JjUdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlmZddlmZmZddlmZmZddlmZmZmZddlmZdd lm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'dd l(m)Z)m*Z*m+Z+ddl,Z,dd l-m.Z.m/Z/m0Z0m1Z1dd l2m3Z3m4Z4dd l5m6Z6ddl7m8Z8m9Z9m:Z:m;Z;ej<e=Z> ddl?Z?n #e@$rdZ?YnwxYw ddlAZAn #e@$rdZAYnwxYwdZBdZCdZDdZEdZFdZGdZHeGZIdZJdZKdZLeLZMdZNdZOdZPdZQdZRdZSdZTdZUd ZVd!ZWd"ZXd#ZYd$ZZd%Z[d&Z\d'Z]d(Z^d)Z_d*Z` dd+lambZcn #e@$rd,ZcYnwxYwd-ecZddZed.Zfefd/Zgd0Zhd1Ziefd2Zjd3Zkd4Zld5ZmdZnd6Zod7Zpd8Zqd9Zrd:ZsdZtd;Zudd?iZxd@eydA<dBZzeGdCdDZ{idEe{dEdFdGeDeEeFeIHdIe{dIdJdKeOLdMe{dMdNdOdPdQdRSdTe{dTdUdKePLdVe{dVdWdKeYLdXe{dXdYdOdZd[d\Sd]e{d]d^dOeZd_d`Sdae{dadbdce[ddedfe{dfdgdOdhdidjSdke{dkdldOdmdndoSdpe{dpdqdOdrdsdtSdue{dudvdOdwdxydze{dzd{dOe]d|d}Sd~e{d~ddOdddSde{dddOdddSde{dddOd ddSde{dddeTeVeQeRdeUeWdide{dddOdddSde{dddOdddSde{dddOdddSde{dddOd!ddSde{dddOdddSde{dddOdddSde{dddOdddSde{dddOdddSde{dddOdddSde{dddOdddSde{dddOdddƬSde{dddOdddˬSde{dddOdddЬSde{dddOe\ddԬSde{ddddddڬSde{dddOddd߬SZ|deyd< ddl}m~ZeD]Zeje|vr ejdOksejsejdvr)edejDZedejDdZe{ejejpejdOejepejepdݬSe|ej<ejD]Zee|vre|eje|e<n #e@$rYnwxYwddZdZddZhdZddddZddZddmdgdfdddgdfddgddfddgddfgZddd Zdd Zdd ZdZGddeZddZddZddZddZddZddZdddd"Zdd$Zdd&Zdd(Zdd)ZejZedd/ZeeCfdd0Zddd2Zddd5Zdd7Zdd9Zdd;Zdd=Zd>d?ddAZddBZddCZddDZdddEZddFddKZddMZddNZddOZddPZddQZddRZdddSZddTZddVZ ddddWdd[Zdd]Zdd`ZddbZddcZeddhZÐdeeydf<ehdgZĐdeeydh<ddjZedkhZƐdeeydl<ddnZǐddoZȐddpZɐddqZʐddtZddeMduddyZddeMduddzZdd{dd}Zdddd~ZϐdddZddddZdddddZedadhZӐddZԐddZՐddZ֐ddZאddZenfddZِdddZڐddZېdd>endddZܐddZݐddÐdZސddĐdZ dŐdƐdZ dŐdƐdZddǐdZddǐdZdȐdɐdZdʐdZdȐdɐdZdʐdZdːdZd̐dZd͐dZdddΐdZdddϐdZdddАdZdddѐdZdd>etdddZddZdҐdÄZddĄZddńZehdƣZdeeyd<ddȄZddɄZddʜdӐd̈́Zd>dΜdԐdЄZ ddՐdӄZdŐd֐dՄZdאdׄZdddؐdلZdِdڄZdڐdۄZdd>eeddd܄Zdېd݄ZddބZdܐd߄ZdݐdZd>dΜdԐdZdސdZdߐdZddddGdddZdddZddZ ddZ ddZ dddZ dݐddddZ dݐdddZdd>ddddZddZddddddZddZddZdZejZddZddZeeCfddZddZdߐdZdېd Zdd Zdd Zdd ZddZddZ ddZ!ddddZ"ddZ#dd>dddZ$ddZ%dddeLdddZ&deIdddddddddd dd"Z'dddd#dd$Z(dd%dd&Z)dd'Z*ddddd(dd)Z+dd*Z,dd+Z-dZ.da/d,eyd-<dd/Z0dd0Z1dd1Z2dd2Z3dd3Z4dd4Z5dd5Z6dd6Z7ddd7Z8dd8Z9dd9Z:dd:Z; ddd<Z<dd=Z=dd>Z>dd?Z?dd@Z@ddAZAdddݐdBddEZB dddQZCddRZDddSZEddTddVZFddTddWZGeidXddYZHddZZIdd>d[dd]ZJdd^ZKdd`ZLd daZMd ddZNd dgZOd djZPd dkZQdd>ddlddnZRdddoddqZSddrZTddtZUeXdduddxZVddyZWddzZXddddd>ddddd{ dd~ZYddZZd>dddddZ[ddZ\ddZ]dS(a Multi-provider authentication system for Hermes Agent. Supports OAuth device code flows (Nous Portal, future: OpenAI Codex) and traditional API key providers (OpenRouter, custom endpoints). Auth state is persisted in ~/.hermes/auth.json with cross-process file locking. Architecture: - ProviderConfig registry defines known OAuth providers - Auth store (auth.json) holds per-provider credential state - resolve_provider() picks the active provider via priority chain - resolve_*_runtime_credentials() handles token refresh and runtime keys - logout_command() is the CLI entry point for clearing auth Nous authentication paths: - Invoke JWT (preferred): use a scoped access_token directly for inference. ) annotationsN)contextmanager) dataclassfield)datetimetimezone)BaseHTTPRequestHandler HTTPServerThreadingHTTPServer)Path)AnyCallableDict FrozenSetIterableListOptionalTuple)parse_qs urlencodeurlparse)get_hermes_homeget_config_pathread_raw_config$require_readable_config_before_write)OPENROUTER_BASE_URLsecure_parent_dir)$sanitize_borrowed_credential_payload)atomic_replaceatomic_yaml_write env_floatis_truthy_value.@zhttps://portal.nousresearch.comz)https://inference-api.nousresearch.com/v1 hermes-clizinference:invokezbilling:manage device_code invoke_jwtxz%https://chatgpt.com/backend-api/codexzhttps://api.x.ai/v1z$78257093-7e40-4613-99e0-527b14b39113z!group_id profile model.completionz*urn:ietf:params:oauth:grant-type:user_codezhttps://api.minimax.iozhttps://api.minimaxi.comz https://api.minimax.io/anthropicz"https://api.minimaxi.com/anthropic<zhttps://portal.qwen.ai/v1zhttps://api.githubcopilot.comz acp://copilotzhttps://ollama.com/v1z#https://api.stepfun.ai/step_plan/v1z$https://api.stepfun.com/step_plan/v1app_EMoamEEZ73f0CkXaXp7hrannz#https://auth.openai.com/oauth/token) __version__unknownz hermes-cli/zhttps://auth.x.aiz!/.well-known/openid-configurationz$b1a00492-073a-47ea-816f-4c329264a828z>openid profile email offline_access grok-cli:access api:accessz/oauth2/device/codei f0304373b74a44d2b584a3fb70ca9e56z(https://chat.qwen.ai/api/v1/oauth2/tokenzhttps://accounts.spotify.comzhttps://api.spotify.com/v1z'http://127.0.0.1:43827/spotify/callbackzFhttps://hermes-agent.nousresearch.com/docs/user-guide/features/spotifyz'https://developer.spotify.com/dashboardz@https://hermes-agent.nousresearch.com/docs/guides/oauth-over-ssh ) zuser-modify-playback-statezuser-read-playback-statezuser-read-currently-playingzuser-read-recently-playedzplaylist-read-privatezplaylist-read-collaborativezplaylist-modify-publiczplaylist-modify-privatezuser-library-readzuser-library-modifyspotifySpotifyDict[str, str]SERVICE_PROVIDER_NAMESzdummy-lm-api-keyceZdZUdZded<ded<ded<dZded<dZded<dZded <dZded <e e Z d ed <dZ ded<dZ ded<dS)ProviderConfigz%Describes a known inference provider.stridname auth_typeportal_base_urlinference_base_url client_idscope)default_factoryDict[str, Any]extratupleapi_key_env_varsbase_url_env_varN)__name__ __module__ __qualname____doc____annotations__r:r;r<r=rdictr@rCrDrA5/home/rurouni/.hermes/hermes-agent/hermes_cli/auth.pyr4r4s// GGG IIINNNO     IEOOOO!E$777E7777     rKr4nousz Nous Portaloauth_device_code)r6r7r8r:r;r<r= openai-codexz OpenAI Codexoauth_external)r6r7r8r;z openai-apiz OpenAI APIapi_keyzhttps://api.openai.com/v1)OPENAI_API_KEYOPENAI_BASE_URL)r6r7r8r;rCrD xai-oauthz%xAI Grok OAuth (SuperGrok / Premium+) qwen-oauthz Qwen OAuthlmstudioz LM Studiozhttp://127.0.0.1:1234/v1) LM_API_KEY LM_BASE_URLcopilotzGitHub Copilot)COPILOT_GITHUB_TOKENGH_TOKEN GITHUB_TOKENCOPILOT_API_BASE_URL copilot-acpzGitHub Copilot ACPexternal_processCOPILOT_ACP_BASE_URL)r6r7r8r;rDgeminizGoogle AI Studioz0https://generativelanguage.googleapis.com/v1beta)GOOGLE_API_KEYGEMINI_API_KEYGEMINI_BASE_URLzaiz Z.AI / GLMzhttps://api.z.ai/api/paas/v4) GLM_API_KEY ZAI_API_KEY Z_AI_API_KEY GLM_BASE_URL kimi-codingzKimi / Moonshotzhttps://api.moonshot.ai/v1) KIMI_API_KEYKIMI_CODING_API_KEY KIMI_BASE_URLkimi-coding-cnzKimi / Moonshot (China)zhttps://api.moonshot.cn/v1)KIMI_CN_API_KEY)r6r7r8r;rCstepfunzStepFun Step Plan)STEPFUN_API_KEYSTEPFUN_BASE_URLarceezArcee AIzhttps://api.arcee.ai/api/v1)ARCEEAI_API_KEYARCEE_BASE_URLgmiz GMI Cloudzhttps://api.gmi-serving.com/v1) GMI_API_KEY GMI_BASE_URLminimaxMiniMax)MINIMAX_API_KEYMINIMAX_BASE_URL minimax-oauthuMiniMax (OAuth · minimax.io) oauth_minimaxglobal)regioncn_portal_base_urlcn_inference_base_url)r6r7r8r:r;r<r=r@ anthropic Anthropiczhttps://api.anthropic.com)ANTHROPIC_API_KEYANTHROPIC_TOKENCLAUDE_CODE_OAUTH_TOKENANTHROPIC_BASE_URLalibabaz Qwen Cloudz6https://dashscope-intl.aliyuncs.com/compatible-mode/v1)DASHSCOPE_API_KEYDASHSCOPE_BASE_URLalibaba-coding-planzAlibaba Cloud (Coding Plan)z-https://coding-intl.dashscope.aliyuncs.com/v1)ALIBABA_CODING_PLAN_API_KEYrALIBABA_CODING_PLAN_BASE_URL minimax-cnzMiniMax (China))MINIMAX_CN_API_KEYMINIMAX_CN_BASE_URLdeepseekDeepSeekzhttps://api.deepseek.com/v1)DEEPSEEK_API_KEYDEEPSEEK_BASE_URLxaixAI) XAI_API_KEY XAI_BASE_URLnvidiaz NVIDIA NIMz#https://integrate.api.nvidia.com/v1)NVIDIA_API_KEYNVIDIA_BASE_URL opencode-zenz OpenCode Zenzhttps://opencode.ai/zen/v1)OPENCODE_ZEN_API_KEYOPENCODE_ZEN_BASE_URL opencode-goz OpenCode Gozhttps://opencode.ai/zen/go/v1)OPENCODE_GO_API_KEYOPENCODE_GO_BASE_URLkilocodez Kilo Codezhttps://api.kilo.ai/api/gateway)KILOCODE_API_KEYKILOCODE_BASE_URL huggingfacez Hugging Facez https://router.huggingface.co/v1)HF_TOKEN HF_BASE_URLxiaomiz Xiaomi MiMozhttps://api.xiaomimimo.com/v1)XIAOMI_API_KEYXIAOMI_BASE_URLtencent-tokenhubzTencent TokenHubz#https://tokenhub.tencentmaas.com/v1)TOKENHUB_API_KEYTOKENHUB_BASE_URL ollama-cloudz Ollama Cloud)OLLAMA_API_KEYOLLAMA_BASE_URLbedrockz AWS Bedrockaws_sdkz/https://bedrock-runtime.us-east-1.amazonaws.comrABEDROCK_BASE_URL azure-foundryz Azure Foundryr9)AZURE_FOUNDRY_API_KEYAZURE_FOUNDRY_BASE_URLzDict[str, ProviderConfig]PROVIDER_REGISTRYlist_providers>recustomrY openrouterrjrnc#nK|]0}|d|d,|V1dS _BASE_URL_URLNendswith.0vs rL rsHppAQZZ =T=Tp]^]g]ghn]o]opapppppprKc#nK|]0}|ds|d,|V1dSrrrs rLrrsHggAK9P9PgTUT^T^_eTfTfgaggggggrKreturnr5cbddlm}tdjD]}||pd}|r|cSdS)uReturn the first usable Anthropic credential, or ``""``. Checks both the ``.env`` file and the process environment, preferring ``~/.hermes/.env`` so a deliberate key rotation isn't shadowed by a stale shell export (matches the api-key resolution path — see #20591). The order mirrors the ``PROVIDER_REGISTRY["anthropic"].api_key_env_vars`` tuple: ANTHROPIC_API_KEY -> ANTHROPIC_TOKEN -> CLAUDE_CODE_OAUTH_TOKEN rget_env_value_prefer_dotenvrr9)hermes_cli.configrrrC)rvarvalues rLget_anthropic_keyrs]>===== ->++C006B  LLL  2rKzhttps://api.kimi.com/coding default_url env_overridecN|r|S|s|S|drtS|S)zReturn the correct Kimi base URL based on the API key prefix. If the user has explicitly set KIMI_BASE_URL, that always wins. Otherwise, sk-kimi- prefixed keys route to api.kimi.com/coding/v1. zsk-kimi-) startswithKIMI_CODE_BASE_URL)rQrrs rL_resolve_kimi_base_urlr sB  *%%"!! rK> ***** your-api-key*nonenulldummyexamplechangeme placeholder your_api_keyyour_api_key_here) min_lengthrr rintboolct|tsdS|}t||krdS|t vrdSdS)zIReturn True when a configured secret looks usable, not empty/placeholder.FT) isinstancer5striplenlower_PLACEHOLDER_SECRET_VALUES)rrcleaneds rLhas_usable_secretr,sZ eS ! !ukkmmG 7||j  u}}444u 4rK provider_idpconfigtuple[str, str]c|dkrj ddlm}m}|\}}|r||\}}||fSn=#t$r%}td|Yd}~nd}~wt $rYnwxYwdSddlm} |j D]6} | | pd } t| r| | fcS7 dd l m } | |} | r| ro| }|rYt!|d dpt!|d d}t#| }t|r|d |fSn#t $rYnwxYwdS) zDResolve an API-key provider's token and indicate where it came from.rYrresolve_copilot_tokenget_copilot_api_tokenz#Copilot token validation failed: %sN)r9r9rr9 load_pool access_tokenruntime_api_keyzcredential_pool:)hermes_cli.copilot_authrr ValueErrorloggerwarning ExceptionrrrCrragent.credential_poolrhas_credentialspeekgetattrr5)rrrrtokensource api_token _base_urlexcrenv_varvalrpoolentrykeys rL _resolve_api_key_provider_secretr 8si  \ \ \ \ \ \ \ \1133ME6 )'<'__,xu! _ _E _z222)<7)<)<(: "'"'&'.4%H%H$I  $   #s**LL!KUT\^cddd#$,!&!&   KUTY[_[kllll _ _ _ JESXZ]^^^^^^^^ _3 _6 4sAB1"B CCCc|r|S|s|St}t|dpi}|d}t|tr|dr|dd}|t j|ddkr)t d|d|dSt|}|r|drt j|dd}|d|d d|d d|d d|d |d<t|d|t d |d |d|dSt d||S)aYReturn the correct Z.AI base URL by probing endpoints. If the user has explicitly set GLM_BASE_URL, that always wins. Otherwise, probe the candidate endpoints to find one that accepts the key. The detected endpoint is cached in provider state (auth.json) keyed on a hash of the API key so subsequent starts skip the probe. redetected_endpointr$key_hashr9NzZ.AI: using cached endpoint %sr6rr%)r$ endpoint_idrr%r1z$Z.AI: auto-detected endpoint %s (%s)z.Z.AI: probe failed, falling back to default %s)_load_auth_store_load_provider_stategetrrJhashlibsha256encode hexdigestrr*r._save_provider_stateinfo)rQrr auth_storestatecachedr1detecteds rL_resolve_zai_base_urlrAs "##J U 3 3 9rE YY* + +F&$&FJJz$:$:&::j"-- w~gnn&6&677AACCCRCH H H LL96*;M N N N*% %#7++H $HLL,, $>'.."2"233==??D ,#<<b11\\'2..\\'2.. & & !" Z666 :HWaccount_missingno_usable_creditssubscription_expiredtemporarily_unavailablez Please retry in a few seconds.)rrKr5r^rOrNrM#_format_nous_entitlement_auth_errorr]s rLformat_auth_errorrms  eY ' '5zz"%((5zz A@@@@ z,,, >V # #6u== =hh z+++ >V # #6u== =VV zUUU >V # #6u== = z...8888 u::rKcz ddlm}m}|d}||d}|r|Sn#t$rYnwxYw|dS)Nr&format_nous_portal_entitlement_messageget_nous_portal_account_infoT force_freshzNous model access capabilityz5 Check credits or billing in Nous Portal, then retry.)hermes_cli.nous_accountrprqr)rZrprq account_inforPs rLrlrl?s         43EEE 88 *     N        J J JJs $( 55rrQct|tsdS|}|sdStj|dddS)zJReturn a short hash fingerprint for telemetry without leaking token bytes.Nutf-8 )rr5rr7r8r9r:)rrs rL_token_fingerprintr{Rsd eS ! !tkkmmG t >'..11 2 2 < < > >ss CCrKc|tjdd}|dvS)NHERMES_OAUTH_TRACEr9>1onyestrue)osgetenvrr)rbs rL_oauth_trace_enabledr\s8 )(" - - 3 3 5 5 ; ; = =C , ,,rK) sequence_ideventrfieldsrRc tsdSd|i}|r||d<||tdt j|dddS)Nrrzoauth_trace %sTF) sort_keys ensure_ascii)rupdaterr<r"dumps)rrrpayloads rL _oauth_tracerasp  ! !&.G-!,  NN6 KK $*WSX"Y"Y"YZZZZZrKr cFtdz }tjdrpt jdz dz d} |d}n#t$r|}YnwxYw||krtd|d|S)N auth.jsonPYTEST_CURRENT_TEST.hermesFstrictz8Refusing to touch real user auth store during test run: zq. Set HERMES_HOME to a tmp_path in your test fixture, or run via scripts/run_tests.sh for hermetic CI-parity env.) rrenvironr6r homeresolver RuntimeError)pathreal_home_authresolveds rL_auth_file_pathros   { *D  z~~+,, )++ 1K?HHPUHVV ||5|11HH   HHH  ~ % %G4GGG  KsA66 BBOptional[Path]c ddlm}|}n#t$rYdSwxYwt} |d|dkrdSn#t$r ||krYdSYnwxYw|dz S)aReturn the global-root auth.json when the process is in profile mode. Returns ``None`` when the profile and global root resolve to the same directory (classic mode, or custom HERMES_HOME that is not a profile). Used by read-only fallback paths so providers authed at the root are visible to profile processes that haven't configured them locally. See issue #18594 follow-up (credential_pool shadowing). rget_default_hermes_rootNFrr)hermes_constantsrrrr)r global_root profile_homes rL_global_auth_file_pathrs<<<<<<--// tt"$$L   u  - -1D1DE1D1R1R R R4 S  ; & &44 ' &  $$s !!.A$$A:9A:r?ct}||siStjdrytjdd}|rWt |dz dz } |d|dkriSn#t$rYnwxYw t|S#t$ricYSwxYw) a8Load the global-root auth store (read-only fallback). Returns an empty dict when no global fallback exists (classic mode, or the global auth.json is absent). Never raises on missing file. Seat belt: under pytest, refuses to read the real user's ``~/.hermes/auth.json`` even when HERMES_HOME is set to a profile path. The hermetic conftest does not redirect ``HOME``, so ``get_default_hermes_root()`` for a profile-shaped HERMES_HOME can still resolve to the real user's home on a dev machine. That would leak real credentials into tests. This guard uses the unmodified ``HOME`` env var (what ``os.path.expanduser('~')`` would resolve to), not ``Path.home()``, because ``Path.home`` is sometimes monkeypatched by fixtures that want to relocate the global root to a tmp path. NrHOMEr9rrFr) rexistsrrr6r rrr4) global_path real_home_env real_roots rL_load_global_auth_storers  )**K+"4"4"6"6  z~~+,, vr22  ]++i7+EI &&e&44 8I8IQV8I8W8WWWIX     ,,,  s$>/B// B<;B<C CCcDtdS)N.lock)r with_suffixrArKrL_auth_lock_pathrs    ( ( 1 11rK lock_pathholderthreading.localtimeout_secondstimeout_messagec#Kt|dddkr=|xjdz c_ dV|xjdzc_n#|xjdzc_wxYwdS|jddt)t "d|_ dVd|_n #d|_wxYwdSt rH|r|jdkr| dd | t rd nd d 5}tj td |z} tr?t j|tjtjznG|dt j|t jdnX#t*t,t.f$r=tj |krt1|tjd YnwxYwd|_ dVd|_trL t j|tjnD#t,t6f$rYn0wxYwt r` |dt j|t jdn#t,t6f$rYnwxYwn#d|_trJ t j|tjw#t,t6f$rYwwxYwt r` |dt j|t jdw#t,t6f$rYwwxYwwxYwddddS#1swxYwYdS)uCross-process advisory flock helper. Reentrant per-thread via ``holder.depth``. Falls back to a depth-only guard when neither ``fcntl`` nor ``msvcrt`` is available (rare). Callers supply their own ``threading.local`` so independent locks (e.g. profile auth.json vs shared Nous store) don't share reentrancy state — that would let one lock's reentrant acquisition silently skip the other's kernel-level flock. depthrr#NTparentsexist_okr.ryencodingzr+za+?g?)rrparentmkdirfcntlmsvcrtrstatst_size write_textopentime monotonicmaxflockfilenoLOCK_EXLOCK_NBseeklockingLK_NBLCKBlockingIOErrorOSErrorPermissionError TimeoutErrorsleepLOCK_UNIOErrorLK_UNLCK)rrrr lock_filedeadlines rL _file_lockrs3 vw""Q&&    EEE LLA LLLFLLA LLLLLL 4$777 }   EEEFLL1FL    4y''))4Y^^-=-=-E-J-JS7333 0D7 C Cy>##c#&?&?? ! !KK 0 0 2 2EMEM4QRRRRNN1%%%N9#3#3#5#5vJJJ#Wo> ! ! !>##x//&777 4      ! !   EEEFL K 0 0 2 2EMBBBB)D NN1%%%N9#3#3#5#5vJJJJ)D   FL K 0 0 2 2EMBBBB)D NN1%%%N9#3#3#5#5vJJJJ)D  3s>AB B&N<7B GN<AHN<H N<%K+)N<81I+)N<+J<N<?J N< AKN<K'$N<&K''N<+N,;1L-,N,-M >N,M  N, ANN,N( %N,'N( (N,,N<<OOc#Kttt|d5dVddddS#1swxYwYdS)aCross-process advisory lock for auth.json reads+writes. Reentrant. Lock ordering invariant: when this lock is held together with ``_nous_shared_store_lock``, acquire ``_auth_store_lock`` FIRST (outer) and the shared Nous lock SECOND (inner). All runtime refresh paths follow this order; violating it risks deadlock against a concurrent import on the shared store. z%Timed out waiting for auth store lockN)rr_auth_lock_holderrs rL_auth_store_lockrs /     s 8<< auth_filec|p t}|s tidS tj|}nz#t $rm}|d} ddl}|j ||n#t $rYnwxYwt d|||tidcYd}~Sd}~wwxYwt|trt|dts(t|dtrU|dit|dtrt!|d|St|trPt|dtr(|d}i}d|vr |d|d <t||rd ndd StidS) N)version providersz .json.corruptruYauth: failed to parse %s (%s) — starting with empty store. Corrupt file preserved at %srcredential_poolsystems nous_portalrM)rractive_provider)rrAUTH_STORE_VERSIONr"loads read_textrrshutilcopy2rrrrJr6 setdefault_migrate_stale_nous_portal_url)rrbr corrupt_pathrrrs rLr4r4*s?._..I     @-B???@j,,..//  @ @ @ ,,_==   MMM FLL 1 1 1 1    D  + sL   .B???????? @#t377;''.. cgg/00$ 7 7 {B''' cggk**D 1 1 = *3{+; < < < #tBCGGI,>,>!E!EBi. G # # ' 6If -I-6#@66DBB B* ; ;;sA&A C!C 7B  C  BC B)C C Cr= target_pathc||n t}|jddt|t|d<t jtj |d<tj |ddz}| |j dtjd t!jj} tjt)|tjtjztjzt0jt0jz}tj|d d 5}|||tj|dddn #1swxYwYtA|| tjt)|jtj!}n#tD$rd}YnwxYw|C tj|tj#|n#tj#|wxYw |$r|%nO#tD$rYnCwxYw# |$r|%ww#tD$rYwwxYwxYw |&t0jt0jzn#tD$rYnwxYw|S) NTrr updated_at)indent .tmp..wryr)'rrrrrrnowrutc isoformatr"r with_namer7rgetpiduuiduuid4hexrr5O_WRONLYO_CREATO_EXCLrS_IRUSRS_IWUSRfdopenwriteflushfsyncrrO_RDONLYrcloserunlinkchmod)r=rrrtmp_pathfdhandledir_fds rL_save_auth_storerTs( +6 O> J  J K (J:8K : KK KK ,K;; LL/tuple[Optional[Dict[str, Any]], Optional[Path]]c|d}t|trG||}t|trt|tfSt }t }|re|d}t|tr;||}t|trt||fSdS)aReturn a provider state plus the auth.json path it came from. Most callers only need the state, but refresh paths that rotate single-use OAuth refresh tokens must write the updated token chain back to the same store they read. In profile mode ``_load_provider_state`` can read a global-root fallback state; persisting a rotated Nous refresh token only to the profile would leave the global/root store stale and cause the next process to replay an already-consumed refresh token. rNN)r6rrJrrr)r=rrr>r global_storeglobal_providers global_states rL _load_provider_state_with_sourcers{++I)T""2 k** eT " " 2;; 1 11 1(**K*,,L7'++K88 & - - 7+// <`` inside the profile, the profile state fully shadows the global state on the next read. See issue #18594 follow-up. )r)r=rr> _source_paths rLr5r5s;:{SSE< LrKr>c|di}t|ts i|d<|d}|||<||d<dSNrrrrrJ)r=rr>rs rLr;r;sX%%k266I i & &,"$ ;{+ "Ik$/J !!!rK source_pathc`t}||} |d|dk}n#t$r ||k}YnwxYw|r"t|||t |dSt |}t|||t ||dS)z?Persist provider state back to the auth store it was read from.NFr)r)rrrr;rr4)r=rr>r active_path same_store source_stores rL_save_provider_state_to_sourcer#s"##K! 0 (((66+:M:MUZ:M:[:[[ 000 K/ 0Ze<<<$$$#K00L{E:::\{;;;;;;s.AAAT set_activer%c|di}t|ts i|d<|d}|||<|r||d<dSdSrr)r=rr>r%rs rL_store_provider_stater'sl%%k266I i & &,"$ ;{+ "Ik4(3 $%%%44rKct5t}|dpds||d<t |ddddS#1swxYwYdS)a5Set ``active_provider`` to *provider_id* only when none is set yet. Used by ``hermes auth add`` OAuth paths that create credential-pool entries directly (no singleton ``providers.`` block). Adding the very first credential for a provider should make it the active provider so the setup wizard's ``_model_section_has_credentials()`` check (which consults ``get_active_provider()``) does not report "No inference provider configured". Subsequent adds for an already-active setup leave the user's chosen active provider untouched. rr9N)rr4r6rrrr=s rLmark_provider_active_if_unsetr*s   ))%'' 0117R>>@@ ),7J( ) Z ( ( ( ))))))))))))))))))sA A((A,/A,cv|pd}|tvp|tvSNr9)rrrr2r normalizeds rLis_known_auth_providerr/s;#**,,2244J * * Rj >>rKct}|d}t|tsi}i}t }|r|dnd}t|tr|}|t|}|D]\\}}t|t r|s||} t| t r| rJt |||<]|S||} t| t r| rt | S||} t| t rt | ngS)uReturn the persisted credential pool, or one provider slice. In profile mode, the profile's credential pool is authoritative. If a provider has no entries in the profile, entries from the global-root ``auth.json`` are used as a read-only fallback — so workers spawned in a profile can see providers that were only authenticated at global scope. Profile entries always win: the global fallback only applies per-provider when the profile has zero entries for that provider. Once the user runs ``hermes auth add `` inside the profile, profile entries fully shadow global for that provider on the next read. Writes always go to the profile (``write_credential_pool`` is unchanged). See issue #18594 follow-up. rN)r4r6rrJritemslist) rr=r  global_poolrmaybe_global_poolmergedgp_key gp_entriesexistingprovider_entriesglobal_entriess rLread_credential_poolr=s "##J >>+ , ,D dD ! !"$K*,,L?KU (():;;;QU#T**(' d"-"3"3"5"5 . . FJj$// z zz&))H(D)) h !*--F6NN xx ,,"D))&.>&$%%% __[11N#-nd#C#C K4   KrK) removed_idsentriesList[Dict[str, Any]]r>Optional[Iterable[str]]cd|pdD}t5t}|d}t|tsi}||d<fd|D}|}t|t r|ng}d|D} t |} |D][} t| ts| d} | r| | vs| |vr8| t| \| |<t|cdddS#1swxYwYdS)aPersist one provider's credential pool under auth.json. This is the final disk-boundary guard for borrowed/reference-only credentials. Callers may pass raw dictionaries, so sanitize here even when ``PooledCredential.to_dict()`` already did the same work upstream. Re-read the on-disk pool under the same lock and merge entries present on disk but missing from ``entries``. Those were added by another process after the caller loaded its in-memory snapshot; without this merge a later rotation/exhaustion rewrite drops the concurrent credential. Pass ``removed_ids`` for entries the caller intentionally removed, so the merge does not resurrect them from the on-disk copy. ch|]}||SrArA)rrids rL z(write_credential_pool..Is999sS9s999rKrArc^g|])}t|trt|n|*SrA)rrJr)rr rs rL z)write_credential_pool..PsM   %&& 2 0 D D D,1   rKch|]A}t|t|d,|dBS)r6)rrJr6)rr s rLrEz(write_credential_pool..WsV   %&& ,199T?? IIdOO   rKr6N) rr4r6rrJr4appendrr) rr?r>removedr=r sanitized_entriesr: existing_listnew_idsr7 disk_entrydisk_ids ` rLwrite_credential_poolrP5s(:9{0b999G   ,,%'' ~~/00$%% 1D,0J( )    !    88K(($.x$>$>FB   *    (,,='>'>' Y YJj$//  nnT**G g00Gw4F4F MM>z;WW X X X X"[ ++7,,,,,,,,,,,,,,,,,,sDD33D7:D7rct5t}|di}||g}||vr||t |ddddS#1swxYwYdS)z@Mark a credential source as suppressed so it won't be re-seeded.suppressed_sourcesN)rr4rrIrrrr= suppressed provider_lists rLsuppress_credential_sourcerVhs   %%%'' **+?DD "--k2>>  & &   ( ( ($$$ %%%%%%%%%%%%%%%%%%sA#A??BBc t}|di}|||gvS#t$rYdSwxYw)z=Check if a credential source has been suppressed by the user.rRF)r4r6r)rrr=rTs rLis_source_suppressedrXssa%'' ^^$8"==  R8888 uus;> A  A ct5t}|d}t|ts ddddS||}t|t r||vr ddddS|||s||d|s|ddt| ddddS#1swxYwYdS)zClear a suppression marker so the source will be re-seeded on the next load. Returns True if a marker was cleared, False if no marker existed. rRNFT) rr4r6rrJr4removepoprrSs rLunsuppress_credential_sourcer\}s   %'' ^^$899 *d++   #{33 -.. & 2M2M V$$$ . NN; - - - 7 NN/ 6 6 6$$$s:C4/C4AC44C8;C8c>t}t||S)uReturn persisted auth state for a provider, or None. In profile mode, ``_load_provider_state`` already falls back to the global-root ``auth.json`` per-provider when the profile has no entry — so this is now a thin convenience wrapper. Profile state always wins when present. Writes (``_save_auth_store`` / ``persist_*_credentials``) are unchanged — they still target the profile only. This mirrors ``read_credential_pool``'s per-provider shadowing semantics so that ``_seed_from_singletons`` can reseed a profile's credential pool from global-scope provider state (e.g. a globally-authenticated Anthropic OAuth or Nous device-code session). See issue #18594 follow-up. )r4r5r)s rLget_provider_auth_stater^s"##J  K 8 88rKcHt}|dS)z8Return the currently active provider ID from auth store.r)r4r6r=s rLget_active_providerras !##J >>+ , ,,rKc|pd} t}|dpd}|r||krdSn#t$rYnwxYw ddlm}|}|d}t|trC|dpd}||krdSn#t$rYnwxYwdh}t|} | r?| j d kr4| j D],} | |vrttj| drdS-d S) aReturn True only if the user has explicitly configured this provider. Checks: 1. active_provider in auth.json matches 2. model.provider in config.yaml matches 3. Provider-specific env vars are set (e.g. ANTHROPIC_API_KEY) This is used to gate auto-discovery of external credentials (e.g. Claude Code's ~/.claude/.credentials.json) so they are never used without the user's explicit choice. See PR #4210 for the same pattern applied to the setup wizard gate. r9rTr load_configrrMrrQF)rrr4r6rrrdrrJrr8rCrrr) rr.r=activerdcfg model_cfg cfg_provider_IMPLICIT_ENV_VARSrrs rL!is_provider_explicitly_configuredrjs#**,,2244J %'' ..!2339r@@BBHHJJ  f **4        111111kmmGGG$$ i & & %MM*55;BBDDJJLLLz))t      44##J//G7$ 11/  G,,, 7B!7!788 tt  5s%AA>> B  B A;D DDc(t5t}|p|d}|s ddddS|di}t|tsi}||d<|d}t|tsi}||d<d}||vr||=d}||vr||=d}|d|krd|d<d}|s ddddSt |dddn #1swxYwYdS)z Clear auth state for a provider. Used by `hermes logout`. If provider_id is None, clears the active provider. Returns True if something was cleared. rNFrrT)rr4r6rrJr)rr=targetrr cleareds rLclear_provider_authrns   %%%'' A /@ A A  %%%%%%%% NN;33 )T** 0I&/J{ #~~/00$%% 1D,0J( ) Y  &!G T>>V G >>+ , , 6 6,0J( )G ;%%%%%%%%< $$$=%%%%%%%%%%%%%%%> 4s)DBD,DD D ct5t}d|d<t|ddddS#1swxYwYdS)z Clear active_provider in auth.json without deleting credentials. Used when the user switches to a non-OAuth provider (OpenRouter, custom) so auto-resolution doesn't keep picking the OAuth provider. Nr)rr4rr`s rLdeactivate_providerrps   %%%'' (, $%$$$%%%%%%%%%%%%%%%%%%s#?AA provider_namecj ddlm}|}|sdSdg}|D]s}|jdkrdnd}|d|d |j|jr|jdnd}|r|d |td |S#t$rYdSwxYw) zReturn a helpful hint string when provider resolution fails. Checks for common config.yaml mistakes (malformed custom_providers, etc.) and returns a human-readable diagnostic, or empty string if nothing found. r)validate_config_structurer9uCConfig issue detected — run 'hermes doctor' for full diagnostics:rZERRORWARNINGz [z] u → r) rrsseverityrIrPhint splitlinesjoinr)rqrsissueslinesciprefix first_hints rL%_get_config_hint_for_unknown_providerrs ??????**,, 2VW 6 6B " w 6 6WWIF LL5v5555 6 6 646GC++--a00J 6 4 44555yy rrsB$B B$$ B21B2)explicit_api_keyexplicit_base_url requestedrrc  |pd}iddddddddddd dd dd d d d dd ddddddddddddddiddddddddddddd d!d"d!d#d$d%d$d&d'd(d'd)d'd*d+d,d+d-d+d.d/id0d/d1d2d3d2d4d2d5d2d6d7d8d7d9d:d;d:dd=d=d=d?d@dAd@dBd@dCdDdEdDidFdGdHdGdIdGdJdGdKdLdMdLdNdLdOdLdPdQdRdQdSdTdUdTdVdTdWdWdXdWdYdWdZd[d\d[d[d[d[d]} d^d_lm}|D]}|jD]}||vr |j||<n#t $rYnwxYw|||}|d`krd`S|d[krd[S|tvr|S|dkr6t|}da|db} |r | dc|z } n| ddz } t| def|s|rd`Sdg} d^dhl m } | pidi} t| tr}| dj} t| trS| tvr&| Sn2#t $r%} t dk| Ydg} ~ ndg} ~ wwxYwt%t'jdls!t%t'jdmrd`S d^dnlm}|d`rd`Sn2#t $r%} t do| Ydg} ~ ndg} ~ wwxYwdg} t1}|dp}|r-|tvr$t3|dqr|}n2#t $r%} t dr| Ydg} ~ ndg} ~ wwxYwtD]n\}}|jdskr|dtvr|jD]P}t%t'j|dur,|r$||krt dv|||||ccSQo|rIt| tr2| r0| djst dw||S d^dxlm}|rdLSn#t@$rYnwxYwtdydzf){uX Determine which inference provider to use. Priority (when requested="auto" or None) — explicit user intent wins over a stale logged-in OAuth provider (#29285): 1. Explicit CLI api_key/base_url -> "openrouter" 2. config.yaml `model.provider` 3. OPENAI_API_KEY / OPENROUTER_API_KEY env vars -> "openrouter" 4. OpenRouter credential pool 5. Provider-specific API keys (GLM, Kimi, MiniMax, ...) -> that provider 6. auth.json `active_provider` (logged-in OAuth) — last-resort fallback 7. AWS Bedrock credential chain 8. Error (no provider configured) autoglmrezz-aizz.aizhipugoogleraz google-geminizgoogle-ai-studiozx-airx.aigrokrTz x-ai-oauthz grok-oauthzxai-grok-oauthkimirjzkimi-for-codingmoonshotzkimi-cnrnz moonshot-cnsteprpzstepfun-coding-planzarcee-airsarceeaiz gmi-cloudrvgmicloudz minimax-chinar minimax_cnzminimax-portalr}zminimax-global minimax_oauthalibaba_codingrzalibaba-codingalibaba_coding_planclauderz claude-codegithubrYzgithub-copilotz github-modelsz github-modelzgithub-copilot-acpr^zcopilot-acp-agentopencoderzenz qwen-portalrUqwen-clihfrz hugging-facezhuggingface-hubmimorz xiaomi-mimotencentrtokenhubz tencent-cloud tencentmaasawsrz aws-bedrockzamazon-bedrockamazongorzopencode-go-subkilorz kilo-codez kilo-gatewayrVz lm-studio lm_studioollamarr) ollama_cloudvllmllamacppz llama.cppz llama-cpprrrzUnknown provider 'z'.z z` Check 'hermes model' for available providers, or run 'hermes doctor' to diagnose config issues.invalid_provider)rNNrcrrMzACould not read config.yaml model.provider for auto-resolution: %srROPENROUTER_API_KEYrz.Could not check OpenRouter credential pool: %sr logged_inz+Could not pre-read active auth provider: %srQ>rYrVr9zProvider resolved to %r via %s, preempting your logged-in OAuth provider %r. If you meant to use the OAuth login, unset %s or set `model.provider` explicitly.zProvider resolved to logged-in OAuth provider %r because config.yaml `model` has no `provider` key. If you meant a different provider, set `model.provider` explicitly.has_aws_credentialszNo inference provider configured. Run 'hermes model' to choose a provider and model, or set an API key (OPENROUTER_API_KEY, OPENAI_API_KEY, etc.) in ~/.hermes/.env.no_provider_configured)!rrrraliasesr7rr6rrrKrrdrrJr5rr*rrrrrrr4get_auth_statusr3r8rCragent.bedrock_adapterr ImportError)rrrr._PROVIDER_ALIASES_lp_pp_alias _config_hintmsg _model_cfgrd _cfg_providere _load_pool _oauth_active_store_maybepidrrrs rLresolve_providerr/s(%v,,..4466J! u!e!%+U!4;U!(!+X!7I8! !u!'-e! [ !#/ ! k ! $4[ !  ! 1- ! BL] !! #!&34D!  !1)! G!'! U!'! !(4\! /!,<_!O^_n! /!2BCX! 4! +!!! -k! )!! .y!!" #!"%3I#!$ m%!$.A-%!& N'!&%*>'!( |)!(&0)!(@L\)!* m+!*,]+!*=N}+!, -!,(-!!!. %/!.(23E/!0 +1!0.;>J\!!|Xx&&&VD?8B6I00 J:JJ'#L L<L77L<AN ON??OR.. R;:R;Optional[float]clt|tr|sdS|}|sdS|dr |dddz} t j|}n#t $rYdSwxYw|j |tj }| S)NZ+00:00)tzinfo) rr5rrr fromisoformatrrreplacerr timestamp)rtextparseds rL_parse_iso_timestamprs eS ! !t ;;==D t }}S$CRCy8#'-- tt }x|44     sA** A87A8expires_at_iso skew_secondsc\t|}|dS|tj|zkS)NT)rr)rr expires_epochs rL _is_expiringrs0(88Mt TY[[<7 88rK expires_inch t|}n#t$rd}YnwxYwtd|S)Nr)rrr)rttls rL_coerce_ttl_secondsrsF*oo  q#;;s  !!ct|tsdS|d}|r|ndS)NrC)rr5rrE)rrs rL_optional_base_urlrsC eS ! !tkkmm""3''G '774'rKzapi.nousresearch.comzFrozenSet[str]_NOUS_STALE_PORTAL_HOSTS>portal.nousresearch.com localhost 127.0.0.1_NOUS_PORTAL_ALLOWED_HOSTSrcL|d}t|tsdS|dpd}|rJt |}|jt vr/td|tt|d<dSdSdS)NrMr:r9z3auth: migrating stale nous portal_base_url %s -> %s) r6rrJrrhostnamerrrDEFAULT_NOUS_PORTAL_URL)rrMstoredrs rLrr3s == D dD ! !hh())/R 6 6 8 8F >&!! ?6 6 6 NNE/   '>D" # # #>> 6 6rKzinference-api.nousresearch.com_ALLOWED_NOUS_INFERENCE_HOSTSurlct|tsdS|}|sdS t|}n#t$rYdSwxYw|jdkr"t d|jdS|jtvr"t d|jdS| dS)uValidate a Portal-returned inference URL against the host allowlist. Returns ``url`` (normalised by stripping trailing slashes) if it's a well-formed ``https:///...`` URL. Returns ``None`` if the URL is missing, malformed, non-https, or points at an unexpected host — letting the caller fall back to the configured default rather than persist or forward a poisoned value. Defense-in-depth: a compromised refresh response from the Portal API (MITM, malicious response injection) could otherwise redirect every subsequent proxy request — bearing the user's inference JWT — to an attacker-controlled endpoint. Validating scheme + host at the source closes that loop before the poisoned URL ever lands in ``auth.json``. The env-var override path (``NOUS_INFERENCE_BASE_URL``) bypasses this — env values come from the trusted OS user, not from the network, and the override is documented for staging/dev use. Co-authored-by: memosr NhttpszEnous: refusing non-https inference URL scheme %r from Portal responsezenous: refusing inference URL host %r from Portal response (not in allowlist); falling back to defaultrC) rr5rrrschemerrrrrE)rrrs rL)_validate_nous_inference_url_from_networkrOs, c3  tiikkG t'"" tt } S M   t ;;; : O   t >>#  sA AAcDttjdS)uReturn the user-set ``NOUS_INFERENCE_BASE_URL`` override, if any. This is the documented dev/staging escape hatch. The env source is trusted (the OS user set it themselves), so it is intentionally NOT gated by the network host allowlist — unlike Portal-returned URLs. Returns a trailing-slash-stripped non-empty string, or ``None`` when the env var is unset/blank. NOUS_INFERENCE_BASE_URLrrrrArKrL_nous_inference_env_overrider~s bi(ABB C CCrKclttjdptjdS)uReturn the user/deployment-set Portal base URL override, if any. Mirrors ``_nous_inference_env_override()``: ``HERMES_PORTAL_BASE_URL`` / ``NOUS_PORTAL_BASE_URL`` are the documented dev/staging escape hatch for pointing Hermes at a non-production Nous Portal (e.g. a hosted agent provisioned on nous-account-service's `staging` environment, which stamps ``HERMES_PORTAL_BASE_URL=https://portal.staging-nousresearch.com`` into the container env). The env source is trusted (the OS user/deployment set it themselves), so — like the inference override — it must NOT be gated by ``_NOUS_PORTAL_ALLOWED_HOSTS``: that allowlist exists to reject an untrusted NETWORK-provided value (a poisoned portal_base_url persisted to auth.json), not a value the operator explicitly configured. Returns a trailing-slash-stripped non-empty string, or ``None`` when neither env var is set/blank. HERMES_PORTAL_BASE_URLNOUS_PORTAL_BASE_URLrrArKrL_nous_portal_env_overriders4"  *++Pry9O/P/P  rKct|tr|ddkriS|dd}|ddt |dzz dzzz } t j|d}tj | d}n#t$ricYSwxYwt|tr|niS)Nrrr#=rry) rr5countsplitrbase64urlsafe_b64decoder9r"rdecoderrJ)rrrbclaimss rL_decode_jwt_claimsrs eS ! !U[[%5%5%:%: kk#q!G sq3w<'>??CJJw//00  -- 56625s+AB:: C C  raw_scopeset[str]ct}t|trW|ddD]-}|}|r||.ndt|ttttfr<|D]9}t|tr"| t|:|S)N,r.) setrr5rrraddr4rB frozensetr _scope_values)rscopespartritems rLrrsuuF)S!!3%%c3//5577 $ $DjjllG $ 7### $ IeS)< = =3 3 3D$$$ 3 mD11222 MrKr= expires_atmin_ttl_secondsr=rrct|}|sdSt|t|dzt|dz}t|vrdS|d}t dt |}t |t tfr+t|tj|zkrdSdSt||rd SdS) zDReturn None when the token can be used for inference, else a reason.access_token_not_jwtr=scpmissing_inference_invoke_scopeexprinvoke_jwt_expiringN%invoke_jwt_expiry_unknown_or_expiring) rrr6NOUS_INFERENCE_INVOKE_SCOPErrrrrr)rr=rrrrrskews rL_nous_invoke_jwt_statusr s  & &F &%%e  7++ , , -  5)) * * + #&00// **U  C q#o&& ' 'D#U|$$ ::$)++, - -((tJ%%766 4rKc,t||||duS)Nr)r )rr=rrs rL_nous_invoke_jwt_is_usablers1 !+      rKrrc||dn|}t||d|d}|dStd|dd|d ) Nrr=rr=r8Nous Portal access token is not a usable inference JWT (z-). Re-authenticate with: hermes auth add nousrMTrL)r6r rK)r>rrreasons rL!_assert_nous_inference_jwt_usablers *6)=EIIn % % %B B B) obtained_atr!c |d}t|tr|sdSt jt j}|d}|r|}nY|d|kr,t|tr|r|}n|}t||d}t|}|1tdt|tj z n!t|d}|r ||d<||d<||d<d|d<||d<||d <d |d <||d<dS) Nragent_key_obtained_at agent_keyrrr agent_key_idagent_key_expires_atagent_key_expires_inFagent_key_reused)r6rr5rrrrrrr rrrrr) r>r!rrexisting_obtained_ateffective_obtained_atrrrs rL#_set_nous_agent_key_from_invoke_jwtr+s 99^,,L lC ( ( 0B0B0D0D ,x| $ $C 99%<== 0 + +,.. +S 1 1 / & & ( ( /!5 # %lEIIl4K4KLLJ(44M  $ As=49;;.//000 rrs rL_select_nous_invoke_jwtr-Ast ,$$-););)=)=- ,n'...!YY~..rKr'c>d|DS)Nc,i|]\}}|tv||SrA)"_NOUS_EFFECTIVE_STATE_IGNORED_KEYS)rr rs rL z2_nous_effective_provider_state..Zs4    C 8 8 8 U 8 8 8rK)r3r>s rL_nous_effective_provider_stater3Ys+  ++--   rKc t|}|d}t|ttfsdSt |t jt dt|zkS)NrFr)rr6rrrrr)rrrrs rL_codex_access_token_is_expiringr5asi  - -F **U  C cC< ( (u ::$)++Asr r fhs rL_save_qwen_cli_tokensrEs#%%I 4$777i   ""in#[#[29;;#[#[IY#[#[\\H  H  bj 29, t|#  B  Yr3 1 1 1 "R HHTZqDAAADH I I I HHJJJ HRYY[[ ! ! ! " " " " " " " " " " " " " " " x+++    "!!!    D     "!!!! "    D  sg"G9A(E-! G-E11G4E15G (F22 F?>F?G>(G.,G>. G;8G>:G;;G>expiry_date_msc t|}n#t$rYdSwxYwtjtdt|zdz|kS)NTr)rrrr)rFr expiry_mss rL_qwen_access_token_is_expiringrJse'' tt IKK#a\!2!233 3t ;y HHs   4@c t|ddpd}|stddd t jt ddd d|td | }n(#t$r}td |dd |d}~wwxYw|j dkr5|j }td|rd|ndzdd  | }n(#t$r}td|dd|d}~wwxYwt|tr7t|ddpdstddd|d} t|}n#t$rd}YnwxYwt|ddpdt|d|p|t|d|ddpdpdt|d|ddpdttjdzt!d|dzzd} t#| | S)N refresh_tokenr9z@Qwen OAuth refresh token missing. Re-run 'qwen auth qwen-oauth'.rUqwen_refresh_token_missingr:!application/x-www-form-urlencodedrrAccept grant_typerMr<r!r?rzQwen OAuth refresh failed: qwen_refresh_failedz9Qwen OAuth refresh failed. Re-run 'qwen auth qwen-oauth'. Response: z*Qwen OAuth refresh returned invalid JSON: qwen_refresh_invalid_jsonrz1Qwen OAuth refresh response missing access_token.qwen_refresh_invalid_responseri`T token_typeBearer resource_urlzportal.qwen.airHr#)rrMrZr\ expiry_date)r5r6rrKr'r(QWEN_OAUTH_TOKEN_URLQWEN_OAUTH_CLIENT_IDrr)rr"rrJrrrrE) rArrMresponserbodyrrexpires_in_seconds refresheds rL_refresh_qwen_cli_tokensrds ?B77=2>>DDFFM   N!-    : C, .!.1 $      /# / /!&     s""}""$$ G'+3#T### 5!&     --//  > > >!,      gt $ $ C NB0O0O0USU,V,V,\,\,^,^  ?!0    \**J) __ )))()GKK;;ArBBHHJJW[[-HHYMZZ``bb'++lFJJ|X4V4VWWc[cddjjllxpxGKK >Sc8d8deeyiyzzAACC49;;-..Q8J1K1Kd1RR I)$$$ sB )A77 BBB C55 D?DDF!! F0/F0credsct5t}i}|drt|d|d<t |d|t |ddddS#1swxYwYdS)aSet active_provider to qwen-oauth in auth.json. Qwen OAuth tokens live in the Qwen CLI credential file managed by _save_qwen_cli_tokens / resolve_qwen_runtime_credentials. This function only writes a minimal provider-state entry (base_url for display) and sets active_provider so that get_active_provider() and _model_section_has_credentials() detect the provider for the setup wizard and status commands. r$rUN)rr4r6r5r;r)rer=r>s rL_mark_qwen_oauth_activergs   %%%'' " 99Z  7 #E*$5 6 6E* Zu===$$$ %%%%%%%%%%%%%%%%%%sAA::A>A>F) force_refreshrefresh_if_expiringrefresh_skew_secondsrhrirjc t}t|ddpd}t |}|s%|r#t |d|}|rFt |}t|ddpd}|stdddtj dd d pt}d||d |dttd S) Nrr9r]z?Qwen OAuth access token missing. Re-run 'qwen auth qwen-oauth'.rUqwen_access_token_missingr:HERMES_QWEN_BASE_URLrCr)rMr$rQr expires_at_msr) r@r5r6rrrJrdrKrrrEDEFAULT_QWEN_BASE_URLr7)rhrirjrArshould_refreshr$s rL resolve_qwen_runtime_credentialsrq sP # $ $Fvzz."55;<<BBDDL-((N i1i7 =8Q8QSghhI)&116::nb99?R@@FFHH   M!,    y/44::<<CCCHHaLaH M22,..//   rKcJt} td}dt||d|d|ddS#t$r*}dt|t|dcYd}~Sd}~wwxYw) NT)rirrQrn)rrrrQrnF)rrrZ)r7rqr5r6rK)r>rers rLget_qwen_auth_statusrs( s#%%I 1TJJJYii))yy++"YY77        YXX         sAA.. B"8BB"B" List[str]c|pt}d|D}t}g}|D]0}||vr*||||1|S)Ncg|]}||SrArA)rrs rLrGz'_spotify_scope_list..E s : : :tT :d : : :rK)DEFAULT_SPOTIFY_SCOPErrrrrI)r scope_textrseenorderedr=s rL_spotify_scope_listr{C s44;;==J : :z//11 : : :FUUDG""    HHUOOO NN5 ! ! ! NrKcFdt|S)Nr.)ryr{)rs rL_spotify_scope_stringr}O s 88' 22 3 33rKexplicitcddlm}||d|dt|tr|dndf}|D]+}t |pd}|r|cS,tddd ) Nr get_env_valueHERMES_SPOTIFY_CLIENT_IDSPOTIFY_CLIENT_IDr<r9zPSpotify client_id is required. Set HERMES_SPOTIFY_CLIENT_ID or pass --client-id.r/spotify_client_id_missingr:)rrrrJr6r5rrKr~r>r candidates candidaters rL_spotify_client_idrS s0/////  011 )**",UD"9"9C +t J   io2&&,,..  NNN  Z (   rKcddlm}||d|dt|tr|dndt f}|D]+}t |pd}|r|cS,t S)NrrHERMES_SPOTIFY_REDIRECT_URISPOTIFY_REDIRECT_URI redirect_urir9)rrrrJr6DEFAULT_SPOTIFY_REDIRECT_URIr5rrs rL_spotify_redirect_urirj s0/////  344 ,--%/t%<%<F .!!!$$ J  io2&&,,..  NNN  ''rKcddlm}|dt|tr|dndt f}|D]>}t |pdd}|r|cS?t S)NrrHERMES_SPOTIFY_API_BASE_URL api_base_urlr9rC) rrrrJr6DEFAULT_SPOTIFY_API_BASE_URLr5rrEr>rrrrs rL_spotify_api_base_urlr~ s//////  344%/t%<%<F .!!!$$J   io2&&,,..55c::  NNN  ''rKcddlm}|dt|tr|dndt f}|D]>}t |pdd}|r|cS?t S)Nrr HERMES_SPOTIFY_ACCOUNTS_BASE_URLaccounts_base_urlr9rC) rrrrJr6!DEFAULT_SPOTIFY_ACCOUNTS_BASE_URLr5rrErs rL_spotify_accounts_base_urlr s//////  899*4UD*A*AK %&&&t)J   io2&&,,..55c::  NNN  ,,rK@lengthctjtj|d}|dddSNasciirrurlsafe_b64encoderurandomrrErrbs rL_spotify_code_verifierr C  "2:f#5#5 6 6 = =g F FC ::c??4C4  rK code_verifierctj|d}t j|ddSNryrrr7r8r9digestrrrrErrs rL_spotify_code_challenger X ^M0099 : : A A C CF  #F + + 2 27 ; ; B B3 G GGrKctjtj|d}|dddSrrrs rL_oauth_pkce_code_verifierr rrKctj|d}t j|ddSrrrs rL_oauth_pkce_code_challenger rrKr<rcode_challengerc >t|d|||d|d}|d|S)NrNS256)r< response_typerr=r>code_challenge_methodrz /authorize?)r)r<rr=r>rrquerys rL_spotify_build_authorize_urlr sH $!'(  E 3 3E 3 33rKtuple[str, int, str]ct|}|jdkrtddd|jpd}|dvrtddd|jstd dd||j|jpd fS) NhttpzHSpotify PKCE redirect_uri must use http://localhost or http://127.0.0.1.r/spotify_redirect_invalidr:r9>rrz?Spotify PKCE redirect_uri must point to localhost or 127.0.0.1.zBSpotify PKCE redirect_uri must include an explicit localhost port.rC)rrrKrportr)rrhosts rL_spotify_validate_redirect_urir s l # #F } V+    ? bD --- M+    ;  P+    fk0S 00rK expected_path3tuple[type[BaseHTTPRequestHandler], dict[str, Any]]cHdddddGfddt}|fS)N)rNr>rZerror_descriptionc&eZdZd fd Zd dZd S) ?_make_spotify_callback_handler.._SpotifyCallbackHandlerrrRct|j}|jkrE|d||jddSt |j}|ddgdd<|ddgdd<|ddgdd<|ddgdd<|d| d d |drd }nd }|j| d dS)Ns Not found.rNrr>rZrr#rztext/html; charset=utf-8zW

Spotify authorization failed.

You can close this tab.zY

Spotify authorization received.

You can close this tab.ry) rr send_response end_headerswfilerrrr6 send_headerr9)rWrparamsrarresults rLdo_GETzF_make_spotify_callback_handler.._SpotifyCallbackHandler.do_GET sidi((F{m++""3'''  """   ///fl++F#ZZ77:F6N$jj4&99!._SpotifyCallbackHandler.log_message s FrKNrrR)rr5rr rrR)rErFrGrr)rrsrL_SpotifyCallbackHandlerr sL 3 3 3 3 3 3 3.      rKr)r )rrrs` @rL_make_spotify_callback_handlerr sc! F"86 #F **rKf@rdict[str, Any]c t|\}}}t|\}}Gddt} |||f|}n.#t$r!} t d|d|d| dd| d} ~ wwxYwt j|jd d id } | tj td |z} tj | kr{|ds|dr@|| | | dStjd tj | k{| | | dnC#| | | dwxYwt ddd)NceZdZdZdS)4_spotify_wait_for_callback.._ReuseHTTPServerTN)rErFrGallow_reuse_addressrArKrL_ReuseHTTPServerr s"rKrz*Could not bind Spotify callback server on :r;r/spotify_callback_bind_failedr: poll_intervalg?T)rlkwargsdaemon@rNrZrrz?Spotify authorization timed out waiting for the local callback.spotify_callback_timeout)rrr rrK threadingThread serve_foreverstartrrrshutdown server_closeryr) rrrrr handler_clsrrserverrthreadrs rL_spotify_wait_for_callbackr sD 6lCCD$8>>K#####:###!!4, <<  M M M M M M M/      V%9?TWBXae f f fF LLNNN~#c?";";;H!n))f~    C     JsOOOn))  C       C     I '   s*A A4A//A4(F5+FAG)previous_state token_payloadrequested_scoperrcttjtj}t |dd}tj||ztj} t|pi} | |||||t|dp| t|ddpd pdt|ddpd t|d p| d pd | | |d d | S) Nrrrr=rZr[rr9rM oauth_pkce) r<rrrr= granted_scoperZrrMr!rrr8) rrrrrr6rrrJrr5rr) rr<rrrrrrrrr>s rL_spotify_token_payload_to_stater* s ,x| $ $C$]%6%6|Q%G%GHHJ' *(DVVVJ %2 & &E LL$.$ ]..w77J?KKQQSS-++L(CCOxPPVVXXd\dM--nbAAGRHHNNPP   o . . yy))    %''}} **,, !#& LrKrNc  tj|dddi|d|||d|}n(#t$r}td|dd |d}~wwxYw|jd kr5|j}td |rd |ndzdd |} t| tr7t| ddpdstddd | S)N /api/tokenrrOauthorization_code)r<rSrNrrrTzSpotify token exchange failed: r/spotify_token_exchange_failedr:rVzSpotify token exchange failed.rWr9rz7Spotify token response did not include an access_token.spotify_token_exchange_invalid) r'r(rrKr)rrr"rrJr5r6) r<rNrrrrr`rdetailrs rL!_spotify_exchange_code_for_tokensrN su: , , ,#%HI&2 ,!. $      3c 3 30     s""$$&& ,)/7%V%%%R 90     mmooG gt $ $ C NB0O0O0USU,V,V,\,\,^,^  E1    Ns#& A AA c t|ddpd}|stddddt |}t |} t j|d d d id||d | }n(#t$r}td|dd|d}~wwxYw|j dkr6|j }td|rd|ndzddd| }t|tr7t|ddpdstddddt||t|t|dpt |t#||S)NrMr9z?Spotify refresh token missing. Run `hermes auth spotify` again.r/spotify_refresh_token_missingTrLr2rrrOrRrTzSpotify token refresh failed: spotify_refresh_failedr:rVz>Spotify token refresh failed. Run `hermes auth spotify` again.rWrz9Spotify refresh response did not include an access_token.spotify_refresh_invalidr=)r<rrrrr)r5r6rrKrrr'r(rr)rr"rrJrrrwr) r>rrMr<rr`rrrs rL_refresh_spotify_oauth_stater} sB  /266<"==CCEEM   M0!     #///I2599: , , ,#%HI-!.& $      2S 2 2)     s""$$&& L)/7%V%%%R 9)!     mmooG gt $ $ C NB0O0O0USU,V,V,\,\,^,^  G*!      +*777EIIg..G2GHH+*511   s-!B B4B//B4ct5t}t|d}|stddddt |}|s%|r#t |d|}|r! t|}t|d|dt|n#t$r}|j r|d rd D]}| |dd|j pd t|d dtjt jd |d< t|d|dt|n2#t&$r%}t(d|Yd}~nd}~wwxYwd}~wwxYwdddn #1swxYwYt|ddpd} | stddddd| | t|ddpdt/|t|dp|dpdt1|t3||dt|d dpdd S)Nr/z>Spotify is not authenticated. Run `hermes auth spotify` first.spotify_auth_missingTrLrFr$rMrrMrrr!refresh_failedruntime_refresh_failurerMrNrPrrOatlast_auth_errorz6Spotify OAuth: failed to persist quarantined state: %srr9z>Spotify access token missing. Run `hermes auth spotify` again.spotify_access_token_missingrZr[rr=r2) rMrrQrZr$r=r<rrrM)rr4r5rKrrr6rr'rrOr[rNr5rrrrrrrr*rrrr) rhrirjr=r>rpr_k _save_excrs rL#resolve_spotify_runtime_credentialsr  s   ''%'' $Z;; P"+!%  m,, Y"5 Y)%))L*A*ACWXXN   4U;;%j)UuUUUU ,,,,   'jEIIo,F,Fjk,, "d++++$- # <,<#&s88";,0&l8<88BBDD 00E+,j-j)UW\]]]](4444$jjj %]_hiiiiiiiij) ''''''''''''''''Ruyy44:;;AACCL   L/!     $%))L(;;GxHH)%00UYY//K599W3E3EKLLRRTT'e444-E:::ii --UYY;;ArBBHHJJ   saA-F)=1B/.F)/ F9BF?"E"!F" F,F F FFFF))F-0F-c td}|sddiS|d}t|ddpd}t |pt |d |dd |d |d |d p|d ||dt |dS)Nr/rFrrMr9rr8rr<rrr=r)rr8r<rr=rrhas_refresh_token)r^r6r5rrr)r>rrMs rLget_spotify_auth_statusr s #I . .E $U##<((J /266<"==CCEEM-J|J/J/J+JKKYY{L99YY{++ .11?++Auyy/A/A  .11!-00   rKredirect_uri_hintcddlm}ttdtdtdttdtdtdttdtttd td td td td tdtd|tdtdtdtdtt s+ t jtn#t$rYnwxYw td }n2#ttf$rttdwxYw|s5ttdtdtd|d||r|tkr |d|ttdt|S)zWalk the user through creating a Spotify developer app, persist the resulting client_id to ~/.hermes/.env, and return it. Raises SystemExit if the user aborts or submits an empty value. r)save_env_valuezF======================================================================zSpotify first-time setupz=Spotify requires every user to register their own lightweightz>developer app. This takes about two minutes and only has to bezdone once per machine.z Full guide: zSteps:z 1. Opening z in your browser...z$ 2. Click 'Create app' and fill in:z1 App name: anything (e.g. hermes-agent)z Description: anythingz Redirect URI: z API/SDK: Web APIz$ 3. Agree to the terms, click Save.z9 4. Open the app's Settings page and copy the Client ID.z 5. Paste it below.zSpotify Client ID: zSpotify setup cancelled.zNo Client ID entered. See z for the full guide.z)Spotify setup cancelled: empty Client ID.rrz0Saved HERMES_SPOTIFY_CLIENT_ID to ~/.hermes/.env)rrprintSPOTIFY_DOCS_URLSPOTIFY_DASHBOARD_URL_is_remote_session webbrowserrrinputrEOFErrorKeyboardInterrupt SystemExitr)rrrbs rL_spotify_interactive_setupr s 100000 GGG (OOO $%%% (OOO GGG IJJJ JKKK "### GGG +) + +,,, GGG (OOO D/ D D DEEE 0111 =>>> )*** 5"3 5 5666 ())) 0111 EFFF !!! GGG     O1 2 2 2 2    D 5)**0022 ' (555 34445 F  Q+;QQQRRRDEEEN-s333I.2NNN46GHHH GGG <=== GGG Js/F FF!F<rrzStarting Spotify PKCE login...z Client ID: zRedirect URI: zIMake sure this redirect URI is allow-listed in your Spotify app settings.z"Open this URL to authorize Hermes:zFull setup guide: docs_urlz)Browser opened for Spotify authorization.zz-Spotify authorization failed: state mismatch.rK)r<rNrrrr)r<rrrrr$zSpotify login successful! Auth state: z. Provider state saved under providers.spotifyz Docs: )#r^rrrKrrrr}r6rrrrrrrrrr_print_loopback_ssh_hintr_can_open_graphical_browserrrrrrrrr5rrr4r'r)rexisting_stateexplicit_client_idr<rrr=rr open_browserrr state_nonce authorize_urlopenedcallbackrr spotify_stater=saved_tos rLlogin_spotify_commandr.S s,Y77=2N !{D99 &'9>JJ    3 # #'B B B .%dNDAAaEa    )~t)L)Ln]]L !'$">">"].BTBTU\B]B] ^ ^E2>BB(88Lt\5999L*,,M,];;N*,,"K0!%+ M *+++ # # #$$$ )< ) )*** UVVV GGG ./// - GGG 1/ 1 1222 GGG\4DEEEER.00R5P5R5RR _]33FF   FFF   R = > > > > P Q Q Q)gdIt<<EFFH||GD122Ghw6GB&BBCCC||G ++HIII5 f%%+ , ,!#+gdIt<<DEE M4!+! M   00%'' j)]uUUUU#J//000000000000000  %&&& %8 % %&&& :;;; '% ' '(((((s85 B> 44  5rK> www-browserw3mlynxlinksbrowshelinkslinks2_CONSOLE_BROWSER_NAMEScddl}dd}tjdd }|r ||rd Stjd rQttjd ptjd }|s|sd S |}n#t$rYd SwxYwt|dd pt|dd pd }|r ||rd SdS)uReturn True only when a *graphical* browser is likely to open. ``webbrowser.open()`` resolves to whatever the platform offers, and on a headless / CLI-only Linux box with no GUI browser installed that is often a text-mode browser (w3m/lynx/links) which launches inside the terminal and takes over the user's session. This guard distinguishes "a real windowed browser will pop up" from "a console browser will hijack the TTY", so callers can fall back to printing the URL instead. Heuristics: * Respect ``$BROWSER`` — if it names a known console browser, refuse. * On Linux, require a display server (``$DISPLAY`` / ``$WAYLAND_DISPLAY``) unless ``$BROWSER`` points at something graphical; no display server almost always means no GUI browser. * Ask ``webbrowser.get()`` what it resolved to and refuse when the underlying command is a known console browser. * macOS and Windows always have a usable default GUI browser. rNrr5rrc|r,|dnd}tj|}|t vS)Nrr9)rrrrbasenamerr?)rrbases rL_names_console_browserz;_can_open_graphical_browser.._names_console_browser s_,1KKMMA ##%%a((rw&&,,..---rKBROWSERr9FlinuxDISPLAYWAYLAND_DISPLAYr7rBT)rr5rr) rrrr6sysplatformrrrr) _webbrowserrD browser_env has_display controllerrs rLr$r$ sN&%$$$.... *..B//K--k::u |w'' JNN9 % % J8I)J)J   ; 5 __&& uu  FB''  :z2 . .   ++I66u 4s)B>> C  C c ddl}|pd}n#t$rd}YnwxYwtjdptjdpd}|d|S)zReturn best-effort 'user@hostname' for the SSH tunnel hint command. Falls back to placeholder tokens when the values cannot be determined so the hint is always syntactically valid even if not copy-pasteable. rNz USERLOGNAMEz@)socket gethostnamerrr)_socketrrs rL_ssh_user_at_hostrV s !    &&((9M !!! ! 9V   @ ) 4 4 @D  X  s  ,,r r! str | Nonec tsdS t|}n#t$rYdSwxYw|jpd}|j}|dvs|sdSd}t t |t dt |t d|t dt dt t d |d |d t t t d |rt d |t dtt |t dS)apPrint an SSH tunnel hint when running a loopback-redirect OAuth flow on a remote host. The auth server (Spotify, MCP servers, ...) will redirect the user's browser to ``127.0.0.1:/callback``. If the browser is on a different machine than the loopback listener (the usual SSH case), the redirect can't reach the listener without a local port forward. The hint is best-effort: silent if we don't think we're remote, or if we can't parse a host/port out of the redirect URI. Pass ``docs_url`` for a provider-specific guide; the generic OAuth-over-SSH guide is always shown after it. Nr9>::1rrz<------------------------------------------------------------u/Remote session detected — SSH tunnel requiredz,Hermes is waiting for the OAuth callback on zrArrMs rL_read_codex_tokensrga s  (    , ,)++J , , , , , , , , , , , , , , ,&'' ^ < >+ , ,D dD ! !hh~&&G gt $ $ G+T22H+//??G4,,%&&  8$$ ] " "!%   + + + "&@EIIn55@""   "' !   ,n  3%2E/ "  1$0E. !#m"&#' %)!"&*"#'+#$$?,,rKr%c|Dtjtjdd}t 5t}t|dpi}t| dtr| dnd}||d<||d<d|d<|rEt| r$t| |d <t|d|t|||| t!|ddddS#1swxYwYdS) zCSave Codex OAuth tokens to Hermes auth store (~/.hermes/auth.json).NrrrOrArechatgpt auth_moder%)ri)rrrrrrrr4r5rr6rJr5rr;rsr)rArer%r=r>ris rL_save_codex_tokensrw s|HL11;;==EEhPSTT   %%%'' $Z@@FB > @ @ t KKEvNNNx   >>rKrMc ~t|tr|stddddt jt dt|}t j|dtd 5}| td d id |td }dddn #1swxYwY|j dkrAtt|dd}|d|d}nd}t|dt d|j dkr d}d|j d}d} |} t| t$r| d} t| t$r| dp| d} t| tr(| r| }| d} t| tr+| rd| }nt| tr| r~| }| dp| d}t|tr+|rd|}n#t($rYnwxYw|d vrd} |d!krd"}d} |j d#vr| sd} t|d||  |}n&#t($r}td$dd%d|d}~wwxYw|d&}t|tr|std'dd(d||t+jt.jd)d*d+}|d }t|tr+|r||d <|S),z>Refresh Codex OAuth tokens without mutating Hermes auth state.rcrOrdTrLrr)rQz User-Agentrr!rrOrMrRr!r?Nr!2Codex provider quota exhausted (429); retry after s. Credentials are still valid.fCodex provider quota exhausted (429). Credentials are still valid; retry after the usage limit resets.Fr#codex_refresh_failedz'Codex token refresh failed with status rrZrNtyperPzCodex token refresh failed: r> invalid_grant invalid_tokeninvalid_requestrefresh_token_reusedzCodex refresh token was already consumed by another client (e.g. Codex CLI or VS Code extension). Run `codex` in your terminal to generate fresh tokens, then run `hermes auth` to re-authenticate.>z*Codex token refresh returned invalid JSON.codex_refresh_invalid_jsonrz6Codex token refresh response was missing access_token."codex_refresh_missing_access_tokenrr)rrMre)rr5rrKr'TimeoutrrClientCODEX_OAUTH_USER_AGENTr(CODEX_OAUTH_TOKEN_URLCODEX_OAUTH_CLIENT_IDr)rdrr\r"rJr6rrrrrrr)rrMrrclientr` retry_afterrPrNrOerrerr_obj nested_code nested_msgerr_descrefresh_payloadrrefreshed_accessupdated next_refreshs rLrefresh_codex_oauth_purer# sM  mS ) ) 1D1D1F1F  X#3!     mCU?%;%;<<==G (0      ;; !#%HI-!.2                 "s"" 19d1S1STT  "/[/// G 6  #("     s""%SH:: & , , 4D4J4J4L4L  D#5!     )..00&,,.. X\22<<>>FFxQTUUG #&&77L,$$8););)=)=8#/#5#5#7#7 Ns= )CCC3F8K,, K98K9-M M% M  M%c  tt|ddpdt|ddpd|}nQ#t$rD}t |ddst dt |dd pd }|s|cYd }~Sd }~wwxYwt |}|d|d<|d|d<t||S) zzRefresh Codex access token using the refresh token. Saves the new tokens to Hermes auth store automatically. rr9rMrrOFzrefresh_token rejected: rNN auth_error)rr5r6rKrr{rJrw)rArrcrrzupdated_tokenss rL_refresh_codex_auth_tokensr s,  >2..4" 5 5  ?B//52 6 6+   s.66  1 SwsFD'A'A'Q\ S S    ),&\\N%.~%>N>"&/&@N?#~&&& sAA B)%9B$B)$B)ctjdd}|s#tt jdz }t |dz }|sdS tj | }| d}t|tsdS| d}| d}|r|sdSt|d rtd |dSt|S#t"$rYdSwxYw) zTry to read tokens from ~/.codex/auth.json (Codex CLI shared file). Returns tokens dict if valid and not expired, None otherwise. Does NOT write to the shared file. CODEX_HOMEr9z.codexrNrArrMru7Codex CLI tokens at %s are expired — skipping import.)rrrr5r r expanduseris_filer"rrr6rrJr5rr*r) codex_homer>rrArrMs rLryry sZ <,,2244J 1x/00 Z  ++-- ;I     t*Y002233X&&&$'' 4zz.11  ?33  = 4 +< ; ;  LLI9   4F|| tts%AE.E +E7E EEc >d} t}n#t$r}}|}t|ddr^t|dddvrKtt t|ddpd}|r||dd}nd}nd}Yd}~nd}~wwxYw| t }|rJtjd d  d pt}d ||d dddSt} | r| d} t| ttfrA| t!jkr*t| t!jz } d| d} nd} t| d t"d||tdd ddt%|d} t | dd pd  }t'dd}t)|}|s|rt+||}|rt-t/tt0|dz5td}t%|d} t | dd pd  }t)|}|s|rt+||}|rGt3| |} t | dd pd  }dddn #1swxYwYtjd d  d pt}d ||d|dddS) uResolve runtime credentials from Hermes's own Codex token store. Falls back to the credential pool when the singleton (``providers.openai-codex.tokens``) has no usable access_token but the pool (``credential_pool.openai-codex``) does. This closes the divergence between the chat path (singleton-only via this function) and the auxiliary path (pool-first via ``_read_codex_access_token``). Without this fallback, a user whose tokens live only in the pool — for example after a manual pool seed, a partial re-auth, or pool-only restoration from a backup — gets a bare HTTP 401 ``Missing Authentication header`` from the wire instead of a usable credential. See issue #32992. NrOFrN>rarbrdrrerfHERMES_CODEX_BASE_URLr9rCrOrrurMr$rQrrervreset_atrrrrLr_r`TrAr$HERMES_CODEX_REFRESH_TIMEOUT_SECONDSrrr\hermes-auth-store)rgrKrr{r5r6_pool_codex_access_tokenrrrrEDEFAULT_CODEX_BASE_URL_codex_pool_rate_limit_statusrrrrr\rJr!rr5rrAUTH_LOCK_TIMEOUT_SECONDSr)rhrirj read_errorr?rrz pool_tokenr$pool_rate_limitr remainingrPrArrefresh_timeout_secondsrps rL!resolve_codex_runtime_credentialsr si"'+J!##     3*E 2 2 wsFD7Q7QV 8 8 6c'#vt:T:T:dXd6e6effH "*HLL>EEcJJ*)  +$%+ $&  899  &**:66H(S%L11 h6L6L49;; 677 3333 :',!&    !  M#%!     $x. ! !Fvzz."55;<<BBDDL'(NPRSS-((N ] 3]8G[\\ Q c%8Q2R2RTknqTq.r.r s s s Q Q%E222D$x.))Fvzz."==CDDJJLLL!-00N" e(; e!@Oc!d!d Q3FL;cdd} t5t}dddn #1swxYwY|d}t|tsdS|d}t|t sdSt j}|D]}t|ts|d }t|tr|sX|d d krr|d }t|d pd }t|dpd } |dkpd|vpd|vpd|vp d| vpd| vpd| v} | s||d} | | |kr=|d|d| |d |ddcSn,#t$rt ddYnwxYwdS)zCReturn metadata for a pool-only Codex credential in quota cooldown.rr rrc||dkrdSt|ttfr$t|}|dkrdS|dkr|dz n|St|tr|}|sdS t|}n#t $rd}YnwxYw| |dkr|dz n|S t j|dd S#t $rYdSwxYwdS)Nr9rlJ)@@rr) rrrr5rrrrrr)rnumericrbs rL_parse_reset_atz6_codex_pool_rate_limit_status.._parse_reset_atms9 =ERKK4 ec5\ * * PEllG!||t'.1B'B'B7V## O eS ! ! ++--C t **    "+25F+F+Fw''GS -ckk#x.H.HIISSUUU   tt ts$9B BB+9C%% C32C3NrrOrrk exhaustedrmrnr9ror rate_limit usage_limitquotaz rate limitz usage limitrpr%re)r%rerrrPz#Codex pool rate-limit lookup failedTexc_inforr rr) rr4r6rrJr4rr5rrrrr*) rr=r r?rr rrNrrPis_rate_limitedrs rLrrks0+K    , ,)++J , , , , , , , , , , , , , , ,~~/00$%% 4((>**'4(( 4ikk  EeT** IIn--EeS))  yy'';6699.//D#677=2>>DDFFF%))$899?R@@FFHHG &6)& F*&f$& 7* & !G+ & g% # &uyy1F'G'GHHH#C7++ % . 9 9$))$788 99%9::    3 @ KKK :T JJJJJK 4s9H;/ H;3H;3-H;&*H;F'H;;&I$#I$c t5t}dddn #1swxYwY|d}t|tsdS|d}t|t sdSdd }|D]D}||r7t |d dcSEn,#t$rt d d YnwxYwdS)aReturn the most-recent usable access_token from the openai-codex pool. Used as a fallback by ``resolve_codex_runtime_credentials`` when the singleton has no creds. Reads ``credential_pool.openai-codex`` entries directly from auth.json and picks the first non-empty access_token, preferring entries that are not currently in an exhaustion cooldown. Returns ``""`` when no usable entry is found (caller handles by raising the original AuthError). Nrr9rOr r?rrcHt|tsdS|d}t|tr|sdS|d}t|t t fr|tjkrdSdS)NFrrpT)rrJr6r5rrrr)r rrs rL _entry_usablez/_pool_codex_access_token.._entry_usableseT** uIIn--EeS))  uyy!677H(S%L11 h6L6Lu4rKrz!Codex pool fallback lookup failedTr)r r?rr) rr4r6rrJr4r5rrrr*)r=r r?rr s rLrrs|I    , ,)++J , , , , , , , , , , , , , , ,~~/00$%% 2((>**'4(( 2     B BE}U## B599^R8899??AAAAA B B III 84 HHHHHI 2s?C+ C/C/-C"*CA CC&DDct|d}t|tr|dnd}t|trtt |ddpd}t |ddpd}|r|r|S|d}t|tr|dnd}t|t r|D] }t|tst |ddpd}t |ddpd}|r|st|pi}||t |dpd d |d<|d r|d |d <|d d |cSt|tr|ndS)zEReturn usable xAI OAuth state from provider state or credential pool.rTrANrr9rMrrZr[)rrMrZrervr)r5rrJr6r5rr4r) r=r>rArrMrr?r r7s rL_xai_oauth_state_from_storers@ [ 9 9E$.ud$;$; EUYYx F&$6::nb99?R@@FFHH FJJ;;ArBBHHJJ  M L nn%677O ot , , K(((  '4    EeT** uyy<<BCCIIKKL /2 > > D"EEKKMMM } %+2&&F ,!.!%))L"9"9"EXFF  F8  yy(( C).>)B)B~&   k< 8 8 8MMMud++ 5555rKct|tr|dnd}t|tott |ddpdoCtt |ddpdS)NrArr9rM)rrJr6rr5r)r>rAs rL"_xai_oauth_state_has_usable_tokensrs$.ud$;$; EUYYx F64   E VZZ339r::@@BB C C E VZZ44:;;AACC D DrKcx|r5t5t}dddn #1swxYwYnt}t|}t|s,tt }t|r|}|st dddd|d}t|tst ddddt|d d pd  }t|d d pd  }|st d dd d|st dddd||d|dpi|ddS)Nz`No xAI OAuth credentials stored. Select xAI Grok OAuth (SuperGrok / Premium+) in `hermes model`.rTxai_auth_missingTrLrAzGxAI OAuth state is missing tokens. Re-authenticate with `hermes model`.xai_auth_invalid_shaperr9rMzMxAI OAuth state is missing access_token. Re-authenticate with `hermes model`.xai_auth_missing_access_tokenzNxAI OAuth state is missing refresh_token. Re-authenticate with `hermes model`.xai_auth_missing_refresh_tokenre discoveryr)rArerr) rr4rrrrKr6rrJr5r)r]r=r>rrArrMs rL_read_xai_oauth_tokensrs5 (    , ,)++J , , , , , , , , , , , , , , ,&'' ' 3 3E -e 4 4!23J3L3LMM -l ; ; ! E   n #!     YYx F fd # #  U )!     vzz."55;<<BBDDL ?B77=2>>DDFFM   [ 0!       \ 1!      .11YY{++1r .11   rhc|d}t|to't|dtS)aTrue when this store has its OWN ``providers.xai-oauth`` block. Distinguishes a profile that genuinely shadows the root xAI grant from one that only *reads* root via ``_load_provider_state``'s fallback. Only the latter needs the refresh write-through below. rrT)r6rrJ)r=rs rL _profile_has_own_xai_oauth_staterAsA{++I i & & W:immK6P6PRV+W+WWrKct}|dStjdrztjdd}|rXt |dz dz } |d|dkrdSn#t $rYdSwxYw |rt|}ni}t|tsdSt|d t|d t||dS#t $r&}td |Yd}~dSd}~wwxYw) uPersist a rotated xAI OAuth ``state`` into the global-root auth.json. Best-effort write-through for the multi-profile rotation hazard (#43589): xAI rotates the refresh_token on every refresh, so when a profile session refreshes a grant it resolved from the root fallback, the rotated chain must land back in root. Otherwise root keeps a now-revoked refresh token and every other profile reading the stale root grant dies with ``invalid_grant`` once its access token expires. Only updates ``providers.xai-oauth`` in the root store; never touches the profile store (the caller already saved that). Swallows all errors — a failed write-through degrades to the pre-existing behavior (root stale), it must never break the profile's own successful save. Nrrr9rrFrrTr$z2xAI OAuth: write-through to global root failed: %s)rrrr6r rrrr4rrJr'rrr*)r>rrrrrs rL'_write_through_xai_oauth_to_global_rootrLs)**K  z~~+,, vr22  ]++i7+EI &&e&44 8I8IQV8I8W8WWWFX     P      +K88LLL,--  FlKeQVWWWW{33333 PPP I3OOOOOOOOOPs0*.B B)(B)-;D*0D E &EE rrrervrrvc|Dtjtjdd}t 5t}t| }t|dpi}||d<||d<||d<|r||d<|r||d<t|d|t||rt|ddddS#1swxYwYdS) NrrrTrArervrr) rrrrrrrr4rr5r;rr)rArrrervr=write_through_to_rootr>s rL_save_xai_oauth_tokensrysR|HL11;;==EEhPSTT   ;;%'' %EZ$P$P P$Z==C h ,n&k  +!*E+   1$0E. !Ze<<<$$$  ; 3E : : :%;;;;;;;;;;;;;;;;;;sA?C!!C%(C%ctt|trd|vrdS |d}t|dkrdS|d}|dt| dzzz }t jt j|d d}| d }t|ttfsdSt|tj td t|zkS#t$rYdSwxYw) NrFrr#rrrryrr)rr5rrr"rrrr9rr6rrrrr)rrparts payload_b64rrs rL_xai_access_token_is_expiringrs* lC ( (C|,C,Cu ""3'' u::>>5Ah ss;///!344 *V5k6H6H6Q6QRRYYZabbcckk%  #U|,, 5SzzdikkC3|3D3D,E,EEFF uus(D)BD)'AD)) D76D7ct}t|trd|vr|S |d}t |dkr|S|d}|dt | dzzz }t jtj| d d}| d}t|ttfs|St|tjz }|d kr|S|d krtd |S|S#t $r|cYSwxYw) u.How far before JWT ``exp`` to proactively refresh xAI OAuth tokens. SuperGrok sessions can still ship multi-hour access tokens, where the gateway-oriented :data:`XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS` window makes sense. Device-code logins often return ~15-minute JWTs; applying the full hour-long skew to those forces a refresh on *every* credential resolution (chat turn, Imagine tool call, ``hermes auth status``, …), which burns single-use refresh tokens and races concurrent callers into ``invalid_grant`` quarantine. rrr#rrrryrri r()%XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDSrr5rrr"rrrr9rr6rrrminr)rmax_skewrrrrrs rL#_xai_proactive_refresh_skew_secondsrsI5H lC ( (C|,C,C""3'' u::>>OAh ss;///!344 *V5k6H6H6Q6QRRYYZabbcckk%  #U|,, O#JJ, >>O   sH%% % s*)D1BD1.*D1D1/D11 E?Erc@t|}|jdkrtd|d|ddd|jpd}|std |d |ddd|d kr.|d std |d |ddd|S)uIRefuse any OIDC discovery endpoint that isn't HTTPS on the xAI origin. The OIDC discovery response is a long-lived, low-frequency request whose output is cached in ``~/.hermes/auth.json``. A single MITM during initial login could substitute a malicious ``token_endpoint``; that URL would then receive the refresh_token on every subsequent refresh — a permanent credential leak from a one-time MITM. Validating scheme + host pins the cached endpoint to the xAI auth origin (or a future ``*.x.ai`` subdomain if xAI migrates) so the cache poisoning loses its persistence guarantee. RFC 8414 §2 requires the issuer to be ``https://`` and SHOULD-keeps the token_endpoint on the same origin; we enforce both. ``x.ai`` is the bare apex, so we accept either exact host match or any ``.x.ai`` suffix. rz(xAI OIDC discovery returned a non-HTTPS r;rrTxai_discovery_invalidr:r9zxAI OIDC discovery z is missing a hostname: r.x.aiz host z is not on the xAI origin (expected x.ai or a *.x.ai subdomain). Refusing to use a cached endpoint that may have been substituted by a MITM during initial discovery; re-authenticate with `hermes model` to re-fetch.)rrrKrrr)rrrrs rL_xai_validate_oauth_endpointrs c]]F } Hu H H H H H (    O !r ( ( * *D   I% I I I I I (     v~~dmmG44~ K% K Kt K K K!(      JrKfallbackc|pdd}|s|S t|}n.#t$r!td|||cYSwxYw|jdkrtd|||S|jpd}|std|||S|dkr4| dstd ||||S|S) uRefuse a non-xAI base_url for the OAuth-authenticated inference path. The xAI Grok OAuth bearer is a high-value, long-lived credential tied to the user's SuperGrok subscription. ``XAI_BASE_URL`` / ``HERMES_XAI_BASE_URL`` let users repoint the inference endpoint (handy for staging or a local proxy), but the env override is also a credential-leak vector: a tampered ``.env`` or hostile shell init that sets ``XAI_BASE_URL=https://attacker.example/v1`` would ship the OAuth access token to a third party on every request, silently. Pin the inference origin to ``api.x.ai`` (or any ``*.x.ai`` subdomain xAI may add). On rejection, fall back to the default and log a warning rather than raise — a bad env var should not deadlock authentication, but it should also never leak the bearer. ``value`` is the already-stripped, trailing-slash-trimmed candidate from env. Empty input returns ``fallback`` unchanged. r9rCz>Ignoring malformed xAI base_url override %r; using %s instead.rznRefusing non-HTTPS xAI base_url override %r (xai-oauth bearer would be sent in cleartext); falling back to %s.zEIgnoring xAI base_url override %r with no hostname; using %s instead.rruRefusing xAI base_url override %r — host %r is not on the xAI origin (expected x.ai or a *.x.ai subdomain). The xai-oauth bearer is only valid against xAI's inference API; sending it elsewhere would leak the credential. Falling back to %s.) rrErrrrrrrr)rrrrrs rL _xai_validate_inference_base_urlrsQ&"##%%,,S11I )$$  L x     } 9 x    O !r ( ( * *D  S x    v~~dmmG44~ 2 tX     s?(A*)A*c tjtddi|}n(#t$r}t d|dd|d}~wwxYw|jdkrt d |jd dd |}n(#t$r}t d |dd |d}~wwxYwt|tst d ddt|ddpd }t|ddpd }|r|st dddt|dt|d||dS)NrQr)r!rzxAI OIDC discovery failed: rTxai_discovery_failedr:r#z#xAI OIDC discovery returned status rz*xAI OIDC discovery returned invalid JSON: xai_discovery_invalid_jsonz2xAI OIDC discovery response was not a JSON object.xai_discovery_incompleteauthorization_endpointr9token_endpointz;xAI OIDC discovery response was missing required endpoints.r)rr) r'r6XAI_OAUTH_DISCOVERY_URLrrKr)r"rrJr5rr)rr`rrrrs rL_xai_oauth_discoveryr-s 9 #12#     /# / / '      s"" I(2F I I I '    --//  > > > -      gt $ $  @ +    !-Er!J!J!PbQQWWYY%5r::@bAAGGIIN !   I +    !!7?WXXXX 7GHHHH"8(  s,! AAA0B B*B%%B*rrrc :~t|tr|stdddd|pt |d}t |dt jtdt|}t j |d d i 5}| |d d idt|d}dddn #1swxYwY|j dkrh|j}|j dkr td|rd|ndzdzdddtd|rd|ndzdd|j dv |} n(#t $r} td| dd| d} ~ wwxYwt| t"stddd dt| d!dpd} | std"dd#d| t| dp|t| d$pd| d%t| d&pd'pd't'jt*jd(d)d*} | S)+NzHxAI OAuth is missing refresh_token. Re-authenticate with `hermes model`.rTrTrLrrrrQrr}rrOrMrSr<rMr~r#rz'xAI token refresh failed with HTTP 403.rWr9uP This OAuth account is not authorized for xAI API access — xAI may be restricting API/OAuth use to specific SuperGrok tiers despite the in-app subscription being active. Re-logging in won't change that; set ``XAI_API_KEY`` and switch to ``provider: xai`` (API-key path) if available, or upgrade your subscription at https://x.ai/grok.xai_oauth_tier_deniedFzxAI token refresh failed.xai_refresh_failed>rVrz)xAI token refresh returned invalid JSON: xai_refresh_invalid_jsonr:z1xAI token refresh response was not a JSON object.xai_refresh_invalid_responserz4xAI token refresh response was missing access_token. xai_refresh_missing_access_tokenid_tokenrrZr[rr)rrMrrrZre)rr5rrKrrr'rrrrr(XAI_OAUTH_CLIENT_IDr)rr"rrJr6rrrrrr) rrMrrendpointrrr`rrrrrs rLrefresh_xai_oauth_purer^s  mS ) ) 1D1D1F1F  V 1!     ##%%`)=o)N)NO_)`H !1ABBBBmCU?%;%;<<==G g:L/M N N N  RX;; #%HI-0!.                  s""$$&&  3 & &9-3;))))=EE%,!&     ')/7%V%%%R 9 %&2j@     --//  = = = +      gt $ $  ? /!     7;;~r::@bAAGGII   B 3!     )W[[99J]KKQQSS J//5266<<>>kk,//'++l33?x@@FFHHTH X\22<<>>FFxQTUU G Ns*?$C//C36C3.F F( F##F()rc  ttdpi}t|dpd}n#t$rd}YnwxYwt t|ddpdt|ddpd||}t |}|d|d<|d|d<|dr |d|d<|d  |d |d <|d r |d |d <t|d |i||d | |S)NrTrvrNrr9rMrrrrZrrer)r5r4r5r6rrrJr)rArrrr>rvrcrs rL_refresh_xai_oauth_tokensrs($%5%7%7EEK +..E2EFF (((' (& FJJ~r * * 0b11 FJJ + + 1r22%' I &\\N%.~%>N>"&/&@N?#}}Z  ;%.z%:z"}}\"".'0'>|$}}\""?'0'>|$#^4!~.  sAA AAc  t}t|d}t|ddpd}t dd}t|dpi}t|ddpd}t|ddpd} |t |nt|} t|} | s|rt|| } | r tttt|d z 5td }t|d}t|ddpd}t|dpi}t|ddpd}t|ddpd} |t |nt|} t|} | s|rt|| } | r|st|d} t||| | }t|ddpd}n=#t $r/} t#| r t%} t'| dpi}t|dpi}|dd|dd||d<d| jpdt| ddt-jt0jd|d<t7| d|d t9| n2#t:$r%}t<d|Yd}~nd}~wwxYwd} ~ wwxYwdddn #1swxYwYtAtCj"dd#dp9tCj"dd#dtH}d||d|dddS)NrArr9"HERMES_XAI_REFRESH_TIMEOUT_SECONDSrrrrrrFr\)rrrrTrMrrTrr r$z2xAI OAuth: failed to persist quarantined state: %sHERMES_XAI_BASE_URLrCrrrrerNr)%rrJr5r6rr!rrrrrrrrrrrK$_is_terminal_xai_oauth_refresh_errorr4r5r[rNrrrrrr'rrrr*rrrrEDEFAULT_XAI_OAUTH_BASE_URL)rhrirjr?rArrrrreffective_skewrpr_q_store_q_state _q_tokensr r$s rL%resolve_xai_oauth_runtime_credentialsr sa " # #D $x. ! !Fvzz."55;<<BBDDL'(LbQQTXXk**0b11I'7<<BCCIIKKNtxx339r::@@BBL + !!! 0 > > -((N U 3U6|^TT5 c%8Q2R2RTknqTq.r.r s s s4 4 )666D$x.))Fvzz."==CDDJJLLLTXXk228b99I /?!D!D!JKKQQSSNtxx;;ArBBHHJJL(3()))8FF  "-00N" ](; ]!>|^!\!\% %e%9:Q%R%RSc%dN"6'5%1(? F $'vzz."'E'E'K#L#L#R#R#T#TLL ;C@@'7'9'9H';Hk'R'R'XVXH(,X\\(-C-C-Ir(J(JI%MM.$???%MM/4@@@1:HX.,7(+(H4H+.s88*C48&.l8<&@&@&J&J&L&L ;;H%672(K^cdddd,X6666("LL TV_554 4 4 4 4 4 4 4 4 4 4 4 4 4 4 l0 ',,2244;;C@@ = 9^R ( ( . . 0 0 7 7 < <+H  %00)   sc6E QA L Q Q Q+C%PQ QP;6Q;QQQ  QQQbool | ssl.SSLContextctjdkr< ddl}tj|S#t $rYnwxYwdS)a~Platform-aware default SSL verify for httpx clients. On macOS with Homebrew Python, the system OpenSSL cannot locate the system trust store and valid public certs fail verification. When certifi is importable we pin its bundle explicitly; elsewhere we defer to httpx's built-in default (certifi via its own dependency). Mirrors the weixin fix in 3a0ec1d93. darwinrNcafileT)rIrJcertifisslcreate_default_contextwherer)rs rL_default_verifyrKs` |x  NNN-W]]__EEE E    D  4s*= A  A insecure ca_bundle auth_staterOptional[bool]rrct|tr|dni}t|tr|ni}|t|dn$t|ddd}|pP|dp;t jdp't jdpt jd}|rdS|rlt |}tj|s)t d |tStj | StS) NtlsFdefaultrrHERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLEuJCA bundle path does not exist: %s — falling back to default certificatesr)rrJr6r"rrr5risfilerrrrr)rrr tls_stateeffective_insecure effective_caca_paths rL_resolve_verifyr(]s\ *4J)E)EM u%%%2I' 488@ bI5=4H%0000 Y]]:u==u M M M  + == % % + 9' ( ( + 9_ % % + 9) * * u:l##w~~g&& % NN\   #$$ $)9999   rKr httpx.Clientr:c||dd|i|rd|ini}||gd}fd|D}|r%tdd|S) zFPOST to the device code endpoint. Returns device_code, user_code, etc.z/api/oauth/device/coder<r=r?r& user_codeverification_uriverification_uri_completerintervalcg|]}|v| SrArA)rfr?s rLrGz(_request_device_code..s;;;QQd]]q]]]rKz%Device code response missing fields: , )r(raise_for_statusr"rry)rr:r<r=r`required_fieldsmissingr?s @rL_request_device_coder7s{{ 222  #(0b H  ==??DO<;;;/;;;GWU7ASASUUVVV KrKrc&tjtd|z}tdt|t}tj|kr$||dd||d}|jdkr)|} d| vrtd| S |} n1#t$r$| td wxYw| d d } | d krtj || d kr)t|dzd}tj || dpd} t| d| td)zDPoll the token endpoint until the user approves or the code expires.r#/api/oauth/token,urn:ietf:params:oauth:grant-type:device_coderSr<r&r+r#rz+Token response did not include access_tokenz1Token endpoint returned a non-JSON error responserZr9authorization_pending slow_downrzUnknown authentication errorr;z*Timed out waiting for device authorization)rrrr%DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDSr(r)r"rrr4rr6rr) rr:r<r&rrrcurrent_intervalr`r error_payload error_code descriptions rL_poll_for_tokenrDs~#a"4"44H1c-1VWWXX .  X % %;; 0 0 0L&*    3 & &mmooGW,, !NOOON T$MMOOMM T T T  % % ' ' 'RSS S T#&&w33 0 0 0 J' ( ( (   $ $"#3a#7<<  J' ( ( ( #''(;<<^@^ j99K99::: C D DDs 3C.C6znous_auth.jsonctjdd}|r!t|Sddlm}|dz S)uzResolve the directory that holds the shared Nous token store. Honors ``HERMES_SHARED_AUTH_DIR`` so tests can redirect it to a tmp path without touching the real user's home. Defaults to ``/shared/``, where ```` is what :func:`hermes_constants.get_default_hermes_root` returns — so Linux/macOS classic installs land at ``~/.hermes/shared/``, native Windows installs at ``%LOCALAPPDATA%\hermes\shared\``, and Docker / custom ``HERMES_HOME`` deployments at ``/shared/``. Sits outside any named profile so all profiles under the same root share the store. HERMES_SHARED_AUTH_DIRr9rrshared)rrrr rrr)overriders rL_nous_shared_auth_dirrIshy1266<<>>H+H~~((***888888 " " $ $x //rKcTttz }tjdrrddlm}|dz tz d} |d}n#t$r|}YnwxYw||krtd|d|S) NrrrrGFrzDRefusing to touch real user shared Nous auth store during test run: z@. Set HERMES_SHARED_AUTH_DIR to a tmp_path in your test fixture.) rINOUS_SHARED_STORE_FILENAMErrr6rrrrr)rrreal_home_sharedrs rL_nous_shared_store_pathrMs " "%? ?D z~~+,, <<<<<< # # % % 03M M ''    ||5|11HH   HHH  ' ' 'ZZZZ  Ks&A== B  B c#K td}n#t$rdVYdSwxYwt|t|d5dVddddS#1swxYwYdS)a Cross-profile lock for the shared Nous OAuth store. Lock ordering invariant: if both this and ``_auth_store_lock`` need to be held, acquire ``_auth_store_lock`` FIRST. All runtime refresh paths follow this order. The one exception is ``_try_import_shared_nous_state``, which holds this lock alone for the entire refresh cycle so concurrent imports on sibling profiles can't race on the single-use shared refresh token; that helper must NOT be called with ``_auth_store_lock`` already held. rNz+Timed out waiting for shared Nous auth lock)rMrrr_nous_shared_lock_holder)rrs rL_nous_shared_store_lockrPs+--99'BB    5     s!&88A$$A(+A(c4t}|sdS|d}t|tr|sdS|d}t |dpd}t |dpd}|t|pdk}||k}|s|sdSdD] }||} | dvr| ||<!dS) zACopy fresher shared OAuth tokens into a profile-local Nous state.FrMrr9) rrMrZr=r<r:r;r!r>Nr9T)_read_shared_nous_stater6rr5rr) r>rGshared_refresh local_refreshshared_access_explocal_access_exprefresh_changedfresher_accessr rs rL_merge_shared_nous_oauth_staterZ4s. $ & &F uZZ00N nc * *.2F2F2H2HuIIo..M,VZZ -E-EFFM#+EIIl,C,CDDK$**,,M4GR0H0H0N0N0P0PPO&)99N >u    3  " "E#J 4rKc |d}|d}t|tr|sdSt|tr|sdSd|||dpd|dpt|dpt |d pt |d pt|d |d tj tj  d } t5t}|jddt#|||jdt)jdt-jj}t)jt|t(jt(jzt(jzt:jt:jz} t)j |dd5}|!tEj#|dd|$t)j%|&dddn #1swxYwYt)j'|| |(r|)nO#tT$rYnCwxYw# |(r|)ww#tT$rYwwxYwxYwdddn #1swxYwYtWdt|tY|dS#tZ$r&}t\/d|Yd}~dSd}~wwxYw)aoPersist a minimal copy of the Nous OAuth state to the shared store. Best-effort: any failure is swallowed after logging. The shared store is a convenience layer; the per-profile auth.json remains the source of truth. We deliberately omit the runtime ``agent_key`` compatibility field; the OAuth tokens are the cross-profile source of truth. rMrNr#rZr[r=r<r:r;r!r) _schemarrMrZr=r<r:r;r!rrTrrrrryrrrCnous_shared_store_written)rrefresh_token_fpz*Failed to write shared Nous auth store: %s)0r6rr5rDEFAULT_NOUS_SCOPEDEFAULT_NOUS_CLIENT_IDrDEFAULT_NOUS_INFERENCE_URLrrrrrrPrMrrrrr7rrrrrrrrrrrrrrr"rrrrrrr rrr{rrr*) r>rMrrGrtmpr rDrs rL_write_shared_nous_statercWs"IIo..M99^,,L }c * *}/B/B/D/D |S ) )l.@.@.B.B$&ii --97##9'9YY{++E/E 99%677R;R#ii(<==[A[yy//ii --l8<00::<<  F!H $ & &  *,,D K  dT  : : : d # # #..DI!T!TBIKK!T!T$*,,BR!T!TUUCC bj(294 t|+B Yr3999*RHHTZqDIIIJJJHHJJJHRYY[[)))*************** 3%%%zz||% Dzz||% %D1               4  'T/ >>      HHH A3GGGGGGGGGHs!N7/C!M>L3(A%K L3K L3 K !L3:(L#"M># L0-M>/L00M>3M/5(MM/ M, )M/+M, ,M//M>2 N7>NN7N/N77 O'O""O'ch t}n#t$rYdSwxYw|sdS tj|}n;#t tf$r'}t d||Yd}~dSd}~wwxYwt|tsdS| d}| d}t|tr|sdSt|tr|sdS|S)uReturn the shared Nous OAuth state if present and well-formed. Returns ``None`` when the file is missing, unreadable, malformed, or lacks required fields. Callers should treat ``None`` as "no shared credentials available — fall through to device-code". Nz.Shared Nous auth store at %s is unreadable: %srMr)rMrrr"rrrrrr*rrJr6r5r)rrrrMrs rLrSrSsI&(( tt <<>>t*T^^--.. Z  EtSQQQttttt gt $ $tKK00M;;~..L }c * *}/B/B/D/Dt |S ) )l.@.@.B.Bt Ns# &A B1BBcD t5t} |n#t$rYnwxYwdddn #1swxYwYt d|dS#t $r&}t d|Yd}~dSd}~wwxYw)zBRemove the shared Nous OAuth store after a terminal token failure.Nnous_shared_store_clearedrz*Failed to clear shared Nous auth store: %s)rPrMr FileNotFoundErrorrrrr*)rrrs rL_clear_shared_nous_stateris H $ & &  *,,D  $                     0@@@@@@ HHH A3GGGGGGGGGHsYA/A5A AAAA A/AA/AA// B9BBrc|t|to'|jdko|jdvot |jS)z>True when retrying the same Nous refresh token cannot succeed.rMrrrrrKrMrNrrOrs rL_is_terminal_nous_refresh_errorrnsJ 3 "" ' LF " ' HR R ' % & & rKc|t|to'|jdko|jdvot |jS)uTrue when retrying the same xAI OAuth refresh token cannot succeed. ``xai_refresh_failed`` covers HTTP 400/401/403 from the token endpoint (invalid_grant, token revoked, refresh_token_reused). ``xai_auth_missing_refresh_token`` means the pool entry has no refresh token at all — retrying will never work. Both carry ``relogin_required=True``; transient failures (429, 5xx) do not. rT>rrrlrms rLrrsJ 3 "" ' LK ' ' HP P ' % & & rKc|t|to'|jdko|jdvot |jS)uTrue when retrying the same Codex OAuth refresh token cannot succeed. ``codex_refresh_failed`` covers HTTP 400/401/403 from the token endpoint (invalid_grant, token revoked, refresh_token_reused). ``codex_auth_missing_refresh_token`` means the pool entry has no refresh token at all — retrying will never work. Both carry ``relogin_required=True``; transient failures (429, 5xx) do not. rO>rrrrrdrlrms rL&_is_terminal_codex_oauth_refresh_errorrqsN 3 "" ' LN * ' H   ' % & & rKcdD]}||dd|jt||dtjt jd|d<t|tdS)zKKeep routing metadata but remove dead OAuth material so it is not replayed.) rrMrrr!r$r%r&r'r(r#NrMTrr ) r[rNr5rrrrrri!invalidate_nous_auth_status_cache)r>rZrr s rL_quarantine_nous_oauth_staterts     #t u:: l8<((2244   E V$$$%'''''rKc|d}t|tsdS|d}t|tsdSg}d}tdth}|D]F}t|tr|d|vrd}1||G|r||d<t d||j|S) zHRemove singleton-seeded Nous pool entries that contain dead OAuth state.rFrMzmanual:rT!nous_pool_device_code_quarantined)rrB)r6rrJr4NOUS_DEVICE_CODE_SOURCErIrrN) r=rZrr r?retainedrJsingleton_sourcesr s rL_quarantine_nous_pool_entriesrzs >>+ , ,D dD ! !uhhvG gt $ $uHG02UO'O'OG  V  /z    NrKcn tt|dzt5t}|s ddddS|d|d|dpt |dpt |dpt|d pd |d pt|d |d dddddd }d d}t||d|}t|dddn #1swxYwYn#t$rw}tdt|jt|ddt!|rt#dt$d|Yd}~dSd}~wt($rI}tdt|jt$d|Yd}~dSd}~wwxYw|S)!uAttempt to rehydrate Nous OAuth state from the shared store. Reads the shared file (if present), runs a forced refresh using the stored refresh_token to produce a fresh inference JWT scoped to this profile, and returns the full auth_state dict ready for ``persist_nous_credentials()``. Returns ``None`` when no shared state is available or the rehydrate fails for any reason (expired refresh_token, portal unreachable, etc.) — caller should then fall through to the normal device-code flow. rrNrrMr<r:r;rZr[r=r!rFrr rrMr<r:r;rZr=r!rr$r&r updated_stater?_reasonr5rrRc$t|dSrT)rc)r~rs rL_persist_shared_refreshz>_try_import_shared_nous_state.._persist_shared_refreshbs(77777rKTrrhon_state_updatenous_shared_import_failedrN) error_typerB&shared_import_terminal_refresh_failurezShared Nous import failed: %s)r)r~r?rr5rrR)rPrrrSr6r`rrar_refresh_nous_oauth_from_statercrKrrrErrnrirr*r)rrGr>rrcrs rL_try_import_shared_nous_stater:s 2 $S39NPi5j5j k k k 0 0,..F  0 0 0 0 0 0 0 0!' > : :!'O!H--H2c0||dd|id|d}|jdkr-|}d|vrtdd d d |S |}n%#t$r}td d d |d}~wwxYwt |dd}t |dpd } |dv} | } |dksd| vsd| vrd} d } t| d || )Nr9zx-nous-refresh-tokenrM)rSr<r~r#rz%Refresh response missing access_tokenrMrTrLzRefresh token exchange failedrMrOrZrrrkrreusezreuse detecteduNous Portal detected refresh-token reuse and revoked this session. This usually means an external process (monitoring script, custom self-heal hook, or another Hermes install sharing ~/.hermes/auth.json) called POST /api/oauth/token with Hermes's refresh token without persisting the rotated token back. Nous refresh tokens are single-use — only Hermes may call the refresh endpoint. For health checks, use `hermes auth status` instead. Re-authenticate with: hermes auth add nous)r(r)r"rKrr5r6r) rr:r<rMr`rrArrNrCreloginlowereds rL_refresh_access_tokenrs{{ ,,,'7)"  Hs""--//  ( (C%+/TXZZZ ZI  III7!'$@@@EH II }  /:: ; ;Dm''(;<<_@_``KPPG!!G %%%G););?OSZ?Z?Z 9  K&tg V V VVsA// B9B  B)rverifyr;r bool | strcxtj|}tj|ddi|5}||dddd|i}d d d n #1swxYwY|jd krd |j} |}t|d p|d p|}n2#t$r%} t d| Yd } ~ nd } ~ wwxYwt|dd|} | d} t| tsgSg} | D]} t| ts| d}t|trT|r@|}d|vr| |dd}| |tt| S)z6Fetch available model IDs from the Nous inference API.rQrrr!rrCz/modelsrr)r!Nr#z#/models request failed with status rrZz'Could not parse error response JSON: %srMmodels_fetch_failedr:r?r6hermesmidr5rrBcj|}d|vrd|fSd|vrd|vrd|fSd|vrd|fSd|fS)Nopusrprosonnetr#r)r)rlows rL_model_priorityz*fetch_nous_models.._model_prioritysXiikk S==s8O C<N>N]R]^^KK G G G LLBA F F F F F F F F G f;PQQQQmmooG ;;v  D dD ! ! I " "$%%  88D>> h $ $ ")9)9 "..""C399;;&&   S ! ! !NNN'''  i(( ) ))s*3A--A14A1A C D &DD c *|d}t|tr|sdSt ||d|dt dt |S)Nr$Fr=r&rr)r6rr5rrrr)r>rr s rL_agent_key_is_usablers ))K C c3  syy{{u % ii  99344As?3344    rK)rrrrjc B t5t}t|d\}}|stdddt }|r|d}nt |dptd}t|} | j r6| j tvr(t d|| j t}t|dpt} t!||| } t#t%|d zt& 5t)|} |d } |d }t+| tr| stdddt-|d|s.| rt/|d||| cdddcdddSt+|tr|stdddt1j|r|nd}t1j|ddi| 5} t7||| |}nX#t$rK}t9|r6t;||dt=||dt/|d||d}~wwxYw dddn #1swxYwYt?j tBj"}tG|d}|d |d <|d p||d <|dp|dpd|d<|dp|d|d<|$|d<||d<t?j%|&|ztBj"$|d<||d<| |d<| dut+| tr| ndd |d!<t/|d||tO||d cdddcdddS#1swxYwY ddddS#1swxYwYdS)"zKResolve a refresh-aware Nous Portal access token for managed tool gateways.rM&Hermes is not logged into Nous Portal.TrrCr:Sauth: ignoring invalid portal_base_url %r (host %r not in allowlist), using defaultr<rrrrrM,No access token found for Nous Portal login.rNz2Session expired and no refresh token is available.r$rQrrrr:r<rM$managed_access_token_refresh_failurergrrZr[r=r!rFr|r)(rr4rrKrrErr6rrrrrrr5r`r(rPrrrZrrr#r'rrrrnrtrzrrrrrrrrrc)rrrrjr=r>state_source_pathenv_portal_overrider:parsed_portal_urlr<r merged_sharedrrMrrrcrr access_ttls rLresolve_nous_access_tokenrs{   m)m)%'' #CJPV#W#W   8!% 899  :188==OO#599->#?#?@@+*fSkk  !) 9 9  ) :.?.HPj.j.ji#%6%?#: +..H2HII  (iTYZZZ $S39NPi5j5j k k kG )G ):5AAM 99^44L!IIo66MlC00   B#%)   , 7 79MNN $ a2:vuN_```#G )G )G )G )G )G )G )Mm)m)m)m)m)m)m)m)lmS11  H#%) m$POODQQG!#56  5%(7"+&3 !!!II !   6s;; e4!#I 6&#I 7z65Rcddd                  6,x|,,C,Y]]<-H-HIIJ$-n$=E. !%.]]?%C%C%T}E/ ""+-- "="="d'>HVVDE%L +:vuFW X X X $U + + +(OG )G )G )G )G )G )G )Mm)m)m)m)m)m)m)m)LG )G )G )G )G )G )G )G )G )Mm)m)m)m)m)m)m)m)m)m)m)m)m)m)m)m)m)m)sERBQ;/ RAQ;"K$I87K8 K AK K K Q;K! !Q;$K! %E=Q;" R;Q? ?RQ? RRRr[ rZr=r!rr$r&rrrrhrrZr$r&r/Optional[Callable[[Dict[str, Any], str], None]]c *|||pt|ptd|ptd|pd|pt||| | t | | dd }t | | |}tj| r| nd}tj |ddi| 5}t| d | d | d  }|s|| d}t|tr|s+|td|dd|dtdddt||d|d|}t!jt$j}t)| d}|d |d <| dp||d<| dp| dpd|d<| d p| d |d <t+| d}|pt|d<||d<||d<t!j||zt$j|d <||t3|dt5|t7|dddn #1swxYwY|S) a Refresh Nous OAuth state without mutating auth.json directly. ``on_state_update`` is called after a successful access-token refresh. Callers that own persistent state can use it to save the newly rotated refresh token before later validation can fail. rCr[r|r}rr$rQrrrr=rrNrMrO) and no refresh token is available. Re-authenticate with: hermes auth add nousrMTrLz.No refresh token is available for Nous Portal.rr:r<rrrZr;r!rpost_refresh_access_token)r`rrErar_rr(r'rrr r6rr5rKrrrrrrrrrrrJrr-)rrMr<r:r;rZr=r!rr$r&rrrrhrr>rrrcurrent_invoke_jwt_statusrefresh_token_valuercrr refreshed_urls rLrefresh_nous_oauth_purerxs4%&8"8+F/FNNsSS1O5OWWX[\\ ,H,,"  4X"  E"h)PU V V VFmHOODIIG g:L/MV\ ] ] ]5'ag$; IIn % %))G$$yy..% % % ! , J5A"'))O"<"< 1377 ?R ,8#E5EEE"(6)-  D#%) . %&7 8 ,1 I ,x|,,C,Y]]<-H-HIIJ$-n$=E. !%.]]?%C%C%ZGZE/ ""+-- "="="drrhrrs rLrrs ))E   bC " ."%% /2&& +|,, #%<== &(BCC99\844ii!344IIm,,99\**))K(("YY'=>>'$$''+&&#'!   rK)r%cddlm}t|}|rEt|r$t||d<t 5t }t|d|t|dddn #1swxYwYt||d}td| DdS)u-Persist Nous OAuth credentials as the singleton provider state and ensure the credential pool is in sync. Nous credentials are read at runtime from two independent locations: - ``providers.nous``: singleton state read by ``resolve_nous_runtime_credentials()`` during 401 recovery and by ``_seed_from_singletons()`` during pool load. - ``credential_pool.nous``: used by the runtime ``pool.select()`` path. Historically ``hermes auth add nous`` wrote a ``manual:device_code`` pool entry only, skipping ``providers.nous``. When the runtime credential expired, the recovery path read the empty singleton state and raised ``AuthError`` silently (``logger.debug`` at INFO level). This helper writes ``providers.nous`` then calls ``load_pool("nous")`` so ``_seed_from_singletons`` materialises the canonical ``device_code`` pool entry from the singleton. Re-running login upserts the same entry in place; the pool never accumulates duplicate device_code rows. ``label`` is an optional user-chosen display name (from ``hermes auth add nous --label ``). It gets embedded in the singleton state so that ``_seed_from_singletons`` uses it as the pool entry's label on every subsequent ``load_pool("nous")`` instead of the auto-derived token fingerprint. When ``None``, the auto-derived label via ``label_from_token`` is used (unchanged default behaviour). Returns the upserted :class:`PooledCredential` entry (or ``None`` if seeding somehow produced no match — shouldn't happen). rrr%rMNc3:K|]}|jtk|VdSrT)rrw)rrs rLrz+persist_nous_credentials..2s/JJqah2I&I&I&I&I&I&IJJrK) rrrJr5rrr4r;rrcnextr?)rer%rr>r=r s rLpersist_nous_credentialsrs7F0///// KKE ,U!!##,U))++g   %%%'' Z777$$$%%%%%%%%%%%%%%%U### 9V  D JJDLLNNJJJ   s+/B&&B*-B*c ddlm}|ddS#t$r&}td|Yd}~dSd}~wwxYw)zGBest-effort pool reseed after providers.nous changes; never fail login.rrrMz7Failed to sync Nous credential pool from auth store: %sN)rrrrr*)rrs rL_sync_nous_pool_from_auth_storer7s{U333333 & UUU NPSTTTTTTTTTUs AAA)rrrrhc * !"tjjddt5t t d\ " st dddt d!t dp.tj d ptj d pt d }t}|r| d }nLt|}|jr6|jt"vr(t$d ||jt}t)t d pt*}t-p|}t/ dpt0} dE !"fd } t3|| } t5j|r|nd} t9dt; dt5j| ddi| 5} d} d}t?|t.r|st dddtA| d d }|s|,tCtE|d!ztF"5tI rm d} d}tA| d d }| d#|s|mt?|t.r|s|pd$}t d%|d&d|d'|rd$n|pd(}t9d)|t;|* tK| || |+}nQ#t $rD}tM|r/tO |d,-tQ|d,-| d.d}~wwxYwtSj*tVj,}t[| d/}|}|d d<| dp| d<| d0p d0pd1 d0<| dp d d<t)| d }|pt*}t-p|}|. d2<| d/<tSj/|0|ztVj,3. d< d} d}t9d4|t;|t;|5| d6dddn #1swxYwYtc |7te |8| d<| d <| d<| dut?| t.r| ndd9 d:<dddn #1swxYwY| d;dddn #1swxYwY!rtg d<}t?|t.r|st d=dd>? d@}ti|}|1tEdAtk|tmj6z n!t[ dB}d|| dC||tntnt/"p tqdD S)FaX Resolve Nous inference credentials for runtime use. Ensures access_token is a valid inference-scoped JWT, refreshing it when needed. Concurrent processes coordinate through the auth store file lock. Returns dict with: provider, base_url, api_key, key_id, expires_at, expires_in, source ("invoke_jwt"), and auth_path. NrzrMrTrFr:rrrCrr;r<rr5rrRc ttkrtd|dS tdn8#t$r+}td|t |jd}~wwxYwtd|t dt d td tdS) Nnous_state_persist_skipped)rrrMnous_state_persist_failed)rrrnous_state_persistedrMr)rrr^rT) r3rr#rrrEr{r6rJrc)rrr=persisted_staterr>state_persistedrs rL_persist_statez8resolve_nous_runtime_credentials.._persist_states5 /u551/BBCC0 +!  .z65J[\\\\   / +!#Cyy1    &'!3EIIo4N4N!O!O 2599^3L3L M M     #5kkO"O %U + + + + +sA A?&A::A?rr$nous_runtime_credentials_startrM)rr^rQrrrrr=rrrr!post_shared_merge_access_unusablerhrrrLaccess_unusable refresh_start)rrr^rruntime_access_refresh_failurerg'terminal_runtime_access_refresh_failurerrZr[r!rrefresh_success)rrprevious_refresh_token_fpnew_refresh_token_fprrrr|r&resolve_nous_runtime_credentials_finalr$z*Failed to resolve a Nous inference API key server_errorr:r&rr'r%) rMr$rQkey_idrrrr> state_pathrr5rrR)9rrrrr4rrKrJrr6rrrrErrrrrrrrarr5r`r(r'rrr{rrr rPrrrZrrnrtrzrrrrrrrrrr-rrrrNOUS_AUTH_PATH_INVOKE_JWTr)#rrrrhr:rrstored_inference_base_urlr;r<rrrrrrMinvoke_jwt_statusrrefresh_reasonrcrrrprevious_refresh_tokenrrQrrrr=rrr>rrs# @@@@@@rL resolve_nous_runtime_credentialsrAs *,,"3B3'K   bAbA%'' #CJPV#W#W   DD%+dDDD Du++ uyy):;; < < 'y122 'y/00 '' &++ 899  :188==OO ( 9 9  ) :.?.HPj.j.ji#%6%?#: 6"599-A#B#BCC   ** " ) * * G.G  +..H2HII % ,% ,% ,% ,% ,% ,% ,% ,% ,% ,% ,N!(iTYZZZ-? LMM ,#/ /0J0JKK    \'H>P3QZ` a a aw ek 99^44L!IIo66MlC00 H  H N)/$HHHH!8ii(( 99\22!!!  T D 1 =,SSVAVXq=r=rsssSDSD5e<<L',yy'@'@ (- /(B(B ,C("'))G"4"4',yy'>'>---) ''JKKK$HD(9(E)-== ] %6%I/F"+!M$*!M!M!M*0%+15 ###=J)wPaPvev$+(3#1-? -N-N  "(='-*3=)))II ) " " ">sCC Z <$)$'+K!"!"!"!" !>$.$'+K!"!"!"!" !//X Y Y Y! "'l8<88%8|9T9T%U%U 1>.09.0In-1:1O1O1`S`o..7mmL.I.I.pUYYWcMdMd.phpl+)2w)?)?)U599WCUCUg)RR[R_R_`tRuRu(v(v 4A4_E_18::W>W+03}}m,.8l+.6.DMMOOj8X\///#)++l+(-^'< (-o(> $-(3#16HI_6`6`1CM1R1R ''BCCCgSDSDSDSDSDSDSDSDSDSDSDSDSDSDSDj .)     $)'    (7E# $*CE& '!*E+ "eO'1&#'>'>HVVDE%Liw w w w w w w w w w w w w w w r ?@@@EbAbAbAbAbAbAbAbAbAbAbAbAbAbAbAH*')))ii $$G gs # #>7>D!'n>>> >122J(44M  $ As=49;;.//000 +A!B!B C C&))N++  +/+@/@/@AA   sH Y?B7Y8CW3O)(W3) P7 3?P2 2P7 7F0W3' Y3W7 7Y:W7 ;AY Y?Y! !Y?$Y! %Y??ZZc dddddddddS)NF)rr:r;access_expires_atr&rinference_credential_presentcredential_sourcerArArKrL_empty_nous_auth_statusr[s)"! $"(-!   rKc  ddlm}|d}|r|stSt |}|stSdd}t || }t|d d }|stSt|d d }tt|d dpd }t|dd }t|o#| dpt|} t|dd} d } | rt|dd pt} | | t|dd p!t|dd pt|dd | r|nd t|dd t|dd t|dd| d| d S#t$rtcYSwxYw)zBest-effort status from the credential pool. This is a fallback only. The auth-store provider state is the runtime source of truth because it is what ``resolve_nous_runtime_credentials()`` refreshes. rrrMr r rtuple[float, float, int]ctt|ddpd}tt|ddpd}tt|ddpd}||| fS)Nr&rRrpriorityr)rrr)r  agent_exp access_exprs rL_entry_sort_keyz3_snapshot_nous_pool_status.._entry_sort_keyyso,WU>HzH95 5rKrrNrr8r9rMoauthr%r,r:r;runtime_base_urlr$rr&Tpool:) rr:r;rrr&rrrr)r r rr)rrrrr4r?rrr5rrrrrr) rr r?rr  runtime_keyrr8rMis_portal_oauthr%portal_status_urls rL_snapshot_nous_pool_statusrhsY 2)333333y   -4//11 -*,, ,t||~~&& -*,, , 6 6 6 6 G111e%6==  -*,, ,und;; {B77=2>>DDFFLLNN == |,,   ) ) @T--@-@ w 22   0$77+*  )0")%1Et"L"L#0u0$77#0uj$//,;ELL!( d!C!C$+E3I4$P$P!%m!4!4,0!0%eoo    )))&((((()s#4G0G(5GD8GG21G2z base_statusrerefreshed_staters rLrrs #F + +E ,eii7788$yy):;;"')),@"A"A!&>)-o.A.A/.R.R)S)S48)5H8X)F)FHH#ii11   $       "S$(6H%)P)P$Q$Q%c6488               & ' ''s 5EI J2AJ-'J2-J2c , ddlm}|d}|r/|r|}|wt |ddpt |dd}|rSt |dsCdt tt |d dd d t |d d |dSt}|r}dt t| d d d | d pd dt| dpd| dd Sn#t$rYnwxYw t}dt t| d | d| d| ddS#t$r6}dt tt |dcYd}~Sd}~wwxYw)zStatus snapshot for Codex auth. Checks the credential pool first (where `hermes auth` stores credentials), then falls back to the legacy provider state. rrrONrrr9Trerurr%r,rr=rervrrQrPzCCodex provider quota exhausted; retry after the usage limit resets.r) rr=rervr rate_limitedrBrZrrvrrQFrr=rZ)rrrselectrr5r5rrr6r\rrrK)rr r rQrrers rLget_codex_auth_statusr su$ 333333y((  D((** KKMME E#4d;;:unb99#B7A#N#N%)&)/*;*;&<&<(/~t(L(L%."N'%)*L*L"N"N#* 788J !%"%o&7&7"8"8$.NN>$B$B!*LjnnW&=&=&JLL$("9"y11a` *z : :          133o//00!IIn55;//ii))yy++        o//00XX         s8B5E8B E EEA;G H+HHHc  ddlm}|d}|r|r|}|wt |ddpt |dd}|rSt |dsCdt tt |ddd d t |d d |d Sn#t$rYnwxYw t}dt t| d| d| d| dd S#t$r6}dt tt |dcYd}~Sd}~wwxYw)NrrrTrrr9TrerNrr%r,rrvrrQFr) rrrr rrr5rrr r6rK)rr r rQrers rLget_xai_oauth_auth_statusr `s 333333y%%  D((** KKMME E#4d;;:unb99 #@!#L#L %)&)/*;*;&<&<(/~t(L(L&9"N'%)*L*L"N"N#*          577o//00!IIn55;//ii))yy++        o//00XX         s1B3B77 CCA;E F+E?9F?Fct|}|r |jdkrddiSd}d}t||\}}d}|jr,t j|jd}|dvrt||j |}n |r|}n|j }t|||j ||t|dS)z>>`bH .-07Av|G,,,T+Px/B/B

>#&&&w7Q V        1022LIq (33I>> 8$N1133('H V V V LLOQT U U U U U U U U V .>>#&&-j  7AA x % %.(..*:*:.- OOC(()   s:?D:: E)E$$E)ct|}|r |jdkrtd|d|d|jr,t j|jdnd}|s|j}t jddp(t jddpd }t jd d}|rtj |nd d g}|rtj |nd }|s+| dstd|d|d|d|d|p||ddS)z>Resolve runtime details for local subprocess-backed providers.r_r5z&' is not an external-process provider.rr:r9rrrYrrrNrz(Could not find the Copilot CLI command 'zQ'. Install GitHub Copilot CLI or set HERMES_COPILOT_ACP_COMMAND/COPILOT_CLI_PATH.missing_copilot_clir^rCprocess)rMrQr$rrr)rr6r8rKrDrrrr;rrrrrrE)rrr$rrrrs rL-resolve_external_process_provider_credentialsr>s##K00G  g'+=== L L L L #    CJBZbry1266<<>>>`bH .- .3399;;  9' , , 2 2 4 4   y2B77==??H$, F5;x 7I2FD07Av|G,,,T  H$7$7 $E$E  ]w ] ] ] &       OOC((#.w   rK default_modelcFt5t}||d<t|dddn #1swxYwYt}|jddt |t}|d}t|trt|}nBt|tr+| rd| i}ni}||d<|r-| r| d|d <n|d dd d lm}|||r!|dd } | rd| vr||d<||d<t#||d |S)aUpdate config.yaml and auth.json to reflect the active provider. When *default_model* is provided the function also writes it as the ``model.default`` value. This prevents a race condition where the gateway (which re-reads config per-message) picks up the new provider before the caller has finished model selection, resulting in a mismatched model/provider (e.g. ``anthropic/claude-opus-4.6`` sent to MiniMax's API). rNTrrrrMrCr$r) clear_model_endpoint_credentialsr9Fr)rr4rrrrrrr6rrJr5rrEr[rrAr ) rr;r?r= config_pathconfig current_modelrgrA cur_defaults rL_update_config_for_providerrGs   %%%'' (3 $%$$$%%%%%%%%%%%%%%% "##KTD999(555   FJJw''M-&&'' M3 ' 'M,?,?,A,A 3 3 5 56  'Ij(06688( 2 9 9# > > *  j$''' CBBBBB$$Y/// 1mmIr22  1c[00#0Ii F7Ok6U;;;; s#>AAcP t}n#t$rYdSwxYw|sdS|d}t|tsdS|d}t|t sdS|}|pdS)z?Return model.provider from config.yaml, normalized, if present.NrrM)rrr6rrJr5rr)rDrrMs rL_get_config_providerrIs "" tt t JJw  E eT " "tyy$$H h $ $t~~%%''H  ts  cv|sdSt|kS)z=Return True when config.yaml currently selects *provider_id*.F)rIrr)rs rL_config_provider_matchesrKs8 u  ! ![%6%6%8%8%>%>%@%@ @@rKc|sdS|}|tvot|S)z?Return True when logout should reset the model provider config.F)rrrrKr-s rL'_should_reset_config_provider_on_logoutrMsF u""$$**,,J * * S/G /S/SSrKc.t}|dvr|SdS)aFallback logout target when auth.json has no active provider. `hermes logout` historically keyed off auth.json.active_provider only. That left users stuck when auth state had already been cleared but config.yaml still selected an OAuth provider such as openai-codex for the agent model: there was no active auth provider to target, so logout printed "No provider is currently logged in" and never reset model.provider. >rMrTrON)rI)rMs rL$_logout_default_provider_from_configrOs%$%%H888 4rKc.t}|s|St|t}|s|S|d}t |t rd|d<d|vr t|d<t||d|S)z5Reset config.yaml provider back to auto after logout.rrrMr$FrB) rrrrr6rrJrr )rCrDrs rL_reset_config_providerrQs!##K     (555   F  JJw  E%4"j    3E* k6U;;;; rKrMr$rQrrMc ddlm}|||||}n#t$rd}YnwxYw|dSttdt|jtd t d}n&#ttf$rtYdSwxYw|d vS) zDPrompt before saving a model whose known pricing exceeds guardrails.r)expensive_model_warningrRNTzH========================================================================zSwitch anyway? [y/N]: F>yr) hermes_cli.model_cost_guardrTrrrPrrrrr)rrMr$rQrTrr`s rL"_confirm_expensive_model_selectionrW3s GGGGGG))      t GGG (OOO '/ (OOO12288::@@BB x ( uu | ##s ''/3B##CCrrEpricing#Optional[Dict[str, Dict[str, str]]]unavailable_modelsOptional[List[str]] portal_urlunavailable_messageconfirm_providerconfirm_base_urlconfirm_api_keyc v '()*+,-ddlm} |pg} d;fd } g} r|vr| |D]} | | vr| | t| t| z}t ot fd|D++rt d |Dd d znd,i(d -d)d *+r|D]} | }|rh| |dd}| |dd}|dd}|r | |nd}|rd*nd\}}}|||f(| <t -t|t|-t )t|)؉*rt )d)()*+,-fd'd}d}+r1d}d|dd,ddd-ddd-}*r |ddd)z }||dzz }d }d!} dd"l m }'fd#| D}|d$|d%|pt d&}| }|s| rd'|d(}g}+rV|dd)}t|d)kr-||d)| r?| D]#} |d*'| $|d+|d,|rd|nd-} |d||d.| d/}!|!dkrd-St%|!t| kr| | |!S|!t| krJ t'd0 }"n#t(t*f$rYd-SwxYw|"r | |"nd-Sd-S#t,t.t0t2jf$rYnwxYwt%|tt7t| d z}#t9| d)D]'\}$} t%d|$d|#d1'| (t| }%t%d|%d)zd|#d2t%d|%d zd|#d3| r|pt d&}| pd4|d5}t%t%d|d6|d,|| D](} t%ddd|#d|'| |)t% t'd7|%d zd8 }&|&sd-St;|&}!d)|!cxkr|%krnn| | |!d)z S|!|%d)zkr0t'd0 }"|"r | |"nd-S|!|%d zkrd-St%d9|%d zn2#t<$rt%d:Ynt*t(f$rYd-SwxYw)|sdSrt|sdS|S)NrR)rW)rr`r_r^s rL_confirmed_selectionz5_prompt_model_selection.._confirmed_selectionlsG 4  $F %%# % % %   4 rKc3BK|]}|VdSrTr6)rmrXs rLrz*_prompt_model_selection..s-&J&J!w{{1~~&J&J&J&J&J&JrKc34K|]}t|VdSrT)r)rrgs rLrz*_prompt_model_selection..s(//qCFF//////rKrrrFpromptr9 completioninput_cache_readTr9r9r9c rC|d\}}}d|d d|d } r |d|dz }|d |}n|}|kr|dz }|S)Nrlr.> ._labels  *..sLAAOCeCSC9CCCCCyCCCCJ 8757977777 3H333z33DDD -   , ,D rKzSelect default model:z rror.InrpOutCachez /Mtokzz)curses_radiolistc&g|] }|SrArA)rrr|s rLrGz+_prompt_model_selection..s!222366#;;222rKzEnter custom model namezSkip (keep current)rC Upgrade at z for paid modelsr#z u ── u ──Nr)selectedcancel_returnsrC searchablezEnter model name: z. z. Enter custom model namez. Skip (keep current)u6Unavailable models (requires paid tier — upgrade at )u── z Choice [1-z] (default: skip): zPlease enter 1-zPlease enter a number)rr5rrQ)hermes_cli.modelsrbrIr4ranyrr6rhermes_cli.curses_uirrrErrextendrxryrrrrrNotImplementedErrorr subprocessSubprocessErrorr5 enumeraterr).rrErXrZr\r]r^r_r`rb _unavailablerdrzr all_modelsprrrs cache_readrt default_idx menu_titlepadheader_DIM_RESETrchoices _upgrade_urlunavailable_footer desc_lines header_partrCidxr num_widthinchoicer|rvrwrxryrzr{s. `` ``` @@@@@@@rL_prompt_model_selectionrUs&988888%+L        G&)33}%%%   g   NN3   gl!3!33JwJ3&J&J&J&Jz&J&J&J#J#JKKKCNUs//J///;;;a??TUH57LIII* 3 3C C  A -,,QUU8R-@-@AA,,QUU<-D-DEEUU#5r:: >HP..z:::b% $I",S%!$c5 1L Is3xxS::IIs5zz22II  *Iq))I           K)J)UcU2UUUUUDU9UUUUUUUUU  2 171Y1111 1Ffy((  D F1 9999992222'2220111,---"=&=EEcJJ 06688! Nl N!M|!M!M!M  !#  ?%**433K;!##!!+a.";";"="=>>>  G# 7 7!!"5s "5"56666   E*<EEE F F F/9Cdii +++t  #  #     774  W  '' 55 5 CLL  344::<</0   tt 39C''///t Ct ,gz7Q R      *CG q())**IGQ''443 212y2222VVC[[223333 G A r9rUrrOr$Login successful! Config updated: z (model.provider=openai-codex)Nz?Existing Codex credentials are expired. Starting fresh login...z:Found existing Codex CLI credentials at ~/.codex/auth.jsonzOHermes will create its own session to avoid conflicts with Codex CLI / VS Code.zCImport these credentials? (a separate login is recommended) [y/N]: r>rUrrrCz=Credentials imported. Note: if Codex CLI refreshes its token,zk>kllK GGG <<<<<< -4466 - - -... J{ J J JKKKKKsOAD"3BDB,)D+B,,A DD D,+D,"3FF,+F,c~|s t}|dd}t|tr|rt |dst d t d}n#ttf$rd}YnwxYw|dvr[td|d t}t t d t d |d dSn#t$rYnwxYwt t d t dt tt|ddpd}t|dd }t!rd}t#||} t%| d| d| dd| ddt'ddtd| d t}t t d ddlm} t d| dt d |d dS)NrQr9r)z:Existing xAI OAuth credentials found in Hermes auth store.rrU>r9rUrrTr$rrz (model.provider=xai-oauth)z6Signing in to xAI Grok OAuth (SuperGrok / Premium+)...z,(Hermes creates its own local OAuth session)rrKrFrr'rArrrerNrr&rrr"r)r r6rr5rrrrrrrrGrrKrrr_xai_oauth_device_code_loginrr\rr) rrrr:rQrrCrr'rers rL_login_xai_oauthrs   <>>Hll9b11G'3'' G .s#===s#W*<*===h===G  L '8J8J L L &    NrKctjtdt|z}tdt|}tj|kr||ddddt |d}|jdkrd|}|d std d d |dstdd d |S |} n4#t$r'| tdd d wxYwt| dpd} | dkrtj |5| dkr)t|dzd}tj |d| dp| dp|j} td| d d tdd d )Nr#rOrrPr:r;r~r#rz?xAI device-code token response did not include an access_token.rTxai_device_token_invalidr:rMz?xAI device-code token response did not include a refresh_token.zAxAI device-code token polling returned a non-JSON error response.xai_device_token_failedrZr9r<r=r>rz&xAI device-code token polling failed: z/Timed out waiting for xAI device authorization.device_code_timeout)rrrrr(rr)r"r6rKrr4r5rrr) rrr&rrrr@r`rrArBrCs rL_xai_oauth_poll_device_tokenrs{~#aZ"9"99H1c-0011 .  X % %;;  C, M0*      3 & &mmooG;;~.. U(3 ;;// U(3 N $MMOOMM     % % ' ' 'S$.  **7339r:: 0 0 0 J' ( ( (   $ $"#3a#7<<  J' ( ( (    1 2 2   )) }   B[ B B *    9 "   s ;D1Err'c Zt|}|d}tjtd|}tj|ddi5}t |}t |dp|d}t |d}t|d } t|d } ttd td |td ||retsWtrI tj |} n#t$rd} YnwxYw| rtdntdtdtd| dt||t |d| | } dddn #1swxYwYt | ddpd} t | ddpd}| r|st#dddt%t'jdddp9t'jdddt, }| |t | d!dpd| d t | d"pd#pd#d$|d|t/jt2jd%d&d'd(S))NrrKrQrr}r/r.r-rr0 To continue: 1. Open:  2. If prompted, enter code: F# (Opened browser for verification)< Could not open browser automatically -- use the URL above.$Waiting for approval (polling every r#s)...r&)rr&rrrr9rMz;xAI device-code token response was missing required tokens.rTrr:rrCrrrrZr[)rrMrrrZrrzoauth-device-code)rArrr$rer)rr'rrrrr5r6rrrr$rrrrrrKrrrrErrrrrrr)rr'rrrr device_dataverification_urlr-rr0r*rrrMr$s rLrr8s %_55I/0NmCo6677G g:L/M N N N RX4V<<  OO7 8 8 /-.   K011 \233 {:.//  n .,../// :y::;;;  V 2 4 4 V9T9V9V V #)9::     V;<<<<TUUU LSH5E5ELLLMMM. )K 677!"    3               Bw{{>266<"==CCEEL OR88>B??EEGGM  }  I +    0 ',,2244;;C@@ = 9^R ( ( . . 0 0 7 7 < <+H)*GKK B77=2>>DDFF!++l33gkk,77C8DDJJLLXPX    X\22<<>>FFxQTUU%   s8CG+E?G E GEA,GG G c  ddl}d}t}d}d}td|dzD]} tjtjd5}||dd |id d i }dddn #1swxYwYn'#t$r}td |ddd}~wwxYw|j dkrn||krztt|dd}||nd|z} tdtt| d} td| d|| |M|j dkrBtt|dd}|d|dnd} td| dt"| |j dkr!||j nd} td| ddd|} | d d!} | d"d!}td#t| d$d%}| r|std&dd'td(td)td*|d+td,td*| d-td.d/}|}d} tjtjd5}||z |krz||||d0|| d1d d i }|j dkr|}n%|j d2vrztd3|j ddd4dddn #1swxYwYn,#t*$rtd5t-d6wxYw|td7dd8|d9d!}|d:d!}|d;}|r|stdd d?i@}dddn #1swxYwYn'#t$r}tdA|ddBd}~wwxYw|j dkrBtt|dd}|d|dnd} tdC| dt"|j dkrtdD|j dddE|}|dFd!}|dGd!}|stdHddIt1jdJd!dKpt8}||dL|t;jt>j !"dMdNdOdPdQS)RzBRun the OpenAI device code login flow and return credentials dict.rNzhttps://auth.openai.comrr#r$rz!/api/accounts/deviceauth/usercoder<rr)r"r!zFailed to request device code: rOrr:rr!rr)z:OpenAI is rate-limiting login requests (429); retrying in zs...z Try again in about zs.z' Wait a minute and run the login again.zOpenAI is rate-limiting Codex login requests (HTTP 429). This is a temporary throttle on OpenAI's side, not a credential problem.r#r,z$Device code request returned status rdevice_code_request_errorr-r9device_auth_idrr05z-Device code response missing required fields.device_code_incompletez!To continue, follow these steps: z# 1. Open this URL in your browser:z z/codex/device z 2. Enter this code:z z/Waiting for sign-in... (press Ctrl+C to cancel)iz/api/accounts/deviceauth/token)rr->rrz$Device auth polling returned status device_code_poll_error Login cancelled.z!Login timed out after 15 minutes.rrrz/deviceauth/callbackzADevice auth response missing authorization_code or code_verifier.device_code_incomplete_exchange)rSrNrr<rrOr?r!zToken exchange failed: token_exchange_failedzOpenAI is rate-limiting Codex login requests (HTTP 429) during token exchange. This is a temporary throttle on OpenAI's side, not a credential problem.zToken exchange returned status token_exchange_errorrrMz.Token exchange did not return an access_token.token_exchange_no_access_tokenrrC)rrMrrruz device-code)rAr$rervr)#rrranger'rrr(rrKr)rdrrrrrrr\r"r6rrrrrrrrErrrrrrr)_timeissuerr<r- max_attemptsattemptrrrdelay wait_hintrrr-rrmax_waitr code_resp poll_resprrr token_resprArrMr$s rLrr~s~ &F%I DLL1,-- emD&9&9::: f{{@@@%y1+-?@#                   7#77'.J    s " " E \ ! !4i..K $/#:KKW E3s5zz2..//E 2&+222    KK    D,330y$1O1OPP & 3; 2 2 2 2:   #  # #$*A      |t'3..%)%5!!9 <6 < < <#*E    ))++K R00I __%5r::N3{z3??@@AAM  N  ;#*B     ./// /000 8& 8 8 8999 !""" .) . . ./// ;<<<H OO  EI \%-"5"5 6 6 6 &//##e+h66 M***"KK===,:SS+-?@( (C// ) 0 0I*j88#Wy?TWWW!/6N               &  "###oo /#*?    #';R@@MM/266M222L  ]  O#*K     \%-"5"5 6 6 6 &%"6.$0!*%2 ()LM%  J                    +c + +#*A     $$0 J 4 0 0  & 3; 2 2 2 2:   4(1 4 4$*A     $$ Gj.D G G G#*@    __  F::nb11LJJ33M   <#*J     )2..4466==cBB " ! )*   X\22<<>>FFxQTUU   s'B A<0 B<B BB B B,B''B,='N$BN: NN  N N N)N;'Q?&Q3' Q?3Q77Q?:Q7;Q?? R# RR#rBcVddl}|ddd}tjt j| d}|d}|||fS)zGGenerate (code_verifier, code_challenge_S256, state) for MiniMax OAuth.rNr`rr2) secrets token_urlsaferrr7r8r9rrrE)rverifier challenger>s rL_minimax_pkce_pairrGsNNN$$R(("-H(x(())0022 fhhvvc{{  ! !" % %E Y %%rKc ||dd|t|d|dddttjd}|jd kr!t d |jp|jd d | }dD]}||vrt d|d d | d|krt dd d |S)Nz /oauth/coderNr)rr<r=rrr>rOr)rrQz x-request-idrr#z$MiniMax OAuth authorization failed: r}authorization_failedr:)r-r. expired_inz&MiniMax OAuth response missing field: authorization_incompleter>z-MiniMax OAuth state mismatch (possible CSRF).state_mismatch) r(MINIMAX_OAUTH_SCOPEr5rrr)rKr reason_phraser"r6)rr:r<rr>r`rrs rL_minimax_request_user_coderRs@{{ '''#"(,%+   @( --  H s"" \8=3ZHDZ \ \$+A    mmooG@   @@@(/I  {{7u$$ ;$+;     NrKrnow_msc.t||dzkS)zMTrue if ``expired_in`` is plausibly a unix-ms absolute time (vs TTL seconds).r)r)rrs rL&_minimax_expired_in_looks_like_unix_msrzs z??fk **rKrrct|}t|dz}t||r|dz S|td|zS)zRReturn access-token expiry as unix seconds (MiniMax uses ms epoch or TTL seconds).rHrrr#)rrrr)rrrbrs rL"_minimax_resolve_token_expiry_unixrsa j//C 4' ( (F-c&AAAV| ==??SC[[ ((rKr- interval_mscddl}t|dz}t|} t| |r| dz } n%|td| z} td|pddz } || kr=||dt |||d d d d  } | jr| nin#t$riYnwxYw| j dkrI dipi dp| j} td| pddd d}|dkrtddd|dkr/tfddDstdddS| | || k=tddd )!NrrHrrr#g@i /oauth/token)rSr<r-rrOrrPrr# base_resp status_msgzMiniMax OAuth error: r,r}rr:rrZz8MiniMax OAuth reported an error. Please try again later.authorization_deniedsuccessc3BK|]}|VdSrTrf)rkrs rLrz&_minimax_poll_token..s-__!w{{1~~______rK)rrMrzhmmoooBGG   GGG   3 & &;;{B//52::<HHYHMC:(8y::(/F  X&& W  J(/E  Y  ____/^_____ R,3EN HQ **,, ! !T A y   s C** C98C9ct5t}t|d|t|ddddS#1swxYwYdS)zGPersist MiniMax OAuth state to Hermes auth store (~/.hermes/auth.json).r}N)rr4r;r)rr=s rL_minimax_save_auth_stater s   %%%'' Z*EEE$$$%%%%%%%%%%%%%%%%%%s/A  AArr'rrc~td}|dkr|jd}|jd}n|j}|j}t \}}}t rd}t d|dt d|tjtj |d d id 5} t| ||j || } t| d} t| d} t t dt d| t d| |rAtr3tj| rt dnt d| d} | t#| nd}t dt%| ||j | |t#| d|}dddn #1swxYwYt'jt*j}t/t#|d|}t1dt#||z }d||||j t4|dd|d|d|d |t'j|t*j!|d" }t;|t d#|d$x}rt d%||S)&z?Run MiniMax OAuth flow, persist tokens, return auth state dict.r}rrrFz#Starting Hermes login via MiniMax (z ) OAuth...Portal: rQrT)rr!follow_redirects)r:r<rr>r.r-rrrrrr0NzWaiting for approval...r)r:r<r-rrrrrrZr[rrMr\r) rMrr:r;r<r=rZrrMr\r!rru#✓ MiniMax OAuth login successful.notification_messagezNote from MiniMax: )rr@r:r;rrrr'rrrr<r5r$rrr6rr rrrrrrrrrrr )rr'rrr:r;rrr>r code_datarr- interval_rawr token_datarexpires_at_unix expires_in_srrs rL_minimax_oauth_loginrs  0G ~~!-(<=$]+BC!1$7!3!5!5Hi  B B B BCCC &_ & &''' emO<<');<'+ - - - 06. O'$E   y);<== +.//   n .,../// :y::;;;  V799 V/00 V;<<<<TUUU }}Z00 +7+Cc,'''  '(((( O'x9\233#    3               B ,x| $ $C8 J| $%%3Oq#o ?@@AAL$*0&$ nn\8<<">2#O4"~66}},_NNNXXZZ"J Z((( 2333nn3444s+ )C))*** s/D-G((G,/G,)rforcerc |dstdddd tj|dd}n#t $rd }YnwxYwt j}|s||z tkr|S|d }tj tj |d 5}| |d d|d |ddddd}dddn #1swxYwY|j dkrV|j tfddD}td|j p|jdd||} | ddkrtddddtjt&j} t+t-| d| } t/dt-| | z } t1|} | | d| d|d| tj| t&j | d!t9| | S)"zBRefresh MiniMax OAuth access token if close to expiry (or forced).rMz:MiniMax OAuth state has no refresh_token; please re-login.r}no_refresh_tokenTrLrr9rRr:)rrrr<rrOrrPrNr#c3 K|]}|vV dSrTrA)rrgras rLrz/_refresh_minimax_oauth_state..Es?ZZAa4iZZZZZZrK)rrinvalid_refresh_tokenzMiniMax OAuth refresh failed: rrrz-MiniMax OAuth refresh did not return success.rrrrr)rrMr!rr)r6rKrrrrr"MINIMAX_OAUTH_REFRESH_SKEW_SECONDSr'rrr(r)rrrrr"rrrrrrrJrrrr )r>rrrrr:rr`rrnow_dtrr new_stateras @rL_refresh_minimax_oauth_stater!"sg 99_ % %  H$+=PT    +EIIlB,G,GHHRRTT   )++C j3&*LLL -.O emO<<'+ - - -  06;; , , ,-";/!&!7 !D,                   s""}""$$ZZZZXZZZZZ VX]-Th>T V V$+;$    mmooG{{8 )) ;$+;!    \(, ' 'F8 GL !""Oq#o0@0@0B0BBCCDDLU I / _eO6LMM'')),_NNNXXZZ" Y''' s#:A&& A54A5 /DD D c|jr|dsdSdD]}||dd|jpdt |ddt jtj d|d < t|dS#t$r&}t d |Yd}~dSd}~wwxYw) aWipe dead tokens from auth.json after a terminal refresh failure. Shared by both the eager-resolve path and the lazy per-request token provider. Mirrors the Nous / xAI-OAuth / Codex-OAuth quarantine pattern so subsequent calls fail fast without a network retry. rMNrr}rrTrr z6MiniMax OAuth: failed to persist quarantined state: %s)rOr6r[rNr5rrrrrr rrr*)r>rr r s rL-_minimax_oauth_quarantine_on_terminal_refreshr#ds  UYY%?%?Z "d#,,s88+ l8<((2244   E Z ''''' ZZZ MyYYYYYYYYYZs B C $CC Callable[[], str]cdd}|S)uReturn a zero-arg callable that yields a fresh MiniMax access token. The Anthropic SDK caches ``api_key`` as a static string at construction time, so a session that resolves credentials once at startup will keep sending the same bearer until MiniMax's server returns 401 — typically ~15 minutes in, because MiniMax issues short-lived access tokens. Returning a *callable* instead of a string lets us hook into the existing Entra-ID bearer infrastructure in :mod:`agent.anthropic_adapter`: ``build_anthropic_client`` detects a callable and routes through ``_build_anthropic_client_with_bearer_hook``, which mints a fresh ``Authorization`` header on every outbound request. Each invocation re-reads the persisted state from ``auth.json`` and calls :func:`_refresh_minimax_oauth_state` — that helper is a no-op when the token still has more than ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS`` of life left, so the steady-state cost is one file read + one timestamp compare per request. Reading state fresh each time also means a refresh persisted by one process (CLI, gateway, cron) is immediately visible to every other process sharing the same ``auth.json``. rr5c4td}|r|dstdddd t|}n##t$r}t ||d}~wwxYw|d}|stdddd|S) Nr}rMNot logged into MiniMax OAuth. Run `hermes model` and select MiniMax (OAuth). not_logged_inTrLz6MiniMax OAuth state has no access_token after refresh.no_access_token)r^r6rKr!r#)r>rrs rL_providez4build_minimax_oauth_token_provider.._provides'88 EIIn55 #(QU   077EE    9% E E E   .)) H(/@SW  A A+A&&A+rr5rA)r*s rL"build_minimax_oauth_token_providerr-}s.* OrK)min_token_ttl_secondsas_token_providerr.r/cNtd}|r|dstdddd t|}n##t$r}t ||d}~wwxYw|rt }n|d}d||dd d d S) uReturn {provider, api_key, base_url, source} for minimax-oauth. When ``as_token_provider`` is True, ``api_key`` is a zero-arg callable that mints a fresh access token per call (proactively refreshing if the cached token is within ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS`` of expiry). This is what the runtime provider path uses so that long sessions survive MiniMax's short access-token lifetime — see :func:`build_minimax_oauth_token_provider` for the rationale. The default (string ``api_key``) preserves the historical contract for diagnostic call sites like ``hermes status`` that just want to know whether a valid token exists right now. r}rr'r(TrLNr;rCrr6)r^r6rKr!r#r-rE)r.r/r>rrQs rL)resolve_minimax_oauth_runtime_credentialsr1s" $O 4 4E   .11  $?T    ,U33 5eSAAA (9;;'#./66s;;   r+ctd}|r|dsdddS tj|dd}|t jz dk}n2#t $r%t|d}YnwxYw|d|dd |dd S) z3Return auth status dict for MiniMax OAuth provider.r}rFr!rr9rrr)rrMrr)r^r6rrrrrr)r>r token_valids rLr"r"s #O 4 4E A .11A"@@@6+EIIlB,G,GHHRRTT !DIKK/14 666599^4455 6!#))Hh//ii --   sAB,B10B1ct|ddpd}t|dd }t|ddpd} t|||dS#t$r0}tt |t d d}~wwxYw) z"CLI entry for MiniMax OAuth login.rNrrFrr$r r#)rrrKrrmr)rrrr'rrs rL_login_minimax_oauthr5s T8T * * 6hFt\5999LdIt,,4G g        $$%%%mmsA B+BB) r:r;r<r=r'rrron_verificationr6$Optional[Callable[[str, str], None]]c  td} |p.tjdptjdp| jd}|ptjdp| jd} |p| j}|p| j}tj |} |rdn|r|nd} trd}td| j d td ||rtd n|rtd |d tj | ddi| 5} t| |||}t|d}t|d}t!|d}t!|d}ttdtd|td||r5t#j|}|rtdntd| |||n#t&$rYnwxYwt)dt+|t,}td|dt/| ||t|d|| }dddn #1swxYwYt1jt4j}t9|dd!}||z}t?|d"p| }|| krtd#|id$|d"|d%|d&|d&p|d'|d'd(d)|d)d*|d*d+| d,t1j!|t4j- d|d.| dutE| tr| ndd/d0dd1dd2dd3dd4dd5d} tG||d6S#tH$r}|j%d7kr|d$tLd}tO|}tt|td8|d9ttd:tQdd}~wwxYw);zMRun the Nous device-code flow and return full OAuth state without persisting.rMrrrCrFTzStarting Hermes login via z...rz'TLS verification: disabled (--insecure)z$TLS verification: custom CA bundle (rrQrr)rr:r<r=r/r-rr0rrrru= Could not open browser automatically — use the URL above.Nr#rrr&)rr:r<r&rrrr;z%Using portal-provided inference URL: r:r<r=rZr[rrMr!rrrr|r$r%r&r'r(r#)rrhrfz Subscribe here: z/billingz>,+J+JKK#33J:>>*>??@@ # "!888 N6LNNOOO?4 Y ((1E  jnn\8<<   >2  88 s}} h,ZHLIIISSUU & %#-fc#:#:D   T !" #$ %& D'( )J,, +        8. . .#!#:fSkk (,,G GGG 'NNN ;z;;; < < < GGG P Q Q QQ--   sQ,C"J HJ H)&J(H))A!JJJ P S'B%S  Sc tdpi}n#t$rYdSwxYw|d}t|tsdSt |vS)aReturn True if the currently-held Nous token carries ``billing:manage``. Reads the persisted ``scope`` string saved at login (``_save_provider_state`` stores ``token_data.get("scope") or scope``). A space-delimited match. Used by the lazy step-up: if False, the first billing call will 403 ``insufficient_scope`` anyway, but checking up front lets a surface skip a doomed round-trip. rMFr=)r^rr6rr5NOUS_BILLING_MANAGE_SCOPEr)r>r=s rLnous_token_has_billing_scoper@sx'//52 uu IIg  E eS ! !u $ 55s  "")r'rr6c tdpi}td}|d}t|tr|nd}g}|pt dgD]}|r||vr||t|vr|td |} t|dpd|dpd|d p|j | ||| } t5t} t| d| t| dddn #1swxYwY t!| n#t"$rYnwxYw t%n#t"$rYnwxYw| d} t| tot| vS) uRe-run the device flow requesting ``billing:manage`` and persist the result. The lazy step-up (plan D-A): triggered when a billing endpoint returns ``403 insufficient_scope``. Runs a fresh device-connect with ``inference:invoke tool:invoke billing:manage`` on the scope. The user must be an ADMIN/OWNER and tick "Allow terminal billing" in the portal for the minted token to actually carry the scope; otherwise the server silently downscopes and this returns False. Reuses the held credential's portal/inference URLs + client_id so the step-up targets the same deployment (incl. a preview via ``HERMES_PORTAL_BASE_URL`` set at the original login). Persists to the auth store + shared store + pool, exactly like ``_login_nous`` — but WITHOUT the model picker (this is a scope upgrade, not a fresh login). Returns True iff the new token carries ``billing:manage``. rMr=r9z tool:invoker.r:Nr;r<)r:r;r<r=r'rr6)r^rr6rr5rr rIr?ryr=r<rr4r;rrcrr) r'rr6priorr _raw_scope prior_scopertokr=rr=granteds rLstep_up_nous_billing_scoperGs]. $F + + 1rE'G7##J *:s ; ;C**KI!!##S(C]'S""  "3i''   S ! ! ! 112333 HHY  E( "344< 99%9::Bd))K((=G,=!''J   %%%'' Z<<<$$$%%%%%%%%%%%%%%%   ,,,,       '))))      nnW%%G gs # # T(AW]]__(TTs6*/E%%E),E)1F F FF!! F.-F.c  t|ddpd}tt|dd}t|ddp'tjdptjd} d}t }|r t }n#t $rd}YnwxYwt|rtd |ntd  td  }n#ttf$rd }YnwxYw|d vr0tdt|}|td|jtt|ddt|ddt|ddp|jt|ddt|dd |||}|d} t!5t#} | d} dddn #1swxYwYt!5t#} t'| d|t)| } dddn #1swxYwYt+|t-ttdtd| d} |dp|d}t/|t0r|st3ddd d!d"lm}m}m}m}m}m }|}tg}d#}|r|d}|d$%}|d&d#}|rY d!d'l!m"}m#}|d$%}||d()pd#}n#tH$rd#}YnwxYw||||\}}|||d$*\}}n||||\}}|d&d#}|r8td+tK|d,tM|||||d| |-}nR|rA|ptN(d.} td/t|pd0| d1ntd2nj#tH$r]}!t/|!t2rtS|!nt1|!}"ttd3|"Yd}!~!nd}!~!wwxYw|st!5t#} | r| | d<n| *ddt)| dddn #1swxYwYttd4td5dStWd| |6}#|r!tY|td7|td8|#d9dS#t$rtd:t[d;tH$r&}!td<|!t[d=d}!~!wwxYw)>z&Nous Portal device authorization flow.rNr$rFrr r!z)Found existing Nous OAuth credentials at z,Found existing shared Nous OAuth credentialsz!Import these credentials? [Y/n]: rU>r9rUrz3Rehydrating Nous session from shared credentials...ruKCould not refresh shared credentials — falling back to device-code login.r\ inference_urlr<r=r)r:r;r<r=r'rrrr;rrMrr"r$rz,No runtime API key available to fetch modelsrr:r)get_curated_nous_model_idsget_pricing_for_providercheck_nous_free_tierpartition_nous_models_by_tier&union_with_portal_free_recommendations&union_with_portal_paid_recommendationsr9Trrr:rozpaid Nous modelsrt) free_tierzShowing u= curated models — use "Enter custom model name" for others.)rXrZr\r]r^r_r`rCz#No free models currently available.rz to access paid models.z,No curated models available for Nous Portal.z?Login succeeded, but could not fetch available models. Reason: z:No provider change. Nous credentials saved for future use.z4 Run `hermes model` again to switch to Nous Portal.)r?zDefault model set to: rz (model.provider=nous)rrzLogin failed: r#).rrrrrSrMrrrrrrrrr=r<rr4r6r;rrcrrr5rKrrJrKrLrMrNrOrvrprqrrrrrErmr[rGrr)$rrrrrrrG shared_pathrr; _prior_storeprior_active_providerr=r-selected_modelrrJrKrLrMrNrOrrZr]rXrP_portal_for_recsrprq _account_info_portal_urlrrPrCs$ rL _login_nousrYsdIt44<OGD*e4455Hk4(( & 9' ( ( & 9_ % %  )**  i #577  # # #"  # GGG FO+OOPPPPDEEE !"EFFLLNNTTVV /0     ,,,KLLL:$3 %ghhh  0 'lD A A#*4$#G#G!$ T::Og>OdGT22!(|U!C!CC /!#   J((<=    H H+--L$0$4$45F$G$G ! H H H H H H H H H H H H H H H   4 4)++J VZ @ @ @' 33H 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 !,,,')))  !""" )x))*** S _$..55W9W9WKk3// { B#(                  3244I GGG') "$ ) 226::10TBBB #->>2CR#H#H #1 )E(DQU(V(V(V BB -+=" " ,+%111.0+++1*P)O!7,<**&Iw5R4Q!7d5551I11*P)O!7,<**&Iw!nn%6;;G FpYpppqqq!8w'9&(;%+%7$/"""$ F:#:BB3GG;<<<)X-X4-X-X-XYYYYDEEE _ _ _0:3 0J0JX',,,PSTWPXPXG GGG ]T[]] ^ ^ ^ ^ ^ ^ ^ ^ _ "## - --// (<4IJ011NN#4d;;; ,,,  - - - - - - - - - - - - - - - GGG N O O O H I I I F1 &n     = ~ . . . ;>;; < < < F;FFFGGGGG  "###oo  $s$$%%%mms&,V5?B V5 BV5B5V53DV5DV5DB9V5$H: V5H  V5 H V5/I V5IV5!I"AV54B0Q0%#N Q0 NQ0NCQ0/V50 S:AS V5SV5*> 0;00111mm " "F  LF L&J&L&LF  3444A&II26::M6"" ;&9 ;  % " $ $ $ /}///000  A29-A#B#B A = > > > > >  A M N N N N N ? @ @ @ @ @ 9999:::::rKr,)rQr5rr5rr5rr5)rr rrrr)rr5rr4rr)r)rQr5rrrr)r$r5rr5)rZrrr)r!r rr_)rZrrr5)rZrKrr5)rr rrQ)rr)rr5rrQrr rrR)rr )rr)rr?)rr rrrrrr5)rrrT)rrrr?)r=r?rrrr )r=r?rr5rr)r=r?rr5rr)r=r?rr5r>r?rrR) r=r?rr5r>r?rrrrR) r=r?rr5r>r?r%rrrR)rr5rrR)rr5rr)rr5rr5)rrQrr?)rr5r?r@r>rArr )rr5rr5rrR)rr5rr5rr)rr5rr)rrQ)rrQrrr)rqr5rr5)rrQrrQrrQrr5r)rr rrrr)rr rr)rr rrQ)rr?rrR)rrQrrQ)rr rr?)rr rr) rr r=r rr rrrrQ) rr r=r rr rrrr)r>r?rr rrR)rr rrQrrR)rr rr rrQ)r>r?r!rQrrR)r>r?rr rrQrrR)r>r?rr?)rr rrrr)rAr?rr )rFr rrrr)rK)rAr?rrrr?)rer?rrR)rhrrirrjrrr?)rrQrrt)rrQrr5r)r~rQr>rrr5)r>rrr5)r)rrrr5)rr5rr5)r<r5rr5r=r5r>r5rr5rr5rr5)rr5rr)rr5rr)rr5rrrr)rr?r<r5rr5rr5rr5rr5rrrr?)r<r5rNr5rr5rr5rr5rrrr?)r>r?rrrr?)rr5rr5)rr5r!rWrrR)r]rrr?) r=r?rAr1rerQrirrrR)rAr1rer5r%r5rrR)rr5rr)rr5rMr5rrrr?)rAr1rrrr1)rr)rr)r=r?rr)r>rrr)r=r?rr)r>r?rrR) rAr?rrrr5rerQrvr5rrR)r)rr5rrrr)rr5rr)rr5rr5rr5)rr5rr5rr5)r$)rrrr1) rr5rMr5rr5rrrr?) rAr?rr5rr5rrrr?)rhrrirrjr_rr?)rr )rrrrQrrrr ) rr)r:r5r<r5r=rQrr?)rr)r:r5r<r5r&r5rrrrrr?)r>r?rrr)rrrr)r>r?rZrKrr5rrR)r=r?rZrKrr5rr)rrrr) rr)r:r5r<r5rMr5rr?) r;r5rQr5rrrrrrt)r>r?rrrr) rrrrrrQrjrrr5)"rr5rMr5r<r5r:r5r;r5rZr5r=r5r!rQrrQr$rQr&rQrrrrrrQrhrrrrr?) r>r?rrrhrrrrr?)rer?r%rQ) rrrrrrQrhrrr?)rr)rr5rr?)rr5r;r5r?rQrr ) rr5rMr5r$r5rQr5rr)r9NNr9r9r9r9r9)rrtrEr5rXrYrZr[r\r5r]r5r^r5r_r5r`r5rrQ)rr5rrR)rr4rrrrR)rr)r=r5rr?) rr)rr5r&r5rrrrrr?)rrr'rrr?)rrB) rr)r:r5r<r5rr5r>r5rr?)rrrrrr)rrrrrr)rr)r:r5r<r5r-r5rr5rrrr_rr?)rr?rrR)rr5r'rrrrr?)r>r?rrrrrr?)r>r?rrKrrR)rr$)r.rr/rrr?)rr4rrR)r:rQr;rQr<rQr=rQr'rrrrrrrQr6r7rr?)r'rrrr6r7rr(^rH __future__rr"loggingrrrrrrIrr7rrrrr contextlibr dataclassesrrrr http.serverr r r pathlibr typingr rrrrrrr urllib.parserrrr'rrrrrrrragent.credential_persistencerutilsrr r!r" getLoggerrErrrrrrrrar`r r?r_rwr!ACCESS_TOKEN_REFRESH_SKEW_SECONDSNOUS_INVOKE_JWT_MIN_TTL_SECONDSr?rrMINIMAX_OAUTH_CLIENT_IDrrMINIMAX_OAUTH_GLOBAL_BASEMINIMAX_OAUTH_CN_BASEMINIMAX_OAUTH_GLOBAL_INFERENCEMINIMAX_OAUTH_CN_INFERENCErroDEFAULT_GITHUB_MODELS_BASE_URLDEFAULT_COPILOT_ACP_BASE_URLDEFAULT_OLLAMA_CLOUD_BASE_URLSTEPFUN_STEP_PLAN_INTL_BASE_URLSTEPFUN_STEP_PLAN_CN_BASE_URLrr hermes_clir+_HERMES_CLI_VERSIONr'CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDSXAI_OAUTH_ISSUERrrXAI_OAUTH_SCOPErrr_r^&QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDSrrrrr)SPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDSrZryrwr2rIr7r4rrr_list_providers_for_registryrr7r8env_varsrB _api_key_varsr _base_url_var display_namer$rrrrrrrr r&r.rArHr\rrKr^rdrmrlr{rrrrrrlocalrrrr4rrr5r;r#r'r*r/r1r=rPrVrXr\r^rarjrnrprrrrrrrrrrrrrrrrr rrrr r+r-r0r3r5r7r@rErJrdrgrqrsr{r}rrrrrrrrrrrrrrrr rrr.rr?r$rVr#rgrsrwr{rrryrrrrrrrrrrrrrrrrr rr(r7rDrKrOrIrMrPrZrcrSrirnrrqrtrzrrrrrrrrrrrrrrrrsrrr r rrrr#r:r>rGrIrKrMrOrQrWrrrrrrrrrrrrrr r rr!r#r-r1r"r5r=r@rGrYr\rArKrLrs"$#"""""   %%%%%%((((((((''''''''OOOOOOOOOORRRRRRRRRRRRRRRRRRRR6666666666  DCCCCCCCMMMMMMOOOOOOOOOOOO  8 $ $LLLL EEEMMMM FFF <H%0,0'($'!"C()%@2@9G42!CA%'"3!@. 7"G F6=$=======$$$#$<':<<*-'&-PPP<R/DDD )-%9A),&$B!;H[A,/)\ "  y*1           M0 NN  %/5(    M0NN  "1 M0 ..  6,* !M00  4"5 1M0<..  "0 =M0H  5(& IM0X~~  9M/ YM0h>>  !$7/ iM0v nn  M=* wM0F >>  9G'    GM0V>>  8@(   WM0lnn  &7- mM0z~~  :-+ {M0J ^^  8-) KM0Z >>  ;)'    [M0j~~  =-+ kM0z^^  0!19)!!9N(BDD   {M0M0P  6\- QM0`~~  S/- aM0p>> *JM7 qM0@..  ?0. AM0P  8., QM0` >>  0)'    aM0p nn  @,* qM0@NN  720 AM0P>>   ;1/   QM0j  <., kM0z>>  =&& {M0J nn  :,* KM0Z  @., [M0jNN  8,* kM0z~~  L+ {M0J^^  31 KM0M0MMMMd HHHHHH++--HH 8( ( (  =I % %S\ %  8b b b ppppppp gggggimnn &4nx!-SX"|*:cl*0b ' ' ' #(#k H HF...,=ch,G!&) H/H4   D D3    "    89      ))))r4gY(S o>o>orHICEvEvEvyNO  #####L....b 5 5 5 5./11111 111"    ----*BKKKK&DDDD---- >B[[[[[[,%%%%>!!!!H2222$IO%%DDDDN.G$'<'<'<'<' > > >.1: $;11 ,,,,^ D D D D, 6 6 6 6    &: @: *2"&      QQQQQ"&#;#;#;#;#;#;R!%      &/Y 0&&"CCCC66662>MsIIIIIEEEEEP%%%%* $ F @    6     44444 #&*0#&*(((((( ( ( ( ( ( - - - - -!!!!! HHHH !!!!! HHHH 4444*11110#+#+#+#+R#$$$$$$^04!!!!!!V",,,,,,d"======D $ I CCCCCCL&::::z\)\)\)\)DJ*3 * *    6666r     KO' ' ' ' ' ' d)-......j;? b,b,b,b,b,J%%%%%8    (" CCCCCCL))))XH $ G qqqqqqhFFFFR%%%%X#6#6#6#6L-1//////dXXXX*P*P*P*P`+/"&( ;;;;;;>$D&&&&R5555p.....j! ______L %%%%%%T $*. \\\\\\F( $#+/      N6.E.E.E.EP.*9?,,0000(25N6    F@H@H@H@HF< H H H H".((((BF"DDDDDDN7W7W7W7W|" 6*6*6*6*6*6*r    "## A u)u)u)u)u)u)~#!% $#*.!##GK#ddddddT"GK @ 888888vUUUU"## SSSSSSt    8)8)8)8)H#X\\\\\ # # # # # # # #B1(1(1(1(h> > > > B* * * * Z><      FJJJJZGGGGT%%%%^$(<<<<<~$AAAATTTT    . $$$$$$H37.2!FFFFFR"" GLGLGLGLGLGL\" AIAIAIAIAIAIN!''''''TFFFFV"CCCCCCLDDDDR&&&&%%%%P++++ ))))<<<<~%%%%D!PPPPPPh8<??????DZZZZ2,,,,`%G#&&&&&&R$     &*(,#!#<@IIIIIIX6666(!<@ @U@U@U@U@U@UFIIIIX;;;;;;sIC CCCC'&C')D00D:9D::CSSS