sj UdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlmZddlmZddlmZddlmZddlmZddlmZdd lmZmZmZdd l m!Z!dd l"m#Z$dd l%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-dd l.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mZ>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMddlNmOZOddlPmQZQddlRmSZS ddlTZTn #eU$rdZTYnwxYwejVeWZXdZYdZZde[de\de\fdZ]de\fdZ^de\fdZ_Gdde`ZaGdde`Zbe jcdZdde[de[fdZede[deffd Zgd!e&de&fd"Zhd#e(e[e&fde*e[fd$Zidd&e[de[fd'ZjekZlemd(d)hZnd*e[de,e[e)e[ffd+Zode[de,e[e)e[ffd,Zpd-e)e[de)e[fd.Zqd-e)e[de)e[fd/Zre-d0Zse!d1z Ztd2Zud3ZvetZwdefd4Zxd5Zyd6Zzd7Z{e,ed8fe|d9<de*efd:Z}d;Z~deffd<Zemhd=Zdae*efe|d><d?e&deffd@ZdeffdAZdeffdBZde)efdCZdDedEedeffdFZdGeddfdHZdIZdJZdae*e[e|dK<ejZeZee[e|dL<ejZeZee[e|dM<ejZdNe*e[ddfdOZde*e[fdPZdQZdNe(e[e&fdeffdRZdSe)e(e[e&fde)e(e[e&ffdTZe jcdUZdNe(e[e&fdeffdVZdSe)e(e[e&fde)e(e[e&ffdWZddYe[de[fdZZd[e jde*e[fd\Zd[e jddfd]Zd[e jddfd^Zd[e jddfd_Z dd`e*edeffdaZ#de[fdbZde[fdcZGdddee jZd1d5dfd[e jdge[dhefde[fdiZd[e jdje[de[fdkZd5dld[e jdge[dmefde[fdnZde[fdoZd5dpdge[dqefdrefddfdsZdge[dteddfduZd1dvd[e jdge[ddfdwZdxZeZee[e|dy<ejZdtedeffdzZdtedeffd{Zd|Zdtee[zdzdeffd}Zd~ZdZde[fdZdGedeffdZdZdZe jdkZejdGefdZd[e jddfdZdZdZdGedefdZdGeddfdZdGeddfdZdGedeffdZdddGedefddddfdZdGeddfdZefdGede\ddfdZdGeddfdZd1dvdGedge[ddfdZdGede*e[fdZdddGedefde(e[e&ffdZdGedefde(e[e&fde(e[e&ffdZdZdZdefdZdeffdZd[e jdeffdZGddeҦZGddeҦZGddeԦZGddeҦZddZdd5ddede\defdeffdZdede*efdZdGede(e[e&ffdZdGede*e\fdZdZdZdZdZemhdZde*e[defde*e[de[fdZGddeSeQeOZGd„dæZdS)a} SQLite State Store for Hermes Agent. Provides persistent session storage with FTS5 full-text search, replacing the per-session JSONL file approach. Stores session metadata, full message history, and model configuration for CLI and gateway sessions. Key design decisions: - WAL mode for concurrent readers + one writer (gateway multi-platform) - FTS5 virtual table for fast text search across all session messages - Compression-triggered session splitting via parent_session_id chains - Batch runner and RL trajectories are NOT stored here (separate systems) - Session source tagging ('cli', 'telegram', 'discord', etc.) for filtering N)deque)contextmanager)Path)sanitize_contextActivityProvenance)_sanitize_surrogates)SKILL_EXCERPT_JOINTSKILL_SCAFFOLD_SQL_LIKEdescribe_skill_invocation)get_hermes_home)is_sqlite_wal_reset_vulnerable)AnyCallableDictListOptionalSetTupleTypeVar)_BRANCH_CHILD_SQL_COMPRESSION_CHILD_SQL_FTS_CJK_TRIGGERS _FTS_TRIGGERS_LISTABLE_CHILD_SQL_PREVIEW_RAW_SELECT_RESET_END_REASONS_RESET_END_REASONS_SQL_ephemeral_child_sql_legacy_reset_child_sql_shape_preview_sql_session_last_active_sql_session_last_active_by_id escape_likeDEFERRED_INDEX_SQLFTS_CJK_STALE_KEYFTS_SQL FTS_STALE_KEYFTS_STORAGE_VERSIONFTS_TRIGRAM_SQLLEGACY_FTS_SQLLEGACY_FTS_TRIGRAM_SQLMAX_FTS5_QUERY_CHARS SCHEMA_SQLSCHEMA_VERSION_PREVIEW_CONTENT_SQL_PREVIEW_HEAD_CHARS_PREVIEW_MAX_CHARS_PREVIEW_SCAFFOLD_WINDOW_PREVIEW_SCAFFOLDED_SQL)SessionPortabilityMixin)SessionSchemaMixin)SessionSearchMixini Nkeyfallbackreturnc ddlm}|dpi}||}||St|}|dkr|n|S#t$r|cYSwxYw)aResolve a transcript safety limit from config at call time. Reads ``sessions.`` from config.yaml lazily (avoiding a circular import at module load) and falls back to the module constant when the config subsystem is unavailable (scaffold installs, stripped test environments). A value of 0 disables the guard entirely. No caching: ``load_config_readonly`` is already mtime-cached, and resolving fresh keeps tests that monkeypatch config or the module constants working. rload_config_readonlysessions)hermes_cli.configr=getint Exception)r8r9r= sessions_cfgvaluelimits 0/home/agent/.hermes/hermes-agent/hermes_state.py_configured_transcript_limitrGbs ::::::++--11*==C   %% =OE  uu0 s=AA A('A(c,tdtS)z:Config-resolved resume guard limit (0 disables the guard).max_resume_messages)rGMAX_SAFE_RESUME_MESSAGESrFresolved_max_resume_messagesrMy '7  rLc,tdtS)zDConfig-resolved in-memory export guard limit (0 disables the guard).max_export_messages)rGMAX_SAFE_EXPORT_MESSAGESrKrLrFresolved_max_export_messagesrRrNrLc2eZdZedfdededeffd ZxZS)SessionResumeTooLargeErrorzacross its lineage message_countrEscopec z||_||_td|d|d|ddS)Nzsession has at least z active messages z; safe resume limit is zi. Export the session instead, or set sessions.max_resume_messages: 0 in config.yaml to disable the guard.)rUrEsuper__init__)selfrUrErV __class__s rFrYz#SessionResumeTooLargeError.__init__sq +   SM S SE S S$) S S S     rL)__name__ __module__ __qualname__rJrAstrrY __classcell__r[s@rFrTrTsf.)                  rLrTc0eZdZefdededeffd ZxZS)SessionExportTooLargeError session_idrUrEc||_||_||_td|d|d|dS)Nz session 'z' has at least z1 active messages; safe in-memory export limit is )rdrUrErXrY)rZrdrUrEr[s rFrYz#SessionExportTooLargeError.__init__sk %*   6  6 6= 6 6.3 6 6     rL)r\r]r^rQr_rArYr`ras@rFrcrcsc .                  rLrcz(?:^|:)pid=(\d+)(?::|$) system_promptcttj|dS)Nutf-8)hashlibsha256encode hexdigest)rfs rF_system_prompt_hashrms, >-..w77 8 8 B B D DDrLholderct|pd}|dS t|d}n#tt f$rYdSwxYw|dkrdS|t jkrdSt' tj | S#t$rYdSwxYwt j dkrdS t j |dn*#t$rYdSttt f$rYdSwxYwdS)aReturn True only when a structured lock holder's local PID is gone. Compression locks are stored in a host-local SQLite database and holder IDs created by ``conversation_compression`` start with ``pid=``. A process killed during gateway shutdown cannot release its lease, so waiting for the full TTL makes every new turn repeatedly attempt compaction. Reclaim only when the kernel proves that PID no longer exists; legacy/unstructured holders, same-process holders, permission errors, and any probe doubt remain protected until normal TTL expiry (conservative: PID reuse must never steal a live lease, and a wrongly-kept lease self-heals via TTL). NFrntT)_COMPRESSION_LOCK_HOLDER_PID_REsearchrAgroup TypeError ValueErrorosgetpidpsutil pid_existsrBnamekillProcessLookupErrorPermissionErrorOSError OverflowError)rnmatchpids rF(_compression_lock_holder_process_is_deadrsB , 2 26Replace lone surrogates when *value* is text; pass anything else through. sqlite3 encodes bound ``str`` parameters as UTF-8 and raises ``UnicodeEncodeError`` on lone surrogates (U+D800..U+DFFF), so a single such code point anywhere in a message aborts the whole write. No-op for well-formed text. ) isinstancer_r rDs rF_scrub_surrogatesrs'+5UC*@*@ K  & & &eKrLrowc|dpd}|r|S|dpd}|pdS)uvA session's workspace grouping key: its git repo root when known, else its cwd. Branch is deliberately excluded so checking out a new branch doesn't fragment a workspace's session history. Returns None for cwd-less (unbound) sessions. Both fields are already recorded on ``sessions`` — this just picks the coarser identity for grouping/filtering. git_repo_rootrpcwdN)r@strip)rrootrs rF workspace_keyrs] GGO $ $ * 1 1 3 3D  775>> R & & ( (C ;$rL model_configcolcd|dS)Nzjson_extract(COALESCE(z, '{}'), '$._delegate_from')rK)rs rF_delegate_from_jsonrs GC G G GGrLautocustom cwd_prefixch|dp|}t|}d||d|dgfS)N/\zA(s.cwd = ? OR s.cwd LIKE ? ESCAPE '\' OR s.cwd LIKE ? ESCAPE '\')/%z\\%)rstrip _escape_like)rprefixescs rF_cwd_prefix_clauser sL   u % % 3F v  CM C]]]+ rLcj|dp|}t|\}}d|d|g|fS)uMatch sessions whose ``workspace_key(row)`` equals ``key``. Mirrors :func:`workspace_key`: a session belongs to workspace ``key`` when its recorded ``git_repo_root`` equals ``key``, or — for rows that predate per-session git metadata — when its ``cwd`` is at or under ``key`` (so a session started in ``repo/src`` still groups with ``repo``). Used by ``hermes -c``/``--resume`` to continue the most recent session in the *current* workspace rather than the global MRU. rz@(s.git_repo_root = ? OR (COALESCE(s.git_repo_root, '') = '' AND )))rr)r8r cwd_clause cwd_paramss rF_workspace_key_clausersOZZ   %#F/77J Y:YYY * rL parent_idsc t}d|Dtt}|rddt |z}|d|d|d|d|d ||z}fd |D}||fd DS) ueDelegate-subagent ids to cascade-delete with *parent_ids*. Only rows carrying the ``_delegate_from`` marker (set at creation, and backfilled by the v16 migration) — generic untagged children keep the orphan-don't-delete contract. Walks marker chains recursively so an orchestrator subagent's own delegate children go too (FK safety). ch|]}||SrKrK.0sids rF z._collect_delegate_child_ids..6s . . .S# .S . . .rL,?zSELECT id FROM sessions WHERE z IN (z) OR (parent_session_id IN (z) AND z IS NOT NULL)c4g|]}|dv |dSidrK)rrfounds rF z/_collect_delegate_child_ids..Gs+UUU#c$iu>T>TCI>T>T>TrLcg|]}|v| SrKrK)rrseedss rFrz/_collect_delegate_child_ids..Js# 5 5 5CCu$4$4C$4$4$4rL)rsetlistjoinlenexecutefetchallupdate)connrdffrontierphcursorrrs @@rF_collect_delegate_child_idsr-s   B . .J . . .E%jjEE{{H  XXcCMM) * * ER E Eb E E)+ E E35 E E E x    VUUU):):UUU X  6 5 5 55 5 5 55rLct||}|rsddt|z}|d|d||d|d||d|d||S)Nrr*DELETE FROM messages WHERE session_id IN ()IUPDATE sessions SET parent_session_id = NULL WHERE parent_session_id IN ("DELETE FROM sessions WHERE id IN ()rrrr)rridsrs rF_delete_delegate_childrenrMs %dJ 7 7C F XXcCHHn % % G"GGGMMM  1+- 1 1 1    ?"???EEE JrLTstate.dbN@cRttkrtStdz S)uResolve the default state DB path at call time. ``DEFAULT_DB_PATH`` is computed when this module is first imported, which freezes the developer's real ``~/.hermes`` even when a test fixture later redirects ``HERMES_HOME`` — importing this module during collection was enough to point every default ``SessionDB()`` at the real state.db. Precedence: 1. A deliberately re-pointed ``DEFAULT_DB_PATH`` (differs from the import-time snapshot — the established test escape hatch) wins. 2. Otherwise resolve ``get_hermes_home()`` fresh so a runtime ``HERMES_HOME`` redirect takes effect regardless of import order. r)DEFAULT_DB_PATH_IMPORT_DEFAULT_DB_PATHr rKrLrF_default_db_pathr{s'111   z ))rLFHERMES_STATE_DB_GUARD_BYPASSrK. _STATE_DB_GUARD_EXTRA_DENY_ROOTSc tjdkr|tjdd}|rt |dz n4t tjddz dz dz }n/t tjddz }| S#t$rYd SwxYw) uAResolve the REAL platform-default Hermes root for the guard. Deliberately avoids ``Path.home()`` / ``hermes_constants``: tests routinely monkeypatch ``Path.home`` to a tempdir, and ``hermes_state`` is often imported lazily *while* such a patch is active — resolving through the patched callable would misidentify the test's own hermetic home as "production" (false positive) or, worse, miss the real one (false negative). ``os.path.expanduser`` reads the HOME environment variable / passwd entry, which the hermetic conftest never rewrites. win32 LOCALAPPDATArphermes~AppDataLocalz.hermesN) sysplatformrxenvironr@rrpath expanduserresolverB)basers rF_real_platform_state_rootrs  <7 " ":>>."55;;==DTT X%%"',,S1122Y>H8S D **3//009>* + + 6 :>>4 5 5  rL>py.test pytest.exe py.test.exepytest_PYTEST_ANCESTORprocc |pg}n#t$rYdSwxYw|D]} t|dd}|ddddd}n#t$rYwxYw|tvrdSdS) aSTrue when *proc*'s command line is a pytest invocation. Covers both ``pytest ...`` (launcher on argv[0]) and ``python -m pytest`` (launcher as a bare ``pytest`` token). A process whose command line we cannot read is treated as "not pytest": guessing the other way would refuse production opens for unrelated reasons. F"'\/rqT)cmdlinerBr_rreplacersplitlower_PYTEST_LAUNCHER_NAMES)rrargtokenr|s rF_process_looks_like_pytestrs,,..&B uu   HHNN3''--c22E==s++223::2>DDFFDD    H  ) ) )44 * 5s ''A7B'' B43B4cttSd}tO tjD]}t |rd}nn#t $rd}YnwxYw|a|S)uvTrue when some ancestor process of this one is a pytest run. ``_running_under_pytest`` reads ``PYTEST_*`` env vars, which a child spawned with a rebuilt environment loses at the same moment it loses the ``HERMES_HOME`` redirect: that child aims at the production DB *and* disarms the guard in one step (#82770). Ancestry is the one test-context signal that survives an env rebuild, so it backs the env check up. Fails open (``False``) when ``psutil`` is unavailable or the walk errors — that restores the previous env-only behaviour rather than blocking real user runs on a psutil hiccup. NFT)rrzProcessparentsrrB)rparents rF_has_pytest_ancestorr s# E   .**2244  -f55 EE   EEE  Ls;A A$#A$c>trdStS)uqTrue when this process is a test run, by environment or by ancestry. Order matters for cost: the env probe is two dict lookups and covers the common in-process case, so the ancestry walk only runs for processes the environment claims are ordinary user runs — and its answer is memoised, so a real ``hermes`` invocation pays for at most one walk. T)rrrKrLrF_in_test_contextr)s#t  ! !!rLcg}t}|||tD]Y} |t|J#t $rYVwxYw|SN)rappendrrrrrB)roots real_rootextras rF_production_state_rootsr 6sE)++I Y1  LLe//1199;; < < < <    H  LsAA99 BBresolvedrc|j|krdS ||}n#t$rYdSwxYw|j}t |dko |ddkS)aTrue when *resolved* is a DB file of the real Hermes home *root*. Matches files directly in the root (``/state.db``) and profile homes (``/profiles//state.db``). Deliberately does NOT match deeper scratch paths (e.g. repo worktrees that happen to live under ``~/.hermes/hermes-agent/...``) so hermetic tests using unusual tempdirs cannot false-positive. TFrprofiles)r relative_torwpartsr)r rrelrs rF_is_production_state_dbrCsw$t""4(( uu IE u::? 5uQx:55s % 33db_pathc ts$tjtrdSt sdS t |}n#t$rYdSwxYwtD]0}t||rtd|d|dtd1dS)u7Fail hard when a pytest-context process resolves a production DB. Raises ``RuntimeError`` before any connection, mkdir, journal-mode pragma, or byte probe can touch the live database. No-op outside pytest and for hermetic (tmp ``HERMES_HOME``) paths. "pytest context" means environment *or* process ancestry — see :func:`_in_test_context`. Env alone is not enough: a child spawned with a rebuilt environment loses ``PYTEST_*`` and ``HERMES_HOME`` together, which is precisely the state in which it writes to production (#82770). NzAlive-system guard: test attempted to open production state.db at z (under real Hermes root u). Tests must run against a temporary HERMES_HOME — pass an explicit tmp db_path or let the hermetic conftest redirect HERMES_HOME. If this test genuinely needs the live database, mark it with @pytest.mark.live_system_guard_bypass — or, for a spawned child process, export z=1 in its environment.) _STATE_DB_GUARD_BYPASSrxrr@_STATE_DB_GUARD_BYPASS_ENVrrrrrBr r RuntimeError)rr rs rF_ensure_test_isolationrVs0J!K!K   ==++--5577 '))   "8T 2 2 #'##BF##*D###      s3A33 BB)zlocking protocolznot authorizeddisk i/o errori_last_init_error_wal_fallback_warned_paths_wal_reset_bug_warned_pathsmsgcJt5|addddS#1swxYwYdS)uoRecord (or clear) the most recent state.db init failure. Thread-safe via _last_init_error_lock. Callers pass a message to record a failure or None to clear. SessionDB.__init__ only calls this to SET on failure — it deliberately does NOT clear on success, because in a multi-threaded caller (e.g. gateway / web_server per- request SessionDB() instantiation), a concurrent successful open racing past a different thread's failure would erase the cause string that thread's /resume handler is about to format. Explicit clears (e.g. test fixtures) are still supported by passing None. N)_last_init_error_lockr)rs rF_set_last_init_errorrst s ctS)aKReturn the most recent state.db init failure, if any. Slash-command handlers (``/resume``, ``/title``, ``/history``, ``/branch``) call this to surface the underlying cause in their error messages when ``_session_db is None``. Returns ``None`` if SessionDB initialized successfully (or hasn't been attempted). )rrKrLrFget_last_init_errorr!s  rL)z:Review the conversation above and update the skill libraryz;Review the conversation above and consider saving to memoryc$t|tsdS|ddvrdS|d}t|tsdS|t fdt DS)ayTrue when ``msg`` is a persisted background-review harness prompt. These are user/system turns the forked skill/memory review agent wrote into a real session in older builds (before the ``_persist_disabled`` isolation fix). They instruct the agent to act as the curator under a hard tool restriction, so replaying them as live history hijacks the session. Frole>usersystemcontentc3BK|]}|VdSr) startswith)rpheads rF z8_is_background_review_harness_message..s/DDatq!!DDDDDDrL)rdictr@r_lstripany_REVIEW_HARNESS_PREFIXES)rr&r*s @rF%_is_background_review_harness_messager0s c4 u wwv000uggi  G gs # #u >>  D DDDD+CDDD D DDrLmessagesc|s|Sg}d}|D]\}t|rd}|r1d}t|tr|ddkrG||]|S)aSDrop background-review harness messages and the curator-mode assistant reply that immediately followed each one. Walk the list once; when a harness user/system message is found, skip it and also skip the next message if it is the assistant turn that answered it. Everything else passes through untouched and in order. FTr# assistant)r0rr,r@r)r1outskip_next_assistantrs rF _strip_background_review_harnessr6s  "C   0 5 5 "&    "' #t$$ K)G)G 3 JrLz^\[[A-Za-z_][A-Za-z0-9_.-]*\]$c^t|tsdS|ddkrdS|dsdS|d}t|tsdSt t |S)aTrue when ``msg`` is a persisted assistant turn whose content is a bare bracketed marker (e.g. ``[memory]``) left over from a tool-call turn. Before the #78148 fix in ``agent.conversation_loop``, a local tool-call template could emit a bare marker as assistant content alongside a real tool call. The loop cached that marker as a fallback and later replayed it as the "final response", persisting it into the session. Sessions written before the fix can still carry these rows. Fr#r3 tool_callsr&)rr,r@r_r_STALE_TOOL_CALL_MARKER_RE fullmatchr)rr&s rF"_is_stale_tool_call_marker_messager; s c4 u wwv+%%u 77< uggi  G gs # #u *44W]]__EE F FFrLcd}|D]}t|r d|d<|dz }|rtd||S)uClear bare protocol-marker content persisted before the #78148 fix. Replaying "[memory]" as if the model had actually answered teaches the model, by example, to keep emitting the same marker in later turns — the exact symptom the issue reported. Only the stray ``content`` field is blanked; the tool call and its result are left untouched so provider tool_call/tool_result pairing stays intact. Sessions with no affected rows pass through unchanged. rrpr&rqzMCleared %d stale tool-call marker message(s) while restoring session (#78148))r;loggerinfo)r1repairedrs rF_strip_stale_tool_call_markersr@!sfH -c 2 2 C N MH  [     OrLSession database not availablercts|dSd}tfdtDrd}|d|dS)u~Format a user-facing 'session DB unavailable' message with cause. When ``SessionDB()`` init fails, callers set ``_session_db = None`` and several slash commands (/resume, /title, /history, /branch) previously responded with a bare ``"Session database not available."`` — no indication of WHY. This helper includes the captured cause (typically ``"locking protocol"`` from NFS/SMB) and points users at the known culprit so they can fix it themselves. Example output: Session database not available: locking protocol (state.db may be on NFS/SMB — see https://www.sqlite.org/wal.html). .rpc3DK|]}|vVdSr)r)rmarkercauses rFr+z0format_session_db_unavailable..Ls0 G Gv6U[[]] " G G G G G GrLuN (state.db may be on NFS/SMB/FUSE/ZFS — see https://www.sqlite.org/wal.html): )r!r._WAL_INCOMPAT_MARKERS)rhintrFs @rFformat_session_db_unavailablerJ:sq ! !E ||| D G G G G1F G G GGG`_ & & &t & & &&rLrczd}tdD] } |d}n\#tj$rJ}|}dt |vrYd}~dStjdYd}~d}~wwxYw|dS|d}t|tr) | d}n#t$rYdSwxYw|3t | ndcS|td|dS) uRead the journal mode from the SQLite DB header on disk. Returns the mode string (e.g. ``"wal"``, ``"delete"``), or ``None`` if the value cannot be determined (new DB, or PRAGMA read failed). A PRAGMA read can fail transiently with ``disk i/o error`` on virtualized block devices (XFS on cloud hosts). Treating that as "mode unknown" pushes callers onto their fail-closed unknown-mode branch even though the on-disk mode is perfectly readable a few milliseconds later. Retry the read a few times before giving up: transient EIO clears, deterministic unsupported-filesystem errors do not. ``None`` is still returned on final failure so the caller's existing "unknown → refuse to downgrade" logic applies. NPRAGMA journal_moder皙?rasciiz:_on_disk_journal_mode: retries exhausted on disk read (%s))rangerfetchonesqlite3OperationalErrorr_rtimesleeprbytesdecodeUnicodeDecodeErrorrr=debug)rlast_exc_rexcmodes rF_on_disk_journal_moder^Qsp%)H 1XXGG ,,455>>@@CC'   Hs3xx~~'7'777tttttt Jt    HHHH   ;441v dE " "  {{7++%   ttt ,0,B %B9BB=C C"!C"c |dtdS#tj$r&}td|Yd}~dSd}~wwxYw)uBound the WAL so it returns space to the OS after big transactions. SQLite's default ``journal_size_limit`` is -1 (unlimited): after a checkpoint the WAL file is *reused in place* and never truncated, so ``state.db-wal`` permanently retains the high-water mark of the largest transaction ever run against it. A single bulk operation is enough to strand gigabytes. Observed on a 3.0 GB ``state.db``: ``hermes sessions optimize`` (FTS merge + VACUUM) rewrites every page through the WAL, leaving a **3.07 GB** ``state.db-wal`` sitting next to the database indefinitely — the host went from 6.9 GB free to 772 MB (100% full) and stayed there, because nothing shrinks the WAL back down. An explicit ``PRAGMA wal_checkpoint(TRUNCATE)`` reclaimed the full 3.07 GB, which confirms the space was pure slack rather than live data. That also makes the maintenance command self-defeating on exactly the databases that need it most: the larger the DB, the larger the WAL it strands, so ``optimize`` can consume more disk than it frees. ``journal_size_limit`` makes SQLite truncate the WAL back to the limit at each checkpoint. 64 MiB is comfortably above normal transaction sizes (so steady-state commits never pay a truncate) while capping the stranded slack at a bounded, predictable figure. ``hermes_cli/kanban_db.py`` already bounds its WAL growth with ``wal_autocheckpoint=100``; the session store — by far the larger database — had no equivalent. Best-effort: never raises. A failure here only costs disk slack, and must not prevent the database from opening. zPRAGMA journal_size_limit=z"journal_size_limit not applied: %sN)r_WAL_SIZE_LIMIT_BYTESrRrSr=rY)rr\s rF_apply_wal_size_limitrazsxB@ I2GIIJJJJJ  #@@@ 93?????????@s!AAActjdkrdS |ddS#tj$rYdSwxYw)uEnable ``PRAGMA checkpoint_fullfsync`` on macOS (no-op elsewhere). On Darwin, ``synchronous=FULL`` (the WAL default) issues a plain ``fsync()``, which Apple documents does *not* guarantee that data has reached stable storage or that writes are not reordered — see the ``fsync(2)`` man page. SQLite's WAL corruption-safety guarantee assumes the OS honors the fsync write barrier; macOS does not unless the app uses ``F_FULLFSYNC``. During a launchd *system* shutdown/reboot the OS page cache is dropped (effectively a power-loss event for in-flight pages), so a WAL checkpoint whose ``fsync()`` "reported" durable may never have hit the platter — corrupting ``state.db`` with a malformed image. This is the trigger in issue #30636 ("SIGTERM during launchd shutdown under high load"), distinct from a plain in-session kill (which the page cache survives and SQLite recovers from). ``checkpoint_fullfsync=1`` forces an ``F_FULLFSYNC`` barrier only at checkpoint boundaries — where WAL frames land in the main DB — so the cost amortizes to roughly +0.1 ms/commit (vs ~+4 ms for the broader ``fullfsync=1`` that flushes on every commit's WAL sync). Guarded by ``sys.platform == "darwin"`` because ``F_FULLFSYNC`` is macOS-only; on other platforms the PRAGMA is a no-op, so we skip it entirely. Best-effort: never raises. darwinNzPRAGMA checkpoint_fullfsync=1rrrrRrSrs rF_apply_macos_checkpoint_barrierrfsY6 |x  455555  #     +>>ctjdkrdS |ddS#tj$rYdSwxYw)uSEnforce ``PRAGMA synchronous=FULL`` on macOS to prevent btree corruption. On Darwin, the default ``synchronous=NORMAL`` only calls ``fsync()``, which Apple's fsync(2) man page explicitly states does *not* guarantee data-on-platter or write-ordering. During a WAL checkpoint race with process termination (e.g., launchd shutdown), this can leave the main DB with half-written btree pages → ``btreeInitPage error 11``. WAL mode's durability guarantee assumes the OS honors fsync barriers; macOS does not unless we explicitly set ``synchronous=FULL``, which issues a real ``fsync()`` on every transaction commit. The ``F_FULLFSYNC`` barrier at checkpoint boundaries is handled separately by :func:`_apply_macos_checkpoint_barrier`. This function is called after any successful WAL activation (either from ``apply_wal_with_fallback()`` setting a fresh WAL or when probing an existing WAL mode). It ensures macOS connections always use FULL synchronous mode, even if a prior connection set ``synchronous=NORMAL``. Best-effort: never raises. rcNzPRAGMA synchronous=FULLrdres rF_enforce_macos_synchronous_fullrisY, |x  ./////  #     rg version_infoc@||n tj}t|S)a:Return True when the linked SQLite library has the WAL-reset bug. Upstream documents the bug in versions 3.7.0 through 3.51.2, fixed in 3.51.3+, with backports 3.50.7 and 3.44.6: https://sqlite.org/wal.html#walresetbug Pre-WAL libraries (< 3.7.0) cannot hit the race and are treated as safe. )rRsqlite_version_info_is_sqlite_wal_reset_vulnerable)rjr>s rFrrs#(3<<9TD *4 0 00rLcH tjd} |d}|n#|wxYwn#tj$rYdSwxYw|r|ddSt |dS)zCReturn ``sqlite_source_id()``, or an empty string when unavailable.:memory:zSELECT sqlite_source_id()rpr)rRconnectrrQcloseErrorr_)rrs rFsqlite_source_idrssz** ,,:;;DDFFC JJLLLLDJJLLLLL =rr #a&.r s1v;;s'A-'AA-A))A--B?Bc\ ddlm}|pi}|di}t|tsdS|dd}n#t $rYdSwxYwt|t sdS|}|dvr|ndS)azReturn the configured journal mode (``wal`` or ``delete``). ``database.journal_mode`` in config.yaml is the canonical operator setting. ``wal`` remains the default; use ``delete`` when the backing filesystem does not provide WAL-safe durability (for example macOS virtiofs, NFS, or SMB). Invalid or malformed values fail safely to the existing default. rr<databasewal journal_mode)rvdelete) r?r=r@rr,rBr_rr)r=configrurawr]s rFresolve_journal_moder{s ::::::%%''-2::j"--(D)) 5ll>511 uu c3  u 99;;    D,,,44%7s=AA A&%A&ceZdZdZdS)WalUnsupportedErroraRaised by :func:`apply_wal_with_fallback` when ``require_wal=True`` and the filesystem cannot provide WAL journal mode. Covers both shapes of WAL refusal on network filesystems (NFS / SMB / FUSE / the AgentFS NFS overlay): SQLite *raising* ``SQLITE_PROTOCOL`` ("locking protocol"), and the quieter macOS-NFS case where ``PRAGMA journal_mode=WAL`` silently returns the still-effective mode without raising. Subclasses ``sqlite3.OperationalError`` so existing ``except sqlite3.OperationalError`` DB-init handling still catches it, while callers that specifically mandate WAL can catch this narrower type. Nr\r]r^__doc__rKrLrFr}r}s    rLr})db_label require_walrrc t}trt|||dkSt|}|dkr/t |t |t |dS|dkrH|tjdt|d}|dkrtjd|pdd |S | d  }|rA|d 9t|d  nd }|dkr/t |t |t |dStd |d }|r|t!|||pdS#tj$r} t#| trt|  t% fdt&Dsd vrt)dD]} t+jd | d  }nB#tj$r0} dt| vr| } Yd} ~ zd} ~ wwxYw|rA|d 9t|d  nd }|dkr4t |t |t |Yd} ~ dSt|} | dks| |rtt| | t!|| t|dYd} ~ dSd} ~ wwxYw)u Set ``journal_mode=WAL`` on ``conn``, falling back to DELETE on failure. Returns the journal mode actually set (``"wal"`` or ``"delete"``). On WAL-incompatible filesystems (NFS, SMB, some FUSE, ZFS), SQLite either raises ``OperationalError("locking protocol")`` / ``OperationalError("disk I/O error")`` or — on macOS NFS / SMB / the AgentFS NFS overlay — silently refuses the switch and leaves the DB in DELETE. Either way the degradation is logged at ERROR level (it is a real loss of concurrency — a write blocks concurrent readers — not a cosmetic warning) and, by default, the function falls back to DELETE (the pre-WAL default, which works on NFS and ZFS) so the feature keeps working. On SQLite builds that still contain the WAL-reset corruption bug (issue #69784), refuse to enable WAL on fresh / non-WAL databases (prefer DELETE). If the on-disk DB is already WAL, keep WAL and warn — never live-downgrade under possible concurrent openers. This gate (#70055) is deliberately RETAINED. An earlier revision of the lock-cancellation fix (#71724) reverted it on the theory that DELETE was "the mode that corrupts", but that comparison was confounded: the clean WAL result came from SQLite 3.53.1, which carries BOTH the WAL-reset fix AND 3.51.0's defenses against close()-broken POSIX locks, so it says nothing about 3.50.4. Re-measured on the actually-bundled 3.50.4 with the lock fix in place, WAL and DELETE are both clean (0/3 each) — i.e. there is no evidence that WAL is safer here, and upstream still documents the WAL-reset bug as real through 3.51.2 with serious consequences. Until a fixed runtime is delivered, keep new databases out of WAL. Callers that genuinely require WAL concurrency (and would rather fail loudly than run silently degraded) pass ``require_wal=True``; the function then raises :class:`WalUnsupportedError` instead of returning ``"delete"``. All current callers deliberately keep the default ``require_wal=False`` so NFS-homed installs keep working. The ERROR is deduplicated per ``db_label``: repeated connections to the same underlying DB (e.g. kanban_db.connect() which is called on every kanban operation) log once per process, not once per call. Different db_labels log independently, so state.db and kanban.db each get one error on the same NFS mount. Shared by :class:`SessionDB` and ``hermes_cli.kanban_db.connect`` so both databases get identical fallback behavior. Never downgrades to DELETE if the on-disk DB header reports WAL — see _on_disk_journal_mode. That holds for both the NFS path and the WAL-reset vulnerability path. rx)rrequire_deletervNcould not verify journal mode before applying configured journal_mode=delete (database is locked — possible concurrent openers); refusing to downgrade a database this process does not exclusively ownDELETE2could not set configured journal_mode=delete (got no resultrzPRAGMA journal_mode=WALrrpz0journal_mode=WAL refused without raising (still c3 K|]}|vV dSrrK)rrErs rFr+z*apply_wal_with_fallback..s'EEV6S=EEEEEErLrrN)r{r_apply_delete_for_wal_reset_bugr^rarfrirRrS_set_journal_mode_no_waitrrQr_rrr}_log_wal_fallback_oncerr.rHrPrTrU)rrr configured current_modeactualrr] silent_excr\r[ retry_excexistingrs @rFapply_wal_with_fallbackr(sl&''J &'' . %1    )..Lud###'---'---uX  *8  +4:: X  *]VEZ{]]]  Nll455>>@@.1Pc!f6Hs3q6{{  ""((***b 5== !$ ' ' ' +D 1 1 1 +D 1 1 15) Ht H H H     x444x  #444 c. / /  #hhnnEEEE/DEEEEE   s " "1XX   4   ,,'@AAJJLLCC/'s9~~/C/C/E/EEE#CHHHH "1v1AKK%%''--/// 5==)$///3D9993D999 555555).. u   0   9%c#hh//S 8x---!$111xxxxxi4sRBF(*FM3#BM.''IM.J&J M. JA`` without waiting on other openers. This is the ONLY place a journal-mode switch pragma may be issued for a non-WAL target. It temporarily forces ``busy_timeout=0`` so SQLite's own exclusivity requirement becomes a concurrent-opener detector: leaving WAL mode requires exclusive access to the database, so if ANY other connection (this process or another) holds the DB open, the pragma fails immediately with ``database is locked`` instead of waiting out a busy timeout and sneaking the flip in between a concurrent writer's transactions — which is exactly how committed-but-uncheckpointed WAL transactions get destroyed. Callers must treat a raised ``OperationalError`` as "not exclusively owned: leave the journal mode alone", never as a retryable condition. Returns the resulting journal mode as reported by SQLite (lowercase), or ``""`` when SQLite returned no row. rzPRAGMA busy_timeoutNzPRAGMA busy_timeout=0zPRAGMA journal_mode=rpzPRAGMA busy_timeout=) rrQrArRrSrvrwr_rr)rr]previous_timeoutrs rFrrs$ll011::<<  +3q6%"3q6{{   $i <LL()))ll8$8899BBDD.1Pc!f6Hs3q6{{  ""((***bP  LLB0@BB C C C C'    D   LLB0@BB C C C C'    D sUAA A,+A,A.D#5DD D #E%D>=E>E EEE)rrc\t|}|dkr@t|dt|t|t |dS|*|rt jdt|dddSd} t|d}nc#t j$rQ}|rt| }d |vsd |vrt|dd|pd cYd}~SYd}~nd}~wwxYw|r |d krt jd |pd dt|dd S)uAvoid enabling WAL when the linked SQLite has the WAL-reset bug. - Already-WAL on disk: leave WAL alone (no live downgrade) and warn. - Mode unreadable (probe blocked by a concurrent opener's locks): ownership is not provably exclusive — leave the journal mode alone and warn. Never treat "could not read the mode" as "not WAL": that exact confusion let a vulnerable-SQLite process flip a live WAL state.db to DELETE under a concurrent WAL writer, destroying its committed-but-uncheckpointed transactions. - Otherwise: set DELETE (refusing to wait out concurrent openers) and warn. - For an explicit operator request, verify SQLite accepted DELETE. rvT)kept_walNr)r indeterminaterprlockedbusyrxrrrF) r^_log_wal_reset_bug_oncerarfrirRrSrr_r)rrrcurrentrr\lowereds rFrrs&$D))G% 48888d###'---'---u  *8  4tLLLLu F '*4::  # ' ' '   c((.."" w  &G"3"3 $Ht4 P P P P&h & & & & & & #4"3"3"3"3 ' &H,,& -)k - - -   Hu5555 8sBC6%AC1&C61C6c ddlm}m}m}||}||}|dvrd|dS|dkrd|dS|S#t$rYnwxYw dS) zReturn a context-appropriate hint for repairing the SQLite runtime. Uses the codebase's install-type detection so the hint matches what ``hermes update`` can actually do for this install (#75153). r)detect_install_method%recommended_update_command_for_methodget_project_root>gitunknownz>Hermes-managed installs can repair the embedded runtime with ``dockerz!update the container image with `zdinstall a Python build bundled with SQLite 3.51.3+ (or backports 3.50.7 / 3.44.6) and restart Hermes)r?rrrrB)rrrmethodcmds rF_wal_reset_repair_hintrDs            '&'7'7'9'9::33F;; ' ' 'ZTWZZZ Z X  =s=== =       <s1A AA AA)rrrc*t5|tvr ddddSt|dddn #1swxYwY|rd}n|rd}nd}t}td|t j||dS)zHLog once per (process, db_label) about the WAL-reset vulnerability path.Nujournal mode could not be verified or exclusively switched (database is locked — possible concurrent openers); leaving the journal mode untouched (no live downgrade under concurrent openers)u\is already in WAL mode — leaving WAL in place (no live downgrade under concurrent openers)z1using journal_mode=DELETE instead of enabling WALu%s: linked SQLite %s is vulnerable to the WAL-reset corruption bug (https://sqlite.org/wal.html#walresetbug) — %s. Upgrade to SQLite 3.51.3+ (or backports 3.50.7 / 3.44.6); %s. See `hermes doctor`. This warning fires once per process per database.)_wal_reset_bug_warned_lockraddrr=warningrRsqlite_version)rrraction repair_hints rFrr`s% $22 2 2 2 22222222 $''111222222222222222 E   E 2  E)**K NN       AAA  A r\ct5|tvr ddddSt|dddn #1swxYwYtd||dS)uLog a single ERROR per (process, db_label) about WAL fallback. ERROR (not WARNING): a DB silently dropped to DELETE means a real loss of concurrency — under the kanban dispatcher + workers a write blocks readers, surfacing as SQLITE_BUSY/lock contention — so it must be loud, not cosmetic. Without this dedup, NFS users running kanban (which opens a fresh connection on every operation — see hermes_cli/kanban_db.py) would fill errors.log with hundreds of identical errors per hour. Nu%s: WAL journal_mode unsupported on this filesystem (%s) — falling back to journal_mode=DELETE (slower rollback-journal mode; reduces concurrency but works on NFS/SMB/FUSE/ZFS). See https://www.sqlite.org/wal.html for details. This message fires once per process per database.)_wal_fallback_warned_lockrrr=error)rr\s rFrrs #11 1 1 1 11111111 #&&x000111111111111111 LL /  rrc ddlm}m}|}n#t$rYdSwxYwdD]}||d|d}| t t |}n4#ttf$r t d|||YtwxYw | d|d |#tj $rYwxYwdS) u+Apply optional performance and WAL-sizing PRAGMAs from ``config.yaml``. Reads the ``database:`` section and applies configurable PRAGMAs when set to integer values. The journal mode itself is NOT handled here — ``database.journal_mode`` is owned by :func:`resolve_journal_mode` inside :func:`apply_wal_with_fallback`, which layers the operator setting under all the safety guards (never live-downgrading an on-disk WAL DB, filesystem fallback, WAL-reset-bug gating). Supported keys under ``database:`` in config.yaml: * ``cache_size`` — negative value = KiB, positive = pages (e.g. ``-262144`` = 256 MB page cache) * ``mmap_size`` — max bytes for memory-mapped I/O (0 = disabled) * ``temp_store`` — 0=DEFAULT(file), 1=FILE, 2=MEMORY, 3=ALWAYS * ``wal_autocheckpoint`` — WAL auto-checkpoint threshold in pages * ``journal_size_limit`` — max journal/WAL size in bytes Best-effort: config load or pragma failures are ignored so DB init never breaks on a malformed ``database:`` section. r)cfg_getr=N) cache_size mmap_size temp_storewal_autocheckpointjournal_size_limitru)defaultz'%s: ignoring non-integer database.%s=%rzPRAGMA =)r?rr=rBrAr_rrvrwr=rrrRrS)rrrr=cfg pragma_name raw_valuerDs rFapply_database_pragmasrsL4CCCCCCCC""$$   GC[$GGG    I,,..//EE:&    NN9     H   LL8;8888 9 9 9 9'    D -s/ ##.A,,.BB!B==CC)zmalformed database schemaz database disk image is malformed_repair_attempted_pathsc|ttjsdStfdtDS)zTrue if *exc* is a SQLite 'malformed schema / disk image' error. These are the corruption classes where the schema fails to parse, so targeted ``sqlite_master`` surgery (not an ordinary FTS rebuild) is the only recovery path. Fc3^K|]'}|tvV(dSrr_r)rrEr\s rFr+z(is_malformed_db_error..s8RRfvS)))RRRRRRrL)rrR DatabaseErrorr._MALFORMED_SCHEMA_MARKERSr\s`rFis_malformed_db_errorrsC c70 1 1u RRRR8QRRR R RRrLct|tjsdSdt|vS)uTrue if *exc* is SQLite's 'file is not a database' error. Raised when a connection's backing file is not a SQLite database — the runtime connection-corruption class: a sibling process (forked curator agent, external repair pass) replaced/truncated the file out from under the live connection. The file on disk may be perfectly healthy; the CONNECTION is broken. Distinct from the malformed-schema class: the fix is a reconnect, not schema surgery. Ffile is not a database)rrRrr_rrs rF_is_not_a_database_errorrs9 c70 1 1u #s3xx~~'7'7 77rL)zno space left on deviceznot enough spacezdatabase or disk is fullz disk fullz full diskenospcc,|dSt|tr!t|ddtjkrdSt|t r|nt |}|tfdtDS)aTrue when *exc* (or a stringified error) is a disk-full / ENOSPC failure. Covers: * ``OSError`` with ``errno.ENOSPC`` * SQLite ``OperationalError: database or disk is full`` (SQLITE_FULL) * Plain English / errno strings that survive RPC wrapping NFerrnoTc3 K|]}|vV dSrrK)rrErs rFr+z%is_disk_full_error..=s(BBVv BBBBBBrL) rrgetattrrENOSPCr_rr._DISK_FULL_MARKERS)r\textrs @rFis_disk_full_errorr/s {u#wGC$$?$?5<$O$OtS#&& 433CHHDjjllG BBBB/ABBB B BBrL)r compressioncompression_closed turn_leasecorruptdiskr) malformedrznot a databasezdatabase corruptionc|dSt|trdSt|trdSt|trdSt |dvrdSdvrdSdvsd vrdSt fd tDrd Sd vsd vrd St|s dvsdvsdvrdSdS)u!Classify a session-persistence failure into a coarse cause bucket. Fast-failing a turn on a SessionDB write error is deliberate (the transcript would otherwise be lost on restart), but the *guidance* the user gets must match the cause: sustained SQLite write-lock contention ("database is locked" on a shared state.db) needs "storage was busy, send it again", while a full disk or read-only database needs the disk-space/permissions advice. Returns one of PERSISTENCE_ERROR_CAUSES: * ``"locked"`` — SQLite lock/busy contention (another process holds the database write lock); transient, retry-later guidance applies. * ``"compression"`` — a live compression lease refused the transcript write; the database itself is healthy and unlocked. * ``"compression_closed"`` — the write targeted a session already rotated (closed) by compression and no live continuation was adopted; the store is healthy — the client must refresh/adopt the new session id, so disk-space advice would be a misdiagnosis. * ``"turn_lease"`` — a presented session-turn-lease holder no longer owns the conversation (expired, released, or reclaimed); fail-fast fencing, not a storage fault. * ``"corrupt"`` — the database file itself is structurally damaged (``database disk image is malformed`` / SQLITE_NOTADB). Distinct from ``"disk"``: freeing space cannot help, the user needs the repair path (``hermes doctor`` / automatic schema surgery). * ``"disk"`` — disk full / read-only / permission-shaped failures (delegates the disk-full patterns to :func:`is_disk_full_error` so the two classifiers can never drift apart — e.g. ENOSPC). * ``"unknown"`` — anything else (or no visible exception at all). Nrrrrz turn leasezclosed by compressionzbeing compressedzcompression leasec3 K|]}|vV dSrrK)rrErs rFr+z-classify_persistence_error..s' ? ?f6T> ? ? ? ? ? ?rLrrrrreadonlyz read-only) rSessionTurnLeaseLostErrorCompressionSessionClosedErrorCompressionSessionBusyErrorr_rr._DB_CORRUPTION_MARKERSr) exc_or_strrs @rFclassify_persistence_errorr^s-<y *788|*;<<$##*9::} z?? " "Dt|$&&##T!!%8D%@%@}  ? ? ? ?(> ? ? ???yD T>>x:&& T>>    $  v 9rLct|}t5|tvr ddddSt| ddddS#1swxYwYdS)aClaim the one-shot repair attempt for *db_path* in this process. Returns True for the first caller, False afterwards. Keeps a malformed DB from triggering an unbounded repair/reopen loop and stops concurrent callers from racing surgery on the same file. NFT)r__repair_attempt_lockrr)rr8s rF_claim_repair_attemptrs g,,C  ) ) ) ##C((( s AAAAg^@皙?rc#`K||jdz} |jdd|d}n8#t $r+}t d||dVYd}~dSd}~wwxYwd} tj tz} trHddl }| d|||jd n9ddl}|||j|jzd}nJ#t*t f$r5tj |krYn tjt.YnwxYw|s!t d |t|V |rtrHddl }| d|||jd n1ddl}|||jn#t $rYnwxYw|dS#|wxYw# |rtrHddl }| d|||jd n1ddl}|||jn#t $rYnwxYw|w#|wxYwxYw) u{Serialize state.db schema surgery across processes. Yields True when this process holds the repair lock for *db_path*, False when the bounded acquire timed out. Unlike the kanban init lock — whose critical section is idempotent, so proceeding without the lock is merely redundant work — proceeding here would be exactly the unsafe interleaving we are trying to prevent, so a caller that gets False must NOT do surgery. ``flock`` is the right primitive for this: the kernel drops the lock when the holding process dies, so a crashed repairer cannot leave a stale lock that wedges every future repair (a pidfile would). The acquire is still bounded because a *live* repairer can legitimately sit in ``VACUUM`` for minutes on a large DB, and an unbounded wait would hang the caller's open with no traceback (the failure shape of #36644). z .repair.lockTrexist_oka+bu^Could not open state.db repair lock %s (%s) — proceeding with in-process serialisation only.NFrrqustate.db repair lock %s held by another process for more than %.0fs — skipping schema surgery in this process to avoid racing the repairer.) with_namer|rmkdiropenrr=rrT monotonic_REPAIR_LOCK_TIMEOUT_SECONDS _IS_WINDOWSmsvcrtseeklockingfilenoLK_NBLCKfcntlflockLOCK_EXLOCK_NBBlockingIOErrorrU_REPAIR_LOCK_POLL_SECONDSLK_UNLCKLOCK_UNrq)r lock_pathhandler\acquireddeadlinerrs rF_cross_process_repair_lockrs^"!!',"?@@I td;;;&&      -.7     H*>##&BB 6 6P!MMMKKNNNNN6==??FOQGGGG LLLKK 1NOOO#W- 6 6 6>##x//E 455555 6 6"  NN-7       @@!MMMKKNNNNN6==??FOQGGGG LLLKK ???    D  LLNNNNNFLLNNNN  @@!MMMKKNNNNN6==??FOQGGGG LLLKK ???    D  LLNNNNFLLNNNNs1A B BBI*+B D65I*6(E<I* E<9I*;E<<+I*(BH+*I+ H85I7H88II'*L-,BK/.L/ K<9L;K<<L?L-L**L-cB |dd}|dt|dzdzdS#tjt t f$r&}td|Yd}~dSd}~wwxYw)uXIncrement the schema cookie after direct ``sqlite_master`` surgery. Ordinary DDL bumps this counter for free, and every other connection compares it before running a prepared statement — that is how they learn to discard a cached schema. Editing ``sqlite_master`` under ``PRAGMA writable_schema=ON`` does NOT bump it, so live connections in other processes keep compiling statements against the schema we just deleted objects from — e.g. writing ``messages`` rows through triggers into ``messages_fts*`` shadow tables that no longer exist. SQLite's writable_schema documentation calls out incrementing ``schema_version`` as the required companion to such an edit. Best-effort and never raises: a failed bump leaves exactly the pre-existing behaviour, and the repair itself is still worth completing. zPRAGMA schema_versionrzPRAGMA schema_version=rqiz)Could not bump state.db schema cookie: %sN) rrQrArRrrv IndexErrorr=r)rrr\s rF_bump_schema_cookiers I,,677@@BB1E Os7||a/?:.MOOPPPPP  !9j 9IIIBCHHHHHHHHHIsAAB8BBr c<||jdzS)Nz.repair-attempts.json)rr|)rs rF_repair_ledger_pathr As   W\,CC D DDrLz Optional[str]cp |}|jd|jS#t$rYdSwxYw)aaCheap identity for a damaged DB file: size + mtime_ns. Hashing a multi-GB corrupt file on every open is exactly the kind of repeated cost this ledger exists to avoid; size+mtime is stable for a file nothing can successfully write to, and any successful repair, truncation or manual restore changes it (resetting the attempt count). :N)statst_size st_mtime_nsr)rsts rF_db_fingerprintrEsN \\^^*//r~/// tts $' 55zDict[str, Any]c tjt|d}t |t r|Sn#t tf$rYnwxYwiS)Nrhencoding)jsonloadsr  read_textrr,rrw)rrzs rF_read_repair_ledgerrTsv j,W55???QQRR c4  J  Z      IsA AA#"A#ct|}|dSt|}|d|ko+t|ddtkS)apWhether *db_path* has already burned its cross-restart repair budget. True only when the ledger records ``_MAX_PERSISTENT_REPAIR_ATTEMPTS`` failed attempts against the CURRENT file fingerprint. Never raises; a missing/corrupt ledger or unstatable DB reads as "not exhausted" (the in-process claim and cross-process lock still bound a single run). NF fingerprintfailed_attemptsr)rrr@rA_MAX_PERSISTENT_REPAIR_ATTEMPTS)rfpledgers rF%_persistent_repair_attempts_exhaustedr^sg  ! !B zu  ) )F =!!R' U  ,a00 1 15T TrL)rr?rc Ft|} |r|ddS||nt|}|dSt|}|d|kr&t |dddznd}ddl}|tj |||j d d d dS#t$r&}td |Yd}~dSd}~wwxYw)uUpdate the persistent attempt ledger after a repair pass. Never raises. Defaults to the post-attempt fingerprint — the file state the NEXT attempt's exhaustion probe will observe. T missing_okNrrrrqseconds)timespec)rr last_attemptrhrz+Could not update state.db repair ledger: %s)r unlinkrrr@rAdatetime write_textrdumpsnow isoformatrBr=r) rr?r ledger_pathrrattemptsr&r\s rF_record_repair_outcomer-psz&g..KK     $  / / / F'3[[9Q9Q : F$W--zz-((B..  ,a00 1 1A 5 5   J#%'/$,$5$9$9$;$;$E$E!*%F%%     KKKDcJJJJJJJJJKs#C0C0B,C00 D :DD z List[Path]c|jd fd|jD}n#t$rgcYSwxYwt |ddS)z8Timestamped forensic backups of *db_path*, newest first..malformed-backup-c|g|]8}|j|jd6|9S)-wal-shm)r|r(endswith)rr)rs rFrz/_existing_malformed_backups..sX   v  (( FOO$455     rLc|jSr)r|)r)s rFz-_existing_malformed_backups..sqvrLT)r8reverse)r|riterdirrsorted)rrrs @rF_existing_malformed_backupsr:s 0 0 0F    ^++--      %--t < < <rcopy2r?rBr)rr&rCrAreasonstamp backup_pathseqsrc_statrestsuffixsidecarr\s rF_backup_db_filerQs  OOOMMM#CCCCCCC ###"#&+>+>w+G+G& 8w 8 8 8   =wOOOV|   ! ! # # , ,_ = =E##w|$N$Nu$N$NOOK C     ''| < ))) *    D  Wk***& X XF'' v(=>>G~~ X Wk&;&;KMMM1C1111111112sP  4BE86E87H8 FHFBH I""I I Ict|}|dks|drdS ttn#t $rdYnwxYwdtdt ffd dddtd t ddffd }|j}|r ||d d D]B}|r| |j |zn|}| r ||CdS) u5Refuse-or-repair read-only DB files BEFORE the first connection opens. Port of Kilo-Org/kilocode#12508's startup preflight. A stray read-only ``state.db`` / ``-wal`` / ``-shm`` (sudo run, restored backup, copied dotfiles) previously surfaced as an opaque ``sqlite3.OperationalError: attempt to write a readonly database`` raised from deep inside ``_init_schema`` — naming no file and no fix — and the obvious wrong "fix" (deleting the ``-wal``) silently loses committed transactions. This preflight: - **Repairs** permissions with ``chmod u+rw`` when the file lives inside the Hermes home tree (``get_hermes_home()``) — the safe repair scope: Hermes owns those files, and the OS makes ``chmod`` fail on files the user doesn't own, which bounds the repair exactly. - **Fails fast with an actionable error** naming the exact file and the exact ``chmod`` command for anything else (root-owned files, read-only mounts, custom paths outside the home tree). - Never deletes or truncates a WAL sidecar — once writable, the normal open path checkpoints its committed frames into the DB as intended. ``:memory:`` and ``file:`` URI paths are skipped (no plain on-disk files to check). Shared by :class:`SessionDB` and ``hermes_cli.kanban_db``. rofile:Nr)r:cdS |S#ttf$rYdSwxYwNF)ris_relative_torrw)r)homes rF_in_repair_scopez2preflight_db_writability.._in_repair_scope&sU <5 99;;--d33 3$   55 s&.AAF)is_dirrYc nddl}tj|tjtjzrdS|r |j|jz|r|jndz}tj||j |zn#t$rYnwxYwtj|tjtjzr#t d||rdnddS|rdnd}|j drdnd}tjd |d |d |rdndd |d | )Nrz2%s preflight: repaired read-only %s (chmod u+rw%s)xrp directoryfiler2uv Do NOT delete the -wal file — it contains committed data that will be merged into the database once it is writable.z is not writable:  zf is read-only for this user. Hermes needs read-write access to open the database. Fix with: chmod u+rwz 'z4' (files owned by another user may need sudo/chown).)r rxaccessR_OKW_OKS_IRUSRS_IWUSRS_IXUSRchmodst_moderr=r>r|r4rRrS)r)rY_statrkindwal_noterXrs rF_ensure_writablez2preflight_db_writability.._ensure_writable.s 9Q"') * *  F  A    mem37Uu}}TUVAFFHH,s23333    yBGbg-..  H!)CCr  $0{{&vv&&  D D  & M M4 M M! M M*0#833b M M<= M MCK M M   sA B BBT)rpr2r3) r_r(rr rrBrrrYrr|is_file) rrrzrjrrOr)rXrWs ` @@rFpreflight_db_writabilityrls8 g,,C jCNN733#O$5$566>>@@ DT5:   D T d       B^F }}. ----&  8> KG  glV3 4 4 4G 99;;  Q     s-A A.-A.cTtjt|d} t||d|d}d|D}|r1d|dd|S|dd D]} |d |d |d 2#tj $ru}t |rYd}~`t| }d |vsd|vrYd}~d|d|cYd}~c|Sd}~wtj $r(}d|d|cYd}~c|Sd}~wwxYwdtj} |d|d|dtjf|d|ddtjf|dn#tj $r} |dn#tj$rYnwxYwt| }d |vsd|vrYd}~|dSd|vrYd}~|dSt|cYd}~|Sd}~wwxYw |dS#tj $r-}t|cYd}~|Sd}~wwxYw#|wxYw)u/Probe a DB on a fresh connection. Returns None if healthy, else a reason. Runs the same first-statement (``PRAGMA journal_mode``) that trips the malformed-schema parse, then ``PRAGMA integrity_check`` and a canonical ``sessions`` read, and finally a rolled-back ``messages`` write so that FTS5 index corruption — which leaves base-table reads and ``integrity_check`` passing while every ``INSERT INTO messages`` fails through the FTS triggers — is reported as unhealthy rather than slipping past as a false "ok" (#50502). Nisolation_levelrMzPRAGMA integrity_checkcg|]D}|t|ddk/t|dES)rokrrrs rFrz%_db_opens_cleanly..qsEOOO!qOS1YY__5F5F$5N5NC!II5N5N5NrLz; r SELECT COUNT(*) FROM sessions messages_ftsmessages_fts_trigrammessages_fts_cjkzSELECT 1 FROM  WHERE z MATCH '""' LIMIT 1z no such tablezno such columnzfts5 read probe failed on rG_hermes_fts_health_probe_BEGIN IMMEDIATEz>INSERT INTO sessions (id, source, started_at) VALUES (?, ?, ?) _health_probezOINSERT INTO messages (session_id, role, content, timestamp) VALUES (?, ?, ?, ?)r$_fts_health_probeROLLBACK no such tokenizer: cjk_unicode61)rRrpr_load_fts5_cjk_extensionrrQrrrqrS SessionDB_is_fts5_unavailable_errorrrrTtime_nsrr)rrrowsproblems fts_tabler\rprobe_session_ids rF_db_opens_cleanlyr[sG ?3w<< > > >Do %%% *++44666||455>>@@OOtOOO  +99Xbqb\**F E 455>>@@@ V) G) GI( G WYWWyWWW(****+ G G G77<<HHHH#hhnn&&"c))-=-D-DHHHHFIFFFFFFFFFFF^ ]( G G G GIFFFFFFFFFFFR ] GHt|~~GG  LL* + + + LLP!?DIKK@    LL&!6+> L    LL $ $ $ $'     Z((((=    c((..""C#%%)9S)@)@ttt 2S88 ttt s88OOOOO )     3xx  sBM+M-.DMG+FM )F3M8F?GMG-G4G5MGM/A?I/.M/L8?JL3J'$L3&J'',L3M-L31M L3L8M3L88MN!N /N0N NNN'T)backuprc nddddd}t|}|s |d|d<|St|rIdtd|dt |jd |d<t d |d|St|5}|s:t|d |d <d |d<|cdddSd|d<|cdddSt|||}t|t| d |cdddS#1swxYwYdS)aRepair a state.db whose ``sqlite_master`` schema is malformed or whose FTS indexes reject writes. Handles two corruption classes: the "duplicate object definition" / malformed-schema class where even ``PRAGMA`` statements fail, and the FTS write-corruption class (#50502) where base tables read fine and ``integrity_check`` passes but writes fail through the ``messages_fts*`` triggers. Tries least-destructive recovery first and escalates: 1. **Rebuild FTS indexes in place** via the FTS5 ``'rebuild'`` command, which rewrites the internal b-tree segments from the canonical ``messages`` rows without dropping or recreating anything. Fixes the FTS write-corruption class while preserving the schema intact. 2. **De-duplicate** ``sqlite_master`` (keep the lowest rowid per ``type``/``name``). Fixes the canonical "table X already exists" case and PRESERVES the existing FTS index intact. 3. **Drop the FTS schema** (every ``messages_fts*`` object) + ``VACUUM``. The next ``SessionDB()`` open rebuilds the FTS indexes from the canonical ``messages`` table. Canonical ``sessions`` / ``messages`` rows are never modified. A timestamped raw backup is taken first unless ``backup=False``. The surgery below is serialised across processes (see :func:`_cross_process_repair_lock`): the gateway service, the Desktop app's backend and interactive CLI sessions all open the same file, and two of them running ``writable_schema`` surgery concurrently is itself a corruption source. Returns a report dict: ``{repaired: bool, strategy: str|None, backup_path: str|None, error: str|None}``. FN)r?strategyrKrz does not existrz$automatic repair has already failed u times on this exact file — the corruption is beyond the schema/FTS repair strategies (likely b-tree page damage). Manual recovery required: restore a backup, or salvage with `sqlite3 z ".recover"`. Delete z$ to force another automatic attempt.zstate.db repair skipped: %sTr?repaired_by_other_processrzYanother process holds the state.db repair lock; skipped schema surgery to avoid racing it)rreport)r?)rrGrrr r|r=rrr_repair_state_db_schema_lockedr-rr@)rrr holding_lockresults rFrepair_state_db_schemarsD F7mmG >>  $555w -W55  !. ! !3:  ! ! *'227  ! ! ! w  2F7ODDD #G , ,  !))1%)z"%@z"4 7O0vVVV wfjj6L6L1M1MNNNN/sD*D*AD**D.1D.rcB t| d|d<d|d<|S|rUt|\}}|rt|nd|d<|+d||d<td |d|S t jt|d } t|d D]4} |d |d |d #t j $rY1wxYw | n#| wxYwt|'d|d<d|d<t d||Sn7#t j $r%}t d|Yd}~nd}~wwxYw t jt|d } |d| | n#| wxYwt|'d|d<d|d<t d||Sn7#t j $r%}t d|Yd}~nd}~wwxYw t jt|d } |d|d}|D] \} } } } |d| | | f!|rt||d| | n#| wxYwt|'d|d<d|d<t d||Sn7#t j $r%}t d|Yd}~nd}~wwxYw t jt|d } |d|dt||d| |d| n#| wxYwt|} | 'd|d<d|d<t d ||S| |d<n.#t j $r}t||d<Yd}~nd}~wwxYw|ds"td!||d|S)"z}Repair strategies for :func:`repair_state_db_schema`. Caller must hold the cross-process repair lock for *db_path*. NTr?already_healthyrrKzepre-repair backup refused; aborting schema repair to avoid mutating the only copy of the damaged DB: rzstate.db repair aborted: %srnruz INSERT INTO (z) VALUES('rebuild') rebuild_ftsz 1zFDELETE FROM sqlite_master WHERE type IS ? AND name IS ? AND rowid <> ?zPRAGMA writable_schema=OFF dedup_schemazRstate.db schema repaired by de-duplicating sqlite_master (FTS index preserved): %sz%state.db dedup repair pass failed: %sz9DELETE FROM sqlite_master WHERE name LIKE 'messages_fts%'VACUUMdrop_fts_rebuildzdstate.db schema repaired by dropping FTS schema; indexes will rebuild from messages on next open: %szsstate.db schema repair could not recover %s automatically (backup: %s); manual restore from backup may be required.)rrQr_r=rrRrprrrSrqrrcommitrr)rrrbpath backup_errorr table_namer\dupestype_r|_countr;rIs rFrr3 s !!)!z.z  -g66|.3 =E } =L=ILL 7O LL6w H H HM Ms7||TBBB  $D ) ) )   LLSzSSJSSS/H  JJLLLLDJJLLLL W % % -!%F: !.F:  NNN   M .  MMMFLLLLLLLLM@s7||TBBB  LL # # # KKMMM JJLLLLDJJLLLL W % % -!%F: !0F:  NNA7   M .  @@@93????????@Es7||TBBB  LL4 5 5 5LLFhjj .3  )tVT CD$'  *#D))) LL5 6 6 6 KKMMM JJLLLLDJJLLLL W % % -!%F: !/F:  NN,-4   M .  EEE>DDDDDDDDE#s7||TBBB  LL4 5 5 5 LLT U U U  % % % LL5 6 6 6 KKMMM LL " " " JJLLLLDJJLLLL"7++ >!%F: !3F:  NN>?F   M w  ###c((w# *    H VM*   Ms4#EC4,C C4 CC4CC4E4D  8EE8E33E8<#H. )G H.G448H..I"=II"&#N BL8#N8M8NN<N77N<#S$A7Q0S0R:SSS2S--S2a\ CREATE VIEW IF NOT EXISTS messages_fts_cjk_src AS SELECT id, role, content, tool_name, tool_calls FROM messages WHERE role <> 'tool'; CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts_cjk USING fts5( content, tool_name, tool_calls, content='messages_fts_cjk_src', content_rowid='id', tokenize='cjk_unicode61' ); a  CREATE TRIGGER IF NOT EXISTS messages_fts_cjk_insert AFTER INSERT ON messages WHEN new.role <> 'tool' AND (new.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_high_water'), -1) OR new.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts_cjk(rowid, content, tool_name, tool_calls) VALUES (new.id, new.content, new.tool_name, new.tool_calls); END; CREATE TRIGGER IF NOT EXISTS messages_fts_cjk_delete AFTER DELETE ON messages WHEN old.role <> 'tool' AND (old.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_high_water'), -1) OR old.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts_cjk(messages_fts_cjk, rowid, content, tool_name, tool_calls) VALUES ('delete', old.id, old.content, old.tool_name, old.tool_calls); END; CREATE TRIGGER IF NOT EXISTS messages_fts_cjk_update AFTER UPDATE OF content, tool_name, tool_calls, role ON messages WHEN (old.content IS NOT new.content OR old.tool_name IS NOT new.tool_name OR old.tool_calls IS NOT new.tool_calls OR old.role IS NOT new.role) AND (old.id > COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_high_water'), -1) OR old.id <= COALESCE((SELECT CAST(value AS INTEGER) FROM state_meta WHERE key = 'fts_cjk_rebuild_progress'), -1)) BEGIN INSERT INTO messages_fts_cjk(messages_fts_cjk, rowid, content, tool_name, tool_calls) SELECT 'delete', old.id, old.content, old.tool_name, old.tool_calls WHERE old.role <> 'tool'; INSERT INTO messages_fts_cjk(rowid, content, tool_name, tool_calls) SELECT new.id, new.content, new.tool_name, new.tool_calls WHERE new.role <> 'tool'; END; ctjd}|r!t|St dz dz S)z1Location of the cjk_unicode61 loadable extension.HERMES_FTS5_CJK_SOlibzlibfts5_cjk.so)rxgetenvrrr )envs rFfts5_cjk_so_pathr, sI )( ) )C &Cyy##%%%   u $'7 77rLcxtjdddvS)zBconfig.yaml ``sessions.cjk_fts`` (default on), via its env bridge.HERMES_CJK_FTS1)0falseoffno)rxrrrrKrLrF_cjk_fts_config_enabledr4 s: 9%s + + 1 1 3 3 9 9 ; ;D rLctsdSt}|sdS |d |t ||dn#|dwxYwdS#t $r!td|dYdSwxYw)uFBest-effort load of the cjk_unicode61 tokenizer into ``conn``. Returns False (never raises) when the .so is absent, the feature is disabled via ``sessions.cjk_fts``, or this Python build has extension loading compiled out — every caller treats False as "behave exactly as before the cjk index existed". FTz#fts5_cjk extension load failed (%s)exc_info) rrrGenable_load_extensionload_extensionr_rBr=r)rrs rFrr; s # $ $u   D ;;==u  ""4((( .   D * * *  & &u - - - -D & &u - - - -t A non-owner tried to write while compression owns the session.Nr~rKrLrFrr_ sHHHHrLrceZdZdZdS)!SessionCompressionInProgressErroraA concurrent writer collided with a *live* compression lock. Split out from :class:`CompressionSessionBusyError` because the two conditions that class covers need opposite handling. This one is transient: a healthy compressor holds the session for a few seconds and the lock row carries its own ``expires_at``, so the write can simply wait (see ``_execute_write``'s patience loop). The other case, a compressor discovering its own lease is gone, is permanent and must fail fast rather than spin out the whole patience budget. Subclassing keeps every existing ``except CompressionSessionBusyError`` handler working unchanged. Nr~rKrLrFrrc s    rLrceZdZdZdS)rakA transcript write presented a turn-lease holder that no longer owns it. Fail-fast fencing: do not retry inside ``_execute_write``. The caller either still thinks it owns the conversation after expiry/reclaim, or the lease row is gone. A later writer may already be persisting a newer turn; landing this write would interleave a stale reply. Nr~rKrLrFrrs srLrc ddlm}nJ#t$r=td|t jt|fi|cYSwxYw||f|t jd|S)a``sqlite3.connect`` that registers the open fd for lock-safety. While a connection is live, byte-level probes of the same file are refused: an ``open()``/``close()`` cancels every POSIX advisory lock this process holds on it -- including a running VACUUM's EXCLUSIVE lock. Released automatically on ``close()``. The ONLY tolerated fallback is the helper being absent entirely (scaffold/embed installs that ship hermes_state without hermes_cli). A real connection failure must propagate: silently retrying an *untracked* connect would disable the guard for the lifetime of that connection, which is precisely the failure mode this module exists to prevent. r)connect_trackedzihermes_cli.sqlite_safe_read unavailable; opening %s untracked (byte-probe guard inactive in this install)) tracking_path connect_fn)rDrrEr=rYrRrpr_)rrkwargsrs rF_connect_tracked_dbr} s4??????? 444  :    s4yy33F33333 4 ?  #?      s AAAd probe_bytesforcerrrc\ ddlm}||||S#t$rYnwxYw |j}n#t $rYdSwxYw|dkrdSddlm}||td||}|r| drdStd |DS) aDetect the #68474 zeroed state.db signature (size>0, NUL header). Byte-level probe, so it is only safe BEFORE any connection to *path* exists in this process: ``close()`` cancels every POSIX advisory lock the process holds on the file, which can pull the EXCLUSIVE lock out from under a running VACUUM and corrupt the database. The read is routed through ``read_header_bytes_preopen``, which refuses (returning False here) once a connection is live. Pass ``force=True`` only for offline files -- quarantined copies, snapshots, archives. Prefer ``hermes_cli.backup.is_zeroed_sqlite_file`` when available; this local copy keeps SessionDB openable without importing the CLI package in constrained embed paths. r)is_zeroed_sqlite_filerF)read_header_bytes_preopen)lengthrsSQLite format 3c3"K|] }|dkV dS)rNrK)rbytes rFr+z%is_zeroed_state_db.. s&**Ttqy******rL) hermes_cli.backuprrBr r rrDrmaxr(all)rrrrsizerr*s rFis_zeroed_state_dbr s" ;;;;;;$$T{%PPPP      yy{{" uu qyyuEEEEEE $ $ S[))   D 4??#566u **T*** * **s ##A AAc rddl}||jdz}|jdd|d}d} t jdz}|d krddl } | d| | |j d d}n>#t$r0t j|krYnt jd YnwxYwnddl} || |j|jzd}nE#t(tf$r0t j|krYnt jd YnwxYw~|st*d | |r|d krHddl }| d| | |jd n1ddl}|| |jn#tt2f$rYnwxYw|dS#|wxYw|st*d | |r|d krHddl }| d| | |jd n1ddl}|| |jn#tt2f$rYnwxYw|dS#|wxYwt;|st*d| |r|d krHddl }| d| | |jd n1ddl}|| |jn#tt2f$rYnwxYw|dS#|wxYw t jd}n#t>$rd}YnwxYw||jd|dtAj!d} d} | rP| d z } ||jd|dtAj!d| d} | P |"| n#t$r} t*d|| Yd} ~ |r|d krHddl }| d| | |jd n1ddl}|| |jn#tt2f$rYnwxYw|dS#|wxYwd} ~ wwxYwdD]y} tGtI|| z} | rD | "tGtI| | zi#t$rYuwxYwz| |r|d krHddl }| d| | |jd n1ddl}|| |jn#tt2f$rYnwxYw|S#|wxYw# |r|d krHddl }| d| | |jd n1ddl}|| |jn#tt2f$rYnwxYw|w#|wxYwxYw)a`Move a zeroed state.db aside (preserve bytes) and return quarantine path. Uses a cross-process lock (``#68805``) so two concurrent startups cannot race: the first process moves the zeroed file and the second re-checks under the lock, finding the file already gone (or a fresh DB in its place) instead of clobbering the quarantine. rNz.quarantine.lockTrrF@Windowsrq{Gz?uquarantine lock for %s not acquired within 5s — refusing to quarantine without the cross-process lock. The zeroed file is left in place. If sessions fail to load, restore from state-snapshots via `hermes snapshot list` / `hermes snapshot restore `.z?quarantine_zeroed_state_db: %s already moved by another processznquarantine_zeroed_state_db: %s is no longer zeroed (another process quarantined it and a fresh DB was created)z %Y%m%d-%H%M%Srz.zeroed--z.bakz"Failed to quarantine zeroed %s: %sr1)%rrr|rrrrTrr%rrrrrrrUrrrrrr=rrrAttributeErrorrqrGr>rrFrBrxryrenamerr_)rrrrrrrrtsdestnr\rOsides rFquarantine_zeroed_state_dbr s OOOty+==>>I 4$777 ^^E " "FHa>##c) ??   ) ) MMM &&KKNNNNN6==??FOQGGG#H&&&~''833Ju%%%%%& & LLL &&KK 1NOOO#H'1&&&~''833Ju%%%%%&  &  LL2     `  @??$$ 11!MMMKKNNNNN6==??FOQGGGG LLLKK ???(    D  LLNNNNNFLLNNNNs{{}}  KKQ   P  @??$$ 11!MMMKKNNNNN6==??FOQGGGG LLLKK ???(    D  LLNNNNNFLLNNNNg"$''  KKE    B  @??$$ 11!MMMKKNNNNN6==??FOQGGGG LLLKK ???(    D  LLNNNNNFLLNNNNW //BB   BBB ~~y 8 8" 8 8ry{{ 8 8 8   kkmm  FA>>9@@b@@29;;@@@@@Dkkmm    KK        LL=tS I I I444  @??$$ 11!MMMKKNNNNN6==??FOQGGGG LLLKK ???(    D  LLNNNNNFLLNNNN3 '  FD F*++D{{}} KKSYY%7 8 89999D    @??$$ 11!MMMKKNNNNN6==??FOQGGGG LLLKK ???(    D  LLNNNNFLLNNNN  @??$$ 11!MMMKKNNNNN6==??FOQGGGG LLLKK ???(    D  LLNNNNFLLNNNNs3_ AC_!D 1_3D _ D  _7E _ (F5_7F _ F!_1BII2II2II22J /__SB_U64_6 ZY<_"BX65Y#6Y Y# Y  Y##Y9<Z:_<2[/._/ [<9_;[<<_B^_^*'_)^**__b6Ba10b1bbbbb6b33b6cdddddddddddddd } tt|dz}|r|jnd|d<n#t $rYnwxYwd t dt|dt|dd n5#t$r(}t d |||cYd}~Sd}~wwxYwd td tffd } |d}|d}|t|nd|d<|t|nd|d<|d|d|d|dz|d<|d}|t|nd|d<|d}|t|nd|d<|d} | t| nd|d<|d} | t| nd|d< d dd DfddD|d <n#t$rYnwxYwd!td ttffd" } | d#|d#<| d$} | d%} | |d$<| |d%<| d&|d'<n | pd| k|d'< n:#t$rYn.wxYw# w#t$rYwwxYwxYw|S)(uBest-effort, strictly read-only stats snapshot of a state.db file. Opens the database with ``mode=ro`` (URI) and a short timeout so it can run against a *live* database held by a gateway without ever taking a write lock or mutating the file. Every field is collected independently: a failed pragma/SELECT yields ``None`` for that field, and the helper itself never raises. Deliberately does NOT instantiate :class:`SessionDB` — its constructor runs schema DDL (migrations, FTS table creation), which is exactly the kind of write a diagnostics probe must never perform. Returned keys (all present, any may be None on failure): - ``page_count``, ``page_size``, ``freelist_count`` — PRAGMA values - ``logical_size_bytes`` — page_count * page_size (post-checkpoint size) - ``wal_size_bytes`` — stat() of ``-wal`` (0 when absent) - ``journal_mode`` — PRAGMA journal_mode string - ``messages`` / ``sessions`` — row counts - ``fts_tables`` — dict of {table_name: bool} presence for messages_fts / messages_fts_trigram / messages_fts_cjk - ``fts_storage_version`` — int from state_meta, None when the marker is absent (legacy pre-v23 inline layout) - ``fts_rebuild_pending`` — True when the deferred v23 backfill has not finished (high_water present and progress < high_water) - ``fts_rebuild_high_water`` / ``fts_rebuild_progress`` — raw ints N) page_count page_sizefreelist_countlogical_size_byteswal_size_bytesrwr1r> fts_tablesfts_storage_versionfts_rebuild_pendingfts_rebuild_high_waterfts_rebuild_progressr2rrrS?mode=roT@)ruritimeoutz4collect_state_db_stats: cannot open %s read-only: %ssqlr:c |}|r|dndS#t$rYdSwxYw)Nr)rrQrB)rrrs rF_scalarz'collect_state_db_stats.._scalar sZ ,,s##,,..C *3q66d *   44 s26 AAPRAGMA page_countPRAGMA page_sizerrrzPRAGMA freelist_countrrMrwSELECT COUNT(*) FROM messagesr1rtr>ch|] }|d SrrKrrs rFrz)collect_state_db_stats.. s,ArLzISELECT name FROM sqlite_master WHERE type = 'table' AND name IN (?, ?, ?)ruci|]}||vSrKrK)rtnamess rF z*collect_state_db_stats.. s/###AJ###rLrr8c d|f}|r|dt|dndS#t$rYdSwxYw)N*SELECT value FROM state_meta WHERE key = ?r)rrQrArB)r8rrs rF _meta_intz)collect_state_db_stats.._meta_int st ll@3&(**'*Jc!f.@s3q6{{{dJ   tt sA A AArrrFr)rr_rGr r rrrBr=rYrrArrrrq)rstatswal_pathr\rpcpsfljmmsgssessr high_waterprogressrrs @@rFcollect_state_db_statsr< s;:"##"& $E" G v-..=E__=N=N"U(--//"9"9TU       D # +DMM + + +w--      Kc # # #  SS< W( ) ) W' ( ()+c"gggTl(*SWWWDk   *u[/A/M*/ *=k@R*RE& ' W, - --/^#b''' W* + ++->Btnw677)-)9CIIItjw677)-)9CIIItj <<,P(** E####U###E,      D  3 8C=      (1y1F'G'G#$Y788 9344*4&'(0$%  +0E' ( (,4MZ+GE' (  JJLLLL    D   JJLLLL    D  LsAA&& A32A391B++ C5CCC5C*J: AH$#J:$ H1.J:0H11A#J:J** J76J7:K!<KK! KK!KK!c tjdsdStjt |}d}tjdD]}}|sd|d} tj|}n#t$rY?wxYw|D]7} tj |d||kr|dz }n(#t$rY4wxYw~|S#t$rYdSwxYw) aBest-effort count of processes holding ``db_path`` open (Linux only). Scans ``/proc/*/fd`` symlinks for the resolved database path. Returns the number of distinct PIDs with the file open, or ``None`` on any error or on non-Linux platforms. Never raises; no lsof dependency. Unreadable per-process fd dirs (other users' processes without root) are silently skipped, so the count is a lower bound. linuxNrz/procz/proc/z/fdrrq) rrr(rxrrealpathr_listdirisdigitrreadlinkrB)rtargetholdersrfd_dirfdsfds rFcount_db_holdersr sJ|&&w// 4!!#g,,//:g&&  C;;== &c&&&F j((      {f#3#3r#3#344>>1 ?H tts_C%AC%BC% B%"C%$B%%C%-"CC% CC%CC%% C32C3complete interruptedrempty>r agent_errorcontent_filterr#has_tool_calls finish_reasonc|pdtvrtS|pd}|dkr|rtnt S|dvrtSt S)u:Classify a session's lifecycle from the shape of its final message. - assistant with a normal finish → ``complete`` - assistant that still has pending tool_calls (no tool result row ever followed, or it would be the last row instead) → ``interrupted`` - user or tool as the last row → ``interrupted`` (the agent never got to answer / never consumed the tool result) - an error finish_reason on the last row → ``error`` - anything unrecognized → ``complete`` (benign default; pickers must not alarm on unknown shapes) rpr3>toolr$)rr_ERROR_FINISH_REASONSSESSION_STATUS_ERRORSESSION_STATUS_INTERRUPTEDSESSION_STATUS_COMPLETE)r#rrrss rFclassify_session_statusr  s ""$$**,,0EEE## ""$$AK.<X))AXX )) ""rLc6)eZdZUdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZd ZdZdZdZdZdZedeedeefdZeddZedejdeeeffdZ edeej!ddfdZ"dde#de$fd Z%deej!fd!Z&dd"Z'dd#Z(deej!fd$Z)e*d%Z+ed&ej,de$fd'Z-ed&ej,de$fd(Z.ed)ej/de$fd*Z0d&ej,ddfd+Z1d&ej,ddfd,Z2dd-Z3ed)ej/ddfd.Z4d)ej/d/ed0ede$fd1Z5 dd2e6ej!ge7fd3ee8de7fd4Z9d5e8d3e8de$fd6Z:de$fd7Z;ed&ej<de$fd8Z=d&ej<de$fd9Z>d&ej<de$fd:Z?dd;Z@dd<ZAde$fd=ZBd>ZCdd?ZDd ZEd@ZFdAZGdBZHde$fdCZI ddDedEedFedGeeefdedHedIeedJedKedLedMedNedOedPedQedReddf"dSZJdDedEedefdTZKdddddddddUdDedEedHedIedJedKedLedRedQedVe$ddfdWZLd dDedYe$ddfdZZMd[d\dIed]ed^eddfd_ZNd[d\d`eeefd^eddfdaZOd[d\d^edeeeffdbZPd[d\dceQed^eddfddZRdee8deQeeeffdfZSdgeTedeUfdhZVddidee8djee#deWeUeUffdkZXddXdldmeedne$deQeeeffdoZYdddpdmedJedLeedHeedeef dqZZddddddrdEedHeedIeedJeedKeedLeedeeeeffdsZ[dtZ\ddudvee8deQeeeffdwZ]dxedyede$fdzZ^d{Z_dMedeeeeffd|Z`dDede$fd}ZadddddddXddd~ dMededEedeQeeefdFedGeeefdedNedOedede$deeUdeeUddfdZbdDededdfdZcdDeddfdZd d dDedede$fdZe d dDedNedeedPeede$deeUf dZf d dDedNedeUdeedPeede$f dZgdeeefddfdZh ddDede8deeddfdZidDedeeeeffdZjdDedeeeffdZkdDedeeefddfdZldDeddfdZmdDedeUfdZndDedeUddfdZodIedeUfdZpdIeddfdZqdDedeUfdZrdDedeUddfdZs d dDedede8de$fdZt d dDedede8de$fdZudDededdfdZvdDedefdZwdDedefdZxddddDedede8d3ee8de$f dZyddd ddddddDedede8de8de8de8de8de$fdZzdddDedede8de$fdZ{dDededdfdZ|dDedeefdZ} dddddDedee8deedee~ddf dZdDeddfdZdDedeeeeffdZ ddDededFeeddfdZdDedeeddfd„Z ddDedFedeeddfdĄZddƜdDedeeefdefdɄZdDedeeefddfdʄZ ddDedededefd̈́ZddddddΜdDedFeedeedeeeefdeede$ddfd҄ZdDede$ddfdԄZedeeeefde$fdքZedeeeefdeeeffdׄZdd؜dDedededeeddf dۄZdZdZdZdDeddfd߄Zdde8de$fdZddZdeQeWeeeeffddfdZdeQeWeeeeffdeQeWeeeefffdZdde8ddfdZddZ ddDedeUdeUdFedeUdeUdeUdee8dee8deedeedeedeedeedeedeUde$ddf$dZd[ddDedFeedeedeedeedeUdeUdeUdeUdeUdee8dee8deedeedeUdeddf"dZ ddDedEedFedefdZddddddddddd dDededFeedeedeedeUdeUdeUdeUdeUdee8deUddfdZddjddeUfdZdeUfdZdDedeeeeffdZdDedeeeeffdZdedeefdZd Zd Zd Zd Zededed iZedEeedeUfdZedeedeefdZdedede$fdZdDededEede$fdZdDedede$fdZdDededEede$fdZdDedede$fdZdDedeefdZdDedeefdZdDedEede$fdZdDede$de$fdZdDede$de$fdZdDede$de$fd Zd dDed!e$de$fd"Zed#eeefde$fd$Zdedeeeeffd%Zdedeefd&Zd'edefd(ZdDedeefd)Zehd*ZdZeeed+<ddd,d-eUd.e$deee8ffd/Z ddEed1eQed2eQed3ed4eUd5eUd6e$d-eUd7e$d8e$d.e$d9e$d:ed;ede$deQeeeff&d?ZdgeQedeeeffd@ZdAZedBedefdCZedBedefdDZedEedeefdFZ ddDedeedGeedHe8ddf dIZedJedeeeeffdKZedLedeefdMZ ddDedNedBedOedPedQedReUdSedTedUedVedWedXedYedZe$d[eed\ed]eed^eedEeeeefdeedGeedHe8deUf0d_Z ddDedeQeeefdeedGeed`eeUdHe8deUfdaZddbdDedNedBed^edEeeeefde$f dcZɐddZʐd dedDedfeUdgeedhedeeQeeeff diZdDedfeUdeQeeeffdjZ̐d dedDedhedeQeeeffdkZ͐d ddXdldDedNed5eUdme$deeUf dnZdDedeeUfdoZdDedpeUdeefdqZdDedeQeeefdeeUeUffdrZ ddDedeQeeefdne$dse$ddf dtZdDede$fduZdDedeUfdvZ ddDedweQeeefdxeeeefdeeUdyeedeUf dzZdeQefd{ZdDedBed]edeUfd|Z ddDed}e$d~e$d4eeUd5eUde$deeUdeQeeeffdZdgeQedeQeeeffdZ ddDedeUdeUdeeeffdZdDedefdZ ddDede$d}e$de$de$deQeeeff dZݐdZdddDede$de$de$deQeeeff dZdDedeWeQeeefeQeeefffdZdDedeUfdZ ddDedeeUdeUfdZ ddDedeeUdeUfdZdDedeQeeeffdZdDede$fdZdDedefdZdDedeQefdZedeQeeefdeeefde$fdZdDedeUdeeeffdZdDedeUdeUfdZ ddEed4eUd5eUdedeQeeeff dZ ddEed1eQed3ed-eUd.e$d9e$de$d2eQedeUfdZddeUde$fdZddddd.e$d9e$de$deeeUffdZddDedeUfdZdDedYede$fdZdeeefde$fdZdeeefde$fdZdDedeQefdZdDeddfdZedjee#dDeddfdZdDedeQefdZ d dDedjee#deeQede$fdZ ddDedjee#de$fdZ ddgeQedjee#deUfdZdeUfdZ ddjee#deUfdZeddddddddddddddddddddddddddee8dee8dee8dee8dEeedeedeed3eedeeUdeeUdee$deedeedHeedJeedKeedeedeeUdeeUdee8dee8deeUdeeUd=e$deWeeff2dńZedeee8deeefddfdDŽZ d deee8dEedeQeeeffdȄZ d deee8dEedeUfdɄZ d deee8dEedeUfdʄZ d deee8dEedeUfd˄ZdXd̜de8de$deUfdτZ ddeee8dEedjee#deUfdфZddXdҜde$de$deeeffdՄZdedeefdքZddלdedLed)eej/ddfd؄ZdedeUfdڄZdedeQeWeeffd܄Z dd݄Z dddޜdJedHedee$dee$ddf dZ dXddJede$ddfdZ dJedHede$fdZ dJedLedeeeeffdZdJedeQeeeffdZdDedeeeeffdZdJedLedeUfdZdddJedLedHedIedDededdfdZdDede$fdZdddJedHed4eUdeQeeeffdZdZdeeUfdZdeUfdZ ddeUdeUde$djee#deUdeeeff dZ d de8deUde$deeeffdZdDedmede$fdZdDedeeeeffdZdeQeeeffdZdDede$fdZdDeddfdZdDededdfdZdS(!rz SQLite-backed session storage with FTS5 search. Thread-safe for the common gateway pattern (multiple reader threads, single writer via WAL mode). Each method opens its own cursor. g4@rg?rrg333333?rg??2irLi'iPiPig>@rfr:c\|dSt|}|d||f|S)NzAINSERT OR IGNORE INTO system_prompts (hash, prompt) VALUES (?, ?))rmr)rrf prompt_hashs rF_store_system_promptzSessionDB._store_system_promptn sC  4)-88  O - (   rLNc0|ddS)Nz|DELETE FROM system_prompts WHERE NOT EXISTS (SELECT 1 FROM sessions WHERE sessions.system_prompt_hash = system_prompts.hash)rres rF#_delete_unreferenced_system_promptsz-SessionDB._delete_unreferenced_system_promptsy s'       rLrcht|}d|vr|d}d|vr||d<|S)N_system_prompt_resolvedrf)r,pop)rdatar s rF_session_row_dictzSessionDB._session_row_dict sDCyy $ , ,xx 9::H$&&(0_% rLrc|dS |dS#t$r tddYdSwxYw)zCClose a partially initialized connection without masking its error.Nz&Could not close a SessionDB connectionTr)rqrBr=rYres rF_close_connection_quietlyz#SessionDB._close_connection_quietly sd < F R JJLLLLL R R R LLADL Q Q Q Q Q Q Rs&AAFr read_onlycV |p t_tj|_t j_tjt_ t j t_ d_ t j_d_d_d_d_d_d_d_d_d_d_d_d_d_d_t;_t jt j_ d_!d_"d_#d_$d} |r!tKdjdjdddd _tLj'j_( tSjd j*}+|d du_jr+|d du_nD#tX$r7jdc}_ |-n#t\$rYnwxYwwxYwd} |s&jdc}_/|dSdSjj01dd|stejd |sj3rtijr j5j6}n#tn$rd}YnwxYwtqj}jj0dz }d|d|pdd|d} tr:| tw| |Aj3r(tijrtMj<| fd fd} | n#tLj<$r} t{| rt}jstr:d|  jj-n#t\$rYnwxYwtj} | @ds| Yd} ~ nd} ~ wwxYwd}n9#t\$r,} twt| jBd| d} ~ wwxYw |s&jdc}_/|dSdS#|s%jdc}_/|wwxYw)N)maxsizerFrSrTr"rrcheck_same_threadrrorrrvrwrrzstate-snapshotszstate.db looks ZEROED (z( bytes, no SQLite header). Preserved at u*(quarantine failed — file left in place)z. Restore from z via `hermes snapshot list` / `hermes snapshot restore ` if available. Opening a fresh empty database so the agent can start.cttjddd_tjj_tjddk_tjdj dtj_ dS)NFr")r7rrorrrvPRAGMA foreign_keys=ON)rr_r_connrRRow row_factoryr _wal_activerrr_fts_cjk_loaded _init_schemarZsrF_connect_and_initz-SessionDB.__init__.._connect_and_initT s0 %%&+ %)    *1 &+DJLLLPUU 'tzJGGGG ""#;<<<'>tz'J'J$!!#####rLc tjjz} dS#tj$r}t |}d|vrd|vr jjn#t$rYnwxYwtj}||krtj ttj jjt!||z dYd}~nd}~wwxYw)NTrrMbP?)rTr_WRITE_PATIENCE_SrRrSr_rr:rqrBrUminrandomuniform_WRITE_RETRY_SLOW_MIN_S_WRITE_RETRY_SLOW_MAX_Sr)rr\errr)rArZs rF$_connect_and_init_with_lock_patiencez@SessionDB.__init__.._connect_and_init_with_lock_patiencej sO >++d.DD))+++"3!#hhnn..#3..63D3D!!#z5 $ 0 0 2 2 2(!!! D!"n..(??!  &$($@$($@!"!"!$HsNE : :  s9 +D *D% BD BDBA-DD u`state.db schema is malformed (%s) — attempting automatic repair (a backup copy is made first).r?rG)Crrrr2 threadingLock_lockqueue LifoQueue_READ_POOL_MAX _read_poolBoundedSemaphore _read_permits_read_permit_exhausted_read_conns_lock_read_conns_closed_read_open_failed_atr= _write_count_fts_runtime_rebuild_attempted_notadb_reconnect_attempted_fts_usermerge_floor_applied _fts_enabled _fts_stale_trigram_availabler>_fts_cjk_available_fts_unavailable_warnedr:r _token_queue Condition_token_queue_cond_token_writer_thread_token_writer_stop_token_writer_busy_token_atexit_hookrrRr;r<rr_fts_table_probe BaseExceptionrqrBr1rrrlrGrr r rrr=rrrrrrr@typer\)rZrr2initialization_completerrzsizeqpathsnapsrrKr\rrAs` @rFrYzSessionDB.__init__ sb4"2"4"4  t|,,,"^%% BG"B B B '7GG '(# ) 0 0 #(%(!  /4+,1(-2)!"' %"'',$ $)77!*!4Y^5E5E!F!F@D!"'"'@D"'K 52 12DL222"&,&+$(  *1 &*4: KKKK!Z..00F--fnEEM%( 11 & 6 $ $/%'+z4$D$* $ +/'l+ 5#':t dj..t44444 5 5i L  % %dT % B B B  L( KKKK 5L'')) 5't|44 5  L--//7EEEEE24<@@ +.??MeMM$)$Y-YMM$)MMM S!!!$S)))=T\%8%8%:%:=?QRVR^?_?_=!/444 $ $ $ $ $,$ $ $ $ $ $ L 7446666( 7 7 7-S119Nt|9\9\ <=@z- ((*** D/ ==zz*--4466666666- 7>'+ # #    !DII$6!?!?#!?!? @ @ @   $"+ 5#':t dj..t44444 5 5* 5#':t dj..t4444 5s%AR'A0HRI2II IIIIR A(R2LR L RL  B+R ORR&?R& QR QRQ7R RRRS? S%'S  SS??)T(cL|jr|jrdS|j5|jr ddddS|jr2t j|jz tkr ddddSdddn #1swxYwY|j dsW|j5|xj dz c_ dddn #1swxYwYt dt|jdSd} td|jd|jddd d }t j|_t'|d |jrt+|n#t j$r|||j5t j|_dddn #1swxYwYt d |jd|jYdSt2$r0|||jwxYw|S)uOpen a fresh read-only connection, or None when unavailable. Callers must return the connection to self._read_pool (see _read_ctx); this opens, it does not track. Only used under WAL: WAL readers see a consistent snapshot and never block on (or get blocked by) the writer, so recall/browse queries can skip self._lock entirely. Under DELETE journal mode (NFS fallback) a reader can hit SQLITE_BUSY storms during writes, so we keep the legacy locked single-connection path there. Fresh read transactions begin per statement (autocommit), so each query observes everything committed so far — read-your-writes holds for the flush-then-search patterns in a turn. NF)blockingrqzVread pool at capacity (%d) for %s; serving this read from the locked writer connectionrSrTrr6rrz'read-only connection open failed for %sr)r=r2rVrWrXrTr_READ_OPEN_RETRY_SECONDSrTacquirerUr=rYrQrrrRr;r<rr>rrr_discard_partial_read_connreleaserjrZrs rF_get_read_connzSessionDB._get_read_conn se  4> 4  "  &         ) N$$t'@@*++                       !))5)99 & 1 1++q0++ 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 LL+     4. &. ..."l#( $D '{D  "4* = = = = # .'---}     + +D 1 1 1& = =,0N,<,<) = = = = = = = = = = = = = = = LLBDL[_L ` ` `   & & ( ( (44     + +D 1 1 1   & & ( ( (   s_ A3,A33A7:A7 B==CC3AE+H!:F H!F# #H!&F# '>H!(9H!c|dS |dS#t$r,}td|j|Yd}~dSd}~wwxYw)zClose a connection that failed between open and hand-off. Separate from _close_read_conn because that one releases a permit and this runs on paths that release their own. Nz2partially-opened read conn close failed for %s: %s)rqrBr=rrrZrr\s rFrtz$SessionDB._discard_partial_read_conn%s < F  JJLLLLL    NNDdlTW          s A!A  Ac |n8#t$r+}td|j|Yd}~nd}~wwxYw|jdS#|jwxYw)uClose a pooled read connection and release its descriptor permit. This was a bare ``except Exception: pass``, which silently swallowed the sqlite3.ProgrammingError raised when close() ran on a thread other than the one that opened the connection — the exact signature of the fd leak this pool fixes. A close that fails leaks a tracked fd, so it must not be invisible. The permit is released even when close() raises: the descriptor is already lost at that point, and withholding the permit too would turn one leaked fd into a permanently narrower read path — failing twice for one fault. The warning is the signal that matters. Pairs with _get_read_conn(). Calling this on a connection that did not come from there over-releases the BoundedSemaphore, which raises ValueError rather than silently widening the ceiling. z!read-conn close failed for %s: %sN)rqrBr=rrrTrurys rF_close_read_connzSessionDB._close_read_conn4s$ ) JJLLLL S S S NN> c R R R R R R R R S   & & ( ( ( ( (D  & & ( ( ( (s+A* A !AA*A  A**Bc|jr|jrdS |jS#tj$r|cYSwxYw)uBorrow a read connection from the pool, opening one on a miss. The single acquisition seam for the read path: the WAL/read_only gate, the pool checkout and the open-on-miss all live here, so there is exactly one place to exercise (and one place for a caller to bypass by accident). Returns None when the read path is unavailable and the caller must fall back to the locked writer connection. A pool hit costs no permit — the connection it hands back is already holding one. Only the miss path can open, and only _get_read_conn() can take a permit, so peak live connections is bounded by _READ_POOL_MAX no matter how many threads miss simultaneously. N)r=r2rR get_nowaitrOEmptyrwr@s rF_checkout_read_connzSessionDB._checkout_read_connMsk 4> 4 )?--// /{ ) ) )&&(( ( ( ( )s+#AAc#lK|}| |Vd}|j5|js3 |j|d}n#t j$rYnwxYwdddn #1swxYwY|s||nx#d}|j5|js3 |j|d}n#t j$rYnwxYwdddn #1swxYwY|s||wwxYwdS|j5|j VddddS#1swxYwYdS)uYield a connection for read-only statements. WAL: a read-only connection borrowed from a bounded pool with NO lock — recall queries never convoy behind writer flushes (the gateway shares one SessionDB across every agent, so this lock was a global choke point). The connection is checked out for the duration of the block, so no two threads ever touch it concurrently. Non-WAL, read-conn failure, or _READ_POOL_MAX already reached: the shared writer connection under self._lock, byte-for-byte the legacy behavior. That last case is the deliberate degradation. Past the ceiling readers convoy on the writer lock instead of opening descriptors — measurably slower under a burst, and the alternative is EMFILE, which takes the whole process down in a way a restart-on-exit supervisor cannot see. NFT) rrVrWrR put_nowaitrOFullr{rNr:)rZrreturneds rF _read_ctxzSessionDB._read_ctxbsa$''))   0  *!!2!! O66t<<<'+HH$z!!! D! !!!!!!!!!!!!!!! 0))$///%!*!!2!! O66t<<<'+HH$z!!! D! !!!!!!!!!!!!!!! 0))$//// 0 F Z  *                     sBA.A  A. AA.AA..A25A2 DC"$CC"C C"C C" D"C& &D)C& *D D))D-0D-r\ctt|}d|vrd|vrdSd|vrdSd|vrdSdS)Nzno such modulefts5Tno such tokenizer: trigramrFrr\rJs rFrz$SessionDB._is_fts5_unavailable_errorsX#hhnn s " "v}}4 (3 . .4 . 4 44urLcTt|}d|vpd|vS)uTrue when only an optional tokenizer is missing (FTS5 itself works). Covers the built-in trigram tokenizer (needs SQLite >= 3.34) and the loadable cjk_unicode61 tokenizer — both mean "this one index can't be served here", never "disable FTS". rrrrs rF_is_trigram_unavailable_errorz'SessionDB._is_trigram_unavailable_errors3#hhnn (C / 91S8 rLrc|d}|dSt|tjs|dn|dpd}d|vS)uTrue when messages_fts exists in ANY pre-v23 shape. v23's messages_fts is external-content over THREE real columns (content, tool_name, tool_calls). Every pre-v23 shape lacks the tool_name/tool_calls columns — whether the old inline single-column form (v11..v22) or the even older external-content single-column form (v10-era, pre-#16751). We therefore detect "needs optimize" as "the stored CREATE lacks the tool_name column", which is the precise v23 marker and correctly catches BOTH legacy variants. Returns False when messages_fts doesn't exist yet (fresh DB mid-init): the post-migration FTS setup block will create it in the v23 shape. zLSELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'messages_fts'NFrrrp tool_name)rrQrrRr;)rrrs rF_db_has_legacy_inline_ftsz#SessionDB._db_has_legacy_inline_ftssjnn =   (**  ;5'W[99Is1vvs5zPb#%%rLct|ddrdSd|_td|jt j|dS)zHLog once that the trigram tokenizer is missing; base FTS5 stays enabled._trigram_unavailable_warnedFNTzSQLite trigram tokenizer unavailable for %s (requires SQLite >= 3.34, this build is %s); CJK/substring search will fall back to LIKE: %s)rrr=r>rrRrrZr\s rF_warn_trigram_unavailablez#SessionDB._warn_trigram_unavailablesY 46 > >  F+/(  > L  "       rLcvd|_|jrdSd|_td|j|dS)NFTzSQLite FTS5 unavailable for %s; full-text session search disabled. Run `hermes update` to rebuild the venv with a current Python (managed uv guarantees FTS5). (underlying error: %s))r]rar=rrrs rF_warn_fts5_unavailablez SessionDB._warn_fts5_unavailablesQ!  '  F'+$ % L       rLct|d}|js|rd|dddt Ddt D}|r`tdt|dtf|D]}|d |d |_ d S | t|s|d tf|d d}|dkr^|dd}dt|fdfD]\}}|d||f|dtf} | r d |_ d S| t|d} | |_ d S#t j$r'tddd |_ Yd SwxYw)uCreate / repair / self-heal the CJK-bigram index surface. ``cursor`` may be a Cursor or a Connection (both expose execute / executescript). Called only for v23-shape DBs with the base FTS surface healthy. Sets ``self._fts_cjk_available``. Never raises; every failure mode degrades to "no cjk index" (trigram/LIKE routing keeps working). Cases: tokenizer loaded, table absent → create. Empty DB: index is complete by construction (triggers cover everything). Populated DB: set the cjk backfill markers so the id-gated triggers stay correct and `optimize-storage` can backfill; the index is NOT served until the backfill completes. tokenizer loaded, table present → ensure triggers (recreates any dropped by a tokenizer-less process), honour the stale breadcrumb (serve only when absent and no backfill pending). tokenizer NOT loaded, table present with live triggers → drop the cjk triggers so message INSERTs don't fail at trigger time, and leave the stale breadcrumb (#self-heal). The table itself stays for a later capable open to rebuild. zNSELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'messages_fts_cjk'cg|] }|d SrrKrrs rFrz4SessionDB._ensure_fts_cjk_schema..s)AaDrLzCSELECT name FROM sqlite_master WHERE type = 'trigger' AND name IN (rc3K|]}dVdSrNrKrr[s rFr+z3SessionDB._ensure_fts_cjk_schema.."0P0P0P0P0P0P0P0PrLru messages_fts_cjk triggers present but the cjk_unicode61 tokenizer is unavailable (%s) — dropping the cjk triggers so message writes keep working. CJK search falls back to trigram/LIKE; run `hermes sessions optimize-storage` on a host with the extension to rebuild.z^INSERT INTO state_meta (key, value) VALUES (?, '1') ON CONFLICT(key) DO UPDATE SET value = '1'DROP TRIGGER IF EXISTS FNz$DELETE FROM state_meta WHERE key = ?z2SELECT COUNT(*) FROM messages WHERE role <> 'tool'rz)SELECT COALESCE(MAX(id), 0) FROM messagesfts_cjk_rebuild_high_water)fts_cjk_rebuild_progressrgINSERT INTO state_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.valuez&SELECT 1 FROM state_meta WHERE key = ?zISELECT 1 FROM state_meta WHERE key = 'fts_cjk_rebuild_high_water' LIMIT 1z@messages_fts_cjk ensure failed; CJK search stays on trigram/LIKETr)rrrQr>rrrr=rrr&r` executescriptFTS_CJK_TABLE_SQLr_FTS_CJK_TRIGGER_SQLrRrS) rZr cjk_presentlivetrign_msgshwkvr=backfill_pendings rF_ensure_fts_cjk_schemaz SessionDB._ensure_fts_cjk_schemas'.6>> ,   (** #  I"(..T(+0P0P>O0P0P0P(P(PTTT)##hjj I NN9 )**NNE*, !%II'G'G'GHHHH&+D # F7 ,  !2 3 3 3 :&( H(**Q A::Chjj$B6s2ww?9!1TF NN8"$hjj   +0'  !4 5 5 5%~~C  hjj +;&:D # # #' , , , NN)-    ',D # # # # ,sDI A I2J  J cvtD]0} |d|#tj$rY-wxYwdS)Nr)rrrRrS)rtriggers rF_drop_fts_triggerszSessionDB._drop_fts_triggers\sa$  G BBBCCCC+      s $66rddlcL|||}|dS ||dS#tj$ra}||s||r||n||Yd}~dSd}~wwxYw)NFT)rirrRrSrrrr)rZrrrstatusr\s rF_ensure_fts_schemazSessionDB._ensure_fts_schemads &&vz:: >5    % % %4'   22377 11#66 1..s3333++C00055555 s3B#ABB#fn patience_sc||j}tj|z}d}dtjdt fd} |j5|jd ||j}|j n:#t$r- |j n#t$rYnwxYwwxYw dddn #1swxYwY|xj dz c_ |j |jzdkr||j |jzdkr||S#t$$rK|)t'tj|jz|}|||jrYTtj$r}t/|}d |vsd |vr6|||rYd}~tjd |d d |||r|||rYd}~d}~wtj$r}||r|||rYd}~#t5|r|sYd}~M||rYd}~h||rYd}~d}~wtj$r-}||r|||rYd}~d}~wwxYw)uExecute a write transaction with BEGIN IMMEDIATE and jitter retry. *fn* receives the connection and should perform INSERT/UPDATE/DELETE statements. The caller must NOT call ``commit()`` — that's handled here after *fn* returns. BEGIN IMMEDIATE acquires the WAL write lock at transaction start (not at commit time), so lock contention surfaces immediately. On ``database is locked``, we release the Python lock, sleep a random jitter, and retry — breaking the convoy pattern that SQLite's built-in deterministic backoff creates. *patience_s* is the total time budget for lock retries (default ``_WRITE_PATIENCE_S``). Transcript-critical writes pass ``_TRANSCRIPT_WRITE_PATIENCE_S`` so a sibling process holding the lock for a legitimate long operation (VACUUM, TRUNCATE checkpoint, pre-bounded-merge FTS optimize from an older still-running install) exhausts routine writers' patience without destroying a user turn. Jitter starts small (20-150ms) for fast reclaim on millisecond contention and backs off to 250ms-1s once the lock has been held longer than ``_WRITE_RETRY_SLOW_AFTER_S``. Returns whatever *fn* returns. Nr\r:cHdt|vS)Nzno more rows availablerrs rF_is_no_more_rowsz2SessionDB._execute_write.._is_no_more_rowss+s3xx~~/?/?? ?rLTr{rqrrrzQdatabase is locked (another Hermes process held the state.db write lock for over .0fus — likely a long maintenance operation such as VACUUM, a large WAL checkpoint, or an older pre-update process; the database itself is healthy))rDrTrrRrrrrNr:rrrjrollbackrBrY_CHECKPOINT_EVERY_N_WRITES_try_wal_checkpoint_FTS_MERGE_EVERY_N_WRITES_try_incremental_merge_ftsrrE_COMPRESSION_BUSY_WAIT_S_sleep_before_write_retryrSr_rrr_reconnect_after_notadb_try_runtime_fts_rebuild_enter_fts_fail_open) rZrrrcompression_deadlinerrr\err_msgs rF_execute_writezSessionDB._execute_writes7:  /J>##j015 @'- @D @ @ @ @` _ Z  J&&'8999!#DJ ))++++(! J//1111(!!! D! ,               !!Q&!!$t'FF!KK,,...$t'EEJJ33555 4   (/+.((4+HH(,,(11($*GH+   c((..**w&&&G*;*;55h KK! "2C8BNCCC  $#C((T-K-KHV`-a-aHHHH(   ##C((T-K-KHV`-a-aHHHH,C007799HHHH0055HHHH,,S11HHHH=    $#C((T-K-KHV`-a-aHHHH sD:C)BC B?B-,B?- B:7B?9B::B??C D:CD:CA"D::AK< K<?H#!;H#"H##K<5!J=$J=J=!J=<J==K<!K76K77K<rc Ftj}||krdS|||z z }||jkr tj|j|j}ntj|j|j}tj t|t||z ddS)aSleep one jitter interval if the patience budget still allows it. Returns True when the caller should retry, False when *deadline* has passed and the error should propagate. Jitter stays small for the first ``_WRITE_RETRY_SLOW_AFTER_S`` (fast reclaim on millisecond contention) and backs off after that, and never overshoots the deadline by a full slow-jitter. FrCT) rTr_WRITE_RETRY_SLOW_AFTER_SrFrGrHrI_WRITE_RETRY_MIN_S_WRITE_RETRY_MAX_SrUrEr)rZrrr)elapsedjitters rFrz#SessionDB._sleep_before_write_retrysn (??5J./ d4 4 4^,,FF ^''F 3vs8c>599::;;;trLc|jrdSd|_td |j5|j2 |jn#t $rYnwxYwd|_tt|j |j ddd}tj |_ ||_t|dd k|_t|d|d t#||_|dddn #1swxYwYn3#t $r&}td |Yd}~dSd}~wwxYwtd dS) u$Close the corrupted write connection and reopen state.db. Returns True when the connection was successfully replaced and the failed write should be retried. Mirrors the constructor's ``_connect_and_init`` so WAL/schema reconciliation runs on the fresh connection. Never raises — logs and returns False on failure so the original error propagates. One-shot per instance: a genuinely unrecoverable database must not put writers into a reconnect loop that pins CPU on every write. FTuwstate.db connection reported 'file is not a database' — closing and reopening the connection to self-heal (one-shot).Nr")rr7rrorrrvr9zrstate.db reconnect after 'file is not a database' failed (%s); the database may need the full offline repair path.zEstate.db connection reopened successfully; retrying the failed write.)r[r=rrNr:rqrBrr_rrRr;r<rr=rrrr>r?r)rZnew_connr\s rFrz!SessionDB._reconnect_after_notadb+s  + 5+/( D   !  $ $:) ((****$!%DJ. %%"&,&+$( (/{$& +HzJJJ 'x*EEEE  !9:::'>x'H'H$!!###3 $ $ $ $ $ $ $ $ $ $ $ $ $ $ $4    LLF    55555    S   ts^D0D$AD$ A# D$"A##B5D$ D0$D((D0+D(,D00 E :EE cvt|rdSt|}d|vod|vS)aTrue for the error class a corrupt FTS index raises on writes. The message varies by SQLite version: older builds raise the generic ``database disk image is malformed`` (covered by ``is_malformed_db_error``); newer builds (e.g. ubuntu-latest CI) raise the FTS5-specific ``fts5: corrupt structure record for table "messages_fts"``. Both mean the same thing for the write path: the canonical rows are fine, the FTS shadow tables are not. Trr)rr_r)r\rs rF_is_fts_write_corruption_errorz(SessionDB._is_fts_write_corruption_erroresB ! % % 4#hhnn}1c!11rLc|jrdS|jsdS||sdSd|_td| |}n3#t $r&}td|Yd}~dSd}~wwxYw|stddStd|dS)ubOne-shot in-place FTS rebuild after a corrupt-index write failure. Returns True when a rebuild was performed and the failed write should be retried; False when the error isn't the FTS-corruption class, FTS is disabled, or a rebuild was already attempted for this instance. Delegates to :meth:`rebuild_fts` (the FTS5 ``'rebuild'`` command — index rewritten from the canonical messages table, zero message-row mutation). Safe to call from ``_execute_write``'s except path: the failed transaction was rolled back and ``self._lock`` released before the exception propagated, and ``rebuild_fts`` re-acquires it. E2E-verified: a corrupted ``messages_fts_data`` shadow table rejects every append; after the in-place rebuild the same append succeeds and search works again. FTustate.db write failed with an FTS-corruption error (%s) — attempting one-shot in-place FTS rebuild; canonical message rows are preserved.zkIn-place FTS rebuild failed (%s); the database needs the full offline repair path (repair_state_db_schema).NzpIn-place FTS rebuild made no progress; the database needs the full offline repair path (repair_state_db_schema).zFstate.db FTS indexes rebuilt in place (%d); retrying the failed write.)rZr]rr=rrrBr)rZr\rebuilt rebuild_excs rFrz"SessionDB._try_runtime_fts_rebuildus  . 5  522377 5.2+ "#&    &&((GG    LLE    55555    LLI   5 T    ts A"" B,B  Bc|jr||sdS |j5|jd |jdt f|jdddtDdt}|r!|jdtf| |j |j n(#t$r|jwxYw dddn #1swxYwYn8#tj$r&}t"d |Yd}~dSd}~wwxYwd |_d|_d|_d|_t"d |d S) anDetach corrupt FTS indexes so canonical writes can continue. The stale breadcrumb and trigger removal commit atomically. Its ordering is load-bearing: after triggers are absent, new canonical rows create an index gap of unknown extent, so another process must never reinstall the triggers without first rebuilding every row. Fr{ziINSERT INTO state_meta (key, value) VALUES (?, '1') ON CONFLICT(key) DO UPDATE SET value = excluded.valuez@SELECT 1 FROM sqlite_master WHERE type = 'trigger' AND name IN (rc3K|]}dVdSrrKrs rFr+z1SessionDB._enter_fts_fail_open..rrLz ) LIMIT 1NzNCould not detach corrupt FTS indexes; canonical write still cannot proceed: %sTzstate.db FTS indexes remain corrupt (%s); disabled FTS sync and retrying the canonical write. Search temporarily uses LIKE until a later SessionDB open rebuilds the indexes.)r]rrNr:rr(rrrQr&_drop_all_fts_triggersrrrjrrRrrr=rr^r_r`)rZr\cjk_triggers_present detach_excs rFrzSessionDB._enter_fts_fail_opensg  (K(KC(P(P 5    ""#4555J&&P&( ,0:+=+="(+0P0P>O0P0P0P(P(P"""* ,, hjj ) , **T.0 // 0A0A0C0CDDDJ%%''''$J'')))(+               2}    LL%    55555  !"'"'  ;     tsSE&EC!D%$E%%E  E E&EE&!E"E&&F5FFcr |j5|jd}|r4|ddkr(td|d|dddddS#1swxYwYdS#t $r&}td|Yd}~dSd}~wwxYw)uqBest-effort PASSIVE WAL checkpoint. Never raises. Flushes committed WAL frames back into the main DB file without requiring an exclusive lock. PASSIVE is safe for frequent periodic use because it does not block concurrent writers and cannot corrupt B-tree pages under I/O pressure. PASSIVE does not truncate the WAL file — it stays at its high-water mark. Explicit checkpoints on the shared ``state.db`` no longer truncate the WAL; it is bounded by ``journal_size_limit`` and the writer's natural post-checkpoint reset rather than by a TRUNCATE at every close or maintenance command. Previous TRUNCATE strategy caused B-tree corruption on large databases (65K+ pages) due to the exclusive-lock I/O pressure from checkpointing thousands of frames at once (issue #45383). PRAGMA wal_checkpoint(PASSIVE)rqrz(WAL checkpoint: %d/%d pages checkpointedrNz#WAL checkpoint (PASSIVE) failed: %s)rNr:rrQr=rYrBr)rZrr\s rFrzSessionDB._try_wal_checkpoints"$ G  ++4(**fQi!mmLLBq 6!9                    G G G NN@# F F F F F F F F F Gs;BA#A9, B9A==BA=B B6B11B6c|S)uEnter a scope that closes this handle on the way out. Ownership of a SessionDB should be released explicitly. Historically an instance with a started token writer pinned ITSELF (bound-method writer target plus a strong ``atexit`` drain hook), so ``__del__`` never ran for exactly the instances that leaked descriptors (#88033). The writer now retires after an idle window and the atexit hook holds only a weak reference, so abandoned handles are eventually collectible — but "eventually, after the idle window and a GC cycle" is not a release policy. Call sites owning a handle are still expected to close it deterministically (see the ownership comments in ``run_agent.py`` and ``tui_gateway/methods_session.py``). This makes the correct usage the easy one, so an owning scope can be exception-safe by construction rather than by remembering a ``try/finally``: with SessionDB(path) as db: db.append_message(...) Purely additive: it changes nothing for callers that already call ``close()`` directly, and ``close()`` stays idempotent, so a scope that closes early still exits cleanly. rKr@s rF __enter__zSessionDB.__enter__s 4 rLc.|dS)zClose the handle, then let any exception propagate. Returns False (never suppressing), so ``with`` here only manages the descriptor lifetime and never swallows a caller's error. F)rq)rZexc_typer\tbs rF__exit__zSessionDB.__exit__s urLc||jdc}|_|tj||j5d|_dddn #1swxYwY |j}n#tj $rYnwxYw| |F|j 5|j ry|j sN |j dn2#t$r%}t d|Yd}~nd}~wwxYw|j dc}|_ ||ddddS#1swxYwYdS)uClose the database connection. Drains queued token deltas first (the background writer needs the connection). Writable connections then attempt a PASSIVE WAL checkpoint (NOT TRUNCATE: transient per-cron-run connections close many times an hour, and a TRUNCATE fires a full WAL reset that races the gateway's live writer and tears B-tree pages — issue #45383). Read-only connections never request a checkpoint. NTrz,WAL checkpoint (PASSIVE) at close failed: %s)_stop_token_writerrhatexit unregisterrVrWrRr}rOr~r{rNr:r2rrBr=rYr1)rZhookrr\s rFrqzSessionDB.close#s !!!(,(?%d%    d # # #  " + +&*D # + + + + + + + + + + + + + + + ( 1133;      ! !$ ' ' '  ( Z 5 5z 5~ **+KLLLL$ J $(:t dj..t444% 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5s`AAA"A<<B B.D<>CD< D#D>D<D'D<<EEc|jddS |dS#t$rYdSwxYw)uSafety net: close the connection if the caller forgot. The async accounting worker retires when idle and its atexit hook holds only a weak reference, so neither can pin an otherwise orphaned instance. During interpreter teardown the order of module cleanup is undefined, so every attribute access remains guarded. Delegates to ``close()`` so the read pool, token writer, and atexit hook are all cleaned up — not just the writer connection. r:N)__dict__r@rqrBr@s rF__del__zSessionDB.__del__QsW =  W % % - F  JJLLLLL    DD s4 AAg@g?fts_v22_trash_c t|d|jdddzfS)zTrue when demoted v22 shadow tables are still awaiting teardown. Caller must hold ``self._lock`` (or pass a migration-time cursor).zSSELECT 1 FROM sqlite_master WHERE type = 'table' AND name LIKE ? ESCAPE '\' LIMIT 1r[\_%)rr_FTS_TRASH_PREFIXrrQrvs rF_has_fts_trashzSessionDB._has_fts_trashsTDLL 2  # + +C 7 7# = ?   (**  rLrdsourcemodelruser_id session_keychat_id chat_type thread_idparent_session_idr profile_namer origin_json display_namec    fd}|jdS)uInsert a session row, enriching NULL metadata on conflict. The gateway's ``get_or_create_session`` creates a bare row (source + user_id) *before* the agent exists; the agent's later ``create_session`` then carries the real ``model`` / ``model_config`` / ``system_prompt``. A plain ``INSERT OR IGNORE`` silently dropped that enrichment, leaving gateway sessions with NULL model/billing metadata. The ``ON CONFLICT`` upsert backfills those fields via ``COALESCE`` — only filling columns that are still NULL, never overwriting values an earlier writer already set (so a later bare call with source="unknown" can't clobber a real source/model). ``chat_id``/``thread_id`` record the messaging origin (the chat/room and thread the session was started in) so that gateway ``/resume`` can prove a persisted, now-inactive row belongs to the caller's chat/thread before switching to it (IDOR scoping — without them the ``sessions`` table has no chat/thread to compare). When ``parent_session_id`` is set (compression fork, delegate/subagent spawn, branch continuation) and this row's own ``cwd``/``git_repo_root``/ ``git_branch``/``profile_name`` are still NULL after the insert, they are backfilled from the parent row. Callers of ``create_session`` for a child session historically didn't propagate these fields themselves (e.g. the compression-fork path), so a lineage could silently lose its working directory and drop out of the project sidebar every time it forked (#64709), or lose its owning profile and be aggregated as "default" every time it rotated or branched (the cross-profile session-jump bug). This only fills NULLs — an explicit value on the child is never overwritten. For compression forks specifically (parent ended with ``end_reason='compression'``), the gateway origin columns (``user_id``/``session_key``/``chat_id``/``chat_type``/ ``thread_id``/``display_name``/``origin_json``) are inherited too, so a crash before the gateway re-records the peer can't strand the child without a recoverable routing mapping (#59527). cb |}|d rtjnd|   t jf| | r0|d f|d fdSdS)Na2 INSERT INTO sessions ( id, source, user_id, session_key, chat_id, chat_type, thread_id, model, model_config, system_prompt, system_prompt_hash, parent_session_id, cwd, profile_name, git_repo_root, origin_json, display_name, started_at ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET model = COALESCE(sessions.model, excluded.model), model_config = CASE WHEN excluded.model_config IS NOT NULL AND json_type( sessions.model_config, '$._reset_from' ) IS NOT NULL AND json_remove( sessions.model_config, '$._reset_from' ) = '{}' THEN json_set( excluded.model_config, '$._reset_from', json_extract( sessions.model_config, '$._reset_from' ) ) ELSE COALESCE( sessions.model_config, excluded.model_config ) END, system_prompt_hash = COALESCE( sessions.system_prompt_hash, excluded.system_prompt_hash ), system_prompt = CASE WHEN sessions.system_prompt_hash IS NULL AND excluded.system_prompt_hash IS NOT NULL THEN NULL ELSE sessions.system_prompt END, session_key = COALESCE(sessions.session_key, excluded.session_key), chat_id = COALESCE(sessions.chat_id, excluded.chat_id), chat_type = COALESCE(sessions.chat_type, excluded.chat_type), thread_id = COALESCE(sessions.thread_id, excluded.thread_id), parent_session_id = COALESCE(sessions.parent_session_id, excluded.parent_session_id), cwd = COALESCE(sessions.cwd, excluded.cwd), profile_name = COALESCE(sessions.profile_name, excluded.profile_name), git_repo_root = COALESCE(sessions.git_repo_root, excluded.git_repo_root), origin_json = COALESCE(sessions.origin_json, excluded.origin_json), display_name = COALESCE(sessions.display_name, excluded.display_name)aUPDATE sessions SET cwd = COALESCE(sessions.cwd, (SELECT p.cwd FROM sessions p WHERE p.id = sessions.parent_session_id)), git_repo_root = COALESCE(sessions.git_repo_root, (SELECT p.git_repo_root FROM sessions p WHERE p.id = sessions.parent_session_id)), git_branch = COALESCE(sessions.git_branch, (SELECT p.git_branch FROM sessions p WHERE p.id = sessions.parent_session_id)), profile_name = COALESCE(sessions.profile_name, (SELECT p.profile_name FROM sessions p WHERE p.id = sessions.parent_session_id)) WHERE id = ? AND parent_session_id IS NOT NULLaUPDATE sessions SET user_id = COALESCE(sessions.user_id, (SELECT p.user_id FROM sessions p WHERE p.id = sessions.parent_session_id)), session_key = COALESCE(sessions.session_key, (SELECT p.session_key FROM sessions p WHERE p.id = sessions.parent_session_id)), chat_id = COALESCE(sessions.chat_id, (SELECT p.chat_id FROM sessions p WHERE p.id = sessions.parent_session_id)), chat_type = COALESCE(sessions.chat_type, (SELECT p.chat_type FROM sessions p WHERE p.id = sessions.parent_session_id)), thread_id = COALESCE(sessions.thread_id, (SELECT p.thread_id FROM sessions p WHERE p.id = sessions.parent_session_id)), display_name = COALESCE(sessions.display_name, (SELECT p.display_name FROM sessions p WHERE p.id = sessions.parent_session_id)), origin_json = COALESCE(sessions.origin_json, (SELECT p.origin_json FROM sessions p WHERE p.id = sessions.parent_session_id)) WHERE id = ? AND parent_session_id IS NOT NULL AND EXISTS ( SELECT 1 FROM sessions p WHERE p.id = sessions.parent_session_id AND p.end_reason = 'compression' ))r'rrr(rTr*)rsystem_prompt_hashrrrrrrrrrrrZrdrrrfrrs rF_doz*SessionDB._insert_session_row.._dos!%!:!:4!O!O  LL/`b0<FDJ|,,,$&% ! IKK#cD D D J"-88>>> ;   G M8 8 M;;; ; rLrN)r_TRANSCRIPT_WRITE_PATIENCE_S)rZrdrrrrfrrrrrrrrrrrrs````````````````` rF_insert_session_rowzSessionDB._insert_session_rowslD D D D D D D D D D D D D D D D D D D D D P CD,MNNNNNrLc $|j||fi||S)z4Create a new session record. Returns the session_id.r)rZrdrrs rFcreate_sessionzSessionDB.create_sessionjs%  V>>v>>>rL)rrrrrrrinclude_compression_ancestorsrc l rsdS f d} || dS)uPersist the gateway routing peer for an existing session row. ``display_name`` / ``origin_json`` carry the gateway's presentation and full origin metadata (#9006) so consumers (mcp_serve, mirror, channel directory) can read routing data from state.db instead of sessions.json. They are COALESCE'd only in the sense that ``None`` leaves the existing value untouched. ``include_compression_ancestors`` keeps a logical compression lineage on one routing peer when an explicit gateway resume moves its tip to a different lane. Normal per-turn metadata refreshes update only the supplied row. Self-healing (#82616): when the target row does not exist yet — the gateway's ``create_session`` write failed and was deferred, or a crash landed between routing publication and row creation — this recorder INSERTs the row with the full identity instead of silently no-opping. Every per-turn peer refresh is therefore a repair opportunity: a gateway session row can no longer be first-created by an identity-less lazy writer (``update_token_counts`` / ``record_auxiliary_usage``) and stay unroutable forever. Nc d}d}g}rd}d}| |   fs| ||d||s^|d f}|5|d    t jf dSdSdS)Nrpz WHERE id = ?a WITH RECURSIVE compression_lineage(id) AS ( SELECT ? UNION SELECT parent.id FROM compression_lineage lineage JOIN sessions child ON child.id = lineage.id JOIN sessions parent ON parent.id = child.parent_session_id WHERE parent.end_reason = 'compression' AND json_extract( COALESCE(child.model_config, '{}'), '$._branched_from' ) IS NULL AND json_extract( COALESCE(child.model_config, '{}'), '$._delegate_from' ) IS NULL AND COALESCE(child.source, '') != 'tool' ) z0WHERE id IN (SELECT id FROM compression_lineage)a9 UPDATE sessions SET session_key = ?, source = ?, user_id = ?, chat_id = ?, chat_type = ?, thread_id = ?, display_name = COALESCE(?, display_name), origin_json = COALESCE(?, origin_json) +SELECT 1 FROM sessions WHERE id = ? LIMIT 1aINSERT INTO sessions ( id, source, user_id, session_key, chat_id, chat_type, thread_id, display_name, origin_json, started_at ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET session_key = COALESCE(sessions.session_key, excluded.session_key), chat_id = COALESCE(sessions.chat_id, excluded.chat_id), chat_type = COALESCE(sessions.chat_type, excluded.chat_type), thread_id = COALESCE(sessions.thread_id, excluded.thread_id), display_name = COALESCE(sessions.display_name, excluded.display_name), origin_json = COALESCE(sessions.origin_json, excluded.origin_json))rextendrrQrT)r lineage_cte target_clause query_paramscurrrrrrrdrrrrs rFrz2SessionDB.record_gateway_session_peer.._dos^K*ML, 0 (!S ##J///        1 0##J/// LL && " &&   1 llAJ=<<>>)LL e'"#'#%%(' IKK    *)rLr) rZrdrrrrrrrrrrs `````````` rFrecord_gateway_session_peerz%SessionDB.record_gateway_session_peerosH   FW W W W W W W W W W W W W W r C     rLT finalizedcHsdSfd}||dS)zMark a gateway session's expiry-finalization flag in state.db. Mirrors ``SessionEntry.expiry_finalized`` (sessions.json) so the flag survives even if the JSON index is pruned or lost (#9006). Nc@|drdndfdS)Nz5UPDATE sessions SET expiry_finalized = ? WHERE id = ?rqrr))rr rds rFrz+SessionDB.set_expiry_finalized.._dos7 LLG&Q 3     rLr )rZrdr rs `` rFset_expiry_finalizedzSessionDB.set_expiry_finalizedsM   F       C     rLrp)rV entry_jsonrVcPrsdSfd}||dS)u Upsert one gateway routing entry (session_key -> SessionEntry JSON). The gateway_routing table is the durable replacement for sessions.json: one row per routing key, holding the full serialized ``SessionEntry`` so the gateway can rehydrate exactly what it wrote. ``scope`` namespaces the index the way separate sessions.json files did (one per sessions_dir) — callers pass their sessions_dir path so two stores with different directories never share routing state. Nc^|dtjfdS)Na!INSERT INTO gateway_routing (scope, session_key, entry_json, updated_at) VALUES (?, ?, ?, ?) ON CONFLICT(scope, session_key) DO UPDATE SET entry_json = excluded.entry_json, updated_at = excluded.updated_atrrT)rrrVrs rFrz1SessionDB.save_gateway_routing_entry.._dos< LL;  Z=      rLr )rZrrrVrs ``` rFsave_gateway_routing_entryz$SessionDB.save_gateway_routing_entrysZ *  F        C     rLentriescjtjfd}||dS)a7Atomically replace the routing index for *scope* with *entries*. Mirrors the sessions.json full-rewrite semantics: keys absent from *entries* are removed (pruned/reset sessions disappear from the index). Runs as a single write transaction. Other scopes are untouched. c|dfr7|dfdDdSdS)Nz+DELETE FROM gateway_routing WHERE scope = ?z\INSERT INTO gateway_routing (scope, session_key, entry_json, updated_at) VALUES (?, ?, ?, ?)c*g|]\}}|| ||fSrKrK)rrrr)rVs rFrzJSessionDB.replace_gateway_routing_entries.._do..2s0OOODAqqOQOeQ3'OOOrL)r executemanyitems)rrr)rVs rFrz6SessionDB.replace_gateway_routing_entries.._do,su LLF Q Q Q   *OOOOOGMMOOOOO  rLNrTr)rZrrVrr)s `` @rFreplace_gateway_routing_entriesz)SessionDB.replace_gateway_routing_entries sQikk        C     rLc|j5|jd|f}dddn #1swxYwYd|DS)z>Load routing entries for *scope* as {session_key: entry_json}.zCSELECT session_key, entry_json FROM gateway_routing WHERE scope = ?Nc,i|]}|d|dS)rrrKrrs rFrz:SessionDB.load_gateway_routing_entries..>s#@@@a- !L/@@@rL)rNr:rr)rZrVrs rFload_gateway_routing_entriesz&SessionDB.load_gateway_routing_entries7s Z  :%%Uhjj                 A@4@@@@/AA A session_keyscHsdSfd}||dS)z=Remove routing entries for the given session keys in *scope*.NcL|dfdDdS)N?DELETE FROM gateway_routing WHERE scope = ? AND session_key = ?cg|]}|fSrKrK)rrrVs rFrzISessionDB.delete_gateway_routing_entries.._do..Js222%222rLr)rrVr!s rFrz5SessionDB.delete_gateway_routing_entries.._doGs?   Q2222\222     rLr )rZr!rVrs `` rFdelete_gateway_routing_entriesz(SessionDB.delete_gateway_routing_entries@sM  F       C     rLolder_than_daysctjt|dzz }|j5|jd|f}dddn #1swxYwYd|DS)u<Keyed gateway rows that were opened and then never used at all. Selects rows that are keyed (``session_key IS NOT NULL``), still open (``ended_at IS NULL``) and carry no evidence of a single turn: no messages, no tokens, no tool or API calls, no recorded activity, no title. Such a row is indistinguishable from "never happened". That is exactly the shape of a leaked test fixture (#82770) — and also of a chat that was routed but never answered. Both are safe to drop: there is no transcript to lose, and the gateway mints a fresh session on the next inbound message either way. ``bulk prune``/``archive`` cannot reach these rows: their shared selector is pinned to ``ended_at IS NOT NULL`` so that a live session is never picked, which permanently excludes every never-closed row. Hence a separate, narrower selector rather than another filter flag. ``pinned`` and ``archived`` rows are excluded — both are explicit user intent to keep the row around. @a SELECT s.id, s.session_key, s.source, s.chat_id, s.chat_type, s.user_id, s.started_at FROM sessions s WHERE s.session_key IS NOT NULL AND s.ended_at IS NULL AND s.title IS NULL AND s.last_activity_at IS NULL AND COALESCE(s.message_count, 0) = 0 AND COALESCE(s.tool_call_count, 0) = 0 AND COALESCE(s.api_call_count, 0) = 0 AND COALESCE(s.input_tokens, 0) = 0 AND COALESCE(s.output_tokens, 0) = 0 AND COALESCE(s.pinned, 0) = 0 AND COALESCE(s.archived, 0) = 0 AND s.started_at IS NOT NULL AND s.started_at < ? AND NOT EXISTS ( SELECT 1 FROM messages m WHERE m.session_id = s.id ) ORDER BY s.started_at Nc,g|]}t|SrKr,rrs rFrz>SessionDB.list_never_active_keyed_sessions..s&&&AQ&&&rL)rTfloatrNr:rr)rZr(cutoffrs rF list_never_active_keyed_sessionsz*SessionDB.list_never_active_keyed_sessionsOs.o 6 6 @A Z  :%%, /0hjj1                4'&&&&&s/A))A-0A- session_idsc|sdS|j5|jd}dddn #1swxYwYg|D]} t j|dpd}n#t $rY,wxYwt|tr:| d|vr# |d|dfsdSfd }| |tS) u5Drop ``gateway_routing`` rows pointing at any of *session_ids*. Routing entries are keyed by ``(scope, session_key)`` and record their target session inside ``entry_json``, so there is no way to reach them by session id in SQL — the match is done in Python over all scopes. rz:SELECT scope, session_key, entry_json FROM gateway_routingNrz{}rdrVrc4|ddS)Nr$r&)rdoomeds rFrz;SessionDB._delete_routing_entries_for_sessions.._dos+   Q     rL) rNr:rrrrrBrr,r@rrr)rZr0rrentryrr3s @rF$_delete_routing_entries_for_sessionsz.SessionDB._delete_routing_entries_for_sessionss 1 Z  :%%Lhjj                )+ B BC  3|#4#<==    %&& B599\+B+Bk+Q+Q s7|S-?@AAA 1      C   6{{s#-AA  A A55 BB sessions_dirr7c||}|sdSd|D}||}d}|D]}|||r|dz }||fS)u}Delete never-active keyed rows and the routing entries naming them. Returns ``(sessions_deleted, routing_entries_deleted)``. The routing entries go first: a stale entry that outlived its target would leave the gateway resuming a session id that no longer exists. Deleting the pair is what leaving them both would have amounted to anyway — the target had no transcript to resume. Deletion goes through :meth:`delete_session` rather than a bulk ``DELETE`` so the delegate cascade, FTS bookkeeping and on-disk transcript cleanup stay owned by one implementation. )r()rrc8h|]}t|dSr)r_rs rFrz>SessionDB.prune_never_active_keyed_sessions..s"444#s3t9~~444rLrr6rq)r/r5delete_session)rZr(r7 candidatesrrouting_deleteddeletedrds rF!prune_never_active_keyed_sessionsz+SessionDB.prune_never_active_keyed_sessionss&::+;   644444CCCHH  J"":L"II 1 ))rL)r active_onlyrr?cZdtdd}g}|r|dz }|||r|dz }|dz }j5j||}dddn #1swxYwYfd|DS) uFList gateway sessions (rows with a session_key) from state.db. Returns the newest row per session_key — the same shape consumers got from sessions.json: one live mapping per routing key. ``platform`` filters on ``source``; ``active_only`` restricts to sessions that have not ended. z SELECT sessions.*, COALESCE(sp.prompt, sessions.system_prompt) AS _system_prompt_resolved, r>ag AS last_active FROM sessions LEFT JOIN system_prompts sp ON sp.hash = sessions.system_prompt_hash WHERE session_key IS NOT NULL AND started_at = ( SELECT MAX(s2.started_at) FROM sessions s2 WHERE s2.session_key = sessions.session_key ) z AND LOWER(source) = LOWER(?)z AND ended_at IS NULLz ORDER BY last_active DESCNc:g|]}|SrKr/rrsrZs rFrz3SessionDB.list_gateway_sessions..s'888a&&q))888rL)flush_token_countsr"rrNr:rr)rZrr?queryparamsrs` rFlist_gateway_sessionszSessionDB.list_gateway_sessionss/ !!!  -Z88      $ 4 4E MM( # # #  - , ,E -- Z @ @:%%eV44==??D @ @ @ @ @ @ @ @ @ @ @ @ @ @ @888848888s.BBB)rrcn|r|dvrdSd}|t|g}|'|dz }|t||dz }|j5d|j||D}dddn #1swxYwY|sdSrAfd|D}|rt|dd St |d krdSn4t |d kr!d |D} t | d krdSt|dd S) aFind the most recent live session_id for a platform + chat origin. Equivalent of gateway/mirror's sessions.json scan: matches on source + chat_id (+ thread_id when provided). When ``user_id`` is provided, exact sender matches are preferred; if multiple distinct users share the chat and none matches, returns None rather than contaminating another participant's session. )NrpNz SELECT id, user_id, started_at FROM sessions WHERE LOWER(source) = LOWER(?) AND session_key IS NOT NULL AND chat_id = ? AND ended_at IS NULL z AND COALESCE(thread_id, '') = ?z ORDER BY started_at DESCc,g|]}t|SrKr,rrs rFrz4SessionDB.find_session_by_origin.. sRRRDGGRRRrLc~g|]9}t|dpdtk7|:Srrp)r_r@)rrsrs rFrz4SessionDB.find_session_by_origin..sBTTT1AEE),<,<,B(C(Cs7||(S(SQ(S(S(SrLrrrqch|]n}t|dpd8t|dpdoSrK)r_r@rrrs rFrz3SessionDB.find_session_by_origin..sxquuY''-2..4466AEE)$$*++1133rL)r_rrNr:rrr) rZrrrrrErFrexactdistinct_userss ` rFfind_session_by_originz SessionDB.find_session_by_origins  7j004 !#g,,/  7 7E MM#i.. ) ) ) ,, Z S SRRTZ%7%7v%F%F%O%O%Q%QRRRD S S S S S S S S S S S S S S S 4  TTTTTTTE +58D>***4yy1}}t YY]]N >""Q&&t474=!!!s8BBB)rrrrrc |sdS|j5|jdtd||f}|!||cdddS|| ddddS|jdtd|||||f}dddn #1swxYwY|r||ndS)uVFind the latest recoverable gateway session for a routing peer. ``sessions.json`` is the fast routing index, but it can be missing or pruned after process-level restart bugs. New gateway sessions persist the deterministic ``session_key`` on the durable session row so the mapping can be rebuilt exactly. Rows ended only by older gateway cleanup's ``agent_close`` bug or a mistaken TUI ``ws_orphan_reap`` (dashboard viewer disconnect before #60609) are treated as recoverable; explicit conversation boundaries such as /new, /resume switches, and compression splits are not. Ordering and emptiness (#82616): candidates are ranked by actual conversation recency (``last_activity_at``, falling back to ``started_at``) — ``started_at`` alone resurrected days-old zombie rows over the live conversation. Rows with messages are preferred, but an empty keyed row is still returned rather than ``None``: returning ``None`` mints a brand-new session id, which is a worse outcome than resuming an empty-but-correctly-keyed row (and "empty" may just mean the transcript lives under a compression child). Reset boundaries fence recovery (#68539): an intentional boundary such as ``session_reset`` (or any explicit non-recoverable end_reason) must block fallback to an *older* row for the same peer. Without the fence, the has-messages ranking above could reach behind a /new reset and silently restore the exact context the user reset. Each candidate is therefore rejected when a boundary row for the peer ended *after* the candidate's last activity — if the conversation's most recent event is an intentional reset, recovery returns nothing rather than reaching behind it. Na SELECT s.*, COALESCE(sp.prompt, s.system_prompt) AS _system_prompt_resolved, (COALESCE(s.message_count, 0) > 0 OR EXISTS ( SELECT 1 FROM messages WHERE messages.session_id = s.id LIMIT 1 )) AS _has_messages FROM sessions s LEFT JOIN system_prompts sp ON sp.hash = s.system_prompt_hash WHERE s.session_key = ? AND s.source = ? AND (s.ended_at IS NULL OR s.end_reason IN ('agent_close', 'ws_orphan_reap')) AND NOT EXISTS ( SELECT 1 FROM sessions b WHERE b.session_key = s.session_key AND b.source = s.source AND b.ended_at IS NOT NULL AND b.end_reason IN (a$) AND b.ended_at > COALESCE(s.last_activity_at, s.started_at) ) ORDER BY _has_messages DESC, COALESCE(s.last_activity_at, s.started_at) DESC LIMIT 1 a! SELECT s.*, COALESCE(sp.prompt, s.system_prompt) AS _system_prompt_resolved, (COALESCE(s.message_count, 0) > 0 OR EXISTS ( SELECT 1 FROM messages WHERE messages.session_id = s.id LIMIT 1 )) AS _has_messages FROM sessions s LEFT JOIN system_prompts sp ON sp.hash = s.system_prompt_hash WHERE s.source = ? AND COALESCE(s.user_id, '') = COALESCE(?, '') AND COALESCE(s.chat_id, '') = COALESCE(?, '') AND COALESCE(s.chat_type, '') = COALESCE(?, '') AND COALESCE(s.thread_id, '') = COALESCE(?, '') AND (s.ended_at IS NULL OR s.end_reason IN ('agent_close', 'ws_orphan_reap')) AND (COALESCE(s.message_count, 0) > 0 OR EXISTS ( SELECT 1 FROM messages WHERE messages.session_id = s.id LIMIT 1 )) AND NOT EXISTS ( SELECT 1 FROM sessions b WHERE b.source = s.source AND COALESCE(b.user_id, '') = COALESCE(s.user_id, '') AND COALESCE(b.chat_id, '') = COALESCE(s.chat_id, '') AND COALESCE(b.chat_type, '') = COALESCE(s.chat_type, '') AND COALESCE(b.thread_id, '') = COALESCE(s.thread_id, '') AND b.ended_at IS NOT NULL AND b.end_reason IN (z) AND b.ended_at > COALESCE(s.last_activity_at, s.started_at) ) ORDER BY COALESCE(s.last_activity_at, s.started_at) DESC LIMIT 1 )rNr:rrrQr/)rZrrrrrrrs rF$find_latest_gateway_session_for_peerz.SessionDB.find_latest_gateway_session_for_peersP 4 ZH H *$$"/E#2f%56hjj7 8--c22=H H H H H H H H F)"3IH H H H H H H H J*$$ 4/E5   B'9i@E##FhjjG KH H H H H H H H H H H H H H H R/2;t%%c***t;sAC(C:;CCCg @) max_gap_srRc||jnt|}td}td}d}g|j5|jd|d}|D]N}d}d} d} |drFd } |jd |d |d|d f}|d } nd} |jd |d|d|d|d |d|d |d|d|dpd|z |dpd|z|df} | sd|dd} nt| dkrd} n| d} |d|d |d|d|d|r|dnd|r|dnd|r| nd|du| d P dddn #1swxYwYfd D} D]} | d!| vr d"| d#<d$| d%<S)&uReport message-bearing session rows that lost their routing identity. A row is a candidate orphan when it has messages but no ``session_key``. It is only *adoptable* when exactly one keyed predecessor can be named as the conversation it continues: * ``lineage`` — ``parent_session_id`` points at a keyed row of the same source. That is a recorded fact, so no time window applies. * ``contiguity`` — exactly one keyed row of the same source (and compatible ``user_id``) fell quiet within *max_gap_s* of the orphan's start, and is older than the orphan's own last activity. Anything ambiguous is reported with ``adoptable=False`` and a reason rather than guessed at: mis-adopting would splice one person's conversation into another person's chat. Branch/delegate/tool rows are excluded outright — they are unkeyed by design, not by damage. Nodzpd.id, d.session_key, d.chat_id, d.chat_type, d.thread_id, d.user_id, d.origin_json, d.display_name, d.end_reasonz SELECT o.id, o.source, o.user_id, o.started_at, o.parent_session_id, a AS last_active, (SELECT COUNT(*) FROM messages m WHERE m.session_id = o.id) AS message_count FROM sessions o WHERE o.session_key IS NULL AND EXISTS (SELECT 1 FROM messages m WHERE m.session_id = o.id) AND COALESCE(o.source, '') != 'tool' AND json_extract(COALESCE(o.model_config, '{}'), '$._branched_from') IS NULL AND json_extract(COALESCE(o.model_config, '{}'), '$._delegate_from') IS NULL ORDER BY o.started_at ASC rprlineagez SELECT z FROM sessions d WHERE d.id = ? AND d.session_key IS NOT NULL AND COALESCE(d.source, '') = COALESCE(?, '') rz9parent session carries no gateway identity of this source contiguity, a AS last_active FROM sessions d WHERE d.session_key IS NOT NULL AND d.id != ? AND COALESCE(d.source, '') = COALESCE(?, '') AND (COALESCE(d.user_id, '') = '' OR COALESCE(?, '') = '' OR d.user_id = ?) AND z/ BETWEEN ? AND ? AND zo < ? ORDER BY last_active DESC LIMIT 2 rr started_atr last_activez'no keyed predecessor fell quiet within rzs of this session's startrqz>ambiguous: more than one keyed predecessor matches this windowrUr) orphan_idrrUrYrZdonor_idrevidence adoptablerIcph|]1dr'tfdDdk)d2S)r^c3@K|]}|ddkdVdS)r\rqNrK)rr[rss rFr+zESessionDB.find_orphaned_gateway_sessions...,s5II!!J-1Z=*H*HA*H*H*H*HIIrLrqr\)sum)rrsrecordss @rFrz;SessionDB.find_orphaned_gateway_sessions..(sa   ~ IIIIwIIIIIAMM jMNMMrLr\Fr^z@ambiguous: more than one unkeyed session claims this predecessorrI) _ORPHAN_ADOPTION_MAX_GAP_Sr-r"rNr:rrrQrr)rZrRgap orphan_active donor_active donor_columnsorphansorphandonorr]rIr; contestedrecordrbs @rFfind_orphaned_gateway_sessionsz(SessionDB.find_orphaned_gateway_sessionss,   + +y!! 155 /44  E )+ Z` ` j((&$hjj% ("K K -.7.(H J.. - 34fX6FG  hjj}* ,H!%!3!3  -  1=   ,   ,   #4L"8,"9-"9-#L16Q#=#L16Q#="=1""0hjj12& .6cQ666Z1,,2 !+1 %+D\"("2)/)@&,\&:'-m'<38$BE$KKd?D'Nu]';';$05$=HH2%*$%6"(      }K +` ` ` ` ` ` ` ` ` ` ` ` ` ` ` H         Fj!Y..&+{#"x sFGGGr[r\cTrrkrdSfd}||S)a{Stamp *orphan_id* with *donor_id*'s routing identity, retire *donor_id*. Re-verifies the pair inside the write transaction, so a concurrent gateway that healed either row in the meantime turns this into a no-op instead of a conflicting write. Existing non-NULL columns on the orphan are preserved. Returns True when the adoption applied. Fc |df}|df}||dS|dr|drdS|dpd|dpdkrdS|d|d|d|d |d |d |d |d f |dtjfdS)NzxSELECT session_key, chat_id, chat_type, thread_id, user_id, origin_json, display_name, source FROM sessions WHERE id = ?z5SELECT session_key, source FROM sessions WHERE id = ?Frrrpa6UPDATE sessions SET session_key = ?, chat_id = COALESCE(chat_id, ?), chat_type = COALESCE(chat_type, ?), thread_id = COALESCE(thread_id, ?), user_id = COALESCE(user_id, ?), origin_json = COALESCE(origin_json, ?), display_name = COALESCE(display_name, ?), parent_session_id = COALESCE(parent_session_id, ?) WHERE id = ? AND session_key IS NULLrrrrrrzfUPDATE sessions SET ended_at = COALESCE(ended_at, ?), end_reason = 'superseded_by_repair' WHERE id = ?T)rrQrT)rrjrir\r[s rFrz5SessionDB.adopt_orphaned_gateway_session.._doDs>LLO hjj  \\G hjj }u' 6-+@ uh%26(+;+ArBBu LL <-()$+&+&)$-(.)    6 LLCh'    4rLr )rZr[r\rs `` rFadopt_orphaned_gateway_sessionz(SessionDB.adopt_orphaned_gateway_session7sY  I,A,A51 1 1 1 1 1 f""3'''rLz AND COALESCE(json_extract(COALESCE({alias}model_config, '{{}}'), '$._branched_from'), '') != ? AND COALESCE(json_extract(COALESCE({alias}model_config, '{{}}'), '$._delegate_from'), '') != ? AND COALESCE({alias}source, '') != 'tool' c|sdS|j5|jd|f}||d |ddkr ddddS|jd|jdzd z|||f}dddn #1swxYwYt|d kr||d ndS) aReturn the unique live direct child of a compression-ended session. A stale agent may observe that another compression path already rotated its parent. Recovery is safe only when the durable lineage identifies exactly one live direct continuation. Multiple children are treated as ambiguous and fail closed rather than guessing which transcript owns subsequent messages. N6SELECT ended_at, end_reason FROM sessions WHERE id = ?ended_at end_reasonrad SELECT s.*, COALESCE(sp.prompt, s.system_prompt) AS _system_prompt_resolved FROM sessions s LEFT JOIN system_prompts sp ON sp.hash = s.system_prompt_hash WHERE s.parent_session_id = ? AND s.ended_at IS NULL zs.aliaszS ORDER BY s.started_at ASC LIMIT 2 rqr) rNr:rrQ"_NON_CONTINUATION_CHILD_FILTER_SQLformatrrr/)rZrrrs rFfind_live_compression_childz%SessionDB.find_live_compression_childsy! 4 Z  Z''H"$hjj  *%-,'=88        :%%9@@t@LL M #$57HI hjj!                836d))q..t%%d1g...dJsAB:AB::B>B>c^sdSfd}t|S)aReopen a compression parent only when no continuation was published. Compression publication is atomic in current builds, but older builds could leave a closed parent behind after an interrupted handoff. This recovery is deliberately conservative: an active compression lease or any canonical child means the lineage is still owned by another path, so the caller must fail closed instead of reopening the parent. Fcx|d f}||d |ddkrdS|djdzd z f}|dSt j}|d f}|K|d }|t ||krdS|d |d |f}|jdkrdS|d f}|jdkS)NrrrsrtrFzt SELECT 1 FROM sessions WHERE parent_session_id = ? rpruz) LIMIT 1 ESELECT holder, expires_at FROM compression_locks WHERE session_id = ? expires_atzTDELETE FROM compression_locks WHERE session_id = ? AND holder = ? AND expires_at = ?rnrqz{UPDATE sessions SET ended_at = NULL, end_reason = NULL WHERE id = ? AND ended_at IS NOT NULL AND end_reason = 'compression')rrQrwrxrTr-rowcount) rrchildr)lock_rowr}r=updatedrZrds rFrz:SessionDB.reopen_orphaned_compression_session.._dos\\H hjj  *%-,'=88u LL 9@@r@JJ K  Z4  hjj  u)++C||' hjj  #%l3 %z):):c)A)A 5,,M(!3Z@ #q(( 5ll1 G#q( (rLrrrZrdrs`` rF#reopen_orphaned_compression_sessionz-SessionDB.reopen_orphaned_compression_sessionsV 5@ )@ )@ )@ )@ )@ )DD'',,---rL) rrrfrrcompression_lock_holderrequire_compression_lease watermarkwatermark_ceilingchild_session_idr1rrrrc p    fd}|dS)uAAtomically close a parent and publish its durable compression child. The parent closure, child row, and compacted handoff become visible in one transaction. Readers can therefore observe either the live parent or a complete child, never an ended parent with a missing/empty child. Concurrent-append safety (#75316): when *watermark* is provided (the parent's :meth:`get_active_message_watermark` captured at compression start), parent rows that arrived during the slow summary call (``id > watermark``) are cloned into the child AFTER the handoff — same pure-SQL column clone as :meth:`archive_and_compact`, with the session id rewritten — so a mid-compression append survives rotation instead of stranding in the closed parent. *watermark_ceiling* bounds the clone from above: the rotation path flushes its OWN un-persisted input transcript to the parent right before publishing (#47202), and those rows are already represented in the compacted handoff — cloning them would duplicate the transcript. The caller captures ``MAX(id)`` immediately BEFORE that flush; only rows in ``(watermark, watermark_ceiling]`` are foreign concurrent tail. ``None`` = unbounded (no internal flush happened). c|df}rL|8r6|dks*t|dtjkrt d|df}|t d|dt dst d |}|d rtjnd|p|d |d |d p|d|d|d|d|d|d|d|dtjf |\}}xd}tg}$d}| t|d|d| }|rd|D} d d| D} d|D} d | } |d| d | d!| d"g| |t| z }|D]y} | d#}|rm t!|t"rtj|n|}|t!|t&rt|nd$z }b#t(t*f$rYuwxYwz|d%||f|d&tjf}|jd'krt d(dS))Nr|rnr}z+Compression lease lost before publication: zSELECT ended_at, cwd, git_branch, git_repo_root, user_id, session_key, chat_id, chat_type, thread_id, display_name, origin_json, profile_name FROM sessions WHERE id = ?zCompression parent not found: rsz"Compression parent already ended: z+Compression child handoff must not be emptyaINSERT INTO sessions ( id, source, model, model_config, system_prompt, system_prompt_hash, parent_session_id, cwd, git_branch, git_repo_root, profile_name, user_id, session_key, chat_id, chat_type, thread_id, display_name, origin_json, started_at ) VALUES (?, ?, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)r git_branchrrrrrrrrrrpz AND id <= ?zRSELECT id, tool_calls FROM messages WHERE session_id = ? AND active = 1 AND id > ? ORDER BY idc8g|]}t|dSr)rArrs rFrzDSessionDB.publish_compression_child.._do..s"@@@AdG @@@rLrc3K|]}dVdSrrKrs rFr+zCSessionDB.publish_compression_child.._do..s"+B+BAC+B+B+B+B+B+BrLcg|]}|dv| S))rrdactive compactedrKrcs rFrzDSessionDB.publish_compression_child.._do..s."""$OOOOOOrLrXINSERT INTO messages (z(, session_id, active, compacted) SELECT z%, ?, 1, 0 FROM messages WHERE id IN ( ) ORDER BY idr8rGUPDATE sessions SET message_count = ?, tool_call_count = ? WHERE id = ?z^UPDATE sessions SET ended_at = ?, end_reason = 'compression' WHERE id = ? AND ended_at IS NULLrqz/Compression parent changed during publication: )rrQr-rTrrr'rr(_insert_message_rowsrArrr_message_column_namesrrr_rrrvrwr~)rrrrtotal_messagestotal_tool_calls_ceiling_clause_params tail_rowstail_ids placeholders clone_colscol_listrsrzparsedrrrrr1rrrrrrZrrfrrs rFrz0SessionDB.publish_compression_child.._do-s||W"$hjj )  .!H%)@@@,/00DIKK??1UBSUU\\1#$  hjj ~"#WDU#W#WXXXj!-"#[HY#[#[\\\ R"#PQQQ!%!:!:4!O!O  LLY%0<FDJ|,,,$&%(6%=<(?+ !:F>$:9%=)9%;';'>*=)IKK/! ! ! D04/H/H&00 ,N,$ #%!2C NN C$0&4ONN3'8#9#9::: LL5&555  (**  %@@i@@@H#&88+B+B+B+B+B#B#BL""#'#=#=d#C#C"""J $yy44HLLDDD"*DD(4DDD*5H5  #c(mm3N&%% o%%._dos8 LL4j*5     rLNr )rZrdrtrs `` rF end_sessionzSessionDB.end_sessions>       C     rLc<fd}||dS)zClear ended_at/end_reason so a session can be resumed. Before clearing a reset boundary, stabilize markerless legacy reset children that still depend on the parent's mutable end_reason. cddtD}|dtd|gtR|dfdS)Nrc3K|]}dVdSrrKrs rFr+z8SessionDB.reopen_session.._do..s"#D#DAC#D#D#D#D#D#DrLaUPDATE sessions AS child SET model_config = json_set(COALESCE(child.model_config, '{}'), '$._reset_from', child.parent_session_id) WHERE child.parent_session_id = ? AND json_extract(COALESCE(child.model_config, '{}'), '$._reset_from') IS NULL AND rzCUPDATE sessions SET ended_at = NULL, end_reason = NULL WHERE id = ?)rrrr )rrrds rFrz%SessionDB.reopen_session.._dos88#D#D1C#D#D#DDDL LLH /w EE HH1011    LLU      rLNr rs ` rFreopen_sessionzSessionDB.reopen_sessions8      & C     rL session_resetrIcsdStjfd} ||}t|S#t$rYdSwxYw)uDurably mark a session as ended by an intentional reset boundary. Promotes *only* live rows (``ended_at IS NULL``) or rows carrying an accidental end_reason that the recovery query (``find_latest_gateway_session_for_peer``) treats as recoverable: ``agent_close`` (older gateway cleanup bug) and ``ws_orphan_reap`` (mistaken TUI reaper). Explicit conversation boundaries such as ``compression``, ``session_reset``, ``session_switch``, etc. are preserved — the first writer wins for those, and a later expiry finalization must not silently overwrite them. Plain ``end_session()`` is NOT sufficient for reset boundaries: it no-ops on an already-ended row, so a row that agent cleanup already closed as ``agent_close`` would stay recoverable and stale-route recovery would resurrect the reset session with its full history (#61220, #61993, #63539). Keep this promotion set in sync with the recoverable set in ``find_latest_gateway_session_for_peer`` — any reason recovery would reopen must be promotable here. ``reason`` lets reset paths keep their auditable specific reasons (``idle``, ``daily``, ``suspended``, ``resume_pending_expired``). Returns ``True`` when the row was promoted, ``False`` when skipped (already has a different explicit end_reason, or row not found). FcD|df}|jS)NzUPDATE sessions SET ended_at = ?, end_reason = ? WHERE id = ? AND (ended_at IS NULL OR end_reason IN ('agent_close', 'ws_orphan_reap'))rr~)rrr)rIrds rFrz/SessionDB.promote_to_session_reset.._dos2\\Ffj) F ? "rL)rTrrrB)rZrdrIrrr)s `` @rFpromote_to_session_resetz"SessionDB.promote_to_session_resets< 5ikk # # # # # # # &&s++D::    55 s#A AArreplace_git_metacrsdS|pd|pdfd}||S)uPersist the authoritative cwd and claim a Git metadata generation. ``git_branch`` records the git branch checked out in ``cwd`` at the time the session started/resumed. The sidebar groups main-checkout sessions by this so feature-branch work doesn't pile under a single "main" row (the main checkout's *current* branch is transient and would misattribute past sessions). ``git_repo_root`` records the git repo this cwd belongs to — the authoritative project key. Resolving it here, at the lowest level, means every surface reads the same membership instead of re-probing git in the GUI over a partial page. Each field is only written when non-empty so a probe failure never clobbers a previously-captured value. ``replace_git_meta`` inverts that non-empty rule: a deliberate workspace MOVE (re-homing a session into another project) must overwrite the old repo identity even when the new cwd resolves to none — keeping the stale root would leave the session grouped under the project it just left. Every call increments ``git_metadata_generation`` in the same write transaction. Async Git probes must publish through :meth:`publish_session_git_metadata` with the returned generation, so an older worker cannot overwrite a newer cwd claim even after an A -> B -> A transition or from another process sharing this database. Metadata from a different cwd is cleared atomically with the move. NrpcB|d f}|dSt|tjr|dn|d}ddg}g}|ks r1|d|pd pdfn,r*|d| r2|kr, s*|d| | |d d |d ||d f}|dSt|tjr|d n|d}t|S)Nz%SELECT cwd FROM sessions WHERE id = ?rrzcwd = ?zBgit_metadata_generation = COALESCE(git_metadata_generation, 0) + 1)git_branch = ?git_repo_root = ?rrUPDATE sessions SET rXz WHERE id = ?z9SELECT git_metadata_generation FROM sessions WHERE id = ?git_metadata_generation) rrQrrRr;rrrrA) rr current_cwdsetsrFrrDbranchrr repo_rootrds rFrz)SessionDB.update_session_cwd.._do,sll7*hjj t,6w ,L,L\'%..RYZ[R\KTD"%Fc!!%5! CDDD v~y/@DABBBB & ,--- f%%% )[C//8H/ /000 i((( MM* % % % LLEtyyEEEv   ,,K hjj {t6@gk6R6R^C122X[\]X^Eu:: rL)rr) rZrdrrrrrrrs `` ` @@rFupdate_session_cwdzSessionDB.update_session_cwdsD  4"))++"(b//11 ! ! ! ! ! ! ! ! ! F""3'''rL generationc |r2|r0t|tst|tr|dkrdS|pd}|pd}|s|sdSg g |r* d ||r* d | |||f fd}t||S)zAPublish async Git enrichment only while its cwd claim is current.rqFrprrct|ddd}|jdkS)NrrXz9 WHERE id = ? AND cwd = ? AND git_metadata_generation = ?rq)rrr~)rrrFrs rFrz3SessionDB.publish_session_git_metadata.._dorsJ\\2tyy222 F ?a' 'rL)rrrArrrr) rZrdrrrrrrrrFrs @@rFpublish_session_git_metadataz&SessionDB.publish_session_git_metadataQsG  *d++ j#..   A~~5"))++"(b//11  i 5  " KK( ) ) ) MM& ! ! !  % KK+ , , , MM) $ $ $ z3 3444 ( ( ( ( ( (D'',,---rL cwd_to_rootcd|DsdSfd}||dS)a$Persist resolved git repo roots for cwds that don't have one yet. Backfills history so projects light up for sessions created before the column existed, without clobbering an already-recorded root. Only non-empty roots are written (a non-git cwd stays NULL). c$g|] \}}|| ||fSrKrK)rrrs rFrz1SessionDB.backfill_repo_roots..s*RRRdTRcR$RRRrLNcHD]\}}|d||fdS)NzXUPDATE sessions SET git_repo_root = ? WHERE cwd = ? AND COALESCE(git_repo_root, '') = ''r))rrrpairss rFrz*SessionDB.backfill_repo_roots.._dosH"   c I3K  rL)rr)rZrrrs @rFbackfill_repo_rootszSessionDB.backfill_repo_roots}sgSRk.?.?.A.ARRR  F      C     rLcooldown_untilrcsdSfd} ||dS#tj$r'}td|Yd}~dSd}~wwxYw)z>Persist the active compression-failure cooldown for a session.Nc:|dfdS)NfUPDATE sessions SET compression_failure_cooldown_until = ?, compression_failure_error = ? WHERE id = ?r))rrrrds rFrz:SessionDB.record_compression_failure_cooldown.._dos2 LL= 3     rLz2record_compression_failure_cooldown(%s) failed: %srrRrrr=r)rZrdrrrr\s ``` rF#record_compression_failure_cooldownz-SessionDB.record_compression_failure_cooldowns  F            $ $ $ $ $}    NNDC          s'AAAc|sdStj}|j5|jd|f}dddn #1swxYwY|dSt |t jr|dn|d}|dSt|}||krdSt |t jr|dn|d}|||z |dS)zBReturn the active compression-failure cooldown for ``session_id``.N_SELECT compression_failure_cooldown_until, compression_failure_error FROM sessions WHERE id = ?"compression_failure_cooldown_untilrcompression_failure_errorrq)rremaining_secondsr) rTrNr:rrQrrRr;r-)rZrdr)rrrs rF get_compression_failure_cooldownz*SessionDB.get_compression_failure_cooldownsW  4ikk Z  *$$- hjj                 ;4#w{++ C4 5 5Q   !4~.. S 4#w{++ C+ , ,Q  -!/#!5   s/AA!Ac|sddddS|j5|jd|f}dddn #1swxYwY|ddddSt |t jr|dn|d}t |t jr|dn|d}d |t|nd|dS) aGReturn the exact stored cooldown columns without expiry filtering. Compression cancellation uses this under its session lease so rollback can preserve an expired row, a partially-null row, or an absent session exactly instead of converting those states through the active-cooldown API. FNsession_existsrrrrrrrqT)rNr:rrQrrRr;r-)rZrdrrrs rF$get_compression_failure_cooldown_rowz.SessionDB.get_compression_failure_cooldown_rowsF T&+tdSS S Z  *$$- hjj                 ;&+tdSS S#w{++ C4 5 5Q #w{++ C+ , ,Q  #)7)Cn%%%    s/A  AAsnapshotct|dd}|s<|}|ddrtddS|d|dfd}|||}dt ndd }||krtd |d |dS) a(Restore and verify an exact cooldown-row snapshot. Unlike the ordinary record/clear helpers, this transactional rollback API deliberately propagates write and verification failures. A caller must not report cancellation as mutation-free when compensation failed. rFzBcannot restore absent compression cooldown row: session now existsNrrct|df}|jdkrtddS)Nrrqz/compression cooldown rollback session missing: )rr~r)rrrrrds rFrz?SessionDB.restore_compression_failure_cooldown_row.._dosY\\=5*-F !##"RjRR$#rLTrz>zJJFzz*E22 "X F<< 011 W%%        C   :::FF"191EeHooo4   X  <$<<17<<   rLcsdSfd} ||dS#tj$r'}td|Yd}~dSd}~wwxYw)z?Clear any persisted compression-failure cooldown for a session.Nc6|dfdS)NzlUPDATE sessions SET compression_failure_cooldown_until = NULL, compression_failure_error = NULL WHERE id = ?r)rrds rFrz9SessionDB.clear_compression_failure_cooldown.._do+s. LL@      rLz1clear_compression_failure_cooldown(%s) failed: %sr)rZrdrr\s ` rF"clear_compression_failure_cooldownz,SessionDB.clear_compression_failure_cooldown&s  F          $ $ $ $ $}    NNCC          s#AAAc|sdS|j5|j}| ddddS|d|f}dddn #1swxYwY|dSt |t jr|dn|d} tdt|pdS#ttf$rYdSwxYw)z3Return the persisted deterministic-fallback streak.rNz=SELECT compression_fallback_streak FROM sessions WHERE id = ?compression_fallback_streak rNr:rrQrrRr;rrArvrwrZrdrrrDs rFget_compression_fallback_streakz)SessionDB.get_compression_fallback_streak:sM 1 Z  :D|        ,,O hjj                  ;1#w{++ C- . .Q   q#ejq//** *:&   11 ( A)AA AB22CCstreakcsdStdt|fd}||dS)z:Persist the deterministic-fallback streak for one session.Nrc8|dfdS)Nz@UPDATE sessions SET compression_fallback_streak = ? WHERE id = ?r)r normalizedrds rFrz6SessionDB.set_compression_fallback_streak.._doXs. LLRZ(     rLrrAr)rZrdrrrs ` @rFset_compression_fallback_streakz)SessionDB.set_compression_fallback_streakRs`  FCKK((        C     rLcXsdSgfd}||dS)zEAtomically increment the session-hygiene failure streak for one chat.rqc|df|df}t|ddS)NzINSERT INTO gateway_hygiene_state (session_key, failure_streak) VALUES (?, 1) ON CONFLICT(session_key) DO UPDATE SET failure_streak = gateway_hygiene_state.failure_streak + 1zFSELECT failure_streak FROM gateway_hygiene_state WHERE session_key = ?r)rrQrrA)rrrrs rFrz7SessionDB.increment_hygiene_failure_streak.._dofsu LLT    ,,Xhjj  MM#c!f++ & & & & &rLrr )rZrrrs ` @rF increment_hygiene_failure_streakz*SessionDB.increment_hygiene_failure_streak`sT 1 ' ' ' ' ' ' C   ayrLcDsdSfd}||dS)z@Clear the persisted session-hygiene failure streak for one chat.Nc6|dfdS)Nz7DELETE FROM gateway_hygiene_state WHERE session_key = ?r))rrs rFrz3SessionDB.reset_hygiene_failure_streak.._do|s+ LLI     rLr )rZrrs ` rFreset_hygiene_failure_streakz&SessionDB.reset_hygiene_failure_streakwsE  F      C     rLc|sdS|j5|j}| ddddS|d|f}dddn #1swxYwY|dSt |t jr|dn|d} tdt|pdS#ttf$rYdSwxYw)aReturn the persisted ineffective-compaction strike count. Mirrors ``get_compression_fallback_streak``: this is the durable half of the anti-thrash guard (``_ineffective_compression_count`` on the built-in compressor), persisted so that a fresh compressor bound to a resumed session inherits an armed/tripped guard instead of starting from zero across process restarts (#54923). rNz?SELECT compression_ineffective_count FROM sessions WHERE id = ?compression_ineffective_countrrs rF!get_compression_ineffective_countz+SessionDB.get_compression_ineffective_countsO 1 Z  :D|        ,,Q hjj                  ;1#w{++ C/ 0 0Q   q#ejq//** *:&   11 rcountcsdStdt|fd}||dS)z@Persist the ineffective-compaction strike count for one session.Nrc8|dfdS)NzBUPDATE sessions SET compression_ineffective_count = ? WHERE id = ?r)rs rFrz8SessionDB.set_compression_ineffective_count.._dos. LLTZ(     rLr)rZrdrrrs ` @rF!set_compression_ineffective_countz+SessionDB.set_compression_ineffective_counts`  FCJJ''        C     rLr@rn ttl_secondsc rsdStj}||zfd} t||S#tj$r'}t d|Yd}~dSd}~wwxYw)uExtend the compression lock lease if ``holder`` still owns it. Ownership is decided by the ``holder`` column alone, deliberately NOT by ``expires_at``: a live owner whose refresher thread was starved (GC pause, loaded CI runner, a slow write escaping ``_execute_write``'s retry budget) past its own TTL must be able to revive its still-unclaimed row on the next tick. Requiring ``expires_at >= now`` here made such a stall permanent — every later refresh matched 0 rows, so the owner kept compressing and rotating with no lease at all, which is exactly the unprotected window a competing path can fork the session lineage in. This does not resurrect a lock somebody else already took: SQLite serialises writes, so a reclaim (DELETE-expired + INSERT-or-IGNORE in :meth:`try_acquire_compression_lock`) and this UPDATE never interleave. Reclaim-first replaces ``holder``, so this UPDATE matches nothing and returns False; refresh-first pushes ``expires_at`` into the future, so the reclaimer's DELETE-expired matches nothing and its acquire fails. FcL|df}|jdkS)NzOUPDATE compression_locks SET expires_at = ? WHERE session_id = ? AND holder = ?rr)rr r}rnrds rFrz/SessionDB.refresh_compression_lock.._dos4,,6Z0C ._doso# ,,' hjj  %/W[%A%AMCMMs1v*4C)E)EQC %%3q6#',,?OO-LL>#^4 (6$ LL&VS*5     ,,K hjj $!+C!=!=IH 3q6,H-- -rLz;Reclaimed stale compression lock for session=%s (holder=%s)z+try_acquire_compression_lock(%s) failed: %sN)rTrr=rrrRrr) rZrdrnrrrrr\r}r)s `` @@rFtry_acquire_compression_lockz&SessionDB.try_acquire_compression_locks. 5ikk;& ' .' .' .' .' .' .' .' .R )-)<)> !}    NN=C    55555 sAA//B%>B  B%csdSfd} ||dS#tj$r'}td|Yd}~dSd}~wwxYw)aKRelease the compression lock for ``session_id`` iff we own it. Idempotent: no-op when the lock has already expired and been reclaimed by a different holder, or when no lock exists. The ``holder`` check prevents a late-returning compressor from clobbering a fresh lock held by someone else. Nc8|dfdS)Nrr))rrnrds rFrz/SessionDB.release_compression_lock.._doWs0 LL6V$     rLz'release_compression_lock(%s) failed: %sr)rZrdrnrr\s `` rFrelease_compression_lockz"SessionDB.release_compression_lockLs  F           $ $ $ $ $}    NN9C          s%AAAcx|s|Sdtffd }||}|h}|rq|d}|r||vs||rn@||}|r|ddkrn|||}|q|r$t|dp|n|S)a Walk compression parents on ``conn`` to the conversation lease key. Must run on the same connection as the lease INSERT/UPDATE/DELETE. A prior ``get_session`` failure must not compute a child id that the later write then persists: refresh would walk to the parent and fail-close. Markers bind to ``parent_session_id`` (same contract as ``_NON_CONTINUATION_CHILD_FILTER_SQL``). Lock errors propagate so ``_execute_write`` / ``acquire_session_turn_lease`` can retry. rc|d|f}|rt|ndS)NzYSELECT id, parent_session_id, source, model_config, end_reason FROM sessions WHERE id = ?)rrQr,)rrrs rF_rowz7SessionDB._session_turn_lease_key_on_conn.._rowssE,,-hjj  !$-4999 -rLrrtrr)r_r@_is_explicit_fork_child_rowr)rZrrdr rseen parent_idrs ` rF_session_turn_lease_key_on_connz)SessionDB._session_turn_lease_key_on_connfs   .c . . . . . .$z""|  $788I $$33G<<%T)__F VZZ 55FF HHY   G 8?Ns7;;t$$2 333JNrLc|s|S|5}|||cdddS#1swxYwYdS)alReturn the stable serialization key for every compression segment. Acquire/refresh/release resolve this inside their write transaction. This helper is for tests and diagnostics; it does not swallow lock errors (a swallowed walk plus a later successful write was the fail-open that replayed the post-rotation refresh miss). N)rr)rZrdrs rF_session_turn_lease_keyz!SessionDB._session_turn_lease_keys   ^^   J77jII J J J J J J J J J J J J J J J J J Js<AArrcrsdStjtdt|zfd}t||S)aAtomically acquire the cross-process turn lease for a conversation. Compression rotates a session into child segments, so the durable key is the lineage root rather than the current segment id. The walk and INSERT share one write transaction. Expired leases and leases whose structured local holder PID is known dead are reclaimed in that same transaction. Frc| }|d|f}|H|d}t|dkst |r|d||f|d|f|d|f}|duo |dkS)NLSELECT holder, expires_at FROM session_turn_leases WHERE conversation_id = ?rnr}HDELETE FROM session_turn_leases WHERE conversation_id = ? AND holder = ?zpINSERT OR IGNORE INTO session_turn_leases (conversation_id, holder, acquired_at, expires_at) VALUES (?, ?, ?, ?)z@SELECT holder FROM session_turn_leases WHERE conversation_id = ?)rrrQr-r) rconversation_idrrownerr}rnr)rZrds rFrz5SessionDB.try_acquire_session_turn_lease.._dos"BB4TTO,,, "hjj  !$X#l+,,33?OO4LLC(.9 LL&!&#z:     LLR "hjj $BxF)B BrLrrTrr-rr)rZrdrnrrrr}r)s``` @@rFtry_acquire_session_turn_leasez(SessionDB.try_acquire_session_turn_leases   5ikk3sE+$6$6777  C C C C C C C C C<D'' 'CCDDDrLg @g.@)r wait_secondspoll_interval_secondson_waitwait_notice_interval_seconds should_abortacquire_patience_srrrr!c >tjtdt|z} d} d} tdt|} |: |rdSn,#t$rt ddYnwxYw ||||| rdSn0#tj $r}t|dkrYd}~nd}~wwxYwtj}| |z }|d krdS| |} |]| | dks || z | krL |td|| z n,#t$rt d dYnwxYw|} tj ttd t||K) a0Wait for a cross-process turn lease without holding a SQLite lock. ``on_wait(elapsed_seconds)`` is best-effort: invoked when the first attempt fails (elapsed ~0) and again about every ``wait_notice_interval_seconds`` while still waiting, so UIs can show that another process holds the conversation. When ``should_abort()`` returns True (for example the agent received ``/stop`` while waiting), acquisition stops immediately and returns False without consuming the full ``wait_seconds`` budget. r5NTFz/session turn lease should_abort callback failedrrrrz*session turn lease on_wait callback failedg{Gz?) rTrrr-rBr=rYrrRrrrrUrE)rZrdrnrrrrrr r!r wait_startedlast_notice_at notice_everyr\r) remainings rFacquire_session_turn_leasez$SessionDB.acquire_session_turn_leases?0>##c#u\/B/B&C&CC 3&B C CDD + P'#|~~%$u% LLI!%! 66 +1 7  4  =   .c22h>>?>>>>   .""C 3IA~~u#" "&3&&.(\99GCS<%7889999 LLD!%! "% Js3tU+@%A%ABBINN O O OW+ Ps< A$$&B  B B--C<CCD22&EE)rcrsdStjtdt|zfd}t|S)z8Extend a turn lease only while ``holder`` still owns it.Frcx|}|d|f}|jdkS)NVUPDATE session_turn_leases SET expires_at = ? WHERE conversation_id = ? AND holder = ?r)rrr~)rrrr}rnrZrds rFrz1SessionDB.refresh_session_turn_lease.._do#sI"BB4TTO\\;_f5F ?Q& &rLr)rZrdrnrrr}s``` @rFrefresh_session_turn_leasez$SessionDB.refresh_session_turn_leases  5Y[[3sE+,>,>#?#??  ' ' ' ' ' ' ' 'D'',,---rLcPrsdSfd}|dS)z>Release a turn lease iff ``holder`` still owns it; idempotent.Ncd|}|d|fdS)Nr)rr)rrrnrZrds rFrz1SessionDB.release_session_turn_lease.._do3sE"BB4TTO LL; &)     rLr )rZrdrnrs``` rFrelease_session_turn_leasez$SessionDB.release_session_turn_lease.sX   F        C     rLc|sdStj}|jd||f}|dSt |t jr|dn|dS)uReturn the current (non-expired) holder for ``session_id``, or None. Diagnostic helper — not used by the locking protocol itself. NzMSELECT holder FROM compression_locks WHERE session_id = ? AND expires_at >= ?rnr)rTr:rrQrrRr;)rZrdr)rs rFget_compression_lock_holderz%SessionDB.get_compression_lock_holder=s}  4ikkj   7     (** ;4 *3 < <Hs8}}#a&HrL) description provenancerr1r2c sdSddlm}m}t||nt j ||||j   fd}|||jdS)a-Stamp durable mid-turn session activity (observation-only). Called (rate-limited) from ``AIAgent._touch_activity`` so gateway/CLI surfaces and stall consumers observe API/tool/compaction activity even when no new message row has been written yet (#72016 / #72039). Never moves ``last_activity_at`` backwards. When the timestamp advances, bounded ``last_activity_description`` / ``last_activity_provenance`` are written with it. No-ops when ``session_id`` is empty or the row does not exist. Nr)bound_activity_descriptionnormalize_activity_provenancec>|dfdS)NzUPDATE sessions SET last_activity_at = ?, last_activity_description = ?, last_activity_provenance = ? WHERE id = ? AND (last_activity_at IS NULL OR last_activity_at < ?)r))rdescprovrdwhens rFrz-SessionDB.touch_session_activity.._dols9 LLV tT:t4      rLr)agent.session_activityr4r5r-rTrDr_ACTIVITY_WRITE_PATIENCE_S) rZrdrr1r2r4r5rr7r8r9s ` @@@rFtouch_session_activityz SessionDB.touch_session_activityNs&  F        2>RRty{{;;))+66,,Z88>         CD,KLLLLLrLcsdSddlm |jdf}n#t j$rd}YnwxYw|jt|t js|dn|d}t|t js|dn|d}|s|r|j j krdSfd}| ||j dS) aClear mid-turn activity labels after a turn ends. Keeps ``last_activity_at`` intact so idle / watchdog clocks stay continuous. Description and provenance are observation labels for *what was happening at* that timestamp during an active turn; once the turn is idle they must not keep advertising "compressing" / "executing tool" (#72039). Response-critical-path contract (#76354 review S1): runs in the turn's ``finally``; a no-op clear (labels already empty) skips the write transaction entirely, and a real clear uses the same short sub-second busy budget as :meth:`touch_session_activity` instead of the full routine write patience. NrrzUSELECT last_activity_description, last_activity_provenance FROM sessions WHERE id = ?last_activity_descriptionrqlast_activity_provenancecN|ddjjfdS)Nz\UPDATE sessions SET last_activity_description = ?, last_activity_provenance = ? WHERE id = ?rp)rUNKNOWNrD)rrrds rFrz4SessionDB.clear_session_activity_labels.._dos; LL'/5zB      rLr) r:rr:rrQrRrrrr;rArDrr;)rZrdrr7r8rrs ` @rFclear_session_activity_labelsz'SessionDB.clear_session_activity_labels}s9  F====== *$$- hjj C }   CCC  ?!+C!=!=c3q663GbCcD!+C!=!=b3q663GaCbD   $6$>$DDD       CD,KLLLLLs.=AAc|sdS||}|sdSddlm}||d|d|dS)z?Return the durable activity snapshot for *session_id*, or None.Nr)build_activity_snapshotlast_activity_atr>r?)rEr>r?) get_sessionr:rDr@)rZrdrrDs rFget_session_activityzSessionDB.get_session_activitys 4z** 4BBBBBB&& WW%788&)gg.I&J&J%(WW-G%H%H    rLmodel_config_jsoncl|fd}||dS)aUpdate model_config and optionally model for an existing session. Uses COALESCE so that passing model=None leaves the stored model column unchanged. Routes through _execute_write for the standard BEGIN IMMEDIATE + jitter-retry + lock guarantee. c:|dfdS)NzMUPDATE sessions SET model_config = ?, model = COALESCE(?, model) WHERE id = ?r))rrrHrds rFrz*SessionDB.update_session_meta.._dos0 LL_"E:6     rLNrDr)rZrdrHrrs ``` rFupdate_session_metazSessionDB.update_session_metasX !!!        C     rLcDfd}|dS)z0Store the full assembled system prompt snapshot.c|}|d|f|dS)NzMUPDATE sessions SET system_prompt_hash = ?, system_prompt = NULL WHERE id = ?)r'rr*)rrrZrdrfs rFrz+SessionDB.update_system_prompt.._dosY!%!:!:4!O!O  LLP#Z0     4 4T : : : : :rLNr )rZrdrfrs``` rFupdate_system_promptzSessionDB.update_system_promptsD ; ; ; ; ; ; ; C     rLprovidercpfd}|dS)aUpdate the model for a session after a mid-session switch. Unlike ``update_token_counts`` which uses ``COALESCE(model, ?)`` (only filling in NULL), this unconditionally sets the model column so that the dashboard reflects the user's latest /model choice. Also nulls ``system_prompt`` so stale ``Model:`` / ``Provider:`` footer metadata is rebuilt on the next turn. A successful /model switch explicitly replaces any confirmed Browser runtime lock while preserving unrelated lineage markers in ``model_config``. When *provider* is given, it is merged into ``model_config`` alongside the model (``$.model`` / ``$.provider``) so a later resume recombines the persisted model with the provider that actually serves it instead of the config.yaml primary provider (#79536). Callers without provider knowledge leave any stored provider untouched. cddi}r|d<r|d<||}|turdS|d|f|dS)Nbrowser_model_lockrrPzmUPDATE sessions SET model = ?, model_config = ?, system_prompt = NULL, system_prompt_hash = NULL WHERE id = ?_merge_model_config_json_MODEL_CONFIG_ROW_MISSINGrr*)rpatchmergedrrPrZrds rFrz+SessionDB.update_session_model.._dos &:4$@E '!&g -$,j!224UKKF222 LL +      4 4T : : : : :rLNrK)rZrdrrPrs```` rFupdate_session_modelzSessionDB.update_session_models^4 !!! ; ; ; ; ; ; ; ;* C     rLskip on_missingrWr\c|d|f}||dkrtd|tSt |t jr|dn|d}i}t |tr_|rK tj |}t |tr|}nB#tj tf$ri}Yn(wxYwt |trt|}|D]#\} } | || d| || <$|rtj|ndS)u=SELECT + tolerant-parse + merge ``patch`` into a session's model_config. Shared by every model_config writer (``update_session_runtime_lock``, ``set_session_yolo``, ``archive_and_compact``, ``patch_session_model_config``) so the merge discipline that keeps lineage markers like ``_branched_from`` / ``_delegate_from`` alive lives in exactly one place. A ``None`` patch value deletes that key. Must run inside an open write transaction (callers own the UPDATE). Returns the serialized merged JSON — ``None`` when the merged dict is empty (matching ``create_session``'s NULL convention) — or the ``_MODEL_CONFIG_ROW_MISSING`` sentinel when the row doesn't exist and ``on_missing == "skip"``; ``on_missing == "raise"`` raises ValueError. .SELECT model_config FROM sessions WHERE id = ?NraisezSession not found: rr)rrQrwrVrrRr;r_rrrr,JSONDecodeErrorrvrr-r() rZrrdrWr\rrzryrr8rDs rFrUz"SessionDB._merge_model_config_jsonsu,ll < M   (**  ;W$$ !Cz!C!CDDD, ,%/W[%A%AMc.!!s1v!# c3   CIIKK  Cfd++$#F()4     T " " #YYF++-- $ $JC} 3%%%%#s %+5tz&!!!5s!+C C('C(cPrsdSfd}|dS)aMerge ``patch`` into a session's model_config JSON atomically. A ``None`` patch value removes that key. No-op when the session row doesn't exist or the patch is empty. This is the standalone setter for callers that need to update model_config *without* rewriting the transcript (the transcript-coupled path is ``archive_and_compact``'s ``model_config_patch``, which shares the same merge helper). Nc||}|turdS|d|fdS)N1UPDATE sessions SET model_config = ? WHERE id = ?)rUrVr)rrXrWrZrds rFrz1SessionDB.patch_session_model_config.._doQsV224UKKF222 LLC$     rLr )rZrdrWrs``` rFpatch_session_model_configz$SessionDB.patch_session_model_configCsZ   F        C     rLr8rc||pi}|d}i}t|tr_|rK t j|}t|tr|}n5#t jtf$ri}YnwxYwt|tr|}|||S)zCRead one key out of a session's model_config JSON (tolerant parse).r) rFr@rr_rrrr,r`rv)rZrdr8rsessionrzryrs rFget_session_model_config_valuez(SessionDB.get_session_model_config_value\s"":..4"kk.))!# c3   CIIKK  Cfd++$#F()4     T " " Fzz#w'''s+BB B )rrP model_options route_source confirmedrhrirjc|pdpd|pi|pdt|tjdfd}|dS)aKPersist a Browser / API client runtime lock without clobbering lineage markers. Merges ``browser_model_lock`` into the existing ``model_config`` JSON so ``_branched_from`` / ``_delegate_from`` survive. Nulls ``system_prompt`` so cached ``Model:`` / ``Provider:`` footers cannot lie after a switch. rp)rPrrhrirj updated_atc|di}|turdS|d|f|dS)NrSzUPDATE sessions SET model_config = ?, model = COALESCE(?, model), system_prompt = NULL, system_prompt_hash = NULL WHERE id = ?rT)rrXlockrrZrds rFrz2SessionDB.update_session_runtime_lock.._dos{22j#7">F222 LL#  +     4 4T : : : : :rLN)rrTr) rZrdrrPrhrirjrrns ``` @rFupdate_session_runtime_lockz%SessionDB.update_session_runtime_lockns"!B[b*0b(.Bi)++    ; ; ; ; ; ; ; ; C     rLenabledcLsdSfd}|dS)uYPersist the per-session YOLO bypass flag into ``model_config``. Merges ``yolo_mode`` into the existing ``model_config`` JSON (same merge discipline as ``update_session_runtime_lock`` so lineage markers like ``_branched_from`` / ``_delegate_from`` survive). The CLI resume paths read this flag back so a ``/yolo ON`` toggle — or a ``--yolo`` launch — survives ``hermes --resume`` into a fresh process. No-op when the session row doesn't exist yet; the creation-time ``model_config`` carries the flag for ``--yolo`` launches. Nc|dti}|turdS|d|fdS)N yolo_moderc)rUrrVr)rrXrprZrds rFrz'SessionDB.set_session_yolo.._dosh22j;W ">F222 LLC$     rLr )rZrdrprs``` rFset_session_yolozSessionDB.set_session_yolosS  F        C     rL session_metac|pid}t|tr' tj|}n#t $rYdSwxYwt|t sdSt|dS)uRead the persisted YOLO flag off a session row dict. Accepts the dict returned by ``get_session`` (``model_config`` is a JSON string) or an already-parsed dict. Returns False on any parse failure — resume must never enable the bypass by accident. rFrs)r@rr_rrrBr,r)rurzs rFsession_yolo_enabledzSessionDB.session_yolo_enableds!r&&~66 c3    joo   uu #t$$ 5CGGK(()))sA AAc|pidttr( tjn#t $riYnwxYwtt sid}t|t r3|drd|DSfddD}|r|St|pidpd}|r| tvrd|iSt|t r d |piDniS) u>Read the persisted runtime route off a session row dict. Accepts the dict returned by ``get_session`` (``model_config`` is a JSON string) or an already-parsed dict. Prefers the nested ``gateway_runtime`` key (written by the gateway's ``_sync_session_model_from_agent`` and the CLI ``/model`` persist), falling back to the top-level ``provider``/``base_url``/``api_mode`` keys the TUI gateway's ``_runtime_model_config`` writes. As a last resort, falls back to the ``billing_provider`` column (written on every session's first accounted API call) so sessions that never ran ``/model`` still restore the provider that actually served them. Returns an empty dict on any parse failure — resume falls back to ambient config resolution. rgateway_runtimerPci|] \}}||| SrrKrrrs rFrz5SessionDB.session_gateway_runtime..sFFFTQ Aq rLcfi|]-}|||.SrKr@)rr8rzs rFrz5SessionDB.session_gateway_runtime..sE   wws||    rL)rPbase_urlapi_modebilling_providerrpci|] \}}||| SrrKr{s rFrz5SessionDB.session_gateway_runtime..sJJJAAM1MMMrL) r@rr_rrrBr,rrr_BARE_BILLING_PROVIDERS)ruruntime top_levelrrzs @rFsession_gateway_runtimez!SessionDB.session_gateway_runtimes !r&&~66 c3    joo    #t$$ C''+,, gt $ $ GZ)@)@ GGFW]]__FFF F    ;       R $ $%7 8 8 >B  %''   2 &&((0GGG 01 1NXY`bfNgNgoJJ'-R!6!6!8!8JJJJmoosA AA) billing_moder~rctfd}|dS)uUnconditionally update the billing provider/base_url for a session. Unlike ``update_token_counts`` which uses ``COALESCE(billing_provider, ?)`` (only filling in NULL), this unconditionally sets the billing fields so that the dashboard reflects the user's latest /model switch. Also nulls ``system_prompt`` so the cached snapshot (which embeds a stale ``Model:`` / ``Provider:`` header) is rebuilt — matching the behavior of ``update_session_model`` (see #48173, #48248). cf|df|dS)NaUPDATE sessions SET billing_provider = ?, billing_base_url = ?, billing_mode = COALESCE(?, billing_mode), system_prompt = NULL, system_prompt_hash = NULL WHERE id = ?)rr*)rr~rrPrZrds rFrz3SessionDB.update_session_billing_route.._dosH LL#8\:>     4 4T : : : : :rLNrK)rZrdrPr~rrs````` rFupdate_session_billing_routez&SessionDB.update_session_billing_routesd& !!! ; ; ; ; ; ; ; ; ; C     rL) input_tokens output_tokenscache_read_tokenscache_write_tokensreasoning_tokensapi_call_count)estimated_cost_usdactual_cost_usd)r cost_status cost_sourcepricing_versionrbilling_base_urlrc 8|j5|j}|jo|dup| }|s|j||f||sst j|jdd}||_| |j 5tj |dfd }||_ tj||jdddn #1swxYwY|r|j|fi|dSdS)uEnqueue a token/cost delta for the background writer. Accepts the same keyword arguments as :meth:`update_token_counts` and applies them asynchronously with identical semantics. Cheap (append + notify) — safe to call on the turn thread after every API call. After close() has stopped the writer, falls back to the synchronous path and may raise like :meth:`update_token_counts`. Nzsession-db-token-writerT)r r|daemonr:cL}||dSdSr)_drain_token_queue_at_exit)dbself_refs rF_drain_at_exitz4SessionDB.queue_token_counts.._drain_at_exit\s2!)B!~ " = = ? ? ? ? ? .~rLr:N)rdrerfis_aliverbrrLThread_token_writer_loopstartrhweakrefrefrregister notify_allupdate_token_counts)rZrdrthreadwriter_stoppedrrs @rFqueue_token_countszSessionDB.queue_token_counts9s #! 4! 4.F!4$7foo&7&7"7 " 4!((*f)=>>>>):):>'-#66#F 17D-LLNNN.6#*;t#4#4@@@@@@ 3A/777&11333C! 4! 4! 4! 4! 4! 4! 4! 4! 4! 4! 4! 4! 4! 4! 4D  ; %D $Z : :6 : : : : : ; ;sC(C==DDrc>|js |jsdSd}|j5tj|z}|js|jr|j}||s<|js5d|_t|j}|jnR|tjz }|dkr ddddS|j ||j|jdddn #1swxYwY|r | ||j5d|_|j dddn #1swxYwYnD#|j5d|_|j dddw#1swxYwYwxYwdS)uOBlock until every queued token delta has been applied. Returns True when the queue is fully drained, False on timeout (callers then read totals that are stale by the still-queued deltas — no worse than reading before the flush existed). Never raises: apply failures are logged by the writer. TNrF) rbrgrdrTrrerrclearwait_apply_token_batchr)rZrbatchrrr&s rFrDzSessionDB.flush_token_countsns  )@ 4  # 7 7~'''1H# 7t'> 72^6??+<+<^ 3$/3D+ !233E%++---$t~'7'77 >> 9 7 7 7 7 7 7 7 7:&++I6667# 7t'> 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7<  8 8''...+88.3D+*55777888888888888888T+88.3D+*557778888888888888888tsZBC6(C66C:=C:E !E  EEF!!F FF FF Fc |j5tj|jz}|js`|jsY|tjz }|dkrd|_ ddddS|j||js|jY|jsd|_ ddddSd|_t|j}|j dddn #1swxYwY | ||j5d|_|j dddn #1swxYwYnD#|j5d|_|j dddw#1swxYwYwxYw)NTrF) rdrTr_TOKEN_WRITER_IDLE_SECONDSrbrfrerrgrrrr)rZ idle_deadliner&rs rFrzSessionDB._token_writer_loops 8' * * $ 0 043R R +;D4K; -0@0@ @I A~~591 * * * * * * * **// :::+;D4K;(04D- * * * * * * * *$+/'T.//!'')))) * * * * * * * * * * * * * * ** 8''...+88.3D+*55777888888888888888T+88.3D+*5577788888888888888883 8s`AC($7C((4C((C,/C,4E !D==EE F !E>2 F >F F F F rc0 ||}n4#t$r'}td||}Yd}~nd}~wwxYw|D]G\}} |j|fi|#t$r&}td||Yd}~@d}~wwxYwdS)zBApply queued deltas in order, coalescing where safe. Never raises.z?async token accounting: coalesce failed, applying raw batch: %sNz5async token accounting: apply failed (session=%s): %s)_coalesce_token_deltasrBr=rr)rZr coalescedr\rdrs rFrzSessionDB._apply_token_batchs 33E::II    NN    IIIIII #,   J ((>>v>>>>   K   s, A AA A## B-BBc.g}|D]\}d}ds$|ftfd|jDz}|r||dd|kr|dd}|jD]2}||d|dz||<3|jD]6}|}|||pd|z||<7|||t fd|DS) aMerge consecutive incremental deltas with an identical route. Only adjacent deltas merge, so ordering across sessions and across a mid-session /model switch is preserved exactly. absolute=True deltas (cumulative overwrites) never merge. Nabsolutec3BK|]}|VdSrr})rfrs rFr+z3SessionDB._coalesce_token_deltas..s>,,&'FJJqMM,,,,,,rLrrrr5cg|] \}}}||f SrKrK)rr[rkws rFrz4SessionDB._coalesce_token_deltas..s"333jabb 333rL)r@tuple_TOKEN_DELTA_ROUTE_FIELDS_TOKEN_DELTA_SUM_FIELDS_TOKEN_DELTA_COST_FIELDSrr,) rZrgroupsrdr8rXrrDrs @rFrz SessionDB._coalesce_token_deltassnEG"' ? ? JC::j)) !me,,,,+/+I,,,'' ?#/fRjms.B.BA5DDA & 1a 0 06::a3C3C CF1II6CCA"JJqMME(&,ZZ]]%9cU$Bq C sJV =>>>>33F3333rL$@ join_timeoutc|j5d|_|j|j}dddn #1swxYwY|n|rZ|||r0t d|t|j dS|j5tj |z}|j ry|tj z }|dkr>NNP$c$*;&<&<  * * * * * * * *&++I666) 7 *++E **.'!'')))+ * * * * * * * * * * * * * * *,  8 8''...+88.3D+*55777888888888888888888T+88.3D+*557778888888888888888  8 8sk(<AA>A)F4AFFF%G<!G//G36G3<H=!H1% H=1H5 5H=8H5 9H=cR |dS#t$rYdSwxYwr)rrBr@s rFrz$SessionDB._drain_token_queue_at_exit+sA   # # % % % % %    DD s  &&rrrrrrrrrrrrrrrch d|rdndtp p p pppp  | r ndrndrndrndf| o p p pppp   fd}|dS)uUpdate token counters and backfill model if not already set. When *absolute* is False (default), values are **incremented** — use this for per-API-call deltas (CLI path). When *absolute* is True, values are **set directly** — use this when the caller already holds cumulative totals (gateway path, where the cached agent accumulates across messages). r)raUPDATE sessions SET input_tokens = ?, output_tokens = ?, cache_read_tokens = ?, cache_write_tokens = ?, reasoning_tokens = ?, estimated_cost_usd = COALESCE(?, 0), actual_cost_usd = CASE WHEN ? IS NULL THEN actual_cost_usd ELSE ? END, cost_status = COALESCE(?, cost_status), cost_source = COALESCE(?, cost_source), pricing_version = COALESCE(?, pricing_version), billing_provider = COALESCE(billing_provider, ?), billing_base_url = COALESCE(billing_base_url, ?), billing_mode = COALESCE(billing_mode, ?), model = COALESCE(model, ?), api_call_count = ? WHERE id = ?a^UPDATE sessions SET input_tokens = input_tokens + ?, output_tokens = output_tokens + ?, cache_read_tokens = cache_read_tokens + ?, cache_write_tokens = cache_write_tokens + ?, reasoning_tokens = reasoning_tokens + ?, estimated_cost_usd = COALESCE(estimated_cost_usd, 0) + COALESCE(?, 0), actual_cost_usd = CASE WHEN ? IS NULL THEN actual_cost_usd ELSE COALESCE(actual_cost_usd, 0) + ? END, cost_status = COALESCE(?, cost_status), cost_source = COALESCE(?, cost_source), pricing_version = COALESCE(?, pricing_version), billing_provider = COALESCE(billing_provider, ?), billing_base_url = COALESCE(billing_base_url, ?), billing_mode = COALESCE(billing_mode, ?), model = COALESCE(model, ?), api_call_count = COALESCE(api_call_count, 0) + ? WHERE id = ?Nc|df}||dnd}||dnd}t||dndpd}|dko+o)tot o |kp| k}|r|d  f|r'|    dSdS)NzISELECT model, billing_provider, api_call_count FROM sessions WHERE id = ?rrrrzUPDATE sessions SET model = ?, billing_provider = ?, billing_base_url = ?, billing_mode = ? WHERE id = ?)rrrrrrrrrrrrrr)rrQrAr_record_model_usage)rrexisting_modelexisting_providerexisting_api_callsfirst_accounted_routerrrrrrrrrrhas_accounted_usagerrrrFrrecord_model_usagerZrdrs rFrz*SessionDB.update_token_counts.._dos,,[ hjj .1_S\\$N;>?$6 7 7PT !$sc*:&;&;TU%[Z[!\!\ #a'W'WKKW)**W$u,U0AEU0U "%  ',.> jY  LLf % % %! ((%5%5!-!-"/&7'9%5'9$3 + +#1!)  rL)rrr)rZrdrrrrrrrrrrrrrrrrrrrFrrs```````````` ```` @@@@rFrzSessionDB.update_token_counts1sB   Ye DDD ) ##CC*#C(#  5M 5-> 5! 5%5 59G 5! 5%4              3 =   3 =  / 9LLT( 2EEd  # @#+l  "M "-> "! "%5 "9G "!  / / / / / / / / / / / / / / / / / / / / / / / / ` C     rL)taskrc|d|f}||dnd}||dnd}||dnd}||dnd}|r|pd}|pd}|pd}|pd}n|p|pd}|p|pd}|p|pd}|p|pd}tj}|d ||||||pd|pd |pd |pd | pd | pd | pd t| pd t| pd ||||fdS) uAccumulate a per-API-call usage delta into session_model_usage. Runs inside the caller's write transaction (after the ``sessions`` UPDATE) so the per-model rows stay consistent with the summary row. When the caller omits the model/provider (some paths only pass token deltas), fall back to the values already recorded on the session row — the same COALESCE-from-session behaviour the summary update uses. ``task`` distinguishes what kind of work consumed the tokens: ``''`` (empty) is the main agent loop; auxiliary calls record their task name (``vision``, ``compression``, ``title_generation``, ...) via :meth:`record_auxiliary_usage` (issue #23270). zYSELECT model, billing_provider, billing_base_url, billing_mode FROM sessions WHERE id = ?NrrrrrrpaINSERT INTO session_model_usage ( session_id, model, billing_provider, billing_base_url, billing_mode, task, api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(session_id, model, billing_provider, billing_base_url, billing_mode, task) DO UPDATE SET api_call_count = api_call_count + excluded.api_call_count, input_tokens = input_tokens + excluded.input_tokens, output_tokens = output_tokens + excluded.output_tokens, cache_read_tokens = cache_read_tokens + excluded.cache_read_tokens, cache_write_tokens = cache_write_tokens + excluded.cache_write_tokens, reasoning_tokens = reasoning_tokens + excluded.reasoning_tokens, estimated_cost_usd = estimated_cost_usd + excluded.estimated_cost_usd, actual_cost_usd = actual_cost_usd + excluded.actual_cost_usd, cost_status = COALESCE(excluded.cost_status, cost_status), cost_source = COALESCE(excluded.cost_source, cost_source), last_seen = excluded.last_seenrr5)rrQrTr-)rZrrdrrrrrrrrrrrrrrrr sess_model sess_provider sess_base_urlsess_billing_mode eff_model eff_provider eff_base_urleff_billing_moder)s rFrzSessionDB._record_model_usagesDll ) M   (** &)_S\\$ 36?.// 36?.// 36?C//  G*I+1rL+1rL+1r  88yI+B}BL+B}BL+F/@FB ikk  5*  #!!"!&Q"'a %A(/C00o,--% +) ) ) ) ) rLrc (|j||fd|i||S)zHEnsure a session row exists (INSERT OR IGNORE). Accepts optional kwargs.rr)rZrdrrrs rFensure_sessionzSessionDB.ensure_session@s, ! VKK5KFKKKrLrq) rrrrrrrrrrc  rsdSd   f d} | dS)u@Record an auxiliary LLM call's usage against *session_id* (issue #23270). Auxiliary calls (vision, compression, title_generation, web_extract, session_search, ...) historically discarded their usage, leaving the dashboard's per-model analytics blind to aux model spend. This writes a per-(model, provider, task) delta into ``session_model_usage`` — the same table the main loop's ``update_token_counts`` feeds — WITHOUT touching the ``sessions`` summary row. That separation is deliberate: the gateway overwrites session counters with absolute main-loop totals, so folding aux tokens into the summary row would either be clobbered or double-counted. Insights/analytics read the union of both. ``api_call_count`` defaults to 1 (one aux LLM call). Background-review forks record an aggregate of N fork API calls in one write with ``task='background_review'`` (issue #87250). Best-effort by contract: callers must never fail an aux call because accounting failed. Nrc | dpd pdpdpd pdddddnt dS)Nrrq)rrrrrrrrrrrrrrr)rrA)rrrrrrrrrrrrZrdrs rFrz-SessionDB.record_auxiliary_usage.._dous  $ $!1!1!).Q+0q"3"8q#5#:!1!6Q#5 $  '/AAS5H5H' %     rL)rr)rZrdrrrrrrrrrrrrs````````````` rFrecord_auxiliary_usagez SessionDB.record_auxiliary_usageKsF   F   Y777                 , C     rLzOptional[Path]ctjdz fd}|pg}|r|r|D]}||t|S)zCRemove empty TUI ghost sessions (no messages, no title, >24hr old).Qc|df}d|D}|rTddt|z}|d|d|||S)NaZ SELECT id FROM sessions WHERE source = 'tui' AND title IS NULL AND ended_at IS NOT NULL AND started_at < ? AND NOT EXISTS ( SELECT 1 FROM messages WHERE messages.session_id = sessions.id ) cfg|].}t|ttfr|dn|d/S)rr)rrrrrs rFrzESessionDB.prune_empty_ghost_sessions.._do..s7SSS:a%77D1Q44QtWSSSrLrrrr)rrrrr*)rrrrr.rZs rFrz1SessionDB.prune_empty_ghost_sessions.._dos<< !  %HJJ TSdSSSC ?"xxc#hh77  HHHH#88>>>JrL)rTr_remove_session_filesr)rZr7r removed_idsrr.s` @rFprune_empty_ghost_sessionsz$SessionDB.prune_empty_ghost_sessionssu$      ())#..4"  >K >" > >**<====;rLchtjdz fd}||pdS)ajMark orphaned compression continuation sessions as ended. Targets child sessions that were never finalized: parent is ended with reason='compression', child has messages but no end_reason/ended_at and api_call_count=0. Non-destructive: preserves all messages and sets end_reason='orphaned_compression'. Fix for #20001. i: chtj}|d|f}|jS)Na UPDATE sessions SET ended_at = ?, end_reason = 'orphaned_compression' WHERE api_call_count = 0 AND end_reason IS NULL AND ended_at IS NULL AND started_at < ? AND parent_session_id IS NOT NULL AND EXISTS ( SELECT 1 FROM sessions p WHERE p.id = sessions.parent_session_id AND p.end_reason = 'compression' AND p.ended_at IS NOT NULL ) AND EXISTS ( SELECT 1 FROM messages m WHERE m.session_id = sessions.id ) )rTrr~)rr)rr.s rFrz=SessionDB.finalize_orphaned_compression_sessions.._dos9)++C\\(f +F.? "rLrr)rZrr.s @rF&finalize_orphaned_compression_sessionsz0SessionDB.finalize_orphaned_compression_sessionssIv% # # # # #6""3'',1,rLc ||5}|d|f}|}dddn #1swxYwY|r||ndS)zGet a session by ID.zSELECT s.*, COALESCE(sp.prompt, s.system_prompt) AS _system_prompt_resolved FROM sessions s LEFT JOIN system_prompts sp ON sp.hash = s.system_prompt_hash WHERE s.id = ?N)rDrrrQr/)rZrdrrrs rFrFzSessionDB.get_sessions !!! ^^   $\\!  F//##C $ $ $ $ $ $ $ $ $ $ $ $ $ $ $/2;t%%c***t;s,A!!A%(A%c||5}|d|f}dddn #1swxYwY|rt |ndS)atReturn the main-loop model route that served most API calls. ``sessions`` is a legacy aggregate row and can hold model/provider fields written by different route changes. ``session_model_usage`` keeps the coherent per-call tuple, so persisted status and billing reads should use its dominant main-loop route when one is available. aWSELECT model, billing_provider, billing_base_url, billing_mode, api_call_count FROM session_model_usage WHERE session_id = ? AND task = '' AND model <> 'unknown' AND billing_provider <> '' ORDER BY api_call_count DESC, (input_tokens + output_tokens + cache_read_tokens + cache_write_tokens + reasoning_tokens) DESC, last_seen DESC LIMIT 1N)rDrrrQr,rZrdrrs rF get_dominant_session_model_routez*SessionDB.get_dominant_session_model_routes !!! ^^   ,,  hjj                  )tCyyyT)s*AA#&A#session_id_or_prefixcP||}|r|dSt|}|j5|jd|df}d|D}dddn #1swxYwYt |dkr|dSdS)a*Resolve an exact or uniquely prefixed session ID to the full ID. Returns the exact ID when it exists. Otherwise treats the input as a prefix and returns the single matching session ID if the prefix is unambiguous. Returns None for no matches or ambiguous prefixes. rzSSELECT id FROM sessions WHERE id LIKE ? ESCAPE '\' ORDER BY started_at DESC LIMIT 2rcg|] }|d SrrKrs rFrz0SessionDB.resolve_session_id..s>>>Ss4y>>>rLNrqr)rFrrNr:rrr)rZrrMescapedrmatchess rFresolve_session_idzSessionDB.resolve_session_ids  !566  ; 344 Z ? ?Z''f F?>FOO,=,=>>>G  ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? w<<1  1: ts>BBBrderivedllmr$rcz||j|jS|jt|dS)uRank a stored title_source. NULL means a pre-provenance row. Rows written before this column existed carry NULL. They were almost always set by the old auto-titler, but a manual ``/title`` from that era is indistinguishable — so treat NULL as ``user`` and refuse to overwrite it. Auto-titling only ever fills genuinely empty titles on legacy rows, which is the conservative direction. Nr)_TITLE_SOURCE_RANKTITLE_SOURCE_USERr@r_)clsrs rF _title_rankzSessionDB._title_rank(s9 >)#*?@ @%))#f++q999rLtitlecp|sdSt|}tjdd|}tjdd|}tjdd|}|sdSt |t jkr-tdt |dt jd |S) aValidate and sanitize a session title. - Strips leading/trailing whitespace - Removes ASCII control characters (0x00-0x1F, 0x7F) and problematic Unicode control chars (zero-width, RTL/LTR overrides, etc.) - Collapses internal whitespace runs to single spaces - Normalizes empty/whitespace-only strings to None - Enforces MAX_TITLE_LENGTH Returns the cleaned title string or None. Raises ValueError if the title exceeds MAX_TITLE_LENGTH after cleaning. Nz [\x00-\x08\x0b\x0c\x0e-\x1f\x7f]rpzB[\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff\ufffc\ufff9-\ufffb]z\s+r^zTitle too long (z chars, max r)r resubrrrMAX_TITLE_LENGTHrw)rcleaneds rFsanitize_titlezSessionDB.sanitize_title6s 4%U++ &._dosullG hjj q ww/;##GN$;<<HH1 IJ'"??,,"*4.K44+Z5  K(N )YeYYKYY \\D#-FFG$N+   F? "rLr)rrrr)rZrdrrrr~r r s```` @@rF_set_session_titlezSessionDB._set_session_titles*##E**D223:D4##F+++8 #8 #8 #8 #8 #8 #8 #8 #8 #8 #t&&s++!|rLc<||||jS)aSet or update a session's title on the user's behalf. Returns True if session was found and title was set. Raises ValueError if title is already in use by another session, or if the title fails validation (too long, invalid characters). Empty/whitespace-only strings are normalized to None (clearing the title). This records ``user`` provenance, so auto-titling will never replace the result. Automatic callers must use :meth:`set_auto_title`. r)r rrZrdrs rFset_session_titlezSessionDB.set_session_titles+&& d&<'   rLcv||j|jfvrtd|||||S)zSet an automatically generated title, honoring provenance precedence. Returns True when the title was written, False when a higher-authority title already holds the row (nothing is modified in that case). z invalid automatic title source: r)TITLE_SOURCE_DERIVEDTITLE_SOURCE_LLMrwr )rZrdrrs rFset_auto_titlezSessionDB.set_auto_titlesL $3T5JK K KJJJKK K&&z5&HHHrLc<||||jS)zBack-compat shim: set an LLM title only if nothing better exists. Retained because older callers (and third-party plugins) reference it by name. New code should call :meth:`set_auto_title` with an explicit source. r)rrrs rFset_auto_title_if_emptyz!SessionDB.set_auto_title_if_emptys+"" d&;#   rLc|j5|jd|f}|}dddn #1swxYwY|r|dndS)z%Get the title for a session, or None.z'SELECT title FROM sessions WHERE id = ?NrrNr:rrQrZrdrrs rFget_session_titlezSessionDB.get_session_title s Z $ $Z''9J=F//##C  $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ #,s7||,1AA  A c|j5|jd|f}|}dddn #1swxYwY|r|ddS|dS)z?Get the provenance of a session's title, or None when untitled.rNrrrrs rFget_session_title_sourcez"SessionDB.get_session_title_source s Z $ $Z''G F//##C  $ $ $ $ $ $ $ $ $ $ $ $ $ $ $  c'l*4>""rcz|jvrtdfd}||dkS)a!Overwrite a title's provenance without touching the title text. Used when a title is carried across a session boundary (compression rotation) and the copy must keep the original's authority rather than the authority of whichever setter performed the copy. zinvalid title source: cB|df}|jS)NzGUPDATE sessions SET title_source = ? WHERE id = ? AND title IS NOT NULLr)rrrdrs rFrz/SessionDB.set_session_title_source.._do$ s-\\5$F ? "rLr)rrwr)rZrdrrs `` rFset_session_title_sourcez"SessionDB.set_session_title_source sd 0 0 0@f@@AA A # # # # # #""3''!++rLarchivedcHfd}||}|dkS)uArchive or unarchive a session. Archived sessions are hidden from the default session list but keep all their messages — this is a soft hide, not a delete. For compression chains, archive the whole logical conversation. Desktop lists compression roots projected forward to their latest continuation; updating only the displayed tip lets the still-unarchived root resurrect it on refresh. Returns True when at least one row was updated. c|drdndf}|j}||dkr-|dd}|S)Na[ WITH RECURSIVE ancestors(id) AS ( SELECT ? UNION SELECT parent.id FROM ancestors a JOIN sessions child ON child.id = a.id JOIN sessions parent ON parent.id = child.parent_session_id WHERE parent.end_reason = 'compression' ), descendants(id) AS ( SELECT ? UNION SELECT child.id FROM descendants d JOIN sessions parent ON parent.id = d.id JOIN sessions child ON child.parent_session_id = parent.id WHERE parent.end_reason = 'compression' ), lineage(id) AS ( SELECT id FROM ancestors UNION SELECT id FROM descendants ) UPDATE sessions SET archived = ? WHERE id IN (SELECT id FROM lineage) rqrSELECT changes()rr~rQ)rrr~r!rds rFrz+SessionDB.set_session_archived.._do8 sp\\:Zh)=A>=F@H8a<<<<(:;;DDFFqIOrLrr )rZrdr!rr~s `` rFset_session_archivedzSessionDB.set_session_archived. sB$ $ $ $ $ $ J&&s++!|rLpinnedcHfd}||}|dkS)ulPin or unpin a session (and its whole compression lineage). ``pinned`` is a durable "keep" flag: pinned sessions are exempt from the ``sessions.auto_archive`` stale sweep (see :meth:`archive_stale_sessions`). Desktop is the current writer — its sidebar pins mirror here so a backend/other-surface sweep honours them. Like :meth:`set_session_archived` the whole compression chain is flipped as a unit, so pinning the surfaced tip protects the root (and vice-versa) no matter which id the caller holds. Returns True when at least one row changed. c|drdndf}|j}||dkr-|dd}|S)NaY WITH RECURSIVE ancestors(id) AS ( SELECT ? UNION SELECT parent.id FROM ancestors a JOIN sessions child ON child.id = a.id JOIN sessions parent ON parent.id = child.parent_session_id WHERE parent.end_reason = 'compression' ), descendants(id) AS ( SELECT ? UNION SELECT child.id FROM descendants d JOIN sessions parent ON parent.id = d.id JOIN sessions child ON child.parent_session_id = parent.id WHERE parent.end_reason = 'compression' ), lineage(id) AS ( SELECT id FROM ancestors UNION SELECT id FROM descendants ) UPDATE sessions SET pinned = ? WHERE id IN (SELECT id FROM lineage) rqrr$r%)rrr~r'rds rFrz)SessionDB.set_session_pinned.._dol p\\:Zf);!<=F@H8a<<<<(:;;DDFFqIOrLrr )rZrdr'rr~s `` rFset_session_pinnedzSessionDB.set_session_pinned` sB$ $ $ $ $ $ J&&s++!|rLhiddencHfd}||}|dkS)uHide or unhide a session (and its whole compression lineage). ``hidden`` is a generic "don't show in the global Sessions sidebar" flag: a hidden session is dropped from the default :meth:`list_sessions_rich` listing (which omits ``include_hidden``) but stays fully resumable by the surface that owns it — useful for plugins that manage their own sessions (e.g. kanban) and don't want them cluttering the shared recents list. Like :meth:`set_session_archived` / :meth:`set_session_pinned` the whole compression chain is flipped as a unit, so hiding the surfaced tip hides the root (and vice-versa) no matter which id the caller holds. Returns True when at least one row changed. c|drdndf}|j}||dkr-|dd}|S)NaY WITH RECURSIVE ancestors(id) AS ( SELECT ? UNION SELECT parent.id FROM ancestors a JOIN sessions child ON child.id = a.id JOIN sessions parent ON parent.id = child.parent_session_id WHERE parent.end_reason = 'compression' ), descendants(id) AS ( SELECT ? UNION SELECT child.id FROM descendants d JOIN sessions parent ON parent.id = d.id JOIN sessions child ON child.parent_session_id = parent.id WHERE parent.end_reason = 'compression' ), lineage(id) AS ( SELECT id FROM ancestors UNION SELECT id FROM descendants ) UPDATE sessions SET hidden = ? WHERE id IN (SELECT id FROM lineage) rqrr$r%)rrr~r,rds rFrz)SessionDB.set_session_hidden.._do r*rLrr )rZrdr,rr~s `` rFset_session_hiddenzSessionDB.set_session_hidden sB$ $ $ $ $ $ J&&s++!|rLreadcHfd}||}|dkS)uMark a session read or unread (and its whole compression lineage). Read state is a watermark, not a flag: ``last_read_at`` records when the conversation was last read, and it counts as unread when activity postdates that watermark (the derived ``unread`` key on :meth:`list_sessions_rich` rows). New messages therefore flip a read conversation back to unread without any write on the message path. Three states: * NULL — never tracked (every pre-feature row): treated as read, so shipping the column doesn't badge a user's entire history at once. * 0 — explicitly marked unread: any activity postdates it. * timestamp — read up to that moment. Like :meth:`set_session_archived` / :meth:`set_session_pinned`, the whole compression chain is stamped as a unit, so reading the surfaced tip clears the root (and vice-versa) no matter which id the caller holds. Returns True when at least one row changed. c|drtjndf}|j}||dkr-|dd}|S)Na_ WITH RECURSIVE ancestors(id) AS ( SELECT ? UNION SELECT parent.id FROM ancestors a JOIN sessions child ON child.id = a.id JOIN sessions parent ON parent.id = child.parent_session_id WHERE parent.end_reason = 'compression' ), descendants(id) AS ( SELECT ? UNION SELECT child.id FROM descendants d JOIN sessions parent ON parent.id = d.id JOIN sessions child ON child.parent_session_id = parent.id WHERE parent.end_reason = 'compression' ), lineage(id) AS ( SELECT id FROM ancestors UNION SELECT id FROM descendants ) UPDATE sessions SET last_read_at = ? WHERE id IN (SELECT id FROM lineage) r5rr$)rrTr~rQ)rrr~r0rds rFrz'SessionDB.set_session_read.._do sv\\:Z)E#F=F@H8a<<<<(:;;DDFFqIOrLrr )rZrdr0rr~s `` rFset_session_readzSessionDB.set_session_read sB($ $ $ $ $ $ J&&s++!|rL session_rowc|d}|dS|dp|d}t|pdt|kS)a Derive unread from a session row's watermark and activity. Shared by ``list_sessions_rich`` and any future surface that holds a row (or projected row) with ``last_read_at`` and ``last_active``. NULL watermark = never tracked = read. last_read_atNFrZrYr)r@r-)r4 last_readrZs rFsession_unreadzSessionDB.session_unread!sb OON33  5!oom44U  8U8U [%A&&y)9)999rLc|5}|d|f}|}dddn #1swxYwY|r||ndS)z?Look up a session by exact title. Returns session dict or None.zSELECT s.*, COALESCE(sp.prompt, s.system_prompt) AS _system_prompt_resolved FROM sessions s LEFT JOIN system_prompts sp ON sp.hash = s.system_prompt_hash WHERE s.title = ?N)rrrQr/)rZrrrrs rFget_session_by_titlezSessionDB.get_session_by_title!s ^^   $\\$  F//##C $ $ $ $ $ $ $ $ $ $ $ $ $ $ $/2;t%%c***t;s,A  AAc6||}t|}|5}|d|df}|}dddn #1swxYwY|r|ddS|r|dSdS)adResolve a title to a session ID, preferring the latest in a lineage. If the exact title exists, returns that session's ID. If not, searches for "title #N" variants and returns the latest one. If the exact title exists AND numbered variants exist, returns the latest numbered variant (the most recent continuation). zaSELECT id, title, started_at FROM sessions WHERE title LIKE ? ESCAPE '\' ORDER BY started_at DESC #%Nrr)r:rrrr)rZrrMrrrnumbereds rFresolve_session_by_titlez"SessionDB.resolve_session_by_title"!s))%00u%% ^^   )\\J"F ((H  ) ) ) ) ) ) ) ) ) ) ) ) ) ) )  A;t$ $  ; ts/A44A8;A8 base_titlec tjd|}|r|d}n|}t|}|j5|jd||df}d|D}dddn #1swxYwY|s|Sd}|D]I}tjd|} | r0t|t| d}J|d|dzS) uGenerate the next title in a lineage (e.g., "my session" → "my session #2"). Strips any existing " #N" suffix to find the base name, then finds the highest existing number and increments. z^(.*?) #(\d+)$rqzESELECT title FROM sessions WHERE title = ? OR title LIKE ? ESCAPE '\'r<cg|] }|d S)rrKrs rFrz7SessionDB.get_next_title_in_lineage..T!sBBBG BBBrLNz ^.* #(\d+)$z #) rrrurrNr:rrrrA) rZr?rrrrrmax_numrms rFget_next_title_in_lineagez#SessionDB.get_next_title_in_lineage?!so*J77  ;;q>>DDDt$$ Z C CZ''X''FCB0A0ABBBH  C C C C C C C C C C C C C C C K 8 8A++A 8gs1771::77'''A+'''s?BBBcr|}|r|hn t}tdD]}|j5|jdt dd|f}|}dddn #1swxYwY||cS|d}|r||vr|cS|||}|S)aWalk the compression-continuation chain forward and return the tip. A compression continuation is a child of a session whose ``end_reason = 'compression'``. Older builds tried to distinguish continuations from branches/subagents by requiring ``child.started_at >= parent.ended_at``. That ordering is too brittle: gateway + compression races can insert the real continuation row before the parent row's ``ended_at`` is written, while a stale websocket later creates/reuses a sibling that *does* satisfy the timestamp test. The visible symptom is brutal: desktop resume follows the stale sibling and the user's latest messages look "lost" even though they are persisted in the real continuation chain. Instead, only follow children of compression-ended parents, exclude explicit branch/delegate/tool children, and prefer children that are themselves continuing the compression chain (``end_reason='compression'``) or still live over stale closed siblings such as ``ws_orphan_reap``. Returns the latest continuation tip, or the input id when no continuation exists. ra SELECT child.id FROM sessions parent JOIN sessions child ON child.parent_session_id = parent.id WHERE parent.id = ? AND parent.end_reason = 'compression' AND json_extract(COALESCE(child.model_config, '{}'), '$._branched_from') IS NULL AND json_extract(COALESCE(child.model_config, '{}'), '$._delegate_from') IS NULL AND COALESCE(child.source, '') != 'tool' ORDER BY CASE WHEN child.end_reason = 'compression' THEN 0 WHEN child.ended_at IS NULL THEN 1 ELSE 2 END, rz DESC, child.started_at DESC, child.id DESC LIMIT 1 Nr)rrPrNr:rr"rQr)rZrdrrr[rrchild_ids rFget_compression_tipzSessionDB.get_compression_tipb!s3*#.yys  A ( (++088(J+.oo''1 ( ( ( ( ( ( ( ( ( ( ( ( ( ( (2{4yH x4// HHX   GGsAA<<B B >rfrr_session_compact_cols_sql)min_message_countinclude_archivedrIrJcrddg}|g}|s|d|5}|dd|d|}dddn #1swxYwYt |dpdt |d pd d S) uTokens and spend across this store, as one aggregate. The sidebar shows a profile's totals beside a page of its sessions, so summing the rows it happens to have loaded would report a fraction of the truth and shrink as paging changed. SQLite adds the columns up over every row instead, at the cost of one scan. Spend is the billed figure when the provider returned one and the estimate otherwise — the same precedence a single row renders. zparent_session_id IS NULLzmessage_count >= ?zCOALESCE(archived, 0) = 0z SELECT COALESCE(SUM(COALESCE(input_tokens, 0) + COALESCE(output_tokens, 0)), 0), COALESCE(SUM(COALESCE(actual_cost_usd, estimated_cost_usd, 0)), 0) FROM sessions WHERE  AND  Nrrqr5)tokenscost_usd)rrrrrQrAr-)rZrIrJwhererFrrs rF usage_totalszSessionDB.usage_totals!s-.BC./ 6 LL4 5 5 5 ^^   ,, U++  hjj                c!fk**c!fm8L8LMMMsAA??BBsourcesexclude_sourcesrrEoffsetinclude_childrenproject_compression_tipsorder_by_last_active archived_onlyid_query search_query compact_rowsinclude_pinnedinclude_hiddenc|g}g}|s?|t|tdd|r|gnt |pg}|rMdd|D}|d|d|||r*|d|||rMdd|D}|d |d|||ru= List sessions with preview (first user message) and last active timestamp. Returns dicts with keys: id, source, model, title, started_at, ended_at, message_count, preview (first 60 chars of first user message), last_active (freshest of last_activity_at heartbeat and latest message timestamp, else started_at). Uses a single query with correlated subqueries instead of N+2 queries. By default, child sessions that represent implementation details (subagent runs, compression continuations) are excluded. User-visible branch and reset children remain listable. Pass ``include_children=True`` to include every child. With ``project_compression_tips=True`` (default), sessions that are roots of compression chains are projected forward to their latest continuation — one logical conversation = one list entry, showing the live continuation's id/message_count/title/last_active. This prevents compressed continuations from being invisible to users while keeping delegate subagents and branches hidden. Pass ``False`` to return the raw root rows (useful for admin/debug UIs). Pass ``order_by_last_active=True`` to sort by most-recent activity instead of original conversation start time. For compression chains, the "most-recent activity" is taken from the live tip (not the root), so an old conversation that was compressed and continued recently surfaces in the correct slot. Ordering is computed at SQL level via a recursive CTE that walks compression-continuation edges, so LIMIT and OFFSET still apply efficiently. ``search_query`` matches case-insensitive substrings against each surfaced row's title and id (and, like ``id_query``, every title/id in its forward compression chain). A punctuation-stripped variant is also matched so e.g. ``an94`` finds ``AN-94``. Only honored in the ``order_by_last_active`` path. Pass ``compact_rows=True`` for dashboard and picker callers that only need lightweight metadata. This omits the ``system_prompt`` blob from the SELECT so SQLite never copies it out of the B-tree page — a significant I/O saving on large databases where the blob routinely runs to tens of kilobytes per row. Pass ``include_pinned=True`` to back-fill any conversation carrying the durable ``pinned`` flag that the LIMIT/OFFSET window left out. A pin is a "this must always be reachable" statement, so a pinned conversation aging past the requested page is a bug, not a paging outcome — the desktop sidebar would render an empty Pinned section. Back-filled rows obey the same filters (source, archived, min_message_count) as the page: an archived or filtered-out conversation stays out. Pass ``session_key`` to restrict results to one stable gateway conversation scope (DM, group, channel, or thread, including the configured per-user isolation policy). s.model_config IS NULLrc3K|]}dVdSrrKrs rFr+z/SessionDB.list_sessions_rich..+""#A#AAC#A#A#A#A#A#ArL s.source IN (rzs.session_key = ?c3K|]}dVdSrrKrs rFr+z/SessionDB.list_sessions_rich..2"rcrLs.source NOT IN (rs.message_count >= ?s.archived = 1s.archived = 0z s.hidden = 0zWHERE rLrpzA, COALESCE(sp.prompt, s.system_prompt) AS _system_prompt_resolvedz=LEFT JOIN system_prompts sp ON sp.hash = s.system_prompt_hashneedler:c(dt|dS)Nr)r)rjs rF _like_patternz3SessionDB.list_sessions_rich.._like_patternl"s2<//2222rLznEXISTS (SELECT 1 FROM chain cq WHERE cq.root_id = s.id AND LOWER(cq.cur_id) LIKE ? ESCAPE '\')z[\W_]+z`REPLACE(REPLACE(REPLACE(REPLACE(LOWER(COALESCE({0}, '')), '-', ''), '_', ''), '.', ''), ' ', '')zEXISTS (SELECT 1 FROM chain cq JOIN sessions cs ON cs.id = cq.cur_id WHERE cq.root_id = s.id AND (LOWER(COALESCE(cs.title, '')) LIKE ? ESCAPE '\' OR LOWER(cq.cur_id) LIKE ? ESCAPE '\'rz OR zcs.titlez LIKE ? ESCAPE '\'rzs.*zr WITH RECURSIVE chain(root_id, cur_id) AS ( SELECT s.id, s.id FROM sessions s a UNION ALL SELECT c.root_id, child.id FROM chain c JOIN sessions parent ON parent.id = c.cur_id JOIN sessions child ON child.parent_session_id = c.cur_id WHERE parent.end_reason = 'compression' AND json_extract(COALESCE(child.model_config, '{}'), '$._branched_from') IS NULL AND json_extract(COALESCE(child.model_config, '{}'), '$._delegate_from') IS NULL AND COALESCE(child.source, '') != 'tool' ), chain_max AS ( SELECT root_id, MAX(cur_idz) AS effective_last_active FROM chain GROUP BY root_id ) SELECT z@, COALESCE( (SELECT a FROM messages m WHERE m.session_id = s.id AND m.role = 'user' AND m.content IS NOT NULL ORDER BY m.timestamp, m.id LIMIT 1), '' ) AS _preview_raw, sz AS last_active, COALESCE(cm.effective_last_active, s.started_at) AS _effective_last_active FROM sessions s LEFT JOIN chain_max cm ON cm.root_id = s.id rMz ORDER BY _effective_last_active DESC, s.started_at DESC, s.id DESC LIMIT ? OFFSET ? z SELECT z@ AS last_active FROM sessions s zY ORDER BY s.started_at DESC LIMIT ? OFFSET ? N _preview_rawpreview_effective_last_activech|] }|d SrrKrrns rFrz/SessionDB.list_sessions_rich.."s222A$222rLz AND s.pinned = 1zWHERE s.pinned = 1a FROM messages m WHERE m.session_id = s.id AND m.role = 'user' AND m.content IS NOT NULL ORDER BY m.timestamp, m.id LIMIT 1), '' ) AS _preview_raw, COALESCE( (SELECT MAX(m2.timestamp) FROM messages m2 WHERE m2.session_id = s.id), s.started_at ) AS last_active FROM sessions s z8 ORDER BY s.started_at DESC rrtr)r\) rrsrtrUtool_call_countrrZrprrfrrr_lineage_root_idunread) rDrrrrrrrrrr_rrrx_compact_session_colsr#rr"rrrr/r!r-rr@rG_get_session_rich_rows_batchrvaluesr,r8);rZrrSrTrrErUrVrIrWrXrJrYrZr[r\r]rr^ where_clausesrFinclude_sourcesrclause clause_params where_sqlbase_where_params prompt_select prompt_join id_needle search_needle outer_where id_paramsfilter_clausesrlcompact_needle compact_sql search_clausecombined_selrErrrr>rrnseen_ids pinned_where pinned_query pinned_cursor pinned_rowstip_ids_by_roottip_idtip_rows projectedtip_rowrXr8s; rFlist_sessions_richzSessionDB.list_sessions_rich!s Z !!!  U  !4 5 5 5  $78H$I$I!S!S!S T T T&,E6(($w}"2E2E  +88#A#A#A#A#AAAL  !@!@!@!@ A A A MM/ * * *  '  !4 5 5 5 MM+ & & &  +88#A#A#A#A#AAAL  !D\!D!D!D E E E MM/ * * *  )$6z$B$B !FM   ( ( ( MM- ( ( ( q  !7 8 8 8 MM+ , , ,  3  !1 2 2 2 2! 3  !1 2 2 2 1   0 0 0>KS:W\\-88:::QS !LL UBBT   QBBP ^**,,2244 %+2244::<< x +$K#%I(*N 3c 3c 3 3 3 3 ; %%I   y!9!9::: <"$ 2}!E!E> >  -- ">">!?!!CDDD!D!R{11*==RRRM$$]]>%B%BCCC%%md&:;;; "<<775>Wy11x111DWXDWDW4@J4--///UD$7@$$ .T#s999sS9s999rLci|]}|dS)rrKrs rFrz8SessionDB.session_lifecycle_statuses..W#s#@#@#@SC#@#@#@rLrc3K|]}dVdSrrKrs rFr+z7SessionDB.session_lifecycle_statuses..X#s"11111111rLa3 SELECT m.session_id, m.role, m.tool_calls IS NOT NULL AS has_tool_calls, m.finish_reason FROM messages m JOIN ( SELECT session_id, MAX(id) AS max_id FROM messages WHERE session_id IN (z[) GROUP BY session_id ) latest ON m.id = latest.max_id Nr#rr)r#rrrd)rrrrr r) rZr0rstatusesrrErrrs rFsession_lifecycle_statusesz$SessionDB.session_lifecycle_statuses@#sQ(:9{0b999 I#@#@C#@#@#@xx11S11111   '3    ^^   7<<s++4466D 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7  C*A[#C(8$9::!/2+++HS& ' ' s)B  BBzjson:r&c6t|trt|S|"t|ttt fr|S |jtj|zS#ttf$rtt|cYSwxYw)ahSerialize structured (list/dict) message content for sqlite. sqlite3 can only bind ``str``, ``bytes``, ``int``, ``float``, and ``None`` to query parameters. Multimodal messages have ``content`` as a list of parts (``[{"type": "text", ...}, {"type": "image_url", ...}]``), which raises ``ProgrammingError: Error binding parameter N: type 'list' is not supported`` when bound directly. Returns the value unchanged when it's already a safe scalar, or a sentinel-prefixed JSON string for lists/dicts. Paired with :meth:`_decode_content` on read. ) rr_r rVrAr-_CONTENT_JSON_PREFIXrr(rvrwrr&s rF_encode_contentzSessionDB._encode_contenty#s gs # # 1(00 0 ?j5#u2EFF?N 6+dj.A.AA A:& 6 6 6'G 55 5 5 5 6s A((-BBc2t|tr||jrg t j|t |jdS#tjtf$rt d|cYSwxYw|S)z;Reverse :meth:`_encode_content`; returns scalars unchanged.NzCFailed to decode JSON-encoded message content; returning raw string) rr_r(rrrrr`rvr=rrs rF_decode_contentzSessionDB._decode_content#s gs # # (:(:3;S(T(T  z'#c.F*G*G*H*H"IJJJ()4   +   s-A2BBdisplay_metadatac|sdSt|tr tj|}n7#tjt f$rt dYdSwxYwt|tst ddStj |St|trtj |St dt|j dS)a~Serialize ``display_metadata`` for its TEXT column without double-encoding. Import/replace paths can hand us an already-serialized JSON string (the same hazard ``tool_calls`` guards against above). ``json.dumps`` on that string would store a quoted JSON string, and the single ``json.loads`` on read then yields a ``str`` instead of a dict. Nz+Ignoring non-JSON display metadata on writez-Ignoring non-object display metadata on writez6Ignoring unexpected display metadata type on write: %s) rr_rrr`rvr=rr,r(rkr\)rrs rF_encode_display_metadataz"SessionDB._encode_display_metadata#s  4 & , , & $455()4   LMMMtt fd++ NOOOt:f%% % & - - 0:.// / D ! " " +   ts00A$#A$turn_lease_holderturn_lease_ttl_secondsc 2|r|||}|d|f}| |d|krtd|t j}t |d|kr7|d|t dt |z||f|d|f} | #| d | d d krt|dSdSdS) uFTranscript-append admission checks, run INSIDE the write txn. Shared by :meth:`append_message` and :meth:`append_messages_batch` so the two writers can never diverge on these correctness invariants (this guard has already needed targeted fixes — see the #74478 patience note below). rNrnz7Session turn lease lost; refusing transcript write for r}r*rrrrsrtr)rrrQrrTr-rr) rZrrdrrrrleaser)rfs rF_check_transcript_write_guardsz(SessionDB._check_transcript_write_guards#sa2  "BB4TTOLL, "hjj  }h3D D D/*%**)++CU<())S00  ?c#u-C'D'DEEE'),, D M   (**    #/ %66/ ;; ; //66rLrzc|dS t|trtj|n|}t|trtj|}n7#tjt f$rt dYdSwxYwt|tst ddS|S)aDecode a ``display_metadata`` column into the dict every reader expects. Every message read path must go through this. Returning the raw TEXT instead reaches the desktop as a string, where ``'task_count' in meta`` throws and fails the whole resume. Rows written before the encode guard landed are double-encoded, so unwrap a second layer when we find one. Nz0Ignoring invalid display metadata on message rowz3Ignoring non-object display metadata on message row) rr_rrr`rvr=rr,)rzmetas rF_decode_display_metadataz"SessionDB._decode_display_metadata$s ;4 &0c&:&:C4:c???D$$$ (z$''$i0    NNM N N N44 $%%  NNP Q Q Q4 sAA0BBrDc`|sdSt|tr|Stj|S)u}Serialize a structured reasoning field for its TEXT column. ``reasoning_details`` / ``codex_reasoning_items`` / ``codex_message_items`` arrive as list/dict structures from the live runtime, but callers that round-trip stored rows — ``get_messages`` straight into ``replace_messages``, e.g. the POST /api/sessions/{id}/fork handler — hand back the raw TEXT these columns already hold, because ``get_messages`` only deserializes ``content`` and ``tool_calls``. Re-dumping that TEXT double-encodes it, and the forked session's next ``get_messages_as_conversation`` json.loads then yields the inner string instead of the original list, so every reasoning-replay consumer (all of which check ``isinstance(..., list)``) silently drops it. Strings are therefore stored as-is; structures are dumped. N)rr_rr(rs rF_reasoning_json_textzSessionDB._reasoning_json_text$s8  4 eS ! ! Lz%   rLr#rr8 tool_call_id token_countr reasoningreasoning_contentreasoning_detailscodex_reasoning_itemscodex_message_itemsplatform_message_idobservedeffect_disposition timestamp api_content display_kindc  || | | t|tr4 t j|}n#tjtf$rg}YnwxYw|rt j|nd |tj |u t|dr"t| nt|n2#ttf$rtd|YnwxYwd|&t|t"rt%|nd  fd}|jS)u Append a message to a session. Returns the message row ID. Also increments the session's message_count (and tool_call_count if role is 'tool' or tool_calls is present). ``platform_message_id`` is the external messaging platform's own message ID (e.g. Telegram update_id, Yuanbao msg_id). It is independent of the SQLite autoincrement primary key and is used by platform-specific flows like yuanbao's recall guard to redact a message by its platform-side identifier. ``api_content`` is the exact content string sent to the API for this message when it differs from ``content`` (ephemeral memory/plugin injections, persist overrides). It is a byte-fidelity sidecar for prompt-cache-stable replay — stored as sent, except lone surrogates (which sqlite3 cannot bind and which the conversation loop scrubs from every outgoing payload anyway, so the scrubbed form IS the wire bytes). Nr/Ignoring invalid explicit message timestamp: %rrrqc||dt  tt rdnddttrtndttrtndf}|j} dkr|d fn|df|S)NrrINSERT INTO messages (session_id, role, content, tool_call_id, tool_calls, tool_name, effect_disposition, timestamp, token_count, finish_reason, reasoning, reasoning_content, reasoning_details, codex_reasoning_items, codex_message_items, platform_message_id, observed, active, api_content, display_kind, display_metadata) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)rqrzUPDATE sessions SET message_count = message_count + 1, tool_call_count = tool_call_count + ? WHERE id = ?zBUPDATE sessions SET message_count = message_count + 1 WHERE id = ?)rrrrr_ lastrowid)rrmsg_idrcodex_items_jsoncodex_message_items_jsonrrdisplay_metadata_jsonrrmessage_timestampnum_tool_callsrrrrreasoning_details_jsonr#rZrdstored_contentrrtool_calls_jsonrrrs rFrz%SessionDB.append_message.._do$sV  / /'"3'= 0   \\] " #%i00&%!%i00%&788*$,'!(AAq6@c6R6R\%k222X\7A,PS7T7T^%l333Z^)+ F<%F!! M#Z0  XMMrLr)rrrr_rrr`rvr(rrThasattrr-rrwr=rYrrrr)!rZrdr#r&rr8rrrrrrrrrrrrrrrrrrrrrrrrrrrs!``` ` ````` ``` `` ``` @@@@@@@@rFappend_messagezSessionDB.append_message3$sq`!% = =>N O O!%!:!:;L!M!M445JKK#'#<#<=P#Q#Q  j# & &  !Z 33 ()4     4>H$*Z000D--g66 IKK   [9k229(-i.A.A.C.C(D(D%%(-i(8(8%z* [ [ [ NPYZZZZZ [  !0::t0L0LSS___RSN4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 v"" D=#   s%BB43B4:AD<<,E+*E+ chunk_rowsc &sdS|`t|krMd}tdt|D]*}||||zz }+|Sfd} | jS)uAppend multiple messages atomically in ONE write transaction. ``messages`` is a list of dicts in the same shape :meth:`_insert_message_rows` already consumes for replace/compact/ import (role, content, tool_name, tool_calls, tool_call_id, finish_reason, reasoning*, codex_*, timestamp, api_content, display_kind, display_metadata, ...). Reusing that helper keeps ONE row-serialization path for every multi-row writer. A turn-boundary flush writes the whole turn (user + assistant + tool rows, typically 3-8 messages) as one BEGIN IMMEDIATE / commit pair instead of one transaction (and, off WAL, one fsync) per row. Atomicity contract: all rows land or none do (the caller re-flushes unstamped messages on the next attempt). The same admission guards as :meth:`append_message` run once for the batch — same session, same instant. ``chunk_rows`` bounds the transaction size for LARGE copies (branch seeds can be thousands of rows; measured: 10k rows ≈ 2.4s inside one BEGIN IMMEDIATE because the FTS triggers run per row, which would monopolize the write lock and starve concurrent writers). When set, the batch commits in chunks of at most that many rows — same recovery semantics as the old per-row loops (a mid-copy failure leaves a partial seed), just with bounded lock holds. A turn flush never needs it. Returns the inserted row count. rN)rrrc||\}}|dkr|d||fn|d|f|S)NrrzUPDATE sessions SET message_count = message_count + ?, tool_call_count = tool_call_count + ? WHERE id = ?zBUPDATE sessions SET message_count = message_count + ? WHERE id = ?)rrr) rinsertedtool_calls_totalrr1rZrdrrs rFrz,SessionDB.append_messages_batch.._do$s  / /'"3'= 0   *.)B)Bj(** &H& !## M/<  Xz*OrLr)rrPappend_messages_batchrr) rZrdr1rrrrinserted_totalrrs ````` ` rFrzSessionDB.append_messages_batch$sH 1  !c(mmj&@&@Nq#h--<<  $"<"<U5:#556,C&7+A #=##" !          4"" D=#   rL)rcvrrsdSfd}t|S)a_Stamp presentation metadata on this turn's freshly persisted row. The model still receives ``role`` and ``content`` unchanged. Gateway and CLI synthetic inputs call this immediately after their serial turn has flushed, preserving producer provenance without classifying by content during transcript rendering. Fc |df}|dS|dt|dfdS)NzqSELECT id FROM messages WHERE session_id = ? AND role = ? AND content = ? AND active = 1 ORDER BY id DESC LIMIT 1FzGUPDATE messages SET display_kind = ?, display_metadata = ? WHERE id = ?rT)rrrQrr)rrr&rrr#rZrds rFrz?SessionDB.set_latest_matching_message_display_kind.._do"%s,,JT4#7#7#@#@Ahjj  {u LLY%l33112BCCF   4rLr)rZrdr#r&rrrs`````` rF(set_latest_matching_message_display_kindz2SessionDB.set_latest_matching_message_display_kind%su    5          $D'',,---rL reactionsauthormessage_row_idemojircTrdSfd}|S)apSet (or with ``emoji=None`` clear) *author*'s reaction on one message. iOS Tapback semantics: one reaction per author per message. Re-sending the same emoji clears it, a different emoji replaces it. Returns the message's full reaction list after the write, or ``None`` when the row doesn't exist or isn't part of *session_id*. Nc|d f}|dS |dpi}| j}fdt |t r|ngD}tfdt |t r|ngDd}duo|duo|dk}r9|s7|ttj d|r || j<n| jd|d|r |nd f|S)NESELECT display_metadata FROM messages WHERE id = ? AND session_id = ?rcpg|]2}t|tr|dk0|3Srrr,r@rrsrs rFrz?SessionDB.set_message_reaction.._do..W%sLa&&,-55??f+D+D+D+D+DrLc3xK|]4}t|tr|dk0|V5dS)rNrrs rFr+z>SessionDB.set_message_reaction.._do..]%sX!!T**01uuX&/H/H/H/H/H/HrLr)rrat5UPDATE messages SET display_metadata = ? WHERE id = ?) rrQrr@REACTIONS_METADATA_KEYrrnextrrrTr-r) rrrrrprevious toggling_offrrrrZrds rFrz+SessionDB.set_message_reaction.._doM%s,,W,hjj {t00Q88>BDxx ;<.%s'<<._do%s<<  hjj G  44S9K5LMM HHT%@AA !)T22 )H&x66!#<<11V;;#<<//<!'+HV$"G"223y>BBGNN&)$i$'K%-\\'%:%:%@b/9'3/G/G$OGGR LLO66t<r$r3rNz0AND content IS NOT NULL AND TRIM(content) != '' rpzISELECT id FROM messages WHERE session_id = ? AND role = ? AND active = 1 z!ORDER BY id DESC LIMIT 1 OFFSET ?rNr:rrArQ)rZrdr#rUr text_filterrs rFlatest_message_row_idzSessionDB.latest_message_row_id%s$ T)>>>&1**4CO V > >TV Z  *$$Q"-QQQT3v;;/hjj                &s1vv$&sAA**A.1A.c0||dS)aRow id of the most recent active user message, or ``None``. The agent's default reaction target: "the message that triggered me", so the model never has to thread row ids through a tool call (mirrors the photon adapter's ``_record_last_inbound``). r$)r#)r)rZrds rFlatest_user_message_row_idz$SessionDB.latest_user_message_row_id%s))*6)BBBrLrc|sdS|j5|jdt||f}dddn #1swxYwY|r|dndS)zRole of the active message at *row_id* in *session_id*, or ``None``. Lets a reaction event carry the target's role so a renderer can match a live message that doesn't know its durable row id yet. NzHSELECT role FROM messages WHERE id = ? AND session_id = ? AND active = 1rr)rZrdrrs rFget_message_rolezSessionDB.get_message_role%s  4 Z  *$$ZVj)hjj                 &s1vv$&s=AAActj}d}d}|D]<}|dd}|d} |} |d |d} t| dr"t| } nt| } nE#t t f$r1td|dYnwxYw|dkr|d nd} |dkr|d nd} |dkr|d nd}| | }| | }| |}t| tr4 tj | } n#tjt f$rg} YnwxYw| rtj| nd}|d p|d }|d}|d||||d|d|t%|d|d| |d|d|dkr"t%|dnd|dkr"t%|dnd|||||drdnddt|trt%|ndt|dtr"t%|dnd||df}t|t(r|j |j|d<|dz }| )|t| t,rt/| ndz }t1|dz| dz}>||fS)uInsert *messages* as fresh active rows for *session_id*. Shared by :meth:`replace_messages` (delete-then-insert) and :meth:`archive_and_compact` (soft-archive-then-insert). Runs inside the caller's write transaction (takes the live ``conn``). Returns ``(inserted_count, tool_call_count)``. Does NOT touch sessions.* counters — the caller owns that, since the two flows reconcile counts differently. rr#rr8rNrr3rrrr message_idrrr&rrrrrrrrrqrr_row_idgư>)rTr@rr-rrvrwr=rYrrr_rrr`r(rrrrr,rrrr)rZrrdr1now_tsrrrr#r8rts_valuerrrrrrrplatform_msg_idrr s rFrzSessionDB._insert_message_rows&swN BN BC7769--D..J & ww{##/j"ww{33Hx55<,1(2D2D2F2F,G,G)),1(OO)!:.jjjLL!RTWT[T[\gThThiiiiij@D @S@S(; < < %>?P%Q%Q "#889NOO '+'@'@AT'U'U $ *c** $$!%J!7!7JJ,i8$$$!#JJJ$8BLdj444O-..G#'',2G2G ''-00K,,] ((););<<GGN++#%cggk&:&:;;GG011%GGM**GGO,,?C{?R?R%cggk&:&:;;;X\GK{GZGZ%cgg.A&B&BCCC`d*$,#,,3AA!6@c6R6R\%k222X\BLSWWUcMdMdfiBjBjt%cggn&=&=>>>pt11#'':L2M2MNN+ C<#t$$ /)B!$I MH% '1*d'C'CJC OOO $(9D(@AAFF)))s% AB77?C98C9(F==GGarchive_droppedcX|rdndfd}|dS)u,Atomically replace the stored messages for a session. Used by transcript-rewrite flows such as /retry, /undo, and /compress. The delete + reinsert sequence must commit as one transaction so a mid-rewrite failure does not leave SQLite with a partial transcript. DESTRUCTIVE by default: every row for the session is DELETEd (and drops out of the FTS index). For compaction that must preserve the pre-compaction transcript under the same id, use :meth:`archive_and_compact` instead. Pass ``active_only=True`` to replace ONLY the live (``active = 1``) rows, leaving soft-archived rows (``active = 0`` — e.g. the ``compacted = 1`` turns that :meth:`archive_and_compact` keeps on disk for #38763 durability, or rewind/undo rows) untouched. Callers that share a session id with an agent already running in-place compaction must use this so a full-history rewrite doesn't wipe the rows the agent deliberately archived. ``message_count``/``tool_call_count`` then track the live set, matching :meth:`archive_and_compact`. Pass ``archive_dropped=True`` to SOFT-archive the live rows instead of DELETEing them: the replaced turns stay on disk with ``active = 0``, ``compacted = 0`` — the same "the user took it back" marking :meth:`rewind_to_message` applies — and stay readable via :meth:`get_messages` with ``include_inactive=True``. This is the mode a rewind/edit/regenerate must use: those flows overwrite a transcript the user may not have meant to drop, and a plain DELETE also evicts the rows from the FTS index, leaving nothing to recover from (#82756). It implies active-only handling — already-archived rows are never touched — so ``active_only`` is redundant with it. The rewritten set is inserted as fresh active rows exactly as in the destructive path, so the live view is identical either way; only the durability of the dropped turns differs.  AND active = 1rpc|df}|#|d|ddkrtr|dfn|df|df|\}}|d||fdS) NrrrsrtrzBUPDATE messages SET active = 0 WHERE session_id = ? AND active = 1)DELETE FROM messages WHERE session_id = ?GUPDATE sessions SET message_count = 0, tool_call_count = 0 WHERE id = ?r)rrQrr) rrfrr active_clauserr1rZrds rFrz'SessionDB.replace_messages.._do&s(llH hjj  #J'3L)]::3J???   :M  O OOM LLY    04/H/Hj(00 ,N, LLY!1:>     rLNr )rZrdr1r?rrr s``` ` @rFreplace_messageszSessionDB.replace_messagesc&sdT.9@))b % % % % % % % % % N C     rLc|j5|jd|f}|ducdddS#1swxYwYdS)uxReturn True if the session has any soft-archived (``active = 0``) rows. Cheap existence probe — does not load rows. NOTE: production rewrite paths no longer branch on this (they pass ``active_only=True`` unconditionally — a probe can fail open or race a concurrent ``archive_and_compact``, #80216); kept for tests and diagnostics. zBSELECT 1 FROM messages WHERE session_id = ? AND active = 0 LIMIT 1NrrZrdrs rFhas_archived_messageszSessionDB.has_archived_messages&sZ 1 1Z''T F??$$D0  1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s2AA A c|sdS|5}|d|f}dddn #1swxYwY|rt|dndS)uSMAX(id) of the session's active rows — the compression watermark. Captured at compression START (before the slow provider summary call). Every active row with ``id > watermark`` at commit time arrived concurrently and must survive the compaction verbatim. Returns 0 for an empty/unknown session. rzMSELECT COALESCE(MAX(id), 0) FROM messages WHERE session_id = ? AND active = 1N)rrrQrArs rFget_active_message_watermarkz&SessionDB.get_active_message_watermark&s 1 ^^   ,,6 hjj                 "(s3q6{{{q(s*AAAcompacted_messagesmodel_config_patch lock_holdercLfd}|S)u9 Non-destructive in-place compaction for a single durable session id. Soft-archives the active messages (``active = 0``) and inserts *compacted_messages* as fresh active rows — atomically, in one write transaction. The conversation keeps ONE session id for life (#38763) WITHOUT destroying history: - The live-context load (:meth:`get_messages_as_conversation`, :meth:`get_messages`) filters ``active = 1`` by default, so the model reloads ONLY the compacted set. - The archived pre-compaction turns stay on disk (active=0) and stay DISCOVERABLE: they are marked compacted=1, and search_messages() includes compacted=1 rows by default — so session_search still finds them, unlike rewind/undo rows (active=0, compacted=0) which stay hidden. They remain in the FTS index (the messages_fts* triggers index on INSERT / drop on DELETE and don't key on active/compacted; flipping to active=0 is a content-preserving UPDATE) and are recoverable via get_messages(..., include_inactive=True). Concurrent-append safety (#75316): when *watermark* is provided (the value of :meth:`get_active_message_watermark` captured at compression START), rows that arrived during the slow provider summary call (``id > watermark``) are NOT summarized away. They are re-sequenced after the compacted set by a pure-SQL column clone (every column except ``id`` — content, api_content, platform_message_id, token counts, reasoning sidecars all survive byte-exact, and the FTS triggers index the clones naturally), and the originals are archived. NOTE: re-sequencing assigns the tail rows fresh ids; consumers that reference durable row ids re-resolve by content (see 3e8ab0610). ``watermark=None`` preserves the historical archive-everything behavior. Commit-fence safety: when *lock_holder* is provided, the commit verifies INSIDE the transaction that the compression lock is still held by that holder and unexpired — a compression whose lease was reclaimed (crash cleanup, TTL expiry, competing writer) fails the commit instead of clobbering the winner's transcript. ``message_count`` is set to the ACTIVE count after commit, matching what the live load returns. ``model_config_patch`` is merged into the session's JSON config in the same transaction; a ``None`` value removes that key. Returns the new active count. c t|df}|6|dks*t|dtjkrt ddd}|d}g}d}|d t fD]}|t |d |d }|rm t|trtj |n|}|t|trt|ndz }#tt f$rYwxYw|d f| \}} |rd d|D} d|D} d| } |d| d| d| d||t|z }| |z } |d|| fn|d|| |f|S)Nr|rnr}zCompression lease for z; lost before commit; refusing to publish a stale compactionr_r[rz^SELECT id, tool_calls FROM messages WHERE session_id = ? AND active = 1 AND id > ? ORDER BY idrr8zQUPDATE messages SET active = 0, compacted = 1 WHERE session_id = ? AND active = 1rc3K|]}dVdSrrKrs rFr+z=SessionDB.archive_and_compact.._do..Q's"'>'>'>'>'>'>'>'>rLcg|]}|dv| S))rrrrKrs rFrz>SessionDB.archive_and_compact.._do..R's. ======rLrXrz, active, compacted) SELECT z", 1, 0 FROM messages WHERE id IN (rrzYUPDATE sessions SET message_count = ?, tool_call_count = ?, model_config = ? WHERE id = ?)rrQr-rTrrUrArrrr_rrrrrvrwrrr)rrpatched_model_configrtail_tool_callsrrzrrrrrrrrrrZrdrs rFrz*SessionDB.archive_and_compact.._do 'sG&<<+M(**  $)[88Xl344 CC;IIII $( !- (,'D'D*&8W(E(($#%HO$<<" Y0  (** ! !C OOCD NN333l+C!!8B38L8L%UTZ___RUF+jQU>V>V/]s6{{{\]]OO ):6!!! D! ! LL6     *.)B)Bj"4** &H& 4 #xx'>'>X'>'>'>>> #99$??  99Z00 @X@@&@@$0@@@  CMM) O3 ") ]/<  4/1EzR OsAEE0/E0r )rZrdrrrrrs`````` rFarchive_and_compactzSessionDB.archive_and_compact&s\h` ` ` ` ` ` ` ` ` ` D""3'''rLct|dd}|r|Sd|dD}||_|S)z>Column names of the messages table, cached per-connection era._message_columns_cacheNcg|] }|d SrqrKrrs rFrz3SessionDB._message_column_names..v'sUUU!UUUrLzPRAGMA table_info(messages))rrrr)rZrcachedcolss rFrzSessionDB._message_column_namesq'sZ7>>  MUUdll+HIIRRTTUUU&*# rLcj||fd}||S)uBackfill the ``api_content`` sidecar onto the newest ACTIVE user row. In-place preflight compaction (:meth:`archive_and_compact`) inserts the current turn's user row BEFORE the turn prologue composes the prefetch/plugin sidecar, and the subsequent crash persist identity-skips every compacted dict — without this backfill the stamped sidecar would never land in the DB and any reload would replay clean content, re-introducing the prompt-cache divergence the sidecar exists to close. The ``content`` match is a defensive guard: if the newest active user row is not the message the caller stamped (racing rewrite, unexpected tail shape), nothing is written. Returns the number of rows updated (0 or 1). c^|dtf}|jS)NzUPDATE messages SET api_content = ? WHERE id = (SELECT id FROM messages WHERE session_id = ? AND role = 'user' AND active = 1 ORDER BY id DESC LIMIT 1) AND content IS ?)rrr~)rrrencodedrds rFrz2SessionDB.set_latest_user_api_content.._do's9\\% #;//WE F? "rL)rr)rZrdr&rrr#s ` ` @rFset_latest_user_api_contentz%SessionDB.set_latest_user_api_contentz'sS"&&w// # # # # # # #""3'''rLinclude_inactiveinclude_compactedlatestafter_idc||s|rtd||rtd|rd}n|rd}nd}|dnd} d|| d |rd nd } |g} || ||r#|5} | d|zd z|g} | }dddn #1swxYwYi}|D]l}|d |d|d|d|d|df}||}|"|d|df|d|dfkr|||<mt |d}|r |ddd}||d}| |d|}|r |ddd}n||r | dz } | |dn||g|5} | | | } | }dddn #1swxYwY|r| g}|D]}t|}d|vr| |d|d<|drZ tj |d|d<n;#tjtf$r"t dg|d<YnwxYw|d||d|d<|||S)uLoad messages for a session in insertion order. By default only active messages are returned. Pass ``include_inactive=True`` to load soft-deleted rows (e.g. for audit / debug views of rewound history). See :meth:`rewind_to_message` for the soft-delete mechanic. Pass ``include_compacted=True`` to additionally load rows preserved by in-place context compaction (``active=0, compacted=1``). Those are durable display history, not soft-deleted rows — a user-visible transcript read must not drop them, or earlier turns silently become unreachable once the UI exhausts its active-only window. Soft-deleted Undo/Rewind rows (``active=0, compacted=0``) stay excluded; use ``include_inactive`` for those. Ordered by AUTOINCREMENT id (true insertion order) rather than timestamp — see c03acca50 for the WSL2 clock-regression rationale. When ``limit`` is provided, returns at most ``limit`` messages starting from ``offset`` (0-based, in insertion order). Enables pagination for the API endpoint to avoid loading entire transcripts. With ``latest=True``, the offset is measured back from the newest message and the selected page is still returned in chronological order. ``offset`` alone (without ``limit``) also pages — SQLite requires a LIMIT clause for OFFSET, so it's emitted as ``LIMIT -1`` (unbounded). ``after_id`` enables keyset pagination (``id > after_id``): O(1) page seeks on huge transcripts where OFFSET degrades to O(n) per page. Ascending order only (incompatible with ``latest``/``offset``). Nz2after_id is incompatible with latest/offset pagingzYafter_id is incompatible with include_compacted (deduped display reads use offset paging)rpz" AND (active = 1 OR compacted = 1)rz AND id > ?z+SELECT * FROM messages WHERE session_id = ?z ORDER BY id DESCASCz ORDER BY id ASCr#r&rrr8rrrc|dS)NrrK)rss rFr6z(SessionDB.get_messages..'s qwrL)r8rz LIMIT ? OFFSET ?zDFailed to deserialize tool_calls in get_messages, falling back to []r)rwrrrrr@r9ryrr7r,rrrr`rvr=rr)rZrdr%r&rErUr'r(r  keyset_clauserrFrrall_rowsrrr8r rrrs rF get_messageszSessionDB.get_messages'sRR  V v QRR R  $5 xyy y  .MM  .AMM-M)1)= 2  X X+ X XDJ:U&&PU X X #|   MM( # # # 2 !! -TAMQ()L "??,,  - - - - - - - - - - - - - - -D $ $ K N $' % $ hhsmm;3x=#d)"<H sSWy?Y"Y"Y #DI$++--->->???D "DDbDz=D FUF| "DDbDz F ** U]rrvFGGG!! )Tc622(( ) ) ) ) ) ) ) ) ) ) ) ) ) ) )    Cs))CC!%!5!5c)n!E!EIww|$$ ++(, 3|3D(E(EC %%,i8+++NN#ijjj(*C %%%+ww)**6*.*G*GL^H_*`*`&' MM#     s6:2B88B<?B<+G88G<?G<&J5J<;J<cg}d|D}tdt|dD]}|||dz}ddt|z}|5}|d|d|}dddn #1swxYwY|d |D|S) uTool results in these sessions that mention a GitHub PR url. A candidate scan, deliberately loose: it hands back every tool result containing ``/pull/`` and leaves the caller to decide which ones make a claim (see the desktop's PR recovery, which only accepts an output that is a bare PR url — the signature of ``gh pr create``). Ordered oldest-first per session so the caller can take the last match. cg|]}||SrKrKrss rFrz2SessionDB.find_pr_url_messages..&(s+++Q+q+++rLrirrzVSELECT session_id, content FROM messages WHERE session_id IN (zq) AND role = 'tool' AND content LIKE '%/pull/%' ORDER BY id ASCNc38K|]}|d|ddVdS)rrq)rdr&NrKrs rFr+z1SessionDB.find_pr_url_messages..2(s2SSsA3q6BBSSSSSSrL)rPrrrrrr) rZr0rrrchunkrrrs rFfind_pr_url_messageszSessionDB.find_pr_url_messages(s8')++++++1c#hh,, T TE +,E88C#e**$455L!! T||+.:+++  (**                 LLSSdSSS S S S S s5-B..B2 5B2 around_message_idwindowc8|dkrd}|5}|d||f}|sgdddcdddS|d|||dzf}|d|||f}dddn #1swxYwYt t |t |z}g} |D]} t | } d| vr|| d| d<| d rZ tj | d | d <n;#tj tf$r"td g| d <YnwxYw| d || d | d <| | t#dt%|dz } t%|} | | | dS) uLoad a window of messages anchored on a specific message id. Returns a dict with: - ``window``: up to ``window`` messages before the anchor, the anchor itself, and up to ``window`` messages after, ordered by id ascending. - ``messages_before``: count of messages strictly before the anchor still in the session (== window unless we hit the start). - ``messages_after``: count of messages strictly after the anchor still in the session (== window unless we hit the end). Used by ``session_search`` for both the discovery shape (anchored on the FTS5 match) and the scroll shape (anchored on any message id). The ``messages_before`` / ``messages_after`` counts let the caller detect session boundaries: when either is less than ``window``, the agent has reached one end of the session. Returns an empty window when ``around_message_id`` is not a real id in ``session_id`` — callers decide how to surface that. rz>SELECT 1 FROM messages WHERE id = ? AND session_id = ? LIMIT 1)r7messages_beforemessages_afterNzPSELECT * FROM messages WHERE session_id = ? AND id <= ? ORDER BY id DESC LIMIT ?rqzNSELECT * FROM messages WHERE session_id = ? AND id > ? ORDER BY id ASC LIMIT ?r&r8zKFailed to deserialize tool_calls in get_messages_around, falling back to []r)rrrQrrreversedr,rr@rrr`rvr=rrrrr)rZrdr6r7r anchor_exists before_rows after_rowsrrrrr9r:s rFget_messages_aroundzSessionDB.get_messages_around5(s2 A::F ^^    LLP"J/hjj ! Q"$aPP        ,,+. ;  hjj  *.7  hjj #               2H[))**T*-=-==  Cs))CC!%!5!5c)n!E!EIww|$$ ++(, 3|3D(E(EC %%,i8+++NNe)+C %%% + ww)**6*.*G*GL^H_*`*`&' MM#    a[!1!1A!566Z.,   s*2CACCCE##5FFc |s|S ||}n#t$r|}YnwxYw|r||kr|}|j5|}|h}d}tdD]} |jd|f}n #t$r|cYccdddSwxYw||} |jdtdtd|f}n #t$r|cYccdddSwxYw|nAt|dr|dn|d } | r| |vrn| | | }||n|cdddS#1swxYwYdS) uRedirect a resume target to the descendant session that holds the messages. Context compression ends the current session and forks a new child session (linked via ``parent_session_id``). The flush cursor is reset, so the child is where new messages actually land — the parent ends up with ``message_count = 0`` rows unless messages had already been flushed to it before compression. See #15000. This helper walks ``parent_session_id`` forward from ``session_id`` and returns the descendant in the chain that has the **most recent** messages. Unlike the original logic, it does NOT short-circuit when the starting session already has messages — a descendant that was created by compression may hold the continuation content and should be preferred by the WebUI and gateway for ``--resume`` and session loading. If no descendant (including the starting session) has any messages, the original ``session_id`` is returned unchanged. The chain is always walked via the child whose ``started_at`` is latest; that matches the single-chain shape that compression creates. A depth cap (32) guards against accidental loops in malformed data. N z3SELECT 1 FROM messages WHERE session_id = ? LIMIT 1aCSELECT id FROM sessions AS child WHERE child.parent_session_id = ? AND json_extract(COALESCE(child.model_config, '{}'), '$._branched_from') IS NULL AND json_extract(COALESCE(child.model_config, '{}'), '$._delegate_from') IS NULL AND json_extract(COALESCE(child.model_config, '{}'), '$._reset_from') IS NULL AND NOT rza AND COALESCE(child.source, '') != 'tool' ORDER BY child.started_at DESC, child.id DESC LIMIT 1keysrr) rGrBrNrPr:rrQr rrr) rZrdtiprrbestr[r child_rowrFs rFresolve_resume_session_idz#SessionDB.resolve_resume_session_id(s.   **:66CC   CCC   3*$$J Z0 <0 < G9DD2YY) #) #&*,,M hjjC!&&&%%%%%0 <0 <0 <0 <0 <0 <0 <0 <&?"D & $ 2 2P &=WF\%]%] PPP!  ! !hjjI!&&&%%%%%O0 <0 <0 <0 <0 <0 <0 <0 .)"#=#=AC#=#=#=#=#=#=rLzSELECT $ FROM messages WHERE session_id IN (rrNrdrGrHrI _is_explicit_branch_session_session_lineage_root_to_tiprrr_CONVERSATION_ROW_COLUMNSrr_rows_to_conversation) rZrdrGr%rHrIr0r rrrs rFget_messages_as_conversationz&SessionDB.get_messages_as_conversation(s_4"l  HT%E%Ej%Q%Q H;;JGGK.E4E ^^   88#=#=#=#=#===L<< /$8 / /6B / /! / / /k""  hjj                ")) !/1+ *   s A$B::B>B>a id, role, content, tool_call_id, tool_calls, tool_name, effect_disposition, finish_reason, reasoning, reasoning_content, reasoning_details, codex_reasoning_items, codex_message_items, platform_message_id, observed, timestamp, api_content, display_kind, display_metadata)rIc$g}|D]7}||d}|ddvr6t|tr!t|}|d|d} |r|d |d| d<|dr |d| d<|d r |d | d <|d r"||d } | | | d <|d r |d | d <|d r |d | d <|d r |d | d <|dr |d| d<|drZ t j|d| d<n;#t jtf$r"t dg| d<YnwxYw|dr |d| d<|drd| d<|ddkr_|dr |d| d<|dr |d| d<|d |d| d<|drZ t j|d| d<n;#t jtf$r"t dd| d<YnwxYw|drZ t j|d| d<n;#t jtf$r"t dd| d<YnwxYw|drZ t j|d| d<n;#t jtf$r"t dd| d<YnwxYw|r| || r"| | 9t|}t|}|r2|r0dd lm} | d|} | rtd!| ||S)"apDecode fetched message rows into the OpenAI conversation format. Extracted from get_messages_as_conversation so get_resume_conversations can build the model-fed and display views from one SELECT. ``rows`` must already be ordered by ``id`` (insertion order) and filtered to the desired session set / active state by the caller. r&r#>r$r3)r#r&rNrrrrrrrrr8zKFailed to deserialize tool_calls in conversation replay, falling back to []rrrTr3rrrrz=Failed to deserialize reasoning_details, falling back to NonerzAFailed to deserialize codex_reasoning_items, falling back to Nonerz?Failed to deserialize codex_message_items, falling back to Noner)repair_message_sequenceuRepaired %d message-alternation violation(s) while restoring session %s — durable transcript kept them, see repair_message_sequence)rrr_rrrrrr`rvr=r#_is_duplicate_replayed_user_messagerr6r@agent.agent_runtime_helpersrVr>) rZrrdrGrHrIr1rr&rdecodedrVr?s rFrSzSessionDB._rows_to_conversation%)s P !P !C**3y>::G6{333 7C8P8P3*73399;;v;7;;C +3t9#8!$TI=! 8%(%7M">" :&).&9N#%& 677" :&).&9N#; 4#&{#3K '( F,/0D,E()<  ++(, 3|3D(E(EC %%,i8+++NN#pqqq(*C %%%+() ?$'(=$>L!: '"&J6{k))'@+.+?C({#8'*;'7C $*+7/23F/GC+,*+8837:cBU>V3W3W/00 0)<888'fggg37/0008./<<7;z#F]B^7_7_344 0)<<<<'jkkk7;3444<,-::59ZDY@Z5[5[122 0)<:::'hiii591222:! T%M%MhX[%\%\  OOC 4H==2(;;  (  L K K K K K..tX>>H  2 sH(E5E>=E>0H5III005J('J(4K5L  L c|rgn|}|5}dd|D}|d|jd|dt |}dddn #1swxYwYfd|D}||dd d }||d dd }||fS) uNReturn ``(model_history, display_history)`` for a session resume in ONE SELECT. ``session.resume`` needs two projections of the same lineage: - ``model_history`` — the tip session's active rows, alternation-repaired (the live-replay working conversation). Equivalent to ``get_messages_as_conversation(session_id, repair_alternation=True)``. - ``display_history`` — the full compression lineage (ancestors → tip), verbatim, with replayed-user dedup. Explicit ``/branch`` sessions are excluded from this lineage because their own rows already contain the copied transcript; including the live parent's rows would let messages written to the original after the fork leak into the branch. The display fetch already reads a superset of the model fetch (the tip rows are part of the lineage), so serving both from one lineage SELECT halves the resume's DB work versus two separate calls, with byte-identical output (see test_get_resume_conversations_matches_separate_reads). rc3K|]}dVdSrrKrs rFr+z5SessionDB.get_resume_conversations..)rLrLSELECT session_id, rM) AND active = 1 ORDER BY idNc,g|]}|dk|SrdrKrrsrds rFrz6SessionDB.get_resume_conversations..)s'EEE!q*'D'DA'D'D'DrLFTrNrO) rZrdr0rrrr model_historydisplay_historys ` rFget_resume_conversationsz"SessionDB.get_resume_conversations)s.// ;; ?ZLL22:>>  ^^   88#=#=#=#=#===L<<d&D6B k"" hjj                FEEEtEEE22 !## 3  44 !"$ 5  o--sA!B00B47B4cf||}dd|D}|5}|d|dt |}dddn #1swxYwYt |r|dndS)z7Count active rows that a full resume would materialize.rc3K|]}dVdSrrKrs rFr+z5SessionDB.get_resume_message_count..)"99999999rLz3SELECT COUNT(*) FROM messages WHERE session_id IN (z) AND active = 1Nr)rQrrrrrQrA)rZrdr0rrrs rFget_resume_message_countz"SessionDB.get_resume_message_count)s77 CC xx99[99999 ^^   ,,G(4GGGk""hjj                 S'3q66a(((s :BBB max_messagesc|t}|dkrtd|dkrdS||}dd|D}|5}|d|dg||dzR}dddn #1swxYwYt|r|dnd}||krt|||S) aReturn resume row count or reject a transcript too large to load. ``max_messages=None`` resolves the limit from config (``sessions.max_resume_messages``); 0 disables the guard and returns the (bounded) count without raising. Nr!max_messages must be non-negativerc3K|]}dVdSrrKrs rFr+z/SessionDB.assert_resume_safe..*rfrLzBSELECT COUNT(*) FROM (SELECT 1 FROM messages WHERE session_id IN (z) AND active = 1 LIMIT ?)rq) rMrwrQrrrrQrArT)rZrdrhr0rrrrUs rFassert_resume_safezSessionDB.assert_resume_safe)sb  799L !  @AA A 1   177 CC xx99[99999 ^^   ,,?K1+0|a/00  hjj                c0CFFq11 < ' ',]LII Is65B77B;>B;cr|t}|dkrtd|dkrdS|5}|d||dzf}dddn #1swxYwYt |r|dnd}||krt ||||S)aReturn active row count or reject an unsafe in-memory export. Exporting one session does not include compression ancestors, so this guard deliberately counts only the requested segment. The limited subquery stops as soon as it proves the transcript exceeds the bound. ``max_messages=None`` resolves the limit from config (``sessions.max_export_messages``); 0 disables the guard and returns the active row count without raising. NrrjzYSELECT COUNT(*) FROM (SELECT 1 FROM messages WHERE session_id = ? AND active = 1 LIMIT ?)rq)rRrwrrrQrArc)rZrdrhrrrUs rFassert_export_safezSessionDB.assert_export_safe*s  799L !  @AA A 1  1 ^^   ,,\A-.  hjj                c0CFFq11 < ' ',Z UU Us.A<<BBc|rgS|}t|dkrgS|5}dd|D}|d|jd|dt|}dddn #1swxYwYfd|D}|sgS| |d d S) uGReturn the ancestor-only display messages for a session lineage. These are messages from parent/grandparent sessions (compression ancestors) that appear in the display transcript but NOT in the tip session's model-fed history. Used by ``session.resume`` to build the ``display_history_prefix`` that ``_live_session_payload`` prepends to the live model history. Previously the prefix was calculated as ``display_history[:len(display) - len(raw)]``, but that overcounts when ``repair_message_sequence`` removes messages from the MIDDLE of the tip history (e.g. verification candidates collapsed by the consecutive-assistant merge) — the length difference includes both ancestor messages AND repair-removed tip messages, but the slice only captures the first N display messages (which are tip messages when there are no ancestors), causing duplication. This method returns ONLY the genuine ancestor messages, identified by ``session_id != tip_session_id``. (#65919) rqrc3K|]}dVdSrrKrs rFr+z8SessionDB.get_ancestor_display_prefix..R*rLrLr\rMr]Nc,g|]}|dk|Sr_rKr`s rFrz9SessionDB.get_ancestor_display_prefix..Y*s'JJJqAlOz,I,I,I,I,IrLTF)rdrGrH) rPrQrrrrrRrrrS)rZrdr0rrr ancestor_rowss ` rFget_ancestor_display_prefixz%SessionDB.get_ancestor_display_prefix7*ss(  + +J 7 7 I77 CC {  q I ^^   88#=#=#=#=#===L<<d&D6Bk""  hjj                KJJJDJJJ  I)) !"$ *   sA!CC Cc|sdS|5}|d|f}dddn #1swxYwY|dSt|dr|dn|d}|sdS t |t rt j|n|}n#t jtf$rYdSwxYwt |to!t| dS)aReturn whether *session_id* is a copied user-facing branch. Branches and compression continuations both use ``parent_session_id``, but they have different history semantics: a branch owns a copied transcript, while a compression continuation needs its ended parent's archived rows for display. The durable ``_branched_from`` marker is the existing discriminator written by all branch creation paths. Fr^NrBrr_branched_from) rrrQrrr_rrr`rvr,rr@)rZrdrr raw_configrys rFrPz%SessionDB._is_explicit_branch_sessionc*sV 5 ^^   ,,@ hjj                 ;5,3C,@,@LS((c!f  5 /9*c/J/JZTZ +++PZFF$i0   55 &$''NDeAh>aJ?rLc|s|gSg}|}t}|5}tdD]}|r||vrnx|||||d|f}|n!t|dr|dn|d}dddn #1swxYwYtt|p|gS)Nrz3SELECT parent_session_id FROM sessions WHERE id = ?rBrr) rrrPrrrrQrrr;)rZrdrxrrrr[rs rFrQz&SessionDB._session_lineage_root_to_tip*sa < uu ^^   W3ZZ W W'T//E!!! W%%%llIJ(**;E6=c66J6JV#122PSTUPV W W W W W W W W W W W W W W WHUOO$$4 4sBC  CCrc|ddkrdS|d}t|tr|sdSt|D]}}|ddkr|d|krdS|ddkr-|ds|drdS~dS)Nr#r$Fr&Tr3r8)r@rr_r;)r1rr&prevs rFrWz-SessionDB._is_duplicate_replayed_user_message*s 776??f $ $5'')$$'3'' w 5X&&  Dxx6))dhhy.A.AW.L.Lttxx;..DHHY4G4G.488T`KaKa.uuurLtarget_message_idc|j5|jdf}dddn #1swxYwY|t ddt |}|ddkr)t d|ddd ||d |d <g}fd }||}|j5|jd f}dddn #1swxYwY|r|d |d nd}t|||dS)uSoft-delete all messages with id >= ``target_message_id`` in *session_id*. The target message itself becomes inactive as well so the caller can pre-fill it as the next user prompt without it appearing twice in the replayed transcript. Rewound rows are kept on disk with ``active=0`` for audit / forensic inspection — use :meth:`get_messages` with ``include_inactive=True`` to see them. Returns a dict:: { "rewound_count": int, # number of rows newly flipped to active=0 "target_message": dict, # full row dict of the target "new_head_id": int|None # id of the last still-active row, or None } Raises ``ValueError`` if the target message does not exist in *session_id* or if its role is not ``"user"``. Always increments ``sessions.rewind_count`` — even when the target is already inactive — so the counter accurately reflects the number of rewind operations performed against the session. Idempotent on the ``active`` flag: re-rewinding past the same target is a no-op on row state but still bumps the counter. z6SELECT * FROM messages WHERE id = ? AND session_id = ?Nzmessage z not found in session r#r$z1rewind target must be a 'user' message (got role=z, id=rr&c|df}d|D}|r9dd|D}|d|d||df|S)NzGSELECT id FROM messages WHERE session_id = ? AND id >= ? AND active = 1cg|] }|d SrrKrrs rFrz._do..*333A1Q4333rLrc3K|]}dVdSrrKrs rFr+z;SessionDB.rewind_to_message.._do..*"'9'9'9'9'9'9'9'9rLz,UPDATE messages SET active = 0 WHERE id IN (rzMUPDATE sessions SET rewind_count = COALESCE(rewind_count, 0) + 1 WHERE id = ?)rrr)rrrrrdr}s rFrz(SessionDB.rewind_to_message.._do*s\\B./F 43!2!2333C "xx'9'9S'9'9'999  R<RRR LL     JrLz@SELECT MAX(id) FROM messages WHERE session_id = ? AND active = 1r) rewound_counttarget_message new_head_id) rNr:rrQrwr,r@rrr) rZrdr}r target_rowrewoundrhead_rowrs `` rFrewind_to_messagezSessionDB.rewind_to_message*sS<Z  *$$H"J/hjj                 ;P,PPJPP #YY >>& ! !V + +G>>&))GG2CGGG  !% 4 4Z^^I5N5N O O 9      (%%c**Z  z))R hjj                 &.S(1+2Ihqkkt !\\(&   s#0AA  A /EE Esince_message_idc<fd}||S)zMark inactive messages with id >= *since_message_id* active again. Returns the number of rows flipped back to ``active=1``. Intended for undo-of-rewind and test cleanup; not wired to a slash command in v1. c|df}d|D}|r9dd|D}|d|d|t|S)NzGSELECT id FROM messages WHERE session_id = ? AND id >= ? AND active = 0cg|] }|d SrrKrrs rFrz:SessionDB.restore_rewound.._do..+rrLrc3K|]}dVdSrrKrs rFr+z9SessionDB.restore_rewound.._do..+rrLz,UPDATE messages SET active = 1 WHERE id IN (r)rrrr)rrrrrdrs rFrz&SessionDB.restore_rewound.._do+s\\B-.F 43!2!2333C "xx'9'9S'9'9'999  R<RRRs88OrLr )rZrdrrs `` rFrestore_rewoundzSessionDB.restore_rewound +s8      ""3'''rLrc.dtdd}g}g}|r*|d|||r.R+s'MMMCD**3//MMMrLN) r"rrrrrNr:rr) rZrrErUrselect_with_last_activerzrF ws_clause ws_paramsr~rs ` rFsearch_sessionszSessionDB.search_sessions'+s& M',, M M M    "   0 0 0 MM& ! ! !  %#8#G#G Iy   + + + MM) $ $ $?LT;gll=99;;;RT  ufo&&& Z N NZ''*[[[[ F NMMM6??;L;LMMM N N N N N N N N N N N N N N N N N Ns=AD  DDexclude_childrenc g} g} |r?| t| tdd|r|gnt|pg} | rMdd| D} | d| d| | |rMdd|D} | d| d| ||r.|+rcrLrdrc3K|]}dVdSrrKrs rFr+z*SessionDB.session_count..+rcrLrfrrgrhriryrLrpzSELECT COUNT(*) FROM sessions sN) rrrrrrrrNr:rrQ)rZrrSrrIrJrYrrTrzrFr{rr|r}r~rs rF session_countzSessionDB.session_countX+s2   U  !4 5 5 5  $78H$I$I!S!S!S T T T&,E6(($w}"2E2E  +88#A#A#A#A#AAAL  !@!@!@!@ A A A MM/ * * *  +88#A#A#A#A#AAAL  !D\!D!D!D E E E MM/ * * *  )$6z$B$B !FM   ( ( ( MM- ( ( ( q  !7 8 8 8 MM+ , , ,  3  !1 2 2 2 2! 3  !1 2 2 2?LT;gll=99;;;RT Z ( (Z''(U)(U(UW]^^F??$$Q' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s:8G??HHrc|j5|jd|f}|}dddn #1swxYwYt ||kS)uCheck if at least N sessions exist (archived included). Short-circuits via LIMIT — much cheaper than ``session_count()``, which pays a full index scan for its default ``archived = 0`` filter (measured 543us vs 4us on a 20k-session DB). Archived sessions count: every caller so far asks "has this install ever had sessions", and an archived session is still a created one. Use this instead of ``session_count() >= n`` when the exact count is irrelevant. zSELECT 1 FROM sessions LIMIT ?N)rNr:rrr)rZrrrs rFsession_count_gezSessionDB.session_count_ge+sZ % %Z''(H1$OOF??$$D % % % % % % % % % % % % % % %4yyA~r)rJrYrcg}g}|r?|t|tdd|r|dn|s|d|rdd|nd}|j5|jt d |jd |d |}dddn #1swxYwYd |DS) aReturn a ``{source: count}`` dict via a single ``GROUP BY`` query. Replaces the O(N) ``list_sessions_rich`` histogram loop with an aggregate query. When ``exclude_children`` is False the query uses ``idx_sessions_source``; when True, the child-exclusion predicates require a full table scan (same as ``session_count`` and ``list_sessions_rich``). ``exclude_children=True`` mirrors ``list_sessions_rich`` visibility (roots + branch/reset sessions, excluding sub-agent runs, delegates, and compression continuations) so the source counts match what the Sessions page actually lists. r`rarhriryrLrpNzSessionDB connection is closedzYSELECT COALESCE(NULLIF(s.source, ''), 'cli') AS source, COUNT(*) AS count FROM sessions szC GROUP BY COALESCE(NULLIF(s.source, ''), 'cli') ORDER BY count DESCcdi|]-}t|dt|dpd.S)rrr)r_rArs rFrz5SessionDB.session_count_by_source..+s7KKKsCM""CG (9$:$:KKKrL) rrrrrNr:rrr)rZrJrYrrzrFr~rs rFsession_count_by_sourcez!SessionDB.session_count_by_source+s(   U  !4 5 5 5  $78H$I$I!S!S!S T T T  3  !1 2 2 2 2! 3  !1 2 2 2?LT;gll=99;;;RT Z  z!"#CDDD:%%&"+&&&  hjj                LKdKKKKsAC,,C03C0c|j5|r|jd|f}n|jd}|dcdddS#1swxYwYdS)z2Count messages, optionally for a specific session.z2SELECT COUNT(*) FROM messages WHERE session_id = ?rrNrr s rFrUzSessionDB.message_count+s Z ( ( M++H:-++,KLL??$$Q' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (sAA((A,/A,c|j5|jd||f}|ducdddS#1swxYwYdS)abCheck if a message with the given platform_message_id exists. Uses the idx_messages_platform_msg_id partial index for efficient lookup. Used by the gateway's transient-failure dedupe guard (#47237) to skip re-persisting a user message that was already saved on a prior retry of the same inbound platform message. zOSELECT 1 FROM messages WHERE session_id = ? AND platform_message_id = ? LIMIT 1Nr)rZrdrrs rFhas_platform_message_idz!SessionDB.has_platform_message_id+sZ 1 1Z''K01F ??$$D0  1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s3AA A rfc|ddkrdS|d}|sdS t|trtj|n|}n#t tjf$rYdSwxYwt|tsdS|d}|d}|d}|r ||kp||kS|d up|d uS) uTrue when ``session`` is a branch, delegate, or tool child of its parent. Markers only count as a fork when they point at ``parent_session_id``. Compression copies ``model_config`` onto the continuation (``publish_compression_child`` callers pass ``agent._session_init_model_config``), so a delegate's continuation carries ``_delegate_from=``. Presence-only matching would treat that real continuation as a fork — the same misclassification ``_NON_CONTINUATION_CHILD_FILTER_SQL`` already avoids by binding both markers to the queried parent. rrTrFrru_delegate_fromN)r@rr_rrrvr`r,)rZrfrzrrbranched delegateds rFr z%SessionDB._is_explicit_fork_child_row+s ;;x F * *4kk.)) 5 %/S%9%9B$*S///sCC4/0   55 #t$$ 5KK 344 77+,,GG,--  Cy(BI,B Bt#&?@@F VD\Y66D MM$t* % % % ,,T22 &:,T |kk,''=88  z)) T]$ (**               J   II 11)<<!*JE D!1T!9!9 NN:d+ , , , HHZ% & & & Gt} **1kk,''=882%//wwj\As"5D##D'*D'c<fd}||dS)z9Delete all messages for a session and reset its counters.cd|df|dfdS)Nrr r)rs rFrz%SessionDB.clear_messages.._doG,sJ LL;j]    LLY      rLNr rs ` rFclear_messageszSessionDB.clear_messagesE,s8      C     rLc"|dSdD]2}|||z } |d##t$rY/wxYw |d|dD])} |d#t$rY&wxYwdS#t$rYdSwxYw)aHRemove on-disk transcript files for a session. Cleans up ``{session_id}.json``, ``{session_id}.jsonl``, and any ``request_dump_{session_id}_*.json`` files left by the gateway. Silently skips files that don't exist and swallows OSError so a filesystem hiccup never blocks a DB operation. N)z.jsonz.jsonlTr  request_dump_z_*.json)r%rglob)r7rdrOr)s rFrzSessionDB._remove_session_filesQ,s   F)  F*6f666A D))))     !&&'Jz'J'J'JKK  HHH----D       DD sA* 77BA.-B. A;8B:A;;B B Bc |j5|jd|f}|sgcdddSt |j|g}dddn #1swxYwY|gt |S)aEReturn every session row that :meth:`delete_session` would remove. The requested session is first, followed by its recursively discovered delegate/subagent children. Branch and compression children are not included because deletion preserves them by orphaning their parent reference. rN)rNr:rrQrr9)rZrdrG delegate_idss rFget_session_delete_targetsz$SessionDB.get_session_delete_targetsl,sZ Q QZ''= }hjj    Q Q Q Q Q Q Q Q 7tzJ<PPL  Q Q Q Q Q Q Q Q Q Q Q Q Q Q Q2VL1122s2A)A))A-0A-expected_delete_idscg|t|ndfd}|}|r1D]}|||t|S)uDelete a session and all its messages. Delegate subagent children (``model_config._delegate_from``) are cascade-deleted with the parent so they never resurface in session pickers as orphaned rows. Branch / compression children are orphaned (``parent_session_id → NULL``) so they remain accessible independently. When *sessions_dir* is provided, also removes on-disk transcript files (``.json`` / ``.jsonl`` / ``request_dump_*``) for every deleted session. When *expected_delete_ids* is provided, deletion proceeds only if the parent plus delegate cascade still matches that exact set. This lets export-before-delete callers fail closed if a new delegate appears after they materialize their archive. The delegate tree is re-walked inside the write transaction on purpose (TOCTOU guard); the cost is accepted for correctness. Returns True if the session was found and deleted. Nc|df}|dSht|g}|krdSt |g|df|df|df|dS)NrFzHUPDATE sessions SET parent_session_id = NULL WHERE parent_session_id = ?r!DELETE FROM sessions WHERE id = ?T)rrQrrrr*)rr actual_ids expected_idsremoved_delegate_idsrZrds rFrz%SessionDB.delete_session.._do,s\\= }F  (u'0 |DD -- 5 ' '(A$ (U(U V V V LL.     LLDzm T T T LL._do,sR\\  F""88>>>?Q& &rL)rrr)rZrdr7rr=s`` rFdelete_session_if_emptyz!SessionDB.delete_session_if_empty,sb& ' ' ' ' ' '(%%c**  A  & &|Z @ @ @G}}rLc|sdStd|DsdSggfd}|}D]}||D]}|||S)uDelete every session in *session_ids* in a single transaction. Backs the dashboard's bulk-select-then-delete flow on the sessions page (``POST /api/sessions/bulk-delete``). Mirrors the single-session :meth:`delete_session` contract per row: * Unknown IDs are silently skipped (no 404) — selection state in the UI can race against another tab's delete, and we'd rather succeed-on-the-rest than fail-the-whole-batch. * Delegate subagent children (``model_config._delegate_from``) are cascade-deleted with their parent; branch children are orphaned (``parent_session_id → NULL``) so they stay accessible. * Messages and the session row both go in one ``_execute_write`` call so a partial failure can't leave the DB in a "messages gone but session row still there" state. * On-disk transcript / ``request_dump_*`` files are cleaned up outside the DB transaction when *sessions_dir* is provided, matching :meth:`prune_sessions` and :meth:`delete_empty_sessions`. Returns the count of sessions that actually existed and were deleted (may be less than ``len(session_ids)`` if some IDs were already gone). rc@h|]}t|t||SrK)rr_rs rFrz,SessionDB.delete_sessions..-s-VVV3C9M9MVRUV3VVVrLcdddtz}|d|d}d|D}|sdSddt|z}t |||d|d||d|d||d |d|||t|S) Nrrz%SELECT id FROM sessions WHERE id IN (rcg|] }|d SrrKrs rFrz:SessionDB.delete_sessions.._do..-s???cD ???rLrrrr)rrrrrrr*) rrrrexisting_placeholdersrrrZ unique_idss rFrz&SessionDB.delete_sessions.._do -sn88C#j//$9::L\\G GGGF@?V__->->???H q$'HHS3x==-@$A$A ! ' '(A$(Q(Q R R R LLH/DHHH    LLU=RUUU    LLM5JMMM     4 4T : : :   x ( ( (x== rL)rrr) rZr0r7rrrrrrs ` @@@rFdelete_sessionszSessionDB.delete_sessions,s: 1VV+VVVWW  1!# *," !" !" !" !" !" !" !" !H##C((' : :C  & &|S 9 9 9 9 : :C  & &|S 9 9 9 9 rLc|j5|jd}|dcdddS#1swxYwYdS)uReturn the count of empty, non-active, non-archived sessions. "Empty" = ``message_count = 0`` AND the session has ended (``ended_at IS NOT NULL``) AND is not archived. The ``ended_at`` guard matches the safety contract used by :meth:`prune_sessions`: only ended sessions are candidates for bulk deletion, so a freshly spawned session whose first message hasn't landed yet — or one held open by the live agent — is never sniped out from under the runtime. Backs the ``GET /api/sessions/empty/count`` endpoint that lets the web dashboard hide its "Delete empty" button when there's nothing to clean up, and pre-populate the confirm dialog with the actual count. z_SELECT COUNT(*) FROM sessions WHERE message_count = 0 AND ended_at IS NOT NULL AND archived = 0rNr)rZrs rFcount_empty_sessionszSessionDB.count_empty_sessions8-s Z ( (Z''#F ??$$Q' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s4A  A A czgfd}|}D]}|||S)uJDelete every empty, ended, non-archived session. Mirrors :meth:`prune_sessions`' transactional shape: * Selects candidate IDs first (``message_count = 0`` AND ``ended_at IS NOT NULL`` AND ``archived = 0``) so we never touch a live session or one the user deliberately archived. * Orphans any child whose parent is in the kill list — children of an empty parent are kept and re-parented to ``NULL`` rather than cascade-deleted, matching ``delete_session`` / ``prune_sessions`` semantics so branch/subagent transcripts survive an inadvertent parent cleanup. * Deletes the rows in a single ``_execute_write`` callback so the operation is atomic — a partial failure (e.g. SIGKILL mid-loop) doesn't leave the DB in a "messages-deleted but session-row-still-there" half-state. * Cleans up on-disk transcript files (``.json`` / ``.jsonl`` / ``request_dump_*``) outside the DB transaction when ``sessions_dir`` is provided. Empty sessions don't typically have transcript files, but the gateway can leave a stub ``request_dump_*`` if it crashed before the first reply — so we still sweep, matching ``prune_sessions``. Returns the number of sessions deleted. c|d}d|D}|sdSddt|z}|d|dt ||D]E}|d|f|d |f|F|t|S) NzYSELECT id FROM sessions WHERE message_count = 0 AND ended_at IS NOT NULL AND archived = 0ch|] }|d SrrKrs rFrz?SessionDB.delete_empty_sessions.._do..w-BBB3t9BBBrLrrrrrrrrrrrrrr*)rrr0rrrrZs rFrz,SessionDB.delete_empty_sessions.._dop-s \\#F CB0A0ABBBK q88C#k*:*:$:;;L LL?/;???[!!    # ( (  ?# @3&III""3''''  4 4T : : :{## #rL)rr)rZr7rrrrs` @rFdelete_empty_sessionszSessionDB.delete_empty_sessionsQ-sl:"$  $ $ $ $ $ $@##C(( : :C  & &|S 9 9 9 9 rL)last_active_beforelast_active_afterstarted_before started_afterr title_likertr min_messagesrhr! model_likerPrrr branch_like min_tokens max_tokensmin_costmax_costmin_tool_callsmax_tool_callsr]rrrrrrrrrrrrrrcx dg}g}|*|d|||*|d|||*|d|||*|d|||r*|d|||rM|d|d t|d |r*|d |||r= ?zs.started_at < ?zs.started_at >= ?rz.LOWER(COALESCE(s.title, '')) LIKE ? ESCAPE '\'rzs.end_reason = ?rgzs.message_count <= ?z.LOWER(COALESCE(s.model, '')) LIKE ? ESCAPE '\'z+LOWER(COALESCE(s.billing_provider, '')) = ?z s.user_id = ?z s.chat_id = ?zs.chat_type = ?z3LOWER(COALESCE(s.git_branch, '')) LIKE ? ESCAPE '\'zA(COALESCE(s.input_tokens, 0) + COALESCE(s.output_tokens, 0)) >= ?zA(COALESCE(s.input_tokens, 0) + COALESCE(s.output_tokens, 0)) <= ?z9COALESCE(s.actual_cost_usd, s.estimated_cost_usd, 0) >= ?z9COALESCE(s.actual_cost_usd, s.estimated_cost_usd, 0) <= ?z#COALESCE(s.tool_call_count, 0) >= ?z#COALESCE(s.tool_call_count, 0) <= ?TrhFrizCOALESCE(s.pinned, 0) = 0rL)rrrrrr)rrrrrrrtrrrhr!rrPrrrrrrrrrrr]clausesrFr|r}s rF_prune_filter_wherezSessionDB._prune_filter_where-s\,,  ) NN    MM, - - -  ( NN    MM+ , , ,  % NN- . . . MM. ) ) )  $ NN. / / / MM- ( ( (  " NN> * * * MM& ! ! !  C NNL M M M MMAl:+;+;+=+=>>AAA B B B  & NN- . . . MM* % % %  )$6z$B$B !FM NN6 " " " MM- ( ( (  # NN1 2 2 2 MM, ' ' '  # NN1 2 2 2 MM, ' ' '  C NNL M M M MMAl:+;+;+=+=>>AAA B B B  , NNH I I I MM(..** + + +  # NN? + + + MM' " " "  # NN? + + + MM' " " "  % NN, - - - MM) $ $ $  D NNQ R R R MMBl;+<+<+>+>??BBB C C C  ! NNS    MM* % % %  ! NNS    MM* % % %   NNK    MM( # # #   NNK    MM( # # #  % NN@ A A A MM. ) ) )  % NN@ A A A MM. ) ) ) t   NN+ , , , ,    NN+ , , ,  8 NN6 7 7 7||G$$f,,rLfiltersc|d5|d"|"tj|dzz |d<dSdSdSdS)z@Translate the legacy age window into the shared activity filter.rNrr)r@rT)r(rs rF_apply_prune_age_filterz!SessionDB._apply_prune_age_filter).sh KK, - - 5 ,--5+,0IKK%'-G( ) ) ) 6 555++rLc ||||jdd|i|\}}|j5|jd|d|}d|DcdddS#1swxYwYdS)azReturn the sessions a matching :meth:`prune_sessions` / :meth:`archive_sessions` call would touch, without modifying anything. Backs ``--dry-run`` and pre-confirmation counts. Accepts the same keyword filters as :meth:`_prune_filter_where` (unknown names raise ``TypeError`` there). Rows are ordered oldest-first and carry ``id, source, title, model, started_at, last_active, ended_at, message_count, archived``. ``older_than_days`` is an inactivity threshold: it uses the latest message timestamp, falling back to ``started_at`` for sessions without messages. raSELECT s.id, s.source, s.title, s.model, s.started_at, COALESCE( (SELECT MAX(m.timestamp) FROM messages m WHERE m.session_id = s.id), s.started_at ) AS last_active, s.ended_at, s.message_count, s.archived FROM sessions s WHERE z? ORDER BY last_active ASC, s.started_at ASCc,g|]}t|SrKr,rs rFrz3SessionDB.list_prune_candidates..W.s;;;#DII;;;rLNrK)rrrNr:rrrZr(rrrPrFrs rFlist_prune_candidateszSessionDB.list_prune_candidates7.s" $$_g>>>00JJJ'JJ v Z < <Z''B,1BBB  F<;):):;;; < < < < < < < < < < < < < < < < < A>c ||||jdd|i|\}}|j5|jd||}t |dcdddS#1swxYwYdS)aCount sessions a matching prune/archive would touch. Same filter surface as :meth:`list_prune_candidates` (including the ``include_pinned`` tri-state), but returns only a count. Used by the CLI to report how many pinned sessions are being spared. r&SELECT COUNT(*) FROM sessions s WHERE rNrK)rrrNr:rrArQrs rFcount_prune_matcheszSessionDB.count_prune_matchesY.s $$_g>>>00JJJ'JJ v Z - -Z''@@@&Fv((+,,  - - - - - - - - - - - - - - - - - -sABB Bc ||||jdd|i|\}}d}||stdd|t |d}|j5|jd||}t| dcdddS#1swxYwYdS) aRCount open sessions excluded from a matching bulk prune. This applies every normal prune filter, but inverts only the ``ended_at`` safety guard. It is visibility-only: callers can explain why an otherwise matching session was skipped without making live sessions eligible for destructive pruning. rrz0prune filter lost its ended-session safety guardzs.ended_at IS NULLNrrrK) rrr(rrrNr:rrArQ) rZr(rrrPrF ended_guard open_wherers rFcount_open_prune_matchesz"SessionDB.count_open_prune_matchesm.s2 $$_g>>>00JJJ'JJ v.  ,, SQRR RD%K0@0@0A0A*BDD Z - -Z''EEEvFv((+,,  - - - - - - - - - - - - - - - - - -s0ACC Cc |dd|jd||d|}|D]}||ddt|S)aBulk-archive (soft-hide) every session matching the filters. Same filter surface as :meth:`prune_sessions`, but instead of deleting rows it flips ``archived = 1`` via :meth:`set_session_archived` so each match's compression lineage is archived as a unit (an unarchived compression root would otherwise resurrect the conversation in Desktop's projected list). Nothing is deleted; messages and transcript files are untouched. Returns the number of sessions matched. ``archived`` defaults to ``False`` here (only select rows not yet archived) so repeat runs are idempotent no-ops. r!F)r(rrTrK) setdefaultrr&r)rZr(rrrrs rFarchive_sessionszSessionDB.archive_sessions.s$ :u---)t) +F  >E   7 7C  % %c$i 6 6 6 64yyrLexclude_pinned idle_daysrc ||dkrdStjt|dzz }|rdnd}|j5|jd|dt dd |f}dddn #1swxYwYd |D}|D]}||d t|S) ujArchive every session untouched for at least ``idle_days`` days. "Touched" is the freshest of ``last_activity_at`` and the latest message timestamp (else ``started_at``) — i.e. real recency, not creation time — so a session created long ago but active yesterday is spared, while an old abandoned one (even a still-open one) is swept. Unlike :meth:`archive_sessions`, this method can also archive unended sessions. Guards: * ``pinned = 0`` when ``exclude_pinned`` (the Desktop "keep" flag). * ``archived = 0`` so repeat runs are idempotent no-ops. * only lineage *tips* / standalone rows are candidates (``end_reason <> 'compression'``); a stale tip archives its whole chain via :meth:`set_session_archived`, so we never resurrect an active conversation by matching an old compressed-away root whose live continuation is recent. Returns the number of sessions archived. Never raises for an empty or non-positive ``idle_days`` — it simply archives nothing. Nrr*zAND s.pinned = 0rpz SELECT s.id FROM sessions s WHERE s.archived = 0 AND COALESCE(s.end_reason, '') <> 'compression' z AND rnz? < ? ORDER BY s.started_at ASC cbg|],}t|tjr|dn|d-S)rr)rrRr;rrs rFrz4SessionDB.archive_stale_sessions...s5OOOQ:a55?$1Q4OOOrLT) rTr-rNr:rr"rr&r)rZrrr. pin_clauserrrs rFarchive_stale_sessionsz SessionDB.archive_stale_sessions.sF2   A 1uY//'99+9A''r Z  :%%  044    hjj                PO$OOO 1 1C  % %c4 0 0 0 03xxsAB  BBZc  ||jdd|i|\ g fd}|}D]}|||S)uDelete sessions matching the filters. Returns count deleted. By default, delete ended sessions inactive for ``older_than_days`` days, optionally restricted to ``source``. Activity is the latest message timestamp, falling back to ``started_at`` for sessions without messages. Additional keyword filters AND together — the full set is defined by :meth:`_prune_filter_where`: * ``last_active_before`` / ``last_active_after`` — epoch bounds on the latest message timestamp (falling back to ``started_at``). * ``started_before`` / ``started_after`` — epoch bounds on ``started_at``. An explicit ``started_before`` overrides the default ``older_than_days`` inactivity cutoff; pass ``older_than_days=None`` for no implicit upper age bound. * ``title_like`` / ``model_like`` / ``branch_like`` — case-insensitive substring matches. * ``end_reason`` / ``provider`` / ``user_id`` / ``chat_id`` / ``chat_type`` — exact matches (provider case-insensitive, against ``billing_provider``). * ``cwd_prefix`` — session cwd equals or is under this path. * ``min_messages`` / ``max_messages`` — bounds on message_count. * ``min_tokens`` / ``max_tokens`` — bounds on input+output tokens. * ``min_cost`` / ``max_cost`` — bounds on USD cost (actual, falling back to estimated). * ``min_tool_calls`` / ``max_tool_calls`` — bounds on tool_call_count. * ``archived`` — tri-state: None = both (default), True = only archived, False = only unarchived. Only prunes ended sessions (not active ones). Child sessions outside the prune window are orphaned (parent_session_id set to NULL) rather than cascade-deleted. When *sessions_dir* is provided, also removes on-disk transcript files (``.json`` / ``.jsonl`` / ``request_dump_*``) for every pruned session, outside the DB transaction. rc|d}d|D}|sdSddt|z}|d|dt ||D]E}|d|f|d |f|F|t|S) Nz"SELECT s.id FROM sessions s WHERE ch|] }|d SrrKrs rFrz8SessionDB.prune_sessions.._do../rrLrrrrrrrr) rrr0rrrrZrP where_paramss rFrz%SessionDB.prune_sessions.._do.s \\>>6d6PPfPPP|!#  $ $ $ $ $ $ $ $0##C(( : :C  & &|S 9 9 9 9 rL)dry_runrrrc* dttfd |5} |}dddn #1swxYwY|rdt||ddS|sddgddSd}|rddl}|jd}|j|jj d |}|j 5|j d t|fdddn #1swxYwYt|}td | fd } || }|r(td t|dt|||dS)uPermanently clear bare tool-call marker content (e.g. "[memory]") left in the ``messages`` table by sessions persisted before the #78148 fix in ``agent.conversation_loop``. ``_strip_stale_tool_call_markers`` already repairs this in memory on every session load (see ``_rows_to_conversation``), so running this is optional — but for long-lived sessions the same rows get re-scanned and re-repaired on every resume, which is wasted work and keeps the contaminated bytes sitting in the DB (and in any downstream cache/backup snapshot of it) indefinitely. This rewrites the affected rows once, in place. Only the ``content`` column is touched — ``role``, ``tool_calls``, and every other column on the row are left exactly as they are, so provider tool_call/tool_result pairing is unaffected. Unlike the in-memory repair, this UPDATE is permanent and can't be undone from within the DB. Since ``backup`` defaults to True, a timestamped full snapshot is taken via ``VACUUM INTO`` (safe against a live connection, unlike the raw-copy ``_backup_db_file`` used for malformed-schema repair) before any row is touched — mirroring ``repair_state_db_schema``'s backup-by-default convention for destructive state.db operations. No snapshot is taken when there is nothing to change. With ``dry_run=True``, reports the affected row count/ids without writing or backing up (read-only, no write lock taken). Returns ``{"dry_run": bool, "rows_affected": int, "row_ids": [...], "backup_path": str|None}``. r:c*|d}g}|D]f}|d}t|trGt|r||dg|S)NziSELECT id, content FROM messages WHERE role = 'assistant' AND tool_calls IS NOT NULL AND tool_calls != ''r&r)rrrr_r9r:rr)rraffectedrr&s rF_find_affectedz?SessionDB.purge_stale_tool_call_markers.._find_affected>/s\\[F#%H(( / /i.gs++/0J0T0TU\UbUbUdUd0e0e/OOCI...OrLNT)r rows_affectedrow_idsrKFrrBz.pre-clean-markers-backup-z VACUUM INTO ?z3Backed up state.db to %s before clean-markers writec|}|r?ddt|z}|d|d||S)Nrrz.UPDATE messages SET content = '' WHERE id IN (r)rrr)rrrrs rFrz4SessionDB.purge_stale_tool_call_markers.._doj/sc .&&C "xxc#hh77  T\TTTJrLzIPermanently cleared %d stale tool-call marker row(s) in state.db (#78148))rrArrr&r)rFrrr|rNr:rr_r=r>r) rZrrr affected_idsrKr&rJrrrs @rFpurge_stale_tool_call_markersz'SessionDB.purge_stale_tool_call_markers/sF DI    ^^   0)>$//L 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0  !$\!2!2'#    !"#  &*  \ OOO%))++44_EEE<))<$GGGGD B B ""?SYYLAAA B B B B B B B B B B B B B B Bd))K KKM{ [ [ [     **3//   KK[L!!     ..#&    s# AA A*DD D c|j5|jd|f}dddn #1swxYwY|dSt |t jr|dn|dS)z1Read a value from the state_meta key/value store.rNrDr)rNr:rrQrrRr;)rZr8rs rFget_metazSessionDB.get_meta/sZ  *$$._do/s0 LLHe      rL)rr)rZr8rDrrs `` rFset_metazSessionDB.set_meta/sp   NNHe     F       C     rLworkspaces_rootct|dsdSddkrdSfd}|S)uRetag legacy kanban worker rows from ``cli`` to ``kanban``. Workers used to spawn without ``HERMES_SESSION_SOURCE``, so their runs landed as untitled ``cli`` rows and the sidebar rendered one per attempt labeled with the worker's own prompt. New workers tag themselves; this reclaims the rows already on disk so they drop out of the session lists too. Identified by cwd under the board's workspaces root — a path only the dispatcher ever runs a session in. Gated per workspaces root (``state_meta``) so each board reclaims its own rows exactly once. Returns the number of rows retagged. rrzkanban_worker_source_retagged:rc|dtdzf}|jpd}d||S)NzaUPDATE sessions SET source = 'kanban' WHERE source = 'cli' AND (cwd = ? OR cwd LIKE ? ESCAPE '\')rrrr)rrr~r)rrretaggedgaterrZs rFrz3SessionDB.retag_kanban_worker_sessions.._do/s\\\Of--45F+!H MM$FM 3 3 3OrL)r_rrr)rZrrrrs` @@rFretag_kanban_worker_sessionsz&SessionDB.retag_kanban_worker_sessions/s_%%,,U33 1888 ==  # % %1       ""3'''rLrc>|sgS|dddddd}|j5|jd|dzf}dddn #1swxYwYd |DS) uuReturn ``[(key, value), ...]`` for state_meta keys with ``prefix``. Used by feature stores that persist one row per session under a namespaced key (e.g. ``loop:``) and need to enumerate them across sessions (the gateway's idle /loop wakeup watcher). ``prefix`` is matched literally — LIKE wildcards in it are escaped. rz\\rz\%r[rz=SELECT key, value FROM state_meta WHERE key LIKE ? ESCAPE '\'Nc.g|]}|d|dfS)rrqrKrs rFrz.SessionDB.list_meta_prefix../s%111SQQ 111rL)rrNr:rr)rZrrrs rFlist_meta_prefixzSessionDB.list_meta_prefix/s I..v..66sEBBJJ3PUVV Z  :%%P3 hjj                 21D1111s 2BB B c6d}||dS)uFCreate Telegram DM topic-mode tables on explicit /topic opt-in. This migration is deliberately not part of automatic SessionDB startup reconciliation. Operators must be able to upgrade Hermes, keep the old Telegram bot behavior running, and only mutate topic-mode state when the user executes /topic to opt into the feature. Schema versions: v1 — initial shape (no ON DELETE CASCADE on session_id FK) v2 — session_id FK gets ON DELETE CASCADE so session pruning automatically clears bindings. c|d|dd}|rrpCASCADENrKrs rFr+zHSessionDB.apply_telegram_topic_migration.._do.. 0sQ$$Fj(Hc!fly-H$$$$$$rLa CREATE TABLE telegram_dm_topic_bindings_new ( chat_id TEXT NOT NULL, thread_id TEXT NOT NULL, user_id TEXT NOT NULL, session_key TEXT NOT NULL, session_id TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE, managed_mode TEXT NOT NULL DEFAULT 'auto', linked_at REAL NOT NULL, updated_at REAL NOT NULL, PRIMARY KEY (chat_id, thread_id) ); INSERT INTO telegram_dm_topic_bindings_new SELECT chat_id, thread_id, user_id, session_key, session_id, managed_mode, linked_at, updated_at FROM telegram_dm_topic_bindings; DROP TABLE telegram_dm_topic_bindings; ALTER TABLE telegram_dm_topic_bindings_new RENAME TO telegram_dm_topic_bindings; CREATE UNIQUE INDEX idx_telegram_dm_topic_bindings_session ON telegram_dm_topic_bindings(session_id); CREATE INDEX idx_telegram_dm_topic_bindings_user ON telegram_dm_topic_bindings(user_id, chat_id); r)r2)rrrQr_r rArr.)rrcurrent_versionfk_rows needs_rebuilds rFrz5SessionDB.apply_telegram_topic_migration.._do/s+   ! ! ! Lll<5hjj 29]S__=T=T=V=V]c'!*ooo\]O"",,K(**!$$$&$$$!! !&&6 LLH9     rLNr )rZrs rFapply_telegram_topic_migrationz(SessionDB.apply_telegram_topic_migration/s1T T T j C     rL)has_topics_enabledallows_users_to_create_topicsr'r(c|tjdttdttfdfd}||dS)zEnable Telegram DM topic mode for one private chat/user. This method intentionally owns the explicit topic migration. Ordinary SessionDB startup must not create these side tables. rDr:c|dS|rdndS)NrqrrKrs rF_to_intz5SessionDB.enable_telegram_topic_mode.._to_intW0s}t$111 $rLc |dttfdS)Na INSERT INTO telegram_dm_topic_mode ( chat_id, user_id, enabled, activated_at, updated_at, has_topics_enabled, allows_users_to_create_topics, capability_checked_at ) VALUES (?, ?, 1, ?, ?, ?, ?, ?) ON CONFLICT(chat_id) DO UPDATE SET user_id = excluded.user_id, enabled = 1, updated_at = excluded.updated_at, has_topics_enabled = excluded.has_topics_enabled, allows_users_to_create_topics = excluded.allows_users_to_create_topics, capability_checked_at = excluded.capability_checked_at )rr_)rr+r(rr'r)rs rFrz1SessionDB.enable_telegram_topic_mode.._do\0sf LL LLLLG.//G9::     rLN)r&rTrrrAr)rZrrr'r(rr+r)s ```` @@rFenable_telegram_topic_modez$SessionDB.enable_telegram_topic_modeG0s ++---ikk %8D> %hsm % % % %           4 C     rL)clear_bindingsr.c@fd}||dS)aDisable Telegram DM topic mode for one private chat. When ``clear_bindings`` is True (default) the (chat_id, thread_id) bindings for this chat are also cleared so re-enabling later starts from a clean slate. Set to False if the operator wants to preserve bindings for a later re-enable. Never creates the topic-mode tables from scratch; if they don't exist there is nothing to disable and the call is a no-op. c |dtjtfr&|dtfdSdS#tj$rYdSwxYw)NOUPDATE telegram_dm_topic_mode SET enabled = 0, updated_at = ? WHERE chat_id = ?z8DELETE FROM telegram_dm_topic_bindings WHERE chat_id = ?)rrTr_rRrS)rrr.s rFrz2SessionDB.disable_telegram_topic_mode.._do0s  (Y[[#g,,/ "LLRW +    sAA##A65A6Nr )rZrr.rs `` rFdisable_telegram_topic_modez%SessionDB.disable_telegram_topic_modex0s>        C     rLc|j5 |jdt|t|f}n!#t j$rYddddSwxYw dddn #1swxYwY|dSt|t jr|dn|d}t|S)zDReturn whether Telegram DM topic mode is enabled for this chat/user.z SELECT enabled FROM telegram_dm_topic_mode WHERE chat_id = ? AND user_id = ? NFrpr) rNr:rr_rQrRrSrr;r)rZrrrrps rFis_telegram_topic_mode_enabledz(SessionDB.is_telegram_topic_mode_enabled0s0 Z   j((\\3w<<0  (** +                            ;5$.sGK$@$@L#i..c!fG}}5BA ABA2#B1A22BB Bc@|j5 |jdt|t|f}n!#t j$rYddddSwxYw dddn #1swxYwY|rt|ndS)z?Return the session binding for a Telegram DM topic, if present.z SELECT * FROM telegram_dm_topic_bindings WHERE chat_id = ? AND thread_id = ? NrNr:rr_rQrRrSr,)rZrrrs rFget_telegram_topic_bindingz$SessionDB.get_telegram_topic_binding0sZ   j((\\3y>>2  (** +                            )tCyyyT)r5c|j5 |jdt|f}n##t j$rgcYcdddSwxYw dddn #1swxYwYd|DS)zAll Telegram DM topic bindings for one chat, newest first. Read-only; returns [] if the bindings table doesn't exist yet (does not trigger the topic-mode migration). zSSELECT * FROM telegram_dm_topic_bindings WHERE chat_id = ? ORDER BY updated_at DESCNc,g|]}t|SrKr,rs rFrzCSessionDB.list_telegram_topic_bindings_for_chat..0s***cS ***rL)rNr:rr_rrRrS)rZrrs rF%list_telegram_topic_bindings_for_chatz/SessionDB.list_telegram_topic_bindings_for_chat0sZ   z))A\\O(**  +                             +*T****s4A6;AA6A&A6%A&&A66A:=A:c$|j5 |jdt|f}n!#t j$rYddddSwxYw dddn #1swxYwY|rt|ndS)aReturn the Telegram DM topic binding for a given session_id, if present. Uses the UNIQUE INDEX on telegram_dm_topic_bindings(session_id) for an efficient reverse lookup. Returns None when the session has no binding or the table does not exist yet. z{ SELECT * FROM telegram_dm_topic_bindings WHERE session_id = ? Nr7rZrdrs rF%get_telegram_topic_binding_by_sessionz/SessionDB.get_telegram_topic_binding_by_session0sZ   j((__&  (** +                            )tCyyyT)4A4;AA4A$A4#A$$A44A8;A8cttddifd}||dS)uRemove the binding row for a single (chat, thread) pair. Called when the Telegram Bot API confirms a topic was deleted externally (``Thread not found`` after the same-thread retry already failed). Without this prune, the stale row keeps living in ``telegram_dm_topic_bindings`` and the recovery logic in ``gateway.run._recover_telegram_topic_thread_id`` cheerfully redirects future inbound messages to the deleted topic, causing tool progress, approvals, and replies to land in the wrong place. Issue #31501. When this prune removes the chat's *last* remaining binding, the chat's row in ``telegram_dm_topic_mode`` is also flipped to ``enabled = 0`` in the same transaction. Otherwise the chat would be left in topic mode with zero lanes — and ``gateway.run._recover_telegram_topic_thread_id`` keeps treating the chat as topic-enabled, lobby messages keep hunting for a binding that no longer exists, and a user who disabled topics in the Telegram client (rather than via ``/topic off``) stays stuck until the next send happens to fail. Clearing the flag makes recovery fully stand down once the dead topics are gone. Returns the number of binding rows deleted (0 when the binding was already absent or the topic-mode tables haven't been migrated yet — both are silent no-ops; we never raise from a cleanup hot path). rrcx |df}|jpdd<n#tj$r dd<YdSwxYwdsdS |df}|+|dt jfdSdS#tj$rYdSwxYw)Nz DELETE FROM telegram_dm_topic_bindings WHERE chat_id = ? AND thread_id = ? rrz SELECT 1 FROM telegram_dm_topic_bindings WHERE chat_id = ? LIMIT 1 r1)rr~rRrSrQrT)rrr&rr=rs rFrz4SessionDB.delete_telegram_topic_binding.._do1s  i( $*?#7a  +   #$  7#   LLJ  (** $LLLg.%$ +    s!$(AAAB&&B98B9)r_r)rZrrrr=s `` @rFdelete_telegram_topic_bindingz'SessionDB.delete_telegram_topic_binding0slBg,, NN A,# # # # # # # J C   wrLr) managed_moderCc8|tjtttttfd}||dS)a Bind one Telegram DM topic thread to one Hermes session. A Hermes session may only be linked to one Telegram topic in MVP. Rebinding the same topic to the same session is idempotent; trying to link the same session to a different topic raises ValueError. c |df}|t|tjr|dn|d}t|tjr|dn|d}t |kst | krt d|d fdS)Nz SELECT chat_id, thread_id FROM telegram_dm_topic_bindings WHERE session_id = ? rrrrqz3session is already linked to another Telegram topicaI INSERT INTO telegram_dm_topic_bindings ( chat_id, thread_id, user_id, session_key, session_id, managed_mode, linked_at, updated_at ) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(chat_id, thread_id) DO UPDATE SET user_id = excluded.user_id, session_key = excluded.session_key, session_id = excluded.session_id, managed_mode = excluded.managed_mode, updated_at = excluded.updated_at )rrQrrRr;r_rw) rexisting_session linked_chat linked_threadrrCr)rdrrrs rFrz*SessionDB.bind_telegram_topic.._doQ1s#||    hjj  +=GHXZaZe=f=f.y99l|}~l AKL\^e^iAjAj!D 0 = =qABCqD {##w..#m2D2D 2Q2Q$%Z[[[ LL        rLN)r&rTr_r) rZrrrrrdrCrr)s `````` @rFbind_telegram_topiczSessionDB.bind_telegram_topic91s ++---ikkg,, NN g,,+&& __ % % % % % % % % % % % L C     rLc|j5 |jdt|f}n!#t j$rYddddSwxYw dddn #1swxYwY|duS)aMReturn True if a Hermes session is already bound to any Telegram DM topic. Read-only: does NOT trigger the telegram-topic migration. If the topic-mode tables have not been created yet (i.e. nobody has run ``/topic`` in this profile), the session is by definition unbound and we return False. z SELECT 1 FROM telegram_dm_topic_bindings WHERE session_id = ? LIMIT 1 NF)rNr:rr_rQrRrSr=s rF#is_telegram_session_linked_to_topicz-SessionDB.is_telegram_session_linked_to_topicy1sZ   j(( __& (**+                           $r? )rEc |j5 |jdtdt ddt |t |f}nw#tj $re|jdtdt ddt |t |f}YnwxYwdddn #1swxYwYg}|D]R}| |}t| dd|d <| |S|S) uGList previous Telegram sessions for this user that are not bound to a topic. Read-only: does NOT trigger the telegram-topic migration. If the topic-mode tables are absent, fall back to a simpler query that just returns this user's Telegram sessions — there can't be any bindings yet. z SELECT s.*, COALESCE(sp.prompt, s.system_prompt) AS _system_prompt_resolved, COALESCE( (SELECT a7 FROM messages m WHERE m.session_id = s.id AND m.role = 'user' AND m.content IS NOT NULL ORDER BY m.timestamp, m.id LIMIT 1), '' ) AS _preview_raw, rna AS last_active FROM sessions s LEFT JOIN system_prompts sp ON sp.hash = s.system_prompt_hash WHERE s.source = 'telegram' AND s.user_id = ? AND NOT EXISTS ( SELECT 1 FROM telegram_dm_topic_bindings b WHERE b.session_id = s.id ) ORDER BY last_active DESC, s.started_at DESC LIMIT ? ae AS last_active FROM sessions s LEFT JOIN system_prompts sp ON sp.hash = s.system_prompt_hash WHERE s.source = 'telegram' AND s.user_id = ? ORDER BY last_active DESC, s.started_at DESC LIMIT ? Nrorprp)rNr:rrr"r_rArrRrSr/r!r-r)rZrrrErr>rrfs rF(list_unlinked_telegram_sessions_for_userz2SessionDB.list_unlinked_telegram_sessions_for_user1sZ6 6 5 z)) &9 2#660\\3u::.34(**56+   z)) &9 2#66(\\3u::.+,(**- ;6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 p*, % %C,,S11G!/ NB0O0O!P!PGI  OOG $ $ $ $s6C0A"A-,C0-A1C!C0 C!!C00C47C4ruc |j5|j ddddS|jdd}|jdd}dddn #1swxYwYt |t |zS#t $r&}t d|Yd}~dSd}~wwxYw)u3Database size in bytes as SQLite itself accounts for it. ``page_count * page_size`` — the size the main DB file will have once the WAL is checkpointed back into it. Prefer this over ``os.path.getsize(db_path)`` when reporting the effect of a VACUUM. In WAL mode a VACUUM's rewrite lands in the ``-wal`` file, and the checkpoint that folds it back is refused while any other connection (a live gateway) holds a read-mark. Until that happens the main file on disk still carries its pre-VACUUM size and keeps growing, so a stat()-based before/after delta understates the win and can go negative — the "reclaimed -3820.1 MB" report on a database that had actually shrunk 60%. Returns None if the pragmas cannot be read. Nrrrz"Could not read logical DB size: %s)rNr:rrQrArBr=rY)rZrrr\s rFrzSessionDB.logical_size_bytes1s["  Q Q:% Q Q Q Q Q Q Q Q"Z//0CDDMMOOPQR  J../ABBKKMMaP  Q Q Q Q Q Q Q Q Q Q Q Q Q Q Q z??S^^3 3    LL=s C C C44444 sEB9 B B9A$B B9BB9B!B99 C)C$$C)cDd} |}n2#t$r%}td|Yd}~nd}~wwxYw|j5 |jdn2#t$r%}td|Yd}~nd}~wwxYw|jd |jdn2#t$r%}td|Yd}~nd}~wwxYwdddn #1swxYwY|S) uRun VACUUM to reclaim disk space after large deletes. SQLite does not shrink the database file when rows are deleted — freed pages just get reused on the next insert. After a prune that removed hundreds of sessions, the file stays bloated unless we explicitly VACUUM. VACUUM rewrites the entire DB, so it's expensive (seconds per 100MB) and cannot run inside a transaction. It also acquires an exclusive lock, so callers must ensure no other writers are active. Safe to call at startup before the gateway/CLI starts serving traffic. FTS5 segments are merged first via :meth:`optimize_fts` so the subsequent VACUUM reclaims the pages freed by the merge. This is a layout-only optimization — search results are unchanged. Returns the number of FTS indexes that were optimized (0 if the merge step failed or no FTS tables exist). rz%FTS optimize before VACUUM failed: %sNrz1WAL checkpoint (PASSIVE) before VACUUM failed: %srzPRAGMA wal_checkpoint(TRUNCATE)z1WAL checkpoint (TRUNCATE) after VACUUM failed: %s) optimize_ftsrBr=rrNr:rrY)rZ optimizedr\s rFvacuumzSessionDB.vacuum2s.  I))++II I I I NNBC H H H H H H H H IZ W W  W ""#CDDDD W W W PRUVVVVVVVV W J  x ( ( ( W ""#DEEEE W W W PRUVVVVVVVV W) W W W W W W W W W W W W W W W,sz AAADA/.D/ B9BDBD<CD D!D<DDDDDretention_daysmin_interval_hoursrSmin_vacuum_interval_dayscdddd} |d}tj}|r; t|} || z |dzkrd|d<|Sn#ttf$rYnwxYw|||} | |d <|d } d} | r4 |t| z |d zk} n#ttf$rd} YnwxYw|rx| dkrr| rp |d|d <|d t|n2#t$r%} t d | Yd} ~ nd} ~ wwxYw|dt|| dkr't d| ||d rdndnD#t$r7} t d| t| |d<Yd} ~ nd} ~ wwxYw|S)uDIdempotent auto-maintenance: prune inactive sessions + optional VACUUM. Records the last run timestamp in state_meta so subsequent calls within ``min_interval_hours`` no-op. VACUUM has its own, typically longer, throttle controlled by ``min_vacuum_interval_days`` so routine pruning does not repeatedly rewrite the database. Designed to be called once at startup from long-lived entrypoints (CLI, gateway, cron scheduler). When *sessions_dir* is provided, on-disk transcript files (``.json`` / ``.jsonl`` / ``request_dump_*``) for pruned sessions are removed as part of the same sweep (issue #3015). Never raises. On any failure, logs a warning and returns a dict with ``"error"`` set. Returns a dict with keys: - ``"skipped"`` (bool) — true if within min_interval_hours of last run - ``"pruned"`` (int) — number of sessions deleted - ``"vacuumed"`` (bool) — true if VACUUM ran - ``"error"`` (str, optional) — present only on failure Fr)skippedprunedvacuumedlast_auto_pruneTrZ)r(r7r[ last_vacuumrr\zstate.db VACUUM failed: %sNzFstate.db auto-maintenance: pruned %d session(s) inactive for %d days%sz + VACUUMrpz$state.db auto-maintenance failed: %sr) rrTr-rvrwrrSrr_rBr=rr>)rZrVrWrSr7rXrlast_rawr)last_tsr[last_vacuum_raw vacuum_duer\s rFmaybe_auto_prune_and_vacuumz%SessionDB.maybe_auto_prune_and_vacuum52s}<.3aU!S!S7 '}}%677H)++C #HooGW}'9D'@@@,0y)% A":.D(( .))F &F8 #mmM::OJ &&"%o(>(>">C[^cCc!cJJ!:.&&&!%JJJ& F&1***FKKMMM)-F:&MM-S:::: FFFNN#?EEEEEEEEF MM+SXX 6 6 6zz \"#)*#5=KK2   ' ' ' NNA3 G G G!#hhF7OOOOOO '  s*F!!AF!A*'F!)A**8F!#B=<F!=CF!C F!!= %s daysz state.db auto-archive failed: %srN) rrTr-rvrwrrr_r=r>rBr) rZrrWrrr`r)r!r\s rFmaybe_auto_archivezSessionDB.maybe_auto_archive2sa(.3!B!B '}}%899H)++C U8__,/AD/HHH,0y)% I":.D22.3H"*F:  MM-s3xx 8 8 8!|| S  ' ' ' NN=s C C C!#hhF7OOOOOO ' s;*C AC A'$C &A''A$C D -DD c<fd}||S)zMark a session as pending handoff to the given platform. Returns True if the row was found and not already in flight; False if the session is already in a non-terminal handoff state. cJ|df}|jdkS)NzUPDATE sessions SET handoff_state = 'pending', handoff_platform = ?, handoff_error = NULL WHERE id = ? AND (handoff_state IS NULL OR handoff_state IN ('completed', 'failed'))rr)rr rrds rFrz&SessionDB.request_handoff.._do2s5,,Q :&C.3s'FFF!D**1--FFFrL)r:rrrB)rZr s` rFlist_pending_handoffszSessionDB.list_pending_handoffs2sm *$$,CGFFFs||~~FFF F   III s9= A  A c8fd}||S)uCAtomically transition pending → running. Returns True if claimed.cH|df}|jdkS)NzXUPDATE sessions SET handoff_state = 'running' WHERE id = ? AND handoff_state = 'pending'rr)rr rds rFrz$SessionDB.claim_handoff.._do3s/,,= C ._do3s- LL4      rLNr rs ` rFcomplete_handoffzSessionDB.complete_handoff3s8      C     rLc@fd}||dS)z/Mark a handoff as failed and record the reason.cH|dddfdS)NzLUPDATE sessions SET handoff_state = 'failed', handoff_error = ? WHERE id = ?r$r))rrrds rFrz#SessionDB.fail_handoff.._do#3s8 LL1ttj)     rLNr )rZrdrrs `` rF fail_handoffzSessionDB.fail_handoff!3s>       C     rLrrUr)r:r)NNNNNNNNNNNNNN)T)r)NNF)NN)r)r)r)rrNrrrNNNNNNNNrF)rN)NNNNrRrFrTFFFNNFFNF)Nr)NNNNNNNNNNNNFNNNNNNNr)NNNr)FF)NNN)FFNrFN)r5)FFFF)NrRrN)NNNrFFFNr)rNN)rrTTNrU)r rTT( r\r]r^rrDrr;rrrrrHrIrr_FTS_MERGE_MAX_PAGES_PER_INDEX_FTS_MERGE_COMMANDS_PER_PASS_IMPORT_MAX_SESSIONS _IMPORT_MAX_MESSAGES_PER_SESSION_IMPORT_MAX_TOTAL_MESSAGES_IMPORT_MAX_SESSION_BYTES_IMPORT_MAX_TOTAL_BYTESr staticmethodrr_r'r*rRr;rrr/ Connectionr1rrrYrwrtr{rrrrSrrCursorrrrrrrrrr-rrrrrrrrrrrqr_FTS_REBUILD_CHUNK_ROWS_FTS_REBUILD_DUTY_FACTOR_FTS_REBUILD_MIN_PAUSErrrrr rrrrrr'r/rrAr5rr>rGrOrQrcrmrprwryrrrrrrrrrrrrrrrrrrrrrr rrrr'r+r.r0rr<rBrGrLrOrYrUrdrgrortrwrrrrrrrDrrrrrrrrrrrrFrrrrrrr classmethodrrrr rrrrrr r&r+r/r3r8r:r>rDrG frozenset_SESSION_COMPACT_EXCLUDEDrH__annotations__rQrrrrrrrrrrrrrrrrrrrrrr rrrrr$r/r4r?rFrTrRrSrcrgrlrnrsrPryrQrWrrrrrrrUrr rrrrrr:rrrrrrrrrrrrrr rrrrr&r-r2r4r8r;r>rBrIrKrN _FTS_TABLESrrSrdrgrjrprsrvryr|rKrLrFrr s:H#' "% # ###!#!%%("#$ '-$!' /."&(3-HSM\   \ w{tCH~\R1C(DRRRR\Rn5n5n5n5n5n5n5d [); <[[[[z    ))))2)Xg.@%A))))*++^+^ (@ T   \   7+C      \  &'.&T&&&\&2  W-E  $       '*B  t     t,t,t,t,l7>d\   <'+NN g()1, -NUON NNNN`+0 888888t 2G,A 2d 2 2 2\ 2/G,A/d////b7(=7$7777rGGGG>8T,5,5,5\`"" )&d"'+!%)!% ! #~O~O~O~O ~O 38n ~O  ~O~Oc]~O~O~O~O~O~O~O~O !~O"#~O$ %~O~O~O~O@c .3@!@!@!@! @!  @!  @!@!@!@!@!@!(,@! @!@!@!@!D!!s!t!t!!!!(BD!!!!,/!;>! !!!!:8:!!!CH~!14! !!!!.<>AAASA$sCx.AAAA8: ! ! ! I !14 !  ! ! ! !2'"'2' d38n 2'2'2'2'hCSJ(, ****tn * sCx ****F#' '9'9'93-'9 '9 d38n  '9'9'9'9\$(!% 0"0"0"0" 0" C= 0" # 0" #0"0"0"0"l"&%)!%#'#'s<s<s<s<# s< c] s< # s<C=s<C=s< $sCx. !s<s<s<s !C ! !PT ! ! ! !N# ,,,, ,  ,,,,d# VVVV V  VVVVp34$O$O$O$O$O$OL J# J# J J J J$#&* 3E3E3E3E3E  3E UO 3E 3E3E3E3Et#$'*.2$'GPGPGPGPGP  GP  GP %GP',GP"GP GPGPGPGP\# .....  .  ..... !S !# !$ ! ! ! !IcIhsmIIII(#-M &*37 -M-M-M-M UO-M c] -M /0 -M -M-M-M-M^.M.M.M.M.M.M`  s  xS#X7O     & $ !!!!} !  !!!!, ! !.6sm !  ! ! ! !FJ1!1!1!&)1!5=c]1! 1!1!1!1!r! .6.6.6.6CH~ .6  .6.6.6.6`!!&*38n! !!!!49=((($'(25( ((((, $"&26&*)!)!)!)!} )! 3- )!  S#X/ )!sm)!)! )!)!)!)!V!3!!$!!!!6*8DcN+C****\*"2phtCH~.F2p4PSUXPX>2p2p2p\2pt'+ !!!!!!!! !!  !! sm !! !!!!!!!!h I! 3;S3;t3;3;3;3;j11%1$1111f8888<U3S#X3F-G(HT04%T#s(^ 3454 eCc3h'( )4444<4848u4848484848l!""# !.2+/%)%))-*.*.&*%g!g!g!g! g!  g!  g! g!g!%UOg!"%g!c]g!c]g!"#g!#3-g!#3-g! sm!g!"#g!$%g!& 'g!g!g!g!x'd d d d } d #3- d #3-d smd d d d  d d %UOd "%d c]!d "c]#d $%d &'d ( )d d d d R           $*.*.!""# !.2@!@!@!@!@! } @! #3- @!#3-@!@!@!@! @!@!%UO@!@! @!@!@!@!D  7G SV    >%-%-%-%-%-N2J < < < <chsm:!(C!(C!(!(!(!(F:c:hsm::::D!* JJJ!!04x}33378SXNNNNDN]abeglbl]mNNNN>!%)!&!")-%*!&# "$$'xxxcxc x  x  xxxx#'x#xxxxx !x"#x$%x&'x( d38n )xxxxt -9- c3h----n' 6c 6c 6 6 6[ 6D c c   [ 38C=\B,0(- =<=<=<"*# =< $C= =< !& =< =<=<=<=<~chtCH~.F\,!C!HSM!!!\!2 !!%!%%)#'#',0%)&*5915+/(-1N N N N  N  N  N N N N N N N  #N !N !N !N "%SM#N $%N &c]'N (sm)N *#4S>2+N ,"*#-N .$C=/N 0!&1N 2 3N N N N h26+/$((-O O O tCH~&O "*# O $C= O SM O !&O  O O O O f6: . . . .(+ .69 .IL ."4S>2 .  . . . .J) =(=(=(=(=(} =(  =( $tCH~& '=(=(=(=(~dd/2d d38n dddd,179.9.9.9.*-9. d38n 9.9.9.9.x/5A\` ' ' ' '(+ '>A 'UY ' # ' ' ' 'DCSCXc]CCCC'3'' ''''"[*S[*DcSVhDX[*]bcfhkck]l[*[*[*[*B" % S!S!S!tCH~&S! S!  S!  S!S!S!S!j 1 1 1 1 1 1)s)s)))),8<#'%) V(V(V(!c3h0V(%T#s(^4 V( C= V( c] V( V(V(V(V(pT#Y(((+(:=( ((((F"'"'#"&@@@@ @ } @  @@3-@ d38n @@@@DS d4S>>R: N N N N  N c3h N N N N `\>R* * * * XOcOdOOOO6 @ @ @ @ @ @5s5tCy5555, d4S>6J QUVY[^V^Q_ dh   \ "U U 25U c3hU U U U n(#((((((<! +N+N+N+N +N  +N d38n  +N+N+N+Nf!!"!&#!&%);(;(;(c;( ;(  ;(  ;(;(;(c;( ;(;(;(;(z#d&"'#!& +L+L+L+L +L  +L c3h +L+L+L+LZ ( ( (s ( ( ( (11471 1111,=4S>=d====<JtCH~J$JJJJ+B#+B$s)+B+B+B+BZ ! ! ! ! ! !HTNPT\43S3T#Y3333((,37 999tn9&d3i0 9  9999|(,***tn*  ****^(,RR#YRtnR RRRRh(c((((6(,BBtnB BBBBH/3-1*.)- $$($($(&*&*#'$("&!%!%#'%)$($($($((,(,$3Q-Q-Q-$UOQ-$E?Q-! Q-   Q-  Q-SMQ-SMQ-SMQ-smQ-smQ-4.Q-SMQ-3-Q-#Q- #!Q-"C=#Q-$c]%Q-&SM'Q-(SM)Q-*5/+Q-,5/-Q-.! /Q-0! 1Q-23Q-4 sDy 5Q-Q-Q-\Q-f !% 37S>     \ ,0 < <!% < < d38n  < < < !>!>!>! >!  >!  >!>!>! >!>!>!>!@6 KKKK K  K d38n  KKKKfOKHSM833333n!"$'+(* XXX X X tn X #& X c3hXXXXx"$# 333 3 3 c3h 3333B(#((((((&CHT#s(^4L.tDcN';$ ( ( ( ( ( (!3!4!!!!!s!3!4!!!!!!rLrc&eZdZdZd dZdefdZdS) AsyncSessionDBuAsync door onto SessionDB: offloads each call via asyncio.to_thread so a blocking SQLite call never freezes the event loop. Generic forwarder — the audit confirms no method returns a live cursor/generator.rrr:Nc||_dSr)_db)rZrs rFrYzAsyncSessionDB.__init__/3s rLr|c^t|j|tsSfd}|S)Nc>Ktjg|Ri|d{VSr)asyncio to_thread)argsrattrs rF _offloadedz.AsyncSessionDB.__getattr__.._offloaded73s: *4A$AAA&AAAAAAAA ArL)rrcallable)rZr|rrs @rF __getattr__zAsyncSessionDB.__getattr__23sMtx&&~~ K B B B B BrL)rrr:N)r\r]r^rrYr_rrKrLrFrr,3sOZZrLr)r)rAr)rrr contextlibrrirloggingrxrOrFrrRrrLrTr collectionsrrpathlibragent.memory_managerrr:ragent.message_sanitizationr agent.skill_commandsr r r hermes_constantsr hermes_cli.sqlite_runtimerrmtypingrrrrrrrrhermes_state_commonrrrrrrrrrr r!r"r#r$rr%r&r'r(r)r*r+r,r-r.r/r0r1r2r3r4hermes_state_portabilityr5hermes_state_schemar6hermes_state_searchr7rzrE getLoggerr\r=rJrQr_rArGrMrRrwrTrccompilersrmrrrrrobjectrVrrrrrrrrrrrQrrrrrrrrrrrrrrr rrrHr`rrMrrrrrrrr!r/r0r6r9r;r@rJrr^rarfrirrsr{rSr}rrrrrrBrrrrrrjrrrrPERSISTENCE_ERROR_CAUSESrrrrrrrrrr_MAX_MALFORMED_BACKUPSr rrrr-r:r?rQrlrrrrrrrrrrrrrrrrrrrrrSESSION_STATUS_EMPTYrr rrrKrLrFrs{         %%%%%%111111555555;;;;;; -,,,,,LKKKKKKKKKKKKKKKKKKK@=<<<<<222222222222MMMM FFF  8 $ $!!cSS.cc                   #-"*-G"H"HEsEsEEEE-S-T----`LSLSLLLLtCH~(3-"HHSHcHHHH#FHH$)VX$677 3 5d3i+@    suS$s)^'<$6$s)6S 6666@ S d3i     GCLL!/##j0  $**$****\ < 68 %c "27778D>F5t#666 $((4.'''ST4d: "$ " " " " d    6d6$646666& D T    ~)#'(3-&&&& (( (+suuCH,,,*IN,,),SX---+Y^--hsm"Xc] EtCH~E$EEEE&4S>" $sCx.8(RZ(IJJGDcNGtGGGG,4S>" $sCx.2''#'UX''''.& 2&x}&&&&R$@ 2$@t$@$@$@$@N  '*<       F '*<     >%) 1 15/ 1  1 1 1 1 #    8c88884     '2   " qqq  qq q  qqqqh!G$6!c!c!!!!P! AAA  AA A  AAAAH@ ''''' '  ''''TSyT@;;;  ;; ;;;;h%(CEES)))%y~'' S} S S S S S 8- 8D 8 8 8 8$CMC/$6C4CCCC*$DcDDDDN 4 D    8 %lg%  JJJJJZIg0ITIIIIR#$EE$EEEE T o    *:4D&FJ%K%K%K %K $%K3B%K %K%K%K%KP = =, = = = =9O V Vd V# VSW V V V VI2TI2&LI2I2I2I2^W W W W W  W W W W t{t{ {{{{|=AWWWDWTWT#s(^WWWWtY Y"Y,0cNY #s(^YYYY| )V8$8888'"42     L   IIIII,III     (C         H'*$+$+$+ $+ #$+26$+ $+$+$+$+NoTohtnoooojJDJT#s(^JJJJZdx}L%*" "L"L"LMM# 3-##C=# ####8T\!T\!T\!T\!T\!"$68OT\!T\!T\!nxs%C**C43C4