+ WjERt^RIHt^RIt^RIt^RIt^RIt^RIt^RIH t ]P!R4t Rt RRlt RR ltR R ltR R ltR7RR/RRllltRRltRRltRRltRRltRRltR]3R]3R]3R]33tR R!ltR"R#ltR$RR%R&/R'R(lltR)tR*R+ltR%R,/R-R.lltR%R&/R/R0lltR1R2lt R3R4lt!R5R6lt"R#)8a~Classic-CLI shutdown and one-shot finalize helpers: process session-id sync, deferred agent startup, exit watchdog, cleanup steps, session-finalize notifications and the terminal input-mode reset. Split out of ``cli.py``; ``cli`` re-exports every public name and moved bodies late-bind cli-level names through ``from cli import ...`` at call time so facade monkeypatch seams hold. ) annotationsN)suppressclic^RIpV#)z]Late import of the ``cli`` facade: mutable CLI module state (and its test seams) lives there.Nrrs KC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\cli_shutdown.py_clirs  Jc V^8dQhRRRR/#) session_idstrreturnNone)formats"r __annotate__rs''''r c"^RIHpV!V4R#)zCKeep process-local session-id consumers aligned after CLI switches.)set_current_session_idN)gateway.session_contextr)r rs& r_sync_process_session_idrs >:&r cV^8dQhRR/#r rrr)rs"rrr"s$r cl\\4;_uu_4\P!4RRR4\P \P 3F3p\\4;_uu_4VP4RRR4K5 R# +'giLi;i +'giK];i)zMBest-effort ``logging.shutdown()`` + stdout/stderr flush before ``os._exit``.N)r Exceptionloggingshutdownsysstdoutstderrflush)_streams r_flush_logging_and_stdior""sf )   JJ + i MMO! ,  ! sB0B" B " B3 c$V^8dQhRRRRRR/#)r namer defaultfloatrr)rs"rrr+s!S5Ur ct\\P!W44# \\3dTu#i;i)zB``float(os.getenv(name))``, or ``default`` when unset/unparseable.)r&osgetenv TypeError ValueError)r$r%s&&r _float_envr,+s4RYYt-.. z "s !77cV^8dQhRR/#)r rr&r)rs"rrr3s666r c ^RIHpV!RR4#)zC``HERMES_EXIT_WATCHDOG_S`` as a float (default 30; ``0`` disables).r,HERMES_EXIT_WATCHDOG_Sg>@)rr,r/s r_exit_watchdog_timeoutr13s . 55r from_signalFc$V^8dQhRRRRRR/#)r timeout_sz float | Noner2boolrrr)rs"rrr9s'*V*V,*Vt*VX\*Vr cXaaa^RIHpHoSfV!4oS^8:dR#\PP R4'dR#VVV3Rlp\ \4;_uu_4\P!VRRR7P4RRR4R# +'giR#;i)ugDaemon timer that ``os._exit(0)``s after ``timeout_s`` once shutdown has begun. Backstop for a cleanup step wedged on network I/O and for interpreter teardown blocked joining non-daemon threads (ThreadPoolExecutor's atexit join). The daemon timer survives ``Py_FinalizeEx``'s joins. ``HERMES_EXIT_WATCHDOG_S=0`` disables. 1. 2. Interpreter teardown blocked joining non-daemon threads — stdlib ``ThreadPoolExecutor`` workers are joined unconditionally by ``concurrent.futures``' atexit hook even after ``shutdown(wait=False)``, so one tool thread wedged on a socket held the process open forever (#27563 class). )r1r"NPYTEST_CURRENT_TESTc<\P!S4S'd\4P'dR#\P RS4S!4\\ 4;_uu_4^RIH pV!RR7RRR4\P!^4R# \ dL[i;i +'giL9;i)NuiExit watchdog fired after %.0fs — forcing process exit (a cleanup step or non-daemon thread is wedged).)kill_live_foreground_processesT)now) timesleepr_cleanup_in_progressloggerwarningrrtools.environments.baser9r(_exit)r9r"r2r4s r _watchdog%_arm_exit_watchdog.._watchdogMs 9 46666   NNC  !" i N *t 4!     ! sB!1B2! B/.B/2 C Tz exit-watchdog)targetdaemonr$) rr1r"r(environgetrr threadingThreadstart)r4r2r1rBr"sfd @r_arm_exit_watchdogrK9stE*, A~ zz~~+,,* )   $_MSSU    s &(B B) cV^8dQhRR/#rr)rs"rrrfs))d)r c4V'd\VR4'gR#\VRR4pVeE\VR4'd3\\4;_uu_4VP ^ R7RRR4\VRR4p\VRR4;'gRp\ V\ 4'd4\PR V\V44VPV4R#\PR V4VP4R# +'giL;i) zVMemory-provider shutdown (on_session_end + shutdown_all) at the real session boundary.shutdown_memory_providerN_memory_manager flush_pending)timeout_session_messagesr zECLI cleanup calling memory shutdown for session %s with %d message(s)zOCLI cleanup calling memory shutdown for session %s without session message list) hasattrgetattrrrrP isinstancelistr>infolenrN)agent_mm _session_msgs_sids& r_shutdown_agent_memory_providerr^fs ge%?@@ %*D 1C 7388 i   b  )!E#6=M 5, - < <D-&& []acfgtcuv &&}5 egkl &&(! s D D cV^8dQhRR/#rr)rs"rrrs55T5r cx^RIHp\4PeV!\4PR7R#R#)stop_listeningN)owner)tools.wake_wordrcr_cli_wake_ownerrbs r_stop_cli_wake_wordrgs(. v)TV334*r cV^8dQhRR/#rr)rs"rrrs))d)r c$^RIHpV!RR7R#)ra interrupt_allz CLI shutdown)reasonN)tools.async_delegationrkrjs r_interrupt_async_delegationsrns 4(r cV^8dQhRR/#rr)rs"rrrstr c ^RIHpV!4R#)rashutdown_mcp_serversN)tools.mcp_tool_lifecyclerrrqs r_shutdown_mcp_serversrts =r cV^8dQhRR/#rr)rs"rrrsdr c ^RIHpV!4R#)rashutdown_cached_clientsN)agent.auxiliary_clientrxrws r_shutdown_cached_aux_clientsrzs >r rg_cleanup_all_terminals_cleanup_all_browsersrzcV^8dQhRR/#)r rr5r)rs"rrrs+++r c$^RIHp\W4#)zA gateway-backed session ends in the gateway: the viewer's ``end_session`` (``session.detach {end_reason}``) makes the owner run finalize and the memory commit (gateway/session_viewer_close).) GatewayAgent)hermes_cli.gateway_agentrrV)rZrs& r_gateway_owns_session_endrs6 e **r c V^8dQhRRRR/#)r r str | Nonerr5r)rs"rrrs Q Qj QT Qr c\\4P4'dR#VeV\4P9dR#\4P'gR#VfR#V\4P9#)FT)rr_active_agent_ref_handed_off_session_ids,_single_query_finalize_attempted_session_ids)r s&r%_should_emit_cleanup_session_finalizers_ !9!9::*0N0N"N 6 > > > TVPP PPr platformrlrc(V^8dQhRRRRRRRR/#)r r rrr rlrz list[str]r)rs"rrrs*J#WZlur c \\4;_uu_4^RIHpHpV!V!WVR74uuRRR4# +'gi.#;i)zWFire on_session_finalize; return the plugin messages meant for the user (never raises).)finalize_sessionsession_end_messagesr rrlN)rrhermes_cli.lifecyclerr)r rrlrrs$$$ r_notify_session_finalizers7 )  O#$4 fl$mn     Is ; A cd\VRR4pT\VRR4;'g\VRR43#)zO``(agent, session_id)`` for a one-shot run; the agent's id wins over the CLI's.rZNr )rU)rrZs& r_oneshot_agent_and_sessionrs6 C$ 'E '%t4XX\SW8X XXr c V^8dQhRRRR/#r rlr rrr)rs"rrrs  s PT r c \\4;_uu_4^RIHpT!R RTRRRRR\ VRR4R \ VR R4;'gR R V/VBRRR4R# +'giR#;i) zHBest-effort ``on_session_end`` hook for a turn cut short (never raises).) invoke_hookr completedF interruptedTmodelNrrrl)on_session_end)rrrrrU)rZr rlextra _invoke_hooks&&&, r_invoke_interrupted_session_endrs )  D )3 ?D RV %$/ :A%UY:Z:c:c^c  #     s ;A A. keyboard_interruptc V^8dQhRRRR/#rr)rs"rrrs#QUr c P^RIHpHpV!V4wrEVfR#\\4;_uu_4VP VP RR44RRR4V\4P9g\V4'dR#V'd'\\4;_uu_4WPn RRR4T!YET\VRR4;'gR\VRR4;'gR\VRR4;'gRR 7R# +'giL;i +'giLq;i) zEBest-effort on_session_end hook for interrupted non-interactive runs.)rrN_ _current_task_id_current_turn_id_current_api_request_id)task_idturn_idapi_request_id) rrrrr interruptreplacerrrr rU)rrlrrrZr s&$ r_emit_interrupted_session_endrsO237E } )   sC01 TV3337PQV7W7W i 'N!$ 6126<<"126<<"u&?DJJ   ! s"D%D D  D% c V^8dQhRRRR/#rr)rs"rrrsLL#LtLr c^RIHpHpV!V4wrEV\4P9dR#V\4P 9g\ V4'dR#T!T\VRR4;'gRVR7Fp\V\PRR7K! \4PPV4R# \4PPT4i;i)ra)rrNrrrT)filer ) rrrrrrrrUprintrradd)rrlrrrZr messages&$ r%_notify_single_query_session_finalizersH237ETVHHHTV3337PQV7W7WL/%z40P0Y0YTYbhjG ' $ 7j ;;?? K;;?? KsC2,C%C(cV^8dQhRR/#rr)rs"rrrs)C)C$)Cr c^RIHpV!V4wr#Ve"V'dV\4P9dR#\ VRR4'dR#\ VRR4p\ V\ 4'd8V'd0\VR4'dVPV\ VRR44\ TR R4;'g\ TR R4pTfR#TP4TPTR 4R# \d\PRR R 7Lri;i \d\PR R R 7Lai;i \d\PRR R 7R#i;i)uDurably flush + finalize the one-shot session row before exit (idempotent, best-effort). One-shot runs get a single turn, so nothing retries a transiently-failed transcript flush, closes the session row, or drains token deltas the kanban ``os._exit(0)`` path skips. Handed-off sessions are left alone. - a turn whose in-loop ``_flush_messages_to_session_db`` failed under write-lock contention (e.g. a busy multiplex gateway sharing state.db) was silently lost — the reply reached stdout and agent.log but the resumed session's stored history never changed (#88583); - the resumed/created titled session row was left dangling open (``ended_at``/``end_reason`` NULL) on every one-shot exit; - queued async token-accounting deltas relied on interpreter-exit hooks, which the kanban SIGTERM path's ``os._exit(0)`` skips entirely. Idempotent and best-effort: ``_persist_session`` dedupes via the per-message ``_DB_PERSISTED_MARKER`` stamps (already-written turns are not re-written) and ``end_session`` no-ops on an already-ended row. See #88234. rN_persist_disabledFrR_persist_sessionconversation_historyz+one-shot final session persist retry failedTexc_info _session_dbz!one-shot token-count drain failed cli_closezone-shot end_session failed)rrrrrUrVrWrTrrr>debugflush_token_counts end_session)rrrZr msgsdbs& r_flush_one_shot_session_storersD"/237E }J*8V8V*Vu)511Su148 dD ! !dwu>P/Q/Q  " "46Ld)S T  t , Q Q]D0QB zI C z;/ S BT RS I 84 HI C 2T BCs<*C69/C6D"E6"DD"EE"E,+E,cV^8dQhRR/#rr)rs"rrr&s  T r c0^RIHp^RIHp\ VRR4'dR#V!V4wr4VP R4pVP R4'dC\PRT;'gRVP R 4VP R 44R#R#) aBounded linger for notify_on_complete background processes (children write to our pipes). Waits on the whole registry: a one-shot process hosts one agent, and task_id filtering would skip processes registered before the session id settled. Skipped when the quiet -Q notify-resume loop already consumed the run's linger budget: it calls wait_for_pending_completions with a shared deadline, so a re-wait here would double-block on the same stuck notify_on_complete child. See #90879. r)process_registry_quiet_notify_linger_doneFNwaitedz>One-shot exit linger for session %s: completed=%s timed_out=%srSr timed_out) rrtools.process_registryrrUwait_for_pending_completionsrGr>rX)rrr_agentrresults& r(_wait_for_oneshot_background_completionsr&s/7s/7705OF  : :4 @F zz( L  " "{ JJ{ # JJ{ #  r cV^8dQhRR/#rr)rs"rrrBs:0:04:0r c^RIp^RIHpHpHpHpHpV!V4V!V4T!\VRR4;'g VP4VP4V!V4V!R R 7R# \ d\PRRR7Lxi;i \ d\PRRR7Lpi;i TP4i;i \ d\PRRR7Li;i) uDSettle the session, then release its lease, then linger as a bystander. Three phases, in this order: 1. **Session-owned settlement** — the durable flush (transcript retry, token drain, ``end_session``), the finalize hook, and memory-provider session finalization. Providers finalize THIS session's remote state at ``on_session_end`` (OpenViking synchronously commits ``sessions/{sid}``, Supermemory flushes pending turns stamped with the session id), so this belongs inside ownership — post-release it would run while a successor may already be mid-turn on the session. The flush runs first: memory shutdown can issue aux-LLM calls and nothing after it may fail in a way that loses the turn (#88583). Settlement is best-effort by design: failures are logged and the release still happens, because the failure mode to avoid is an exited process pinning the lease — a dangling open row is recoverable (session_recovery reaps stale rows), a wedged lease is not. 2. **Ownership handoff** — release the active-session lease. Every turn of the run (main turn, kanban goal loop, notify-completion follow-ups) has finished and the success path has no session-owned writes left, so a waiting delivery may acquire and resume the session immediately: releasing only at process exit let an alive-but-idle one-shot refuse deliveries for the whole exit linger (bounded, minutes) after its turn had ended (#118826 / #122770). 3. **Process-only work, lease-free** — the bounded linger for notify_on_complete children (pipe drain, the boundary the one-shot path itself declares "NOT part of the spawner's delivery", #113608) and resource teardown. ``_run_cleanup``'s memory-shutdown call is idempotent (``_memory_provider_shutdown``), so its post-release repeat is a no-op; neither it nor the linger touches session rows. Releasing between settlement and the linger is what prevents the handoff race: a successor that acquires and reopens the session can never receive this process's stale ``cli_close`` end-stamp, because phase 1 has already run it. N)rr _run_cleanupr^rz#one-shot session store flush failedTrrZz(one-shot memory provider shutdown failedz*one-shot background completion wait failedF)notify_session_finalize) rrrrr^rrr>rrUr_release_active_session)r cli_modulerrrr^rs& r_finalize_single_queryrBsHrr& O )# . .c2 T ,GC$,G,g,g:KgKg h ##%R05/# O LL>L N O T LLCdL S T ##% R AD QRs\A1CBBC1"BCBC"B>;C=B>>CC"C;:C;)N)#__doc__ __future__rrr(rrHr; contextlibr getLoggerr>rrr"r,r1rKr^rgrnrtrzr_CLEANUP_STEPSrrrrrrrrrrrr rrs #     5 !'6 *Ve*V*VZ)25 )  I&)A9(Mi(+I9*U + Q]gY  8L2L L&)CX 8:0r