|+jq UdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ddl m Z mZddlmZmZmZmZmZmZmZmZmZddlmZdd lmZmZdd lm Z dd lm!Z"ej#e$Z%eZ&ddZ'ddZ(dddZ)gdZ*de+d<dZ,ddddZ-dd!Z.dd$Z/dd'Z0dd*Z1d+Z2 ddd1Z3dd5Z4dd9Z5e&6d:edd;<ed=edd><edd?<edd@<fddEZ7e&6dFededdG<eddH<fddKZ8GdLdMeZ9e&:dNedfddPZ;dQZe&:dTedVededfddZZ?e&6d[edfdd^Z@e&Ad[edfdd_ZBGd`daeZCe&DdFedfddbZEe&AdFedfddcZFddeZGddgZHGdhdieZIe&:djedfddkZJGdldmeZKe&:dnedfddoZLe&AdnedVedVedfddrZMGdsdteZNe&:duedfddvZOe&6dwedd><eddx<fddzZP ddlQZRn #eS$rdZRYnwxYwe&6d{edd><fdd|ZTe&6d}edd><fddZUe&6dedd><fddZVGddeZWe&:dedd><fddZXGddeZYe&:dedfddZZGddeZ[e&:dedfddZ\GddeZ]e&:dedfddZ^e&6ddZ_ddZ`ddZaddZbe&6dededfddZce&:dedfddZde&AdedfddZee&6dedfddZfe&6dedfddZge&6dedddedfddZhe&:ded=eddedfddZiGddeZjGddeZkddZle&6ded=fddZme&:dddZne&DdddZoe&Aded=d<fddZpe&:ddd„ZqdZrGdĄdeZsGdƄdeZte&6dȦdɄZue&Ddʦdd̄Zve&:dͦd d΄ZwGdτdeZxe&:dѦedfd d҄ZyGdӄdeZze&6dզdքZ{e&|dզd dׄZ}e&~dئd dڄZdS( umKanban dashboard plugin — backend API routes. Mounted at /api/plugins/kanban/ by the dashboard plugin system. This layer is intentionally thin: every handler is a small wrapper around ``hermes_cli.kanban_db`` or a direct SQL query. Writes use the same code paths the CLI and gateway ``/kanban`` command use, so the three surfaces cannot drift. Live updates arrive via the ``/events`` WebSocket, which tails the append-only ``task_events`` table on a short poll interval (WAL mode lets reads run alongside the dispatcher's IMMEDIATE write transactions). Security note ------------- Plugin HTTP routes go through the dashboard's session-token auth middleware (``web_server.auth_middleware``) just like core API routes — every ``/api/plugins/...`` request must present the session bearer token (or the session cookie set when you load the dashboard HTML). The token is the random per-process ``_SESSION_TOKEN`` printed at startup; the dashboard's own pages inject it via ``window.__HERMES_SESSION_TOKEN__`` so logged-in browsers don't have to handle it manually. For the ``/events`` WebSocket we still require the session token as a ``?token=`` query parameter (browsers cannot set the ``Authorization`` header on an upgrade request), matching the established pattern used by the in-browser PTY bridge in ``hermes_cli/web_server.py``. This means ``hermes dashboard --host 0.0.0.0`` is safe to run on a LAN: plugin routes are no longer an unauthenticated exception. The auth still isn't multi-user — anyone who can read the printed URL+token gets full dashboard access — but they can't ride along just because they can reach the port. ) annotationsN)asdictPath)AnyOptional) APIRouterFileForm HTTPExceptionQuery UploadFile WebSocketWebSocketDisconnectstatus) FileResponse) BaseModelField) kanban_dbkanban_diagnosticsws 'WebSocket'returnboolcx ddlm}n#t$rYdSwxYwt||S)aKAuthorize a WebSocket upgrade by delegating to the dashboard's canonical WS auth gate (``hermes_cli.web_server._ws_auth_ok``). Delegating (rather than re-implementing a ``_SESSION_TOKEN``-only check) means this endpoint transparently accepts whatever the core gate accepts in each mode: * loopback / ``--insecure``: legacy ``?token=<_SESSION_TOKEN>`` * gated OAuth: single-use ``?ticket=`` (the browser SDK's ``buildWsUrl`` mints one per connect) * server-internal: the process-lifetime ``?internal=`` credential The previous bespoke check only understood ``_SESSION_TOKEN``, so the kanban live-events WS was rejected on every OAuth-gated deployment even though the rest of the dashboard worked. Routing through the shared gate also means this can never drift from core auth again. Imported lazily so the plugin still loads in test contexts where the dashboard ``web_server`` module isn't importable (e.g. the bare-FastAPI test harness); there we accept so the tail loop stays testable, matching the prior behaviour. r) web_serverT) hermes_clir Exceptionr _ws_auth_ok)r_wss B/usr/local/lib/hermes-agent/plugins/kanban/dashboard/plugin_api.py_ws_upgrade_authorizedr#@s\.0000000 tt  ## $ $$s  board Optional[str]c||dkrdS tj|}n0#t$r#}tdt |d}~wwxYw|r9|tjkr)tj|stdd|d|S)aIValidate and normalise a board slug from a query param. Raises :class:`HTTPException` 400 on malformed slugs so the browser sees a clean error instead of a 500. Returns the normalised slug, or ``None`` when the caller omitted the param (which then falls through to the active board inside ``kb.connect()``). N status_codedetailboard  does not exist)r_normalize_board_slug ValueErrorr str DEFAULT_BOARD board_exists)r$normedexcs r"_resolve_boardr6as } t>077 >>>CHH====>  &I333Iz-_compute_task_diagnostics..s%%%1qw%%%raci|]}|gSrrrtids r" z-_compute_task_diagnostics..!s&B&B&B3sB&B&B&Braz,SELECT * FROM task_events WHERE task_id IN (z ) ORDER BY idr[ci|]}|gSrrrs r"rz-_compute_task_diagnostics..'s$@$@$@S"$@$@$@raz*SELECT * FROM task_runs WHERE task_id IN (rZ)configc6g|]}|Sr)to_dictrrTs r"rz-_compute_task_diagnostics..8s 333 333ra)rrhermes_cli.configrconfig_from_runtime_configjoinlenexecutetuplefetchall setdefaultappendcompute_task_diagnosticsget)rrkdr diag_config placeholdersrowsrow_idsevents_by_taskev_row runs_by_taskrun_rowoutrsrdiagss r"_compute_task_diagnosticsrs433333------/"/ >>K  IxxH 566 || ? ? ? ? (OO   (**  || <  (**   &%%%%G88SECLL011L&B&B'&B&B&BN,,R|RRR ghjjHH !!&"3R88??GGGG$@$@$@$@$@L<<P\PPP ghjjHH  2B77>>wGGGG!#C  4 4g++   sB ' '   S" % %      433U333CH Jra diagnostics list[dict]Optional[dict]c|sdSddlm}i}d}d}d}d}|D]}||dd|ddz||d<||ddz }|dpd}||kr|}|d } | |vr|| } | |kr| }| }||||d S) u(Compact summary for cards: {count, highest_severity, kinds, latest_at}. Replaces the old hallucination-only ``warnings`` object — same shape additions plus ``highest_severity`` so the UI can color badges per diagnostic severity. Returns None when ``diagnostics`` is empty. NrSEVERITY_ORDERr\count last_seen_atseverity)rkinds latest_athighest_severity)hermes_cli.kanban_diagnosticsrrindex) rrrlatest highest_idx highest_sevrrTlasevidxs r""_warnings_summary_from_diagnosticsr<s t<<<<<<E FK!%K E  " " 99QvY22QUU7A5F5FFai w""" UU> " " 'a ;;FeeJ .  &&s++C[  ! ! '   rar[r1dict[str, list[str]]cd|d|fD}d|d|fD}||dS)z8Return {'parents': [...], 'children': [...]} for a task.cg|] }|d S) parent_idrrs r"rz_links_for..es,  +razFSELECT parent_id FROM task_links WHERE child_id = ? ORDER BY parent_idcg|] }|d S)child_idrrs r"rz_links_for..ls,  * raESELECT child_id FROM task_links WHERE parent_id = ? ORDER BY child_idparentschildren)r)rr[rrs r" _links_forrcsz T J  G S J  HH 5 55raz/boardzFilter to a single tenant) descriptionFz$Kanban board slug (omit for current)z1Restrict to tasks using this workflow template idz+Restrict to tasks at this workflow step keytenantinclude_archivedworkflow_template_idcurrent_step_keyct|}t|} tj|||||}i}|dD]\}||dddddxxdz cc<||d dddd xxdz cc<]d |d D} i} |d D]M}| |dddd} | dxxdz cc<|ddkr| dxxdz cc<Nt|d} |dd} dtD|rgd<tj |d|D}|D]}| |j }|r|dtnd}t||}| |j ddd|d<| |j d|d<| |j |d<| |j }|r||d<t||d<|jvr|jnd }||d!|d"D}d#|d$D}fd%D||t'| t't)jd&|S#|wxYw)'u{Return the full board grouped by status column. ``_conn()`` auto-initializes ``kanban.db`` on first call so a fresh install doesn't surface a "failed to load" error on the plugin tab. ``board`` selects which board to read from. Omitting it falls through to the active board (``HERMES_KANBAN_BOARD`` env → on-disk ``current`` pointer → ``default``). r8)rrrrz*SELECT parent_id, child_id FROM task_linksrrrrrrrc,i|]}|d|dS)r[nrrs r"rzget_board..s2* * *  iL!C&* * * razASELECT task_id, COUNT(*) AS n FROM task_comments GROUP BY task_idzbSELECT l.parent_id AS pid, t.status AS cstatus FROM task_links l JOIN tasks t ON t.id = l.child_idpid)rEtotalrcstatusrENrz1SELECT COALESCE(MAX(id), 0) AS m FROM task_eventsmci|]}|gSrrrrbs r"rzget_board..s)G)G)GA!R)G)G)Graarchivedcg|] }|j Srr)rts r"rzget_board..s7L7L7L7L7L7LrarI link_counts comment_countprogressrwarningsr?cg|] }|d S)rrrs r"rzget_board..s,    hK   razJSELECT DISTINCT tenant FROM tasks WHERE tenant IS NOT NULL ORDER BY tenantcg|] }|d S)assigneerrs r"rzget_board..s,    jM   raziSELECT DISTINCT assignee FROM tasks WHERE assignee IS NOT NULL AND status != 'archived' ORDER BY assigneec&g|] }||dS))nametasksr)rrcolumnss r"rzget_board..s2;? 66ra)rtenants assigneeslatest_event_idnow)r6r=r list_tasksrrrrfetchonerGlatest_summariesrrZ_CARD_SUMMARY_PREVIEW_CHARSrUrrrkeysinttimeclose)rrr$rrrrrrowcomment_countsrpdiagnostics_per_taskr summary_maprfullpreviewrTrcolrrrs @r" get_boardr zsV* 5 ! !E u   Dm$ -!5-    24 << 8  (**  C  " "3{#3PQ5R5R S S         " "3z?q4Q4Q R R         * * \\S* * * /1<< B   (**  C##CJQ0G0GHHA gJJJ!OJJJ9~''& Q 9MMM,, ?  (**S*H)G)G)G)G  %"$GJ   07L7Le7L7L7LMM  # #A??14((D6:D11122 1W555A*qtPQ5R5RSSAm !/!3!3AD!!>""?33ty{{##    s L7M..Nz/tasks/{task_id}z@With run_state_name: filter runs by column 'status' or 'outcome'z4With run_state_type: exact value for that run columnrun_state_typerun_state_namec Bt|}t|} |du|duz rtdd||dvrtddtj||}|tdd|d tj||}t || }t||g }||pg} | r| |d <t| |d <|dtj ||Ddtj ||Ddtj ||Dt||dtj||||Dd|S#|wxYw)Nr8r(zDrun_state_type and run_state_name must be passed together or omittedr))rrz,run_state_type must be 'status' or 'outcome'r,task not foundrIrrrc,g|]}t|Sr)rhrs r"rzget_task...s ZZZaq))ZZZrac,g|]}t|Sr)r`)res r"rzget_task../sTTT!{1~~TTTrac,g|]}t|Srrrrris r"rzget_task..0s!cccA,Q//cccrac,g|]}t|Sr)rrs r"rzget_task..2s.! ra) state_type state_name)rKcommentsevents attachmentslinksruns)r6r=r rget_taskrJrUrrr list_comments list_eventslist_attachmentsr list_runsr) r[r$r r rrK full_summarytask_dr diag_lists r"rrs  5 ! !E u   D+ d "~'= > ]   %.@U*U*UE !$00 <C8S8S8S8STTT T!/g>> D>>>*$'CCCIIg&&,"  O$-F= !!CI!N!NF: ZZ93J4QX3Y3YZZZTTy/DT7/S/STTTcc9STXZa9b9bcccg..",--    "  s EFFceZdZUded<dZded<dZded<dZded<dZd ed <d Zded <dZ ded <e e Z ded<dZ ded<dZded<dZded<dZded<dZded<dZded<dS)CreateTaskBodyr1titleNr%rgrrrrpriorityscratchworkspace_kindworkspace_path)default_factoryrFrFrr>idempotency_key Optional[int]r{rskills goal_modegoal_max_turns)__name__ __module__ __qualname____annotations__rgrrr*r,r-rlistrr>r/r{r1r2r3rrar"r(r(DsJJJD"H"""" F    H#N####$(N((((t444G4444F%)O)))))-----"&F&&&&I$(N((((((rar(z/tasksr]ct|}t|} tj|f|j|j|jd|j|j|j |j |j |j |j |j|j|j|jd}tj||}d|rt'|ndi}|r@|jdkr5|jr. ddlm}|\}}|s|r||d<n#t.$rYnwxYw||S#t2$r#} t5d t7|  d} ~ wwxYw#|wxYw) Nr8 dashboard)r)rgr created_byr,r-rr*rr>r/r{r1r2r3rKrAr)_check_dispatcher_presencer;r(r))r6r=r create_taskr)rgrr,r-rr*rr>r/r{r1r2r3rrUrhermes_cli.kanbanr<rrr0r r1) r]r$rr[rKrgr<rBmessagers r"r=r=Us 5 ! !E u   D''  -%""1"1>%O>#3 ' ;>'"1!   $!$00 &D(J 4(8(8(8dK  DK7**t}* HHHHHH#=#=#?#? .7.&-DO      <<<CFF;;;;< sHB$D C#"D # C0-D /C00D D6D11D66D99Eirawcr|pddddd}dd|D}|d}|st dd |d d S) avReduce a client-supplied filename to a safe basename. Strips any directory components (``os.path.basename`` on both separators) so a malicious ``../../etc/passwd`` or ``C:\x`` collapses to its leaf. Rejects empty / dotfile-only names. The result is only ever joined under the per-task attachments dir, never used verbatim as a path from the client. r'\/rc3JK|]}||dv|VdS)N) isprintable)rchs r" z(_safe_attachment_name..s;NN"(8(8NRv=M=M2=M=M=M=MNNra.r(zinvalid attachment filenamer)NrH)replacesplitstriprlstripr )r@rs r"_safe_attachment_namerNs I2  tS ) ) / / 4 4R 8 > > @ @D 77NNNNN N N T T V VD ;;s   ! ! # #D S4QRRRR :raz/tasks/{task_id}/attachmentsc2t|}t|} tj||t dd|dddtj||Di|S#|wxYw)Nr8r,rrr)rc,g|]}t|Srrrs r"rz)list_task_attachments..s.() ##ra)r6r=rrr r"r)r[r$rs r"list_task_attachmentsrQs 5 ! !E u   D   dG , , 4C8S8S8S8STTT T -6-Gg-V-V  s A BB.filerrpc ^Kt|}t|} tj||t dd|dt |jpd}tj||}|dd | d \}}} |} d } || z r(|d | d || } | d z } || z (|| z } d} t| d5} | dd{V}|snz| t|z } | tkrG|| dt ddtdzd|| dddn #1swxYwYn0#t$rt$$r}t dd|d}~wwxYwtj||| t)| |j| |pd}tj||}d|rt1|ndi|S#t2$r#}t dt)|d}~wwxYw#|wxYw)aStore an uploaded file for a task and record its metadata. The blob lands under ``attachments_root(board)//`` with a sanitised, collision-resolved name. The worker reads it via the absolute path surfaced in ``build_worker_context``. r8Nr,rrr)r'T)rexist_okrIr (rrwbi) missing_okizattachment exceeds z MB limitzfailed to store attachment: r:)rmrqrnrorp attachmentr()r6r=rrr rNrmtask_attachments_dirmkdir partitionexistsopenreadr_MAX_ATTACHMENT_BYTESrunlinkwriteOSErroradd_attachmentr1resolvernget_attachmentrrr0)r[rRr$rpr safe_namedest_dirstemdotext candidater dest_pathrrchunkr5att_idattrs r"upload_task_attachmentrqs 5 ! !E u   D9  dG , , 4C8S8S8S8STTT T)$-*=2>> 1'GGGtd333#,,S11c3 )#++-- 11111s1C11I FA)#++-- y(  ^i&& %#%"&))K"8"8888888E SZZ'E444 !((D(999+(+ g6KP[6\ g g g IIe$$$%  % % % % % % % % % % % % % % %      ^ ^ ^C8\WZ8\8\]]] ] ^)  I--//00*$3    &tV44sD.s333E  <<<CFF;;;;< snCI&4F7BF+ F7+F//F72F/3F76I&7G$ GG$$A-I&& J0JJJJ,z/attachments/{attachment_id} attachment_idrct|}t|} tj||}|t ddtj|} t|j}| |n&#ttf$rt ddwxYw| st ddtt||j|jpd|S#|wxYw) Nr8r,attachment not foundr)zattachment file unavailablezattachment file missing on diskzapplication/octet-stream)pathrm media_type)r6r=rrfr attachments_rootrerrq relative_tor0rcis_filerr1rmrnr)rrr$rrprootstoreds r"download_attachmentr|sV 5 ! !E u   D&t];; ;C8NOOO O)666>>@@ W#/**2244F   t $ $ $ $G$ W W WC8UVVV V W~~ [C8YZZZ ZV\'E+E    s%AD71;B-,D7-#CAD77E ct|}t|} tj||}|t ddd|d|S#|wxYw)Nr8r,rtr)T)okrZ)r6r=rdelete_attachmentr r)rrr$rrps r"remove_attachmentrs{ 5 ! !E u   D)$ >> ;C8NOOO O-00  s ,A""A8ceZdZUdZded<dZded<dZded<dZded<dZded<dZ ded <dZ ded <dZ ded <dZ d ed <dS)UpdateTaskBodyNr%rrr0r*r)rgresult block_reasonrrr) r4r5r6rr7rr*r)rgrrrrrrar"rr&s F    "H"""""H""""ED F    "&L&&&&"G!!!!#H######rarc r t|}t|} tj||}|t dd|d|jb tj|||jpd}n0#t$r#}t dt|d}~wwxYw|st dd|j |j }d}|d kr)tj |||j |j |j }n|d krtj|||j }n|d krtj|||j }n|dkrHtj||}|r|j dvrtj||}not%||d}n]|dkrtj||}nA|dkrt dd|dvrt%|||}nt dd||s`|dkrEt)||} | r3dd| D} t dd| t dd|d|jtj|5|dt3|j|f|d|t5jdt3|jit3t9jfdddn #1swxYwY|j|jPtj|5gg} } |jk|jst dd| d| |j|j/| d | |j| ||d!d| d"| |d#|t3t9jfdddn #1swxYwYtj||} d$| rtC| ndi|"S#|"wxYw)%Nr8r,rrr)ztask not foundTrErrrrCreasonr@rArCr@rrBr(FCannot set status to 'running' directly; use the dispatcher/claim path)r?r>r@zunknown status: z, c3PK|]!}|dd|dd|ddV"dS)r)rUrZz , status=rrNrrrs r"rHzupdate_task..rs[** ! !zOOqwOO8OOO******rau:Cannot move to 'ready': blocked by parent(s) not done — zstatus transition to z not valid from current state*UPDATE tasks SET priority = ? WHERE id = ?^INSERT INTO task_events (task_id, kind, payload, created_at) VALUES (?, 'reprioritized', ?, ?)r*ztitle cannot be emptyz title = ?zbody = ?zUPDATE tasks SET z WHERE id = ?zZINSERT INTO task_events (task_id, kind, payload, created_at) VALUES (?, 'edited', NULL, ?)rK)#r6r=rrr r assign_task RuntimeErrorr1r complete_taskrrr block_taskr schedule_task unblock_task_set_status_direct archive_task_parents_blocking_readyrr* write_txnrrjsondumpsrr)rgrLrrUr)r[r]r$rrKr~rscurrentblockersnamessetsvalsupdateds r" update_taskr5s 5 ! !E u   Dp!$00 <C8S8S8S8STTT T   ' D*'7#3#;t  D D D#CFFCCCC D N# %ABF{{,'">#O$-  i)$@TUUUk!!,T77CWXXXg#,T7;;Dw~1III"/g>>BB,D'7CCBBj+D'::i# #c555'gq99#g|]}|d|d|ddS)rZr)r)rZr)rrrs r"rz+_parents_blocking_ready..s>    w7q{CC   ra)rr)rr[rs r"rrsR << 6     hjj       ra new_statusc tj|5|d|f}| ddddS|dkrR|d|f}|r't d|Ds ddddS|ddk}|dd vo|d v}|d |||||f}|jd kr ddddSd}|r+|dkr%|d rtj||d d d|d}|d||tj d|ittj f|r|d|fD]y} | d} |d| f} | jd krM|d| tj dd|dttj fzdddn #1swxYwY|dvrtj |dS)a Direct status write for drag-drop moves that aren't covered by the structured complete/block/unblock/archive verbs (e.g. todo<->ready, running<->ready). Appends a ``status`` event row for the live feed. When this transitions OFF ``running`` to anything other than the terminal verbs above (which own their own run closing), we close the active run with outcome='reclaimed' so attempt history isn't orphaned. ``running -> ready`` via drag-drop is the common case (user yanking a stuck worker back to the queue). z5SELECT status, current_run_id FROM tasks WHERE id = ?NFrAzYSELECT t.status FROM tasks t JOIN task_links l ON l.parent_id = t.id WHERE l.child_id = ?c3.K|]}|ddkVdS)rrENrrs r"rHz%_set_status_direct..s<++*+( v%++++++rarrB>rEraUPDATE tasks SET status = ?, claim_lock = CASE WHEN ? = 'running' THEN claim_lock ELSE NULL END, claim_expires = CASE WHEN ? = 'running' THEN claim_expires ELSE NULL END, worker_pid = CASE WHEN ? = 'running' THEN worker_pid ELSE NULL END WHERE id = ?rcurrent_run_id reclaimedzstatus changed to z (dashboard/direct))rrrzbINSERT INTO task_events (task_id, run_id, kind, payload, created_at) VALUES (?, ?, 'status', ?, ?)rrzBUPDATE tasks SET status = 'todo' WHERE id = ? AND status = 'ready'zWINSERT INTO task_events (task_id, kind, payload, created_at) VALUES (?, 'status', ?, ?)r?parent_reopened)rrparent>rErAT) rrrrrallrowcount_end_runrrrrrecompute_ready) rr[rprevparent_statuses was_runningreopening_satisfied_parentcurr_rrdemoteds r"rrs  T " "RR|| C J   (**  <RRRRRRRR  "ll'  hjj   s++/>+++(( -RRRRRRRR08n 1 N2 2 7"66 # ll  ZW E    <1  ORRRRRRRRP  :22ts, III'F''''''rarz/tasks/{task_id}/commentsc|jstddt|}t |} t j||tdd|dt j|||jpd|j d d i| S#| wxYw) Nr(zbody is requiredr)r8r,rrr:)rfrgr~T) rgrLr r6r=rr add_commentrfr)r[r]r$rs r"rrCs <    H4FGGGG 5 ! !E u   D  dG , , 4C8S8S8S8STTT T ''."?Kgl    d|  s AB11Cc$eZdZUded<ded<dS)LinkBodyr1rrN)r4r5r6r7rrar"rrXs"NNNMMMMMrarz/linkscDt|}t|} tj||j|jddi|S#t$r#}tdt|d}~wwxYw#|wxYw)Nr8r~Tr(r)) r6r=r link_tasksrrrr0r r1)r]r$rrs r"add_linkr]s 5 ! !E u   DT7#4g6FGGGd|  <<<CFF;;;;< s##A B#BBB Brrct|}t|} tj|||}dt |i|S#|wxYw)Nr8r~)r6r=r unlink_tasksrr)rrr$rr~s r" delete_linkrjsi 5 ! !E u   D  #D)X > >d2hh  s &AA2ceZdZUded<dZded<dZded<dZded<d Zd ed <dZded <dZ ded <dZ ded<d Z d ed<dS) BulkTaskBodyrFidsNr%rrr0r*Frarchiverrrr reclaim_first) r4r5r6r7rrr*rrrrrrrar"rr}sNNN F    "H"""""H""""G F    !G!!!!#H####Mrarz /tasks/bulkc d|jpgD}|stddg}t|}t|} |D]}|dd} t j||}|-|d d ||M|jr,t j ||s|d d |j ]|jsU|j }|d kr*t j |||j |j |j} n|dkrt j||} n|dkrHt j||} | r| j dvrt j||} nt#||d} n|dkr.|d d ||e|dkrt j||} nG|dvrt#|||} n1|d d| ||| s|d d|d |j |jr t j|||jpdd} nt j|||jpd} | s|d d n;#t.$r.} |d t1|  Yd} ~ nd} ~ wwxYw|jt j|5|dt9|j|f|d|t;jdt9|jit9t?jfdddn #1swxYwYn;#t@$r.} |d t1|  Yd} ~ nd} ~ wwxYw||d|i|!S#|!wxYw)uApply the same patch to every id in ``payload.ids``. This is an *independent* iteration — per-task failures don't abort siblings. Returns per-id outcome so the UI can surface partials. cg|]}||Srr)ris r"rzbulk_update..s / / /Q /1 / / /rar(zids is requiredr)r8T)rZr~NFz not found)r~rzarchive refusedrErrCrArrBrr@>r?r>zunknown status ztransition to z refused)rzassign refusedrrr*results)"rr r6r=rrupdaterrrrrrrrrrrrrr reassign_taskrrr1r*rrrrrrrr) r]r$rrrrentryrKrr~rrs r" bulk_updaters 0 /w{(b / / /C G4EFFFFG 5 ! !E u   DQM "M "C+.d$;$;EJ 5 )$44<LLEL===NN5)))?H$1$<<H 5F GGG>-go-AF{{&4 ##*>$+O%,%5  i&1$<<g'0s;;H3:1I#I#I!*!7c!B!BBB!3D#w!G!GBBi $!@% u--- k))&4T3??000/c1== 5Lq5L5L MMMu--- U 5Sa5S5S5S TTT#/ ="0!*!8 $c7+;+Ct.2"""BB "+!6 $c7+;+Ct""B "K!LLE9ILJJJ'=== SVV <<<<<<<<=#/",T22   H !122C8 @ $*j#g>N:O:O-P"Q"Q --/                5 5 5 SVV 44444444 5 NN5 ! ! ! !7#  s O6AN O6DN .O60A!N O6$N 8AJN  K $K N  KN ,BN4 N N N N N  O6 O$N?:O6?OO66P z /diagnosticsz*Filter by severity: warning|error|criticalrc ,t|}t|} t|d}|sgdd|SrNi}|D]\}}fd|D}|r|||<|}|sgdd|St |}ddgt|z} d | d | d t| D} g} |D]S\}}| |} | || r| d nd| r| d nd| r| dnd|dTddlm} dt!| Dfd}| || t%d| Dd|S#|wxYw)aReturn ``[{task_id, task_title, task_status, task_assignee, diagnostics: [...]}, ...]`` for every task on the board with at least one active diagnostic. Severity-filterable so the UI can render "just the critical ones" or the CLI can grep. Useful for the board-header attention strip AND for ``hermes kanban diagnostics`` which shells to this endpoint when the dashboard's running, or invokes the engine directly when it isn't. r8Nrr)rrcdg|],}tj|d*|-S)r)rseverity_at_or_abover)rrTrs r"rz$list_diagnostics.. s8^^^a)@zARART\)])]^^^^rarrc i|] }|d| Srrrs r"rz$list_diagnostics..s.    dGQ   raz;SELECT id, title, status, assignee FROM tasks WHERE id IN (rr)rr)r[ task_title task_status task_assigneerrci|]\}}|| Srr)rrrs r"rz$list_diagnostics..,s>>>DAq1a>>>rac|dd}|dd |dpd fS)Nrrrrr)r)rtopsev_idxs r" _sort_keyz#list_diagnostics.._sort_key-sSm$Q'CSWWZ00"555''.)).Q/ rakeyc3@K|]}t|dVdS)rN)rrs r"rHz#list_diagnostics..7s/<<1Q}-..<<<<<>In$=$=>>>      Y<<<<<<<   sG=;G=E G==Hz/workers/activecdt|}t|} |d}d|D}|t |t t jd|S#|wxYw)aReturn every currently-running worker on the board. A worker is a ``task_runs`` row whose ``ended_at`` is NULL and whose ``worker_pid`` is non-NULL, belonging to a task with ``status='running'``. Returns ``{workers: [...], count: N, checked_at: }``. Each worker entry carries enough context for the dashboard to link back to its task without a second round-trip. r8a SELECT r.id AS run_id, r.task_id, t.title AS task_title, t.status AS task_status, t.assignee AS task_assignee, r.profile, r.worker_pid, r.started_at, r.claim_lock, r.claim_expires, r.last_heartbeat_at, r.max_runtime_seconds FROM task_runs r JOIN tasks t ON t.id = r.task_id WHERE r.ended_at IS NULL AND r.worker_pid IS NOT NULL AND t.status = 'running' ORDER BY r.started_at ASC cg|]Y}|d|d|d|d|d|d|d|d|d|d |d |d d ZS) r_r[rrrrvrzr}rxryr|r{) r_r[rrrrvrzr}rxryr|r{r)rrs r"rz'list_active_workers..os   h-y>!,/"=1!$_!5y>!,/!,/!,/!$_!5%()<%='*+@'A     ra)workersr checked_at)r6r=rrrrrr)r$rrrs r"list_active_workersrHs 5 ! !E u   D+||   , (**- .     "#S\\TY[[IYIYZZ  s A#BB/z/runs/{run_id}r_ct|}t|} tj||}|t dd|ddt |i|S#|wxYw)zDirect lookup of a ``task_runs`` row by its integer id. Returns ``{run: {...}}`` using the same serialisation as the per-task run history embedded in ``GET /tasks/{task_id}``. 404 when no such run exists. r8Nr,run rr)run)r6r=rget_runr rr)r_r$rrss r"get_run_endpointrs 5 ! !E u   D  dF + + 9C8Qv8Q8Q8QRRR Ry||$  s SIGKILL flow, run-outcome bookkeeping, and event-log append all match what the existing ``POST /tasks/{task_id}/reclaim`` endpoint does. Responses: * 200 ``{"ok": true, "run_id": ..., "task_id": ...}`` on success. * 404 when ``run_id`` is unknown. * 409 when the run has already ended, or the task is no longer in a claimable state. Closes the gap left by PR #28432, which shipped the read-only sibling endpoints (``/workers/active``, ``/runs/{run_id}``, ``/runs/{run_id}/inspect``) but no termination control surface. r8Nr,rrr)rz already endedrzcannot terminate run z: task z$ is no longer in a reclaimable stateT)r~r_r[) r6r=rrr r~ reclaim_taskr[rr)r_r]r$rrsr~s r"terminate_run_endpointrs!. 5 ! !E u   D  dF + + 9C8Qv8Q8Q8QRRR R : !4f444  #D!)GN K K K 4F4419444 fCC  s BCCceZdZUdZded<dS) ReclaimBodyNr%rrrrar"rrrrarz/tasks/{task_id}/reclaimc t|}t|} tj|||j}|st dd|dd|d|S#|wxYw) a+Release an active worker claim on a running task. Used by the dashboard recovery popover when an operator wants to abort a stuck worker (e.g. one that keeps hallucinating card ids) without waiting for the claim TTL. Maps 1:1 to ``hermes kanban reclaim --reason ...``. r8rrzcannot reclaim z7: not in a claimable state (not running, or unknown id)r)T)r~r[)r6r=rrrr rr[r]r$rr~s r"reclaim_task_endpointrs 5 ! !E u   D   #D''. I I I 3g333 w//  s 7A--Bc"eZdZUdZdZded<dS) SpecifyBodyuOptional author override. Nothing else is configurable from the dashboard — model + prompt come from ``auxiliary.triage_specifier`` in config.yaml, same as the CLI.Nr%rf)r4r5r6__doc__rfr7rrar"rr9s/((!F      rarz/tasks/{task_id}/specifyc(t|}tj|p tj5ddlm}|||jpd}dddn #1swxYwYt|j |j |j |j dS)uFlesh out a triage-column task via the auxiliary LLM and promote it to ``todo``. Maps 1:1 to ``hermes kanban specify ``. Returns the outcome shape used by the CLI: ``{ok, task_id, reason, new_title}``. A non-OK outcome is NOT an HTTP error — the UI renders the reason inline (e.g. "no auxiliary client configured") so the operator knows what to fix, and retries without a page reload. This endpoint runs in FastAPI's threadpool (sync ``def``) because the underlying LLM call can take tens of seconds to minutes on reasoning models, which would block the event loop if we used ``async def`` without an explicit ``run_in_executor``. r)kanban_specifyNrf)r~r[r new_title) r6rscoped_current_boardr2rr specify_taskrfrr~r[rr)r[r]r$rrs r"specify_task_endpointr!As& 5 ! !E  '(H1H I I   .----- -- N*d.                  7:?.&   %A!!A%(A%c:eZdZUdZded<dZded<dZded<dS) ReassignBodyNr%rvFrrr)r4r5r6rvr7rrrrar"r$r$msE!G!!!!M F      rar$z/tasks/{task_id}/reassigncRt|}t|} tj|||jpdt |j|j}|stdd|dd||jpdd | S#| wxYw) aaReassign a task to a different profile, optionally reclaiming first. Used by the dashboard recovery popover when an operator wants to retry a task with a different worker profile (e.g. switch to a smarter model after the assigned profile keeps hallucinating). Maps 1:1 to ``hermes kanban reassign [--reclaim]``. r8N)rrrzcannot reassign zS: unknown id, or still running (pass reclaim_first=true to release the claim first)r)T)r~r[r) r6r=rrrvrrrr rrs r"reassign_task_endpointr&ss 5 ! !E u   D  $ ' O #tw455>      SwSSS wGOz+_configured_home_channels..s a mrar) gateway.configr2r platformsr home_channelrvaluer5r6rr)r2gw_cfgrr4pcfghcs r"_configured_home_channelsr@s6666666  $$&&  F *0022   $ 4,      z+G%v        KK++K,,, Ms  ' 66cJ ddlm}|pdS#t$rYdSwxYw)z@Return the current Hermes profile name for notify-sub ownership.rget_active_profile_namedefault)hermes_cli.profilesrCrrBs r"_active_profile_namerFsO??????&&((5I5 yys  ""subdicthomec.|d|dkovt|ddt|dko.1??qQz]h%>%>%>%>%>%>??raNr,(No home channel configured for platform zJ. Set one from the messenger via /sethome, or configure gateway.platforms.z.home_channel in config.yaml.r)r8rrr5r6)r[r4r5r6notifier_profileTr~r[r;) r@nextr r6r=rradd_notify_subrFr)r[r4r$rRrIrrKs ` r"subscribe_homerasI & ' 'E ????E??? F FD  PhPP(0PPP    5 ! !E u   D!$00 <C8S8S8S8STTT T O;'/4133     wEE  s &A%C C6czt}tfd|Dd}|stdddt|}t |} t j|||d|d pd d ||d |S#|wxYw) zKRemove any notify subscription on *task_id* that matches *platform*'s home.c34K|]}|dk|VdSrXrrYs r"rHz#unsubscribe_home..<r[raNr,r\rIr)r8r5r6)r[r4r5r6Tr^)r@r_r r6r=rremove_notify_subr)r[r4r$rRrIrs ` r"unsubscribe_homere8s & ' 'E ????E??? F FD  KhKKK     5 ! !E u   D # O;'/4     wEE  s #,B$$B:z/statsct|}t|} tj||S#|wxYw)zPer-status + per-assignee counts + oldest-ready age. Designed for the dashboard HUD and for router profiles that need to answer "is this specialist overloaded?" without scanning the whole board themselves. r8)r6r=r board_statsrr$rs r" get_statsriUsU 5 ! !E u   D$T**  s A Az /assigneesct|}t|} dtj|i|S#|wxYw)a<Known profiles + per-profile task counts. Returns the union of ``~/.hermes/profiles/*`` on disk and every distinct assignee currently used on the board. The dashboard uses this to populate its assignee dropdown so a freshly-created profile appears in the picker before it's been given any task. r8r)r6r=rknown_assigneesrrhs r" get_assigneesrlesZ 5 ! !E u   DY6t<<=  A A!z/tasks/{task_id}/logri)geletailr0c t|}t|} tj||}|n#|wxYw|t dd|dtj|||}tj||}|r| j nd}|t||du||pd t|o||kd S) u}Return the worker's stdout/stderr log. ``tail`` caps the response size (bytes) so the dashboard drawer doesn't paginate megabytes into the browser. Returns 404 if the task has never spawned. The on-disk log is rotated at 2 MiB per ``_rotate_worker_log`` — a single ``.log.1`` is kept, no further generations, so disk usage per task is bounded at ~4 MiB. r8Nr,rrr)) tail_bytesr$rr')r[rur] size_bytescontent truncated) r6r=rrrr read_worker_logworker_log_pathr]statst_sizer1r)r[rpr$rrKrtlog_pathros r" get_task_logr{zs 5 ! !E u   D!$00   |4OG4O4O4OPPPP'DNNNG(>>>H&.oo&7&7 >8==?? " "QDH %=b$.4$;//  rmz /dispatchmax)aliasdry_runmax_ncVt|}t|} tj||||} t ||S#t $r(dt|icY|SwxYw#|wxYw)Nr8)r max_spawnr$r)r6r=r dispatch_oncerr TypeErrorr1)rrr$rrs r"dispatchrs 5 ! !E u   D ( 'U%    +&>>  + + +c&kk* * *  + s(BAB8BBBB(c`eZdZUded<dZded<dZded<dZded<dZded<d Zd ed <dS) CreateBoardBodyr1slugNr%rriconcolorFrswitch) r4r5r6r7rrrrrrrar"rrsp IIID!%K%%%%DEFrarcHeZdZUdZded<dZded<dZded<dZded<dS)RenameBoardBodyNr%rrrr)r4r5r6rr7rrrrrar"rrsVD!%K%%%%DErarrdict[str, int]cj tj|}|siStj|} |d}d|D|S#|wxYw#t$ricYSwxYw)z.s(;;;AhKQsV;;;ra)rkanban_db_pathr]r<rrrr)rrurrs r" _board_countsrs 'd333{{}} I t,,, <<Ihjj <;d;;; JJLLLLDJJLLLL  s.*B#B#2B 5B# B  B## B21B2z/boardsctj|}tj}|D]S}|d|k|d<t|d|d<t |d|d<T||dS)z@Return every board on disk with task counts and the active slug.)rr is_currentcountsr)boardsr)r list_boardsget_current_boardrrvalues)rrrbs r"rrs "4D E E EF)++G //V9/,#AfI..( 8++--..'  1 11rac tj|j|j|j|j|j}n0#t$r#}tdt|d}~wwxYw|j rL tj |dn0#t$r#}tdt|d}~wwxYw|tj dS)uGCreate a new board. Idempotent — ``slug`` collision returns existing.rrrrr(r)Nr)r$r) r create_boardrrrrrr0r r1rset_current_boardr)r]metar5s r"create_board_endpointrs >% L+-     >>>CHH====>~B B  'V 5 5 5 5 B B BCCAAA A Bi&A&C&C D DDs,25 A"AA"-B B5B00B5z/boards/{slug}cF tj|}n0#t$r#}tdt |d}~wwxYw|rtj|stdd|dtj||j|j|j |j }d|iS) ucUpdate a board's display metadata (slug is immutable — create a new one to rename the directory).r(r)Nr,r-r.rr$) rr/r0r r1r3write_board_metadatarrrr)rr]r4r5rs r" rename_boardrs>066 >>>CHH====> V/77V4TT4T4T4TUUUU  ) \' \m    D T? A?AzHard-delete instead of archivedeletec tj|| }n0#t$r#}tdt |d}~wwxYw|tjdS)z)Archive (default) or hard-delete a board.)rr(r)N)rr)r remove_boardr0r r1r)rrresr5s r" delete_boardrso>$Tv:>>> >>>CHH====>i&A&C&C D DDs AAAz/boards/{slug}/switchc tj|}n0#t$r#}tdt |d}~wwxYw|rtj|stdd|dtj|d|iS)uPersist ``slug`` as the active board for subsequent CLI / slash calls. Dashboard users pick boards via a client-side ``localStorage`` — this endpoint is for ``/kanban boards switch`` parity so gateway slash commands and the CLI share the same current-board pointer. r(r)Nr,r-r.r)rr/r0r r1r3r)rr4r5s r" switch_boardrs>066 >>>CHH====> V/77V4TT4T4T4TUUUU ''' v rg333333?ceZdZUdZded<dS) DescribeBodyNr%r)r4r5r6rr7rrar"rr;s#!%K%%%%%%rarceZdZUdZded<dS)DescribeAutoBodyFr overwriteN)r4r5r6rr7rrar"rr?s#Irarz /profilesc ddlm}|}n&#t$r}t dd|d}~wwxYwdd|DiS) uReturn every installed profile with its description. Consumed by the dashboard's settings panel (orchestrator picker) and the profile-description editing UI. Profiles without a description still appear here — they're routable on name alone, just less precisely. rprofilesrXzfailed to list profiles: r)Nrc g|]^}|jt|j|jpd|jpd|jpdt|jt|jpdd_S)r'r)r is_defaultmodelproviderrdescription_auto skill_count) rrrrrrrrrrs r"rz'list_profile_roster..Rs    "1<00BJ," }2$();$<$<"1=#5A66      ra)rr list_profilesrr ) profiles_modrr5s r"list_profile_rosterrCsW777777--// WWW4UPS4U4UVVVVW          s A;Az/profiles/{profile_name} profile_namec ddlm}||}|dkr ddlm}ddlm}||}n||}|stdd|d |j pd }| ||d n0#t$rt$r}td d| d}~wwxYwd||dS)aSet or clear the description of a profile. Empty string clears the description; non-empty stores it as a user-authored description (``description_auto: false``) so the auto-describer won't overwrite it on a sweep without ``--overwrite``. rrrD)get_hermes_homerr, profile 'z ' not foundr)r'F)rrrXzfailed to update profile: NT)r~rvr)rrnormalize_profile_namehermes_constantsrpathlibrget_profile_diris_dirr rrLwrite_profile_metar) rr]rcanonr_Path profile_dirtextr5s r"update_profile_descriptionrasgX77777733LAA I   8 8 8 8 8 8 - - - - - -% 1 122KK&66u==K!!## _C8]L8]8]8]^^^ ^#)r0022'' " (     XXX4VQT4V4VWWWWX5 > >>sB2B55C" CC"z&/profiles/{profile_name}/describe-autoc ddlm}||t|j}n&#t $r}t dd|d}~wwxYwt|j|j|j |j dS) uGenerate a description for the named profile via the auxiliary LLM (``auxiliary.profile_describer``). Persists with ``description_auto: true`` so the dashboard can surface a "review" badge. Maps 1:1 to ``hermes profile describe --auto``. Non-OK outcomes are NOT HTTP errors — the UI renders the reason inline (e.g. "no auxiliary client configured") so the operator can fix config and retry without a page reload. r)profile_describer)rrXzdescriber crashed: r)N)r~rvrr) rrdescribe_profilerrrr r~rrr)rr]rrr5s r"auto_describe_profilersQ000000#44 7,--5   QQQ4O#4O4OPPPPQ7:'.*   s/2 AAAceZdZUdZded<dS) DecomposeBodyNr%rf)r4r5r6rfr7rrar"rrrrarz/tasks/{task_id}/decomposec^t|}tj|p tj5ddlm}|||jpd}dddn #1swxYwYt|j |j |j t|j |j pg|jdS)uFan a triage-column task out into a graph of child tasks via the auxiliary LLM, routed to specialist profiles by description. Maps 1:1 to ``hermes kanban decompose ``. Returns the outcome shape used by the CLI: ``{ok, task_id, reason, fanout, child_ids, new_title}``. A non-OK outcome is NOT an HTTP error — the UI renders the reason inline. Runs in FastAPI's threadpool (sync ``def``) because the LLM call can take minutes on reasoning models. r)kanban_decomposeNr)r~r[rfanout child_idsr)r6rrr2rrdecompose_taskrfrr~r[rrrr)r[r]r$rrs r"decompose_task_endpointrs" 5 ! !E  '(H1H I I  //////"11 N*d2                 7:?.w~&&&,"&   r"cHeZdZUdZded<dZded<dZded<dZded<dS)OrchestrationSettingsBodyNr%orchestrator_profiledefault_assigneezOptional[bool]auto_decomposeauto_promote_children)r4r5r6rr7rrrrrar"rrsY*.....&*****%)N)))),0000000rarz/orchestrationc ddlm}|pi}n#t$ri}YnwxYwt|tr|dpini}|dpd}|dpd}t|dd}t|d d}|}|} dd lm } | pd } |r| |s| }|r| |s| }n#t$r d } |s| }|s| }YnwxYw||||||| d S) z}Return the current kanban orchestration knobs from config.yaml plus the resolved effective values (filling in fallbacks).rrr(rr'rrTrrrD)rrrrresolved_orchestrator_profileresolved_default_assigneeactive_profile) rrr isinstancerHrrLrrrrCprofile_exists) rr- kanban_cfg explicit_orchexplicit_defaultrr resolved_orchresolved_defaultractive_defaults r"get_orchestration_settingsrs111111kmm!r .8d.C.CK#''(##)rJ^^$:;;ArHHJJM"'9::@bGGII*..)94@@AAN 0G!N!NOO"M' .777777%==??L9 +L$?$? $N$N +*M .|'B'BCS'T'T .-  ..." +*M .-  .!.,(!6)6%5(  s $$2AEEEc ddlm}m}|pi}n&#t$r}t dd|d}~wwxYw|di}t |tsi}||d< ddlm }n#t$rd}YnwxYw|j j|j pd }|rH|F | |st d d |d n#t$rt$rYnwxYw||d <|j j|j pd }|rH|F | |st d d |d n#t$rt$rYnwxYw||d<|jt|j|d<|jt|j|d< ||n&#t$r}t dd|d}~wwxYwt#S)uUpdate the kanban orchestration knobs in ~/.hermes/config.yaml. Each field is optional — only fields explicitly passed are written. ``orchestrator_profile`` / ``default_assignee`` accept empty strings to clear the override and fall back to the default profile. r)r save_configrXzfailed to load config: r)Nr(rr'r(rz' does not existrrrrzfailed to save config: )rrrrr rrrHrrrrLrrrrrr)r]rrr-r5kanban_sectionrrs r"set_orchestration_settingsr sU>>>>>>>>kmm!r UUU4Sc4S4STTTTU^^Hb11N nd + +'&H 7777777  #/,299;;  L, #22488'$'A4AAA !       15-.+(.B5577  L, #22488'$'A4AAA !       -1)*)+/0F+G+G'($026w7T2U2U./U C UUU4Sc4S4STTTTU & ' ''s^ :5:0A77 BB0*CC21C2!*E E#"E#( F44 G>GGz/eventsrcKt|s(|tjd{VdS|d{V |jdd} t|}n#t$rd}YnwxYw|jd} |rtj |ndn#t$rdYnwxYwdfd } tj ||d{V\}}|r| ||d d{Vtjtd{V^#t $rYdStj$rYdSt$$rX}t&d | |d{Vn#t$$rYn wxYwYd}~dSYd}~dSd}~wwxYw)N)codesince0rr$ cursor_valrrtuple[int, list[dict]]c tj} |d|f}g}|}|D]|} |drt j|dnd}n#t $rd}YnwxYw||d|d|d|d||dd |d}}||f|S#|wxYw) Nr8zmSELECT id, task_id, run_id, kind, payload, created_at FROM task_events WHERE id > ? ORDER BY id ASC LIMIT 200r]rZr[r_r\r^)rZr[r_r\r]r^) rr<rrrloadsrrr)rrrr new_cursorrsr]ws_boards r" _fetch_newz!stream_events.._fetch_newg s*$8444D ||NM(**  #%'  ) )A'>? l"T$*Qy\":":":PT$'''"&'JJg#$Y<"#H+ !& #*&' o   "#4JJ!3  s01C $A/.C/ A>;C=A>>A CC2T)rcursorzKanban event stream error: %s)rrrr)r#r http_statusWS_1008_POLICY_VIOLATIONaccept query_paramsrrr0rr/asyncio to_thread send_jsonsleep_EVENT_POLL_SECONDSrCancelledErrorrr:r;)r since_rawr ws_board_rawrrr5rs @r" stream_eventsrK s "" % %hhK@hAAAAAAAAA ))++@O''55  ^^FF   FFF **733  HT^y6|DDDZ^HH   HHH       8 5#*#4Z#H#HHHHHHHNFF Illf#G#GHHHHHHHHH- 344 4 4 4 4 4 4 4  5   !   3S999 ((**            D        DDDDD sD?2BD? BD?BD?/CD? CD?CA(D?? F> F> F>&F9FF9 F*'F9)F**F99F>)rrrr)r$r%rr%)N)r$r%)rKrLrJr%rrM)rVrWrrM)rbrcrrM)rirjrrM)rsrtrrM)rrrrrr)rrrr)rrr[r1rr) rr%rrr$r%rr%rr%)r[r1r$r%r r%r r%)r]r(r$r%)r@r1rr1)r[r1r$r%)r[r1rRrr$r%rpr%)rrrr$r%)r[r1r]rr$r%)rrr[r1rr8)rrr[r1rr1rr)r[r1r]rr$r%)r]rr$r%)rr1rr1r$r%)r]rr$r%)r$r%rr%)r_rr$r%)r_rr]r r$r%)r[r1r]rr$r%)r[r1r]rr$r%)r[r1r]r$r$r%)rr)rr1)rGrHrIrHrr)r[r%r$r%)r[r1r4r1r$r%)r[r1rpr0r$r%)rrrrr$r%)rr1rr)rr)r]r)rr1r]r)rr1rr)rr1)rr1r]r)rr1r]r)r[r1r]rr$r%)r]r)rr)r __future__rrrloggingsqlite3r dataclassesrrrtypingrrfastapir r r r r rrrrrfastapi.responsesrpydanticrrrrrr getLoggerr4r:routerr#r6r=rGr7rrUr`rhrrr_WARNING_EVENT_KINDSrrrrr rr(postr=r`rNrQrqr|rrrpatchrrrrrrrrrrrrpsutilr ImportErrorrrr r rrrrr!r$r&r0r@rFrKrUrarerirlr{rrrrrrrrrrrrrrrrrrrputr websocketrrrar"rs!!!F#"""""   CCCCCCCCCCCCCCCCCCCCCC******%%%%%%%% //////g!! %%%%B,*****>  " %)      *    6%)AAAAAH$$$$N6666.H!E$4OPPP"U5\\ 53YZZZ*/% M+++',e G'''CCCCCT !5;;$)E \%%%%*E P%%% 7777 7|)))))Y)))"X@Ed *****f)& *++?DuT{{    ,+  +,,tCyy 5;;!%d GGGG-,GT *++CH5;;,+4-..AFt    /.  $ $ $ $ $Y $ $ $ !!NSeTXkkssss"!st!""5:U4[[    #" .ccccT((((()(((  ())KP5QU;;    *) (y X7CeDkk]]]]]LN 53YZZZ#e @IIIIIbGGG  53YZZZ99999x !53YZZZ* $%%!53YZZZ@W@W@W@W&%@WF!!!!!y!!! '((!53YZZZ,,,,)(,f!!!!!)!!! '((!5;;)(:!!!!!)!!! '((!5;;(((()((V!!!!!9!!!  ())!5;;*)LIN> "U4[[ 5;;%%%%%B 9::GLuT{{;:D;<!!!!!I!!! )**!5;;####+*#V11111 111 '''T C(C(C(C(L)JJJJJJsOO)(O)