jLdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z ddlmZmZddlmZddlmZddlmZddlmZmZdd lmZe j6d k(rddlZnddlZd Zd Zd Z e j6d k(Z!e"Z#dZ$da%dZ&hdZ'Gdde(eZ)de*de*fdZ+de*de*ddfdZ,e GddZ-defdZ.ddeedefdZ/defdZ0defdZ1de(fd Z2d!ede3fd"Z4d!ede*fd#Z5d!edejldzfd$Z7d!ed%e*de*fd&Z8d!ed'e9e(efddfd(Z:d!eddfd)Z;d*d+de*d,e3ddfd-Zde*dee*fd2Z?dee(fd3Z@d!e(ezdzdee(fd4ZAde*deefd5ZBde*dee*fd6ZCde*dee(fd7ZDd8e(dzde3fd9ZEde*de3fd:ZFd;e9e(efde3fd<ZGd;e9e(efde*d=ede)fd>ZH ddd?deed=eedee-fd@ZIde9fdAZJde9e(effdBZKd!edee9e(effdCZLd!ed'e9e(efddfdDZMddeedee9fdEZNddFeedee9e(effdGZOd;ee9e(efdee*fdHZPdedIe3ddfdJZQddKZRde3fdLZSde*de3fdMZTddNZUde3fdOZVddPZWddFeede3fdQZXddRZYe#e#e#e#e#e#e#e#e#dS dTedUedVedWedXedYedZed[ed\eddfd]ZZd'e9e(efdede9e(effd^Z[dedefd_Z\dee9e(effd`Z] ddaee9e(efdee*fdbZ^ddcZ_dd0e(d.e(ddee9e(efde`e3ee9e(efffdeZad0e(d.e(ddfdfZbdddgdhee*diee*de*fdjZcdkZddlZedmZfdlZgdefdnZhdefdoZidpe(dqe*de3fdrZjd!edse(dte(due(dqe*de3f dvZkdwe*de3fdxZlde3fdyZmddzZndwe*de3fd{Zode3fd|Zpde3fd}Zqdd~Zr ddddeedIe3dee*fdZs ddddeedIe3de3fdZty)u Gateway runtime status helpers. Provides PID-file based detection of whether the gateway daemon is running, used by send_message's check_fn to gate availability in the CLI. The PID file lives at ``{HERMES_HOME}/gateway.pid``. HERMES_HOME defaults to ``~/.hermes`` but can be overridden via the environment variable. This means separate HERMES_HOME directories naturally get separate PID files — a property that will be useful when we add named profiles (multiple agents running concurrently under distinct configurations). N) dataclass)datetimetimezone)Enum)Pathget_hermes_home)AnyOptional)atomic_json_writewin32hermes-gatewaygateway_state.jsonz gateway-locks gateway.lock> gateway.pidrr.gateway-takeover.json.gateway-planned-stop.jsonceZdZdZdZdZdZy)ProcessIdentityz?Result of validating persisted metadata against a live process.matchmismatchunknownN)__name__ __module__ __qualname____doc__MATCHMISMATCHUNKNOWN/home/cube/projects/richard/traning coach/.omo/evidence/nutricoach-v150-combined/st_01a0560c-r63-installed-wheel-first-claim-qa/venv/lib/python3.12/site-packages/gateway/status.pyrr;sI EHGr"rpidreturnc$ttdd}| ||dStjj ds t dddl}|jdd}|jd|d}|dkrt |jd|S) N pidfd_openrlinuxzpidfds are unavailableT use_errnoizpidfd_open failed) getattrossysplatform startswithOSErrorctypesCDLLsyscall get_errno)r$ native_openr1libcfds r# _pidfd_openr8Cs"lD1K3"" << " "7 +.// ;;tt; ,D c3 "B Avf&&(*=>> Ir"r7sigc(ttdd}| |||ytjj ds t dddl}|jdd}|jd||dd}|dkrt |jdy) Npidfd_send_signalr(zpidfd signalling is unavailablerTr)izpidfd_send_signal failed) r+signalr-r.r/r0r1r2r3r4)r7r9 native_sendr1r6results r#_pidfd_send_signalr?Rs&"5tA stable, verified process authority for one gateway instance.r$Nr7processprocess_create_timerecord expected_homer%c0|j |j|jduxs|jduS|j;t |j|j |jt juS|j |jy |jjsy|jj|jk7ry|jjdtk7ry|jjdtk7ryt|jjd}t|j}|||k7ryt|jdd}t!|sy|}t|jd|k7ryt#dj%|jj'S#t(j*t(j,t(j.f$rYywxYw) zERevalidate the same process instance before every destructive action.NFkindboot_idhomeenviron HERMES_HOME )rDrEr7rB_record_matches_live_gatewayr$rrrC is_running create_timeget _GATEWAY_KIND_get_boot_identity_canonical_homer+callablelooks_like_gateway_command_linejoincmdlinepsutil AccessDenied NoSuchProcess ZombieProcess)self record_homerErJ environments r#is_validzGatewayProcessHandle.is_validls ;; $"4"4"<77$&B$,,d*B B 77 ,KK4+=+=#(()  << 4#;#;#C <<**,||'')T-E-EE{{v&-7{{y)-?-AA)$++//&*ABK+D,>,>?M"k]&BdllIt-O2388DLL&G %AG &"G $G .1G 2HHr9c|js td|jt|j|y|j td|t j k(r|jjy|tt ddk(r|jjy|jj|y)Nz gateway process identity changedz%gateway process handle is unavailableSIGKILL) r_r0r7r?rBr<SIGTERM terminater+kill send_signal)r\r9s r#rez GatewayProcessHandle.send_signals}}<= = 77  tww ,  << AB B &.. LL " " $ GFIt4 4 LL    LL $ $S )r"timeoutcN|j2tj|jggg|\}}}t|S|jy |jj |y#t j $rYyt jt jf$rYywxYw)NF)rfT) r7selectboolrBwaitrXTimeoutExpiredrZr[)r\rfready_s r# wait_for_exitz"GatewayProcessHandle.wait_for_exits 77  -- 2r7CKE1a;  <<   LL  g  .$$ $$f&:&:;  s A**B$?"B$#B$c||jy tj|jy#t$rYywxYwN)r7r,closer0)r\s r#rqzGatewayProcessHandle.closes5 77?   HHTWW    s / ;;r%N)rrrrint__annotations__r7rBrXProcessrCfloatrDdictrErrir_rernrqr!r"r#rArAasH HBd %)GV^^d ")(,,FD4K!%M4$;%"$"H *s *t * U t r"rAc t}|dz S)z@Return the path to the gateway PID file, respecting HERMES_HOME.rrrIs r# _get_pid_pathrzs  D - r"pid_pathcV||jtSt}|tz S)z1Return the path to the runtime gateway lock file.) with_name_GATEWAY_LOCK_FILENAMEr )r{rIs r#_get_gateway_lock_pathrs.!!"899  D ( ((r"c<tjtS)z5Return the persisted runtime health/status file path.)rzr}_RUNTIME_STATUS_FILEr!r"r#_get_runtime_status_pathrs ? $ $%9 ::r"ctjd}|r t|Sttjdtjdz dz }|dz tz S)zBReturn the machine-local directory for token-scoped gateway locks.HERMES_GATEWAY_LOCK_DIRXDG_STATE_HOMEz.localstatehermes)r,getenvrrI_LOCKS_DIRNAME)override state_homes r# _get_lock_dirrsTyy23HH~bii 0$))+2H72RSTJ  > 11r"cdtjtjj Srp)rnowrutc isoformatr!r"r# _utc_now_isors << % / / 11r"pathc&|jtvSrp)name_AUTHORITY_FILENAMESrs r#_is_authority_pathrs 99, ,,r"c Rtj|j}tj|j stj |j s tdtj|jtjttddzS)zDOpen the configured authority directory without accepting a symlink.z"unsafe gateway authority directory O_DIRECTORYr) r,lstatparentstatS_ISLNKst_modeS_ISDIRr0openO_RDONLYr+)rinfos r#_authority_parent_fdrsf 88DKK D ||DLL!dll)C:;; 774;; gb-.K K LLr"cVttdd} tj|}t j |jrB||j|k7s1|jdk7s"t j|jdk7ry|S#t$rYyt$rYywxYw)zCReturn a safe authority-file stat without following its final link.getuidcyrpr!r!r"r#z!_authority_stat..r"N) r+r,rFileNotFoundErrorr0rS_ISREGrst_uidst_nlinkS_IMODE)r current_uidrs r#_authority_statrs5'"h 57Kxx~ LL &  # {(B ==A  << % . K  sB B(B('B(flagsct|} |ttddz}|tjzr$tj|j |d|}n"tj|j ||}tj |tj|}ttdd}tj|jrB||j|k7s1|jdk7s"tj|jdk7r tj |td|S#tj |wxYw) z@Open one private regular authority file without following links. O_NOFOLLOWrrdir_fdrcyrpr!r!r"r#rz!_authority_open..rr"runsafe gateway authority file)rr+r,O_CREATrrrqfstatrrrrrrr0)rr parent_fd open_flagsr7rrs r#_authority_openrs$T*IWRq99 2:: JiHBJyAB  88B>Epayloadc b|jjddt|}|jr | t dt |}d|j dtjdtjdd}d} tj|tjtjztjzttdd zd | }tj |d d 5}d}t#j$||dd|j'tj(|j+dddtj,||j ||tj(| |tj2|tj2|y#1swYoxYw#t.$r) tj0|| #t$rYwxYwwxYw#|tj2|tj2|wxYw)zCAtomically replace a private authority file without path following.Tparentsexist_okNr.z.tmprrrrwutf-8encoding,:)indent separators) src_dir_fd dst_dir_fd)rmkdirrexistsr0rrr,getpidsecrets token_hexrrO_EXCLO_WRONLYr+fdopenjsondumpflushfsyncfilenoreplace BaseExceptionunlinkrq)rrexistingrtemporary_namer7handles r#_write_authority_jsonr sKKdT2t$H {{})566$T*I 1RYY[M73D3DQ3G2HMN B WW  JJ "R[[ 072|Q3O O    YYr3 1VB IIgvdz J LLN HHV]]_ % 2  II    > HHRL +2 1   IInY 7      > HHRL sWA3G AF?AG ?GG G=G-,G=- G96G=8G99G==H.H.ct|yt|} tj|j|tj |tj |y#tj |wxYw)z7Remove only a validated private regular authority file.Nr)rrr,rrrrq)rrs r#_unlink_authority_filer6sVt$$T*I $))I.  s 6A%%A<F)forcerc|r|trv tjddt|ddgddd}|jd k7r>|jxs|jxsd j}t|xsd |y|stjnttd tj}t j ||y#t$r't j |tjYywxYw) zTerminate a PID with platform-appropriate force semantics. POSIX uses SIGTERM/SIGKILL. Windows uses taskkill /T /F for true force-kill because os.kill(..., SIGTERM) is not equivalent to a tree-killing hard stop. taskkillz/PIDz/Tz/FT capture_outputtextrfNrztaskkill failed for PID ra) _IS_WINDOWS subprocessrunstrrr,rdr<rb returncodestderrstdoutstripr0r+)r$rr>detailsr9s r# terminate_pidrBs   ^^VSXtT:# F    !}}; ;BBDG'E'?u%EF F %&..769fnn+UCGGC!  GGC (  s'C-C76C7identitycltj|jdjddS)Nr)hashlibsha256encode hexdigest)rs r# _scope_hashr]s* >>(//'2 3 = = ? DDr"scopec:t|dt|dz S)N-z.lock)rr)rrs r#_get_scope_lock_pathras" ?wa H(='>eD DDr"cBtd|d} t|jdjdS#tt t ttf$rYnwxYw ddl }t|j|jdzS#t$rYywxYw) z:Return the kernel start time for a process when available./proc/z/statrrrNi@B) rrs read_textsplitr IndexErrorPermissionError ValueErrorr0rXrurO Exception)r$ stat_pathrXs r#_get_process_start_timeresvcU%()I 9&&&8>>@DEE z?J P   >6>>#&224y@AA s!+=AA"/B BBc tdjdj}|r|S ddl}d|jdS#ttt t f$rY5wxYw#t$rYywxYw)z5Return a host-boot identity for PID-reuse validation.z/proc/sys/kernel/random/boot_idrrrNz boot-time:z.6f) rrrrr r0UnicodeDecodeErrorrX boot_timer )rHrXs r#rRrRvs 89CCD %'  N  ,F,,.s344 9K L    s",A A) A&%A&) A54A5c|y tt|jjS#tt t tf$rYywxYwrp)rr expanduserresolver0 RuntimeError TypeErrorr rs r#rSrSsK |4:((*22455 \9j 9s/5AAcf td|dj}|jdD]a}|jds|j ddj dd }t|j jcS d d l }t|j|d d }t|r|j!d nd }|r't|j jSd S#ttttf$rYwxYw#t"$rYy wxYw)zHReturn a live process's HERMES_HOME, or None when it cannot be verified.rz/environs HERMES_HOME==rstricterrorsrNrJrK)r read_bytesrr/ partitiondecoderrrr r0rrXr+rurTrPr )r$rawentryvaluerXrJs r#_read_process_homer$s VC5)*557YYw'E0-a0777QE{--/7799(.&..-y$?080A m,t5:tE{%%'//1DD 9K L    s8ADA DDA,D$D$D! D!$ D0/D0ct|S)zBPublic wrapper for retrieving a process start time when available.)r)r$s r#get_process_start_timer&s "3 ''r"ctd|d} |j}|r1|jddjddj S tjdd t|d d gd d d }|jdk(r4|jj r|jj S ddl}|j|}|j!}|rdj#|S y#t t tf$rYwxYw#ttjf$rYqwxYw#t$$rYywxYw)zReturn the process command line as a space-separated string. On Linux, reads /proc//cmdline directly. On macOS and other platforms without /proc, falls back to ``ps -p -o command=``. On Windows (no /proc, no ps), uses psutil. rz/cmdliner rignorerps-pz-ozcommand=TrrNrL)rrrr rrr r0rrrrrrkrXrurWrVr )r$ cmdline_pathr!r>rXproc cmdline_partss r#_read_process_cmdliner0sH&X./LW%%' ;;w-44WX4NTTV V   4S4 4      !fmm&9&9&;==&&( (  v~~c"  88M* *  9  8    Z.. /       s6C;A)D8D4;DDD10D14 E?Ecommandc|sy tj|d}|Dcgc]1}|jdj ddj 3}}|sy|D]5}|dk(s|j dry|jdd d }|d vs5yd j|}d |vxsd|vxstd|D}|syg}d} |D]B}| rd} |dvrd} |jds|jdr2|j|Dt|D]*\} }|dk7r | d zt|k\ry|| d zdk(cSy#t$r|j}YKwxYwcc}w)amReturn True only for a real ``gateway run`` process command line. Lifecycle decisions (is the gateway up? did restart relaunch it?) must not fire on loose substring matches. The previous ``"... gateway" in cmdline`` test also matched ``hermes_cli.main gateway status`` and even unrelated processes like ``python -m tui_gateway`` -- which made ``restart()`` race against a still-draining old process and ``status``/``start`` report false positives. This requires the actual ``gateway`` subcommand followed by ``run`` (or one of the gateway-dedicated entrypoints), excluding the other ``gateway`` management subcommands and any process that merely contains the word "gateway". Tokenizes quote-aware (``shlex``) so quoted Windows paths with spaces (``"C:\Program Files\...\hermes-gateway.exe"``) survive, and strips ``--profile``/``-p`` selectors from anywhere in argv -- Hermes's ``_apply_profile_override`` removes them before argparse, so the profile flag (and a profile literally named ``gateway``) can legally appear on either side of the ``gateway`` subcommand. F)posixz"'\/zgateway/run.pyz/gateway/run.pyTr)rzhermes-gateway.exerLzhermes_cli.mainzhermes_cli/main.pyc3JK|]}|jddddvyw)r5rr6)rz hermes.exeN)rsplit).0ts r# z2looks_like_gateway_command_line..s'PAqxxQ#'??s!#)z --profiler+z --profile=z-p=gatewayr)shlexrr rrlowerendswithr8rVanyr/append enumeratelen) r1 raw_tokensr:tokenstokenbasenamejoinedhas_gateway_entryfiltered skip_nextis r#rUrUs( %[[6 BL LAaggen$$T3/557F L  $ $7H(I<<Q'+ ? ? XXf FV# Q 6 ) Q PP P  HI I  ' 'I    L )U-=-=e-D h'5 I   q5CM !A%'' ( ] %]]_ %MsE 6E+ E('E(c4t|}|syt|S)zBReturn True when the live PID still looks like the Hermes gateway.F)r0rU)r$rWs r#_looks_like_gateway_processrNs#C(G  *7 33r"rDc|jdtk7ry|jd}t|tr|sydj d|D}t |S)zMValidate gateway identity from PID-file metadata when cmdline is unavailable.rGFargvrLc32K|]}t|ywrp)r)r9parts r#r;z-_record_looks_like_gateway..0s2TTs4yTs)rPrQ isinstancelistrVrU)rDrPrWs r#_record_looks_like_gatewayrU'sR zz&]* ::f D dD !hh2T22G *7 33r"rEc||jdtk7rtjSt |stjS|jd}t |}|tjS|tj S||k7rtjS|jd}t}t|tr|stjS|tj S||k7rtjSt|jd}t|}tt|} ||tjS| tj S||k7s| |k7rtjSt|} | tj St| rtjStjS)aUReturn whether *record* names this exact live gateway process. PID liveness alone is not process identity: PIDs are reused, a generic gateway command can belong to another profile, and kernel start counters reset at reboot. All four identity fields must agree before lifecycle commands may report or signal the process. rG start_timerHrI)rPrQrr _pid_existsrr rRrSrrSr$r0rUr) rDr$rErecorded_start current_start recorded_boot current_bootr]expected_home_value live_home live_commands r#rMrM4szz&]*''' s '''ZZ -N+C0M'''&&&&'''JJy)M%'L mS )'''&&& $'''!&**V"45K)-8 23 78I19'''&&&))Y:M-M'''(-L&&& +< 8  % %r")rEc|xs t}|xs |j}t|jt|k7ryt|}t |syt |t |fD]}t|tst|}|"tjjdr@ t|t|||}|%|j!r|cS|j# t%j&|}t|||j)||}|j!s|cSy#t$rd}YwxYw#t$j*t$j,t$j.f$rYwxYw)a*Open a stable handle for this profile's verified gateway, if supported. A pidfd binds signalling to the process instance opened before the final metadata check. Platforms without an equivalent stable handle fail closed rather than falling back to a validate-then-``os.kill`` race. Nr()r$r7rDrE)r$rBrCrDrE)rzrrSris_gateway_runtime_lock_active_read_pid_record_read_gateway_lock_recordrSrw_pid_from_recordr-r.r/rAr8r0r_rqrXrurOrYrZr[) r{rEresolved_pid_path resolved_home lock_pathrDr$rrBs r#open_running_gateway_processrhksx!3MO!=%6%=%=M(//0OM4RR&'89I )) 4 *+!),&$' v& ;  << " "7 + -"3'!"/ !??$!M  nnS)G)$+$7$7$9+ F ?? MIJ )   ##V%9%96;O;OP   s$0D:03E : EE 2FFc tjtttj t tjtttdS)N)r$rGrPrWrHrI) r,rrQrTr-rPrrRrSr r!r"r#_build_pid_recordrjsByy{SXX-biik:%' 12  r"c Zt}|jdddditd|S)NstartingFr) gateway_state exit_reasonrestart_requested active_agents platforms updated_at)rjupdater)rs r#_build_runtime_status_recordrts6!G NN#""n  Nr"c t|r[t|tj} tj|dd5}|j j }dddn |jdj }sy tj|}t|t r|SdS#1swYWxYw#t$rwxYw#tttf$rYywxYw#tj$rYywxYw)Nrrr)rrr,rrreadrr rrr0rrloadsJSONDecodeErrorrSrw)rr7rr!rs r#_read_json_filerzs  d # r{{3B YYr39V ++---/C: ..'.288:C **S/!$/79T9!:9   w(: ;   sR%CCB5C'!C C)5B>:C C  CC&%C&)C?>C?cTt|r t||yt||dddy)Nrrr)rrmode)rrr )rrs r#_write_json_filer}s.$dG,   r"c0t|xs tS)zNRead only validated JSON authority records; legacy numeric PIDs lack identity.)rzrzr{s r#rbrbs 86} 77r"rgc0t|xs tSrp)rbr)rgs r#rcrcs IA)?)A BBr"cZ|sy t|dS#tttf$rYywxYw)Nr$)rsKeyErrorrr )rDs r#rdrds5 6%=!! i ,s ** cleanup_stalec|sy t| tt|y#t$rY!wxYw#t$rYywxYw)aDelete a stale gateway PID file (and its sibling lock metadata). Called from ``get_running_pid()`` after the runtime lock has already been confirmed inactive, so the on-disk metadata is known to belong to a dead process. Unlike ``remove_pid_file()`` (which defensively refuses to delete a PID file whose ``pid`` field differs from ``os.getpid()`` to protect ``--replace`` handoffs), this path force-unlinks both files so the next startup sees a clean slate. N)rr rr{rs r#_cleanup_invalid_pid_pathrsQ  x( 5h?@        s &5 22 AAc|jd|jtjt ||j  t j|jy#t$rYywxYw)Nr) seektruncaterrrjrr,rrr0rs r#_write_gateway_lock_recordr s[ KKN OOII!6* LLN  !    s#A55 BBc tr|jdtj|j dk(r!|j d|j |jttj|jtjdytj|jtjtjzy#t t"f$rYywxYw)Nr rTF)rrr,SEEK_ENDtellwriter_WINDOWS_LOCK_OFFSETmsvcrtlockingrLK_NBLCKfcntlflockLOCK_EXLOCK_NBBlockingIOErrorr0rs r#_try_acquire_file_lockrs   KK2;; '{{}! T"  KK, - NN6==?FOOQ ? KK )F G W %sB"C)%AC))C;:C;c ddl}t|jt|S#t$rYnwxYwt r ddl}|jj}|j|j_ |j|j_ |j|j_ d}d}d}d}d}|j||zdt|} | s|j} | |k(ry| |k(ry y |j| d} | |k(|j| S#|j| wxYw#t t"f$rYywxYw t%j&t|dy #t($rYyt*$rYy t $rYywxYw) uCross-platform "is this PID alive" check that does NOT kill the target. CRITICAL on Windows: Python's ``os.kill(pid, 0)`` is NOT a no-op like it is on POSIX. CPython's Windows implementation (``Modules/posixmodule.c::os_kill_impl``) treats ``sig=0`` as ``CTRL_C_EVENT`` because the two values collide at the C level, and routes it through ``GenerateConsoleCtrlEvent(0, pid)`` — which sends a Ctrl+C to the entire console process group containing the target PID, not just the PID itself. Any caller that wanted to "check if this PID is alive" via ``os.kill(pid, 0)`` on Windows was silently killing that process (and often unrelated processes in the same console group). Long-standing Python quirk; see bpo-14484. Implementation: prefer :mod:`psutil` (hard dependency — the canonical cross-platform answer, maintained by Giampaolo Rodolà, uses ``OpenProcess + GetExitCodeProcess`` on Windows internally). Fall back to a hand-rolled ctypes ``OpenProcess`` / ``WaitForSingleObject`` pair on Windows + ``os.kill(pid, 0)`` on POSIX if psutil is somehow unavailable — e.g. stripped-down install or import error during the scaffold phase before ``psutil`` is pip-installed. rNiriWr,FT)rXri pid_existsrs ImportErrorrr1windllkernel32c_void_p OpenProcessrestypec_uintWaitForSingleObject GetLastError CloseHandler0AttributeErrorr,rdProcessLookupErrorr ) r$rXr1r!PROCESS_QUERY_LIMITED_INFORMATION SYNCHRONIZE WAIT_TIMEOUTERROR_INVALID_PARAMETERERROR_ACCESS_DENIEDrerr wait_results r#rXrX&s, %F%%c#h/00      }}--H,2??H (39==H ( ( 0,2MMH ! ! )06 -"K%L&( #"# ))1K?CF++-11 -- -&::61E #l2$$V,$$V,(    GGCHa !    s['* 66B+D3-D35D D3D00D33EE E)) F 4F >F F c& trI|jttj|j tj dytj|j tjy#t$rYywxYw)Nr) rrrrrrLK_UNLCKrrLOCK_UNr0rs r#_release_file_lockrqs[  KK, - NN6==?FOOQ ? KK  7    sAB2B BBcTtyt}|jjdd t j t |tjtjzdd}t|s|jyt||ay#t$rYywxYw)zClaim the cross-process runtime lock for the gateway. Unlike the PID file, the lock is owned by the live process itself. If the process dies abruptly, the OS releases the lock automatically. Trr+rrF) _gateway_lock_handlerrrr,rrO_RDWRrr0rrqr)rrs r#acquire_gateway_runtime_lockr|s' ! #DKKdT2?4RZZ1GH$Y`a "& ) v&!  sAB B'&B'cpt}|ydat| |jy#t$rYywxYw)z&<&>',>BXBZ,Z)*2"((*M.@.K.K.MM?+=ryyI4Zab  !& ) v &  LLN  LLN    w     LLN   sf0B>C+C -C> C  C  CC C('C(+D -C>=D > D D  D  D c t}|jjddtjt }t |} tj|jtjtjztjzttddzd|} tj |dd 5}|j#||j%tj&|j)d d d tj&| tj|y #t$rtj|wxYw#1swYXxYw#t*$r3 tj,|j|#t.$rYwxYwwxYw#tj|wxYw) zWrite the current process PID and metadata to the gateway PID file. Uses atomic O_CREAT | O_EXCL creation so that concurrent --replace invocations race: exactly one process wins and the rest get FileExistsError. TrrrrrrrrN)rzrrrdumpsrjrr,rrrrrr+FileExistsErrorrqrrrrrr rr0)rrDrr7fs r#write_pid_filers^ ?DKKdT2 ZZ)+ ,F$T*I  WW II JJ "R[[ 072|Q3O O     YYr3 1Q GGFO GGI HHQXXZ 2  !   2 1   IIdii 2      sbA%E7E7AE+E7 E(+E40E77 F3!F#"F3# F/,F3.F//F33F66G ) rmrnrorpr.platform_state error_code error_messageserved_profilesrmrnrorpr.rrrrc t} t| xs t} t} | j di| d| d<| d| d<| d| d<| d| d<| d| d<| d| d<t | d<|t ur|| d <|t ur|| d <|t urt|| d <|t urtd t|| d <|t urt|xsg| d<|t urQ| dj|i} |t ur|| d<|t ur|| d<|t ur|| d<t | d<| | d|<t| | y)zBPersist gateway runtime health information for diagnostics/status.rqrGr$rPrWrHrIrrrmrnrorrprrrrN) rrzrtrj setdefaultr_UNSETrimaxrsrTrPr}) rmrnrorpr.rrrrrrcurrent_recordplatform_payloads r#write_runtime_statusrs $ %Dd#E'C'EG&(N {B'$V,GFO#E*GEN$V,GFO*<8GL' 2GI$V,GFO(NGLF"#0 & !, &'+,='>#$F"#&q#m*<#= f$&*/*?R%@!"v";/33HbA  '(6 W % V #-7 \ *  &0= _ -)5&)9 X&T7#r"c|jd}|dvr|S|js|St|}|t|}d|d<|St |}t |r|St |sGt|}d|d<d|d<t|d< tt||t|d |St|||j}|tjurt|}d|d<|S|S#t$r}td |d}~wwxYw) azReconcile a conclusively dead gateway without trusting its finalizer. SIGKILL and a host crash prevent the gateway from writing its own terminal record. The first observer, while the runtime lock is inactive, is the authority that writes ``stopped``. An unreadable or live-but-mismatched identity is deliberately preserved and surfaced as degraded instead. rm>Nstoppedstartup_failedNdegradedrunexpected_exitrnrrz.unable to reconcile dead gateway runtime stateTr)rPrrdrwrrarXrr}%_get_runtime_status_path_for_pid_pathr0rrMrrr) rr{rmr$observedrg reconciledexcrs r#_observe_runtime_statusrs(KK0M;; ??  7 #C {=$.!&x0I%i0 s '] &/ ?#$5 =!#/> <  U B8Lj Y "($?+GS(//JH,,,=$.! N UJKQT T UsC00 D 9 DD c,|jtSrp)r}rrs r#rrGs   2 33r"c^t}tt|}|yt||S)zCRead runtime status and reconcile only a conclusively dead gateway.Nr)rzrzrr)r{rs r#read_runtime_statusrKs.HCHMNG "7X >>r"runtimec||n t}t|tsy|jd}|dvry|dk(rI|jdxsijd}t|tr|jddk7ryt |}|yt ||t jtjur|Sy) aReturn a live gateway PID from the runtime status record, if valid. ``get_running_pid()`` is the primary liveness source because it verifies the runtime lock and PID file. Launch-service managers can still leave us with a live process and a fresh ``gateway_state.json`` but no ``gateway.pid``; use this as a conservative fallback only after validating the full process and profile identity tuple. Nrm>Nrrrunningrqtelegramr connected) rrSrwrPrdrMrzrrr)rrrmrr$s r#get_runtime_status_running_pidrTs!,g2E2GG gt $KK0M;; !KK ,277 C h %(,,w*?;*N 7 #C {#GS-/2H2HI_MbMbb r"c t}t|}|) t|d}||t jk7ry|jdy#ttt f$rd}YEwxYw#t$rYywxYw)ahRemove the gateway PID file, but only if it belongs to this process. During --replace handoffs, the old process's atexit handler can fire AFTER the new process has written its own PID file. Blindly removing the file would delete the new process's record, leaving the gateway running with no PID file (invisible to ``get_running_pid()``). Nr$T missing_ok) rzrzrsrrr r,rrr )rrDfile_pids r#remove_pid_filerrs   &   ve}-#BIIK(? t $ i4     s9A1AA1A1A.+A1-A..A11 A=<A=metadatact||}|jjddit|t ||xsit d}t |}|#|jr |jd|r t|d}|tjk(r3|j!d|j!dk(rt#||d|fS|du}|t%|sd}nt'|}|j!d|||j!dk7rd}|s8|j!d'|%t)|st+|} | t-|sd}|s-|j!d|t)|st+|} | d}|sq t/d|d } | jrQ| j1d j3D].} | j5d s| j7d } | dvrd}n|r |jdnd|fS tj:|tj<tj>ztj@zd} tjD| dd 5}tGjH||dddy#t$rY)wxYw#tttf$rd}Y4wxYw#tt8f$rYwxYw#t$rYwxYw#tB$rdt |fcYSwxYw#1swYyxYw#tJ$r$ |jd#t$rYwxYwwxYw)zAcquire a machine-local lock keyed by scope + identity. Used to prevent multiple local gateways from using the same external identity at once (e.g. the same Telegram bot token across different HERMES_HOME dirs). Tr)r identity_hashrrrNrr$rWrz/statusrrzState:r>Tr:Frr)TN)&rrrrjrrrzrrr0rsrrr r,rrPr}rXrrNr0rUrr splitlinesr/rr rrrrrrrrr )rrrrgrDr existing_pidstalerZ live_cmdline _proc_status_line_stater7rs r#acquire_scoped_lockrso %UH5I 4$7  $X.N"n Fy)HI,,.       - x/L 299; &8<< +ET`Ia+a Y /> !$  #|, 7 E LL.:%1%l)CC E \2:%-7 E#8#FL#/7QRZ7[ $ \2>%17 E#8#FL#/ $ '+f\N',J'K '..0)5)?)?)?)Q)\)\)^#(#3#3H#=-2[[]1-=F'-';04$) *_    D 1(? "1 WWY RYY 6 De L YYr3 1V IIff %2 w    )Z0 L ~$_5    1oi00012        -     s0JJ/AK (K K!AK0'L?L L J,+J,/K K  KK! K-,K-0L L  LLL M"L54M5 M>MMMc*t||}t|}|sy|jdtjk7ry|jdt tjk7ry |j dy#t$rYywxYw)zDRelease a previously-acquired scope lock when owned by this process.Nr$rWTr)rrzrPr,rrrr0)rrrgrs r#release_scoped_lockrs$UH5Iy)H ||Ebiik)||L!%+E#~5  t $ NW i ,  KK4K (      <   N sNAC!"D D-!D6D  DDDD D*)D*- D:9D:rc t|}||ttjt d}t t |y#ttf$rYywxYw)aRecord that ``target_pid`` is being replaced by the current process. Captures the target's ``start_time`` so that PID reuse after the target exits cannot later match the marker. Also records the replacer's PID and a UTC timestamp for TTL-based staleness checks. Returns True on successful write, False on any failure. The caller should proceed with the SIGTERM even if the write fails (the marker is a best-effort signal, not a correctness requirement). )rrr replacer_pidrTF) rrRr,rrr}rr0r rrrDs r#write_takeover_markerrs] 3J?$!202IIK&.   24f= _ %A A AAc:ttdddtS)aCheck & unlink the takeover marker if it names the current process. Returns True only when a valid (non-stale) marker names this PID + start_time. A returning True indicates the current SIGTERM is a planned --replace takeover; the caller should exit 0 instead of signalling ``_signal_initiated_shutdown``. Always unlinks the marker on match (and on detected staleness) so subsequent unrelated signals don't re-trigger. rrrrrrr)rr_TAKEOVER_MARKER_TTL_Sr!r"r# consume_takeover_marker_for_selfr#s# (!#,&$  r"cX tjdy#t$rYywxYw)zDRemove the takeover marker unconditionally. Safe to call repeatedly.TrN)rrr0r!r"r#clear_takeover_markerr%s- !#**d*;     ))c t|}||ttjt d}t t |y#ttf$rYywxYw)a&Record that ``target_pid`` is being stopped intentionally. The gateway exits non-zero for unexpected SIGTERM so service managers can revive it. Service stop commands send the same SIGTERM, so the CLI writes this short-lived marker first to let the target process exit cleanly. )rrr stopper_pidrTF) rrRr,rrr}rr0r rs r#write_planned_stop_markerr)s] 3J?$!20299;&.   68&A _ %rc:ttdddtS)zDReturn True when the current process is being intentionally stopped.rrrr!)rr_PLANNED_STOP_MARKER_TTL_Sr!r"r#$consume_planned_stop_marker_for_selfr,s! '%',&(  r"ct}t|}|sy t|d}|jd}|jd}|jdxsd}t|tr |jdytj}||k7ryt|}t}t|t r|r||k7r |jdy||||k(Sy#tt t f$r& |jdYy#t$rYYywxYwwxYw#t$rYywxYw#t$rYywxYw) ueReturn True only when a live planned-stop marker names the current process. This is a **non-destructive** probe used by the watcher thread (``gateway/run.py:_run_planned_stop_watcher``) to decide whether to trigger shutdown. Unlike :func:`consume_planned_stop_marker_for_self`, it never unlinks a marker that matches us — the shutdown handler does the authoritative consume on its own thread. It *does* clean up markers that can never apply to this process: malformed markers and markers older than the TTL are unlinked so a stale file left behind by a previous gateway instance cannot wedge the new one. Markers naming a different PID/start_time are left in place (they may still be consumed legitimately by the process they name) but report False here. Returns False (without raising) on any read/parse error. FrrrrrTr)rrzrsrPrrr rr0rr+r,rrrRrSr) rrDrrrrrrrs r# planned_stop_marker_targets_selfr.sk$ ) *D T "F   -. "JJ':;$45ZZ -3  $>?  KK4K (iikGW-W5N$&K ~s + [ (  KK4K ($)C N22 W i ,  KK4K (       2   sNAC'0D$ D3'D!<D DD!DD!$ D0/D03 D?>D?cX tjdy#t$rYywxYw)z/Remove the planned-stop marker unconditionally.TrN)rrr0r!r"r#clear_planned_stop_markerr0Ns- %'..$.?    r&Trc|xs t}t|}t|}t|}t |}d}||fD]e}t |t st|} | "t|| |j} |r| tjur| cS| tjusdd}g|s#tt|} | t| ||s|s| t!||y)zReturn the PID of a running gateway instance, or ``None``. Checks the PID file and verifies the process is actually alive. Cleans up stale PID files automatically. FNTrr)rzrrarbrcrSrwrdrMrrrr rzrrr) r{rrer lock_activeprimary_recordfallback_recordidentity_unknownrDr$rrs r#get_running_pidr6Vs!3MO/0AB01CDK%&78N/0BCO!?3&$' v& ; /=N=U=UV 8'<'<<J .. .# 4 !"GHY"Z[   #G6G H /N4N!"3=Q r"c t||duS)z1Check if the gateway daemon is currently running.rN)r6rs r#is_gateway_runningr8s 8= A MMr"rprr)urrrr,r=r<rhrrrrXr- dataclassesrrrenumrpathlibrhermes_constantsr typingr r utilsr r.rrrQrrrobjectrr~rrrrrrsr8r?rArzrrrrrirr stat_resultrrrwrrrrrrrRrSr$r&r0rUrNrUrMrhrjrtrzr}rbrcrdrrrrXrrrrarrrrrrrtuplerrrrr"rr+rrrrrr#r%r)r,r.r0r6r8r!r"r#rBs    !', #<<7 + llg% '#c4 S S  F3 FS FT F QQ Qh t )Xd^)t);$; 2t22c2-T-d-MtMM$2>>D#8&$ss0&&tCH~&$&R  $ .3sdt6E#E#EEEsEtE#"HSM&#*t+ CHTN*(( ( &s&x}&RGS4ZGDGT4S4T4 4tCH~ 4$ 44 cN4 44 4p $8%)8tn8D>8"# 8v4 d38n :$:8DcN#;:0 4 $sCx. T 8x~8$8 C$C8DQTVYQYNC[CXd38n5(3-    ,  d  GSGTGV d0  htn8"N # !2$2$2$ 2$  2$  2$2$2$2$2$ 2$j, #s(^,, #s(^ ,^4D4T4?Xd38n5?)- d38n % c]< 0ssscsXd3PS8n=Usafgkmuvz{~AD|DwEnFhFbGsl  s  c  d  $ $&*-}-sm- -F5 <,4, 0t0 ST< << <  <  < <~cd4$( #$,dG$GT  $((tn((c] (X $NNtnNN Nr"