(GjH$dZddlZddlZddlZddlZddlZddlZddlZddlmZm Z ddl m Z ddl m Z ddlmZmZddlmZejdkrddlZnddlZd Zd Zd ZejdkZeZd Zdad Zde fdZdudee de fdZ de fdZ!de fdZ"de#fdZ$ddde%de&ddfdZ'de#de#fdZ(de#de#de fdZ)de%dee%fdZ*de%dee%fdZ+de%dee#fd Z,d!e#dzde#dzfd"Z-d!e#dzde&fd#Z.d!e#dzde&fd$Z/de%de&fd%Z0d&e1e#efde&fd'Z2d(e dee#fd)Z3d!e#d(e de&fd*Z4dd+d&e1e#efde%d,ee de&fd-Z5de1fd.Z6de1e#effd/Z7d0e dee1e#effd1Z8d0e d2e1e#efddfd3Z9dudee dee1fd4Z:dud5ee dee1e#effd6Z;d&ee1e#efdee%fd7Zde&fd;Z?de%de&fd<Z@dvd=ZAde&fd>ZBdvd?ZCdud5ee de&fd@ZDdvdAZEeeeeeeeeedB dCedDedEedFedGedHedIedJedKeddfdLZFdud0ee dee1e#effdMZGdNede%fdOZHeIdPhZJdQe&dCedFede&fdRZKdQe&dCede&fdSZL dudd+dTee1e#efd,ee dee%fdUZMdvdVZNdude#de#dWee1e#efdeOe&ee1e#efffdXZPde#de#ddfdYZQdddZd[ee%d\ee%de%fd]ZRd^ZSd_ZTd`ZUd_ZVde fdaZWde fdbZXdce#dde%de&fdeZYd0e dfe#dge#dde%de&f dhZZdie%de&fdjZ[de&fdkZ\dvdlZ]die%de&fdmZ^de&fdnZ_de&fdoZ`dvdpZa dudqdrdee d8e&dee%fdsZb dudqdrdee d8e&de&fdtZcdS)wu Gateway runtime status helpers. Provides PID-file based detection of whether the gateway daemon is running, used by send_message's check_fn to gate availability in the CLI. The PID file lives at ``{HERMES_HOME}/gateway.pid``. HERMES_HOME defaults to ``~/.hermes`` but can be overridden via the environment variable. This means separate HERMES_HOME directories naturally get separate PID files — a property that will be useful when we add named profiles (multiple agents running concurrently under distinct configurations). N)datetimetimezone)Pathget_hermes_home)AnyOptionalatomic_json_writewin32hermes-gatewayzgateway_state.jsonz gateway-locksz gateway.lockreturnc(t}|dz S)z@Return the path to the gateway PID file, respecting HERMES_HOME.z gateway.pidrhomes 4/home/rurouni/.hermes/hermes-agent/gateway/status.py _get_pid_pathr-s   D - pid_pathcj||tSt}|tz S)z1Return the path to the runtime gateway lock file.) with_name_GATEWAY_LOCK_FILENAMEr)rrs r_get_gateway_lock_pathr3s4!!"8999   D ( ((rcNttS)z5Return the persisted runtime health/status file path.)rr_RUNTIME_STATUS_FILErr_get_runtime_status_pathr;s ?? $ $%9 : ::rctjd}|rt|Sttjdtjdz dz }|dz tz S)zBReturn the machine-local directory for token-scoped gateway locks.HERMES_GATEWAY_LOCK_DIRXDG_STATE_HOMEz.localstatehermes)osgetenvrr_LOCKS_DIRNAME)override state_homes r _get_lock_dirr)@s`y233HH~~bi 0$)++2H72RSSTTJ  > 11rcbtjtjSN)rnowrutc isoformatrrr _utc_now_isor/Is < % % / / 1 11rF)forcepidr0c|rtrddlm} tjddt |ddgddd| }n0#t $r#tj|tj Yd SwxYw|j dkr6|j p|j pd }t|pd |d S|s tj nt!td tj }tj||d S)zTerminate a PID with platform-appropriate force semantics. POSIX uses SIGTERM/SIGKILL. Windows uses taskkill /T /F for true force-kill because os.kill(..., SIGTERM) is not equivalent to a tree-killing hard stop. r)windows_hide_flagstaskkillz/PIDz/Tz/FT )capture_outputtexttimeout creationflagsNztaskkill failed for PID SIGKILL) _IS_WINDOWShermes_cli._subprocess_compatr3 subprocessrunstrFileNotFoundErrorr$killsignalSIGTERM returncodestderrstdoutstripOSErrorgetattr)r1r0r3resultdetailssigs r terminate_pidrNMs,   EDDDDD ^VSXXtT:#0022 FF!    GC ( ( ( FF    ! !}; ;BBDDG'E%E%E%EFF F % U&..769fn+U+UCGCs3A)A21A2identityctj|dddS)Nutf-8)hashlibsha256encode hexdigest)rOs r _scope_hashrWns3 >(//'22 3 3 = = ? ? DDrscopecJt|dt|dz S)N-z.lock)r)rW)rXrOs r_get_scope_lock_pathr[rs* ??DD H(=(=DDD DDrctd|d} t|ddS#tt t ttf$rYnwxYw ddl }tt| | dzS#t$rYdSwxYw) uReturn a stable per-process start-time fingerprint, or None. Used as a PID-reuse guard: a ``(pid, start_time)`` pair uniquely identifies a process, so a recycled PID (same number, different process) yields a different value and is never mistaken for the original. On Linux this is field 22 of ``/proc//stat`` (start time in clock ticks since boot, an int). On platforms without ``/proc`` (macOS, Windows) we fall back to ``psutil.Process(pid).create_time()`` — a float epoch timestamp — quantized to an int (centiseconds) for stable equality. The two sources are never mixed on a single platform: ``/proc`` always succeeds first on Linux, and always fails on macOS/Windows so psutil is always used there. Because the guard only compares the value recorded at spawn against the live value *on the same host*, the differing units across platforms are irrelevant — only same-source equality matters. /proc//statrQencodingrNd)rint read_textsplitrA IndexErrorPermissionError ValueErrorrIpsutilroundProcess create_time Exception)r1 stat_pathris r_get_process_start_timerovs$(c((())I 9&&&88>>@@DEEE z?J P      5,,88::S@AABBB tts$:A#A65A6:AC CCc t|S)zBPublic wrapper for retrieving a process start time when available.)ro)r1s rget_process_start_timerqs "3 ' ''rctd|d} |}|r=|ddddSn#t t tf$rYnwxYwts tj dd t|d d gd d d }|j dkr2|j r|j Sn#ttjf$rYnwxYw ddl}||}|}|rd|Sn#t&$rYnwxYwdS)zReturn the process command line as a space-separated string. On Linux, reads /proc//cmdline directly. On macOS and other platforms without /proc, falls back to ``ps -p -o command=``. On Windows (no /proc, no ps), uses psutil. r]z/cmdline rQignore)errorsps-p-ozcommand=Tr6r7r8rN )r read_bytesreplacedecoderHrArgrIr<r>r?r@rErGTimeoutExpiredrirkcmdlinejoinrm)r1 cmdline_pathrawrKriproc cmdline_partss r_read_process_cmdliners....//LW%%''  W;;w--44WX4NNTTVV V W  8       ^tSXXtZ8# F  A%%&-*=*=*?*?%}**,,,23    D   ~~c""   +88M** * +       4s7A))BBA&C66DDAE E%$E%commandc|sdS tj|d}n$#t$r|}YnwxYwd|D}|sdS|D]C}|dks|drdS|dd d }|d vrdSDd |}d |vpd|vpt d|D}|sdSg}d}|D]N}|rd}|dvrd}|ds|dr9||Ot|D]1\} }|dkr | d zt|krdS|| d zcSdS)aoReturn the Hermes gateway lifecycle subcommand from a command line. Lifecycle decisions (is the gateway up? did restart relaunch it?) must not fire on loose substring matches. The previous ``"... gateway" in cmdline`` test also matched ``hermes_cli.main gateway status`` and even unrelated processes like ``python -m tui_gateway`` -- which made ``restart()`` race against a still-draining old process and ``status``/``start`` report false positives. This requires the actual ``gateway`` subcommand followed by ``run`` (or one of the gateway-dedicated entrypoints), excluding the other ``gateway`` management subcommands and any process that merely contains the word "gateway". Tokenizes quote-aware (``shlex``) so quoted Windows paths with spaces (``"C:\Program Files\...\hermes-gateway.exe"``) survive, and strips ``--profile``/``-p`` selectors from anywhere in argv -- Hermes's ``_apply_profile_override`` removes them before argparse, so the profile flag (and a profile literally named ``gateway``) can legally appear on either side of the ``gateway`` subcommand. NF)posixcg|]=}|ddd>S)z"'\/)rHr~lower.0ts r z/_gateway_command_subcommand..s> L L LAaggenn$$T3//5577 L L Lrzgateway/run.pyz/gateway/run.pyr?r)r zhermes-gateway.exer|zhermes_cli.mainzhermes_cli/main.pyc3RK|]"}|ddddvV#dS)rrr)r#z hermes.exeN)rsplitrs r z._gateway_command_subcommand..s;PPAqxxQ#'??PPPPPPr)z --profilerxTz --profile=z-p=gateway) shlexrerhendswithrrany startswithappend enumeratelen) r raw_tokenstokenstokenbasenamejoinedhas_gateway_entryfiltered skip_nextis r_gateway_command_subcommandrs( t%[666 %%%]]__ %M L L L LF t $ $ $7H(I(I $55<<Q''+ ? ? ?55 @XXf  FV# Q 6 ) Q PPPPP P P t HI    I  ' ' 'I    L ) ) U-=-=e-D-D  h''5 I    q5CMM ! !55A 4s >>c(t|dkS)zAReturn True only for a real ``gateway run`` process command line.r?rrs rlooks_like_gateway_command_liners &w / /5 88rc$t|dvS)a9Return True for command lines that can host the gateway runtime. ``gateway restart`` is normally a management command, not the gateway runtime. On hosts without a service manager, though, the manual restart fallback executes ``run_gateway()`` in that same process, so its argv stays as ``gateway restart`` while it owns the webhook port and writes runtime state. Keep the public ``looks_like_gateway_command_line()`` strict, and use this broader matcher only when validating Hermes-owned runtime records or no-supervisor cleanup scans. >r?restartrrs r'looks_like_gateway_runtime_command_liners 'w / /3E EErcFt|}|sdSt|S)zBReturn True when the live PID still looks like the Hermes gateway.F)rr)r1rs r_looks_like_gateway_processr%s*#C((G u *7 3 33rrecordc|dtkrdS|d}t|tr|sdSdd|D}t |S)zMValidate gateway identity from PID-file metadata when cmdline is unavailable.kindFargvr|c34K|]}t|VdSr+)r@)rparts rrz-_record_looks_like_gateway..6s(22Ts4yy222222r)get _GATEWAY_KIND isinstancelistrr)rrrs r_record_looks_like_gatewayr-s{ zz&]**u ::f  D dD ! !uhh22T22222G 27 ; ;;r profile_homec4|jjdkr|jSdS)aiReturn the profile id a HERMES_HOME directory represents, or None. A named profile's home is ``/profiles/`` (immediate parent is ``profiles``). The root/default home (``~/.hermes`` or ``$HERMES_HOME``) has no such parent, so it maps to the default profile (``None`` here, which callers treat as "the bare, flag-less gateway"). profilesN)parentname)rs r_profile_name_for_homer:s#:--  4rc|}t|}t|}|/|dkr)|}d||vp d||vpd||vSd|vsd|vrdSd|vr d||vrdSdS) uReturn True when a gateway command line belongs to ``profile_home``. Mirrors ``hermes_cli.gateway._matches_current_profile`` so the dashboard's cross-profile liveness fallback scopes a live PID to the *right* profile. In a per-profile container, one profile's stale ``gateway_state.json`` can record a PID that the OS has since recycled onto a DIFFERENT profile's live gateway. That recycled PID's command line still ``looks_like_gateway`` — so without a profile check the dead profile is reported running. A named profile gateway carries ``-p ``/``--profile `` (or, rarely, an explicit ``HERMES_HOME=``) on its argv; the default/root gateway runs bare with no profile flag. Ndefaultz --profile z-p z hermes_home=z -p FT)rrr@)rr command_lc profile_namehome_lc profile_lcs r _command_line_belongs_to_profilerGsJ),77L,%%''GLI$=$=!'')) % % % 3 6!Z!!Z/ 6'g'':5 z!!Vz%9%9u##(@w(@(@ (R(Ru 4r expected_homerct|}|r't|sdS|t||sdSdSt|S)u6Return True when a live PID still identifies as this gateway record. Prefer the live command line whenever it is readable. Runtime status files can outlive the gateway process they describe; if PID reuse leaves the same PID occupied by an s6 supervisor/log process, the stale record's argv should not make that unrelated process count as a running gateway. When ``expected_home`` is provided (the dashboard enumerating a specific profile's state file), the readable live command line must additionally belong to *that* profile — otherwise a PID recycled onto a different profile's live gateway would make the dead profile look alive. When the live command line cannot be read (Windows/permission), fall back to the persisted record so cross-platform behavior is preserved. FNT)rrrr)rr1r live_cmdlines r _record_matches_live_gateway_pidrlsc()--L6|DD 5  $-M -. . $5t %f - --rctjtttjt tjdS)N)r1rr start_time)r$getpidrrsysrrorrr_build_pid_recordrs9y{{SX-bikk::   rc rt}|dddditd|S)NstartingFr) gateway_state exit_reasonrestart_requested active_agents platforms updated_at)rupdater/)payloads r_build_runtime_status_recordrsJ!!G NN#""nn  NrpathcD|sdS |d}n#ttf$rYdSwxYw|sdS t j|}n#t j$rYdSwxYwt|tr|ndS)NrQr_) existsrdrHrIUnicodeDecodeErrorjsonloadsJSONDecodeErrorrdict)rrrs r_read_json_filers ;;==tnngn..4466 ' (tt  t*S//  tt $// 977T9s#(AAAA33BBrc,t||dddS)N),:)indent separatorsr )rrs r_write_json_filersdGDZHHHHHHrc|p t}|sdS |}n#tt f$rYdSwxYw|sdS t j|}n9#t j$r' dt|icYS#t$rYYdSwxYwwxYwt|trd|iSt|tr|SdSNr1) rrrdrHrIrrrrrcrhrr)rrrs r_read_pid_recordrs1*=??H ??  t  ""((** ' (tt t*S//   3s88$ $ $ $   444  '3 w'4   4sA&AA$#A$,BB7B$!B7$ B3.B72B33B7 lock_pathc<t|p tSr+)rr)rs r_read_gateway_lock_recordrs IA)?)A)A B BBrcr|sdS t|dS#tttf$rYdSwxYwr)rcKeyError TypeErrorrh)rs r_pid_from_recordrsO t6%=!!! i ,tts 66 cleanup_stalec|sdS |dn#t$rYnwxYw t|ddS#t$rYdSwxYw)aDelete a stale gateway PID file (and its sibling lock metadata). Called from ``get_running_pid()`` after the runtime lock has already been confirmed inactive, so the on-disk metadata is known to belong to a dead process. Unlike ``remove_pid_file()`` (which defensively refuses to delete a PID file whose ``pid`` field differs from ``os.getpid()`` to protect ``--replace`` handoffs), this path force-unlinks both files so the next startup sees a clean slate. NT missing_ok)unlinkrmrrrs r_cleanup_invalid_pid_pathrs  4((((       x((//4/@@@@@      s **#A A! A!c2|d|tjt || t j|dS#t$rYdSwxYw)Nr) seektruncaterdumprflushr$fsyncfilenorIhandles r_write_gateway_lock_recordr s KKNNN OOI!!6*** LLNNN  !!!!!      s &B BBc tr|dtj|dkr)|d||ttj | tj dn>tj | tjtjzdS#t t"f$rYdSwxYw)Nr rTF)r<rr$SEEK_ENDtellwriter_WINDOWS_LOCK_OFFSETmsvcrtlockingrLK_NBLCKfcntlflockLOCK_EXLOCK_NBBlockingIOErrorrIrs r_try_acquire_file_lockrs   H KK2; ' ' '{{}}!! T"""  KK, - - - N6==??FOQ ? ? ? ? K )F G G Gt W %uusC3C77D  D c . ddl} |t||jkrdSn&#t |dd$rYdSt $rYnwxYwt|t|S#t$rYnwxYwtr ddl }|j j }|j|j_|j|j_|j|j_d}d}d}d }d }|||zdt|} | s&|} | |krdS| |krd SdS || d} | |k|| S#|| wxYw#t*t,f$rYdSwxYw t/d t|d d} t5| dkr| ddkrdSn#t6$r t9jddddt=t|gd d d } | jdkr/| j !"drYdSn#t $rYnwxYwYntFtHt*f$rYnwxYw tKj&t|dd S#tN$rYdStH$rYd St*$rYdSwxYw)uCross-platform "is this PID alive" check that does NOT kill the target. CRITICAL on Windows: Python's ``os.kill(pid, 0)`` is NOT a no-op like it is on POSIX. CPython's Windows implementation (``Modules/posixmodule.c::os_kill_impl``) treats ``sig=0`` as ``CTRL_C_EVENT`` because the two values collide at the C level, and routes it through ``GenerateConsoleCtrlEvent(0, pid)`` — which sends a Ctrl+C to the entire console process group containing the target PID, not just the PID itself. Any caller that wanted to "check if this PID is alive" via ``os.kill(pid, 0)`` on Windows was silently killing that process (and often unrelated processes in the same console group). Long-standing Python quirk; see bpo-14484. Implementation: prefer :mod:`psutil` (hard dependency — the canonical cross-platform answer, maintained by Giampaolo Rodolà, uses ``OpenProcess + GetExitCodeProcess`` on Windows internally). Fall back to a hand-rolled ctypes ``OpenProcess`` / ``WaitForSingleObject`` pair on Windows + ``os.kill(pid, 0)`` on POSIX if psutil is somehow unavailable — e.g. stripped-down install or import error during the scaffold phase before ``psutil`` is pip-installed. rNF NoSuchProcessririWrzTr]r^rQr_Zrwryzstate=rxr{)(rirkrcstatus STATUS_ZOMBIErJrmbool pid_exists ImportErrorr<ctypeswindllkernel32c_void_p OpenProcessrestypec_uintWaitForSingleObject GetLastError CloseHandlerIAttributeErrorrrdrerrAr>r?r@rErGrHrrfrgr$rBProcessLookupError)r1rir#r%!PROCESS_QUERY_LIMITED_INFORMATION SYNCHRONIZE WAIT_TIMEOUTERROR_INVALID_PARAMETERERROR_ACCESS_DENIEDrerr wait_result stat_fieldsrs r _pid_existsr8s,   ~~c#hh''..00F4HHHuIv33   55    D F%%c#hh//000      D  MMM}-H,2?H (39=H ( 0,2MH ! )06 -"K%L&( #"# ))1K?CF ++--111 5---4u -&::61EE #l2$$V,,,,$$V,,,,(   55  -c#hh---..88'8JJPPRR ;!## A#(=(=u    N44SXX?#'  <1$$)9)9)D)DS)I)I$ 55    OW5    D   GCHHa 4!   55   44   55 sB=ABA*B A*'B)A**1B B)(B)5BFFF-FFFF21F26A%H K)A.JK J(%K'J((K-KK "K.. L; L LLc6 trN|ttj|tjddStj|tj dS#t$rYdSwxYw)Nr) r<rrrrrLK_UNLCKrrLOCK_UNrIrs r_release_file_lockr<s  8 KK, - - - N6==??FOQ ? ? ? ? ? K  7 7 7 7 7      sAB 1B BBctdSt}|jddt |dd}t |s|dSt||adS)zClaim the cross-process runtime lock for the gateway. Unlike the PID file, the lock is owned by the live process itself. If the process dies abruptly, the OS releases the lock automatically. NTparentsexist_oka+rQr_F)_gateway_lock_handlerrmkdiropenrcloser )rrs racquire_gateway_runtime_lockrFs't ! # #DKdT222 $w / / /F !& ) ) uv&&&! 4rct}|dSdat| |dS#t$rYdSwxYw)z&<&>&>',>BXBZBZ,Z,Zt  $ $ & &u $dW = = =F  !& ) )  v & & &  LLNNNNN    DD    LLNNNNN    DD   LLNNNN    D sTC5B BBB44 CCC,CC, C)&C,(C))C,c(t}|jddtjt } t j|t jt j zt j z}n#t$rwxYw t j |dd5}| |ddddS#1swxYwYdS#t$r* |dn#t $rYnwxYwwxYw)zWrite the current process PID and metadata to the gateway PID file. Uses atomic O_CREAT | O_EXCL creation so that concurrent --replace invocations race: exactly one process wins and the rest get FileExistsError. Tr>wrQr_Nr)rrrCrdumpsrr$rDO_CREATO_EXCLO_WRONLYFileExistsErrorfdopenrrmrrI)rrfdfs rwrite_pid_filerVsj ??DKdT222 Z)++ , ,F WT2: 1BK? @ @   Yr3 1 1 1 Q GGFOOO                     KK4K ( ( ( (    D  s` 9B BC-C CCCCC D(C?>D? D  D D  D) rrrrplatformplatform_state error_code error_messageserved_profilesrrrrrWrXrYrZr[c t} t| p t} t} | di| d| d<| d| d<| d| d<| d| d<t | d<|t ur|| d<|t ur|| d<|t urt|| d <|t urt|| d <|t urt|pg| d <|t urb| d |i} |t ur|| d <|t ur|| d <|t ur|| d<t | d<| | d|<t| | dS)zBPersist gateway runtime health information for diagnostics/status.rrr1rrrrrrrr[r"rYrZN) rrrr setdefaultr/_UNSETr parse_active_agentsrrr) rrrrrWrXrYrZr[rrcurrent_recordplatform_payloads rwrite_runtime_statusrbs $ % %Dd##E'C'E'EG&((N {B'''$V,GFO#E*GEN$V,GFO*<8GL(NNGLF""#0 &  !, &&'+,='>'>#$F""#6}#E#E f$$&*/*?R%@%@!"v";/33HbAA  ' '(6 W % V # #-7 \ *  & &0= _ -)5&)9 X&T7#####rc<t|p tS)aKRead the persisted gateway runtime health/status information. ``path`` is optional so callers that need to inspect a *different* profile's state file (e.g. the dashboard enumerating every profile) can do so without mutating ``HERMES_HOME`` in-process. Defaults to the active profile's ``gateway_state.json``. )rr)rs rread_runtime_statusrds 4=#;#=#= > >>rrcn tdt|S#ttf$rYdSwxYw)uCoerce a persisted ``active_agents`` value to a clamped non-negative int. The shared coercion for the in-flight gateway-turn count. Used on the WRITE side (``write_runtime_status``) and by both HTTP read surfaces (``/api/status`` and ``/health/detailed``) so the count is clamped to a single contract — never negative, never raising on a manually-edited or otherwise non-numeric value (degrades to ``0``). r)maxrcrrh)rs rr_r_'sD1c#hh z "qqs 44runninggateway_runningcx|sdS|tvrdS t|dkS#ttf$rYdSwxYw)uWhether the gateway is actively processing in-flight turns. The contract NAS gates lifecycle actions on. Busy iff the gateway is live (``gateway_running``), in the ``running`` state, AND at least one agent is mid-turn (``active_agents > 0``). Degrades to ``False`` whenever liveness is unknown, the state is anything but ``running``, or the count is absent/unparseable — i.e. a down or file-absent gateway reads "not busy", never a spurious "busy". NOTE: liveness keys off ``gateway_running`` (a live PID / health probe), NEVER ``updated_at`` — a healthy idle gateway never advances that timestamp. Fr)_DRAINABLE_GATEWAY_STATESrcrrh)rhrrs rderive_gateway_busyrk<sa u555u=!!A%% z "uus $99c2t|o|tvS)uWhether the gateway can accept a begin-drain request right now. True iff the gateway is live and in the ``running`` state — i.e. not already draining/stopping/stopped and not in a failed-start state. This is independent of ``active_agents``: an idle running gateway is drainable (the drain just completes immediately). Degrades to ``False`` for a down or non-running gateway. )r rj)rhrs rderive_gateway_drainablermUs  O]6O%OOrruntimecV||n t}t|tsdS|ddvrdSt |}|t |sdS|d}t |}| |||krdSt|||r|SdS)a`Return a live gateway PID from the runtime status record, if valid. ``get_running_pid()`` is the primary liveness source because it verifies the runtime lock and PID file. Launch-service managers can still leave us with a live process and a fresh ``gateway_state.json`` but no ``gateway.pid``; use this as a conservative fallback by checking both the persisted state and the OS process identity. ``expected_home`` scopes the OS-identity check to a specific profile's HERMES_HOME. Pass it when validating *another* profile's state file (the dashboard enumerating every profile): a stale record whose PID the OS has recycled onto a different profile's live gateway must not be reported running for the dead profile. Omit it (the default) for the active profile, where any live gateway command line is acceptable. Nr>Nstoppedstartup_failedrr)rdrrrrr8ror)rnrrr1recorded_start current_starts rget_runtime_status_running_pidrtas(!,gg2E2G2GG gt $ $t{{?##'JJJt 7 # #C {+c**{t[[..N+C00M"  % ^ + +t'MRRR 4rc6 t}t|}|Q t|d}n#ttt f$rd}YnwxYw||t jkrdS|ddS#t$rYdSwxYw)ahRemove the gateway PID file, but only if it belongs to this process. During --replace handoffs, the old process's atexit handler can fire AFTER the new process has written its own PID file. Blindly removing the file would delete the new process's record, leaving the gateway running with no PID file (invisible to ``get_running_pid()``). Nr1Tr) rrrcrrrhr$rrrm)rrfile_pids rremove_pid_filerws   &&   ve}--i4    #BIKK(?(? t $$$$$      s7B 8B AB AB 2B BBmetadatact||}|jddit|t ||pit d}t |}|<|r( |dn#t$rYnwxYw|r? t|d}n#tttf$rd}YnwxYw|tjkr@|d|dkrt#||d|fS|du}|s}t%|sd}njt'|}|d|||dkrd}|sH|d3|1t)|s"t+|} | t-|sd}|s9|d$|"t)|st+|} | d}|s t/d|d } | rb| d D]9} | d r"| d } | dvrd}n:n#tt8f$rYnwxYw|r( |dn#t$rYnwxYwd|fS tj|tjtjztj z} n!#tB$rdt |fcYSwxYw tj"| dd 5}tGj$||dddn #1swxYwYn7#tJ$r* |dn#t$rYnwxYwwxYwdS)zAcquire a machine-local lock keyed by scope + identity. Used to prevent multiple local gateways from using the same external identity at once (e.g. the same Telegram bot token across different HERMES_HOME dirs). Tr>)rX identity_hashrxrNrr1rr]z/statusrQr_zState:r>TrFrM)TN)&r[rrCrrWr/rrrrIrcrrrhr$rrrr8rorrrrrd splitlinesrrergrDrOrPrQrRrSrrrm)rXrOrxrrexisting existing_pidstalersr _proc_status_line_staterTrs racquire_scoped_lockrs %UH55I 4$777   $X..N"nn Fy))HI,,..       - - - -    D J# x//LL)Z0   LLL  29;; & &8<< +E+ET`IaIa+a+a Y / / /> !$8 |,,7  7 E E LL..:%1%l)C)CCC E% \22:%-7 EE.$9#F#FL#/7QRZ7[7[/ $% \22>%17 EE2$9#F#FL#/ $  '+,J\,J,J,J'K'K '..00*)5)?)?)?)Q)Q)\)\)^)^**#(#3#3H#=#=!*-2[[]]1-=F'-';';04$)E !* $_5  #   D 1111    (? "1 WY RY 6 D E E 111oi0000001 Yr3 1 1 1 &V Iff % % % & & & & & & & & & & & & & & &       - - - -    D   :sB B)(B)0CC"!C"B J))J=<J=K K'&K'/9L))MM N"N8 NNN N N ON21O2 N?<O>N??Ocft||}t|}|sdS|dtjkrdS|dt tjkrdS |ddS#t$rYdSwxYw)zDRelease a previously-acquired scope lock when owned by this process.Nr1rTr)r[rrr$rrorrI)rXrOrr}s rrelease_scoped_lockrs$UH55Iy))H ||Ebikk))||L!!%+E#~5  t $$$$       NsZAAB/BB BBBBB.C CCE E,+E,rc  t|}||tjtt t d}t t|dS#ttf$rYdSwxYw)aRecord that ``target_pid`` is being replaced by the current process. Captures the target's ``start_time`` so that PID reuse after the target exits cannot later match the marker. Also records the replacer's PID and a UTC timestamp for TTL-based staleness checks. Returns True on successful write, False on any failure. The caller should proceed with the SIGTERM even if the write fails (the marker is a best-effort signal, not a correctness requirement). )rr replacer_pidrrTF) ror$rr@rr/rrrIrgrrrs rwrite_takeover_markerrs 3J??$!2IKK$'(9(9$:$:&..    244f===t _ %uusA)A--BBcJttddtS)aCheck & unlink the takeover marker if it names the current process. Returns True only when a valid (non-stale) marker names this PID + start_time. A returning True indicates the current SIGTERM is a planned --replace takeover; the caller should exit 0 instead of signalling ``_signal_initiated_shutdown``. Always unlinks the marker on match (and on detected staleness) so subsequent unrelated signals don't re-trigger. rrrrr)rr_TAKEOVER_MARKER_TTL_Srrr consume_takeover_marker_for_selfrs- (!##,$    rcn tddS#t$rYdSwxYw)zDRemove the takeover marker unconditionally. Safe to call repeatedly.TrN)rrrIrrrclear_takeover_markerrsL !##**d*;;;;;      "& 44c t|}||tjtd}t t |dS#t tf$rYdSwxYw)a&Record that ``target_pid`` is being stopped intentionally. The gateway exits non-zero for unexpected SIGTERM so service managers can revive it. Service stop commands send the same SIGTERM, so the CLI writes this short-lived marker first to let the target process exit cleanly. )rr stopper_pidrTF)ror$rr/rrrIrgrs rwrite_planned_stop_markerrs| 3J??$!29;;&..    688&AAAt _ %uusAAA('A(cJttddtS)zDReturn True when the current process is being intentionally stopped.rrr)rr_PLANNED_STOP_MARKER_TTL_Srrr$consume_planned_stop_marker_for_selfrs+ '%'',(    rc@t}t|}|sdS t|d}|d}|dpd}nF#tt t f$r, |dn#t$rYnwxYwYdSwxYwt|tr* |dn#t$rYnwxYwdStj }||krdSt|}||||kSdS)ueReturn True only when a live planned-stop marker names the current process. This is a **non-destructive** probe used by the watcher thread (``gateway/run.py:_run_planned_stop_watcher``) to decide whether to trigger shutdown. Unlike :func:`consume_planned_stop_marker_for_self`, it never unlinks a marker that matches us — the shutdown handler does the authoritative consume on its own thread. It *does* clean up markers that can never apply to this process: malformed markers and markers older than the TTL are unlinked so a stale file left behind by a previous gateway instance cannot wedge the new one. Markers naming a different PID/start_time are left in place (they may still be consumed legitimately by the process they name) but report False here. Returns False (without raising) on any read/parse error. Frrrr:Tr)rrrcrrrrhrrIrrr$rro)rrrrrrrs r planned_stop_marker_targets_selfr$sk$ ) * *D T " "F u  -.. "JJ':;;ZZ --3 i ,  KK4K ( ( ( (    D uu  $>??  KK4K ( ( ( (    D uikkGWu-W55N$)C N22 4sHAA%%B(=BB( B!B( B!!B('B(C C%$C%cn tddS#t$rYdSwxYw)z/Remove the planned-stop marker unconditionally.TrN)rrrIrrrclear_planned_stop_markerrbsL %''..$.?????      rTrc|p t}t|}t|}|s'|t}||St ||dSt |}t |}||fD]g}t|} | t| s$| d} t| } | | | | krSt|| r| cSht |||t}||SdS)zReturn the PID of a running gateway instance, or ``None``. Checks the PID file and verifies the process is actually alive. Cleans up stale PID files automatically. Nrr) rrrKrtrrrrr8rror) rrresolved_pid_pathrJ lock_active runtime_pidprimary_recordfallback_recordrr1rrrss rget_running_pidrjsU!3MOO/0ABB01CDDK   8::K&""!"3=QQQQt%&788N/0BCCO!?3v&& ; 3  L11/44  %-*C YgHgHg  +FC 8 8 JJJ /}MMMM466  "  4rc(t||duS)z1Check if the gateway daemon is currently running.rN)rrs ris_gateway_runningrs 8= A A A MMrr+)rN)d__doc__rSrr$rrCr>rrrpathlibrhermes_constantsrtypingrr utilsr rWrrrrr&r<objectr^rrBrrrrr)r@r/rcr rNrWr[rorqrrrrrrrrrrrrrrrrrrr rr8r<rFrHrKrVrbrdr_ frozensetrjrkrmrtrwtuplerrrrrrrrrrrrrrrrrrrrrrrrs     '''''''',,,,,, ######<7MMMMLLL + lg% '# t    ))Xd^)t))));$;;;; 2t22222c2222.3sdtBE#E#EEEEEEsEtEEEE  #    F(( (((( 's'x}''''TGtGd GGGGT9S4Z9D9999 FS4Z FD F F F F4S4T4444  .  ....@4 d38n    :$:8DcN#;::::&I4I$sCx.ITIIIIx~$:CC$C8DQTVYQYNC[CCCCXd38n5(3-       ,     d     sSsTssssn    d*     htn.6 # !0$0$0$0$0$ 0$  0$  0$0$0$0$0$ 0$0$0$0$f??htn?c3h8P???? S S    $&Iyk22-0AD 2 P Pc Pd P P P P)-)%)))) d38n %)D>)c] ))))X    0sssscsXd3PS8n=Usafgkmuvz{~AD|DwEnFhFbGssssl  s  c  d     $ $&****}*sm* ****@5 <,4,,,, 0t0000 STG GG G  G  GGGGTcd4$&    #$*d;$;;;;|     $----tn--c] ----b $NNNNtnNN NNNNNNr