+ WjEURt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI Ht^RIHt^RIHtHtHtHt^RIHt^RIHt^RIHtHt]P8!]4t^t^t ^t!^t"R t#^t$R t%Rt&]'!R R 04t(^t)R t*R Rlt+]!RR44t,]!RR7!RR44t-RRlt.RRlt/RR/RRllt0Rt1!RR4t2R#)!aHTransmit exported shared-metrics packages to the Nous telemetry service. Sender side of the ingest contract (telemetry repo ``CONTRACT.md``): ``202`` durably stored, mark sent; ``400`` permanently malformed, never retry; ``429`` keep, retry after ``Retry-After``; ``5xx`` / timeout / connection error keep, retry with backoff. ) annotationsN)contextmanager) dataclass)datetime timedeltatimezoneUTC)parse_retry_after_seconds) write_txn) _isoformat_utc_nowii,iic V^8dQhRRRR/#)valuestrreturnr)formats"bC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\observability\shared_metrics_sender.py __annotate__rGs9999cT\P!V4P\4#)zBParse a stamp this module itself wrote (Z-suffixed ISO-8601, UTC).)r fromisoformat astimezoner)rs&r _parse_stamprGs  ! !% ( 3 3C 88rcF]tRt^Lt$Rt^tR]R&^tR]R&^tR]R&Rt R#) SendOutcomez6What one pass did. Returned for tests and diagnostics.intsentrejecteddeferredrN) __name__ __module__ __qualname____firstlineno____doc__r__annotations__rr __static_attributes__rrrrrLs"@D#MHcHcrrT)slotsc6]tRt^Ut$R]R&R]R&R]R&RtR#) _Responserstatus str | None retry_afterrbodyrN)r!r"r#r$r&r'rrrr*r*Us K Irr*c(V^8dQhRRRRRRRR/#) rendpointrpayloadbytestimeoutrrr*r)rs"rrr\s(  C % S Y rc ,RRRR/pTp\V4\8d\P!V^R7pRVR&\P P WVRR 7p\P PWRR 7;_uu_4p\VPVPPR 4VPR 4PR R44uuRRR4# +'giR#;i \PPdp\TP TP'dTPPR 4MRTP"'d"TPR 4PR R4MR4uRp?#Rp?ii;i)zDPOST one package. Raises on transport failure; never on HTTP status.z Content-Typezapplication/jsonz User-Agentzhermes-agent-shared-metrics/1)mtimegzipzContent-EncodingPOST)dataheadersmethodr3z Retry-Afteriutf-8replaceN)lenGZIP_THRESHOLD_BYTESr6compressurllibrequestRequesturlopenr*r+r9getreaddecodeerror HTTPErrorcodefp)r0r1r3r9r.rCresponseexcs&&$ r_postrO\s7 *5G D 7|**}}WA.&,"#nn$$X'RX$YG  ^^ # #G # = =  $$]3 d#**7I>> = = = << ! !  HH.1kkkCKKOOM *t9<CHHTN ! !'9 5R   sD(C3AC C3 C0 *C30C33FAF"&FFFc$V^8dQhRRRRRR/#)rrr,defaultrrr)rs"rrrys!-- -S-S-rcb\V4pVfV#\^\\V4R44#)NiQ)r maxminr)rrQsecondss&& r_retry_after_secondsrVys.'.G q#c'lF+ ,,rnowc(V^8dQhRRRRRRRR/#) r connectionsqlite3.Connection send_enabledboolrWzdatetime | NonerNoner)rs"rrrs0> > "> >   >  > rc\T;'g \44pTpVPR4P4pVeE\\ \ V^,44\ \R7,4p\W64pVPRV34\VPR4P44pVR,pVPR4p VPR4P4p V'dIV f)\R W344p VPR W34R#VPR W^,34R#V eVPR WJ^,34R#R#) zReconcile the consent-window table with the observed config state. THE ONLY writer of consent state; must run inside a write transaction. Idempotent in (config, now, store): call it from anywhere, any number of times, in any order. z2SELECT stamp FROM consent_marks WHERE name = 'obs'NrUz INSERT INTO consent_marks(name, stamp) VALUES ('obs', ?) ON CONFLICT(name) DO UPDATE SET stamp = MAX(stamp, excluded.stamp) z%SELECT name, stamp FROM consent_marksobsr8z>SELECT rowid FROM send_consent_windows WHERE closed_at IS NULLc30"TF qfKVxK R#5iNr).0xs& r )reconcile_send_consent..sAKqKs zLINSERT INTO send_consent_windows(opened_at, last_confirmed_at) VALUES (?, ?)z]UPDATE send_consent_windows SET last_confirmed_at = MAX(last_confirmed_at, ?) WHERE rowid = ?zUUPDATE send_consent_windows SET closed_at = MIN(last_confirmed_at, ?) WHERE rowid = ?) r r executefetchonerrrMAX_OBS_ADVANCE_SECONDSrTdictfetchallrFrS) rYr[rWstamp raw_stamp previous_obsceilingmarksr`r8open_rowopeneds &&$ rreconcile_send_consentrssh s((hj )EI%%<hj \!_- .CZ1[ [ E#    ##$KLUUW XE ,C 99V D!!Hhj   ASKAAF   !     #qk"       $  rzEXISTS ( SELECT 1 FROM send_consent_windows w WHERE package_outbox.period_start >= w.opened_at AND package_outbox.period_end <= CASE WHEN w.closed_at IS NULL THEN w.last_confirmed_at ELSE w.closed_at END )c ]tRt^tRtR]R]PR]R] RR/RR llt ] R 4t R R lt ]R Rl4t]RRl4tRR/RRlltRRltRR/RRlltRRlt]RRl4tRRltRRltR R!ltR"tR#)#SharedMetricsSenderz4Sends exported packages, one bounded pass at a time.postsleeprW max_attempts consent_checkNc$V^8dQhRRRRRR/#)rr0rrxrrr]r)rs"rr SharedMetricsSender.__annotate__s*,,,, ,rc ZWnW nW0nW@nWPnW`nWpnR#rb)_store _endpointrO_sleep_now _max_attempts_consent_check)selfstorer0rvrwrWrxrys&&&$$$$$r__init__SharedMetricsSender.__init__s+ !   ),rc # "VPP4;_uu_4p\V4;_uu_4VxRRR4RRR4R# +'giL;i +'giR#;i5i)z0One store connection inside a write transaction.N)r} _connectionr )rrYs& r_writeSharedMetricsSender._writesL[[ $ $ & &*:&&  '' &&&' & &s2#A7A#A A# A7 A A## A4 . A7c$V^8dQhRRRRRR/#)rrWrseenzset[str]rz dict | Noner)rs"rrr{s!66x6x6K6rc  VP4;_uu_4p\V4pV\\R7,pRP RV44pV'dRV R2MRpVP R\ RV R 2V\.\V4O54P4pVf R R R 4R #\V^,4p V^,;'gVPW9V^,4p V fR V R R /uuR R R 4#\\P!44p VP R\V4W34R V R\V^,4R\V 4RV R R/uuR R R 4# +'giR #;i)a=Claim exactly ONE package, immediately before it is sent (see _CLAIM_LEASE_SECONDS). ``seen`` (packages this pass finished with) is excluded IN SQL: with LIMIT 1, returning None for a seen row would look like an empty queue and abandon everything behind it, and rows can legitimately become eligible again mid-pass. r_,c3&"TFpRxK R#5i)?Nr)rc_s& rre2SharedMetricsSender._claim_next..s#6ACsz AND package_id NOT IN ()r>aO SELECT package_id, payload_json, sent_install_id FROM package_outbox WHERE exported_at IS NOT NULL AND (send_state IS NULL OR send_state = 'pending') AND (next_attempt_at IS NULL OR next_attempt_at <= ?) AND zC AND send_attempts < ? ze ORDER BY created_at, package_id LIMIT 1 N package_idskipTa( UPDATE package_outbox SET send_state = 'pending', send_attempts = send_attempts + 1, next_attempt_at = ?, claim_token = ? WHERE package_id = ? payload_jsonderived claim_tokenF)rr r_CLAIM_LEASE_SECONDSjoinrgCONSENT_GATE_SQLMAX_SEND_ATTEMPTSsortedrhr_freeze_identityuuiduuid4) rrWrrYrl lease_until placeholders exclusionrowrrtokens &&& r _claim_nextSharedMetricsSender._claim_nextsk[[]]jsOE 2F GGK88#6#66LFJ2<.BPRI$$ ,,- k" )9F4L9hj {/]2SVJ!fUU 5 5jcRSf UG$j&$?;]< %E   K(%< j.#c!f+yRUV]R^ufeY]]]sB E*0!E*#E*AE** E; c$V^8dQhRRRRRR/#)rrYrZrrrr,r)rs"rrr{(s$''&'47' 'rc Rp\P!V4p\V\4'dVP R4MRp\V\4'gR\ V4P R2pM2\V\4'dVP4'gRpMRpVe,\PRW4VPRWQ34R#VPR W134\V4# \\3dRpLbi;i) zRecord the transmitted install_id on the row, or reject an unusable one. Rejecting rather than raising matters: an exception would roll back the claim transaction and block every healthy package behind this one. N install_idz payload is z, expected objectz payload has no usable install_idzunreadable payloadz-Shared-metrics package %s cannot be sent (%s)z UPDATE package_outbox SET send_state = 'rejected', last_error = ? WHERE package_id = ? zBUPDATE package_outbox SET sent_install_id = ? WHERE package_id = ?)jsonloads isinstancerjrFtyper!rstrip TypeError ValueErrorloggerwarningrg)rYrrrr1reasons&&& rr$SharedMetricsSender._freeze_identity's  jj.G 7A$6O6O\2UYJgt,,&tG}'='=&>>OP C00 8H8H8J8J;   NNJJ _    $   P  $ :9:& *)F *sC22DDc$V^8dQhRRRRRR/#)rrrtransmitted_idrr2r)rs"rrr{Ts&MMCMMMrc \\P!V44pWR&\P!V^RR7P R4#)zRebuild the exact bytes to send: deterministic json.dumps of the stored package with install_id from the frozen ``sent_install_id`` column (resends are byte-identical).rT)indent sort_keysr<)rjrrdumpsencode)rrr1s&& r_bodySharedMetricsSender._bodySs=tzz,/0 . zz'!t<CCGLLrrc$V^8dQhRRRRRR/#)rrrrr,rr]r)rs"rrr{[s"zPTrc 8RPRV44pRp.VP4OVNpVeVR, pVPV4VP4;_uu_4pVP RV RV 2V4RRR4R# +'giR#;i)zWrite send state for one package. Guarded on send_state so a lapsed pass cannot resurrect a row another process already finished. With ``token`` the write is also compare-and-set on claim_token: a superseded claimant writes zero rows. z, c3*"TF q R2xK R#5i)z = ?Nr)rcnames& rre,SharedMetricsSender._mark..bsB'$& 'sz3 AND (send_state IS NULL OR send_state = 'pending')Nz AND claim_token = ?zUPDATE package_outbox SET z WHERE package_id = ?)rvaluesappendrrg)rrrcolumns assignments predicateparamsrYs&&$, r_markSharedMetricsSender._mark[siiB'BB I 6)6:6   / /I MM% [[]]j   ,[M9NykZ ]]]s %B B c$V^8dQhRRRRRR/#)rrrrr,rr\r)rs"rrr{ns!s:$rc  VfR#VP4pV\\R7,pVP4;_uu_4pVP R\ V4W\ V434pVP ^8HuuRRR4# +'giR#;i \d\PRRR7R#i;i)aGAtomically re-assert ownership and extend the lease (CAS, one row; rowcount == 1 is the only grant). A read-only check is not enough: a claimant whose lease expired while suspended still has its token in the row and would POST while another process reclaims. Renewing in the same CAS keeps the 30s POST inside the 300s lease. NFr_aQ UPDATE package_outbox SET next_attempt_at = ? WHERE package_id = ? AND claim_token = ? AND (send_state IS NULL OR send_state = 'pending') AND next_attempt_at > ? z$Unable to renew shared-metrics claimTexc_info) rrrrrgr rowcount Exceptionrr)rrrrWrrYcursors&&& r _renew_claim SharedMetricsSender._renew_claimns = ))+C 2F GGK*#++ ,jCQ !+  NNADN Q s/?B6B= B B BB"CCc ,V^8dQhRRRRRRRRRR /#) rrr delay_secondsrrrr,rr]r)rs"rrr{s4     .1  ;>  JT    rc  VP4P4\^\V44,pVP VVR\ \ P!V\R74VR,R7R#)pending)tz:NiN)r send_statenext_attempt_at last_errorN) r timestamprSrrr r fromtimestampr)rrrrrretry_ats&&&&$ r_deferSharedMetricsSender._defers_99;((*SC 4F-GG  &x'='=h3'OPd|  rc V^8dQhRRRR/#)rpackagerjrrr)rs"rrr{s7E7E7E#7Erc  jaaa VR,oVPR4o SPVR,VR,4pRVVV 3Rllp\^SP^,4EFpSP SS 4'g\ P RS4R#SPSPV\R 7pVP^8Xd1SPSS R \SP44R R 7R #VP\9d[\ PR SVP4SPSS RRVP RVP R, 2R7R#VPR8Xd$V!\#VP$\&4R4u#RVP 2pVSP8dV!\&V4u#SP/SP1V44EK V!\&R4# \(d%p\+T4P, RT 2pR p?L|R p?ii;i)zTry one package. Returns 'sent', 'rejected', or 'deferred'. Delivery is at-least-once: renewal plus token-fenced writes close the claim->POST and settle-after-reclaim gaps, but a suspension MID-POST can still duplicate. rrrrc$V^8dQhRRRRRR/#)rdelayrrrrr)rs"rr3SharedMetricsSender._send_one..__annotate__s!   c c rc0<SPSWSR7R#))rr )r)rrrrrs&&rdefer,SharedMetricsSender._send_one..defers KK EK ?rz:Shared-metrics claim on %s superseded or expired; yieldingr r;rN)rrsent_atrz8Telemetry package %s rejected with HTTP %s; not retryingrzHTTP z: :NiN)rrriz rate limitedzattempts exhausted)rFrrangerrrinforOr~REQUEST_TIMEOUT_SECONDSr+rr r_PERMANENT_STATUSESrr.rVr-_FAILURE_BACKOFF_SECONDSrrr!r_backoff) rrr.rattemptrMrrNrrs f& @@r _send_oneSharedMetricsSender._send_ones \*  M*zz'.1793EF  Q 2 2Q 67G$$Z77 PR\" 3::dnndD[:\??c)JJ"%F *499; 7D"??&99NNR"  JJ"%J%*8??*;2hmmD>Q=R#S&??c) ,X-A-AC[\& ! 12$,,,5v>> KK g. /O8R-/CDD? 8 I../r#7 8s"H H2H--H2c V^8dQhRRRR/#)rrrrfloatr)rs"rrr{s]]#]%]rc j\P!^\\V^, ,,4#)z1s, 5s, 25s with full jitter.)randomuniform_BACKOFF_BASE_SECONDS_BACKOFF_FACTOR)rs&rrSharedMetricsSender._backoffs%~~a!6/gXYk:Z![\\rcV^8dQhRR/#)rrrr)rs"rrr{s  k rc  \4p\4p\\4FpVP 4'g+\ P R4VPRR7V#VPVP4V4pTfT#TPTR,4TPR4'dR pMTPT4p\Y\!Y4^,4K V# \d\ PRRR7T#i;i \d\ PR RR7R pLri;i) zRun one bounded pass, one claim+send at a time, re-checking consent before each send so revoking `send` mid-pass stops the remainder. Never raises.z2Shared-metrics sending disabled mid-pass; stoppingF)r[z(Unable to select shared-metrics packagesTrrrrz%Unable to send shared-metrics packager )rsetrMAX_PACKAGES_PER_PASS_still_consentedrr _reconcilerrrraddrFrsetattrgetattr)routcomerrrresults& r send_pending SharedMetricsSender.send_pendings1-,-A((** PQU3(' **499;= HHW\* +{{6""#(!^^G4F GWW%=%A B3.4# ITXY# !(NN#JUYNZ'F(s$( C5D5"DD$EEc V^8dQhRRRR/#)rr[r\rr]r)rs"rrr{sXX$X4Xrc VP4;_uu_4p\W!VP4R7RRR4R# +'giR#;i \d\P RRR7R#i;i)z1Run the single consent writer from within a pass.)rWNz*Unable to reconcile shared-metrics consentTr)rrsrrrr)rr[rYs&$ rrSharedMetricsSender._reconcilesS X*&zTYY[Q X NNGRVN W Xs-AAA A AA"A:9A:cV^8dQhRR/#)rrr\r)rs"rrr{s  $ rc VPfR#\VP44# \d\P RRR7R#i;i)zRe-read profile-owned send consent: docs promise ``send: false`` stops transmission immediately, and a pass can run for minutes.Tz7Unable to confirm shared-metrics send consent; stoppingrF)rr\rrr)rs&rr$SharedMetricsSender._still_consentedsP    & ++-. .  NNT_cN d s+"AA)rr~rrrOrr})r!r"r#r$r%rOtimerwr MAX_ATTEMPTSrrrr staticmethodrrrrrrrr rrr'rrrrurus>,  , jj , ,),,*!!6p''VMMD&>  W[  7Er]] DX  rruii')3r% __future__rr6rloggingrsqlite3r urllib.errorrBurllib.requestr contextlibr dataclassesrrrrragent.retry_utilsr hermes_cli.sqlite_utilr shared_metricsr r getLoggerr!rrrrrr@rrr frozensetrrrirrr*rOrVrsrrurrrr s#    %!777,0   8 $  #  c + )9      :->  > H@@r