`gjo9:UdZddlmZddlZddlZddlZddlZddlmZm Z eje Z dZ dZdZdZd Zd ZGd d eZGd deZej,dej.ZddZddZddZddZGddZdaded<ddZ ddZ!y) a3 Signal attachment rate-limit scheduler. Process-wide token-bucket simulator that mirrors the per-account attachment rate limit signal-cli/Signal-Server enforce. Producers (``SignalAdapter.send_multiple_images`` and the ``send_message`` tool's Signal path) call ``acquire(n)`` before an attachment send; on a 429 they call ``feedback(retry_after, n)`` so the model recalibrates from the server's authoritative hint. The scheduler serializes concurrent calls through an ``asyncio.Lock``, giving FIFO fairness across agent sessions sharing one signal-cli daemon. ) annotationsN)AnyOptional 2g$@c&eZdZdZddfd ZxZS)SignalRateLimitErroru( Raised by ``SignalAdapter._rpc`` for rate-limit responses when the caller has opted in via ``raise_on_rate_limit=True``. Carries the server-supplied per-token Retry-After (in seconds) on signal-cli ≥ v0.14.3 ``retry_after`` is None when the version doesn't expose it. c2t||||_yN)super__init__ retry_after)selfmessager __class__s V/root/.hermes/venv/lib/python3.12/site-packages/gateway/platforms/signal_rate_limit.pyrzSignalRateLimitError.__init__5s !&r)rstrrOptional[float]returnNone)__name__ __module__ __qualname____doc__r __classcell__)rs@rr r +s''rr c eZdZy)SignalSchedulerErrorN)rrrrrr!r!:srr!z$Retry after (\d+(?:\.\d+)?)\s*secondc d}t|tr|jdxsi}|jdxsi}|jdxsg}|Dcgc]4}t|tr"|jdr|jd6}}|rtt |St |jdd}n t |}t j|}|rt|jdSdScc}w) u2Pull the per-token Retry-After window from a signal-cli rate-limit error. Tries two sources, in order: 1. ``error.data.response.results[*].retryAfterSeconds`` — the structured field signal-cli ≥ v0.14.3 surfaces for plain RateLimitException. 2. ``"Retry after N seconds"`` parsed out of the message — covers libsignal-net's RetryLaterException that gets wrapped as AttachmentInvalidException during attachment upload, where the structured field stays null. Returns None when neither yields a value. dataresponseresultsretryAfterSecondsrN) isinstancedictgetfloatmaxr_RETRY_AFTER_REsearchgroup)errmsgr%r&r'r candidatesmatchs r_extract_retry_after_secondsr7Js C#twwv$"88J'-2,,y)/R07 +,!T"quu-@'A EE% &   Z) )#'')R()#h  " "3 'E$)5Q 3t3 s9Dc t|tr|jdtk(ryt|trt |jddn t |}|j }d|vxsd|vxs d|vxsd|vS) u True if a signal-cli RPC error reflects a rate-limit failure. Matches three layers: - typed ``RATELIMIT_ERROR`` code (signal-cli ≥ v0.14.3, plain RateLimitException) - legacy ``[429] / RateLimitException`` substrings - libsignal-net's ``RetryLaterException`` / ``Retry after N seconds`` surfaced inside ``AttachmentInvalidException`` when the rate limit is hit during attachment upload — signal-cli never re-tags these as RateLimitException, so substring is the only signal. codeTrr$z[429] ratelimitretrylaterexceptionz retry after)r*r+r,SIGNAL_RPC_ERROR_RATELIMITrlower)r2r msg_lowers r_is_signal_rate_limit_errorr?js#t4N!N c4  CGGIr "# X  I7 & ) # & I - & I % rc td|}|dkrtt|dStdtt|dz dS)z9Human-friendly wait label for user-facing pacing notices.Zsr)<z min)r.intround)secondsrCs r _format_waitrHsL CA2veAh-""!Sq2v'( ) ..rc,|dkrytdd|zS)uHTTP timeout for a Signal ``send`` RPC. signal-cli uploads attachments serially during the call, so the server-side time scales with batch size. Default 30s is fine for text-only sends but truncates large attachment batches mid-upload — we then log a phantom failure even though signal-cli completes the send a few seconds later. Scale at 5s/attachment with a 60s floor. rg>@gN@g@)r.)num_attachmentss r_signal_send_timeoutrKs!! tS?* ++rcpeZdZdZeeeef d dZd dZd dZ d dZ d dZ ddZ ddZ y )SignalAttachmentScheduleru[Process-wide token-bucket simulator for Signal attachment sends. The bucket holds up to ``capacity`` tokens (default 50, matching Signal's server-side rate-limit bucket size). Each attachment consumes one token. Tokens refill at ``refill_rate`` tokens/second, calibrated from the per-token Retry-After hint we get from the server when a 429 fires. Until we've observed one, we use the documented default (1 token / 4 seconds). Concurrent ``acquire(n)`` calls serialize through an ``asyncio.Lock`` — natural FIFO across agent sessions hitting the same daemon. ct||_t||_dt|z |_t j |_tj|_ y)N?) r-capacitytokens refill_ratetime monotonic last_refillasyncioLock_lock)rrPdefault_retry_afters rrz"SignalAttachmentScheduler.__init__sI h Ho ':!;;>>+\\^ rctj}||jz }|dkDrN|j|jkr5t |j|j||j zz|_||_y)NrrSrTrUrQrPminrR)rnowelapseds r_refillz!SignalAttachmentScheduler._refillsbnn((( Q;4;;6dmmT[[7TEUEU;U-UVDKrctj}||jz }|j}|dkDr5||jkr&t |j|||j zz}||z }|dkry||j z S)aDBest-effort estimate of the seconds until ``n`` tokens would be available. Used to decide whether to emit a user-facing pacing notice *before* committing to an ``acquire`` that may block silently. Lock-free; small races vs. concurrent acquires are benign for an informational notice. rrAr[)rnr]r^ projecteddeficits r estimate_waitz'SignalAttachmentScheduler.estimate_waitsnn(((KK Q;9t}}4DMM9wAQAQ7Q+QRIi- a<))))rc K|dkry||jkDrtd|d|jdd}d} |j4d{|j|j|k\r<|r|dkDr"t j d||j||cdddd{S||jz }dddd{|jz }|r>t jd |||j||jd |jz d }tj|d{||z }777{#1d{7swYxYw7&w) uBlock until at least ``n`` tokens are available, return the seconds slept. Does **not** deduct tokens — the bucket is a read-only model of server-side capacity. Call ``report_rpc_duration()`` after the RPC to synchronise the model with the server timeline. Not perfect in case lots of coroutines try to acquire for big uploads (``report_rpc_duration`` will take a long time to get hit) but this is just a simulation. Signal server is ground truth and will raise rate-limit exceptions triggering requeues. The lock is released during ``asyncio.sleep`` so other callers can interleave. A retry loop re-checks after each sleep in case the deadline was pessimistic. rrAz'Signal scheduler was called requesting z tokens (max is )TNzNSignal scheduler: tokens sufficient for %d (remaining=%.1f, total_slept=%.1fs)ukSignal scheduler: pausing %.1fs for %d tokens (available=%.1f, deficit=%.1f, refill=%.4f/s ≈ %.1fs/token)rOF) rPr!rXr_rQloggerdebugrRinforVsleep)rra total_slept first_passrcwaits racquirez!SignalAttachmentScheduler.acquiresh" 6 t}} &9!===/,    zz * * ;;!#%q Bt{{K ' * * *dkk/ * *T---D T!T[['$$cD,<,<&<  # --% % % 4 K- * * * * * *( &stAE D; E A E E#D=$E)E8 ED?A+E/E0 E=E?EEE EEc K|dkry|j4d{tj}|j}t d|t |z |_||_dddd{tj|dkDr|dkDrtjntjd|||j||jy77_#1d{7swYoxYww)uRecord an attachment-send RPC that just completed. Deducts ``n_attachments`` tokens without crediting refill during the upload window. Signal's server checks the bucket at RPC start and does *not* refill during request processing — refill resumes after the response. Crediting upload-time refill causes cumulative drift that eventually triggers 429s. Advances ``last_refill`` so the next ``acquire`` / ``_refill`` starts counting from this point. rNrA uSignal scheduler: RPC for %d att took %.1fs — tokens %.1f → %.1f (deducted=%d, no upload refill credited, refill=%.4fs⁻¹)) rXrSrTrQr.r-rUrglogloggingINFODEBUGrR)r rpc_duration n_attachmentsr] token_befores rreport_rpc_durationz-SignalAttachmentScheduler.report_rpc_durations A  :: # #.."C;;Lc<% 2F#FGDK"D   # #  (2--!2CGLL _ < $++ 4++   # # # # #sFC$C C$AC" C$-C .AC$ C$C!C C!C$c|r@|dkDr;dt|z }||jk7rtjd||||_d|_t j |_y)a-Apply server feedback after a 429. ``retry_after`` is the per-*token* refill window the server reports (None when signal-cli is older than v0.14.3 and didn't surface it). When present we calibrate ``refill_rate`` from it: the server is authoritative. rrOzaSignal scheduler: calibrating refill_rate to %.4f tokens/sec (server retry_after=%.1fs per token)rAN)r-rRrgrirQrSrTrU)rr n_attemptednew_rates rfeedbackz"SignalAttachmentScheduler.feedback/s` ;?U;//H4+++ ;k $,  >>+rctj}||jz }|j}|dkDr5||jkr&t |j|||j zz}t|dt|jt|j d|j dkDrtd|j z ddStddS)uReturn current scheduler state for diagnostic logging (read-only). Does not advance ``last_refill`` — safe to call from logging paths without perturbing the bucket. rr)rrOinf)rQrPrRrefill_seconds_per_token) rSrTrUrQrPr\rRrFrEr-)rr]r^rbs rstatezSignalAttachmentScheduler.stateEs nn(((KK Q;9t}}4DMM9wAQAQ7Q+QRIIq)DMM* !1!115LPL\L\_`L`cD4D4D.Da(H   gllqfr   rN)rPr-rYr-rrrr)rarErr-)rvr-rwrErr)rrr{rErr)rr+)rrrrr-!SIGNAL_RATE_LIMIT_BUCKET_CAPACITY%SIGNAL_RATE_LIMIT_DEFAULT_RETRY_AFTERrr_rdrnryr}rr"rrrMrMs[   AB%*+P%Q $ $# $  $*"1 f :,, rrMz#Optional[SignalAttachmentScheduler] _schedulerctXtatjdt tj tj dtj z tS)z?Return the process-wide scheduler, creating it on first access.uMSignal scheduler: created (capacity=%d tokens, refill=%.4f/s ≈ %.1fs/token)rO)rrMrgrirErPrRr"rr get_schedulerr_sN.0  [  ## $  " " *(( (  rcday)uDrop the cached scheduler so the next ``get_scheduler`` call builds a fresh one. Test-only — never call from production paths.N)rr"rr_reset_schedulerrms Jr)r2rrr)r2rrbool)rGr-rr)rJrErr-)rrMr)"r __future__rrVrsrerStypingrr getLoggerrrgSIGNAL_MAX_ATTACHMENTS_PER_MSGrrSIGNAL_RATE_LIMIT_MAX_ATTEMPTS$SIGNAL_BATCH_PACING_NOTICE_THRESHOLDr< Exceptionr r!compile IGNORECASEr/r7r?rHrKrMr__annotations__rrr"rrrs #   8 $"$$&!()%!"'+$ '9 ' 9 "**DbmmT4@B/ ,$p p n37 /6 r