FjtR UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZddlmZmZmZmZmZmZddlmZmZddlmZdd lmZejeZ eZ!ddZ"ddZ#dddZ$gdZ%de&d<dZ'ddddZ(ddZ)dd!Z*dd$Z+d%Z, ddd+Z-dd/Z.dd3Z/e!0d4edd56ed7edd86edd96edd:6fdd?Z1e!0d@ededdA6eddB6fddEZ2GdFdGeZ3e!4dHedfddJZ5GdKdLeZ6e!7d@edfddMZ8e!9d@edfddNZ:ddPZ;ddRZ<GdSdTeZ=e!4dUedfddVZ>GdWdXeZ?e!4dYedfddZZ@e!9dYed[ed[edfdd^ZAGd_d`eZBe!4daedfddbZCe!0dcedd86eddd6fddfZD ddlEZFn #eG$rdZFYnwxYwe!0dgedd86fddhZHe!0diedd86fddlZIe!0dmedd86fddnZJGdodpeZKe!4dqedd86fddrZLGdsdteZMe!4duedfddvZNGdwdxeZOe!4dyedfddzZPGd{d|eZQe!4d}edfdd~ZRe!0ddZSddZTddZUddZVe!0dededfddZWe!4dedfddZXe!9dedfddZYe!0dedfddZZe!0dedfddZ[e!0dedddedfddZ\e!4ded7eddedfddZ]GddeZ^GddeZ_ddZ`e!0ded7fddZae!4dddZbe!7dddZce!9ded7d6fddZde!4dddZedZfGddeZgGddeZhe!0ddZie!7dddZje!4dddZkGddeZle!4dedfddZmGddeZne!0d¦dÄZoe!pd¦ddĄZqe!rdŦddȄZsdS)umKanban dashboard plugin — backend API routes. Mounted at /api/plugins/kanban/ by the dashboard plugin system. This layer is intentionally thin: every handler is a small wrapper around ``hermes_cli.kanban_db`` or a direct SQL query. Writes use the same code paths the CLI and gateway ``/kanban`` command use, so the three surfaces cannot drift. Live updates arrive via the ``/events`` WebSocket, which tails the append-only ``task_events`` table on a short poll interval (WAL mode lets reads run alongside the dispatcher's IMMEDIATE write transactions). Security note ------------- Plugin HTTP routes go through the dashboard's session-token auth middleware (``web_server.auth_middleware``) just like core API routes — every ``/api/plugins/...`` request must present the session bearer token (or the session cookie set when you load the dashboard HTML). The token is the random per-process ``_SESSION_TOKEN`` printed at startup; the dashboard's own pages inject it via ``window.__HERMES_SESSION_TOKEN__`` so logged-in browsers don't have to handle it manually. For the ``/events`` WebSocket we still require the session token as a ``?token=`` query parameter (browsers cannot set the ``Authorization`` header on an upgrade request), matching the established pattern used by the in-browser PTY bridge in ``hermes_cli/web_server.py``. This means ``hermes dashboard --host 0.0.0.0`` is safe to run on a LAN: plugin routes are no longer an unauthenticated exception. The auth still isn't multi-user — anyone who can read the printed URL+token gets full dashboard access — but they can't ride along just because they can reach the port. ) annotationsN)asdict)AnyOptional) APIRouter HTTPExceptionQuery WebSocketWebSocketDisconnectstatus) BaseModelField) kanban_dbkanban_diagnosticsprovided Optional[str]returnboolc|sdS ddlm}n#t$rYdSwxYwt|dd}|sdSt jt |t |S)zConstant-time compare against the dashboard session token. Imported lazily so the plugin still loads in test contexts where the dashboard web_server module isn't importable (e.g. the bare-FastAPI test harness). Fr) web_serverT_SESSION_TOKENN) hermes_clir Exceptiongetattrhmaccompare_digeststr)r_wsexpecteds B/usr/local/lib/hermes-agent/plugins/kanban/dashboard/plugin_api.py_check_ws_tokenr"@s u0000000 tt  s,d33H t  s8}}c(mm < <077 >>>CHH====>  &I333Iz-_compute_task_diagnostics..s%%%1qw%%%r^ci|]}|gSrrrtids r! z-_compute_task_diagnostics..s&B&B&B3sB&B&B&Br^z,SELECT * FROM task_events WHERE task_id IN (z ) ORDER BY idrXci|]}|gSrrrs r!rz-_compute_task_diagnostics.. s$@$@$@S"$@$@$@r^z*SELECT * FROM task_runs WHERE task_id IN (rW)configc6g|]}|Sr)to_dictrrQs r!rz-_compute_task_diagnostics..s 333 333r^)rrhermes_cli.configrconfig_from_runtime_configjoinlenexecutetuplefetchall setdefaultappendcompute_task_diagnosticsget)rzr|kdr diag_config placeholdersrowsrow_idsevents_by_taskev_row runs_by_taskrun_rowoutrfrdiagss r!_compute_task_diagnosticsrs433333------/"/ >>K  IxxH 566 || ? ? ? ? (OO   (**  || <  (**   &%%%%G88SECLL011L&B&B'&B&B&BN,,R|RRR ghjjHH !!&"3R88??GGGG$@$@$@$@$@L<<P\PPP ghjjHH  2B77>>wGGGG!#C  4 4g++   sB ' '   S" % %      433U333CH Jr^ diagnostics list[dict]Optional[dict]c|sdSddlm}i}d}d}d}d}|D]}||dd|ddz||d<||ddz }|dpd}||kr|}|d } | |vr|| } | |kr| }| }||||d S) u(Compact summary for cards: {count, highest_severity, kinds, latest_at}. Replaces the old hallucination-only ``warnings`` object — same shape additions plus ``highest_severity`` so the UI can color badges per diagnostic severity. Returns None when ``diagnostics`` is empty. NrSEVERITY_ORDERrYcount last_seen_atseverity)rkinds latest_athighest_severity)hermes_cli.kanban_diagnosticsrrindex) rrrlatest highest_idx highest_sevrrQlasevidxs r!"_warnings_summary_from_diagnosticsr"s t<<<<<<E FK!%K E  " " 99QvY22QUU7A5F5FFai w""" UU> " " 'a ;;FeeJ .  &&s++C[  ! ! '   r^rXrdict[str, list[str]]cd|d|fD}d|d|fD}||dS)z8Return {'parents': [...], 'children': [...]} for a task.cg|] }|d S) parent_idrrs r!rz_links_for..Ks,  +r^zFSELECT parent_id FROM task_links WHERE child_id = ? ORDER BY parent_idcg|] }|d S)child_idrrs r!rz_links_for..Rs,  * r^ESELECT child_id FROM task_links WHERE parent_id = ? ORDER BY child_idparentschildren)r)rzrXrrs r! _links_forrIsz T J  G S J  HH 5 55r^z/boardzFilter to a single tenant) descriptionFz$Kanban board slug (omit for current)z1Restrict to tasks using this workflow template idz+Restrict to tasks at this workflow step keytenantinclude_archivedworkflow_template_idcurrent_step_keyct|}t|} tj|||||}i}|dD]\}||dddddxxdz cc<||d dddd xxdz cc<]d |d D} i} |d D]M}| |dddd} | dxxdz cc<|ddkr| dxxdz cc<Nt|d} |dd} dtD|rgd<tj |d|D}|D]}| |j }|r|dtnd}t||}| |j ddd|d<| |j d|d<| |j |d<| |j }|r||d<t||d<|jvr|jnd }||d!|d"D}d#|d$D}fd%D||t'| t't)jd&|S#|wxYw)'u{Return the full board grouped by status column. ``_conn()`` auto-initializes ``kanban.db`` on first call so a fresh install doesn't surface a "failed to load" error on the plugin tab. ``board`` selects which board to read from. Omitting it falls through to the active board (``HERMES_KANBAN_BOARD`` env → on-disk ``current`` pointer → ``default``). r5)rrrrz*SELECT parent_id, child_id FROM task_linksrrrrrrrc,i|]}|d|dS)rXnrrs r!rzget_board..s2* * *  iL!C&* * * r^zASELECT task_id, COUNT(*) AS n FROM task_comments GROUP BY task_idzbSELECT l.parent_id AS pid, t.status AS cstatus FROM task_links l JOIN tasks t ON t.id = l.child_idpid)rBtotalrcstatusrBNr|z1SELECT COALESCE(MAX(id), 0) AS m FROM task_eventsmci|]}|gSrrrr_s r!rzget_board..s)G)G)GA!R)G)G)Gr^archivedcg|] }|j Srr)rts r!rzget_board..s7L7L7L7L7L7Lr^rF link_counts comment_countprogressrwarningsr<cg|] }|d S)rrrs r!rzget_board..s,    hK   r^zJSELECT DISTINCT tenant FROM tasks WHERE tenant IS NOT NULL ORDER BY tenantcg|] }|d S)assigneerrs r!rzget_board..s,    jM   r^ziSELECT DISTINCT assignee FROM tasks WHERE assignee IS NOT NULL AND status != 'archived' ORDER BY assigneec&g|] }||dS))nametasksr)rrcolumnss r!rzget_board..s2;? 66r^)rtenants assigneeslatest_event_idnow)r3r:r list_tasksrrrrfetchonerDlatest_summariesrrW_CARD_SUMMARY_PREVIEW_CHARSrRrr rkeysinttimeclose)rrr#rrrzrrrowcomment_countsrpdiagnostics_per_taskr summary_maprfullpreviewrQrcolrrrs @r! get_boardr`sV* 5 ! !E u   Dm$ -!5-    24 << 8  (**  C  " "3{#3PQ5R5R S S         " "3z?q4Q4Q R R         * * \\S* * * /1<< B   (**  C##CJQ0G0GHHA gJJJ!OJJJ9~''& Q 9MMM,, ?  (**S*H)G)G)G)G  %"$GJ   07L7Le7L7L7LMM  # #A??14((D6:D11122 1W555A*qtPQ5R5RSSAm !/!3!3AD!!>""?33ty{{##    s L7M..Nz/tasks/{task_id}z@With run_state_name: filter runs by column 'status' or 'outcome'z4With run_state_type: exact value for that run columnrun_state_typerun_state_namec t|}t|} |du|duz rtdd||dvrtddtj||}|tdd|d tj||}t || }t||g }||pg} | r| |d <t| |d <|dtj ||Ddtj ||Dt||dtj ||||Dd|S#|wxYw)Nr5r&zDrun_state_type and run_state_name must be passed together or omittedr')r rrz,run_state_type must be 'status' or 'outcome'r*task not foundrFrrrc,g|]}t|Sr)rers r!rzget_task..s ZZZaq))ZZZr^c,g|]}t|Sr)r])res r!rzget_task..sTTT!{1~~TTTr^c,g|]}t|Sr)rwrs r!rzget_task..s.! r^) state_type state_name)rHcommentseventslinksruns)r3r:rrget_taskrGrRrrr list_comments list_eventsr list_runsr) rXr#rrrzrH full_summarytask_dr diag_lists r!rrs 5 ! !E u   D* d "~'= > ]   %.@U*U*UE !$00 <C8S8S8S8STTT T!/g>> D>>>*$'CCCIIg&&,"  O$-F= !!CI!N!NF: ZZ93J4QX3Y3YZZZTTy/DT7/S/STTTg..",--     s D4E**FceZdZUded<dZded<dZded<dZded<dZd ed <d Zded <dZ ded <e e Z ded<dZ ded<dZded<dZded<dZded<dS)CreateTaskBodyrtitleNrrdrrrrpriorityscratchworkspace_kindworkspace_path)default_factoryrCrFrr;idempotency_key Optional[int]rnr}skills)__name__ __module__ __qualname____annotations__rdrrrrrrlistrr;rrnrrr^r!rr)sJJJD"H"""" F    H#N####$(N((((t444G4444F%)O)))))-----"&F&&&&&&r^rz/tasksrZct|}t|} tj||j|j|jd|j|j|j |j |j |j |j |j|j}tj||}d|rt#|ndi}|r@|jdkr5|jr. ddlm}|\}}|s|r||d<n#t*$rYnwxYw||S#t.$r#} t1d t3|  d} ~ wwxYw#|wxYw) Nr5 dashboard) rrdr created_byrrrrrr;rrnrrHr>r)_check_dispatcher_presencer8r&r')r3r:r create_taskrrdrrrrrrr;rrnrrrRr hermes_cli.kanbanr(rrr.rr) rZr#rzrXrHrdr(r?messagers r!r)r)8s 5 ! !E u   D%' -%""1"1>%O>#3 ' ;>    !$00 &D(J 4(8(8(8dK  DK7**t}* HHHHHH#=#=#?#? .7.&-DO      <<<CFF;;;;< sHBD>CD C(%D'C((D D. D))D..D11EceZdZUdZded<dZded<dZded<dZded<dZded<dZ ded <dZ ded <dZ ded <dZ d ed <dS)UpdateTaskBodyNrr rrrrrdresult block_reasonrsrrt) r r!r"r r#rrrrdr.r/rsrtrr^r!r-r-hs F    "H"""""H""""ED F    "&L&&&&"G!!!!#H######r^r-c r t|}t|} tj||}|t dd|d|jb tj|||jpd}n0#t$r#}t dt|d}~wwxYw|st dd|j |j }d}|d kr)tj |||j |j |j }n|d krtj|||j }n|d krtj|||j }n|dkrHtj||}|r|j dvrtj||}not%||d}n]|dkrtj||}nA|dkrt dd|dvrt%|||}nt dd||s`|dkrEt)||} | r3dd| D} t dd| t dd|d|jtj|5|dt3|j|f|d|t5jdt3|jit3t9jfdddn #1swxYwY|j|jPtj|5gg} } |jk|jst dd| d| |j|j/| d | |j| ||d!d| d"| |d#|t3t9jfdddn #1swxYwYtj||} d$| rtC| ndi|"S#|"wxYw)%Nr5r*rrr'ztask not foundTrBr.rsrtr@reasonr=r>r@r=rr?r&FCannot set status to 'running' directly; use the dispatcher/claim path)r<r;r=zunknown status: z, c3PK|]!}|dd|dd|ddV"dS)rz (rWz , status=r rNrrrs r! zupdate_task..s[** ! !zOOqwOO8OOO******r^u:Cannot move to 'ready': blocked by parent(s) not done — zstatus transition to z not valid from current state*UPDATE tasks SET priority = ? WHERE id = ?^INSERT INTO task_events (task_id, kind, payload, created_at) VALUES (?, 'reprioritized', ?, ?)rztitle cannot be emptyz title = ?zbody = ?zUPDATE tasks SET z WHERE id = ?zZINSERT INTO task_events (task_id, kind, payload, created_at) VALUES (?, 'edited', NULL, ?)rH)#r3r:rrrr assign_task RuntimeErrorrr complete_taskr.rsrt block_taskr/ schedule_task unblock_task_set_status_direct archive_task_parents_blocking_readyrr write_txnrrjsondumpsrrrdstriprrRr)rXrZr#rzrHokrscurrentblockersnamessetsvalsupdateds r! update_taskrQws 5 ! !E u   Dp!$00 <C8S8S8S8STTT T   ' D*'7#3#;t  D D D#CFFCCCC D N# %ABF{{,'">#O$-  i)$@TUUUk!!,T77CWXXXg#,T7;;Dw~1III"/g>>BB,D'7CCBBj+D'::i# #c555'gq99#g|]}|d|d|ddS)rWrr )rWrr rrs r!rz+_parents_blocking_ready..s>    w7q{CC   r^)rr)rzrXrs r!rDrDsR << 6     hjj       r^ new_statusc tj|5|d|f}| ddddS|dkrR|d|f}|r't d|Ds ddddS|ddk}|dd vo|d v}|d |||||f}|jd kr ddddSd}|r+|dkr%|d rtj||d d d|d}|d||tj d|ittj f|r|d|fD]y} | d} |d| f} | jd krM|d| tj dd|dttj fzdddn #1swxYwY|dvrtj |dS)a Direct status write for drag-drop moves that aren't covered by the structured complete/block/unblock/archive verbs (e.g. todo<->ready, running<->ready). Appends a ``status`` event row for the live feed. When this transitions OFF ``running`` to anything other than the terminal verbs above (which own their own run closing), we close the active run with outcome='reclaimed' so attempt history isn't orphaned. ``running -> ready`` via drag-drop is the common case (user yanking a stuck worker back to the queue). z5SELECT status, current_run_id FROM tasks WHERE id = ?NFr>zYSELECT t.status FROM tasks t JOIN task_links l ON l.parent_id = t.id WHERE l.child_id = ?c3.K|]}|ddkVdS)r rBNrr8s r!r9z%_set_status_direct..6s<++*+( v%++++++r^r r?>rBraUPDATE tasks SET status = ?, claim_lock = CASE WHEN ? = 'running' THEN claim_lock ELSE NULL END, claim_expires = CASE WHEN ? = 'running' THEN claim_expires ELSE NULL END, worker_pid = CASE WHEN ? = 'running' THEN worker_pid ELSE NULL END WHERE id = ?rcurrent_run_id reclaimedzstatus changed to z (dashboard/direct))rrr rszbINSERT INTO task_events (task_id, run_id, kind, payload, created_at) VALUES (?, ?, 'status', ?, ?)rrzBUPDATE tasks SET status = 'todo' WHERE id = ? AND status = 'ready'zWINSERT INTO task_events (task_id, kind, payload, created_at) VALUES (?, 'status', ?, ?)r<parent_reopened)r r4parent>rBr>T) rrErrrallrowcount_end_runrFrGrrrecompute_ready) rzrXrWprevparent_statuses was_runningreopening_satisfied_parentcurr\rrdemoteds r!rBrBs  T " "RR|| C J   (**  <RRRRRRRR  "ll'  hjj   s++/>+++(( -RRRRRRRR08n 1 N2 2 7"66 # ll  ZW E    <1  ORRRRRRRRP  :22t >d2hh  s &AA2ceZdZUded<dZded<dZded<dZded<d Zd ed <dZded <dZ ded <dZ ded<d Z d ed<dS) BulkTaskBodyrCidsNrr rrrFrarchiver.rsrrt reclaim_first) r r!r"r#r rrrwr.rsrtrxrr^r!rurusNNN F    "H"""""H""""G F    !G!!!!#H####Mr^ruz /tasks/bulkc d|jpgD}|stddg}t|}t|} |D]}|dd} t j||}|-|d d ||M|jr,t j ||s|d d |j ]|jsU|j }|d kr*t j |||j |j |j} n|dkrt j||} n|dkrHt j||} | r| j dvrt j||} nt#||d} n|dkr.|d d ||e|dkrt j||} nG|dvrt#|||} n1|d d| ||| s|d d|d |j |jr t j|||jpdd} nt j|||jpd} | s|d d n;#t.$r.} |d t1|  Yd} ~ nd} ~ wwxYw|jt j|5|dt9|j|f|d|t;jdt9|jit9t?jfdddn #1swxYwYn;#t@$r.} |d t1|  Yd} ~ nd} ~ wwxYw||d|i|!S#|!wxYw)uApply the same patch to every id in ``payload.ids``. This is an *independent* iteration — per-task failures don't abort siblings. Returns per-id outcome so the UI can surface partials. cg|]}||Srr)ris r!rzbulk_update..s / / /Q /1 / / /r^r&zids is requiredr'r5T)rWrINFz not found)rIruzarchive refusedrBr2r@r>r5r?r6r=>r<r;zunknown status ztransition to z refused)rxzassign refusedr:r;rresults)"rvrr3r:rrupdaterrwrCr r>r.rsrtr?rArBr@rrx reassign_taskr<r=rrrErrrFrGrrr) rZr#rvr|rzrentryrHrJrIrfrs r! bulk_updaters 0 /w{(b / / /C G4EFFFFG 5 ! !E u   DQM "M "C+.d$;$;EJ 5 )$44<LLEL===NN5)))?H$1$<<H 5F GGG>-go-AF{{&4 ##*>$+O%,%5  i&1$<<g'0s;;H3:1I#I#I!*!7c!B!BBB!3D#w!G!GBBi $!@% u--- k))&4T3??000/c1== 5Lq5L5L MMMu--- U 5Sa5S5S5S TTT#/ ="0!*!8 $c7+;+Ct.2"""BB "+!6 $c7+;+Ct""B "K!LLE9ILJJJ'=== SVV <<<<<<<<=#/",T22   H !122C8 @ $*j#g>N:O:O-P"Q"Q --/                5 5 5 SVV 44444444 5 NN5 ! ! ! !7#  s O6AN O6DN .O60A!N O6$N 8AJN  K $K N  KN ,BN4 N N N N N  O6 O$N?:O6?OO66P z /diagnosticsz*Filter by severity: warning|error|criticalrc ,t|}t|} t|d}|sgdd|SrNi}|D]\}}fd|D}|r|||<|}|sgdd|St |}ddgt|z} d | d | d t| D} g} |D]S\}}| |} | || r| d nd| r| d nd| r| dnd|dTddlm} dt!| Dfd}| || t%d| Dd|S#|wxYw)aReturn ``[{task_id, task_title, task_status, task_assignee, diagnostics: [...]}, ...]`` for every task on the board with at least one active diagnostic. Severity-filterable so the UI can render "just the critical ones" or the CLI can grep. Useful for the board-header attention strip AND for ``hermes kanban diagnostics`` which shells to this endpoint when the dashboard's running, or invokes the engine directly when it isn't. r5Nrr)rrcdg|],}tj|d*|-S)r)rseverity_at_or_abover)rrQrs r!rz$list_diagnostics..Os8^^^a)@zARART\)])]^^^^r^rrc i|] }|d| Srrrs r!rz$list_diagnostics..Zs.    dGQ   r^z;SELECT id, title, status, assignee FROM tasks WHERE id IN (rrr r)rX task_title task_status task_assigneerrci|]\}}|| Srr)rr{rJs r!rz$list_diagnostics..ns>>>DAq1a>>>r^c|dd}|dd |dpd fS)Nrrrrr)r)rtopsev_idxs r! _sort_keyz#list_diagnostics.._sort_keyosSm$Q'CSWWZ00"555''.)).Q/ r^keyc3@K|]}t|dVdS)rN)rrs r!r9z#list_diagnostics..ys/<<1Q}-..<<<<<>In$=$=>>>      Y<<<<<<<   sG=;G=E G==Hz/workers/activecdt|}t|} |d}d|D}|t |t t jd|S#|wxYw)aReturn every currently-running worker on the board. A worker is a ``task_runs`` row whose ``ended_at`` is NULL and whose ``worker_pid`` is non-NULL, belonging to a task with ``status='running'``. Returns ``{workers: [...], count: N, checked_at: }``. Each worker entry carries enough context for the dashboard to link back to its task without a second round-trip. r5a SELECT r.id AS run_id, r.task_id, t.title AS task_title, t.status AS task_status, t.assignee AS task_assignee, r.profile, r.worker_pid, r.started_at, r.claim_lock, r.claim_expires, r.last_heartbeat_at, r.max_runtime_seconds FROM task_runs r JOIN tasks t ON t.id = r.task_id WHERE r.ended_at IS NULL AND r.worker_pid IS NOT NULL AND t.status = 'running' ORDER BY r.started_at ASC cg|]Y}|d|d|d|d|d|d|d|d|d|d |d |d d ZS) r\rXrrrrirmrprkrlrorn) r\rXrrrrirmrprkrlrornr)rrs r!rz'list_active_workers..s   h-y>!,/"=1!$_!5y>!,/!,/!,/!$_!5%()<%='*+@'A     r^)workersr checked_at)r3r:rrrrrr)r#rzrrs r!list_active_workersrs 5 ! !E u   D+||   , (**- .     "#S\\TY[[IYIYZZ  s A#BB/z/runs/{run_id}r\rct|}t|} tj||}|t dd|ddt |i|S#|wxYw)zDirect lookup of a ``task_runs`` row by its integer id. Returns ``{run: {...}}`` using the same serialisation as the per-task run history embedded in ``GET /tasks/{task_id}``. 404 when no such run exists. r5Nr*run rr'run)r3r:rget_runrrwr)r\r#rzrfs r!get_run_endpointrs 5 ! !E u   D  dF + + 9C8Qv8Q8Q8QRRR Ry||$  s SIGKILL flow, run-outcome bookkeeping, and event-log append all match what the existing ``POST /tasks/{task_id}/reclaim`` endpoint does. Responses: * 200 ``{"ok": true, "run_id": ..., "task_id": ...}`` on success. * 404 when ``run_id`` is unknown. * 409 when the run has already ended, or the task is no longer in a claimable state. Closes the gap left by PR #28432, which shipped the read-only sibling endpoints (``/workers/active``, ``/runs/{run_id}``, ``/runs/{run_id}/inspect``) but no termination control surface. r5Nr*rrr'r1z already endedr3zcannot terminate run z: task z$ is no longer in a reclaimable stateT)rIr\rX) r3r:rrrrq reclaim_taskrXr4r)r\rZr#rzrfrIs r!terminate_run_endpointr%s!. 5 ! !E u   D  dF + + 9C8Qv8Q8Q8QRRR R : !4f444  #D!)GN K K K 4F4419444 fCC  s BCCceZdZUdZded<dS) ReclaimBodyNrr4rrr^r!rrYrr^rz/tasks/{task_id}/reclaimc t|}t|} tj|||j}|st dd|dd|d|S#|wxYw) a+Release an active worker claim on a running task. Used by the dashboard recovery popover when an operator wants to abort a stuck worker (e.g. one that keeps hallucinating card ids) without waiting for the claim TTL. Maps 1:1 to ``hermes kanban reclaim --reason ...``. r5r3r1zcannot reclaim z7: not in a claimable state (not running, or unknown id)r'T)rIrX)r3r:rrr4rrrXrZr#rzrIs r!reclaim_task_endpointr]s 5 ! !E u   D   #D''. I I I 3g333 w//  s 7A--Bc"eZdZUdZdZded<dS) SpecifyBodyuOptional author override. Nothing else is configurable from the dashboard — model + prompt come from ``auxiliary.triage_specifier`` in config.yaml, same as the CLI.Nrrc)r r!r"__doc__rcr#rr^r!rr{s/((!F      r^rz/tasks/{task_id}/specifyct|}tjd} |p tjtjd<ddlm}|||j pd}|!tj ddnG|tjd<n7#|!tj ddn|tjd<wxYwt|j |j |j|jdS)uFlesh out a triage-column task via the auxiliary LLM and promote it to ``todo``. Maps 1:1 to ``hermes kanban specify ``. Returns the outcome shape used by the CLI: ``{ok, task_id, reason, new_title}``. A non-OK outcome is NOT an HTTP error — the UI renders the reason inline (e.g. "no auxiliary client configured") so the operator knows what to fix, and retries without a page reload. This endpoint runs in FastAPI's threadpool (sync ``def``) because the underlying LLM call can take tens of seconds to minutes on reasoning models, which would block the event loop if we used ``async def`` without an explicit ``run_in_executor``. HERMES_KANBAN_BOARDr)kanban_specifyNrc)rIrXr4 new_title)r3osenvironrrr/rr specify_taskrcpoprrIrXr4r)rXrZr#prev_envrrrs r!specify_task_endpointrs& 5 ! !Ez~~344H9,1,LY5L () .----- -- N*d.     JNN0$ 7 7 7 708BJ, - -   JNN0$ 7 7 7 708BJ, - 8 8 8 87:?.&    ?B""4Cc:eZdZUdZded<dZded<dZded<dS) ReassignBodyNrriFrrxr4)r r!r"rir#rxr4rr^r!rrsE!G!!!!M F      r^rz/tasks/{task_id}/reassigncRt|}t|} tj|||jpdt |j|j}|stdd|dd||jpdd | S#| wxYw) aaReassign a task to a different profile, optionally reclaiming first. Used by the dashboard recovery popover when an operator wants to retry a task with a different worker profile (e.g. switch to a smarter model after the assigned profile keeps hallucinating). Maps 1:1 to ``hermes kanban reassign [--reclaim]``. r5N)rxr4r1zcannot reassign zS: unknown id, or still running (pass reclaim_first=true to release the claim first)r'T)rIrXr) r3r:rr~rirrxr4rrrs r!reassign_task_endpointrs 5 ! !E u   D  $ ' O #tw455>      SwSSS wGOz+_configured_home_channels.."s a mr^r) gateway.configrr platformsr home_channelrvaluerrrr)rgw_cfgr.rpcfghcs r!_configured_home_channelsrs6666666  $$&&  F *0022   $ 4,      z+G%v        KK++K,,, Ms  ' 66cJ ddlm}|pdS#t$rYdSwxYw)z@Return the current Hermes profile name for notify-sub ownership.rget_active_profile_namedefault)hermes_cli.profilesrrrs r!_active_profile_namer&sO??????&&((5I5 yys  ""subdicthomec.|d|dkovt|ddt|dko.b1??qQz]h%>%>%>%>%>%>??r^Nr*(No home channel configured for platform zJ. Set one from the messenger via /sethome, or configure gateway.platforms.z.home_channel in config.yaml.r'r5rrrr)rXrrrnotifier_profileTrIrXr) rnextrr3r:rradd_notify_subrr)rXrr#rrrzrHs ` r!subscribe_homerZsI & ' 'E ????E??? F FD  PhPP(0PPP    5 ! !E u   D!$00 <C8S8S8S8STTT T O;'/4133     wEE  s &A%C C6czt}tfd|Dd}|stdddt|}t |} t j|||d|d pd d ||d |S#|wxYw) zKRemove any notify subscription on *task_id* that matches *platform*'s home.c34K|]}|dk|VdSr rr s r!r9z#unsubscribe_home..r r^Nr*r.r'r5rr)rXrrrTr)rrrr3r:rremove_notify_subr)rXrr#rrrzs ` r!unsubscribe_homer}s & ' 'E ????E??? F FD  KhKKK     5 ! !E u   D # O;'/4     wEE  s #,B$$B:z/statsct|}t|} tj||S#|wxYw)zPer-status + per-assignee counts + oldest-ready age. Designed for the dashboard HUD and for router profiles that need to answer "is this specialist overloaded?" without scanning the whole board themselves. r5)r3r:r board_statsrr#rzs r! get_statsrsU 5 ! !E u   D$T**  s A Az /assigneesct|}t|} dtj|i|S#|wxYw)a<Known profiles + per-profile task counts. Returns the union of ``~/.hermes/profiles/*`` on disk and every distinct assignee currently used on the board. The dashboard uses this to populate its assignee dropdown so a freshly-created profile appears in the picker before it's been given any task. r5r)r3r:rknown_assigneesrrs r! get_assigneesrsZ 5 ! !E u   DY6t<<=  A A!z/tasks/{task_id}/logri)geletailrc t|}t|} tj||}|n#|wxYw|t dd|dtj|||}tj||}|r| j nd}|t||du||pd t|o||kd S) u}Return the worker's stdout/stderr log. ``tail`` caps the response size (bytes) so the dashboard drawer doesn't paginate megabytes into the browser. Returns 404 if the task has never spawned. The on-disk log is rotated at 2 MiB per ``_rotate_worker_log`` — a single ``.log.1`` is kept, no further generations, so disk usage per task is bounded at ~4 MiB. r5Nr*rrr') tail_bytesr#rr%)rXpathexists size_bytescontent truncated) r3r:rrrrread_worker_logworker_log_pathr'statst_sizerr)rXr#r#rzrHr)log_pathsizes r! get_task_logr1s 5 ! !E u   D!$00   |4OG4O4O4OPPPP'DNNNG(>>>H&.oo&7&7 >8==?? " "QDH %=b$.4$;//  r z /dispatchmax)aliasdry_runmax_ncVt|}t|} tj||||} t ||S#t $r(dt|icY|SwxYw#|wxYw)Nr5)r5 max_spawnr#r.)r3r:r dispatch_oncerr TypeErrorr)r5r6r#rzr.s r!dispatchr;s 5 ! !E u   D ( 'U%    +&>>  + + +c&kk* * *  + s(BAB8BBBB(c`eZdZUded<dZded<dZded<dZded<dZded<d Zd ed <dS) CreateBoardBodyrslugNrrriconcolorFrswitch) r r!r"r#rrr?r@rArr^r!r=r=sp IIID!%K%%%%DEFr^r=cHeZdZUdZded<dZded<dZded<dZded<dS)RenameBoardBodyNrrrr?r@)r r!r"rr#rr?r@rr^r!rCrC sVD!%K%%%%DEr^rCr>dict[str, int]cj tj|}|siStj|} |d}d|D|S#|wxYw#t$ricYSwxYw)z.s(;;;AhKQsV;;;r^)rkanban_db_pathr'r9rrrr)r>r&rzrs r! _board_countsrHs 'd333{{}} I t,,, <<Ihjj <;d;;; JJLLLLDJJLLLL  s.*B#B#2B 5B# B  B## B21B2z/boardsctj|}tj}|D]S}|d|k|d<t|d|d<t |d|d<T||dS)z@Return every board on disk with task counts and the active slug.)rr> is_currentcountsr)boardsrK)r list_boardsget_current_boardrHrvalues)rrLrKbs r!rMrM"s "4D E E EF)++G //V9/,#AfI..( 8++--..'  1 11r^c tj|j|j|j|j|j}n0#t$r#}tdt|d}~wwxYw|j rL tj |dn0#t$r#}tdt|d}~wwxYw|tj dS)uGCreate a new board. Idempotent — ``slug`` collision returns existing.rrr?r@r&r'Nr>)r#rK) r create_boardr>rrr?r@r.rrrAset_current_boardrN)rZmetar2s r!create_board_endpointrV.s >% L+-     >>>CHH====>~B B  'V 5 5 5 5 B B BCCAAA A Bi&A&C&C D DDs,25 A"AA"-B B5B00B5z/boards/{slug}cF tj|}n0#t$r#}tdt |d}~wwxYw|rtj|stdd|dtj||j|j|j |j }d|iS) ucUpdate a board's display metadata (slug is immutable — create a new one to rename the directory).r&r'Nr*r+r,rRr#) rr-r.rrr0write_board_metadatarrr?r@)r>rZr1r2rUs r! rename_boardrYCs>066 >>>CHH====> V/77V4TT4T4T4TUUUU  ) \' \m    D T? A?AzHard-delete instead of archivedeletec tj|| }n0#t$r#}tdt |d}~wwxYw|tjdS)z)Archive (default) or hard-delete a board.)rwr&r'N)r.rK)r remove_boardr.rrrN)r>r[resr2s r! delete_boardr_Vso>$Tv:>>> >>>CHH====>i&A&C&C D DDs AAAz/boards/{slug}/switchc tj|}n0#t$r#}tdt |d}~wwxYw|rtj|stdd|dtj|d|iS)uPersist ``slug`` as the active board for subsequent CLI / slash calls. Dashboard users pick boards via a client-side ``localStorage`` — this endpoint is for ``/kanban boards switch`` parity so gateway slash commands and the CLI share the same current-board pointer. r&r'Nr*r+r,rK)rr-r.rrr0rT)r>r1r2s r! switch_boardra`s>066 >>>CHH====> V/77V4TT4T4T4TUUUU ''' v rZg333333?ceZdZUdZded<dS) DescribeBodyNrr)r r!r"rr#rr^r!rcrcs#!%K%%%%%%r^rcceZdZUdZded<dS)DescribeAutoBodyFr overwriteN)r r!r"rfr#rr^r!reres#Ir^rez /profilesc ddlm}|}n&#t$r}t dd|d}~wwxYwdd|DiS) uReturn every installed profile with its description. Consumed by the dashboard's settings panel (orchestrator picker) and the profile-description editing UI. Profiles without a description still appear here — they're routable on name alone, just less precisely. rprofileszfailed to list profiles: r'Nric g|]^}|jt|j|jpd|jpd|jpdt|jt|jpdd_S)r%r)r is_defaultmodelproviderrdescription_auto skill_count) rrrlrmrnrrorrpr8s r!rz'list_profile_roster..s    "1<00BJ," }2$();$<$<"1=#5A66      r^)rri list_profilesrr) profiles_modrir2s r!list_profile_rosterrssW777777--// WWW4UPS4U4UVVVVW          s A;Az/profiles/{profile_name} profile_namec ddlm}||}|dkr ddlm}ddlm}||}n||}|stdd|d |j pd }| ||d n0#t$rt$r}td d| d}~wwxYwd||dS)aSet or clear the description of a profile. Empty string clears the description; non-empty stores it as a user-authored description (``description_auto: false``) so the auto-describer won't overwrite it on a sweep without ``--overwrite``. rrhr)get_hermes_home)Pathr* profile 'z ' not foundr'r%F)rrorjzfailed to update profile: NT)rIrir)rrinormalize_profile_namehermes_constantsrvpathlibrwget_profile_diris_dirrrrHwrite_profile_metar) rtrZrrcanonrv_Path profile_dirtextr2s r!update_profile_descriptionrsgX77777733LAA I   8 8 8 8 8 8 - - - - - -% 1 122KK&66u==K!!## _C8]L8]8]8]^^^ ^#)r0022'' " (     XXX4VQT4V4VWWWWX5 > >>sB2B55C" CC"z&/profiles/{profile_name}/describe-autoc ddlm}||t|j}n&#t $r}t dd|d}~wwxYwt|j|j|j |j dS) uGenerate a description for the named profile via the auxiliary LLM (``auxiliary.profile_describer``). Persists with ``description_auto: true`` so the dashboard can surface a "review" badge. Maps 1:1 to ``hermes profile describe --auto``. Non-OK outcomes are NOT HTTP errors — the UI renders the reason inline (e.g. "no auxiliary client configured") so the operator can fix config and retry without a page reload. r)profile_describer)rfrjzdescriber crashed: r'N)rIrir4r) rrdescribe_profilerrfrrrIrtr4r)rtrZrrrr2s r!auto_describe_profilersQ000000#44 7,--5   QQQ4O#4O4OPPPPQ7:'.*   s/2 AAAceZdZUdZded<dS) DecomposeBodyNrrc)r r!r"rcr#rr^r!rrrr^rz/tasks/{task_id}/decomposec8t|}tjd} |p tjtjd<ddlm}|||j pd}|!tj ddnG|tjd<n7#|!tj ddn|tjd<wxYwt|j |j |jt|j|jpg|jdS)uFan a triage-column task out into a graph of child tasks via the auxiliary LLM, routed to specialist profiles by description. Maps 1:1 to ``hermes kanban decompose ``. Returns the outcome shape used by the CLI: ``{ok, task_id, reason, fanout, child_ids, new_title}``. A non-OK outcome is NOT an HTTP error — the UI renders the reason inline. Runs in FastAPI's threadpool (sync ``def``) because the LLM call can take minutes on reasoning models. rr)kanban_decomposeNr)rIrXr4fanout child_idsr)r3rrrrr/rrdecompose_taskrcrrrIrXr4rrr)rXrZr#rrrrs r!decompose_task_endpointrs," 5 ! !Ez~~344H 9,1,LY5L ()//////"11 N*d2     JNN0$ 7 7 7 708BJ, - -   JNN0$ 7 7 7 708BJ, - 8 8 8 87:?.w~&&&,"&   rcHeZdZUdZded<dZded<dZded<dZded<dS)OrchestrationSettingsBodyNrorchestrator_profiledefault_assigneezOptional[bool]auto_decomposeauto_promote_children)r r!r"rr#rrrrr^r!rrsY*.....&*****%)N)))),0000000r^rz/orchestrationc ddlm}|pi}n#t$ri}YnwxYwt|tr|dpini}|dpd}|dpd}t|dd}t|d d}|}|} dd lm } | pd } |r| |s| }|r| |s| }n#t$r d } |s| }|s| }YnwxYw||||||| d S) z}Return the current kanban orchestration knobs from config.yaml plus the resolved effective values (filling in fallbacks).rrrrr%rrTrrhr)rrrrresolved_orchestrator_profileresolved_default_assigneeactive_profile) rrr isinstancerrrHrrrirprofile_exists) rr kanban_cfg explicit_orchexplicit_defaultrr resolved_orchresolved_defaultrractive_defaults r!get_orchestration_settingsr!s111111kmm!r .8d.C.CK#''(##)rJ^^$:;;ArHHJJM"'9::@bGGII*..)94@@AAN 0G!N!NOO"M' .777777%==??L9 +L$?$? $N$N +*M .|'B'BCS'T'T .-  ..." +*M .-  .!.,(!6)6%5(  s $$2AEEEc ddlm}m}|pi}n&#t$r}t dd|d}~wwxYw|di}t |tsi}||d< ddlm }n#t$rd}YnwxYw|j j|j pd }|rH|F | |st d d |d n#t$rt$rYnwxYw||d <|j j|j pd }|rH|F | |st d d |d n#t$rt$rYnwxYw||d<|jt|j|d<|jt|j|d< ||n&#t$r}t dd|d}~wwxYwt#S)uUpdate the kanban orchestration knobs in ~/.hermes/config.yaml. Each field is optional — only fields explicitly passed are written. ``orchestrator_profile`` / ``default_assignee`` accept empty strings to clear the override and fall back to the default profile. r)r save_configrjzfailed to load config: r'Nrrhr%r&rxz' does not existrrrrzfailed to save config: )rrrrrrrrrrirrHrrrrrr)rZrrrr2kanban_sectionrrrs r!set_orchestration_settingsrLsU>>>>>>>>kmm!r UUU4Sc4S4STTTTU^^Hb11N nd + +'&H 7777777  #/,299;;  L, #22488'$'A4AAA !       15-.+(.B5577  L, #22488'$'A4AAA !       -1)*)+/0F+G+G'($026w7T2U2U./U C UUU4Sc4S4STTTTU & ' ''s^ :5:0A77 BB0*CC21C2!*E E#"E#( F44 G>GGz/eventswsr cK|jd}t|s(|tjd{VdS|d{V |jdd} t|}n#t$rd}YnwxYw|jd} |rtj |ndn#t$rdYnwxYwdfd } tj ||d{V\}}|r| ||d d{Vtjtd{V^#t $rYdStj$rYdSt$$rX}t&d| |d{Vn#t$$rYn wxYwYd}~dSYd}~dSd}~wwxYw)Ntoken)codesince0rr# cursor_valrrtuple[int, list[dict]]c tj} |d|f}g}|}|D]|} |drt j|dnd}n#t $rd}YnwxYw||d|d|d|d||dd |d}}||f|S#|wxYw) Nr5zmSELECT id, task_id, run_id, kind, payload, created_at FROM task_events WHERE id > ? ORDER BY id ASC LIMIT 200rZrWrXr\rYr[)rWrXr\rYrZr[) rr9rrrFloadsrrr)rrzrr new_cursorrfrZws_boards r! _fetch_newz!stream_events.._fetch_news*$8444D ||NM(**  #%'  ) )A'>? l"T$*Qy\":":":PT$'''"&'JJg#$Y<"#H+ !& #*&' o   "#4JJ!3  s01C $A/.C/ A>;C=A>>A CC2T)r cursorzKanban event stream error: %s)rrrr) query_paramsrr"r http_statusWS_1008_POLICY_VIOLATIONacceptrr.rr-asyncio to_thread send_jsonsleep_EVENT_POLL_SECONDSr CancelledErrorrr7r8) rr since_rawr ws_board_rawrr r2rs @r! stream_eventsrs O   ( (E 5 ! !hhK@hAAAAAAAAA ))++@O''55  ^^FF   FFF **733  HT^y6|DDDZ^HH   HHH       8 5#*#4Z#H#HHHHHHHNFF Illf#G#GHHHHHHHHH- 344 4 4 4 4 4 4 4  5   !   3S999 ((**            D        DDDDD s0E BE B+(E*B++E C"!E" C1.E0C11A(E G&G7 GGF76G7 GGGGG)rrrr)r#rrr)N)r#r)rHrIrGrrrJ)rSrTrrJ)r_r`rrJ)rfrgrrJ)rzr{r|r}rr~)rrrr)rzr{rXrrr) rrrrr#rrrrr)rXrr#rrrrr)rZrr#r)rXrrZr-r#r)rXrr#r)rzr{rXrrr$)rzr{rXrrWrrr)rXrrZrir#r)rZrmr#r)rrrrr#r)rZrur#r)r#rrr)r\rr#r)r\rrZrr#r)rXrrZrr#r)rXrrZrr#r)rXrrZrr#r)rr)rr)rrrrrr)rXrr#r)rXrrrr#r)rXrr#rr#r)r5rr6rr#r)r>rrrD)rr)rZr=)r>rrZrC)r>rr[r)r>r)rtrrZrc)rtrrZre)rXrrZrr#r)rZr)rr )tr __future__rrrrFloggingrsqlite3r dataclassesrtypingrrfastapirrr r r r rpydanticr rrrrr getLoggerr r7routerr"r3r:rDr#rrRr]rerw_WARNING_EVENT_KINDSrrrrrrrpostr)r-patchrQr[rTrDrBrirkrmrprsrurrpsutilr ImportErrorrrrrrrrrrrrrrrrrrrrrr1r;r=rCrHrMrVrYr_rarrcrersrrrrrrputr websocketrrr^r!rs;!!!F#"""""    jjjjjjjjjjjjjjjj%%%%%%%% //////g!! ====,,*****>  " %)      *6%)AAAAAH$$$$N6666.H!E$4OPPP"U5\\ 53YZZZ*/% M+++',e G'''CCCCCT !5;;$)E \%%%%*E P%%% 6666 6z ' ' ' ' 'Y ' ' 'X@Ed (((((^ $ $ $ $ $Y $ $ $ !!NSeTXkkssss"!st!""5:U4[[    #" .ccccT((((()(((  ())KP5QU;;    *) (y X7CeDkk]]]]]LN 53YZZZ#e @IIIIIbGGG  53YZZZ99999x !53YZZZ* $%%!53YZZZ@W@W@W@W&%@WF!!!!!y!!! '((!53YZZZ,,,,)(,f!!!!!)!!! '((!5;;)(:!!!!!)!!! '((!5;;++++)(+\!!!!!9!!!  ())!5;;*)LIN> "U4[[ 5;;%%%%%B 9::GLuT{{;:D;<!!!!!I!!! )**!5;;&&&&+*&\11111 111 '''T C(C(C(C(L)IIIIIIs LLL