+ WjcRt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI H t ^RI H t HtHt^RIHt] 'd^RIt]P&!R4tRRltRR ltR R ltR R ltRRltRRltRRltRRltRRltRRltR6RRRR/RRllltRt RR lt!R!R"lt"^Kt#R#t$R$R%lt%R&R'lt&R(R)lt'R*R+lt(R7t)R,R-lt*R.R/lt+R0RR1^R2R3/R4R5llt,R#)8z|Serve-process lifecycle: parent death watchdog, port-conflict preflight, READY announcement, browser open, trusted proxies. N)Path) TYPE_CHECKINGAnyOptional)atomic_json_writezhermes_cli.web_serverc0V^8dQhR\R\/#)pidreturn)intstr)formats"SC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\web_server_lifecycle.py __annotate__rs;N;Ns;Ns;Nc a\PR8Xd\RV R24PRR7pTP R^4^,P4P4p\T4^8gT^,P4'g\RT 24hR T^, 2#\PR 8XEd^RIp^R IHoR pVP!R RR7pSP"SP$SP".VP&nSP*VP&nSP*.VP/SP04.^,,VP2nSP$VP2nSP*.VP4nSP$VP4nVP'VRV4pV'g2VP74pVR 9d \ V4h\VRV 24hV3Rl\9^44wrrVP3WtP;V 4VP;V 4VP;V 4VP;V 44'g\VP74RV 24hVP5V4V P<^ ,V P>,p RV R, 2#\@PB!RR\EV4RR.RRRRRR7pVPFP4pVPH^8XdV'dRV 2#VPH^8Xd V'd RVPJPM49d \ V4h\RV RVPJP4 24h \dp\ T4ThRp?ii;i TP5T4i;i)!zReturn a cross-runtime marker for the current incarnation of ``pid``. ``ProcessLookupError`` means the process is absent; other failures stay distinct so callers fail safe rather than killing a healthy backend. linuxz/proc/z/statzutf-8)encodingN)z invalid /proc stat data for PID zlinux:nt)wintypesikernel32T)use_last_errorFzOpenProcess failed for PID c3D<"TFpSP4xK R#5iN)FILETIME).0_rs& r (_process_start_marker..>s,S(QX->->-@-@(s zGetProcessTimes failed for PID win:lD\88psz-pz-ozlstart=replace)capture_outputtextrerrorscheckps:zno such processzps could not inspect PID z: )Wi)'sysplatformr read_textFileNotFoundErrorProcessLookupErrorrsplitstripsplitlenisdigitOSErrorosnamectypesrWinDLLDWORDBOOL OpenProcessargtypesHANDLErestypePOINTERrGetProcessTimes CloseHandleget_last_errorrangebyrefdwHighDateTime dwLowDateTime subprocessrunr stdout returncodestderrlower)r stat_lineexcfieldsr6!process_query_limited_informationrhandleerrorcreation exit_timekerneluserfiletimeresultmarkerrs& @r_process_start_markerrYse  ||w 3vcU%01;;W;MI !!#q)!,224::< v; 6":#5#5#7#7se!DE E,S%PQ(,S)V )++ X. Y0GV\I]_e_k_klp_qf3359XY\X]7^__   (++r1X5K5KKh!33455 ^^T4S4CTX_cnu#,E;F ]] "F A&VH~ Qv2Cv}}GZGZG\2\ %% -cU"V]]5H5H5J4KL MMe! 3$S)s 2 3H   (s$N30A3O3 O> O  OO%c0V^8dQhR\R\/#)rrXr r bool)r s"rrrVs66s6t6rcVPR4wrpV'dV'dW3P48wdR#VR9dVP4#VR8wdR#VP4p\;QJdRV4F 'gK RM RM !RV44p\;QJdRV4F 'gK RM RM !RV44p\ V4^8;'d T;'dT#):Fr!c3l"TF*qP4;'d\V4^8HxK, R#5i)N)r2r1rtokens& rr-_valid_parent_start_marker..cs'KF5==?66s5zQ6Fs44Tc3,"TF pRV9xK R#5i)r^Nras& rrrcds4VE3%?"9"?FJN  -- s4B BBcV^8dQhRR/#rr Nre)r s"rrrsdrcTRFp\V4K R# \dK#i;i)ulPre-import heavy modules so the event loop is not stalled on first use. Cold Windows installs pay .pyc compilation + Defender scans (15-30s) on these chains; the first WS RPC burst (setup.status, setup.runtime_check, gateway.ready→resolve_skin, model.options) pulled them in on the loop thread (#60800). Warm them all off-loop while the socket is already open. N)zhermes_cli.gatewayzhermes_cli.authzhermes_cli.copilot_authzhermes_cli.runtime_providerzhermes_cli.skin_enginezhermes_cli.inventoryzhermes_cli.model_switch) __import__ Exception)mods r_warm_gateway_modulers.  sO   s  ''c$V^8dQhR\/#rr )float)r s"rrrs555rcP^RIHpV!4# \d ^RIHpTu#i;i))_get_restart_drain_timeout)%DEFAULT_GATEWAY_RESTART_DRAIN_TIMEOUT)hermes_cli.gatewayr ImportErrorgateway.restartr)rrs r_resolve_restart_drain_timeoutrs+5A)++ 5I445s %%cV^8dQhRR/#rre)r s"rrrs   rc^RIHp^RIHpV!V!RRR74R# \d"p\ P RT4Rp?R#Rp?ii;i)uBring this process's own state.db schema current at startup — read-only first. The dashboard is a view layer; the gateway owns the writer. A healthy store must never see a second writable ``SessionDB`` from this process (its close-time checkpoint and a possible FTS rebuild in ``_init_fts`` are the two-writer corruption vector, #107688 / #100896). Access-mode semantics (no bootstrap of a missing store; one additive catch-up of a store that lags SCHEMA_SQL, only while no gateway owns it, #79531 / #140315) live in the routers' own-store opener, :func:`hermes_cli.web_server_sessions._open_session_db_at_path`. Never raises: an unfixable store still gets the per-poll read-probe heal. )_open_session_db_for_profile)release_or_closeNT) read_onlyzvstartup schema reconcile of state.db failed (%s); session reads will report the store unavailable until owner recovery)hermes_cli.web_server_sessionsrhermes_state_registryrr_logwarning)rrrMs r_eager_reconcile_own_session_dbrsG  O:5ddKL    KLO   s A AA c4V^8dQhRRR\R\/#)rserverzuvicorn.Serverfallbackr r )r s"rrrs"-rcVP'd]VP^,P'd:VP^,P^,P4^,#V#)zTRead the OS-assigned port from the live uvicorn socket (ephemeral port-0 discovery).)serverssockets getsockname)rrs&&r_read_bound_portrsL ~~~&..+333~~a ((+779!<< Orc(V^8dQhR\RR/#)r actual_portr Nr)r s"rrrs Q QS QT Qrc\PPR4pV'gR#\\ V4R\ V4/RRR7R# \ d"p\PRY4Rp?R#Rp?ii;i)zPublish the port through an atomic ready file when ``HERMES_DESKTOP_READY_FILE`` is set. Windows Desktop launches via ``pythonw.exe`` (no console flash) cannot use stdout for the port announcement, so Electron waits for this JSON instead. HERMES_DESKTOP_READY_FILENport)indent separatorsz+Failed to write dashboard ready file %r: %s),r^) r4environgetrrr rrr)rtargetrMs& r_write_dashboard_ready_filersd ZZ^^7 8F Q$v,[1A(B4\fg Q BFPPQs#A A<A77A<c LV^8dQhR\R\R\R\RR/#)rhostr open_browserinitial_profiler Nr r r\)r s"rrrs1"8"8c"8"84"8Z]"8bf"8rca a V'gR#^RIo \PR8g;'gP\\P P R4;'g \P P R44pV'g\PR4R#^RI H pVR9dTMRpRV!V4 R V 2o V'd^R I H pS R V!V4 2, o V V 3R lp\P!VR R7P4R#)zOpen the dashboard URL in the user's browser if appropriate. Skips headless Linux (no DISPLAY/WAYLAND_DISPLAY) so a TUI browser can't SIGHUP the server; maps ``0.0.0.0``/``::`` binds to ``127.0.0.1``. NrDISPLAYWAYLAND_DISPLAYzzSkipping browser-open: no DISPLAY or WAYLAND_DISPLAY detected (headless Linux). Pass --no-open to suppress this detection.)format_url_host 127.0.0.1zhttp://r^)quotez /?profile=c|<\P!R4SPS4R# \dR#i;i)g?N)timesleepopenr) _open_url webbrowsersr_open"_maybe_open_browser.._opens1  JJsO OOI &   s ', ;;T)rdaemon)z0.0.0.0z::)rr)r*r\r4rrrdebughermes_cli.url_utilsr urllib.parser threadingThreadstart) rrrr _has_displayr _display_hostrrrrs &&&& @@r_maybe_open_browserrs <<7*rrd2::>>)3L3q3qPRPZPZP^P^_pPq.rL   K  4 (99D{M/-89;-HI&z%"8!9:: E$/557r pid_existsprocess_start_markercRV^8dQhR\R\\,R\/#)r desktop_pidexpected_start_markerr )r rr r\)r s"rrrs*%%%#C=%  %rc^VeMT;'g\pV!\V44pTe'\ YQ4'dR#\ YQ4'dR#Vf ^RIHpTp\V!\V444'*# \dR#\dRpLqi;i \dR#i;i)akTrue when the exact Desktop process that owns this backend is gone. ``HERMES_PARENT_PID`` is the Electron PID, not necessarily our PPID (the Windows ``hermes.exe`` launcher adds shims), so never compare getppid(). The start marker (newer Desktops) defeats PID recycling; PID-only probing stays for older ones. Any inconclusive failure keeps serving (fail-safe). NTF) _pid_exists) rYr r-rrrwgateway.statusrr\)rrrrprobe actual_markerrs&&$$ r_is_serve_orphanedrs ,(AA,AE % %c+&6 7 (.}TT >}dd   2$J 3{#34555!&  % $  % sU BBA=BB*B= BB BBBBB B,+B,g$@c8V^8dQhR\P/#r)rTimer)r s"rrr0s)//rc\P!\\PRR7pRVnVP 4\P!\P4V#)aAsk this backend to shut itself down, with a hard-exit backstop. ``os._exit`` here skipped the flush-on-kill handlers this same process installs before serving (#96095, ``install_exit_flush_signal_handlers``) and every ``atexit`` hook, so an unclean desktop exit dropped the in-memory transcripts that a SIGTERM from a live desktop persists to ``state.db``. Raise SIGTERM instead, and keep the reap guaranteed the way ``cli.py``'s ``_arm_exit_watchdog`` does: a daemon timer that ``os._exit``\ s if the unwind stalls (it survives ``Py_FinalizeEx``'s non-daemon thread joins). ``raise_signal`` reaches Python's handler on Windows too, where ``os.kill(pid, SIGTERM)`` would terminate the process without running it. Returns the armed ceiling timer. )argsT)r) rr_ORPHAN_EXIT_CEILING_Sr4_exitrrsignal raise_signalSIGTERM)ceilings r_request_orphan_shutdownr0sBoo4bhhTJGGN MMO ' NrcV^8dQhRR/#rre)r s"rrrFs3V3Vd3Vrc &aaa\PPR4p\PPR4;'gRo\PPR4;'gRp\T;'gR4oS^8:dR#SRJpY!RJ8wdR#T'dQ\ S;'gR4'dT'dYP48wd\PRSS4R#\R\\PPRR 444oR TTT3R llp\P!TR RR7P4R# \\ 3dR#i;i \\ 3dR oLai;i)aExit when the exact desktop parent that spawned this backend dies. Desktop passes its PID and, in newer versions, a start marker (defeats PID reuse) plus a per-spawn nonce (makes mixed-version plumbing fail safe: marker without nonce or vice versa disables the watchdog). HERMES_PARENT_PIDHERMES_PARENT_START_MARKERNHERMES_PARENT_NONCEzParent-death watchdog disabled: unusable HERMES_PARENT_START_MARKER=%r / nonce; falling back to no parent tracking for desktop PID %s.g?HERMES_SERVE_WATCHDOG_POLL_Sz2.0g@cV^8dQhRR/#rre)r s"rr2_start_parent_death_watchdog..__annotate__ls # #4 #rc<\SS4'g\P!S4K*\P RSS4\ 4R# \ dLi;i)zaParent-death watchdog: desktop PID %s appears orphaned (expected_start_marker=%r); shutting down.N)rrrrrrr)rpoll start_markersr_loop+_start_parent_death_watchdog.._looplsR$[,?? JJt   LLs  !"   sA AATzserve-parent-watchdog)rrr5)r4rrr TypeErrorr{rpr/rrmaxrrrr)raw_pidnonce has_markerrrrrs @@@r_start_parent_death_watchdogrFsQjjnn01G::>>">?GG4L JJNN0 1 9 9TE'--R( aT)J4'(5l6H6HbIIQVZ_cncncpZp  E    3bjjnn-KUSTU # #E$5LMSSUK z "* z "s*6 E"E";3E:"E76E7:FFzBACKEND_PORT_IN_USE port={port}c0V^8dQhR\R\/#)rrMr )r3r\)r s"rrrseewe4erct^RIpVPVP^b^0R09;'g\VRR4R8H#)z@True when ``exc`` is the platform's address-in-use bind failure.Ni@'winerror)errno EADDRINUSEgetattr)rMrs& r_is_addr_in_use_errorrs= 99))2r59 9 d dWS*VZ=[_d=ddrc<V^8dQhR\R\R\/#)rrrr r)r s"rrrs!""c"""rcV'gR#^RIpRV9d VPM VPpVPW2P4p\ TRR4p\ PR8Xd#TeTPTPT^4M'TPTPTP^4TPY34TP4R# \dR#i;i \d&p\T4uRp?TP4#Rp?i\dTP4R#i;i TP4i;i)uProbe whether binding ``host:port`` would fail with EADDRINUSE. ``port == 0`` (ephemeral) never conflicts, so it is skipped. Any probe error other than address-in-use returns ``False`` so uvicorn surfaces it with its normal diagnostics (bad host, EACCES, …). FNr^SO_EXCLUSIVEADDRUSEwin32)socketAF_INET6AF_INET SOCK_STREAMr3rr)r* setsockopt SOL_SOCKET SO_REUSEADDRbindrcloser)rr_socketfamilyr _exclusiverMs&& r_port_bind_conflictrs !$W  '//Fv':':;W&;TB <<7 "z'=   W//Q ?   W//1E1Eq I D<  )  *$S))      sTC A=C- C*)C*- D:8 DD:D= D:%D:&D=9D::D==Ec(V^8dQhR\RR/#)rliner N)r )r s"rrrsstrc\P!^VR,P44R# \d&\ TRR7R# \ dR#i;ii;i)uyWrite a machine-parsed sentinel line to the REAL stdout (fd 1). ``tui_gateway.server`` redirects ``sys.stdout`` to stderr at import (#94724), so a ``print()`` sentinel never reaches the Desktop's stdout pipe; fd 1 is untouched. If fd 1 is unwritable (pythonw.exe) fall back to ``print()`` for humans only — pythonw spawns discover the port via the ready file. Never raises.  TflushN)r4writeencoder3printr)rs&r_write_machine_sentinel_linersU TD[((*+   $d # #   s&,0 A  A  AA AA c4V^8dQhR\R\RR/#)rrrr N)r r )r s"rrrs!  c   rcl\\PVR74\RV RV R2RR7R#)z@Print the machine sentinel + a human hint naming likely holders.)rz Port z on u is already in use — likely another 'hermes serve' / 'hermes dashboard' backend or the Hermes gateway. Stop the other process, or pass --port (--port 0 picks a free ephemeral port).TrN)r_PORT_IN_USE_SENTINELr r)rrs&&r_report_port_in_users= !6!=!=4!=!HI $tD6"2 2 rchV^8dQhR\\\3,R\\,/#)rdashboard_configr )dictr rlist)r s"rrrs&44T#s(^4S 4rcxVPR.4pVR 9d.pMN\V\4'dV.pM4\V\\34'g\ P RV4.p\\4pVFp\V\4'dVP4'g\ P RV4KGVP4pRV9dA\P!VRR7pVP^8Xd \R4h\V4pM \\P!V44pWb9gKVPV4K V\\48wd&\ PR R P!V44V# \d\ P RT4EK<i;i) zReturn the bounded proxy addresses uvicorn may trust: loopback plus valid config entries. Invalid or unbounded (/0, '*') ``dashboard.trusted_proxies`` entries fail closed so client-supplied forwarding headers never become request metadata. trusted_proxieszVdashboard.trusted_proxies must be a list of IP addresses or CIDR networks; ignoring %rz[Ignoring invalid dashboard.trusted_proxies entry %r; expected an IP address or CIDR network/F)strictzunbounded networkzwIgnoring unsafe dashboard.trusted_proxies entry %r; use a bounded IP address or CIDR network, never '*' or a /0 networkzDashboard trusted proxies: %sz, )Nr)r isinstancer r"tuplerr&_DEFAULT_DASHBOARD_FORWARDED_ALLOW_IPSr/ ipaddress ip_network prefixlenr{ ip_addressappendinfojoin)r  configuredtrusted raw_entryentrynetwork normalizeds& r_dashboard_forwarded_allow_ipsr7sy "%%&7> 1499W3EF N  LLE    sAFF!F98F9cV^8dQhRR/#rre)r s"rrr s88$8rc^RIHp^RIHpHpVR,pR\ P V!VR,R,43R\ PV!VR,R,433FowrEp\P!V4pR Vn VP'dK7\P!V4pVPV4VPV4Kq \P!R4P\P 4R #) auvicorn's default console logging, without its ``dictConfig``. ``uvicorn.Config``'s default ``log_config`` runs ``dictConfig``, which calls ``logging.shutdown()`` on every live handler: a multiplexed gateway's profile log routers are already installed when its listener is built, and a closed router stays closed. The listeners pass ``log_config=None`` and get uvicorn's handlers here instead: ``uvicorn`` to stderr, ``uvicorn.access`` to stdout, neither propagating into the Hermes log files. )LOGGING_CONFIG)AccessFormatterDefaultFormatter formattersuvicorndefaultfmtzuvicorn.accessaccessFN)uvicorn.configr:uvicorn.loggingr;r<r)rJrHlogging getLogger propagatehandlers StreamHandler setFormatter addHandlersetLevelINFO) r:r;r<formatsr5stream formatterloggerhandlers r_uvicorn_console_loggingrR s.A\*G CJJ 01CE1J KL 3::wx7H7O'PQ$i""4( ++F3G   +   g &$ i ))',,7rws_pingtimeout_graceful_shutdownlifespanautoc V^8dQhR\R\R\R\\\ \ 3,,R\\ ,R\/#)rrr auth_requiredrSrTrU)r r r\rr(r)r s"rrr%sK4*4*C4*s4*d4*#+E%,,?#@4*5=e_4*TW4*rca ^RIp^RIHp^RIHp Hp V!4P R4;'g/o R RV 3Rlllp VfW9dR MV !R4V !R43p\4VP!WVR RV\S 4V^,V^,V VVR 7 p WP!V 43# \d/o Li;i) auvicorn ``Config`` + ``Server`` for a dashboard or gateway-session listener (FastAPI-free, so the gateway can build its session listener without importing the dashboard app). WS keepalive ping runs ON the agent event loop; a GIL-holding worker call can starve it for minutes, so uvicorn misses the pong and drops a healthy local socket (#53773/#48445/#50005). The ping only detects half-open connections (proxy 524, dropped tunnels), impossible on loopback where a dead client sends a real FIN/RST -> WebSocketDisconnect. So: no ping on loopback; non-loopback sits behind a Cloudflare Tunnel (~100s idle) and keeps a config-driven cadence (dashboard.ws_ping_interval/_timeout, #79635) defaulting to 20/20. *ws_ping* overrides both (SSH-isolated Desktop backends). N) load_config) _DESKTOP_ATTACHMENT_WS_MAX_BYTES_LOOPBACK_HOST_VALUES dashboardc<V^8dQhR\R\R\/#)rkeyr?r )r r)r s"rr+build_listener_server..__annotate__<s!cEUrcl<\SPW44# \\3dTu#i;ir)rrrr{)r_r?dash_cfgs&&r_ws_ping_setting/build_listener_server.._ws_ping_setting<s5 c34 4:& N s 33ws_ping_intervalws_ping_timeoutr) rr log_level log_config proxy_headersforwarded_allow_ipsrerf ws_max_sizerTrU)g4@)NN) r>hermes_cli.configrZhermes_cli.web_server_boundaryr[r\rrrRConfigr7Server) served_apprrrXrSrTrUr>rZr[r\rcconfigrbs&&&$$$$ @rbuild_listener_serverrr%s-f=$$[177R "&"?, / 02BCT2UFW ^^DI$$;8D  4 #<#F& >>&) ))A sB-B-- B=<B=r)rz::1)-__doc__asynciorDr*r4rrFr)rrpathlibrtypingrrrutilsrr>rErrYrprwrrrrrrrrrrrPORT_IN_USE_EXIT_CODErrrrrr)r7rRrrrerrrys   //#01;N|6$ H...5 0 Q "8J% %  %%X,3Vv9e"J$ *>&4n864*CG4*GH4*Z`4*4*r