.-.-.1]9M0V1]1]1]-9 -2;?;S;STZ;[;[3;1616:B--8>8DAJ;H;6;656565656565656 4=-2-2-2065J491212121212121212-2 -2S:;7%2z4>3HL3?=C[3[L48(/ ,>)*)*)*-4J@TVZ,[,[E','8WULdfk=l=l'8+HA+M+M15 >[0[-1,W0=0H-.07u>SUY/Z/Z/m^m)W(V(V(V(V(V/D/DTQU/V/V/V-=04-=-=-=)2).7;7O7OPV7W7WH/7-sFN-s6>mmFNT]hqm6r6r0r0r0r0r0r0r0r/8).).).,2NN0k05-.-.-.-.-.-.-.-.).*/):wuNmos?t?t):5mmFNT\gpm6q6q0q0q0q0q0q0q0q/8).).).,2NN0i05-.-.-.-.-.-.-.-.).%)$<$<[$I$I$I+@%*.2.T.T,6@Q/U/*/*)*)*)*)*)*)*)*%)$<$<[$I$I$I+@%*.2.T.T,6@Q/U/*/*)*)*)*)*)*)*)*)*%* %F# 7T%=%N%N%P%PPPPPPP# 7N  7011&&x00E99#GH.@AA:'--.E.E.G.G.M.M.O.OPPPIl]:>>r     QAHPBIg..4";;===b %DK$@$@$Q$Q%$H      CCCCCCJJJJJJ#FIt<<BIIKKD- 1 1!% 11&/BB-',H D D (.88&%# *}7J7J7L7L**(***33FFCCCCCCCCC33E6;OO  0  % %h / / /"NN# O          F X ? ? ? ? ? ?           "kmmGe[$77G 7 < = = 74AM W5.5.5.1#\':$-~g'BBB $0$+."$$$LL$7L X X X LLMw W W W W W W W W X  R+ R  0 0>P Q Q Q ))  $ $V , ,     o 96<_LFO11"!>!>/RHOPVXceiHjHjrSd!C!CDDDpr$V["==C+6'-H*//-:: : : : : : : : %2$< !!%$-0'-!%!=!=e!D!D$3"5->>%9'="1 " "      L$ "&":":6"B"B&-))+G''# 'tO'<'$R@Z([([R";?? DQQQV  # #$7 8 8 8 8 8S$''(899?RH>>2GG TTTTTTTTTT LL@#R( W: (G R& g!-!1!12B!C!C!$gVVVVVV*0022==??E5zzB,0IIeCRCj,A,A))-VE R-V-V-VV)),:,@,@,B,B) 2RRRRRR+B+B0220AA-" ,,(( %222+1(((2'944"&)),,ARA]A]A_A_,,,##$Q#P#Ph#P#P)\99"&)),,?P?[?[?]?],,,##$UW#T#T(#T#T-K,JK\,],])#f@Q#f#f\d#f#f L "LLLLLL#t 4 6 6!5fo!F!F&**733#/#3#34H!#L#L#QPQ#/#3#34D#E#E#M ~r::      " " " > LLL!  " ; ;1A1A.1Q1Q ;Zn ;&::L::*//+00X^TcT200        CCCCCCC,<46 1"+H"5"5//JAw'(A(A'(J(JKKK3w"}}%mA........./ C C C >BBBBBBBB C ?JJJJJJ ;C

>>>>>>> ?2"&l&6&6x&@&@!A!A *V++ '%( (8(8"(E(E$F$F$L$L$N$N ! += +\%%&=>>??J<J22Hs7||b7H (+  L!, $  M!, - )!, $$W.EFF " 677*  I1>FM,,3  !!"9::# }# Q\#  M!,#'":"H"H"U"UUUUUUU ((555..(E/(%.M!+9 6S%ND B +  (,,Wb99 .CC!, .!*b!7!9!9=C_$TFO$9$9RT%'          *+../@$BRZ^B^__O +e #c 'Bc #0;-,)2=/.   #F03E4D0E0EK - $"6NN%0#e6F2G2G ! KK8(-*B 2GG%0# /H +../?WNN ?B>?R?RU`?`?`~kll;;fh $2 & 4?10!- 6A32!# # #K'J478H4I4I L12GG%0# /H  "6KK)4%0XTVWW$3L-2)+776??h66$ 83 8 R 8 8 59 #6 9 9 % 0!: ,E 9 925e6F2G2GE,/481"6KK)4e$3L*99)#/#3#34H!#L#L:       .99]5       $  K!,!!1!1.!A!ABBM,,UHn[h,ii >,,UH=========//  8H8H8R8R %)%=%=f%E%EN%"??$e^ L L(,(@(@(H(H ("/"4"4 & ,)-)I)I&RVRnRnotRuRu)v)v#5## %LLL %FKKKKKKKKLn  # #$7 8 8 8 8 8kj  # #$7 8 8 8 8gp p p  #77?? &-&&(Dd''# 'tL'9'9=$OO CH-@$A$AC&AA88"D$@$@$G$G "Ch|&<&<C&226>BBBBBBBBB       8+ F F F% l!VXX--,2J}Oh).&0373K3[3[\i\t3u3u-u-u-u-u-u-u**$000-/***0 ();CDD)A B B""88F++v55$8#C!5 4%13 37((92E2EI_2_.!E6.$*$8#C!5 4%1$:#E!7 6%)Y[[ ' ' #5,==N8;E>1  # #$7 8 8 8 8 8!C''"IKDKDDD       # #$7 8 8 8 8gp f  # #$7 8 8 8 8sE E%$E%2AJ(J-,J-! L)L.-L. )[76\>7 \\>\9\>> ]-]((]-6Cb b:b55b:Bs8 h0/s80is8iB+s80ls8ls8ls87ms8m# s8"m##s8>ns8n*'s8)n** s84A7p,+s8, p96s88p99s8?qs8 q'$s8&q''s80rs 6r=:s <r=="s s8 s41s83s44s88 tt B*AR35BAQ8186AQ88B?AD0B8AAC:C9AD0C: AD)DAD$DAD0D$AD)D)AD0D-AQ8D/AD0D0G)AQ8LAAMMAQ8M AN M&ANNAQ8NAN N AAQ8OAAPPAQ8P AQPAP;P6AQ8P;AQQAQ8Q5AR3Q87AR/R/AR3R3 AS"R=ASSAS"T BAVV AWV$0AWWAWX6)AY Y AY/Y.AY/Z"#A[[ A[[A[[AA\9\9 A]]A]_-BAbb Ab1b Ab,b,Ab1c9C,Bfg&CAkkBfk AkkBfkAkkB0Bfn)BfoAooBfo Ao&o#Bfo%Ao&o&B+Bfr Ar3r2Bfr3 As#r=AssBfsAs#s#D#BfxA!Ay)y(Bfy)2AzzBfzAzzB.Bf} 3A~~Bf~ A~~ Bf~A~~BBf@)BBB=B<BfB= BC.CBC)C$BfC)BC.C.ABfEA4BF:F9BfF: BG)GBG$GBfG$BG)G)BfG-1BI0HBH<H;BI0H< BI+IBI&I!BI0I&BI+I+BI0I/BfI0 BJI:BJJBfJBJJXBfb=A!BddBfd Bed)Be eBfe BeeBfe*Bff Bu(f CBi,i+Bu#i, Bi9i6Bu#i8Bi9i9Bu#jBn4j5%BkkBn4k Bk*k'Bn4k)Bk*k*C Bn4n3Bu#n4'BooBu#oBooA,Bu#q ABr r Bu#r BrrBu#rBrrBBu#tBu+t7Bu#uBu(u Bu+u#Bu(u(Bu+u+Bvctt|ddddrNt||5|cdddS#1swxYwY|S)uSession-info block for the auto-reset notice, profile-scoped. When multiplexing, resolve model/provider/context inside the profile serving ``source`` — otherwise the banner advertises the base config's model while the session actually runs on the profile's (#59003). Mirrors ``_run_agent``'s gating so single-profile gateways never enter the scope. Call via ``asyncio.to_thread`` from async handlers: under the scope, resolution can do blocking work (credential refresh, context-length HTTP probes) that must not run on the event loop. The scope is entered inside this method, so contextvars behave correctly in the worker thread. rGNrpF)r}rmr _format_session_infors r.r9 z(GatewayRunner._reset_notice_session_infok8s 744002F N N 3'(M(Mf(U(UVV 3 30022 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3((***sA$$A(+A(c^ddlm}m}t}d}d}d}d}d}d} d} d} d} t } | r| di} t | tr| dp| d} | d}|( t|}n#ttf$rYnwxYw| dpd}| dpd}|} |} dd l m }|| }n%#t$r| d }YnwxYwn#t$rYnwxYw t}|dp|}|dp|}|d }n#t$rYnwxYw|, dd lm}|| || || |rd}n#t$rd}YnwxYw|.|r,|r* dd l m}||||}|r|}n#t$rYnwxYw|||pd|pd||pd|}|d}n ||krd}nd}|dkr |dz dd}n|dkr |dzd}nt%|}d|dd|pdd|d|dg}|r$d |vsd!|vsd"|vr|d#|d$|S)%aResolve current model config and return a formatted info block. Surfaces model, provider, context length, and endpoint so gateway users can immediately see if context detection went wrong (e.g. local models falling to the 128K default). r)get_model_context_lengthDEFAULT_FALLBACK_CONTEXTNrrrr rrrs ru ryrv rx rz r|r{ rGu:default — set model.context_length in config to overridedetectedi@Br MiKu ◆ Model: `ru◆ Provider: openrouteru ◆ Context: z tokens (ry localhostz 127.0.0.1z0.0.0.0u◆ Endpoint: r)r r r rr?rBr@rAr0r=r2rKrt rFr^r rw ry rCrbr2)rr r rr| rrry custom_provsrHconfigured_modelconfigured_providerconfigured_base_urlr[raw_ctxrt rXrw ry custom_ctxrr ctx_source ctx_displayr s r.r z"GatewayRunner._format_session_info8sf \[[[[[[[&(( $ "" '))D @ HHWb11 i.. 3'0}}Y'?'?'Y9==QXCYCY$'mm,<==G*!47LL11 ):6!!! D!(}}Z88@DH(}}Z88@DH*2'*2'@QQQQQQ#B#B4#H#HLL @@@#'88,>#?#?LLL@    D  355G{{:..:(H{{:..:(Hkk),,GG    D  ! , -NNNNNN++$'' 1-1) - - -(,%%% - ! (\ (h ( PPPPPP??%%1 7,6)    21 ^Mr"7^)     ! ,!JJ 7 7 7UJJ#J Y & &+i7>>>>KK u $ $+u4777KKn--K $5 # # # 7X5 7 7 ?K ? ?* ? ? ?   600K84K4Ky\dOdOd LL4(44 5 5 5yysA.9s(BBGGGBBBBBBr0rr4 r|z . Use /whoami for the full list.zNo slash commands are enabled for non-admins on this platform. Ask an admin to add you to allow_admin_from or to set user_allowed_commands.u⛔ /z is admin-only here. )gateway.slash_accessr rGrcan_runrrrirNr{rH user_allowed_commandsr2r)rrr _policy_for_sourcerl allowed_previewr|s r.r z!GatewayRunner._check_slash_access8s/ QPPPPP 4##DK88~  !N!N 4 Z %+_ =FO ! !# N    !!=>>  ))BB_SbS-ABBBBBC00255552?55 F3  D}CC6CCCr0own_keyc t|dd}t|dd}|r|sgS|jj}t|ddpd}dd||t |t |g}g}t |jD]K\} } | |kr | tus| s| |ks| |dzr| | L|S)uFind running-agent keys for OTHER participants in the same thread. Only applies when the message originates in a thread. In per-user thread mode (``thread_sessions_per_user=True``) each participant gets an isolated session key of the form ``agent:main:{platform}:{chat_type}:{chat_id}:{thread_id}:{user_id}``, so a run started by another user is invisible to the caller's own ``/stop``. This returns the keys of any *actually running* agents (not the pending sentinel, not the caller's own key) whose key shares the caller's ``{chat_id}:{thread_id}`` prefix. Returns an empty list when the source is not in a thread, or when no sibling runs exist — callers must still gate on authorization. rNrr+r|r}z agent:main) r}rNr{r2rCrqrrrrrb) rrr rrrNr+rmatchesrr@s r._sibling_thread_run_keysz&GatewayRunner._sibling_thread_run_keys*9sFK66 &)T22  I?(FK66<"  8YG c)nn M  t399;;<< $ $JCg~~///u/f}}v| < <}s###r0cP||jdS|jdS|jjdS |jjj}n#t$rYdSwxYw|dkrdS t dz }|sEt|ddr2tjt|ddz dkr d|_ d SdStj | }n#t$rYdSwxYw| d |krdS| d }t|tsdS|j|krdSt|ddr d|_ d S| d }t|tt frtj|z d krdSd S)ajReturn True if this /restart is a Telegram re-delivery we already handled. The previous gateway wrote ``.restart_last_processed.json`` with the triggering platform + update_id when it processed the /restart. If we now see a /restart on the same platform with an update_id <= that recorded value, it is a redelivery when this process booted from that restart. Otherwise the marker must still be recent (< 5 minutes). Only applies to Telegram today (the only platform that exposes a numeric cross-session update ordering); other platforms return False. NFr!z.restart_last_processed.jsonrrrrTrN update_idr r\)rplatform_update_idrNr{rFrrfr}rDrrrrrBr@r0r1)rrrr marker_pathrH recorded_uidr s r._is_stale_restart_redeliveryz*GatewayRunner._is_stale_restart_redeliveryT9s =EL05  # +5 < (5 "\28NN   55  Z ' '5 &)GGK%%'' D"8%@@  gdOS&I&IIBNN05D-4u:k335566DD   55  88J  > 1 15xx ,, ,,, 5  #l 2 25 4/ 7 7 (-D %4 xx// lS%L 1 1 y{{\)C//uts(6 AAAC3&C C('C(c"K|pd}|j}d} t|jddpt t|ddpd}t|dd}|r4|r2|t |t|ddt|ddd}n#t $rd}YnwxYw d d lm}|||d S#t $r*}t d |d|cYd}~Sd}~wwxYw)zHandle /suggestions in the gateway. Delegates to the shared handler so CLI and gateway never drift. The origin is built from the event source so an accepted suggestion's job delivers back to this chat/thread. r|Nr{rNrr( rrNrr( rr)handle_suggestions_commandrrr zsuggestions command failed: %szSuggestions command failed: ) r rDrr}rNrCrFhermes_cli.suggestions_cmdr rrr) rrrrQrrrNrr rs r.r z)GatewayRunner._handle_suggestions_command9sl&&((.B5577 v>>l#gfV`bdFeFeFkikBlBlHfi66G G  ("7||!(d!C!C!(d!C!C     FFF  6 M M M M M M--d69UUU U 6 6 6 LL91 = = =5!55 5 5 5 5 5 5 6s0A=B33 CCC D$D D Dc@K|pd}|j}d} t|jddpt t|ddpd}t|dd}|r4|r2|t |t|ddt|ddd}n#t $rd}YnwxYw d d lm}|||d S#t $r9}t d |d dlm } | d|cYd}~Sd}~wwxYw)a Handle /blueprint in the gateway. Delegates to the shared handler so CLI, TUI, and gateway never drift. Returns a BlueprintCommandResult: ``text`` is shown to the user, and if ``agent_seed`` is set the dispatch site rewrites ``event.text`` to the seed and falls through to the agent (the ``/steer`` pattern) so the agent gathers the slot values conversationally. Origin is built from the event source so a directly created blueprint job delivers back to this chat. r|Nr{rNrr( rr r)handle_blueprint_commandrr zblueprint command failed: %s)BlueprintCommandResultzCron blueprint command failed: ) r rDrr}rNrCrFhermes_cli.blueprint_cmdr rrrr ) rrrrQrrrNrr rr s r.r z'GatewayRunner._handle_blueprint_command9s&&((.B5577 v>>l#gfV`bdFeFeFkikBlBlHfi66G G  ("7||!(d!C!C!(d!C!C     FFF  Q I I I I I I++DSSS S Q Q Q LL7 ; ; ; G G G G G G))*OA*O*OPP P P P P P P  Qs0A=B33 CCC D$.DDDc` t|jtr|jpidint |jdipi}|s'ddlm}|pidpi}t|ddpdS#t$rYdSwxYw)a%Resolve the configured /goal turn budget for gateway sessions. GatewayRunner.config is a GatewayConfig dataclass, not the full user config mapping. Top-level config blocks such as ``goals`` are therefore only available through hermes_cli.config.load_config(). goalsrrrAr3 ) r@rGrArBr}rKrr0rF)r goals_cfgrs r._goal_max_turns_from_configz)GatewayRunner._goal_max_turns_from_config9s dk400="''444T['266<"   E999999([]]0b55g>>D" y}}["55;<< <   22 sBB B-,B-cK ddlm}n3#t$r&}td|Yd}~dSd}~wwxYw |j|jd{V}n3#t$r&}td|Yd}~dSd}~wwxYwt|ddpd}|sdS| }||| |fS) zReturn a GoalManager bound to the session for this gateway event. Returns ``(manager, session_entry)`` or ``(None, None)`` if the goals module can't be loaded. rrzgoal manager unavailable: %sNrz'goal manager: session lookup failed: %sr3r|r3default_max_turns) rrrFrrrrr, rr}r% )rrrrrrsidrAs r._get_goal_manager_for_eventz)GatewayRunner._get_goal_manager_for_event:s%   4 4 4 4 4 4 4    LL7 = = =:::::  "&":"P"PQVQ]"^"^^^^^^^MM    LLBC H H H::::: m\488>B :4466 {cYGGGVVs' ;6;%A%% B/BBrcK||}|s,tdt|dddS ||}n#t $rd}YnwxYw||j||d{V}|=t|dds.tdt|dd dSdSdS) zCSend a /goal judge status line back to the originating chat/thread.$goal continuation: no adapter for %srNNrrT)goal continuation: status send failed: %srrU) r#rrrr}rRrFrrr)rrrrr~r.s r._send_goal_status_noticez&GatewayRunner._send_goal_status_notice:s **622  LL?Q[]aAbAb c c c F 77??HH   HHH ||FNGh|OOOOOOOO  gfi&F&F  NN;99         sA A,+A,cHK}|s,tdtdddSd fd } }n#t $rd}YnwxYw|rt |dr d}t|di|}|t|dd}|||| dS#t $r%}td |Yd}~nd}~wwxYw|d{VdS) a Send a /goal status line after the main response is delivered. The gateway message handler returns the agent response to the platform adapter, which sends it after this method's caller has returned. For a natural Discord/Telegram reading order, goal status belongs after that send. Platform adapters provide a one-shot post-delivery callback for exactly this boundary; when unavailable, fall back to direct awaited delivery rather than silently dropping the notice. r, rNNr%cK d{VdS#t$r(}td|dYd}~dSd}~wwxYw)Nr- Tr)r. rFrr)rrrrs r._deliverzHGatewayRunner._defer_goal_status_notice_after_delivery.._deliver@:s `33FGDDDDDDDDDDD ` ` `JCZ^_________ `s# AAAregister_post_delivery_callback_active_sessions_hermes_run_generationr zAgoal continuation: post-delivery callback registration failed: %sr) r#rrrr}rrFrrBr2 ) rrrrr1 rr rYrs ``` r.(_defer_goal_status_notice_after_deliveryz6GatewayRunner._defer_goal_status_notice_after_delivery1:s**622  LL?Q[]aAbAb c c c F ` ` ` ` ` ` ` `  66v>>KK   KKK   g77,MNN g g!  *B  F4466 kSIFFF}}  F  R R R R R R" II   III **  b!*+   ll9%%+  M6%??LL L L L L L L L||-..  F344:  F G..v66G55f==J D: D)!,!1!##'  "":z7CCCCC D D D D G G G LL@# F F F F F F F F F Gs; ;6; B B-,B-6A#F G)G  Gct|dd}|dSt|dr|jrt|jSt|dr|jr |jjSdS)z5Extract Discord guild_id from the raw message object.rL Nguild_idguild)r}rrB r0rC r)rrr>s r. _get_guild_idzGatewayRunner._get_guild_id:ste]D11 ;4 3 # # %  %s|$$ $ 3  SY 9< tr0cdK|j}t|dsdS|}|sdS|||jjd{V}|sdSt|dr j|_t|dr j|_ t|dr fd |_ | |d{V}n#t$rs}td |d|_t|}d |vsd |vsd |vrdt"jdcYd}~Sd|cYd}~Sd}~wwxYw|rt'|jj|j|<t|dr!|j|j|<dj|jj|jj<||jjdd|jdSd|_dS)z.Join the user's current Discord voice channel.join_voice_channelz2Voice channels are not supported on this platform.z,This command only works in a Discord server.Nz(You need to be in a voice channel first._voice_input_callback_on_voice_disconnect_voice_mode_gettercjtjt |dS)NrC)rrBr@rxr rC)rrs r.rz:GatewayRunner._handle_voice_channel_join..:s69I9M9M 0#g,,??::r0z Failed to join voice channel: %spynaclnacldaveyz@Voice dependencies are missing (PyNaCl / davey). Install with: `z -m pip install PyNaCl`zFailed to join voice channel: _voice_sourcesrBT)rzJoined voice channel **zL**. I'll speak my replies and listen to you. Use /voice leave to disconnect.zFFailed to join voice channel. Check bot permissions (Connect + Speak).)r#rrrD get_user_voice_channelr_handle_voice_channel_inputrG _handle_voice_timeout_cleanuprH rI rF rFrrrCrEr\r$r0r_voice_text_channelsto_dictrN rr@rNrRr\r)rrrrrB voice_channelrr err_lowers` r._handle_voice_channel_joinz(GatewayRunner._handle_voice_channel_join:s**5<88w 455 HGG%%e,, BAA%<< el*         >== 73 4 4 M,0,LG ) 72 3 3 N+/+MG ( 70 1 1 ****G & 8#66}EEEEEEEEGG 8 8 8 NN=q A A A,0G )A I9$$)(;(;w)?S?SN&)nNNN8A77 7 7 7 7 7 7 8  589M5N5NG ( 2w 011 J38<3G3G3I3I&x0]bD T__U\-BELDXYY Z  " " $ $ $  . .w 8LVZ . [ [ [\-*<\\\  )-%WWs+C"" E,AE EEEEczK||j}||}|rt|dsdSt|dr||sdS ||d{Vn2#t $r%}td|Yd}~nd}~wwxYwd|j | |jj |jj <| |||jj dt|d rd|_d S) z Leave the Discord voice channel.leave_voice_channelzNot in a voice channel.is_in_voice_channelNzError leaving voice channel: %srCTrrG zLeft voice channel.)r#rrD rrY rX rFrrrr@rNrrRrZrG )rrrrrB rs r._handle_voice_channel_leavez)GatewayRunner._handle_voice_channel_leave:sp**5<88%%e,, -ww0EFF -,,w 566 -g>Y>YZb>c>c -,, A--h77 7 7 7 7 7 7 7 7 A A A NN @TUUV     ++GU\5ITX+YYY 73 4 4 1,0G )$$s.B B9B44B9cd|j|tj|<||jtj}|||ddS)zCalled by the adapter when a voice channel times out. Cleans up runner-side voice_mode state that the adapter cannot reach. rCTrZ N)rr@rxr rRrrBrZ)rrrs r.rQ z+GatewayRunner._handle_voice_timeout_cleanup ;so HM)97CCD    -##H$455 ++GWt+LLLLLr0rB r transcriptc ddlm}tjdd|}tjdd|}|sdSt j d ||f}t|d d }t|ts i}||_ fd | |gD}|D]d\} } | |kr|||<d St| d kr>t|d kr+|d | |dkr|||<d Se| |f|dd ||<dS)arSuppress repeated STT outputs for the same recent utterance. Voice capture can occasionally emit the same utterance twice a few seconds apart, which creates a second queued agent run and overlapping spoken replies. Dedup exact and near-exact repeats per guild/user over a short window while allowing genuinely new turns through. r)SequenceMatcher\s+rNz[^\w\s]r|Fg(@rNc0g|]\}}|z k||fSrr)r,rgtxtr@rAs r.rz@GatewayRunner._is_duplicate_voice_transcript..,;s:   CRx>))I)))r0Tr r )difflibr_ r)rrDrErDrzr}r@rArrBrratiorb) rrB rr] r_ rr recent_storerecentrpriorr@rAs @@r._is_duplicate_voice_transcriptz,GatewayRunner._is_duplicate_voice_transcript;s ,+++++VFC44::<<BBDD VJJ77  5n!t%@$GG ,-- :L-9D *     '++C44      HAu ""$* S!tt5zzRC OOr$9$9"?4 ;;AACCtKK(.L%44 sJ'((("233K Sur0c ZK|jtj}|sdS|j|}|sdSt |di|}|r=t j|}t||_ t||_ nEt tjt|t|t|d}| |st d|dS||||r'td|||dddS |j|}|rS|ddd d d d } |d |d| d{Vn#t($rYnwxYwddlm} t/||t0j| |d} || d{VdS)zHandle transcribed voice from a user in a voice channel. Creates a synthetic MessageEvent and processes it through the adapter's full message pipeline (session, typing, agent, TTS reply). NrN channel)rNrrrQr+z/Unauthorized voice input from user %d, ignoringz?Suppressing duplicate voice transcript for guild=%s user=%s: %srz @everyoneu @​everyonez@hereu@​herez**[Voice]** <@z>: r)SimpleNamespace)rB rC )rrrvrL )rrBrxr rR r}r from_dictrCrrQrPrrrri ri_client get_channelr4rrFtypesrm rrr}r/) rrB rr] r text_ch_id source_datarrk safe_textrm rrs r.rP z)GatewayRunner._handle_voice_channel_input?;s|-##H$455  F155h??   Fg'7<<@@JJ  ",[99F \\FN"7||F  "!)JG g,,# F''//  LLJG T T T F  . .x* M M  KKQ4C4     F o11*==G M&uu-55kCTUU]]^egtuu ll#KG#K#K #K#KLLLLLLLLL    D  *)))))$*'FFF    $$U+++++++++++s"A/G GGrRr r$ cV|r|drdS|jj}|j||jj|d}|jtj k}|dkp|dko|}|sdStd|D} | rdS|r|sdSdS)aDecide whether the runner should send a TTS voice reply. Returns False when: - voice_mode is off for this chat - response is empty or an error - agent already called text_to_speech tool (dedup) - voice input and base adapter auto-TTS already handled it (skip_double) UNLESS streaming already consumed the response (already_sent=True), in which case the base adapter won't have text for auto-TTS so the runner must handle it. zError:FrCrBrDc3K|]K}|ddko-td|dpgDVLdS)r[rbc3rK|]2}|dpiddkV3dS)rrrNr)r,tcs r.r/zCGatewayRunner._should_send_voice_reply...;s[ ##)r..v66:JJr0rN)rBrb)r,r\s r.r/z9GatewayRunner._should_send_voice_reply..;s   GGFOO{ * 77<006B      r0T) rrrrrBr@rNrvrr}rb) rrrrRr r$ r voice_modeis_voice_inputshould has_agent_ttss r.rV z&GatewayRunner._should_send_voice_reply;s$ 8..x88 5,&%))$//%,:OQX*Y*Y[`aa , 0AA5  ?l*=~  5  &        5  , 5tr0cHtt|jddS)zFReturn whether inbound voice/STT transcripts should be echoed to chat.stt_echo_transcriptsT)rr}rGrs r.r z*GatewayRunner._should_echo_stt_transcripts;sGDK)?FFGGGr0rcKddl}d}d} ddlm}m}||dd}|s3 ||hdhz D]'} t j| #t $rY$wxYwdS|jjtj krdnd} tj tjdd|jdd d | }t jtj |d t'j||| d{V} t+j| } nt#t*jt0f$r[t2d| r | ddn| Y||hdhz D]'} t j| #t $rY$wxYwdSwxYw| d|}| drtj |sat2d| d ||hdhz D]'} t j| #t $rY$wxYwdS||j} ||}|rRt?| drBt?| dr2| |r| !||d{Vn| rt?| dro|"|}|#|j|}|tI|}d |d<ndd i}|jj%|||d}| j&di|d{Vn4#tN$r'}t2d|d Yd}~nd}~wwxYw||hdhz D]'} t j| #t $rY$wxYwdS#||hdhz D]'} t j| #t $rY$wxYwwxYw)zEGenerate TTS audio and send as a voice message before the text reply.rN)r_strip_markdown_for_ttsoggmp3 hermes_voice tts_reply_rrT)rL)r output_pathz.Auto voice reply TTS returned invalid JSON: %srrrzAuto voice reply TTS failed: %srplay_in_voice_channelrY send_voicer5 )r audio_pathr-r~zAuto voice reply failed: %srr)(uuidtools.tts_toolrr r`r rdrrNrxrrgr2tempfile gettempdiruuid4hexmakedirsdirnamerrrrrGr=rrrBisfiler#rD rrY r rrRrArr rF)rrrr_uuidr actual_pathrr tts_textr audio_ext result_jsonr.rrB r]r^ send_kwargsrs r.rW zGatewayRunner._send_voice_reply;sp  E  S S S S S S S S..tETE{;;H x!+.$7  IaLLLLD  q"'!6(:K!K!KQVI#%%~AU[[]].ss3AAiAAJ K 33d C C C C ' 1#( !!!K K00()4   OfqRCQ\]a^a]aQbQbxCDDDT!+.$7  IaLLLLD  Y  !**[*==K::i(( {0K0K @&**WBUBUVVVH!+.$7  IaLLLLD  E..u|<?? 8 33H== 833HkJJJJJJJJJJ 8WWl;; 8#;;EBB ">>u|\ZZ *"&{"3"3K,0K))#+T"2K$|3"- , + // )g(77;777777777 L L L NN8!dN K K K K K K K K L!+.$7  IaLLLLD  j+.$7  IaLLLLD sMA  AACM"D76M7=F(4MF F"!F"'F((A;M/I IIDMO N %NON  ON// N<;N< O3 O"!O3" O/ ,O3.O/ /O3c&Kddlm}ddlm d|v}ddlm}m}||\}} |j|}| | | |j | |} hd} hd} g} g}|D]\\}}||j }|| vr|s|s| |E|||f]| rp fd| D}||j j|| d {Vn8#t$$r+}t&d |j|Yd }~nd }~wwxYw|D]\}} ||j }||j j|| r)||j j|| d {VnU|| vr)||j j|| d {Vn(||j j|| d {V#t$$r+}t&d|j|Yd }~d }~wwxYwd S#t$$r&}t&d|Yd }~d Sd }~wwxYw)uExtract explicit MEDIA: tags from a response and deliver them. Called after streaming has already sent the text to the user, so the text itself is already delivered — this only handles file attachments that the normal _process_message_background path would have caught. Unlike the non-streaming path in ``gateway/platforms/base.py`` (which also auto-detects bare local paths via ``extract_local_files``), this post-stream rescan is EXPLICIT-ONLY. The visible reply has already been streamed verbatim, so a bare path string here was either (a) already shown to the user as text, or (b) stale tool/inspected content that was never part of the intended visible reply. Promoting such paths into uploads after the fact sent files the model never asked to deliver (#20834). Only ``MEDIA:`` directives — the explicit attachment contract — trigger post-stream uploads. rr)rz[[as_document]])rshould_send_media_as_audio.3gp.avi.mkv.mov.mp4.webm.gif.jpg.png.jpeg.webpc0g|]}d|dfS)zfile://r|r)r,r_quotes r.rz>GatewayRunner._deliver_media_from_response..J<s/OOOa444b9OOOr0)rimagesr~Nz0[%s] Post-stream image batch delivery failed: %s)is_voicerr r~r video_pathr~rrr~z*[%s] Post-stream media delivery failed: %sz'Post-stream media extraction failed: %s)pathlibr urllib.parserrirr extract_mediafilter_media_delivery_pathsextract_imagesrRrrr|rErbsend_multiple_imagesrrFrrrrNr send_video send_document)rrRrrrrforce_document_attachmentsrr media_filescleaned _thread_meta _VIDEO_EXTS _IMAGE_EXTSr non_image_media media_pathr rr rr s @r.rX z*GatewayRunner._deliver_media_from_response <s%, !     000000J I *;h)F & ^ ^ ^ ^ ^ ^ ^ ^#*#8#8#B#B KI-I+VVK  " "7 + + +;;EL$JfJfglJmJmnnLKKKKDDDK !#K$&O(3 C C$ Hd:&&-3355;&& (' :' &&z2222#**J+ABBBB hhOOOO;OOOF!66 % 4%!-7 !hhhNN#UW^Wcefggggggggh)8 b b$ Hb$z**17799C11%,2GW_```%00$)L$8'1%11  ++%00$)L$8'1%11 &33$)L$8&0%14 !bbbNN#OQXQ]_`aaaaaaaab+ b b0 I I I NNDa H H H H H H H H H IsmC$I 66D-,I - E"7!EI E"" I -B8H&%I & I0!II II J*J  Jrrr rrrqc BKtt|dddds |||||||d{VS||}t|5|||||||d{VcdddS#1swxYwYdS)a>Profile-scoping wrapper around the background agent task. When multiplexing is active, resolve the inbound source's profile and run the whole task inside ``_profile_runtime_scope`` so credentials resolve from that profile's secret scope. Mirrors the pattern in ``_run_agent``. rGNrpF)r}_run_background_task_innerr rm)rrrr rrrqrcs r._run_background_taskz"GatewayRunner._run_background_taskp<s3 wtXt446JERR 88)9:{ <.run_sync<sg$W- +/{;;$2>  $t  %*E &6%5'8&7&6%5"&!3!3'1nn5H&I&I&I')ffVnnn')ffX&6&6&6%'FF7OOO#%&&... 137KU0S0S0S!".0VV4E-F-F-F#$ 'w%&*\'(#NN)*!' 2 2+,%..-.#NN/0%..12%..34%..56 't'7@PQQQ7:$(#?#?#A#A#A;>9 11%4 '2 11%8888D11%8888s E::FrirzError: r rru&✅ Background task complete Prompt: "z" rIz(No response generated))r image_urlcaptionr~)r r r rZr r )r image_pathr~r z" (No response generated)zBackground task %s failedz failed: ).r= r r#rrrNrRr?rrBrrrhermes_cli.tools_configr rH rrWrrrrrrrrrbr rFrr rirr r send_imager r`rgrrEr r send_image_filer r)-rrrr rrrqr_thread_metadatarrr rRr rrgryrr r.rRr rr text_contentr headerr alt_text_should_send_media_as_audior r r _is_voicer r r r r rHrr rr r s-` `` @@@@@@@@@@r.r z(GatewayRunner._run_background_task_inner<s%  &%%%%%%2 !'R **622  NNMv`g h h h F;;FDTUUv .00K$($G$G'%H%% !E>"%%i00 llN`7```-# /@@L C C C C C C%&9&9+|&T&TUU #006BI ) .A B B Jd 'B466N#EEU F   &6D "!%!C!C6!C!R!RD 88WWJ%O Z (4411GAt./#k2B2B.B.BKNNE''111#**4000ZZ040P0P"K11++++++%ZZZ'UWXYYYYYYYYZ& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9& 9P ==hGGGGGGGGF;AIvzz"2B777rH 7 76::g+>+> 76VG_66M (/(=(=h(G(G% XFFFFFFM1MkZZ '.'='=h'G'G$  "+#f++2B2BKQ7QQQ !,, & & 5!1'   !,, & &)B B!1'-3Lb  'Ix%00$*N&/$,%5 1 % IHH OOO .9.?R)J 7++J77:@@BBD66viXX")"4"4(.+5)9#5## "[00")"4"4(.+5)9#5## "[00")"9"9(.+5)9#:## #*"7"7(.*4)9#8## %7<!"+#f++2B2BKll"Nkgkkk-#       8' B B B ll"NH7HHQHH-#        s/A$TD*THT I 'ITI  D:T$N,+T, N96T8N99AT B)R54T5 S?TSTA T VU>8)U"!U>" U/,U>.U//U>>VcbK||}t|dd}|t|dsddiS |d{Vn0#t$r#t ddddicYSwxYwd tffd }d|d |d d S)z?Read Telegram private-topic capability flags via Bot API getMe._botNget_mecheckedFz1Failed to fetch Telegram getMe topic capabilitiesTrrct|rt|Stdd}t|tr||vr||Sttr|SdS)N api_kwargs)rr}r@rArB)rr mes r._fieldz>GatewayRunner._get_telegram_topic_capabilities.._fieldk=sr4   )r4((( \488J*d++ , 0B0B!~~d+++"d## $vvd||#4r0has_topics_enabledallows_users_to_create_topics)r r r )r#r}rr rFrrrrC)rrrbotr r s @r. _get_telegram_topic_capabilitiesz.GatewayRunner._get_telegram_topic_capabilities_=s**622gvt,, ;gc844;u% % &zz||######BB & & & LLLW[L \ \ \u% % % % &       "(&)=">">-3V4S-T-T   sA*B B cHK||}||jsdSd}t|dd}t|rR |t |jdd{V}n,#t $rt ddYnwxYw|sdSd} ||jddt|i d{V}t|d d}n,#t $rt d dYnwxYw|sdSt|d d}|t|d sdS | t |jt |dd{VdS#t $r t ddYdSwxYw)zJCreate/pin the managed System topic after /topic activation when possible.N_create_dm_topicSystemz&Failed to create Telegram System topicTrz,System topic for Hermes commands and status.rrrTz*Failed to send Telegram System topic intror pin_chat_message)rrTdisable_notificationz)Failed to pin Telegram System topic intro) r#rr}rr0rFrrrrrCrr )rrrr create_topicrT send_resultr s r._ensure_telegram_system_topicz+GatewayRunner._ensure_telegram_system_topic{=sU**622 ?&.? F w(:DAA L ! ! V V".,s6>/B/BH"M"MMMMMMM  V V V EPT UUUUU V  F  V ' >%s9~~6!-!!K !lDAAJJ V V V LLEPTL U U U U U V  Fgvt,, ;gc+=>>; F U&&FN++z??%)'           U U U LLDtL T T T T T T Us7$A++&BBAC""&D  D 8=E77&F! F!c K||}||jrt|dsdSttjdz dz }|sdS ||jt|d|j rdt|j indd{VdS#t$r t dd YdSwxYw) zFSend the bundled BotFather Threads Settings screenshot when available.Nr assetsz'telegram-botfather-threads-settings.jpgu/BotFather → Bot Settings → Threads Settingsr)rr r r~z)Failed to send Telegram topic setup imageTr)r#rrrr]r^r_rfr rCrrFrrr)rrrr s r. _send_telegram_topic_setup_imagez.GatewayRunner._send_telegram_topic_setup_image=s4**622 ?&.?IZ8[8[? F(^^++--4x?Bkk   ""  F U))z??IAGAQ[+s6+;'<'<==W[ *           U U U LLDtL T T T T T T Us;AC &C54C5r% ctjddt|pd}|sdSt |dkr|dddz}|S) zFReturn a Bot API-safe forum topic name from a generated session title.r` rNr| Hermes ChatxNur)r)rrCrDrrrr% r s r._sanitize_telegram_topic_titlez,GatewayRunner._sanitize_telegram_topic_title=sp&c%+2&6&677==?? ! = w<<#  dsdm**,,u4Gr0c|jtjkoZ|jdkoOt t |ddo1t |jot t |ddS)z>Return True only for Discord threads Hermes just auto-created.r-auto_thread_createdFauto_thread_initial_nameN)rNrxr r+rr}rrs r._is_discord_auto_thread_lanez*GatewayRunner._is_discord_auto_thread_lane=s{ Ox/ / H H, HWV%:EBBCC HV%&& HWV%?FFGG  r0ctjddt|pd}|sdSt |dkr%t |ddz}|S)aReturn a Discord-safe semantic thread title from a session title. Discord thread names are capped at 100 characters measured in UTF-16 code units (emoji count double), so truncate with the UTF-16 helpers rather than Python code-point slices. r` rNr|rr Mr)r)rrCrDrrrrs r._sanitize_discord_thread_titlez,GatewayRunner._sanitize_discord_thread_title=st&c%+2&6&677==?? ! = W   " "0"==DDFFNGr0c Ktj|j|d{VsdSt|ddr||nd}|dSt|dd}|dS||} |t |j|t|ddd{VdS#t$r t ddYdSwxYw) zCBest-effort semantic rename of a newly auto-created Discord thread.Nr rename_threadr)only_if_current_namez@Failed to rename Discord auto-thread for generated session titleTr) rrrr}r#r rCrrFrrr)rrr3r% rr r1 s r.-_rename_discord_auto_thread_for_session_titlez;GatewayRunner._rename_discord_auto_thread_for_session_title=sF&t'H&QQQQQQQQ  F6=dJPT6U6U_$**6222[_ ? F$??  F99%@@  l-F$%%%,V5OQU%V%V           l l l LL[fjL k k k k k k ls<5B33&CCc|r||sdS tj}n!#t$rt |dd}YnwxYw||rdS t j|}n#t$r|}YnwxYwt| ||||td}|dSdd}| |dS)zJSchedule Discord auto-thread rename from the auto-title background thread.Nrz1Discord semantic thread rename failed to scheduler log_messager%c |dS#t$r tddYdSwxYw)Nz%Discord semantic thread rename failedTrr.rFrrrfuts r._log_rename_failurezSGatewayRunner._schedule_discord_semantic_thread_rename.._log_rename_failure>sX U  U U U Dt TTTTTT U&AAr) rrrrWr} is_closedrr4rFrrrrorrr3r% r copied_sourcerrs r.(_schedule_discord_semantic_thread_renamez6GatewayRunner._schedule_discord_semantic_thread_rename=s2 D==fEE  F 8+--DD 8 8 84$77DDD 8 <4>>++< F #'/77MM # # #"MMM #)  > >}jZ_ ` ` K     > F U U U U   !455555s!/A  A )A>> B  B cKtj|j|d{Vr|jr|jsdS||rdS||}|tt|dd}t|r\ ||t|jt|j}n#t$rd}YnwxYwt|trdSt|dd}| |t|jt|jd{V}|r7t|dpdt|krdSn-#t$r t dd YdSwxYw|dS||} t|d d} | :| t|jt|j| d{VdSt|d d} | t| d dnd} | | t| ddnd} | dS | t'|jt'|j| d{VdS#t(t*f$r"| |j|j| d{VYdSwxYw#t$r t dd YdSwxYw)zLBest-effort rename of a Telegram DM topic when Hermes auto-titles a session.N_get_dm_topic_inforr r3r|z5Failed to verify Telegram topic binding before renameTrrename_dm_topic)rrrr edit_forum_topiceditForumTopic)rmessage_thread_idrz8Failed to rename Telegram topic for auto-generated title)rrrrr$_telegram_topic_auto_rename_disabledr#r}rrrCrFr@rAr0 rBrrrrr0r=r2) rrr3r% rget_infooperator_topicrra topic_name rename_topicr r s r.(_rename_telegram_topic_for_session_titlez6GatewayRunner._rename_telegram_topic_for_session_title>s&t'CVLLLLLLLL TZTb jpjz  F  4 4V < <  F**622  tG}}.BDIIH!! *%-Xgs6>7J7JCPVP`LaLa%b%bNN ***%)NNN*nd33FT=$77  !  * E E//!&"233!F!!s7;;|#<#<#BCCs:VVF    T_c ddd  ? F88??  d"7,=tDDL'"l//!&"233# '6400CILws,>EEE^b 'KN?730@$#G#G#G`d ' &&//&)&*:&;&;# z*   &&"N&,&6#   d d d LLS^bL c c c c c c ds\1C CC>A8E99&F#"F#A J? ?J?8J /J<8J?;J<<J??&K)(K)ct|ddr:t|jddr$|jj|jnd}|dSt|ddpi}|d}|dSt |t r|St |tr(| dvSt |S)zReturn True when operator disabled per-topic auto-rename for this Telegram chat. Controlled via ``gateway.platforms.telegram.extra.disable_topic_auto_rename``. Default is False (auto-rename enabled, preserves prior behaviour). rGNr Frudisable_topic_auto_rename>r;r<r=r>) r}rGr rBrNr@rrCrDrE)rrrrur{s r.r#z2GatewayRunner._telegram_topic_auto_rename_disabledk>stXt,, 18kSW1X1X DK ! % %fo 6 6 6   5 gt44: 566 =5 eT " " L eS ! ! G;;==&&((,FF FE{{r0c|r||sdS||rdS tj}n!#t$rt |dd}YnwxYw||rdS tj|}n#t$r|}YnwxYwt| ||||td}|dSdd}| |dS)z>Schedule a topic rename from the auto-title background thread.Nrz.Telegram topic title rename failed to schedulerr%c |dS#t$r tddYdSwxYw)Nz"Telegram topic title rename failedTrrrs r.rzPGatewayRunner._schedule_telegram_topic_title_rename.._log_rename_failure>sX R  R R R AD QQQQQQ Rrr)rr#rrrWr}rrr4rFrr(rrors r.%_schedule_telegram_topic_title_renamez3GatewayRunner._schedule_telegram_topic_title_rename>sM D88@@  F  4 4V < <  F 8+--DD 8 8 84$77DDD 8 <4>>++< F #'/77MM # # #"MMM #)  9 9-UZ [ [ H     > F R R R R   !455555s#AA$#A$B B$#B$r ct|dsi|_t|jpd}|sdSddl}|}|j|d}||z |jkrdS||j|<dS)zRate-limit the BotFather Threads Settings screenshot. If a user sends /topic repeatedly while Threads Settings are still off, we shouldn't keep re-uploading the screenshot every time. _telegram_capability_hint_tsr|TrNrF)rr/rCrrDrzrB$_TELEGRAM_CAPABILITY_HINT_COOLDOWN_Srs r.%_should_send_telegram_capability_hintz3GatewayRunner._should_send_telegram_capability_hint>s t;<< 302D -fn*++ 4oo044WcBB :A A A558)'2tr0c dS)Nuz/topic — enable multi-session DM mode (one bot, many parallel chats) Usage: /topic Enable topic mode, or show status if already on /topic help Show this message /topic off Disable topic mode and clear topic bindings /topic Inside a topic: restore a previous session by ID How it works: 1. Run /topic once in this DM — Hermes checks BotFather Threads Settings are enabled and flips on multi-session mode. 2. Tap All Messages at the top of the bot and send any message. Telegram creates a new topic for that message; each topic is an independent Hermes session (fresh history, fresh context). 3. The root DM becomes a system lobby — send /topic, /status, /help, /usage there. Normal prompts go in a topic. 4. /new inside a topic resets just that topic's session. 5. /topic inside a topic restores an old session into it.rrs r._telegram_topic_help_textz'GatewayRunner._telegram_topic_help_text>s M  r0c\K|jsddlm}|tdSt |jpd}|sdS |j|t |jpdd{V}n#t$rd }YnwxYw|sd S |j | d{Vn6#t$r)}t d d |cYd}~Sd}~wwxYwdD]>}t||d}t|tr||d? dS)z5Cleanly disable topic mode for a chat via /topic off.r)format_session_db_unavailablez,gateway.shared.session_db_unavailable_prefix)rr|zCould not determine chat ID.rNFz@Multi-session topic mode is not currently enabled for this chat.r~z%Failed to disable Telegram topic modezFailed to disable topic mode: )rr/uMulti-session topic mode is now OFF for this chat. Existing topics in Telegram aren't removed — they'll just stop being gated as independent sessions. The root DM works as a normal Hermes chat again. Run /topic to re-enable later.)rrr5rrCrrrrFdisable_telegram_topic_moderrr}r@rAr)rrr5rcurrently_enabledrr stores r.%_disable_telegram_topic_mode_for_chatz3GatewayRunner._disable_telegram_topic_mode_for_chat>s k B B B B B B00:h8i8ijjj jfn*++ 211 &&*&6&U&UFN0b11'V''!!!!!!   & & & %    &  VUU :">>w>OO O O O O O O O O : : :   D E E E9C99 9 9 9 9 9 9 : T ) )DD$--E%&& ) '4((( G  s06A;; B  B !B44 C'>C"C'"C'c HKgd} |jt|jt|jdd{V}n.#t $r!t ddg}YnwxYw|r|d|D]}t| dpd }t| d pd }t| d pd  }d |d|d}|r|d|z }||| d dddd|d ddgn| gdd |S)N)z*Telegram multi-session topics are enabled.r|zTo create a new Hermes chat, open All Messages at the top of this bot interface and send any message there. Telegram will create a new topic for it.r|rc )rrlimitz)Failed to list unlinked Telegram sessionsTrzPrevious unlinked sessions:rr|r% zUntitled sessionr z- u — `rrzTo restore one:]1. Create or open a topic. To create a new one, open All Messages and send any message there..2. Send /topic inside that topic.zExample: Send /topic rz inside a topic.)z-No previous unlinked Telegram sessions found.r|z$To restore a previous session later:r<r=r) r(list_unlinked_telegram_sessions_for_userrCrrrFrrrrbrBrDextendr2) rrr rCr@r3r% r rs r.#_telegram_topic_root_status_messagez1GatewayRunner._telegram_topic_root_status_message>s    !-VVFN++FN++WHH     LLDtL T T THHH    LL6 7 7 7# # # T!2!2!8b99 GKK00F4FGGgkk)44:;;AACC6E66666.-G---D T"""" LL!o@O (=(=OOO      LL   yysAA(A;:A;raw_session_idcK|j}|j|d{V}|sd|S|j|d{V}|sd|St |dpddkrdSt |dpdt |jkrdS|j| d{V}|j t |j t |j  d{V}|r|r|d |krd S| |} |j t |j t |j t |j||d d{Vn*#t$r} dt | vrYd} ~ d Sd} ~ wwxYw|j|d{Vp|} d} t!|j|d{VD]T} | ddkr9| dr$t | d} nUn#t$$rd} YnwxYwd| } | r| d| z } | S)zBRestore an existing Telegram-owned Hermes session into this topic.NzSession not found: rr|r!zNThat session is not a Telegram session and cannot be restored into this topic.rz3That session does not belong to this Telegram user.rr r3z9That session is already linked to another Telegram topic.restored)rrrrr3 managed_modezalready linkedr[rbrzSession restored: z Last Hermes message: )rrresolve_session_idrDrrCrBr#is_telegram_session_linked_to_topicr0 rrrrr2get_session_titler get_messagesrF)rrrrArr3r@linkedcurrent_bindingrrr% last_assistantrrRs r._restore_telegram_topic_sessionz-GatewayRunner._restore_telegram_topic_session%?s+>>~?S?S?U?UVVVVVVVV  BA)=)=)?)?AA A(44Z@@@@@@@@ BA)=)=)?)?AA A w{{8$$* + +z 9 9cc w{{9%%+ , ,FN0C0C C CHH'KKWaKbbbbbbbb $ 0 K K''&*++!L! !         S" So&9&9,&G&G:&U&URR226::  "66FN++f.//FN++'%' 7           3s88++RRRRRR   &88DDDDDDDDR  "#$*:*G*G *S*S$S$S$S$S$S$STT  ;;v&&+55'++i:P:P5%(Y)?)?%@%@NE " " "!NNN "0//  F E^EE EHs2AG-- H7HHH>cfgxcycyzzz{{{ BBBBBB ~t<<%d,?FF *v*$MM15fllnn1E1EMM-Iv)6@6O6O)[U[#,))) ()%~ (43FtLLLLL!MMMMMMMMMMMMMMMM$    N L R##$Pdiiu 6N6N$P$PQQQ V##$T &//8R8R$T$TUUU ^##$\DIIf[FYFYJRDIIl33d::PRMl-lYelllJ &*&>&T&TUZUa&b&b b b b b b b .CC!,j    99U## # ; ; ; NN2A 6 6 60::: : : : : : : ;sQ("A Q(AQ(A=Q("C: Q(C  Q( C EQ('.K'K =JK  J*'K )J**K ? K KKKKQ( L!L<Q(LC0Q(7A QQ( Q Q(QQ(( R(2+R#R(#R(rrn rc < Kd} |}t|tr|dnd}t|tr#t |dd}n#t $rYnwxYw|sd{VS||j dtf fd } | |jj } dd|d | d | d | d } | ||| | d{VS)uGate a destructive session slash command (/new, /reset, /undo). ``execute`` is an async callable ``execute() -> str | EphemeralReply`` that performs the destructive action. If the ``approvals.destructive_slash_confirm`` config gate is off, ``execute`` runs immediately (returning its result). Otherwise this routes through ``_request_slash_confirm`` — native yes/no buttons on Telegram/Discord/Slack, text fallback elsewhere. Three-option resolution: - ``once`` — run ``execute`` and return its result - ``always`` — persist ``approvals.destructive_slash_confirm: false``, then run ``execute`` - ``cancel`` — return a "cancelled" message; do not run ``execute`` TrNdestructive_slash_confirmchoicecZK|dkrddS|dkra ddlm}|ddtd n2#t$r%}td |Yd}~nd}~wwxYwd{V}|dkrd }t |tr||zS|S|S) Nrnu🟡 /z# cancelled. Conversation unchanged.r<r)save_config_valuez#approvals.destructive_slash_confirmFz8User opted out of destructive slash confirm (session=%s)z5Failed to persist destructive_slash_confirm=false: %su ℹ️ Future /clear, /new, /reset, and /undo will run without confirmation. Re-enable via `approvals.destructive_slash_confirm: true` in config.yaml.)rrerrirFrr@rC)rcrerr.noterro rs r. _on_confirmzCGatewayRunner._maybe_confirm_destructive_slash.._on_confirm@s)!!LLLLL!! 555555%%&KUSSSKKR#!NNOQT#799______F!!R fc**)!D=( Ms-A A4A//A4u⚠️ **Confirm /z** u Choose: • **Approve Once** — proceed this time only • **Always Approve** — proceed and silence this prompt permanently • **Cancel** — keep current conversation _Text fallback: reply `z approve`, `z always`, or `z cancel`._)rrrr% rhandler) _read_user_configr@rArBrrFrrrC_typed_command_prefix_forrN_request_slash_confirm) rrrrr% rn ro confirm_requiredrQrrg_pprompt_messagers ` ` @r.r z.GatewayRunner._maybe_confirm_destructive_slash?s4  ((**C0:30E0EO ,,,4I)T** Z#' 6QSW(X(X#Y#Y     D   # ?????? "225<@@  c        < + +EL,A B B T T T T T ')  T T 68  T T GI  T T T 00" 1         sA8B BBc|Kddlm}|j}||}t |dd} | ddl} | d} | |_t| } | || ||| |} | || |} d}| v | |j|||| | d{V}|rt |ddrd }n9#t$r,}t d ||j|Yd}~nd}~wwxYw|rdS|S) aRAsk the user to confirm an expensive slash command. ``handler`` is an async callable ``handler(choice: str) -> str`` where ``choice`` is ``"once"``, ``"always"``, or ``"cancel"``. The handler runs on the event loop when the user responds; its return value is sent back as a gateway message. Returns a short acknowledgment string to send immediately (before the user's response). If buttons rendered successfully the ack is ``None`` (buttons are self-explanatory); if we fell back to text the message itself IS the ack. rr8 rNrZF)rr% rrr> r~rTz*send_slash_confirm failed for %s on %s: %s)r r9 rrr}rrrnextregisterr#rRrsend_slash_confirmrrFrrrrN)rrrrr% rrhr rrcounterrr> rr~ used_buttons button_resultrs r.rkz$GatewayRunner._request_slash_confirm6@s* >=====226:: $ 8$?? ? * * * * &&q))G*1D 'W '  ##KWgNNN**62233FD >fj$77G 9B//,/LL)r0rr+c|dSd|i}||||||r3d|d<t|}|r |dvr||d<|t||d<|tjkr|t||d <|S) zGBuild thread metadata for synthetic sends that only have routing state.Nrr+rT telegram_dm_topic_reply_fallback>r|r;direct_messages_topic_idtelegram_reply_to_message_idrT)_is_telegram_dm_topic_targetrCrxry) rrNrrr+rrr~rs r.rz)GatewayRunner._thread_metadata_for_target@s  4$/#;  , ,    -   T<@H7 8i..C ;s)++7:34".;>?R;S;S78 x~ % %*=*I&))<%=%=H\ "r0r}cr|tjks|dS|dkrdS||rtt|dd}t |ri ||t |t |}t |tS#t$rt ddYnwxYwdS)z>Return True when a target is a Telegram private DM topic lane.NFr,Trz,Failed to inspect Telegram DM topic metadatar) rxrr}rrrCr@rArFrrr)rNrrr+rget_dm_topic_info topic_infos r.rz*GatewayRunner._is_telegram_dm_topic_target@s x( ( (I,=5   4  7  'W 7KT R R )** 88!2!27CLL#i..!Y!YJ&j$777!```LL!OZ^L_____`us'B &B43B4c t|S)zBReturn the platform-specific reply anchor for GatewayRunner sends.)r)rrs r.rz%GatewayRunner._reply_anchor_for_event@s'u---r0ct|dd}|r|sdS tj||_dS#t $rtdYdSwxYw)z;Ensure a background task is watching for update completion._update_notification_taskNz;Skipping update notification watcher: no running event loop) r}rprr_watch_update_progressrrWrrr)r existing_tasks r.rz1GatewayRunner._schedule_update_notification_watch@s&A4HH  !3!3!5!5  F X-4-@++--..D * * * X X X LLV W W W W W W Xs+A$B?B@ @ poll_intervalstream_intervalc  !"#$%&Ktdz }tdz }tdz }tdz }tdz }tj$$|z} d d"d} d%||fD]!} | r t j| } | d} | d"| d }| d } | d }| d }| rO"rMt| &|j & | &"||| %| s| d"} n#t$rYwxYw# r"sQtd|s|r$| kr|r|d{VrdStj|d{V|s|r$| k|s|rC|s/|d|d{VdSdt$dt$fdd}$#d!d4 !"#$%&fd }$| kr|r|rU |}t'||kr!||dz !t'|}n#t($rYnwxYw|d{V |pd}t-|}|dkr. "dt1%&d{Vn@ "d|t1%&d{Vtd|| n2#t$r%}td|Yd}~nd}~wwxYw|||||fD]}|dtd z d|j| ddS|rU |}t'||kr!||dz !t'|}n#t($rYnwxYw!r+$#z |kr|d{V|r| r|j| s t j|}|d!d}|d"d}|r|d{Vd#}t=t? d$de "||| t1%&%d{Vd}n2#t$r%}t!d&|Yd}~nd}~wwxYw|sT|rd'|d(nd}t= d)d*} "d+||d,|d-|d.t1%&d{Vd|j| <td/| |dd0n>#t j"t(f$r%}t!d1|Yd}~nd}~wwxYwtj|d{V$| k|std2||d|d{V "d3t1%&d{Vn#t$rYnwxYw|||||fD]}|dtd z d|j| ddSdS)5aWatch ``hermes update --gateway``, streaming output + forwarding prompts. Polls ``.update_output.txt`` for new content and sends chunks to the user periodically. Detects ``.update_prompt.json`` (written by the update process when it needs user input) and forwards the prompt to the messenger. The user's next message is intercepted by ``_handle_message`` and written to ``.update_response``. rr.update_output.txt.update_exit_coder2 NrNrr+rrrTrr}zOUpdate watcher: cannot resolve adapter/chat_id, falling back to completion-only124rr%c.tjdd|S)Nz\x1b\[[0-9;]*[A-Za-z]r|)r)rrs r. _strip_ansiz9GatewayRunner._watch_update_progress.._strip_ansiSAs62B== =r0rr|c KsddSd  sdSdfdtdtD}|D]f} d|dt  d{V5#t $r%}td |Yd}~_d}~wwxYwdS) z!Send buffered output to the user.r|N c*g|]}||zSrr)r,rclean max_chunks r.rzOGatewayRunner._watch_update_progress.._flush_buffer..hAs&VVVeAa)mO,VVVr0r```  ```rRrzUpdate stream send failed: %s) rDrDrM rrrrFrrr) chunkschunkrrrrrbufferrlast_stream_timerr~rNs @@r. _flush_bufferz;GatewayRunner._watch_update_progress.._flush_bufferZAs_<<>> K''--//EF#yy{{  IVVVVVeAs5zz96U6UVVVF E EE!,,,,,,!=hQY!Z!Z!Z' !EEELL!@!DDDDDDDDE E Es1B99 C(C##C(r;u✅ Hermes update finished.rRru(❌ Hermes update failed (exit code {}).z&Update finished (exit=%s), notified %sz$Update final notification failed: %sTrr1 rrFsend_update_prompt)rrrrr~z%Button-based update prompt failed: %sz (default: rytyped_command_prefixr%u"⚕ **Update needs your input:** z Reply `zapprove` (yes) or `z)deny` (no), or type your answer directly.z!Forwarded update prompt to %s: %sr z Failed to read update prompt: %sz$Update watcher timed out after %.0fsu-❌ Hermes update timed out after 30 minutes.r)#rrrrDrfrrrrBrxrrrFrrrrprPrCrrdrDr0rrformatrir rrr}rrrrrG)'rrrr pending_path claimed_pathr exit_code_pathr rrrgr" rr+rrT bytes_sentrr exit_code_rawrrr prompt_data prompt_textr sent_buttonsbtn_err default_hintrmrrrrrrr~rNs' @@@@@@@@r.rz$GatewayRunner._watch_update_progress Asj $&<< #&DD "%99 %(;;"%:: '))99;;( !<0  D{{}} "j)9)9::G#*;;z#:#:L%kk)44G ' K 8 8I")++m"<"$>$D$D$F$F$M#M #M 2 2I A~~%ll#9%A(U]%^%^%^+ &ll#FMMiXX%A(U]%^%^%^+ KK H)U`aaaa NNNNN#I1MMMMMMMMN' k(+7..AHHH---- 22::d:KKK+// TBBB!!## )3355G7||j00'*++"66%(\\ D||~~ &499;;1A#Ao"U"U#moo%%%%%%% ""$$, H, H 7;;KHH, H*H"&*[-B-B-D-D"E"EK"-//(B"?"?K)ooi< > > > >! ? ?s C5F FF&AN** N76N7 CR SR==S5AU99 VV[]+[##B]++^&^!!^&1-a a,+a,c& Ktdz }tdz }tdz }tdz }|s|sdSd}|} |r ||n#t$rv|s_Y|rZ|d|d|d|ddSdSYnwwxYw|s_ |rZ|d|d|d|ddSdSt j|}|d}|d } |d } |d } |d } |st d d}|}|| |rZ|d|d|d|ddSdS| pd} t| }d}|r|}t|}|j|}|s| rt d|d}|}|| |rZ|d|d|d|ddSdS|r| r||| | | | |}t!jdd| }|r4t%|dkr d|ddz}|dkrd|d}nd|d}n |dkrd}nd}|| |t)||d{Vt d|| |n2#t*$r%}td |Yd}~nd}~wwxYw|rX|d|d|d|dn`#|rY|d|d|d|dwwxYwdS)!aIf an update finished, notify the user. Returns False when the update is still running so a caller can retry later. Returns True after a definitive send/skip decision. This is the legacy notification path used when the streaming watcher cannot resolve the adapter (e.g. after a gateway restart where the platform hasn't reconnected yet). rrrrFTrrNrr+rrTz2Update notification deferred: update still runningr;r|z:Update notification deferred: %s adapter not connected yetrz\x1b\[[0-9;]*mrr4 iTNru!✅ Hermes update finished. ``` ru❌ Hermes update failed. ``` u(✅ Hermes update finished successfully.u]❌ Hermes update failed. Check the gateway logs or run `hermes update` manually for details.rRrz0Sent post-update notification to %s:%s (exit=%s)z#Post-update notification failed: %s)rrfr4rFr rrrrBrrirDr0rxrrr)rrrrrFr)rrrr rcleanupactive_pending_pathr" rrr+rrTrrr8rNrr~r\rs r.rz'GatewayRunner._send_update_notificationAs$&<< #&DD "%99 %(;;""$$ \-@-@-B-B 5*^ 7""$$ $ ((6666($$$'..00$#h 7#**d*;;;##t#444""d"333%%%66666  7 7k$$$"((** d 7#**d*;;;##t#444""d"333%%%66666  7 7aj!7!7!9!9::G";;z22Lkk),,G K00I K00I \22J!((**  PQQQ&2#$$\222H 7#**d*;;;##t#444""d"333%%%66666  7 7E+4466<<>>E#MM**IF!!## 1$..00 --Hm''11G w  P  &2#$$\222L 7#**d*;;;##t#444""d"333%%%66666  7 7I 7 ;;'(2# < 12v>>DDFF z6{{T))!&!7 A~~RVRRRP6PPP!^^DCCyCll9(XVVV#  F    E E E NN@! D D D D D D D D E 7#**d*;;;##t#444""d"333%%%666  7#**d*;;;##t#444""d"333%%%6666  7 tspR$/BR$D#R$R$DR$;CR$0CR$CR$#T1$ S.S T1ST11AVc Ktdz }|sdS tj|}|d}|d}|d}|d}|d}|r|s |d dSt|}|j|} | s4t d | |d dS|j j |} | ;| j s4td | |d dS||||||| } | t#|d t%| |d{V} | Xt'| dddurEtd||t'| dd |d dStd||t#|t#||rt#|ndf|d S#t*$r<} td| Yd} ~ |d dSd} ~ wwxYw#|d wxYw)zANotify the chat that initiated /restart that the gateway is back.rNrNrr+rrTTrz6Restart notification skipped: %s adapter not connectedzJRestart notification suppressed: %s has gateway_restart_notification=falseru;♻ Gateway restarted successfully. Your session continues.rRrrFz3Restart notification to %s:%s was not delivered: %srrz"Sent restart notification to %s:%szRestart notification failed: %s)rrfrrrrBr rxrrrrrGr rrirrrCrr}rrF)r notify_pathrHrrr+rrTrNrrr~r.rs r.rz(GatewayRunner._send_restart_notificationhBs"%;; !!## 4@ 0:k335566D88J//Lhhy))G--I--I,//J w n   $  / / / / /k --Hm''11G  L \   $  / / / / /Y ;044X>>L' 0Y' ` L   $  / / / / /I77#$. 8H#<<G M5hRRR(F!gfi&F&F%&O&OI FG-JKK     $  / / / / / KK4    |$$c'lli4YC NNNUYY   $  / / / /     NN>L' 0Y' mNnc$,&7&7PTP^9hT^9L9L9LdhiF  Fi$7$7, ;;LN# < P#*<<DL))!=hQY!Z!Z!Z$0$$FF %A($S$S$SM$P'.|| --#%2(4(("""""" (/||C 4E4Ew'O'O!O!O!O!O!O!O%'&)T*J*Je*S*SNNP  1NOO   f%%% ENL    LNL  s0D!I;I J 'JJ cfddlm}t|ddpi}||jj}t|dd}||jjj|jj|jjpd|jj rt|jj nd|jj rt|jj nd|jj rt|jj nd|j |jjrt|jjndt|jddpd| S) a@Set session context variables for the current async task. Uses ``contextvars`` instead of ``os.environ`` so that concurrent gateway messages cannot overwrite each other's session state. Returns a list of reset tokens; pass them to ``_clear_session_env`` in a ``finally`` block. r)set_session_varsrNsupports_async_deliveryTr|rw) rNrr( rrrQrrTrwasync_delivery)r rr}rBrrNr{rr( rrCrrQrrT)rrr _adaptersrg_async_deliverys r.r2 zGatewayRunner._set_session_envCs. =<<<<<D*d339r ==!899!(,EtLL^,2N*n.4"7>~7OWc'.2333UW3:>3IQC.///r7>~7OWc'.2333UW+9@9RZs7>4555XZGNIr::@b*    r0rc(ddlm}||dS)z>Restore session context variables to their pre-handler values.r)clear_session_varsN)r r)rrrs r.rJ z GatewayRunner._clear_session_env!Cs+>>>>>>6"""""r0cKtj}t}|j||j|g|Rd{VS)zJRun blocking work in the thread pool while preserving session contextvars.N)rrrr@ _get_executorr)rfuncrQrrs r.rz+GatewayRunner._run_in_executor_with_context&Csx'))nn)T)    G             r0cpt|dd}|tj}||_|5t|ddrt dt|dd}|t|ddr(t jdd }||_|cdddS#1swxYwYdS) z:Return the gateway-owned executor for blocking agent work.rNrFz.Gateway is shutting down; executor unavailabler _shutdownrc r) max_workersthread_name_prefix) r}rrrrW concurrentfuturesThreadPoolExecutorrrrexecutors r.rzGatewayRunner._get_executor1Cst-t44 <>##D"&D    t0%88 U"#STTTt[$77H78[%#H#H%-@@ "'7A"*                  sA.B++B/2B/c(t|dd}|dS|5d|_t|dd}d|_dddn #1swxYwY|dS |dddS#t$r|dYdSwxYw)zBStop the gateway-owned executor without touching the loop default.rNTrF)rlcancel_futures)rl)r}rrrur=rs r.r z GatewayRunner._shutdown_executorDCst-t44 < F  " "%)D "t[$77H!DN " " " " " " " " " " " " " " "   F *   5  > > > > > * * *   5  ) ) ) ) ) ) *s# AA AA-- BB)rrr rrrc ddlm}ddlm}m}ddlm} t|tr|n | } |pd } |pd } d} | p| }|dup|}|r)|r& | ||| \}}| s)t|tr| } t|tr| dnd}t|tr| d nd}| s)t|tr| } t|tr| } n2#t$r%}td |Yd}~nd}~wwxYw| s |} | s |} || | | | S#t$r&}td |Yd}~d Sd}~wwxYw)aiResolve image-input routing for the effective model this turn. Returns ``"native"`` (attach pixels on the user turn) or ``"text"`` (pre-analyze with vision_analyze and prepend the description). See agent/image_routing.py for the full decision table. Gateway sessions can have /model overrides that live outside config.yaml. Image preprocessing runs before AIAgent sets the auxiliary_client runtime globals, so resolve the same per-session runtime bundle the upcoming agent turn will use instead of consulting only the persisted default model. r)decide_image_input_mode)_read_main_model_read_main_providerrr|NrrrOuOimage_routing: session runtime resolution failed, falling back to config — %s)rOu;image_routing: decision failed, falling back to text — %sr)agent.image_routingrrrrrKrr@rArDrrCrBrFrrr)rrrr rrrrrrrQresolved_providerresolved_modelresolved_requested_providerneeds_session_runtimehas_session_identityr rruntime_providerruntime_requested_providerrs r.r z&GatewayRunner._decide_image_input_modeWCs*2  C C C C C C T T T T T T T T 5 5 5 5 5 5!+K!>!>Q++KKMMC!)R 6 6 8 8 #kr0022N*, '(9$9$O=O !#)#5#D $ )= 151T1T%$/$'2U22.J *       LLVX[ \ \ \66666 sCA5G8C2E+*G+ F5FGF)G G4G//G4 user_textr clKddlm}ddlm}d}g}|D]} td||||d{V}t j|} | dr>| d d } || } | d | d |d n| d|d#t$r>} t d| | d|dYd} ~ d} ~ wwxYw|r d |} |r| d|S| S|S)a Auto-analyze user-attached images with the vision tool and prepend the descriptions to the message text. Each image is analyzed with a general-purpose prompt. The resulting description *and* the local cache path are injected so the model can: 1. Immediately understand what the user sent (no extra tool call). 2. Re-examine the image with vision_analyze if it needs more detail. Args: user_text: The user's original caption / message text. image_paths: List of local file paths to cached images. Returns: The enriched message string with vision descriptions prepended. r)vision_analyze_tool)sanitize_contextzDescribe everything visible in this image in thorough detail. Include any text, code, data, objects, people, layout, colors, and any other notable visual information.zAuto-analyzing user image: %s)r user_promptNranalysisr|z0[The user sent an image~ Here's what I can see: zA] [If you need a closer look, use vision_analyze with image_url: z ~]z[The user sent an image but I couldn't quite see it this time (>_<) You can try looking at it yourself with vision_analyze using image_url: rOzVision auto-analysis error: %sz[The user sent an image but something went wrong when I tried to look at it~ You can try examining it yourself with vision_analyze using image_url: r) tools.vision_toolsragent.memory_managerrrrrrrrBrbrFrr2) rrr rranalysis_promptenriched_partsrgr r.rrrs r.r z)GatewayRunner._enrich_message_with_visionCs#* ;:::::999999 8    D  >rz! 6 11i112552: >>>>>>,. R RD R :DAAA&01A4HHHHHHHH)$V!' !5J*11*=== #))*;j*;*;*;<<<<"JJw@@EKK GuUUU"))*TUUU R R R 6:::%%&PQQQQQQQQ R  2[[00FLL 6Y__..,>>555 J 11i113III11 1000s&BDse!# UL$77=2  ,, ) )GAt(22 )""4(((r0cKt|dr4t|d}t|dgpg}|t|fS||}|s||nt|ddpdgfS||nt|ddpd}|||d{V\}}t |d|t |dt|||fS)aWTranscribe a pending audio event once and cache the result on the event. Voice follow-ups can be inspected first by the interrupt monitor and later consumed by the pending-drain path. Both need the same transcript, but only one STT call and one transcript echo should happen for the platform message. rX _gateway_pending_stt_transcriptsNrr|)rr}rqrYr r7) rrrr cached_textcached_transcriptsr r enriched_textrs r.$_transcribe_pending_audio_event_oncez2GatewayRunner._transcribe_pending_audio_event_onceGDs9 55 6 6 9!%)DEEK!(0RTV!W!W!][] %7 8 88 855e<<  f ) 599GE6SWFF F7>>> V VB VllN%%%%%#  V V V ={HUUUUUUUU V V Vs'A,, B6BBrcK||s|gfS |||d{V\}}|tur)||||n|} |||||| |d{V|p||fS#t $r*} td|| |gfcYd} ~ Sd} ~ wwxYw)a]Transcribe a pending voice event and echo transcripts once. Unified helper for all interrupt/monitor/backup/drain paths that need to transcribe a pending voice event and echo the transcript to chat. Returns ``(enriched_text, transcripts)`` so the caller can feed the enriched text into ``agent.interrupt()`` or the pending-drain flow. If the event has no STT-eligible media, returns ``(text, [])`` unchanged. The caller is responsible for the ``_build_media_placeholder`` fallback when ``text`` is empty and the event has non-audio media. Nrz%s transcription failed: %s) rYr_UNSETrRrrrFrr) rrrrrrrEr~rr echo_meta trans_excs r.rZz0GatewayRunner._transcribe_and_echo_pending_voiceDsY*..u55 8O /3/X/X00****** &M;V##88,,U33*2 99"' :       !(D+5 5    NN8+y Q Q Q8OOOOOO sA9B C !CC C r0c ddlm}t|dpd}d}d}d}|r |j|jj|}|rt|ddr|j Sn3#t$r&}t d||Yd}~nd}~wwxYw| |} | | St|} | r| d}| d }| d }t|dp|pd} t|d p|pd} t|d p|pd} | r| r| s5td || | | |d d dS t#| }|jt&vrN ddlm}||jst/| n#t$rt/| wxYwn,#t$rtd| YdSwxYw||| | t|dpdpdt|dpdpdt|dpdpdS)aResolve the canonical source for a synthetic background-process event. Prefer the persisted session-store origin for the event's session key. Falling back to the currently active foreground event is what causes cross-topic bleed, so don't do that. r)rrr|rNz>Synthetic process-event session-store lookup failed for %s: %srNr+rzcSynthetic event source unresolvable: session_key=%r platform=%r chat_type=%r chat_id=%r evt_type=%srr7rz9Synthetic process event has invalid platform metadata: %rrrrQ)rNrr+rrrQ)r:rrCrBrDrrrr}rrFrrrrr/rErrxr{rrrr r2)rr0rrderived_platformderived_chat_typederived_chat_idrcr cached_sourcerr r+rrNrs r._build_process_event_sourcez)GatewayRunner._build_process_event_sourceDs 211111#''-006B77==??   5 "11333*377 DD(WUHd;;( <'    T !;;KHHM($$(55G 5#*:#6 $+K$8!"))"4CGGJ//I3CIrJJPPRRXXZZ  ,,G0AGRHHNNPPVVXX cggi((AOArBBHHJJ I W  NN]Iw$$    4  ..H~%===4KKKKKK,::8>JJ8(7778 444$]3334    NNK   44  }#''+..4"55;;==E **0b117799AT#''+..4"55;;==E     sCAB C #CC J4/I$#J$I>>J%J+*J+r c K||}|spt|dpd}|sIt|dpd}|rt ||}|r|jt j}ddlm }m }|q||sf t d|||||d{Vd S#t$r'} td || Yd} ~ d Sd} ~ wwxYwtd |dStd |dddSt|jdr |jjnt|j} d}|jD]\} } | j| kr| }n|sdSddlm } | |sddlm }t|dpdpt|jpd} t d|||||d{Vd S#t$r'} td || Yd} ~ d Sd} ~ wwxYw i}t|dpd}|r||d<t)|t*j|d t|dpdpd|}t d| |j|j||d{Vd S#t$r&} td| Yd} ~ d Sd} ~ wwxYw)a Inject a watch/completion notification as a synthetic message event. Routing must come from the queued event itself, not from whatever foreground message happened to be active when the queue was drained. Returns ``True`` after adapter acceptance, ``False`` after a retryable adapter failure, and ``None`` when the event has no gateway route. This is not a transactional boundary: a process crash after adapter acceptance can still cause durable at-least-once replay. origin_session_idr|rNr)adapter_supports_push deliver_wakeuIWatch pattern notification — waking api_server session %s via self-post)rr3Tz;Watch notification self-post wake failed for session %s: %sFzZDropping watch notification for raw session %s: no api_server adapter to self-post throughzCDropping watch notification with no routing metadata for process %sr3r4r{)r)rparent_session_idr rT)rrvrrArTr~uAWatch pattern notification — injecting for %s chat=%s thread=%sr% )rrCrBrDr/rrxr* gateway.wakerrrrirFrrrNr{rrrrr$rr/r)rr r0rraw_sidr rrrrr rr _wake_push_okr~r  synth_events r.rP z(GatewayRunner._inject_watch_notificationDs11#66* #''"566<"==CCEEG "#''-006B77==??"-c22:!G -++H,?@@LLLLLLLL&/D/DW/M/M&% 7# +l7PWXXXXXXXXXX#t$%%%-#Q %uuuuu %> t NNU i00   418'1R1Rl--X[\b\kXlXl M''))  DAqw-''( 4GGGGGG}W%%  2 1 1 1 1 1#''"566<"==CCEEbV^Ma_aIbIbG  ' #l7PPPPPPPPPPt   Q uuuuu   H #CGG,?$@$@$FB G G M M O O   C1B-.&(-sww|44:;;AACCKt! K KKS     ((55 5 5 5 5 5 5 54    LLA1 E E E55555 sI/D D:D55D:/J J:J55J:>CN O OOcDt|dpd}|dkr-t|dpd}|r||dfndS|dkrBt|dpd}|d}|r||||fSdS) aReturn a producer-stable identity when one is available. Delegation UUIDs identify one producer completion. Process session IDs are normally unique too, but include the persisted spawn epoch so an explicitly reused ID represents a distinct process incarnation. Legacy process events without ``started_at`` are delivered without deduplication rather than risking suppression of a real completion. rr|r: delegation_idNr2r3r})rCrB)r0r= producer_idr}s r._completion_delivery_identityz+GatewayRunner._completion_delivery_identitynEsswwv,"-- ) ) )cggo66<"==K2=GHk2..4 G | # #cggl339r::K..J ;z5 +z::tr0r cHKt|dd}|dS ||d{V}n.#t$r!td|dYdSwxYw|dS|dsd S|d d krdS ||d{V}|r||krdS||d{V}n.#t$r!td |dYdSwxYw||drdSd S) u0Classify an async-completion delivery target before adapter acceptance. Returns one of: - ``"deliver"`` — the spawning session is live, or ended by a compression rotation with a verified live continuation. The inner #55578 resolver (:meth:`_resolve_async_delegation_session`) still owns the actual route retarget; this pre-flight only proves the completion is deliverable so the durable ack stays honest. - ``"terminal"`` — the spawning session is gone for good (unknown, or ended at an explicit user boundary such as /new). Delivery can never succeed; the durable row should be terminally dropped rather than falsely acknowledged as delivered or replayed forever as pending. - ``"retry"`` — transient uncertainty (session DB unavailable, lookup error, or a compression rotation caught mid-flight before its continuation exists). The claim should be released so a later consumer can retry; the attempt cap bounds the churn. rNrz z7Async-completion pre-flight parent lookup failed for %sTrr|r deliverr r9z4Async-completion pre-flight tip lookup failed for %s)r}rrFrrrrBr )rr rr_tip_session_idtips r._classify_completion_targetz)GatewayRunner._classify_completion_targetEs&T=$77  7 %112CDDDDDDDDFF    LLI!D    77   >:zz*%% 9 ::l # #} 4 4: #-#A#ABS#T#TTTTTTTN! ^7H%H%Hw"..~>>>>>>>>CC    LLF!D    77   ;#''*--;7ys'5'A A #C?C'DDc K||}d}d}|ddkrt|dpd}|r ddlm}dt |dt d j}|||sd Sn4#t$r'}t d ||Yd }~d Sd }~wwxYwt|d pd }|r| |d {V} | dkrbt d|pd||r@ ddlm} | ||n,#t$rtddYnwxYwd S| dkrD|r@ ddlm} | ||n,#t$rtddYnwxYwd S|Y|j5||jvs ||jvr d d d d S|j|d d d n #1swxYwYd } |||d {V} | dur| |;| s9|j5|j|d d d n #1swxYwY|rB| sA ddlm} | ||S#t$rtddYSwxYwSSd} ||j5|j|d |j|<t/|j|jkr8|jd t/|j|jk8d d d n #1swxYwY|rG ddlm}|||n3#t$r&}t d||Yd }~nd }~wwxYw |;| s9|j5|j|d d d n #1swxYwY|rD| sD ddlm} | ||dS#t$r tddYdSwxYwdSdS#|;| s9|j5|j|d d d n #1swxYwY|rB| sA ddlm} | ||w#t$rtddYwwxYwwwxYw)aDeliver once per live gateway, or return False for a retry. ``True`` means this caller reached adapter acceptance, ``False`` means injection failed and the claim was released for retry, and ``None`` means either another same-lifecycle caller owns/delivered the producer event or the event has no gateway route. No cross-process exactly-once guarantee is claimed. r|rr:rr)claim_completion_deliveryr r}r Nz/Could not claim durable async completion %s: %sFr r|zAsync delegation %s targets permanently-gone session %s; terminally dropping delivery (result remains in the delegation records).z)drop_completion_deliveryz'Could not drop durable completion claimTrrz )release_completion_deliveryz*Could not release durable completion claimr )complete_completion_deliveryz5Could not acknowledge durable async completion %s: %s)rrBrCr1rr __import__r r rFrrrDrrrrrrrrrerP rWrrr r)rr r0identitydurable_claim_iddurable_delegation_idrrr verdictrrr injection_resultrs r. _deliver_completion_notificationz.GatewayRunner._deliver_completion_notificationEs" 55c:: " 776??0 0 0$'(@(@(FB$G$G !$ ! !PPPPPP']"T((']']Z=O=O=U=U=W=W=[']']$44-/?$ $t$!!!!NNI-s!55555 ! !$CGG,?$@$@$FB G G M M O O  ) !!% @ @AR S SSSSSSSj((NN/.;=N  (  WWWWWW44 57G )"LL I)-)  4g%%'  ZZZZZZ77 57G )"LL L)-) !5  / C C DDD4#HHH  C C C C C C C C 488BBB  C C C C C C C C C C C C C C C, ^%)%D%DZQT%U%UUUUUUU t++'<#H#3KK8@@JJJKKKKKKKKKKKKKKK ^ ^^RRRRRR//-/?!^^^LL!MX\L]]]]]^ ^ ^AH#3RR8@@JJJFJD9(CDABB=>>=EE5EQQQDABB=>> RRRRRRRRRRRRRRR  SSSSSS00-/?!NNO-s #H#3KK8@@JJJKKKKKKKKKKKKKKK ^ ^^RRRRRR//-/?!^^^LL!MX\L]]]]]]^ ^ ^ ^ ^#H#3KK8@@JJJKKKKKKKKKKKKKKK ^ ^^RRRRRR//-/?!^^^LL!MX\L]]]]]^ ^ ^sFA B++ C5CCE,,&FF#F66&GG-H4H44H8;H8!Q.JJ J %J88&K! K!& Q1A:M7+ Q7M;;Q>M;?QNQ O"O>QOQO>>PPP""&Q  Q  SR: SR S R SR)(S)&SSSSc`|drdSt|ddpd}|sdS|dd|d<|dd|d<|dd|d<|dr |d|d<dSdS)aFill platform/chat_id/thread_id/chat_type on an async-delegation event. Async-delegation completion events only carry ``session_key`` (the daemon worker has no access to the per-message routing metadata the terminal background watcher captures at spawn time). Parse the session_key into the routing fields ``_build_process_event_source`` expects. Best-effort: a CLI-origin event (empty session_key) is left as-is and simply won't route on the gateway. rNNrr|r+rr)rBr/)rr0r6s r. _enrich_async_delegation_routingz.GatewayRunner._enrich_async_delegation_routing:Fs 77:    F#CGGM2$>$>$D"EE  F **Z44J!::k266KIr22I ::k " " 3%k2C    3 3r0cKtjdd{Vddlm}|jr g}g}|js |j}n#t$rYnawxYw| ddkr| |n| ||j|D]}|j ||D]}| |t|}|s) |||d{V}|dur|j |e#t$r?}|j |td|Yd}~d}~wwxYwn2#t$r%}td |Yd}~nd}~wwxYwtj|d{V|jdSdS) uDrain async-delegation completions and inject them as new turns. Background subagents (``delegate_task(background=true)``) run on the async-delegation daemon executor — they have no per-process watcher task, so their completion events would only be seen by the post-turn queue drain. This watcher covers the IDLE case: when a background subagent finishes while no agent turn is running, its result still re-enters the originating session promptly. Mirrors the CLI's idle ``process_loop`` drain. Stays silent when the queue has nothing for us; ignores non-async event types (those are handled by ``_run_process_watcher`` / the post-turn drain). rNrrrr:Fz$Async delegation injection error: %sz"Async delegation watcher error: %s)rrpr<rrrIrFrGrFrBrbrHr$rCr"rrrr) rrlr rK async_eventsr0r rrs r.rz'GatewayRunner._async_delegation_watcherOFsmABBBBBBm * F! .4466,!2==??$wwv*<<<$++C0000s+++.4466,#22C(,,S1111' P PC99#>>>!Ec!J!JJ%! P*.*O*OPZ\_*`*`$`$`$`$`$`$` $--044S999$PPP,00555 %KQOOOOOOOOP P F F F A1EEEEEEEE F-)) ) ) ) ) ) ) )Am * * * * *sfF$ A$#F$$ A1.F$0A11B*F$:EF$ F !5FF$F  F$$ G.GGrc. Kddlm}|d}|d}|dd}|dd}|dd}|d d}|d d} |d d} t|d pdpd } |dd} |} t d||| | | dkrZ| sX tj |d {V||}||j rn:t d|d Sd} tj |d {V||}|nt|j }||k}|}|j rddlm }m}| rv||s`ddlm}ddlm}t'|ddpd}|j r||j nd}|||}t)|}d}t||krK|| d }|d}|dkr ||dzd n|}dt|d|}n|}iddd|d|d|d |d dd|d |d | d | d | d!t'|d!d d|d"|jd#t'|d#d$d%t'|d%dd&|}||}|snF|||d {V}|durאn"||rt d'|n| d(vp| d)ko|jd*v}|r|j r|j d+d nd} | r#ddlm}|| t'|ddpd} d,|d-|jd.| d/}!d }"|jD]\}#}$|#j|kr|$}"n|"rk|ri |rd |ind }%|"||!t9|%|01d {Vn2#t:$r%}&t d2|&Yd }&~&nd }&~&wwxYwn|r| d3kr| s|j r|j d4d nd} | r#ddlm}|| t'|ddpd} d,|d5| d/}!d }"|jD]\}#}$|#j|kr|$}"n|"rk|ri |rd |ind }%|"||!t9|%|01d {Vn2#t:$r%}&t d2|&Yd }&~&nd }&~&wwxYwt d6|d S)7u Periodically check a background process and push updates to the user. Runs as an asyncio task. Stays silent when nothing changed. Auto-removes when the process exits or is killed. Notification mode (from ``display.background_process_notifications``): - ``all`` — running-output updates + final message - ``result`` — final completion message only - ``error`` — final message only when exit code != 0 - ``off`` — no messages at all rrr3check_intervalrr|rNrrrrQrTNnotify_on_completeFzCProcess watcher started: %s (every %ss, notify=%s, agent_notify=%s)rCTz"Process watcher ended (silent): %s)r;r)redact_terminal_output) strip_ansirrl rrrZu'[… output truncated — showing last z chars] rr2r+r}rcompletion_reasonexitedtermination_sourcer8ugProcess watcher: completion for %s already consumed via wait/log — skipping raw notification (#65379)>rBr.r>Nriz[Background process z finished with exit code z~ Here's the final output: rOrRrzWatcher delivery error: %srBi z is still running~ New output: zProcess watcher ended: %s)r<rrBrCrDrrrrrrpr-r output_bufferr;is_completion_consumedrr*tools.ansi_stripr+r}rrrr"rrr{rrrFr)'rrrr3rlrr rrrrQrT agent_notify notify_moder@last_output_lencurrent_output_lenhas_new_outputr; _pr_checkr*r+_command_raw_LIMIT_tail_nlrAcompletion_evtr rrn new_outputr rrr send_metars' r.rz"GatewayRunner._run_process_watcherFs <;;;;;\* +,kk-44  J33 ++i,,KK R00 ++i,,KK R00 \228b99??AAIT {{#7?? >>@@  Z (K G G G %    mH---------*..z::?gn?   LL=z J J J FP F-)) ) ) ) ) ) ) )&**:66G!$W%:!;!; //AN0O~E F nmmmmmmm/ (H(H(T(T/CCCCCC;;;;;;&w 2>>D"H@G@U]::g&;<<<[]D11$AADB8LLH "F4yy6)) $fWXX#jj..36"99cAghh%eUee^cee#& &$j&&{&#M & $W[[b%A%A & "7 &$Y&"7&$Y&%j&%gg|T&J&J&"8&$W%6&,WW>QS[-\-\&-gg?SUW.X.X& !$!&N$"=!<^!L!LJ%&*&K&K"N''!!!!!!I!E))!33J??LLN"  #44W#w.U73DI3U!JBIBW!_!6uvv!>!>]_J!GGGGGG%;%;&B(G(G(M2&& CzCCT[TeCC5?CCC!#G $ 3 3 5 5""17m33&'G!E4 J7 JJDM(Wi(@(@SWI"),, ' ,)EiZg)h)h)h#/## )JJJ"LL)EqIIIIIIIIJ FK5$8$8$8>E=RZW245599XZ CCCCCC!7!7"GGY$C$C$Ir""J2:22$.222 M//11DAqw-//"#0 Fw FF@I$S[)$<$.lGsDDDcTDDDr0)_HONCHO_CACHE_BUSTING_KEYS)clss r."_empty_honcho_cache_busting_configz0GatewayRunner._empty_honcho_cache_busting_configjGsDDS%CDDDDr0cr ddlm}m}|} |j}n#t $rd}YnwxYwt ||f}|j|}|t|S| |}|j pi}|j |j t|j|jpdt#|tr!t%|ngd} || i|_t| S#t($r|cYSwxYw)zD>>D=BDD65D6ci}t|tr|ni}|jD]\}}||}|dkr(t|tr|dkr|nd||d|<Ht|tr||||d|<{d||d|< ddlm}t|dd|d<n#t$rd|d<YnwxYwt|d d }t|tr@| d kr(| | n'| ||S) alPull values that must bust the cached agent. Returns a flat dict keyed by 'section.key'. Missing config keys and non-dict sections yield None values, which still contribute to the signature (so 'absent' vs 'present-and-null' differ). The live tool registry generation is included too. MCP reloads and dynamic MCP tool-list changes mutate the registry without necessarily changing config.yaml. Cached AIAgent instances freeze their tool schemas at construction time, so a registry generation change must rebuild the agent before the next turn. rrNrr)registry _generationztools.registry_generationrr rhoncho)r@rArKrBrtools.registryrfr}rFrrCrErfrdrR) rQr rrQsectionr section_valrfrs r._extract_cache_busting_configz+GatewayRunner._extract_cache_busting_configGs!' T::Bkk: / /LGS'''**K-''J{D,I,I':= 9I9I++tw&&&&''K.. /*5//#*>*>w&&&&''*.w&&&&'' 4 / / / / / //6xPT/U/UC+ , , 4 4 4/3C+ , , , 4 3*55 h $ $ A)9)9X)E)E JJs??AA B B B B JJs==?? @ @ @ s*CCCrXr ephemeral_prompt cache_keysr cddl}ddl}t|ddpd} | r9|| nd} t|pi} | || |dd|dd|dd|dd|rt|ng|pd| t|pdt|pdg d t } || dd S) u:Compute a stable string key from agent config values. When this signature changes between messages, the cached AIAgent is discarded and rebuilt. When it stays the same, the cached agent is reused — preserving the frozen system prompt and tool schemas for prompt cache hits. ``cache_keys`` is an optional flat dict of additional config values that should invalidate the cache when they change. Callers pass the output of ``_extract_cache_busting_config(user_config)`` so edits to model.context_length / compression.* in config.yaml are picked up on the next gateway message without a manual restart. ``user_id`` and ``user_id_alt`` are the runtime user identities carried by the current message's gateway source. They participate in the cache key because the Honcho memory provider freezes them into ``HonchoSessionManager`` at first-message init (see ``plugins/memory/honcho/__init__.py::_do_session_init``). Without them in the signature, a shared-thread session_key (one in which ``build_session_key`` intentionally omits the participant ID, e.g. ``thread_sessions_per_user=False``) would reuse the cached AIAgent across distinct users, causing the second user's messages to be attributed to the first user's resolved Honcho peer. This broke #27371's per-user-peer contract in multi-user gateways. Per-user agent rebuilds in shared threads trade prompt-cache warmth for correct memory attribution. rNryr|rrrOrPT) sort_keysrr ) r rrCrBr r r rH rrQ) rrXr rmrnrr r _j_api_key_api_key_fingerprint_cache_keys_sortedblobs r._agent_config_signaturez%GatewayRunner._agent_config_signatureGstJ #""""""" w{{9b117R88PX`w~~hoo.?.?@@JJLLL^`#Z%52$<$<$>$>??xx$ J++ J++ 0"55 J++,<D'((("!&B"GMr""K%2&& #  &~~dkkmm,,6688"==r0c`||jvrdSt|dd}|dS ||}n-#t$r tddYdSwxYw|sdS|d|d|dd }|d}|r t|}|d |d <|d |d <|d |d <|ds|d|d<n-#t$r td |dYnwxYw||j|<td||d|pddS)uLazily restore a persisted /model override after a gateway restart. ``_session_model_overrides`` is in-memory only, so before persistence a restart silently reverted every session to the global default model. The non-secret parts (model/provider/base_url) are written through to the session store when /model runs (and cleared on /new); here we read them back on first use and re-resolve credentials via the normal runtime provider resolution — api_key is never persisted to disk. No-op when an in-memory override already exists (live state wins) or when the store has nothing persisted (e.g. the user ran /new, which clears both the in-memory dict and the persisted field). Nrz/Failed to read persisted session model overrideTrrrr)rrrryrPrRzdCredential re-resolution failed for persisted override (provider=%s); using credential-less overridezIRehydrated persisted /model override for session=%s: model=%s provider=%sr|) r=r}get_model_overriderFrrrrBrari)rrr8 persistedrrrXs r.rz/GatewayRunner._rehydrate_session_model_overrideGs  $7 7 7 Fot44 = F 00==II    LLAD     FF     F]]7++! j11! j11$ $  ==,,   DXNN&-kk)&<&<#'.{{:'>'>$.5kk:K.L.L*+||J//C+2;;z+B+BHZ(    Dt  6>%k2 W g..B     s"8&A"!A"BE'E/.E/c|j|}|s||fS|d|}dD]}||}||||<|drO|d:|dr%t|d|d<||fS)aApply /model session overrides if present, returning (model, runtime_kwargs). The gateway /model command stores per-session overrides in ``_session_model_overrides``. These must take precedence over config.yaml defaults so the switched model is actually used for subsequent messages. Fields with ``None`` values are skipped so partial overrides don't clobber valid config defaults. r)rryrrPrRNryrRr)r=rBrc)rrrrrrr s r.rz+GatewayRunner._apply_session_model_override6Hs044[AA ).( ( We,,U * *C,,s##C&)s#   y ) ) ""#455= Z((>1N Z((11N, -n$$r0cf|j|}|du|t|nddS)zXD   r0rc|sdS|dr-t|dpi|j|<n|j|d||dS)z?Restore the session override captured before a one-turn switch.Nr|r)rBrAr=rr. rV s r.rU z-GatewayRunner._restore_session_model_override[Hs  F << ' ' A9= Z((.B::D )+ 6 6  ) - -k4 @ @ @   -----r0 agent_modelcp|j|}|duo|d|kS)zGReturn True if *agent_model* matches an active /model session override.Nr)r=rB)rrrrs r._is_intentional_model_switchz*GatewayRunner._is_intentional_model_switchgHs9044[AAt#L W(=(=(LLr0r c|sdS||||sdSt|di|d}|B |n,#t$rt ddYnwxYw|j|d|j|dt|dr|j |d| dS)uPop ALL per-running-agent state entries for ``session_key``. Replaces ad-hoc ``del self._running_agents[key]`` calls scattered across the gateway. Those sites had drifted: some popped only ``_running_agents``; some also ``_running_agents_ts``; only one path also cleared ``_busy_ack_ts``. Each missed entry was a small, persistent leak — a (str_key → float) tuple per session per gateway lifetime. Use this at every site that ends a running turn, regardless of cause (normal completion, /stop, /reset, /resume, sentinel cleanup, stale-eviction). Per-session state that PERSISTS across turns (``_session_model_overrides``, ``_voice_mode``, ``_pending_approvals``, ``_update_prompt_pending``) is NOT touched here — those have their own lifecycles. When ``run_generation`` is provided, only clear the slot if that generation is still current for the session. This prevents an older async run whose generation was bumped by /stop or /new from clobbering a newer run's state during its own unwind. Returns True when the slot was cleared, False when an ownership guard blocked it. FNrz%Failed to release active session slotTrr) rI r}rreleaserFrrrrrrrr)rrr leases r.r0z*GatewayRunner._release_running_agent_statelHs': 5  %d.J.J / / %56;;?? TRR   U  U U U Dt TTTTT U   d333 ##K666 4 ( ( 5   ! !+t 4 4 4 ##%%%tsA&BBc|sdSt|dd}t|dd}||dS|||fd}|dS ||S#t$r tddYdSwxYw)uIRelease the turn lease acquired by (``session_key``, ``run_generation``). Companion to the acquisition in ``_handle_message_with_agent`` (#64934). The token map is keyed by (routing key, run generation), so this can only ever free the lease its own turn acquired — a stale unwind whose generation was bumped by /stop or /new pops ITS token, and the registry's identity check refuses it if a newer turn already holds the lease. Idempotent and safe for bare test runners built via ``object.__new__`` (getattr defaults). FrNrzFailed to release turn leaseTr)r}rrrFrrr)rrr rrfrxs r.r z!GatewayRunner._release_turn_leaseHs 53T::466 >X-5 K8$?? =5 ##E** *    LL7$L G G G55 s A&B B new_session_idc|r|sdSt|dd}t|dd}||dS|||f}|dS |||S#t$r tddYdSwxYw)uFollow a mid-turn session_id rotation with the held turn lease. Compression (session-hygiene pre-compression or the agent's own compressor) can rotate ``session_entry.session_id`` while this turn is in flight. The turn's flush targets the NEW id, so the serialization boundary must follow it — otherwise an alias routing key resolving the new id (topic tip-walk onto the fresh child) could start a concurrent turn the lease never sees (#64934 rotation-alias window). Call at every site that reassigns session_entry.session_id mid-turn. Fail-open no-op when there is no held token. FrNrzFailed to rebind turn leaseTr)r}rBrebindrFrrr)rrr rrrfrxs r.rB z GatewayRunner._rebind_turn_leaseHs . 53T::466 >X-5 K899 =5 ??5.99 9    LL6L F F F55 s A!!&B  B c|sdStD]>}t||d}t|tr||d?||t d||dS)uClear ALL conversation-scoped per-session state for ``session_key``. THE single conversation-boundary funnel. Call this — and nothing else — whenever a session_key crosses a conversation boundary: /new, /resume, auto-reset (idle/daily/suspended), expiry finalization, and the compression-exhausted auto-reset. Why a funnel: these boundaries used to each carry a hand-copied pop-list of the per-session dicts, and the lists drifted every time a new dict was added (#48031, #58403, #10702, #35809 were all "boundary X forgot dict Y" bugs — e.g. /new cleared the /model override but not the /model --once restore snapshot). Adding a new conversation-scoped dict now means adding its attribute name to _CONVERSATION_SCOPED_STATE below; every boundary picks it up automatically. Scope rules: - Conversation-scoped (cleared here): model/reasoning overrides, one-turn restore snapshots, pending model notes, last-resolved model cache, queued follow-up events, and the boundary security state (approvals, /yolo, slash-confirm, update prompts). - Turn-scoped (NOT cleared here): _running_agents/_ts, slot leases, turn-lease tokens — owned by _release_running_agent_state and the dispatch finally. - Idle agent-cache eviction is NOT a conversation boundary: the session is still alive and a resumed turn rebuilds from these overrides. Only true boundaries call this. Safe on bare test runners built via ``object.__new__`` (every access is getattr-guarded). Nz&Cleared conversation scope for %s (%s))rEr}r@rAr&_clear_session_boundary_security_staterrr)rrrJr r8s r.rI z'GatewayRunner._clear_conversation_scopeHs@  F. - -DD$--E%&& - +t,,, 33K@@@ 4k6     r0c|sdSt|dd}t|tr||dt|dd}t|tr||dt|dd}t|tr||d ddlm}n#t $rd}YnwxYw|J ||n3#t $r&}t d||Yd}~nd}~wwxYw ddl m }n#t $rYdSwxYw ||dS#t $r'}t d ||Yd}~dSd}~wwxYw) zHClear per-session control state that must not survive a boundary switch.N_pending_skills_reload_notesrrrr8 z?Failed to clear slash-confirm state for session boundary %s: %s clear_sessionz:Failed to clear approval state for session boundary %s: %s) r}r@rArr r9 rFrerrrrUr)rrpending_skills_reload_notespending_approvalsupdate_prompt_pendingr r_clear_approval_sessions r.rz4GatewayRunner._clear_session_boundary_security_stateIs8  F&- 0$' ' # 14 8 8 ? ' + +K > > >#D*>EE ' . . 5  ! !+t 4 4 4 '.F M M +T 2 2 9 ! % %k4 8 8 8 & A A A A A A A & & &!%    &  ) "((5555    U   O O O O O O O    FF   # #K 0 0 0 0 0    LLL          sT:C CCC,, D6DD D'' D54D59 E E7E22E7c|sdS|jd}| i}||_t||ddz}|||<|S)aeClaim a fresh run generation token for ``session_key``. Every top-level gateway turn gets a monotonically increasing token. If a later command like /stop or /new invalidates that token while the old worker is still unwinding, the late result can be recognized and dropped instead of bleeding into the fresh session. rrNrZ)rrBrr0)rr generationsnext_generations r.r z+GatewayRunner._begin_session_run_generation1Isj 1m''(ABB  K+6D (kook1==>>B#2 K r0cn||}|rtd||||S)z7Invalidate any in-flight run token for ``session_key``.u-Invalidated run generation for %s → %d (%s))r rri)rrrJr s r.r z0GatewayRunner._invalidate_session_run_generationCIsG77 DD   KK?     r0r c|sdS|jdpi}t||dt|kS)zEReturn True when ``generation`` is still current for ``session_key``.Trr)rrBr0)rrr rs r.rI z%GatewayRunner._is_session_run_currentOIsQ 4m''(ABBHb ;??;2233s:FFr0c|r|r|dS t|di|}| t|dt|dSdS#t$rYdSwxYw)zDBind a gateway run generation to the adapter's active-session event.Nr3 r4 )r}rBr7r0rF)rrrr interrupt_events r.rG z*GatewayRunner._bind_adapter_run_generationVIs k Z-? F %g/A2FFJJ;WWO*)A3z??SSSSS+*    DD sAA A A )release_running_staterG rH rcK|sdS|j|}|r|tur|||||||}t t|dd}|rt|r| |} tj |j } d| vp*td| D} n#tt f$rd} YnwxYw| r$|||j| d{Vn!|||jd{V|r%t'|dr|||j|d|r,||||dSdS) zFInterrupt the current run and clear queued session state consistently.Nrinterrupt_session_activityr~c3FK|]}|jtjjuVdSr(kindinspect Parameter VAR_KEYWORDr,params r.r/z=GatewayRunner._interrupt_and_clear_session..~IsC??J'"3"????????r0Frr)rrBrrr r#r}rrrRrr parametersrbrr=r2rrrrrrr0r. ) rrrrG rH rr rrr~paramsaccepts_metadatas r.r z*GatewayRunner._interrupt_and_clear_sessionfIs^  F,00==  6]2III  # #$4 5 5 5 // DW/XXX**622%, MM7& & "  Vx :;; V77??H ) *+EFFQ#-#7$3??!'???<<  z* ) ) )#(    ) V88(988fnUUUUUUUUU  5ww(=>> 5  ' ' 4 4 4 "";555 2  - -k : : :  $ $[ 1 1 1 1 1 2 2s2AC;;DDcK|j|sdSt|dd}t|dd}|r|dS |j|d{V}|r|ddnd}n#t$rYdSwxYw|dS|5||}t |t rt|dkrz|dturkt|dkr|dnd}|||kr ddddS|d|kr,||d|d|f||<n|d|d||f||<ddddS#1swxYwYdS) uRe-baseline a cached agent's stored message_count after THIS turn. The cross-process coherence guard (#45966) compares the session's on-disk ``message_count`` against the count snapshotted next to the cached agent, and rebuilds the agent on a mismatch. But the snapshot is taken at agent-BUILD time — before this turn writes its own user + assistant (+ tool) rows — and the cache entry is never rewritten on a reuse. So without this re-baseline, THIS process's own turn would grow ``message_count`` and the very next turn would see a mismatch and rebuild the agent — every turn, for every conversation — silently destroying the per-conversation prompt caching the cache exists to protect. Call this once a turn has completed and the agent has flushed its rows to the SessionDB. It snapshots the now-current count (which includes this process's own writes) so the guard only fires when a DIFFERENT process changes the transcript out from under us. The ``_sig`` is left untouched; only the count element is refreshed, and only when the same agent is still cached (no rebuild/eviction raced in between). Fail-safe: any DB error leaves the snapshot as-is, which at worst costs one unnecessary rebuild on the next turn. When the cache entry records a ``session_id`` (4-tuple form, #54947) that differs from the current ``session_id`` — meaning the cache was built for a DIFFERENT conversation under the same ``session_key`` — the snapshot is intentionally left untouched. Overwriting it with the current session's count would corrupt the original conversation's baseline and cause the next switch back to fire the cross-process guard spuriously. Fail-safe: the legacy 3-tuple shape (no ``session_id``) is still re-baselined as before. Nrr message_countrrrrZ) rr}rrBrFr@rrr) rrr3rX r _sess_row_livera _snapshot_sids r.rU z0GatewayRunner._refresh_agent_cache_message_countIs"D   #: # Fd$7>> ~t44 fn F ".:::FFFFFFFFI9BLIMM/1555EE    FF  = F   ZZ ,,F 65)) KK!OO1I%<<< .1[[1__q $  ,*1L1L!        "!9%%$,06ay&)U.K{++#1Ivay%/{+1                  s*:A22 B?B A3E 8EEErcn|r|sdSt|dsi|_t||j|<dS)zDStage per-turn must-deliver notes for the next agent run (one-shot).NrD)rrDrq)rrrs r.rF z-GatewayRunner._set_pending_turn_sidecar_notesIsJ %  Ft:;; 2/1D ,8.jJs$??a!'??????r0c 3K|]M\}}|jtt|ddpdtt|ddpdfVNdS)rr|rN)r{rCr})r,rhcs r.r/z6GatewayRunner._ephemeral_change_key..kJs{ Ar GFB//5266Ir228b99r0r9)#r rrNr{rxr r:rm rCrB rrrrTryrrjrrFr+r( chat_topicrQrr}rshared_multi_user_sessionrconnected_platforms home_channelsrr rr r ) rr r srcrN discord_ids discord_toolsrm slack_toolsrr home_display key_tuples r.rz#GatewayRunner._ephemeral_change_key)Js n),=3<%%2  <8+ + + = = = = = =#8#8#:#:CCCMCL&B''C&,"--CM'R((CK%2&&~.3 K  <8> ) ) ; ; ; ; ; ;!4!4!6!6?##CK  < < < < < <224455LL   LLL    !r " "  # $ $  # $ $  # $ $ $" % %  # $ $  !r " " Y--3 4 4 2 3 3    ??7#>??? ? ?  %288::       1 4~~d9oo44W==>>HHJJJsC88 DDc t|dd}t|tr||dt|dd}t|tr||dt|dd}d}|r6|5|j|d}dddn #1swxYwYn)t|dd}|||d}t|t r |r|dn|}| |t urdSdt|diD}t||vrdS tj |j |fd d t|dd   dS#t$r, | |YdS#t$rYYdSwxYwwxYw) uRemove a cached agent for a session (called on /new, /model, etc). Pops the entry AND soft-releases the evicted agent's LLM client pool so the httpx connection (sockets + held buffers) is freed promptly rather than waiting on CPython GC — AIAgent holds reference cycles (callbacks, tool state) that delay refcount collection, so a manual release is required to keep gateway RSS flat across many /new, /model, undo and reset operations (#29298, same leak class as #25315). The release is soft (``release_clients()``): it frees the client pool and per-turn child subagents but PRESERVES the session's terminal sandbox, browser daemon, and tracked bg processes (keyed on task_id), because the session may resume with a freshly-built agent. Call sites that want a hard teardown (true conversation boundaries like /new) already call ``_cleanup_agent_resources`` before evicting; ``release_clients`` is idempotent and safe to run again after that (the client is already None). Cleanup runs on a daemon thread so we never block holding ``_agent_cache_lock`` on slow socket teardown — mirrors the cap-enforcer and idle-sweeper paths. rNrrrrcBh|]}||tu t|Sr(rrr,r s r.rz4GatewayRunner._evict_cached_agent..J8   }*A!A!A qEE!A!A!Ar0rTz agent-evict-rrrQdaemonr)r}r@rArrrrrrrThread_release_evicted_agent_softrCr rF) rr _pin_store _vc_storerevictedr r@ running_idss r.r. z!GatewayRunner._evict_cached_agentxJs6T#;TBB j$ ' ' . NN; - - -D"4d;; i & & - MM+t , , ,1488  8 C C+// TBB C C C C C C C C C C C C C C CT>488F! **[$77(%88QWQ ' =E%<<< F  T#4b99@@BB   e99 # # F   7X;C $4$4SbS$9;;     eggggg    00777777      s=B88B<?B<AF&& G1G  GGGGinterrupt_depthc|dkr6tj|_d|_t|drd|_d|_dS)uReset per-turn state on a cached agent before a new turn starts. Both _last_activity_ts and _last_activity_desc are only reset for fresh external turns (depth 0); they are semantically paired — desc describes the activity *at* ts, so updating one without the other would make get_activity_summary() misleading. For interrupt-recursive turns both are preserved so the inactivity watchdog can accumulate stuck-turn idle time and fire the 30-min timeout (#15654). The depth-0 reset is still needed: a session idle for 29 min would otherwise trip the watchdog before the new turn makes its first API call (#9051). rzstarting new turn (cached)_last_flushed_db_idxN)rD_last_activity_ts_last_activity_descrr_api_call_count)r@rs r._init_cached_agent_for_turnz)GatewayRunner._init_cached_agent_for_turnJsP a  &*ikkE #(DE %u455 /-.* !r0rcX|t|dsdSt|dddS t|dd}|dS||j|}|dS||sdS||rdSt|dd}|t|tr|ndt d|dS#t$r'}t d||Yd}~dSd}~wwxYw)uFire on_session_end extraction before soft-evicting a live agent. Soft eviction (``_release_evicted_agent_soft``) deliberately keeps the session resumable and does NOT fire ``on_session_end`` — that hook is reserved for the true session boundary, tear-down done by ``_session_expiry_watcher`` when the session finally expires. But the watcher tears down whatever agent it finds in ``_agent_cache`` at expiry time. If cache pressure (the LRU cap) soft-evicts a finalizable session's agent BEFORE it expires, the watcher later finds no cached agent and ``on_session_end`` is silently skipped — memory providers never see the transcript (#11205, LRU-cap variant). We hold the live, fully-scoped agent right now, so commit its end-of-session memory extraction here using the agent's own memory manager (correct per-user/chat scoping, no reconstruction). This uses ``commit_memory_session`` — extraction WITHOUT provider teardown — so the eviction stays soft and a resumed turn keeps working. Only fires for sessions the expiry watcher will eventually finalize (finite reset policy). For ``mode == "none"`` sessions the watcher never runs, so there is no missed-boundary to compensate for and we skip the commit (the agent is simply released). Best-effort: any failure is swallowed so eviction still proceeds. Ncommit_memory_session_memory_managerrrzlCommitted on_session_end extraction before soft-evicting finalizable session=%s (cache pressure, pre-expiry)z)Pre-evict memory commit failed for %s: %s) rr}rrrBis_session_finalizablerG rr@rqrrrrF)rr@rr rcrrs r. _commit_memory_before_soft_evictz.GatewayRunner._commit_memory_before_soft_evictJsp4 =/F G G= F 5+T 2 2 : F OT?D99F~  ! ! # # #O'',,E} 0077 ))%00 u&94@@H  ' 'Jx4N4N(XTX Y Y Y LLFGJ      O O O LLDc2 N N N N N N N N N Os/C80C80C8C8AC88 D)D$$D)c\|||||dS)aZCommit end-of-session memory (if warranted), then soft-release. Runs on the daemon eviction thread so the memory-provider call and the client teardown never block the caller's held cache lock. Order matters: commit uses the live agent's memory manager before ``release_clients`` drops the message buffer. N)rr)rr@rs r._commit_then_release_softz'GatewayRunner._commit_then_release_softKs4 --eS999 ((/////r0c|dS t|dr|n||n#t$rYnwxYwt|dr g|_dSdS)uSoft cleanup for cache-evicted agents — preserves session tool state. Called from _enforce_agent_cache_cap and _sweep_idle_cached_agents. Distinct from _cleanup_agent_resources (full teardown) because a cache-evicted session may resume at any time — its terminal sandbox, browser daemon, and tracked bg processes must outlive the Python AIAgent instance so the next agent built for the same task_id inherits them. Nrelease_clientsr)rrrrFr)rr@s r.rz)GatewayRunner._release_evicted_agent_softKs = F u/00 5%%''''--e444    D  5- . . )&(E # # # ) )s:A A Ac t|dd}|dSt|dsdSdt|diD}tdt |t z }g}|dkrt |}|d|D]c}||}t|tr |r|dnd}|t||vrL| ||fd|D]\}} | |dt |t z } | dkr/tdt |t | |D]l\}}td|t ||.RKrr0rrukAgent cache over cap (%d > %d); %d excess slot(s) held by mid-turn agents — will re-check on next insert.z;Agent cache at cap; evicting LRU session=%s (cache_size=%d)Tzagent-cache-evict-rr)r}rrrr_AGENT_CACHE_MAX_SIZErqrrBr@rrrbrrrrirrrr ) rr rexcess evict_plan ordered_keysrrcr@rremaining_over_caps r._enforce_agent_cache_capz&GatewayRunner._enforce_agent_cache_cap8Ks0~t44 > Fv}--  F   T#4b99@@BB   QF &;;<<"$ A:: ..L#GVG, 0 0 3$.ue$<$<PPaD$Ek)A)A!!3,////  " "FC JJsD ! ! ! ! [[+@@  ! ! NNDF 24F    %  JC KKMS[[     98c#2#h88  %'''#  r0c t|dd}t|dd}||dStj}g}dt|diD}|5t|D]\}}t |t r |r|dnd}|)t||vr;t|dd} | O|| z tkrd} t|dd} | .| | j |} n#t$rd} YnwxYw| -| +| | r| | s|||f|D]\}} ||d dddn #1swxYwY|D]n\}}t"d ||t|d|z t'j|j|fd d |dd  ot/|S)uEvict cached agents whose AIAgent has been idle > _AGENT_CACHE_IDLE_TTL_SECS. Safe to call from the session expiry watcher without holding the cache lock — acquires it internally. Returns the number of entries evicted. Resource cleanup is scheduled on daemon threads. Agents currently in _running_agents are SKIPPED for the same reason as _enforce_agent_cache_cap: tearing down an active turn's clients mid-flight would crash the request. rNrrcBh|]}||tu t|Sr(rrs r.rz:GatewayRunner._sweep_idle_cached_agents..Krr0rrrz3Agent cache idle-TTL evict: session=%s (idle=%.0fs)Tzagent-cache-idle-rr)r}rDrrqrr@rr_AGENT_CACHE_IDLE_TTL_SECSrrrBrFrrG rbrrrirrrr r) rr rr@to_evictrrrcr@ last_activityrr rs r.rK z'GatewayRunner._sweep_idle_cached_agentsKs~t441488 >U]1ikk "  T#4b99@@BB   4 &4 &"6<<>>221 21 2 U$.ue$<$<PPaD=e99 ++ '/BD I I  (-'+EEE2%)M$T?DAAF-!-"11333,2O,?,?,D,DM$---(, -&1"."99-HH/ & : := I I/!OOS%L111" & &Q 3%%%% &g4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &4 &j#  JC KKES75*=sCCC     7X3SbS33     egggg8}}s8-BF50D10F51 E=F5?EA(F55F9<F9cLtjdd}|r|dSt }|dpid}|pd}|r|dSdS)zReturn the proxy URL if proxy mode is configured, else None. Checks GATEWAY_PROXY_URL env var first (convenient for Docker), then ``gateway.proxy_url`` in config.yaml. GATEWAY_PROXY_URLr|r%r proxy_urlN)r`rzrDrr?rB)rrrQs r._get_proxy_urlzGatewayRunner._get_proxy_urlKs i+R006688  #::c?? ""$$wwy!!'R,,[99yb!!  #::c?? "tr0r c <K ddlm} m} n#t$r dgdgdcYSwxYw} | sdgdgdSt jdd} dtffd } g}|r| d |d |D]J}| d }| d }|dvr|r| ||d K| d|d ddi}| rd| |d<|r||d<d|dd}d}ttdddd}|ddl m }|}t|j}t!}ddlm}|||d}||jo |jdknt|}||}|r@ ddlm}m}|}|rd} |jt4jkrt9|dr ||jf dLd } t|d!d}!|!r|jnd}"d"}#|jt4jkrd}"d}#|jt4jkr tAt|d#d$pd$nd$}$||j!|j"|"|#|$|jpd%t|d&dpd'}%|||j|%|| || (}n2#tF$r%}&tH%d)|&Yd}&~&nd}&~&wwxYwd}'|r&tMj'|(}'|}|r4 |)|j|*d{Vn#tF$rYnwxYwd}(tUj*}) | dd+,}*| |*-4d{V}+|++| d.||/4d{V },|,j,d0kr|,-d{V}-tH.d1|,j,| |-dd2d3|,j,d4|-dd5gdgdcdddd{Vcdddd{V|r|/|'rS tMj0|'d6-d{VS#tLj1tLj2f$r|'3YSwxYwSd}.|,j4523d{V}/| stH6d7pd8pddgdgto||d"d9ccdddd{Vcdddd{V|r|/|'rS tMj0|'d6-d{VS#tLj1tLj2f$r|'3YSwxYwS|/8d:d;<}0|.|0z }.d=|.vr|.9d=d>\}1}.|1}1|1s4|1:d?r|1d@d}2|2dAkrn twj<|2}3|3 dBg}4|4rP|4d dCi}5|5 d d}|r|(|z }(|r|=|n#tvj>$rYnwxYwd=|.vto|.t~krtdD!6 dddd{Vn#1d{VswxYwYdddd{Vn#1d{VswxYwYn#tLj2$rtF$r}6tHAdE| |6|(szdF|6gdgdcYd}6~6|r|/|'rS tMj0|'d6-d{VS#tLj1tLj2f$r|'3YSwxYwSYd}6~6nd}6~6wwxYw|r|/|'rS tMj0|'d6-d{Vn#tLj1tLj2f$r|'3YnuwxYwnp#|r|/|'rS tMj0|'d6-d{Vw#tLj1tLj2f$r|'3YwwxYwwxYwtUj*|)z }7| s7tH6dGpd8pddgdgto||d"d9StH6dH| |pdddI|7to|(|(pdJd|d dK|(d gd>gto|||duot|(d9S)MaTForward the message to a remote Hermes API server instead of running a local AIAgent. When ``GATEWAY_PROXY_URL`` (or ``gateway.proxy_url`` in config.yaml) is set, the gateway becomes a thin relay: it handles platform I/O (encryption, threading, media) and delegates all agent work to the remote server via ``POST /v1/chat/completions`` with SSE streaming. This lets a Docker container handle Matrix E2EE while the actual agent runs on the host with full access to local files, memory, skills, and a unified session store. r) ClientSession ClientTimeoutuE⚠️ Proxy mode requires aiohttp. Install with: pip install aiohttprirr^r uH⚠️ Proxy URL not configured (GATEWAY_PROXY_URL or gateway.proxy_url)GATEWAY_PROXY_KEYr|r%c<sdSSr!rI r rrsr._run_still_currentz>GatewayRunner._run_agent_via_proxy.._run_still_current"L)%[%t// ^LL Lr0rr_r[r>rarbraz Content-Typezapplication/jsonzBearer AuthorizationzX-Hermes-Session-Idz hermes-agentT)rrstreamNrG streamingStreamingConfigrrCGatewayStreamConsumerStreamConsumerConfigpause_typing_for_chatc0||dSr(r rg_chat_ids r._pause_typing_before_finalizezIGatewayRunner._run_agent_via_proxy.._pause_typing_before_finalizehLs%::8DDDDDr0SUPPORTS_MESSAGE_EDITINGFfresh_final_after_secondsreditr+ edit_intervalbuffer_thresholdcursor buffer_onlyr transportr+)rrrGr~on_before_finalizeinitial_reply_to_idrun_still_currentz+Proxy: could not set up stream consumer: %srr? )r sock_readrz/v1/chat/completions)rheadersrzProxy error (%d) from %s: %sru⚠️ Proxy error (z): r\r#uKDiscarding stale proxy stream for %s — generation %d is no longer currentr7)rirr^r rr3response_previewedr9r4)rrrZzdata: r z[DONE]rdeltazAProxy SSE stream exceeded max buffer size without a line boundaryz Proxy connection error to %s: %su⚠️ Proxy connection error: uKDiscarding stale proxy result for %s — generation %d is no longer currentz>proxy response: url=%s session=%s time=%.1fs response=%d charsr3 z(No response from remote agent)rbr)Baiohttprrrrr`rzrDrrbrBr}rzrrrNr?rrrrrRrN rr r#rxrrrrMATRIXr1rrrFrrrrrr send_typingrDpostrD rrfinishrrrmrnriter_anyrirrr1rrron_deltarG#_GATEWAY_PROXY_SSE_BUFFER_MAX_CHARSr2r)8rrr rrr3rr r_AioClientSessionrr proxy_keyr api_messagesr\r[rrr_stream_consumer_scfgrrr r_plat_streaming_streaming_enabledr rr rgr_adapter_supports_edit_effective_cursor _buffer_only_fresh_final_secs _consumer_cfg_sc_err stream_task full_response_start_timeoutr@resprjrrrrrHobjrrr_elapseds8` `` r._run_agent_via_proxyz"GatewayRunner._run_agent_via_proxyKs.  Q Q Q Q Q Q Q Q Q   "i     ''))  "l  I1266<<>>  MD M M M M M M M M .0  O   n M M N N N H HC776??Dggi((G,,,,##Tg$F$FGGGV@@AAA$23E"F  ='<'<''>,,,,,,,e1133"KK m + 2s . 3! 35,.-.)+25g,,.86;$$7@@@@@@@@@@@@@A A A A A A A A A A A A A b  * ''))) ))!*;DDDDDDDDDDD,g.DE)))&&((((() )] %||GI|FF$#fnn+1<<a+@+@LD&#'::<)@@@@@@@@@@@@@@@@@@@@@@@@@@@A A A A A A A A A A A A A A A A A A A A A A A A A A A F%        LL;Y J J J  &K&K&K "!"   * ''))) ))!*;DDDDDDDDDDD,g.DE)))&&((((() )        * ''))) ))!*;DDDDDDDDDDD,g.DE)))&&((((() )  * ''))) ))!*;DDDDDDDDDDD,g.DE)))&&((((() ) 9;;'!!##  KK]"s#!    #%"%g,,(&+   L  (b#2#.#m:L:L   ,P/PG44$??!'ll$"2$">"V4 CVCV   s$$A>]\>]a0`'_<`a0$_/_32_37a0<`a0`::/a,+a,0c b'&c'/cccc_interrupt_depthrir r r cbKtt|dddds(|||||||||| | | | |  d{VS||}t|5|||||||||| | | | |  d{VcdddS#1swxYwYdS)uProfile-scoping wrapper around the agent run. When multiplexing is active, resolve the inbound source's profile and run the whole turn inside ``_profile_runtime_scope`` so config/skills/ memory resolve to that profile's home AND credentials resolve from that profile's secret scope (never the process-global ``os.environ``). When multiplexing is off this is a transparent pass-through — zero behavior change for single-profile gateways. rGNrpF)rr r=rrir r r )r}_run_agent_innerr rm)rrr rrr3rr r=rrir r r rcs r.rH zGatewayRunner._run_agent!Msc2wtXt446JERR ..&*'!1DT-*%9'= / < FK . .@PRV0W0W   tsA B2CCc ,ddlm}m}m}ddlm}d} |jpd}|r|}|s||}|r|}|s |pd}||}|rQ||sFt d||j j |j t|dd|S|S#t$rMt d |j j |j t|dd|pd d |cYSwxYw) uResolve which profile's HERMES_HOME should serve this inbound source. Resolution order: 1. ``source.profile`` — set by /p// URL prefix, per-credential adapter ownership, OR profile_routes matching at ``build_source`` time. 2. ``_profile_name_for_source`` — re-run routing here as a defensive fallback for sources that bypass ``build_source``. 3. The active profile (the multiplexer's own home). r)rr profile_exists)r#Nr|rz\Profile %r does not exist for source %s/%s (guild_id=%s), falling back to global HERMES_HOMErB zjFailed to resolve profile directory for source %s/%s (guild_id=%s), falling back to global HERMES_HOME: %sz (no profile)Tr)rrr rHrjr#rwrDrFrrrNr{rr}rF) rrrr rHr#explicit_profiler profile_dirs r.r z.GatewayRunner._resolve_profile_home_for_sourceMs          544444 # %N(b//11D (#'  ,44V<<,'+$ >..00=I)/$//K )t(<(< )9$O)NFJ55 '(((  % % % NN9% D11 2N    #?$$ $ $ $ %sB%B<:B<t&d?ttddffd@ d5t6dAtddffdB !j)jj8krj4r r|' dCnX|'rT|'j4kr5 n46jj)|'tEd9d :ndd5t6dDt6ddffdE    f*dF}*d}+rtWj;|)}+d},rtWj;|(},d}-fdG}.tWj;|.}-fdH}/tWj;|/}0tWj<fdI}1tWj;|1}2t{dJdK}3|3dkr|3nd|dLddMd+krdt}j>fdN}4tWj;|4}5ddOdPt6dQt dt fdR}6 t{dSdT}7|7dkr|7nd}8t{dUdV}9|9dkr|9nd}:d};tWj?@|*d} tWjAh|=Xd{V\}?}@|?rB}>nWCs@r=!}Ad}B|Ar|BrtO|AdYr |ADr|AjE }C|Cr|CjFnd}D|CrtE|CdZdpg}EG|Cr7H|C|A|Dpd[d\j4r d]j4ind^d{V\}D}@n|Ds|Ert|C}DtKd_|2Lrd`nda|BM|Dnd}> tWjAh|=Xd{V\}?}@|?rB}>ned}Fdb}G|FrLtO|Fdcr< |FN}H|H dddb}Gn#t($rYnwxYw|;s|:|G|:krd};!}I|Irt'|:dezpdf}Jt'|8|:z dezpdf}K |IOj)dg|Jdh|Kdijd{Vn2#t($r%}LtPdk|LYd}L~Lnd}L~LwwxYw|G|8krd}<nWCs@r=!}Ad}B|Ar|BrtO|AdYr |ADr|AjE }C|Cr|CjFnd}D|CrtE|CdZdpg}EG|Cr7H|C|A|Dpd[d\j4r d]j4ind^d{V\}D}@n|Ds|Ert|C}DtKd_|2Lrd`nda|BM|D|<rd}Mi}N|Mr6tO|Mdcr& |MN}Nn#t($rYnwxYw|N dldm}O|N ddd}P|N dn}Q|N dod}R|N dpd}StQdq|P|8|O|R|S|Qpdr|Mr*tO|Mdsr|MMtt'|8dezpdf}Tdt|Tdug}U|Qr$|USdv|Qdw|Pdxdy|Rdz|Sd{ n#|USd||Od}|Pdxd~|Rdz|Sd |USddT|Udrd dgng|Rdpgddd}>d}Vd}W|Wr|W dnd}X|VtO|Vdr|Xst}Y ddlVmW}ZmX}[tE|Vdd[pd[}\|\r|\|Zvr |[|Y|\}Yn#t($rYnwxYw|VjY|Ykr0Z|VjYs[d}]!}^d}_d}`|]rN|^rKrHt|^}_]|^|_}_|] dr]|_s[|] drF|] d}at|artKdpd|an|a}`n|_r|_jFpd[}btE|_dZdpg}cG|_rFH|_|^|bdj4r d]j4ind^d{V\}`}@|`st|_}`n|bpt|_}`|`r#tPd|`dd|]r@|`s>|_s<|] d}d|dr%|d}`tPd|`dd|`r|`_`dzr|`_addf}e|er"|eddfdbnd[}f|frB ddlcmd}g|g|frtKd|fd}_d}`n#t($rYnwxYwjer8|_s|`r4tKdpdfd}_d}`|_s|` rtPd|`dd|^r:tO|^dr*r(|^jgvr|^jghjikrtjd!}^|^r|_rt|^jE|_n(|^r&tO|^dr|^l|`dp|>d |+r|+m|,r|,m|2m|5m|-ro ddu}h|hs3|-m |-d{Vn#tVjn$rYnvwxYw tWjo|-dWXd{VnT#tVjptVjnf$r6|-m |-d{Vn#tVjn$rYnwxYwYnwxYw|0mrqjerrd|+|,|2|0|5fD]#}i|ir |id{V#tVjn$rYwxYw$S|] d}j|jsډd}k|kr|-r tWjo|-dWXd{Vn#tVjptVjnf$r6|-m |-d{Vn#tVjn$rYnwxYwYn1t($r%}ltPd|lYd}l~lnd}l~lwwxYwt|>tr|>n|]pi}mt |m d}n|m dd[}o|6|k|o|nO}p ddlsmt}q|q|m|o}rn#t($rd}rYnwxYw|rrtKdpdn|orv|pst tKdpd|^Oj)|ojd{VnQ#t($r%}ltjd|lYd}l~ln'd}l~lwwxYw|ortKdpdtEt[|^dd_|^u}st|sr8 |s}ttjx|tr|td{Vn#t($rYnywxYwnt|^rrtO|^drb|^jyzd}st|sr8 |s}ttjx|tr|td{Vn#t($rYnwxYw|] d}u}v|`}wd}xd}y}z|_tE|_ddp}v{|_r|stKdpd|]|+r|+m|,r|,m|2m|5m|-ro ddu}h|hs3|-m |-d{Vn#tVjn$rYnvwxYw tWjo|-dWXd{VnT#tVjptVjnf$r6|-m |-d{Vn#tVjn$rYnwxYwYnwxYw|0mrqjerrd|+|,|2|0|5fD]#}i|ir |id{V#tVjn$rYwxYw$S }|v}zn/#t($r"tPdpddYnwxYw~|_|v|u|zd{V}w|w|]|+r|+m|,r|,m|2m|5m|-ro ddu}h|hs3|-m |-d{Vn#tVjn$rYnvwxYw tWjo|-dWXd{VnT#tVjptVjnf$r6|-m |-d{Vn#tVjn$rYnwxYwYnwxYw|0mrqjerrd|+|,|2|0|5fD]#}i|ir |id{V#tVjn$rYwxYw$S|_}xtE|_dd}y!}{|{r4 |{j)jd{Vn#t($rYnwxYwd{V|w|u|v|zdfz|x|y d{V}|t|]|||+r|+m|,r|,m|2m|5m|-ro ddu}h|hs3|-m |-d{Vn#tVjn$rYnvwxYw tWjo|-dWXd{VnT#tVjptVjnf$r6|-m |-d{Vn#tVjn$rYnwxYwYnwxYw|0mrqjerrd|+|,|2|0|5fD]#}i|ir |id{V#tVjn$rYwxYw$S |+r|+m|,r|,m|2m|5m|-ro ddu}h|hs3|-m |-d{Vn#tVjn$rYnvwxYw tWjo|-dWXd{VnT#tVjptVjnf$r6|-m |-d{Vn#tVjn$rYnwxYwYnwxYw|0mrqjerrd|+|,|2|0|5fD]#}i|ir |id{V#tVjn$rYwxYw$n#|+r|+m|,r|,m|2m|5m|-ro ddu}h|hs3|-m |-d{Vn#tVjn$rYnvwxYw tWjo|-dWXd{VnT#tVjptVjnf$r6|-m |-d{Vn#tVjn$rYnwxYwYnwxYw|0mrqjerrd|+|,|2|0|5fD]#}i|ir |id{V#tVjn$rYwxYw$wxYwd}kt|>trn|> dsX|> dpd[}}|} p|}dk}~t |> d}nt |kotE|kdd}t |> d}|6|k|}|nO}|~s,|s*|s|r&tKdpd||n|d|>d<n|~s|r|k|kj}|r |kjj)||>ddd{Vd|>d<tKd|pdn5#t($r(}tjdpd|Yd}~nd}~wwxYwr|$rrt|>tr|> dstO|$drtuj)|$tWj,dfd } |$|n2#t($r%}tPd|Yd}~nd}~wwxYw|>S)a Run the agent with the given message and context. Returns the full result dict from run_conversation, including: - "final_response": str (the text to send back) - "messages": list (full conversation including tool calls) - "api_calls": int - "completed": bool This is run in a thread pool to not block the event loop. Supports interruption via new messages. )rr rrr3rr rNrr r%c<sdSSr!rrsr.rz:GatewayRunner._run_agent_inner.._run_still_currentMrr0r r@r r r)set_tool_preview_max_lentool_preview_length)set_friendly_tool_labelsfriendly_tool_labelsT tool_progressHERMES_TOOL_PROGRESS_MODEr tool_progress_overridesrBtool_progress_grouping accumulate)choose_status_phraseresolve_status_phrase_catalogF)rr allow_genericr rrrXcB|r7t j}d|D}||vrt |sdS ||}t|tr0|dkr|rdndSt|rdndS)z8Return off|raw|generic for a gateway visibility surface.c,h|]}t|Srr)r,items r.rzPGatewayRunner._run_agent_inner.._display_surface_mode..0Ns0!!!,D11!!!r0rCgenericr>)rPrNrr@rCrDrEr) r rrrXrrr{rrrr s r._display_surface_modez=GatewayRunner._run_agent_inner.._display_surface_mode&Ns- !#:6?#K#K !! =!!! % 55:; V]^^6!5++KwPWXXE%%% =%++--*=*=*?*?9*L*L$1rD waiting heartbeat long_runningz still on itzone sec)rFrrr)rrr rQ _phrase_err_generic_status_catalog_generic_status_recentrVs r._generic_status_phrasez>GatewayRunner._run_agent_inner.._generic_status_phrase>Ns r++'#13  r r r I;WWW(,0b(b(b}}hqqqqqqq rs A "AA A rh>logrC live_statusfullsupports_status_textrCrginterim_assistant_messages)rrthinking_progressrR voice_mixer_activec~dsddSsdSdd< jj}|t|dsdS t |d t ddS#t$r&}t d|Yd}~dSd}~wwxYw)z?tool_start_callback: speak a one-time ack in the voice channel.rNTplay_ack_in_voicezvoice ack scheduling errorrzvoice ack schedule failed: %s) rrBr rrrorrFrr) rrrQrg_ack_errrxr_voice_ack_fired_voice_ack_guild_voice_ack_looprs r.voice_ack_callbackz:GatewayRunner._run_agent_inner..voice_ack_callbackNs" &6q&9&A%%'' "& Q }(()9::Hwx9L'M'M H(../?/BCC#! <   H H H rxclarifyis_interruptedrI )get_tool_emojiu⚙️supports_code_blocksr|r)get_tool_preview_max_lenrNrrr(rZrrz ...r^ ) ensure_asciir(z) z: ")r get_tool_verbtool_verb_connectorverb_drops_preview __dedup__)' agent.displayryset_status_textrrFrrrrr@strftimerHrrBr\rzrNrOr{r?r(rrr}rr#r@rArCrDrrrrrQrqrrrr)8rrr rQkwargsry_phrase_ls_errrg preview_strrq rzrNrOr{rgate_on _hint_err thinking_textr\_agent_for_interruptremoji_code_block_full_code_block_short_progress_adapterr _cmd_full _block_header_pl_cap_lines _cmd_short _multilineargs_strrrrrd_LONG_TOOL_THRESHOLD_S_live_status_adapter_live_status_moder_thinking_enabled agent_holderlast_progress_msg last_toollast_was_terminal_block log_queuelong_tool_hint_fired progress_modeprogress_queue repeat_countrrtool_progress_enableds8 r.progress_callbackz9GatewayRunner._run_agent_inner..progress_callbackNsd %0%..,, K!^33 3FXFXFZFZ3EEEEEE"5"5%$5$?$?DDT##-<T>T 455"1#D)5LMM$)####X7749K+L+LX6:03*../I/I/K/KLLL%Il]&BDVWWW XXXLL!KYWWWWWWWWX[((I,D,D(F+4 +C+C 1>H-m---D,"&&s+++) !222I%% :F'P|AD$'3(*:E993F    %%)y|*C*C$IaL 5 4 4 4 4 4"N9h???E $  $  )$($<$JJ5!+f!4J'4$L$L:$L$L$L! ))#/15+A."&&'7888F-2'* 4FFFFFF2244C#z$UCPPPHQww3x==3#6#6#+HS1WH#5#="QQYQQdiikk1B1BQQxQQCC4"??Y??G???CC"33Y333C""3'''!,'-1'** 3 /.00!Aggss2w<<$&&%itaxi058G & i00@)))44Z!&0000!&YYY0C0CI0N0NYPWYY"??Y??G???C-2'**/////-2'* '***Q1$""Kl1o#FGGG#& a LO   s # # # # #sUA)A;; B*B%%B*=B!G H)H  H"J JJK K*)K*rrr+rxrRcTKdSddlm}ddlm}tdz }|dd||dz d d d }||d tjdt}| tj d|_ | | |dnq#j$rt#jdd{VYnKt&$r?}t(d|t#jdd{VYd}~nd}~wwxYw#t"j$rYnwxYw |dn#j$rYnt&$rYnwxYwF|| ||dS#t&$rYdSwxYw# |dn#j$rYnt&$rYnwxYwF|| ||w#t&$rYwwxYwxYw)uHDrain log_queue and append tool-call lines to tool_calls.log. Only active when ``display.tool_progress`` is ``log``. Uses a RotatingFileHandler (5MB × 3 backups) so the audit log can't grow unbounded, and the shared RedactingFormatter so secrets never land on disk. Nr)RotatingFileHandlerRedactingFormatterlogsTrKztool_calls.logiPrr9)maxBytes backupCountr;z %(message)szhermes.tool_calls.Fro333333?zwrite_tool_log error: %srZ)logging.handlersrrrrrO setFormatterrrrsetLevelINFO propagate addHandlerrirGEmptyrrprFrrrm removeHandlerflushr)rrlog_dir file_handler tool_loggerrrr}s r.write_tool_logz6GatewayRunner._run_agent_inner..write_tool_logOs  < < < < < < 7 7 7 7 7 7"V+G MM$M 6 6 6..**( L  % %&8&8&G&G H H H!+,PI,P,PQQK   . . .$)K !  " "< 0 0 0 //#((y/C/C/E/EFFFF ;111%mC00000000000$/// %?CCC%mA............../ /)    #((y/C/C/E/EFFFF ;$ )),777 &&((( &&((((( DD#((y/C/C/E/EFFFF ;$ )),777 &&((( &&(((( DsE"(C0/E"0$EE" E5EE"EE""E41H3E44H:(F## F;/ F;:F;(G?? H  H J'(H<;J'< IJ' IJ'IJ'.(JJ' J$!J'#J$$J'c  K'sdS*+sdStjtjurP's: 'n#t $rYnwxYw':dSgd&dkd}d}ttrjnt ttddpd}n#t $rd}YnwxYwtd||dkrdnd z d !rh tjjj}d |vp*t!d |Dn#t$t&f$rd YnwxYwd t(dt(f!+fd dt*dt(fddt*dt*t*ffd d- fd dt(f!"+fd dt,ffd } #sP's: 'n#t $rYnwxYw':dS'} $r$d nd}|,t|dd rt/jd d{Vn#t $rYnwxYwt|t2rBt|dkr/|d dkr#|\}}} r|d| dzdd<rdn|} n[t|t2r/t|dkr|d dkrdgd%d <d )d <W|} | |d{Vr[t7j}t/jd d{V#r"+j!!d{Vt7j} || |z z } | d krt/j| d{V#sdSr85d"} | d{V}|j st|d#d$pd$!}t|d%d r"tD#d&j$d'|vsd(|vr4tD%d)j$t7j}nd &+j| "!*d{V} rIt|d+d r8t|d dr't)|j'nr:d"} &+j| "!*d{V}n$&+j| "!*d{V}|j r7|j'r0|j' r't)|j't7j}t/jd d{V#r"+j!!d{Vn'#(j($rt/jd d{VYnt.j)$r'sC '}t|t2rFt|dkr3|d dkr'|\}}} r|d| dzdd<|d{Vnt|t2rst|dkr`|d dkrT|d{Vr3r1r/} |d{Vn#t $rYnwxYwdgd%d <d )d <n%||d{Vn#t $rYnwxYw'Crrr|d{Vr3r1r/} | d{Vn#t $rYnwxYwYdSt $r?}tD*d,|t/jdd{VYd}~nd}~wwxYw~).Nseparaterg?MAX_MESSAGE_LENGTHr rZr @rFr~c3FK|]}|jtjjuVdSr(rrs r.r/zQGatewayRunner._run_agent_inner..send_progress_messages..YPsC %"J'*;*GGr0rTrc~Kj||d}tddrd|d<r|d<jdi|d{VS)N)rrTrREQUIRES_EDIT_FINALIZEFTfinalizer~r)rr} edit_message)rTrr_edit_accepts_metadata_progress_metadatarrs r._edit_progress_messagez^GatewayRunner._run_agent_inner..send_progress_messages.._edit_progress_messageaPs|%~",& 7$.send_progress_messages.._progress_text..nPs( = =tT = = = = = =r0)r2)r s r._progress_textzVGatewayRunner._run_agent_inner..send_progress_messages.._progress_textmPs#yy = =u = = ====r0cg}g}|D]=}||gz}|r1|kr|||g};|}>|r|||S)z>Partition progress lines into platform-sized editable bubbles.)rb)r groupsrFrr_PROGRESS_TEXT_LIMIT_progress_len_fnrs r._split_progress_groupsz^GatewayRunner._run_agent_inner..send_progress_messages.._split_progress_groupspPs%' "!,,D '4& 0I,#3#3NN94M4M#N#NQe#e#e g...#'&"++MM'*** r0crKt|ddr.send_progress_messages.._track_progress_resultPs%D 599D  d;;D %++C0A,B,BCCCCC DDDDDDr0rcjKj|d{V}||S)Nr,)rr)rr.r_progress_reply_torrrs r._send_progress_textz[GatewayRunner._run_agent_inner..send_progress_messages.._send_progress_textPsc&||"N // ,   '&v... r0cK r sdS }t|dkrdS|d} Q |d{V}|js7t|ddr"tdjdSd dSn&|d{V}|jr|jr|j |ddD]1}|d{V}|jr|jr|j 2|d dS) aStart fresh editable progress bubbles before a bubble exceeds limit. Returns True when it delivered/split the current buffer, or when a transient edit failure left the buffer and message identity intact for a later retry. In either case the caller should skip the normal send/edit path for this tick. FrZrN retryableu>[%s] Transient overflow edit failure — keeping can_edit=TrueTr)rrr}rrrrrT) r first_textr.rrrrrrcan_editprogress_linesprogress_msg_ids r.!_roll_progress_overflow_if_neededziGatewayRunner._run_agent_inner..send_progress_messages.._roll_progress_overflow_if_neededPs&!X! 5//??v;;!## 5+^F1I66 ".#9#9/:#V#VVVVVVVF!> %"6;>>("LL ` ' $(4#($u %$7#6z#B#BBBBBBBF~<&*;<*0*;#ABBZ<rrbase_msgrr\_now _remaining full_textr.r _flood_result _pending_textrrrrrrrrrrrrrrrrrrrrprogress_groupingrr}rrrs, @@@@@@@@@@@@r.send_progress_messagesz>GatewayRunner._run_agent_inner..send_progress_messages(Ps ! ..v66G  G}})-@-MMM(..00&113333$)..00 N"O(J6HM&) #g':;;&&   +&)'';OQU*V*V*^Z^&_&_## + + +&*### +$'#-@3-F-FrrAN$$ &+ "! 3 3#*#4W5I#J#J#UL"l2)5)<)<)>)>+*":.333-2***3 < d >s > > > > d tDz         D D D D D D D           * T* * * * * * * * * * * * * X| +{+--//"0"6"6"8"8&& . 9 9 ; ; ; ;#,&&& %&#1"6"6"8"8& (3355C BN/X|ATX,/;02BEAA;#*-"2"22222222$$"#u--3#c((a--CFkDYDY-0*8U)O4<1N1N%!)1N1N1NN2.4BPnR00#C//3CHHMMc!fP[F[F[+/)+/3)!,*+ Q !&--c222>>@@@@@@@@!(,(8(8 %mC000000000--//c")"5"5fnOa"5"b"bbbbbbbb  >++D!8D=Pf.?P.4.?O0P 0 7 7F$B$B !"8"8)"T"TTTTTTTTT(!!! D!FF +++LL!=qAAA!-**************+u| +s8"A77 BB C00 C?>C?"A E00FFY H54Y5 I?YIYY09J+*Y+ J85Y7J88BYBY;Y Y!B Y.F%Y$a9<$a9!C^>&]98^>9 ^^>^7^>=a9> _ a9 _  ?a9 `a9 `+(a9*`++a91 a9:5a44a9r~ prev_toolsc sdSg}|pgD]d}t|tr+||dpdB|t |et djr jjndj |||dtddS)Nrr|z agent:step)rNrr3r~ tool_namesr z agent:step hook scheduling errorr) r@rArbrBrCrrrNr{rr) r~r_names_t _hooks_ref_loop_for_steprr3rs r._step_callback_syncz;GatewayRunner._run_agent_inner.._step_callback_syncQs%%'' !#F!'R + +b$''+MM"&&.."6B7777MM#b''**** $ 9? P 5 5b%~",!*"(' //>      r0rc tj||dS#t$r&}td|Yd}~dSd}~wwxYw)Nzevent_callback hook error: %s)rrun_coroutine_threadsaferrFrrr)rrrrrs r._event_callback_syncz._event_callback_syncQs B0OOJ88" B B B ._status_callback_sync.._track_status_idQs!jjll$!#|T::CsIu55:#:(//C99999::::s  &&r) rrNrrrr{rrCrrro) rrprepared_message_futrrrrr_status_adapter_status_chat_id_status_thread_metadatars r._status_callback_syncz=GatewayRunner._run_agent_inner.._status_callback_syncQs;" *<*<*>*> >     ' >-3_KFO)))7GMr8J8JKKDSDQ  ++O_jZjmDEEN NNN D | 9::::::&&'788888 9 9r0c 0*qrstuvwxyzj|jkrdn jj}pd}pd}|r|dz|z}jjpdt ddt dd}|r|dz|z}t} \}}t d|| d pdn!#t$r}d |gd gd cYd}~Sd}~wwxYwj }| } | __dvd} t t dddd} | d dlm} | } |d} | | jo | jdknt-| }|}}|}|s|r^ d dlm}m}}|r d}j|jkrt9|dr |jf dd}t |dd}|st;d| j}d}j|jkrd}d}j|jkr tAt | ddpdnd}|| j!| j"|||| jpdt ddpd}||j|fd nd|!v|rd"tFddfvfd# } vd <n2#t$r%}t d$|Yd}~nd}~wwxYwdd%d"tFd&t,ddfvfd'}$||}%|d(|d)|&t d*dt d+d,}dyd}t d-d} t d.d}!d}"| rN|!L| 5|! }#dddn #1swxYwY|#rtO|#d/kr|#d/}"d}$|"64|"kr. j()|"}$n#t$rd}$YnwxYwd}%j*KrI j*j+,}&|&r|& d0d }%n#t$rYnwxYwd}'| r|!| 5|! }(|(r|(d1|krtO|(d2kr|(d2nd})tO|(d/kr|(d/nd}*|*duo duo|*k}+|+o|$o|*|"k},|,rft-d3|*j./d}-ta|-tbr |-r|-d nd}.|.r |.tdur|.}'n|+sq|)o|%m|%|)krgt-d4|)|%j./d}-ta|-tbr |-r|-d nd}.|.r |.tdur|.}'ny|(d yt9|!d5r' |!3n#th$rYnwxYw5y|y_6t d6d}dddn #1swxYwY|r*y(7y8|' tsj:j;|'fdd7tGdd89<n7#t$r* ;|'n#t$rYnwxYwYnwxYwy{dd(|d(i|d)t{id:|d;ddd?|pdd@j>pddA| dBjdC| dCdD| dEdF| dGdH| dIdJ| dKdL| dMddN| dOdPdQ|d*j?d+j@dRjAdSjdTjBdjCdjDdUdVt j*dWj*dX8y| r9|!7| 5y||%f|!<Edddn #1swxYwYt dY|ssndy_Fd ndy_G~jHrndy_I| y_J|r|ndy_Ky_LdfdZ }/|/y_Mdy_N}y_O| y_Pjy_Q| dCpiy_RdSTy_UtsjVtgrtsjWsd[tFddffd\ udrstufd] }0d[tFddfrstufd^ }1|1y_XrQrOt td_dZ|0`nt dad}2|2|0|2< dbi dc}3ta|3t,r|3rddnd}3|3r!tG|3[nddy_\detFdtFffdf }4|4y_]y_^yd <t9ydgryj_ndd <ttth\}5}6|rt ydPdkr|t|5t ydid}7|7|5urYtddjtO|5tO|7t|7tjfk}5t|5}8d dllhmi}9mj}:mk};ml}<dmtddfqfdn }=}>}?t doi}@r|@/dnd}A|Ar|Adzzt}Btt|Bp}Cd}Dr3 j(jq }Dn#t$rd}DYnwxYwd}E|D1t |Ddqdr tt |Ddrd|Bp}Et-|Dduot |Ddqdo|Cp|E}Ft-|5o |5ds dtduko|C}G|Fr[t |Ddvdpdw}H}>}It-t |Idxd}Jt|H|Jyn |Gr}>dzzt d{d}@|@r&r$|@vr |@/d}K|Kr|KdzztatFr}si|Dgt |DdqdrVt |Ddvdpdw}L}Mt|Ldt-t |Mdxdypdq|;q}N|9q|= s}O|Or d d|ltmu}P|P|O\}Q}R|Rr)tdd}tO|R|Rtd~|QDr|Q}Sn}Sn6#t$r'}Ttdd|T}SYd}T~Tn d}T~TwwxYw}St|S|6}U|5d}V|>|>|Vd<n|6r|Vd<|Vd<|?|?|Vd<yjx|Ufi|V}W|#||b|c_}j(~j(|bd}d|drt dQd|jkrt dddkrt ddj* j*j+|b}f|frQ|f dr.run_sync.._pause_typing_before_finalizeNRs!) > >x H H H H Hr0rTz(skip streaming for non-editable platformFrrrr+rc.dS)N)r)rH)rsr.rzBGatewayRunner._run_agent_inner..run_sync..{Rs););N)K)Kr0)rrrGr~on_new_messagerrrrcJr|dSdSr()r&)rrr+s r._stream_delta_cbzJGatewayRunner._run_agent_inner..run_sync.._stream_delta_cbRs;#5#5#7#7!D$4$=$=d$C$C$C$C$C!D!Dr0z$Could not set up stream consumer: %s)already_streamedrc2sdS|}.|rn|dS|s%r#t|pdsdSt |t ddS)Nr|rz+interim_assistant_callback scheduling errorr)on_segment_break on_commentaryrCrDrrr) rr display_textrrrr r r+s r._interim_assistant_cbzOGatewayRunner._run_agent_inner..run_sync.._interim_assistant_cbRs))++F# #/'E(99;;;;(66|DDDF#?#lFXVXBYBYB_B_BaBaF(#(('$!8) #! M      r0rrXrr )rnrr rrrrrZruAgent cache invalidated for session %s: cached agent's session_id %s is ended in state.db (stale self-heal artifact, #54878 x #54947) — discarding instead of reusing across the routing recoveryzfAgent cache invalidated for session %s: message_count changed (%s -> %s), possible cross-process writer z#Reusing cached agent for session %szagent-xproc-evict-rrrHr r r r ephemeral_system_promptprefill_messagesrrrr r r r r r r r r r r r r3rNrQrr( gateway_session_keyrrr z)Created new agent for session %s (sig=%s)cr sdS t|}n-#t$r tddYdSwxYw|sdSt |tddS)Nzrender_notice_line failedTrz)notice_callback delivery scheduling errorr)rrFrrrrr )rrrrrrrs r._notice_callback_synczOGatewayRunner._run_agent_inner..run_sync.._notice_callback_syncSs&.@.@.B.BF-f55DD LL!.run_sync.._deliver_bg_review_messageSs&.@.@.B.BF(#(('!=>U`f`o!p!p!p) #! M      r0c5t}dddn #1swxYwY|D] }|dSr()rcrqre)r" queued_bg_review_pending_bg_review_pending_lock_bg_review_releasers r._release_bg_review_messageszUGatewayRunner._run_agent_inner..run_sync.._release_bg_review_messagesTs"&&(((,//"#566G&,,...///////////////&77F..v666677s$AA A cr sdSsR5s#| ddddS dddn #1swxYwY|dSr()r rb)rr!r"r#rrrs r._bg_review_sendzIGatewayRunner._run_agent_inner..run_sync.._bg_review_send Ts&.@.@.B.BF)0022#0##188::#.55g>>>"########################+*733333s+A++A/2A/r2 r r r memory_notificationsr<questionc $ddlm}ddl}sdS|jdd}||pd||rt |nd n#t$rYnwxYw rdnd}t|dd}t|r |dn,#t$rt d d YnwxYwd }t||rt |nd|pd  td}|d }nj |d} t!t| dd }n4#t$r'} td| d }Yd} ~ nd} ~ wwxYw|s|pddS|} ||t+| } | | dkrdt-| dz dS| S)Nrr5 r|rc )r rr(rflush_pending_syncg@rz2Stream-consumer flush before clarify prompt failedTrF)rr(rr rr~zClarify send failed to schedulerr rzClarify send failed: %sz'[clarify prompt could not be delivered]z[user did not respond within rzm])r r6 r r r rqrqr rFr}rrrrr send_clarifyr.rrrget_clarify_timeoutwait_for_responser1r0)r(rr r r _scrsend_okrr.rrrRrrr r rstream_consumer_holders r._clarify_callback_synczPGatewayRunner._run_agent_inner..run_sync.._clarify_callback_sync7TsAAAAAA$$$$&2"[[]].ss3 %%) + 1r%-4>DMMM$ &#99/JJJJ D 7MW033SWC$S*>EEF'',s++++ LLL!%!  .#00 /!)18 BW d#-$/$52!8 1#! A   ;#GG(!$B!7!7"&wvy%'H'H"I"I$((('@#FFF"'(E!..{/@bAAADD&::<<'99*eT[nn9]]#x2~~P3w|;L;LPPPPs<A44 BB8B>>&C'&C'64E++ F5FFr rrzPersisted transcript lagged live cached history for session %s (disk=%d, memory=%d); preserving live conversation context (possible FTS write corruption)r)register_gateway_notifyreset_current_session_keyset_current_session_keyunregister_gateway_notify approval_datac |dd}|dd}t|}tt dd t  | | |dd|d d|d d   td }|td| d}|j rdSt d|j n2#t$r%}t d|Yd}~nd}~wwxYwt dd}t||||dd|d d|d d } t  |  td}|| ddSdS#t$r&}t d|Yd}~dSd}~wwxYw)aYSend the approval request to the user from the agent thread. If the adapter supports interactive button-based approvals (e.g. Discord's ``send_exec_approval``), use that for a richer UX. Otherwise fall back to a plain text message with ``/approve`` instructions. rr|rzdangerous commandsend_exec_approvalNrTrrF)rrrrr~rrrz#send_exec_approval scheduling errorrz$send_exec_approval: loop unavailabler rzLButton-based approval failed (send returned error), falling back to text: %sz6Button-based approval failed, falling back to text: %srr%rrz#Approval text-send scheduling errorz#Failed to send approval request: %s)r rBrr}rrr8rrWr.rrrrFrr)r6rdesc _approval_fut_approval_resultrrmr\_approval_send_fut_approval_session_keyrrr r s r._approval_notify_synczOGatewayRunner._run_agent_inner..run_sync.._approval_notify_syncTs 55oFFF#'' 266$((8KLL/s33 4002FMMY(@+>>(7(+,A,0)@0=0A0ABSUY0Z0Z.;.?.?QU.V.V-:->->~u-U-U?  +#)(M))) )0"./U"V"VV+8+?+?+?+K+K(+3#"Fj,2%TVX_.DcJJ4$1$5$56G$N$N"/"3"3OT"J"J!.!2!2>5!I!I L)A',,+%<- '%$I * * *&*5*11"1=====65 LLLLL!FKKKKKKKKKLs81BD1 D11 E ;EE AH IH;;IrA)rArSrWrr[rrTrLinteractive_resumerHz[System note: A new message has arrived. The conversation history contains pending tool outputs from an interrupted turn. IGNORE those pending results. Address the user's NEW message below FIRST. Do NOT re-execute old tool calls from the history.] r)build_native_content_partsz:Native image attachment: skipped %d unreadable path(s): %sc3HK|]}|ddkVdS)rr Nrrs r.r/zCGatewayRunner._run_agent_inner..run_sync..Us1LLquuV}} ;LLLLLLr0z8Native image attachment failed, falling back to text: %s)conversation_historyr r r r rrir r" session_prompt_tokenssession_completion_tokensrr r u/Session split detected: %s → %s (compression)uSSkipping session split sync for stale run %s — generation %s is no longer currentr7znSkipping session split sync for %s because the session binding moved from %s to %s before compression finishedr,ruGRestored source.thread_id=%s from binding after session split %s → %sztd||dS)Nz@Gateway auto-title failure suppressed (not user-visible): %s: %s)rrr)rrs r._title_failure_cbzKGatewayRunner._run_agent_inner..run_sync.._title_failure_cbVs* ^ #r0rryrP)rrrryrPcXtddkotddkS)NrrrN) _title_model_title_providerr@sr.rzBGatewayRunner._run_agent_inner..run_sync..Vs6#E7D99\IT 'z4 @ @O Sr0)failure_callback main_runtimeruntime_validatorc2|Sr()r-r% effective_session_idrrs r.rzBGatewayRunner._run_agent_inner..run_sync..Vs#RVR|R|"0!SSr0title_callbackc2|Sr()rrSs r.rzBGatewayRunner._run_agent_inner..run_sync..Vs#RVRR"0!SSr0r rHrresponse_transformedr+ )rr r3rrWr+ rr)rNrr{rDrrr}rWrrrrrBrFrrrrrrzrrrrrN rr r#rrrWrr!r1rrrCrrvrlrr_is_session_ended_in_dbrrrrirrr@rrr r* rrHrrrrrr r rrr rQr( r+rrtool_progress_callbacktool_start_callbackr step_callbackstream_delta_callbackinterim_assistant_callbackstatus_callbacknotice_callbacknotice_clear_callbackevent_callbackrrrr2r_gateway_turn_context_notesrrbackground_review_callbackrr2 rEr'clarify_callbackrlr rrr?rrrrDrrUr2r3r4r5rAr;rGrrrSr~ rr@rbrr tools.clarify_gatewayrr$r r3rrL %get_telegram_topic_binding_by_sessionrrrgrrrcrerbrhagent.title_generatorrI BaseExceptionrr)rcombined_ephemeralevent_channel_promptcfg_channel_promptrHrrrr rrr,rr-r._want_stream_deltas_want_interim_messages_want_interim_consumerrr rgrr/r0r1r2r3r4rr _sigreused_cached_agentrX r _peek_cached_sid _peek_entry_cached_sid_is_dead_current_msg_countr_xproc_evicted_agentra _cached_mc _cached_sid_session_id_mismatch_stale_dead_sid_reuser _ev_agentrr$r&_pdc _mem_notifr1rr _selected_history_media_pathsr2r3r4r5r>_persist_user_message_override _persist_user_timestamp_override_pending_notes_msn_freshness_window_interruption_is_fresh _resume_entry_resume_mark_is_fresh_is_resume_pending_has_fresh_tool_tail_reason_resume_adapter_interactive_resume_srn _sn_reason _sn_adapter_approval_session_token _native_imgsr@rS r _run_message_img_exc_api_run_message_conversation_kwargsr._clear_clarify_sessionri_last_prompt_toks _input_toks _output_toks_context_lengthr _resolved_model_session_was_split_compacted_in_placeagent_session_idrc_session_split_entry_persistedentry_session_id_binding_effective_history_offsetrrrp unique_tagstagrIall_msgsrKmaybe_auto_title_kwargsr=r!r"r#rr+rMrNr@rTr rxrrr=rrrrr r r rrrrrrir r r rr"interim_assistant_messages_enabledlog_mode_enabledrr needs_progress_queuer r rrr result_holderr rr3rrr0 tools_holderr rts @@@@@@@@@@r.r z0GatewayRunner._run_agent_inner..run_syncQsk%4%+Ox~$E$E556?K`L "0!52 $2$8b#?#?#A#A # b&86&ADX&X%_%_%a%a"!%!D!D$"!&+t<<!&*:DAA "E""  " `&86&ADV&V%]%]%_%_"466N (,(K(K! + +)L))%~  I>--j99;;L"   &UPS&U&U "!"  'B#EE' F    &6D "!%!C!C;"D""D  $ # GD(D99;MME}::::::')) 65\;O #* :%/U":/**  #5 %G "%; ""B R&<B RARcccccccc#77??H<E8<5!?h.???GHVmDnDn?)1)/I"&IIII29C]_c1d1d.5["./Y"Z"ZZ,1L)(- !?ho==02-+/L &(2CCC"'%1Lc"R"R"YVYZZZ!$* )=(<*/*=-2-C#4(46G&+o&?&-fk2&F&F&L"))) ,A+@$,$*N#0%<$2#="L!K!K!K!K%)/L0@.@ , , ,(/DDsDtDDDDDDD5E.q1 RRRLL!GQQQQQQQQRNS   C d W[           .88%XXJ //7#9% "==kJJ 488#FM4@@0DE"' !$(;TBBKT>488F $  6v1 ::"(**["9"9K:::::::::::::::63{#3#3a#7#7'21~$"'  ,*$ 220*.*<*T*T(++''!000*/'''0"& + + $ 0 4 @ @ L LI O-6]]?A-N-N* D$( n 7v1 m7m7#ZZ 44Fk7&)t"3"3 36f++//VAYYt 36v;;??fQii (t3: *$ 6: +z 9-1@ 3@ +/? ?. 1M7 #KK!F !,[ '+&7&;&;K&N&NG6@%6P6P(fU\(f bfI(AY>U-U-U 8A 4 4-7 * 6 2 > 2j @ @#KK!?!,Z9K  '+&7&;&;K&N&NG6@%6P6P(fU\(f bfI(AY>U-U-U8A 4$*1IE 'v}==)!)$*$6$6{$C$C$C$C'/!)!)!)$(D!) < ! $t ! %*E !&6%5!'8&7!-?,F$!&*%;%Ct!&6%5!"&!3!3!'1nn5H&I&I&I!')ffVnnn!')ffX&6&6&6! %'FF7OOO!!"#%&&...#!$137KU0S0S0S%!&.0VV4E-F-F-F'!( *z)!**\+!,#NN-!.!' 2 2/!0%..1!2#NN3!4%..5!6%..7!8%..9!:)4 ;!< 't'7@PQQQ=!@$(#?#?#A#A#AA!!D 86#5$ 8 8"4);Z/{+55777 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 H+W[\\\)(,7 "!   ('7q&9&E""4  %:D9P"Z"5"5VZE *:E 'H^/h/D/DdhE ,$9E !          "%:E !*.E '#7E %5E "!%!3E &0nn5H&I&I&ORE # 17 88EE11E -"+!2!2 ,. &/n&6&6 # C D            7 7 7 7 7 7 7 7 7 4 4 4 4 4 4 4 4 4 4 4 4 40?E , H; H4002SUYZZf#CC#3#1D #?4NPTUUD',G[) %B77;;)>)@)@)@TXE &O O #O O O O O O O O O O O b&R>T>T"U"U555 1M1# wulD'I'IZ'W'W8!752Et#L#L M11NNO$S%7%7Y %I!ty{{%%%M)E](S(S             Y LTY LdY LY LY LY LY LY LY LY LY LY L|=Q *@V ,%T+A2FFN%%k4888TD 2-'10!@ A A %C*733-&&& " !M ))$($6$?$C$CK$P$PMM )))$(MMM) %* !(W]DTV[-\-\((FM+BDII 1)))%"&T)FM+;UCCF+D/D""  $(+!"%))&11V;+*$$ " !-$GG\K\18.#'":":6"B"B&*O-A4HH''#5W2E& 18.[ %T+I4PPN 6+ 6+2O2O%))+t<<6"Vmg5G7C((   "-M+;UCC.M?DAAVEV#66v>> 4 $ -A4HH!!%0$52 !&=&=>S&T&T # # #$9;P Q Q Q; C $GG TT +/RRRRRR+E+E#(,,($"NN \ #H xLLVLLLLL306LL,3L$///V$(/ /$+L#N *$$ -:)(($2=Ca()?@@+KCJ()?@)9C(63?Ee()AB//0@YYDXYY))*?@@@]]]]]]**+@AAAA D))*ABBBB*)*?@@@]]]]]]**+@AAAA D))*ABBBB%M!  + '')))$ZZ(899N!" KLO!!_F _'&*>?? _$+F,EG[]^$_$_!%f.EqII &v/JANN ")&*CEUWX"Y"Y"^]^@FPgfgt<<'.ulD'I'I$--//> A'.3*  *-===9=66)Z77 3(.3&, ,<(*00222*GG,'" :>62FJ559JJJ T::dBB T::B(4#'#3#7#]#]'7$^$$$ [(A(A/28K3H/I/IF,"LL i & 0 * 0  % Z%)% 255.E6$4  / /0De L L L)X,?Xc-FXFX &" !@N0bc->P>P""""B&/Sa!b!b%`DJJJwDWDW%_%@vg%@%@%@]_N$n :r : : K!;!;fjj599  vzz)U;;   K!8!8 "6::mU#C#C(4G)H)HVZZ00,VZZ8OQV-W-W+FJJ7Mu,U,U\!_2%&?)*=!"6 )*;!"#K#$&2,&5)V~--2QJJz2..#&}#5#5(<333/ /  T55D"$K)44d?? HHSMMM'..s333*D#**1.BCCC%3d%:TYY{=S=S%SN7 $"27 6FFFFFFGTUVGW_}Q/33JCCC]_H -DEJ#S75'4#@#@#@tLJO&YgeZ&F&F&FUYO,=# )-%,UGT%B%B(/z4(H(H(/z4(H(H'.ui'F'F(/z4(H(H ))) )-$..///////*. / /+33F;; EEEEEE/0@AA ::6BBEEEEEE/0@A %$ 0%9IJJ,&  2 !D! .! &**-=">">!MRSDT\M!,00R@@@Z\!]STEU\]1-11+qAAA[\ ! -PQBR\]1-11+>>>X\ ! ][\M]h}Q/33M5IIIch !]STEU`=+// 5AAA[`!-:JTq)--g666PT!$R_`aRb%l]1%5%9%9:M%N%N%Nhl!'$Q'3M!$(()?GGG-2!"a.B#!$!";%!&%&9'!(%&7)!* +!, -!./!0#22&,jj1Eu&M&M(. 3I5(Q(Q VccdUe$oM!$4$8$89JD$Q$Q$QkoA!!!! sA D D:& D5/D:5D:1D*L M &MM  P,,P03P0!Q<< R  R 7S SS,E+[Y.-[. Y;8[:Y;;=[[ [>A] ];]('];( ]52];4]55];:];$ddd;s s*)s*,A|<;,< }-}(#,(}--A,> , A@'9A@ @ A@'@ A@@A@'@A@@A@'I!A3AKK&AK>K=AK>U/D4AZ$Z$ AZ1Z0AZ1cKtdD]G}d#dd{VdStjdd{VHdS)z8Wait for the stream consumer to be created, then run it.rrNr&)rM rrrp)rr0s r._start_stream_consumerz>GatewayRunner._run_agent_inner.._start_stream_consumer*Ws3ZZ * *)!,80377999999999FFmD))))))))))  * *r0c4Kd"tjdd{Vd"sdS6s tdpddSdj<jrddSdS)Nrr&uLSkipping stale agent promotion for %s — generation %s is no longer currentr|ro)rrprI rrirrre)rr rrsr. track_agentz3GatewayRunner._run_agent_inner..track_agent6Wsq/)mD)))))))))q/)  )$2N2N^33) b%2" 0.monitor_for_interruptWWs* 4 [mC(((((((((2[ $77??H#! x)@AA$"hFdFdepFqFq$" ,Q ""+3*D*H*H*U*UK+/L*6/:/?/E2 /6k._notify_long_runningWs '"66v>>O"  04 L Mm$4555555555% .II %%% $III%BBa)E #TY[[=%@R$G H H *!_ !#)-++#$) **&'*6L"M"M '<<>>!#1"MM ZR0@-A Z ZBGWDX Z Z#%&&"8"8"XBFFCWReturn True only when the actual final reply reached the user.NFfinal_response_sentThas_delivered_text)r}rrrF)consumerrrrs r. _stream_confirmed_final_deliveryzHGatewayRunner._run_agent_inner.._stream_confirmed_final_deliveryWsux!6>> t %%,X7KT%R%R".//%%#$6$6z$B$BCCC$%%%$uu%5sA A! A!rr? rir#rrrr|zVoice-backup-interruptrrzABackup interrupt detected for session %s (monitor task state: %s)rprdrr[r@ rrZu⚠️ No activity for zB min. If the agent does not respond soon, it will be timed out in z- min. You can continue waiting or use /reset.rz!Inactivity warning send error: %srA r4rIrGrHzaAgent idle for %.0fs (timeout %.0fs) in session %s | last_activity=%s | iteration=%s/%s | tool=%srWru⏱️ Agent inactive for u( min — no tool calls or API responses.z!The agent appears stuck on tool `z` (rB z!s since last activity, iteration r%z).zLast activity: rKzs ago, iteration z6). The agent may have been waiting on an API response.zTo increase the limit, set agent.gateway_timeout in config.yaml (value in seconds, 0 = no limit) and restart the gateway. Try again, or use /reset to start fresh.rr)rirr^r rrTrTr)_AGGREGATOR_PROVIDERSnormalize_model_for_providerrr_rEz5Ignoring control interrupt message for session %s: %sr7z Voice-drainz9Processing queued message after agent completion: '%s...'r pending_steerz0Delivering leftover /steer as next turn: '%s...'r/ uZDiscarding command '/%s' from pending queue — commands must not be passed as agent inputz=Discarding pending follow-up for session %s during gateway %sz#Processing pending message: '%s...'r3 u^Interrupt recursion depth %d reached for session %s — queueing message instead of recursing. queue_message)rirrroz5Stream consumer wait before queued message failed: %srrir zZQueued follow-up for session %s: suppressing intentional silence marker before continuing.zoQueued follow-up for session %s: final stream delivery not confirmed; sending first response before continuing.z7Failed to send first response before queued message: %sz_Queued follow-up for session %s: skipping resend because final streamed delivery was confirmed.r r r ruNDiscarding stale goal continuation for session %s — goal is no longer activez:Queued follow-up session-key resolution failed; reusing %srr ri) rr rrr3rr r=rrir final_content_deliveredrWzSuppressing normal final send for session %s: final delivery already confirmed (streamed=%s previewed=%s content_delivered=%s).r$ )rrTrrzPEdited streamed message %s for session %s to include plugin-transformed content.z2Failed to edit streamed message for session %s: %sr2 c|dfd } t|tddS#t$rYdSwxYw)Nr%cpKD]/} |d{V #t$rY,wxYwdSr()delete_messagerF)_mid_adapter_snapshot_chat_id_snapshot _ids_snapshots r. _delete_allzRGatewayRunner._run_agent_inner.._cleanup_temp_bubbles.._delete_allZs -!!!"3"B"B 14## )!!! D! !!s & 33z$Temp bubble cleanup scheduling errorrr)rrrF)rrrr_loop_snapshots r._cleanup_temp_bubblesz=GatewayRunner._run_agent_inner.._cleanup_temp_bubblesZs!!!!!!!!,# ~%$J !DDs - ;;z-Post-delivery cleanup registration failed: %sNNNr)rr<r= r r}rr?rrNr r rH rBr@rArrrrMr0rFrOr`rzgateway.status_phrasesrVrWrCrcr rzrxr+r#r}QueuerM r rrrrrmrrrrrryrGrurrrRrrFEISHUr rqrrr?rDrkrrlr.r rrrrYrZrrrirprr[rrrr_INTERRUPT_REASON_TIMEOUTrbr2rhermes_cli.model_normalizerrrrr. rrrrDrr1rEr(r0 rrwr3 re_MAX_INTERRUPT_DEPTHrrrrnrmrrr0rerK r r rr isawaitabler rrrrr rr"rU rH rsrTrrr2 )rrr rrr3rr r=rrir r r r agent_cfg_localdisplay_configrM_tplrO_ftl _resolved_tp_env_tp _display_cfg_platforms_cfg _platform_cfg_legacy_tp_overrides_tool_progress_configuredrWr]interim_assistant_messages_mode_thinking_mode_va_vtc_gid_tc_cleanup_adapter_progress_reply_in_thread_slack_adapter_for_progress_progress_thread_idrrr progress_tasklog_taskr5rr tracking_taskrinterrupt_monitor_NOTIFY_INTERVAL_RAWr _notify_taskr_agent_timeout_raw_agent_timeout_agent_warning_raw_agent_warning_warning_fired_inactivity_timeout_POLL_INTERVALrRrpr_backup_adapter _backup_agent _bp_event_bp_text_bp_media_urlsr _idle_secs_act _warn_adapter _elapsed_warn_remaining_mins _warn_err_timed_out_agent _activity _last_desc _secs_ago _cur_tool_iter_n _iter_max _timeout_mins _diag_linesr _result_for_fb _run_failed _cfg_modelrr_agent_providerr.rrr" rErrv_leftover_steer_pending_parts_pending_cmd_word _rc_pending_has_stream_consumerrwas_interruptedr.r_delivery_result _previewedfirst_response_already_streamedr r _bg_cb _bg_resultupdated_history next_source next_messagenext_message_idnext_channel_promptnext_session_key_followup_adapterro_final_is_empty_sentinel_content_delivered _transformed _streamed _sc_msg_id _edit_errr_rper rxrrrrrrrrrdrfrerrrrrrrrrrrrrr r r rrrqrrrsrrVr r rrrrrrrrrrrrrr}rrrr0rrr rts`````````````` @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@r.r?zGatewayRunner._run_agent_innerMs8:    22-%'-!13          &%%%%%  MD M M M M M M M M +,, +FO<< ??????!"5"5k<"P"PQQ%//'228b+//0CDDL$B77.$// N CBBBBB  > > > > > >**; F[]^__D $ $$%=SYYYA > > > >    D   > > > > > >**; F\^bccD $ $T$ZZ 0 0 0 0    D /.{L/ZZ )788)3ND)I)IQ~~r %))+66<"&**<88>B +//0IJJPb | + =$//5#}4  /669 $88 " 48 4GG2'2U  43KOghhxlx^^^^^^^^,."?"? \"Z"Z "=A"'  3 3 3 3 3,/s8d?  3   3   3 3 3 3 3 3 3 3 30JNeiw{ r r r rC$J rX[^bXb rqt rAD r r r r r r r r ,+++++ -^ C k[c[kHk43 }f   $77??+-CUKK (#'  % %#' )E1YfoIY6Y;K*U%++---QU +@*? (+3+>*?+ + + ' Ox/ / 9/58 +/. +3+>*?    +e34I8I+?HDF !Fs $)'"715 ?h. . .-##H$455C3 6==D$%% '#7K*L*L !%ID#3xx3v~#6#6663;Q;QRV;W;W6.2(+!244 H H H H H H H H H H4! # #K?Q R R  @QZ433F;;;VZ  ' ! " " 15H5W W W!& # &(!&w!%y $y $#y $#y $sy $aey $y $y $y $y $y $y $y $y $y $y $y $y $y $y $y $y $y $y $y $y $y $V%)! ?hn , ,*.*B*B6*J*J '*65043:@DD-t11-- !55504---59 OV-/?5   ! +"f&666  , ,V5E F F F11#!&+t<<$4 2'+ ::LW]Wfggg8?H4G"HHHVM]HbrH    5 5 5 5 5 5 nQ +Q +Q +Q +Q +Q +Q +Q +Q +Q +Q +Q +Q +Q +Q +Q +Q +h v  v "&!133Z  3 D T          8 BS B4 BD B B B B B B B226:: . ?ho - -&2B -GW - 1'7AA # #% '/&&*:::009IJJJ55ON'%fk4@@(8 6+/ $! 9c! 9C! 9D! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9Fo o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o n)  J#/0F0F0H0HIIM  =*>>+;+;<N3RWY2Y.Z.Z._^_O ]&3&8&8$*N%Om%O%O7F%O%O%O.E '9'"'"!"!"!"!"!"!"!"!"$-]]] & -PR[ \ \ \ \ \ \ \ \]!^33.2+.55776K6*.*B*B6*J*J(4Q +6 6$+O=T$U$U6$3$I$I+$V$V6)8(I(M(Mk(Z(ZI9B'Ly~~H(418LRV1W1W1][]#'#B#B9#M#M !S8<8_8_(1(7(.(0B4LTZTd1n+v?O1P1Pjn 9`9&9&3&3&3&3&3&3&KHaa*2!Sn!S/G /R/RH"KK!; +*;*@*@*B*B Q  *33H===/33555GC6J#= #/?  #0@BX(Y(Y$4$I$I$K$K $']]+?KK %MM*BAFF %MM.99 #--(8!<<%MM*:A>>  E~{' $J0@+(N(NJ$../HIII #Nb$8 9 9 >Q ))))  &&=I==%B==%,==/8===  &&N*NN NNN%,NN/8NNN ""?'+ii &<&&>!{!355  '.fj"&E&E&KO&_?BW+W+W%A%A*o%^%^  D<:--d6W6WXcekeq6r6r-,,[999#1%F..v66G!MG* p'* pk* p 6w L L !% : :;Q^ _ _ ::m,,!p]!pvzzReGfGf!p(. 3F(G(G%45FGG4 S'.3- #4"p%2$6$<"M")-t"L"L"RPRK66}EE [+/+R+R)#")(5HNHX%bk63C%D%D^b ,S,,&&&&&&  'N&>}&M&MG"/"Z3KM3Z3Zp %`bijmkmjmbnooo  cg cm c"(**_"="="c-GLL!SU\]`^`]`Uabbb 7==??55c:: !(!6!6tQ!?!?ES$[N1$5abb$9$?$?$A$A$AY[!$  VVVVVV&;'899+"KK!M 1 -1M&*G$~ = G  S&3--// !% C YC Y BGCRCLQQQ Bww0BCCB BXcgngXX,[9??AAA$t'@@@NNA(+ #66v>>GD=D3G4M{\ijjjj DWWo%F%FD--k7CCC(+`(X_/`/``` '$$&&& "!!!  $ $ & & &    ! ! ! !+>.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !  " " "  112~ 8++J777'2C]T`a  " "1 A#)**]";";&V%13C e{ e e")"2;"L"L"LLLLLLLLL ' 4g6LM%%%'..000%&1 1 1 1 1 1 1 1 1#*#9%%% $%(eee"LL)`bcdddddddde4>h3M3M'axxTZT`^`$!%&6&:&:;O&P&P!Q!QJ%5%9%9:JB%O%ON(H(H&",)))%5``````/R/R,n00,,%555/4,,,5+ x'.3(0A i"KK!R + 2s#*,, & .)@#/## )iii"NN+dfghhhhhhhhi' }'.3tG}}.JDQQ]!(!C!C''5"D""$F++%%-3VXX #*#6z#B#B!5*4$4$4$4$4$4$4$4#,%%% $% %!%WW6P%Q%Q%!(!A!E!EkSW!X!X#F++%%-3VXX #*#6z#B#B!5*4$4$4$4$4$4$4$4#,%%% $% #)**Z"A"A$ & "&&*##.  ,")-4"H"H"RFK77 FF&tOrOrs}O~O~& l'.3 &J '$$&&& "!!!  $ $ & & &    ! ! ! !+>.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !  " " "  112~ 8++J777'2C]T`a  " "1 c+/+G+G +T+T(($ X'.3%)% *.)Z)Z+* /$4 *[**$$$$$$L $+%` '$$&&& "!!!  $ $ & & &    ! ! ! !+>.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !  " " "  112~ 8++J777'2C]T`a  " "1 C'+&B&B=&Q&QO*1-AQSW*X*X' %)$<$.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !  " " "  112~ 8++J777'2C]T`a  " "1 qC YL '$$&&& "!!!  $ $ & & &    ! ! ! !+>.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !  " " "  112~ 8++J777'2C]T`a  " "1 e '$$&&& "!!!  $ $ & & &    ! ! ! !+>.q1=%,!&&((()))))))))"1!%.{CHHHHHHHHHHH#0'2HI!!!#**,,,!"---------&5!!! D! !  " " "  112~ 8++J777'2C]T`a  " "1 (%Q' h % %8 hll8.D.D8 \\"2339rF%+!Bv/B  hll+?@@AAJ!%F%>FF""    -C D DEEL98$I & l   M_  V&3& ,0((' L S_!^ !k66$*N'1$,-=$>%) 7 480 n& (:s%P'.3  ' T , --8T**-LL** - (*KLL -!!122M &  0 $577N         $ T @@)-A  T T T LdSSSSSSSS Ts60E11 E>=E>,F// F<;F<,-W W)(W)3IB@ *n.-B@ . n;8B@ :n;;AB@ *p87B@ 8 q'q"B@ "q''FB@ +x?B@ x  B@ x  G B@ -A@@B@ @ A@@B@ @A@@I+B@ J0AJ1J0B@ J1 AJ>J;B@ J=AJ>J>D2B@ Q*AQ3Q3ARRARR AR&R&/AS7SASSAS7SAS1S.AS7S0AS1S1AS7S6AS7UAUUAU*U)AU*U/$B@ VAV1V0B@ V1/AX/W!AW*W)AX/W*AW<W9AX/W;AW<W<AX/W?B@ X AX/X AX*X%B@ X*AX/X/A$B@ ZAZ'Z&B@ Z' AZ6Z3B@ Z5AZ6Z6'B@ [AA\\B@ \ A]\)A] ]B@ ] A]]A&B@ ^5&A__B@ _ A_)_&B@ _(A_)_)AB@ `*&AaaB@ a AaaB@ aAaaBB@ eAe#e#Ae5e4Ae5e9Aff/Ag'gAggAg'gAg!gAg'g Ag!g!Ag'g&Ag'h?AiiAiiAii Ai6i5B@ i6)Aj"jB@ j!Aj"j"&B@ mAm m AmmAmm Am=m=/Aon-An6n5Aon6AooAooAooAoo Aop&Ap/p/AqqAqq=B@ r"Ar'r&B@ r' Ar4r1B@ r3Ar4r4AB@ vAv v AvvAvv#Aww/Axw0Aw9w8Axw9Ax xAxx Ax x AxxAxy)Ay2y2AzzAz|A| | A||A||"A|?|?/A~}/A}8}7A~}8A~ ~A~~ A~ ~ A~~A~(A11B@@B@@ A9BFBBB B BFB BBBBFBBBBBFB"BB?B>BFB?/BDC/BC8C7BDC8BD DBDD BD D BDD BFDBDDABFE(BE1E0BFE1BF FBFFBF FBFJABK"K" BLK,BLLBLNBN'N' BON1BOOBOr(r)r"r)rr|r)r )r\)rrrr)r rr)NNrNNNNN(srr^r_r`rr rCr1__annotations__rrrrrr r0rrrrrrrrrrrrre rrrxrr r=r>r?r@rDr rrrrrrrrrnr r&rr=rrEr@rrRrZr\rhrrrrurrtrrrpropertyrrrrrr frozensetrrrrrrrrrrrrrArrrrrr rr r"r$r(r&r'r4r<rFrTr[rbrfrkrrrwr{rrrr staticmethodrrrrerrrrrrrrrrrrrrrrrrrrrrrrrqrrrrrrr rrrr%rr&rrrrrrrFuturerrrrrrcrrrr r r+rUr2r4r9r>rPr^r`rdr r r rrr rrrrh rp rr rr rr r r r r r r r r rrr rr' rr r r r r~ r rrrr r9 r r r r r r r% r* r. r5 r rD rV r[ rQ ri rP rV r rW rX r r r r r rrr rrr(r#r-r0r1r3r9r@rLr`rr rkrirRrrr_APPROVAL_TIMEOUT_SECONDSrryWHATSAPPr r!EMAILSMSDINGTALKrWECOMWECOM_CALLBACKr r r r_UPDATE_ALLOWED_PLATFORMSrrrrrrr2 rJ rrrrrr r r r rYrrrrZrrP objectrrr"r$rrrrKrPrM classmethodrRrdrlrvrrr}rU rr0r rB rI rr r rI rG r rU rF rrE r3 rr. rrrrrrK rr<rH rFr r?rr0r.rr s57,.S%Z(---'c'''&OS&&&$IEIII $J $$$It#(D((($$$$"'4'''#t###!&$&&&-2$d2227;Xm4;;;)-J&---,0M8GL)000SWxS$x7M2N-N(OPWWW'+x}+++:<d3S#X#67<<&?DDD>@ $sDcN':";@@@@B#T#x}*<%=BBB8:c49n!5:::/1De,111')d38n)))). $...6:(>2999!$$$$;?X&78???-2$d222x8x8x 6x8x8x8x8v >- - - - f$$&??-8-c-c----4S>4@@@@ ,s ,d ,W[ , , , ,+c+D+UY++++$****X"327 :<>B222-5c]2 2222h 8% 8 8 8 8 6 6 6 6 6 :?26 .+/%)&* R%R%R%'R%c] R% d^ R% sDy  R%R%R%R%h-s-3-X\-ae----^.Y.YS.YT.Y.Y.Y.Y`OS#XO4OOOO #9L#QU####8!"*!" !"!"!"!"F\>Q\VZ\\\\|###$#### )c)))) C    ( s    (8 /U / / / /,E,,,,." 4" " " " H,Z,Z,Z,Z\     5555"1117U7UU7Ud7U7U7U7UrDcDDDDLsLLLLWTWWWW"55N5UX5]a5555 !!! / ! . ! !!!!F@DU3U4UUU\US3SV>        HSM W_`cWd pt    @0000(////0**U*T****H)-$('+ !  SM   }  0AC$ $ $ #$ t$ $ $ $ L44Dc3h$8\B U3 U U U\ U"'+#'#'33333 d^ 3 C= 3C=3 33338$(#' EEEEE C= E C= E EEEE844c44$;444\4 FFc4i8HFFF\F8+/%) 222'2c] 2  2  22228 T T#4. T  T T T T"%)))c]) # ))))6 MMM M  MMMM.d \$ $   \  3   \ A#AAA\A.\$\6 D   \ $+\($$$$$@!$c!$$+!$$!$!$!$\!$F $sCx.    hsm    #      sHSM! " :#3#4###\#J4C4D4444lQQQQ\Q!%83%8|%8X\%8%8%8%8Nj|jZ]jbfjjjjX 9#%9#E$sCx.RVBV$sCx.q>Tq>q>q>q>fp'p'cp'p'p'p'dcH'H'H'H'T@ !& % pppp p  p  ppppd****GGGGGRdd/5d@DUCZ@Pd ddddL7$77 7  7777,`<`<+3`< `<`<`<`Q9 99992+3 &'48 9   %       F#8$X$X#$X$X$X\$XLAAA % & AAAAL'+$$$sm$ 3 x}5t; < $$$$V(Gc(Gd(G(G(G(GTT#TT ,  TTTTl\B<\BHSM\B\B\B\B|0>cd* UC UD U U U U$&* XXXX X d38n% X c] X #XXXX@ &*       d38n%  c]   #    0?s?tCy???? *%6X c    E9#E9_bE9E9E9E9N8++3++++(v cv v v v v(D#(D47(D #(D(D(D(D`%}%s%t%%%%TO,O4OOOOr6|66666     .2&c] $sCx. ! 4$(-1!%"""8$"#"C= " C= "&c]"#" $sCx. !""""H $(!% 8$#C= C=  #  \>.|. ...\.!$!* 8>8+< h&7)@(/S[SgiqiwzBzH +!! X X X X #!$ g?g?g?g? g?  g?g?g?g?RtttttlF0(5c8TW=AX;Y2ZF0F0F0F0VGKNNNs5c8C=)@#ABCN U3Xc]* + , NNNN`  4    B##$####    z1D&****,+/%)&*"&#GGG'Gc] G d^ G 3- G}G GGGGRCC#YC CCCCJW1W1#YW1 sDI~  W1W1W1W1r49$(55C=5 sTz49$ % 5555J'VVV #Y VV VVVVJ+++  ++ sDI~ ++++ZL tL L L L \oo$(o $oooob4HU3VCS=T4U\(33333333j@^@^$(@^ $@^@^@^@^D3D3T3333*0*0*0*0*0*0*0*d|>$|>4|>|>|>|>|)0"PRU3d ?%;T#s(^%K LQQQE4S>EEE[EB>B>B>B> B> 4K B> t B>4ZB> B>B>B>\B>H8 S8 T8 8 8 8 t%%'*%<@% %%%%: C D     .3 .$ .SW . . . .MM#MRVMMMM)- 2222! 2  2222hsCD403EH :) S) S) T) ) ) ) V-#-$----^$UW   c c [^    G3GCGDGGGG$J   .'+2222222222  22 ! 22 $22 22222222hII,4SMI IIIIVD3DtCyDUYDDDD@s@tCy@@@@00UX0]efi]j0000<#'6>sm *LK4LKCLKLKLK\LK\GsGtGGGGR"3"""""\".5Oc5O5O5O5O5O5On 0s 0 0 0 0 0 0)))))):PPPPdV3VVVVx . (,*.g g g g d38n% g  g  g g ! g #3-g  c3hg g g g d  (, !*.(,%).226,,,,d38n% ,  ,  ,,! ,,#3-,! ,TN,'sm,!), c3h,,,,\.}.#....`6%}6%6%6%6%6%~ (, !*.(,%).226[4[4[4[4d38n% [4  [4  [4[4! [4[4#3-[4! [4TN[4'sm[4!)[4 c3h[4[4[4[4[4[4r0r?)r stop_eventrcddlm}m}|}|s |rZt |ddsIt |ddr8|s||k||ddSn2#t$r%}t d|Yd}~nd}~wwxYw|||dSdS)uPoll for the planned-stop marker and trigger graceful shutdown. On Windows, ``asyncio.add_signal_handler`` raises NotImplementedError for SIGTERM/SIGINT, so the standard signal-driven shutdown path never runs when ``hermes gateway stop`` signals the gateway. The consequence is that the drain loop is skipped — in-flight agent sessions are killed mid-turn and ``resume_pending`` is never set, so the next gateway boot has no idea those sessions need to be auto-resumed (issue #33778, v0.13.0 session-resume feature broken on native Windows). This watcher runs on every platform (cheap, defensive) and bridges the gap on Windows by translating a filesystem marker into the same shutdown-handler invocation a real SIGTERM would have produced on POSIX. The CLI's ``hermes_cli.gateway_windows.stop()`` writes the marker via ``write_planned_stop_marker(pid)`` and then waits for the gateway PID to exit; this watcher is what makes that exit happen cleanly. On POSIX this is a no-op safety net — the signal handler always races us to consuming the marker file because it fires synchronously from the kernel's signal delivery. Args: stop_event: cleared by start_gateway() during normal shutdown to tell the watcher to exit. runner: the GatewayRunner instance; we check ``_running`` and ``_draining`` to avoid triggering shutdown if the gateway is already in one of those states. loop: the asyncio event loop the shutdown handler must run on. shutdown_handler: same callable that's wired to SIGTERM — tolerates a ``None`` signal argument (planned stop case) and consumes the marker via ``consume_planned_stop_marker_for_self()``. poll_interval: seconds between marker checks. 0.5s gives a responsive shutdown without burning CPU. r)_get_planned_stop_marker_path planned_stop_marker_targets_selfrFrNz#Planned-stop watcher tick error: %s) rrRrSr rfr}rlcall_soon_threadsaferFrrr) rPrunnerrshutdown_handlerrrRrSr rs r._run_planned_stop_watcherrWZs^Z0/11K!!$'" D""$$  U;; FJ66 ,8799OOM222 ))*:DAAA D D D LL> C C C C C C C C D &&&I!!$'$'$'$'$'sAB>B C!CCrrlc<ddlm}m}ddlm}d}d}d} d} t d|d} |s9| dz } | |zdkrw|ru ddlm } |9t| ||t d } | | d n2#t$r%}t d|Yd }~nd }~wwxYw| |zdkr |d}|rt d|n2#t$r%}t d|Yd }~nd }~wwxYw |d}|rt d|n2#t$r%}t d|Yd }~nd }~wwxYw| | zdkr_ |\}}|rt d||n2#t$r%}t d|Yd }~nd }~wwxYw| | zdkrU ddlm}|t!ddn2#t$r%}t d|Yd }~nd }~wwxYw|| |9t dd S)uBackground thread for gateway-only periodic chores (NOT cron). Split out of the historical ``_start_cron_ticker`` so the cron *trigger* can live behind the ``CronScheduler`` provider (built-in or external) while these gateway-specific chores keep running independently of which provider fires cron. An external scale-to-zero provider has no 60s loop at all, but this housekeeping still wants its hourly cadence — so it owns its own loop. Refreshes the channel directory every 5 minutes and prunes the image/audio/document cache + expired ``hermes debug share`` pastes once per hour, and polls the curator hourly (its inner gate enforces the real weekly cadence). r)cleanup_image_cachecleanup_document_cache)_sweep_expired_pastesrr)z+Gateway housekeeping started (interval=%ds)rZrNz*Channel directory refresh scheduling errorrr{rz#Channel directory refresh error: %sr) max_age_hoursz-Image cache cleanup: removed %d stale file(s)zImage cache cleanup error: %sz0Document cache cleanup: removed %d stale file(s)z Document cache cleanup error: %sz4Paste sweep: deleted %d expired paste(s), %d pendingzPaste sweep error: %s)maybe_run_curatorrc8td|S)Nz curator: %s)rri)r\s r.rz-_start_gateway_housekeeping..~[s6;;}c+J+Jr0)idle_for_seconds on_summaryzCurator tick error: %szGateway housekeeping stopped)rirYrZhermes_cli.debugr[rrir rrrr.rFrr agent.curatorr]r1rl)rPrrrlrYrZr[IMAGE_CACHE_EVERYCHANNEL_DIR_EVERYPASTE_SWEEP_EVERY CURATOR_EVERY tick_countrrrrdeleted remainingr]s r._start_gateway_housekeepingrj.[sSRRRRRRR666666M KK=xHHHJ!!=*a ) )Q . .8 . GMMMMMM# 3//994%$PC  2 ... G G G BAFFFFFFFF G ) )Q . . A--B???ZKK OQXYYY A A A >>>>"":tV^"_____r0g@P@gA@rr-pollcK|dStjtd|z}|rtj|krWtj|d{V|r)tj|kW| S)uWait for a daemon thread to exit WITHOUT blocking the event loop. A synchronous ``thread.join()`` here would freeze the event loop — fatal for the cron ticker, whose in-flight delivery is a coroutine scheduled onto *this* loop via ``safe_schedule_threadsafe``. Blocking the loop deadlocks that delivery (the loop can never run it), so ``join(timeout=5)`` always times out and the message is silently dropped on restart (#58818). Polling ``is_alive()`` with ``await asyncio.sleep`` keeps the loop running so the pending delivery completes, then the ticker sees ``stop_event`` and exits. Returns True if the thread exited within ``timeout``. NTr)rrrDris_aliverp)r-rrors r._await_thread_exitrr[s~t'))..003sG3D3DDH //  " 8 : : ? ? A AH L LmD!!!!!!!!! //  " 8 : : ? ? A AH L L   r0r4 verbosityc|<=Kddlm}|ddlm}m}m}m}m}m} |} | P| tj kr8|r|| } t d|  ddlm } | | n2#t$r%} td| Yd} ~ nd} ~ wwxYw ddlm}|| }n#t$rg}YnwxYw | | d n`#t"$rYnTt$t&f$rAtd |  dd lm}|n#t$rYnwxYwYd SwxYwdd lm}d }t/dD]%}|| sd}nt1jd&td|  | | d n$#t"$rd}Ynt$t&f$rYnwxYw|s5t/dD]%}|| sd}nt1jd&|s?td|  dd lm}|n#t$rYnwxYwd S ddlm}||| n-#t$r td| dYnwxYw| t9dz dn#t$rYnwxYw dd lm}|n#t$rYnwxYw ddlm}|| | }|rt d|n\#t$rYnPwxYwt?t9}td| |tAd| dd S dd l!m"}|d!n#t$rYnwxYwdd"l#m$}m%}|tLd#$ dd%l'm(}d} dd&l)m*}|}n#t$rd}YnwxYw|tL|'n2#t$r%}td(|Yd}~nd}~wwxYw|dd)l+m,}tZj.tZj/d*0|tZj1} t[j2|}!|!3| |!4|d+t[j56|!| t[j5j7kr&t[j53| tq|=ts|=_:d }5t|4|1rt=jed?d r dd@lfmg}6t|6dA}7|7r8|7|5dB<t dCt|7dD|7Dn2#t$r%},tdE|,Yd},~,nd},~,wwxYwt|4|1r=fdF|5dG<tjJ|4jL|3f|5ddHI}8|8LtjJt|3f=jbtwj<d>ddJI}9|9Lt=dKd}:t|:r |:=\d{V ddLlQml};|;n#t$rYnwxYw=j]r)=jXr td;=jXd S|3m |4nn2#t$r%} tdM| Yd} ~ nd} ~ wwxYwt|8tNd{Vs tdOtt|9tNd{V|&m|'rdPN dd.shutdown_signal_handler\s! @ G G G G G G??AA   @ @ @ LL;Q ? ? ? ? ? ? ? ? @ fm + +LL! H HOOOOOOCCEE  H H H CQGGGGGGGG H E           65oFFMM E E E M LL? D D D D D D D D E   KKQ+8G h''i      KKK+8N h''>N     *. &15F - KK5+8N h''>N     $ F*,B,B=,Q,Q F F F @"EEEEEEEE F F(614OO &&}X6 F F F @"EEEEEEEE FFKKMM*****st AAA A11 B ;BB $B:: C+C&&C+/$F GF>>G!G)) H3HHc6dddS)NFTr!)r+rUsr.restart_signal_handlerz-start_gateway..restart_signal_handler]s"4@@@@@r0SIGUSR1z6Skipping signal handlers (not running in main thread).zplanned-stop-watcherr)write_pid_filer rwz^Another gateway instance (PID %d) started during our startup. Exiting to avoid double-running.zBGateway runtime lock is already held by another instance. Exiting.z8PID file race lost to another gateway instance. Exiting.)start_nous_auth_keepalivez%Nous auth keepalive did not start: %s)rOzMCP tool discovery failed: %szGateway exiting cleanly: %sz Gateway exiting with failure: %s)rN)rlresolve_cron_scheduler)rrrp)r r profile_homesz:Cron scheduler will tick %d profile(s) under multiplex: %scLg|]!}t|tr|dn|"S)r)r@rrs r.rz!start_gateway..]s/PPPQZ5118QqTTqPPPr0z6Could not resolve profile homes for multiplex cron: %sc"jpj Sr()rrrsr.rzstart_gateway..]s   = =5 r0 can_dispatchzcron-scheduler)rrQrrrzgateway-housekeepingrp )stop_nous_auth_keepalivezCron provider stop() error: %srubCron ticker did not exit within %.0fs of shutdown — an in-flight delivery may have been dropped.rz}Exiting with code 1 (signal-initiated shutdown without restart request) so systemd Restart=on-failure can revive the gateway.z_Exiting with code 75 (service-restart requested) so the service manager relaunches the gateway.Kr()ugateway.code_skewrurrvrwrxr r ryr`rrrirzrFrrr{ProcessLookupErrorPermissionErrorrdrr|r}rM rDrprr~r#r rrCprinttools.skills_syncrhermes_loggingrrr!hermes_cli.security_audit_startuprrKrrrrWARNINGrrBDEBUG StreamHandlerrrrrlevelrrrrrset_exception_handlerrrcurrent_thread main_threadrrradd_signal_handlerNotImplementedErrorrrrrrWr atexitrFileExistsErrorrqhermes_cli.nous_auth_keepaliverryrTrOr@ rrr SystemExitrr rrNrmrlrrr@r}rGrr rqrrjrrrcrrr_CRON_SHUTDOWN_DRAIN_TIMEOUT$_HOUSEKEEPING_SHUTDOWN_DRAIN_TIMEOUTr2rr)>rGr4rsrurvrwrxr r ry existing_pidexisting_start_timerzrr{_old_gateway_childrenr|r}old_gateway_exitedrr~r _releasedr-rrrr _audit_cfgr _audit_excr _stderr_level_stderr_handlerrrrsig_planned_stop_watcher_stop_planned_stop_watcher_threadrr _current_pidrrrO_looprrNrlr cron_stop cron_providercron_start_kwargsr r cron_threadhousekeeping_threadstart_watchdogrrrUs> @@r. start_gatewayr[sI$:99999#?$$LLBIKK$?$? Q "8"8"F"F  KKN    G@@@@@@%%l3333 G G G BAFFFFFFFF G +EEEEEE(B(B<(P(P%% + + +(*%%% +  l%88888%   #W-    G  DDDDDD))++++ Duu  3 2 2 2 2 2!& 2YY( !( !"{<00)-&E 3W !M,d;;;;;)...)-&&&'1D*)"2YY))*{<88"15.!E 4(((() !LLM$ HHHHHH--////$ 5 @@@@@@%%)l    C !  O     ""]2::d:KKKK     @@@@@@%%''''     CCCCCC44*%8 aKK TV_```    o//00K LL^k    OlOOO    5 111111 $      ;:::::::Ml;;;; RSSSSSS   9 9 9 9 9 9(**JJ   JJJ %%,zRRRRR RRR DjQQQQQQQQR333333#O ==AA)W][[ !/ ??  ///$$%7%78]%^%^___&&777 7,..4 4 4     ( ( 7 7 7 6 " "F/37mmF+ "']+]+]+]+]+]+]+~AAAAA  # % %D >???!!Y%:%<%<<<M6>2  C ''-DcJJJJ&     69 % %  ''8NOOOO&       LMMM"+!2!2#,#3((&$8O P # $$$ !&&(((MMMOOOOOOOOOO"?$$LLBIKK$?$?  /0<   u ' ' ) ) P   u $$&&& F   uu   OOO$$$ OO0111CLLLLLL!!#### CCC EEN  " " $ $$$$$$$$ KKKKKK  """"      &   Q LL;V=O P P PuMMOOO: ::: 5q99999999:#K9UVVV V V V V V V  ./K    %I    ""$$$ %%a%000 777777      #)***"&*C  M   u"  .   nn 4s4B B5B00B59C CC C,, E 8+E $D54E 5 E?E EE E % F33 GGG,H== I  I I$$'J J%K KKK$$ K10K150L&& L32L3N N#"N#P OP O*'P)O**P P/ P**P/W W,+W, X&& X32X3 \.]  ] 9^ ^9^44^9 5` `0 `++`0.c?? d  d Ag-- h7hh;l ll!m66 n%n  n%+p<< q q c ddlm}|n#t$rYnwxYwddl}|d}|ddd |d d d d |}d}|jr]ddl}t|jd5}| |pi}tj |}dddn #1swxYwY tjt|}|rdnd} nE#t $r8} | jd} n$t%| jt&r| j} nd} Yd} ~ nd} ~ wwxYwt)| dS)z CLI entry point for the gateway.r)configure_windows_stdioNz)Hermes Gateway - Multi-platform messaging)rz--configrzPath to gateway config file)r_ z --verboser store_truezVerbose output)rr_ r9r:rZ)hermes_cli.stdiorrFargparseArgumentParser add_argument parse_argsrGrHrIrJrnrn rrrrr r@r0_exit_after_graceful_shutdown) rrparserrQrGrHrPrHrrrs r.r*r*7^s <<<<<<!!!!      OOO  $ $1\ $ ] ]F  D/LMMM  T,EUVVV     D F {3 $+ 0 0 0 3A>>!$$*D",T22F 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3$ +mF3344 'AAa  6>II  $ $ III"),,,,,s6  %,CC!$C!)'D E.EErcRtjtjfD]'} |#t$rY$wxYw ddlm}m}||n#t$rYnwxYw ddlm }|dn#t$rYnwxYwtj |dS)uFlush stdio, release the PID file + runtime lock, then hard-exit. Graceful teardown is already complete by the time this runs, so there is nothing left that needs a clean interpreter shutdown. We deliberately use ``os._exit`` (not ``sys.exit``): ``sys.exit`` raises ``SystemExit``, which triggers ``Py_FinalizeEx`` → ``wait_for_thread_shutdown`` and joins every non-daemon thread — exactly the hang (#53107) a wedged tool-worker causes. ``os._exit`` bypasses ``atexit`` handlers, so we cannot rely on the ``atexit``-registered ``remove_pid_file`` / ``release_gateway_runtime_lock`` (registered in ``start_gateway``) to run. The full-shutdown path releases both explicitly in ``_stop_impl``, but the EARLY exit paths — clean-fatal-config (#51228) and startup-aborted-before-running — raise ``SystemExit`` right after ``runner.start()`` without going through ``_stop_impl``, so on those paths ``atexit`` was the only thing releasing them. Now that those paths are routed through this backstop (#53107), release both here explicitly. Both calls are idempotent — ``remove_pid_file`` only unlinks a PID file that belongs to this process, and ``release_gateway_runtime_lock`` no-ops when the lock is already released — so this is a no-op on the normal shutdown path and the actual cleanup on the early-exit paths. Logging IS drained here: the rotating file handlers are driven by an async ``QueueListener`` on a dedicated thread (see ``hermes_logging._register_queued_handler``), so records emitted right before shutdown may still be sitting in the in-memory queue. ``os._exit`` below bypasses ``atexit``, so the ``atexit``-registered listener drain never runs on this path — we drain explicitly (bounded, via ``drain_log_queue``) or lose the last log lines (including the shutdown reason on the early-exit paths). Stdio is flushed too. rr )drain_log_queuerrN) r\rrrrFrr r rrr`_exit)rrr r rs r.rrl^s@:sz*  LLNNNN    D   PPPPPPPP$$&&&&       222222$$$$$      HYs01 >>A A,+A,0B BB__main__rr(r?r)rN)r6rr%N)rcr)r%rn)r%rD)rrtr%N)NNr)r)NFr(r`hermes_bootstrapModuleNotFoundErrorrconcurrent.futuresrrrrrr`r)rrir\rr rrDsqlite3 collectionsr contextvarsrr rrtypingrr r r r r rragent.account_usagerragent.async_utilsrrr< rrrrrrrragent.conversation_loopr agent.i18nrrKrrhrrrrrr'compiler* IGNORECASEDOTALLrrCr4r2rrrIrBrQrS_GATEWAY_PROVIDER_ERROR_RErrrrryrPrrhrrrrrrrrrrrrrrArrcrr+rCr1r6r;r?rGrSrZrr@rhrkrrrlrsr{rrrrrrrragent.replay_cleanupr_is_interrupted_tool_resultrrrrrrr_is_dangerous_confirmationrrrrrrr0rrr rrrrrr!rargrhr]r_rjr#r$utilsr%r&r'r(rdotenvr)hermes_cli.env_loaderr* _env_pathr^r4r5r3rW contextlibrX_contextmanagerrzrY_PORT_BINDING_PLATFORM_VALUESrZr rWr\rbrmrsr{r0r1 _config_pathrfrHrOrIrlrJrr=rLr?rMrFr_key_valr@rB _terminal_cfgrDrE_terminal_backend_terminal_env_map_cfg_key_env_varr| rrrqrQ_auxiliary_cfg_aux_bridged_keysrrr re _task_key _task_cfg_prov_model _base_urlrrr_upper _agent_cfg _sessions_cfgr_tz_cfg _security_cfg_redact _gateway_cfg_strict _allow_dirs_allow_dirs_strrl _trust_recent_trust_recent_seconds _bridge_errrrrrrdir _network_cfg_bootstrap_excrrgateway.cwd_placeholderrr_configured_cwdrzr6 _resolved_cwdrrrxrrnrrurqr:rrrrrrrrrrr gateway.deliveryr r gateway.turn_leaser gateway.authz_mixinr gateway.kanban_watchersrgateway.slash_commandsrrirrrrrrrrgateway.shutdown_watchdogrrrrgateway.restartrrrrgateway.whatsapp_identityr _canonical_whatsapp_identifierr!_expand_whatsapp_auth_aliasesr"_normalize_whatsapp_identifierrrrJr r r rFr5r<rMrrErr^rarcrVrsrzrrrrrrrrr r r _INTERRUPT_REASON_SSE_DISCONNECTr r rrrrrrrr?r rrrrr'r/rCrLweakrefrrNrrgrcrmrsrxr}r~rrAbstractEventLooprWrjrnrrrrrrr*rrr0r.r's*   "     D     ######$$$$$$NNNNNNNNNNNNNNNNNNNNPOOOOOOOTTTTTTTT                    GFFFFF%%%%%%999999#)-&+.(&6#)rz*TUU&BJ >MBIA!!H = = = = = =,#-"*HH    / 1 + 7 6 4 =       M##$t:(i999 LsLtLLLL (RZ  M  )bj  M  $]M $>M BJ788BJ122BJ122BJ344BJ)**BJ/00BJ9::3333lKcKcKKKK *.    tCH~&  d38n    )])t))))X , % ,04S#X ,  , , , ,Fcc: =, =3 = = = =*!      :($.2:  M $ $ ?S?T????.s##4csSU]^aUb< :# : : : : C C C$!    c] @ F FC FRU FZ^ F F F F"59$$$$$$  $  $$'s8d?$ $$$$N<B BBB SMB B B  BBBBB-%S/ % ?? ? ? c3h? ?  #s(^ ????D,M(!a%O! _(3- _D _ _ _ _ CS CSX C C C C$$C$$$$*)c)c))))JcJCJDJJJJXd^.%)# f+f+f+ $sCx. !f+SMf+ f+  4S#X # ./ f+f+f+f+RDcN+ $sCx.,PXY\P]be4d38n1E(F3:!!!@!>ST. NM )-N+N+4S>"N+N+"#N+ 49d? N+N+N+N+b.T#s(^0D.....h1111f 3 3 3 3 3 3>>>>>> $m+ o n  T, 1 1 1 -R"5?2&&,"D - - - - - - - - - - - - - - - 766666%%  0 0 0 0 0 06=6t<!~!-!1 ! #$? !  7 !%&C!$%A!5! !9!/!/!/!-! !9! #$?!!"!";#!$)H";3%A1Y";+M3](G5$?9!!! <'8&=&=&?&? 9 9"(},,(2D  5((SSYY:N-N-N  5((ZZc-B-B(PPPPPP778I4::<<XX<#%7#5#5d#;#;D!z$t 559/9tz$/?/? 8,,/2s4yy 8,+r22  Ijj>> I!F E E  IIIIII88::99F%))&-88889     / I I *..y"== !z)T22IMM*b99::@@BBY]]7B7788>>@@C j" = =>>DDFF 3y}}Y;;<<BBDD"**GUf__AFBJ=F===>E>DBJ:F:::;KAJBJ=F===>I@HBJ>?Bs@A@@ ;< R00  ZZ t<< M))/2s=3K/L/L +,=0069c!"2377 23xx 2..  JJ|T::  L00?BsAc,O_B`>a>a :;!\11@CLQcDd@e@e <= )L88;2:MMFIc !9:GG BC((:r**  ?+l:: 'PRTUU[[]];IL !;<II DE      ;tK  ) ; ;-8 ; ;     L          (_666666"cceeOODD88BGGLz,%%*,*:*:<*H*H*D))))___ E LN L LSVS]^^^^^^^^^_U777777UUU E B. B BTTTTTTTTTUU>>>>>>  """"UUU E B. B BTTTTTTTTTU! >!$ WVVVVVVV*..443/-===44&;;bi00&/bi 4g' ' %'' ' c)$)++&&   M ~t,,,,%2 >"                          QPPPPPPP777777999999>>>>>><<<<<<                       8 $ $ NV OZ ^ N6 b (3-J!&((, %E    DtDDDDN,HSM"/t ////dBsBsBBBB E E E E E EZZZZZZCDEEEEEEs,sCTW6#e#####'c'hsm''''T449L4444*3>#< %<"$8!'i$$&&%%''!''))(..00*0022)//11   58C=5T5555040E#*cDj:P4Q0000f=3=3:====@C:C#CCCC FFFFFd;d;;;;|TD[T::d::::(  4$; #    & $#  }}   #Y : $#   }  } o:Xd3i06CM4d|@>$0LX\000 RRRRR R  RRRRj>t>>>>>0$4( @3 3 3 3 pBBBBBB axaxaxaxax-/IKdaxaxaxTq  V'V'V'V'  #V'  V' V'V'V'V'rV0V0IOV0adV0V0V0V0r ` `9? `X[ ` ` ` `( $(,$GJ!! Y% &!16!>C! !!!!.t t  7t t bjknbot x|t t t t n2-2-2-j:S:T::::z zDFFFFFs 5yZ% y%Z))y,Z)-y[y[!y [!!G>y .dydydUyz)Az$$z)-A#||>|77|>}~}==~~ #