yjUdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlmZddlmZmZddlmZmZddlmZmZddlmZdd lmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&dd l'm(Z(m)Z)m*Z*ddl+Z+dd l,m-Z-m.Z.m/Z/m0Z0dd l1m2Z2m3Z3dd l4m5Z5ddl6m7Z7m8Z8m9Z9m:Z:ej;e<Z= ddl>Z>n #e?$rdZ>YnwxYw ddl@Z@n #e?$rdZ@YnwxYwdZAdZBdZCdZDdZEdZFdZGeFZHdZIdZJdZKeKZLdZMdZNdZOdZPdZQdZRdZSdZTd ZUd!ZVd"ZWd#ZXd$ZYd%ZZd&Z[d'Z\d(Z]d)Z^d*Z_d+Z`d,Za dd-lbmcZdn #e?$rd.ZdYnwxYwd/edZedZfd0Zgegd1Zhd2Zid3Zjegd4Zkd5Zld6Zmd7ZndZod8Zpd9Zqd:Zrd;Zsdwd?Zxd@dAiZydBezdC<dDZ{dEZ|ddJZ}ddKZ~eGdLdMZidNedNdOdPeCeDeEeHQdRedRdSdTeNUdVedVdWdXdYdZd[\d]ed]d^dTeOUd_ed_d`dTeXUdaedadbdXdcddde\dfedfdgdXeYdhdi\djedjdkdleZdmndoedodpdXdqdrds\dtedtdudXdvdwdx\dyedydzdXd{d|d}\d~ed~ddXdddedddXe^dd\dedddXddd\dedddXddd\dedddXe\dd\dedddXd dd\idedddeSeUePeQdeTeVddedddXddd\dedddXddd\dedddXddd\dedddXd!dd\dedddXddd\dedddXddd\dedddXddd\dedddXdddĬ\dedddXdddɬ\dedddXdddά\dedddXdddӬ\dedddXdddج\dedddXdddݬ\dedddXddd\dedddXe[dd\dedddddd\edddddd\edddXddd\dZdezd< ddlmZeD]Zejevr ejdXksejsejdvr)edejDZedejDdZeejejpejdXejepejepd\eej<ejD]Zeevreejee<n #e?$rYnwxYwddZdZddZhdZdddÐdZdĐd Zddvd gd fddd gdfddgddfddgddfgZdŐdZdƐdǐdZdd Zdd!Zd"ZGd#d$eZdȐd'Zdɐd*Zdʐd+Zdːd,Zd̐d/Zd͐d0Zdd1dΐd6Zdϐd8ZdАd:Zdѐd<Zdϐd=ZiZd>ezd?<ejZdҐdBZdӐdEZedԐdJZeeBfddKdՐdLZd֐dאdNZd֐dؐdPZdِdRZedڐdSZdېdUZdܐdWZdݐdYZdZd[dސd]Zd^d[dߐd_Zdd`ZddaZddbZddcZd֐dddZdeZddhZddiddnZddpZddqZddrZÐddsZĐddtZŐdduZƐd֐ddvZǐddwZȐddyZ ddddzdd~ZʐddZːddZ̐ddZ͐ddZeϐdhZАdezd<ehdZѐdezd<ddZeϐdhZӐdezd<ddZԐddZՐddZ֐ddZאddZddeLdddZddeLdddZddddZdd1ddZܐd֐ddZddddZdddddZeϐddhZddZddZdϐdZdѐdZddZeofddZdddZddZd^dZeodddZdѐdZd֐ddZd֐ddZ dddZ dddZd֐d d„Zd֐d dÄZd d dƄZd dȄZd d dɄZd dʄZd dτZddфZddԄZdՐd֜dd؄ZddٜddބZdd֜ddZdd֜ddZd^dZeudddZdѐdZddZddZd͐dZehdZdezd<d͐dZddZddddZdZdddZ d֐ddZdddZddZdd֜ddZ ddZ ddZ d^dZefdddZ ddZ dZiZdezd<ejZddZdedddZd֐d d Zd!d Zdd Zd"d Zd#d ZdZdddZd$dZd%dZddddPdZdd&dZd'd(dZd)dZd*dZd+dZd,d-dZ dddd.dZ!ddd/d Z"d^dZddd0d!Z#d1d#Z$dddd$d2d(Z%d3d,Z&d4d-Z'd5d/Z(d0Z)ej*Z+dϐd1Z,dϐd2Z-eeBfd6d3Z.d7d4Z/d%d5Z0d!d6Z1d8d7Z2d9d9Z3d9d:Z4d9d;Z5d:d<Z6d;d=Z7dd֜d<d>Z8d=d?Z9ddZd@d>dDZ:d?dEZ;ejZdddeKdId@dJZ?dKeHdddddddd^ddL dAdRZ@dd^ddSdBdTZAddUdCdVZBddWZCdddd^dXdDdYZDdѐdZZEdѐd[ZFdZGdaHd\ezd]<dEd_ZIdd`ZJdѐdaZKdѐdbZLdѐdcZMddZNdeZOd.ZPddfZQdѐdgZRdѐdhZSdFdiZTdFdjZUd֐ddkZVdѐdlZWdFdmZXdFdnZY d֐dGdpZZddqZ[ddrZ\ddsZ]ddtZ^dϐduZ_ddddvdHdyZ` dIdJdZadKdZbddZcd^ddLdZdd^ddLdZeejddMdZfdNdZgddZddOdZhdѐdZidZjejddPdZkdQdZldRdZmdSdZndTdZodUdZpdVdZqdWdZrddZdddXdZsdd^ddYdZtdZdZud[dZveWd^dd\dZwdѐdZxd]dZydddddZdd^ddd d^dZzd͐dZ{dZdddd_dZ|d]dZ}ddZ~dS(`a Multi-provider authentication system for Hermes Agent. Supports OAuth device code flows (Nous Portal, future: OpenAI Codex) and traditional API key providers (OpenRouter, custom endpoints). Auth state is persisted in ~/.hermes/auth.json with cross-process file locking. Architecture: - ProviderConfig registry defines known OAuth providers - Auth store (auth.json) holds per-provider credential state - resolve_provider() picks the active provider via priority chain - resolve_*_runtime_credentials() handles token refresh and runtime keys - logout_command() is the CLI entry point for clearing auth Nous authentication paths: - Invoke JWT (preferred): use a scoped access_token directly for inference. ) annotationsN)contextmanager) dataclassfield)datetimetimezone)BaseHTTPRequestHandler HTTPServer)Path)AnyCallableDict FrozenSetIterableListOptionalTuple)parse_qs urlencodeurlparse)get_hermes_homeget_config_pathread_raw_config$require_readable_config_before_write)OPENROUTER_BASE_URLsecure_parent_dir)$sanitize_borrowed_credential_payload)atomic_replaceatomic_yaml_write env_floatis_truthy_value.@zhttps://portal.nousresearch.comz)https://inference-api.nousresearch.com/v1 hermes-clizinference:invokezbilling:manage device_code invoke_jwtxz%https://chatgpt.com/backend-api/codexzhttps://api.x.ai/v1z$78257093-7e40-4613-99e0-527b14b39113z!group_id profile model.completionz*urn:ietf:params:oauth:grant-type:user_codezhttps://api.minimax.iozhttps://api.minimaxi.comz https://api.minimax.io/anthropicz"https://api.minimaxi.com/anthropic<zhttps://portal.qwen.ai/v1zhttps://api.githubcopilot.comz acp://copilotzhttps://ollama.com/v1zhttps://api.actual.inc/v1zhttp://127.0.0.1:8080/v1z#https://api.stepfun.ai/step_plan/v1z$https://api.stepfun.com/step_plan/v1app_EMoamEEZ73f0CkXaXp7hrannz#https://auth.openai.com/oauth/token) __version__unknownz hermes-cli/zhttps://auth.x.aiz!/.well-known/openid-configurationz$b1a00492-073a-47ea-816f-4c329264a828z>openid profile email offline_access grok-cli:access api:accessz/oauth2/device/codei f0304373b74a44d2b584a3fb70ca9e56z(https://chat.qwen.ai/api/v1/oauth2/tokenzhttps://accounts.spotify.comzhttps://api.spotify.com/v1z'http://127.0.0.1:43827/spotify/callbackzFhttps://hermes-agent.nousresearch.com/docs/user-guide/features/spotifyz'https://developer.spotify.com/dashboardz@https://hermes-agent.nousresearch.com/docs/guides/oauth-over-ssh ) zuser-modify-playback-statezuser-read-playback-statezuser-read-currently-playingzuser-read-recently-playedzplaylist-read-privatezplaylist-read-collaborativezplaylist-modify-publiczplaylist-modify-privatezuser-library-readzuser-library-modifyspotifySpotifyDict[str, str]SERVICE_PROVIDER_NAMESzdummy-lm-api-keyzdummy-actual-local-api-keybase_urlstrreturnboolc t|pdjpdd}n#t$rYdSwxYw|dvS)z5Return True for Actual's loopback local API endpoint..F>0.0.0.0 localhost::1 127.0.0.1)rhostnamelowerrstrip Exception)r2hosts 5/home/ragecks/.hermes/hermes-agent/hermes_cli/auth.pyis_actual_local_base_urlrCsjR((17R>>@@GGLL uu ? ??s=A A Act|pdd}|stS t |}|jpdd}|jd}n#t$r|cYSwxYw|dkr |dvr|dzSt|r |dvr|dzS|S)zReturn Actual's OpenAI-compatible base URL. Actual hosted inference is exposed at api.actual.inc, while the Actual client's offline local server binds a loopback host. Both use a /v1 API surface for Hermes' Responses transport. r7/r8zapi.actual.inc>r7rE/v1) r3stripr?DEFAULT_ACTUAL_BASE_URLrr=r>pathr@rC)r2urlparsedrArIs rBnormalize_actual_base_urlrLs hn"   # # % % , ,S 1 1C '&&#%2,,..55c::{!!#&&   DI$5$5U{$$):):U{ JsAB B('B(ceZdZUdZded<ded<ded<dZded<dZded<dZded <dZded <e e Z d ed <dZ ded<dZ ded<dS)ProviderConfigz%Describes a known inference provider.r3idname auth_typer7portal_base_urlinference_base_url client_idscope)default_factoryDict[str, Any]extratupleapi_key_env_varsbase_url_env_varN)__name__ __module__ __qualname____doc____annotations__rRrSrTrUrdictrXr[r\rYrBrNrNs// GGG IIINNNO     IEOOOO!E$777E7777     rcrNnousz Nous Portaloauth_device_code)rOrPrQrRrSrTrU openai-codexz OpenAI Codexoauth_external)rOrPrQrSz openai-apiz OpenAI APIapi_keyzhttps://api.openai.com/v1)OPENAI_API_KEYOPENAI_BASE_URL)rOrPrQrSr[r\ xai-oauthz%xAI Grok OAuth (SuperGrok / Premium+) qwen-oauthz Qwen OAuthlmstudioz LM Studiozhttp://127.0.0.1:1234/v1) LM_API_KEY LM_BASE_URLcopilotzGitHub Copilot)COPILOT_GITHUB_TOKENGH_TOKEN GITHUB_TOKENCOPILOT_API_BASE_URL copilot-acpzGitHub Copilot ACPexternal_processCOPILOT_ACP_BASE_URL)rOrPrQrSr\geminizGoogle AI Studioz0https://generativelanguage.googleapis.com/v1beta)GOOGLE_API_KEYGEMINI_API_KEYGEMINI_BASE_URLzaiz Z.AI / GLMzhttps://api.z.ai/api/paas/v4) GLM_API_KEY ZAI_API_KEY Z_AI_API_KEY GLM_BASE_URL kimi-codingzKimi / Moonshotzhttps://api.moonshot.ai/v1) KIMI_API_KEYKIMI_CODING_API_KEY KIMI_BASE_URLkimi-coding-cnzKimi / Moonshot (China)zhttps://api.moonshot.cn/v1)KIMI_CN_API_KEY)rOrPrQrSr[stepfunzStepFun Step Plan)STEPFUN_API_KEYSTEPFUN_BASE_URLarceezArcee AIzhttps://api.arcee.ai/api/v1)ARCEEAI_API_KEYARCEE_BASE_URLgmiz GMI Cloudzhttps://api.gmi-serving.com/v1) GMI_API_KEY GMI_BASE_URLactualzActual Computer)ACTUAL_API_KEYACTUAL_BASE_URLminimaxMiniMax)MINIMAX_API_KEYMINIMAX_BASE_URL minimax-oauthuMiniMax (OAuth · minimax.io) oauth_minimaxglobal)regioncn_portal_base_urlcn_inference_base_url)rOrPrQrRrSrTrUrX anthropic Anthropiczhttps://api.anthropic.com)ANTHROPIC_API_KEYANTHROPIC_TOKENCLAUDE_CODE_OAUTH_TOKENANTHROPIC_BASE_URLalibabaz Qwen Cloudz6https://dashscope-intl.aliyuncs.com/compatible-mode/v1)DASHSCOPE_API_KEYDASHSCOPE_BASE_URLalibaba-coding-planzAlibaba Cloud (Coding Plan)z-https://coding-intl.dashscope.aliyuncs.com/v1)ALIBABA_CODING_PLAN_API_KEYrALIBABA_CODING_PLAN_BASE_URL minimax-cnzMiniMax (China))MINIMAX_CN_API_KEYMINIMAX_CN_BASE_URLdeepseekDeepSeekzhttps://api.deepseek.com/v1)DEEPSEEK_API_KEYDEEPSEEK_BASE_URLxaixAI) XAI_API_KEY XAI_BASE_URLnvidiaz NVIDIA NIMz#https://integrate.api.nvidia.com/v1)NVIDIA_API_KEYNVIDIA_BASE_URL ai-gatewayzVercel AI Gatewayzhttps://ai-gateway.vercel.sh/v1)AI_GATEWAY_API_KEYAI_GATEWAY_BASE_URL opencode-zenz OpenCode Zenzhttps://opencode.ai/zen/v1)OPENCODE_ZEN_API_KEYOPENCODE_ZEN_BASE_URL opencode-goz OpenCode Gozhttps://opencode.ai/zen/go/v1)OPENCODE_GO_API_KEYOPENCODE_GO_BASE_URLkilocodez Kilo Codezhttps://api.kilo.ai/api/gateway)KILOCODE_API_KEYKILOCODE_BASE_URL huggingfacez Hugging Facez https://router.huggingface.co/v1)HF_TOKEN HF_BASE_URLxiaomiz Xiaomi MiMozhttps://api.xiaomimimo.com/v1)XIAOMI_API_KEYXIAOMI_BASE_URLtencent-tokenhubzTencent TokenHubz#https://tokenhub.tencentmaas.com/v1)TOKENHUB_API_KEYTOKENHUB_BASE_URL ollama-cloudz Ollama Cloud)OLLAMA_API_KEYOLLAMA_BASE_URLbedrockz AWS Bedrockaws_sdkz/https://bedrock-runtime.us-east-1.amazonaws.comrYBEDROCK_BASE_URLvertexzGoogle Vertex AIr7 azure-foundryz Azure Foundry)AZURE_FOUNDRY_API_KEYAZURE_FOUNDRY_BASE_URL)rrzDict[str, ProviderConfig]PROVIDER_REGISTRYlist_providers>r|customrp openrouterrrc#nK|]0}|d|d,|V1dS _BASE_URL_URLNendswith.0vs rB rsHppAQZZ =T=Tp]^]g]ghn]o]opapppppprcc#nK|]0}|ds|d,|V1dSrrrs rBrrsHggAK9P9PgTUT^T^_eTfTfgaggggggrccbddlm}tdjD]}||pd}|r|cSdS)uReturn the first usable Anthropic credential, or ``""``. Checks both the ``.env`` file and the process environment, preferring ``~/.hermes/.env`` so a deliberate key rotation isn't shadowed by a stale shell export (matches the api-key resolution path — see #20591). The order mirrors the ``PROVIDER_REGISTRY["anthropic"].api_key_env_vars`` tuple: ANTHROPIC_API_KEY -> ANTHROPIC_TOKEN -> CLAUDE_CODE_OAUTH_TOKEN rget_env_value_prefer_dotenvrr7)hermes_cli.configrrr[)rvarvalues rBget_anthropic_keyr$s]>===== ->++C006B  LLL  2rczhttps://api.kimi.com/coding default_url env_overridecN|r|S|s|S|drtS|S)zReturn the correct Kimi base URL based on the API key prefix. If the user has explicitly set KIMI_BASE_URL, that always wins. Otherwise, sk-kimi- prefixed keys route to api.kimi.com/coding/v1. zsk-kimi-) startswithKIMI_CODE_BASE_URL)rhrrs rB_resolve_kimi_base_urlrIsB  *%%"!! rc> ***** your-api-key*nonenulldummyexamplechangeme placeholder your_api_keyyour_api_key_here) min_lengthrr rintct|tsdS|}t||krdS|t vrdSdS)zIReturn True when a configured secret looks usable, not empty/placeholder.FT) isinstancer3rGlenr>_PLACEHOLDER_SECRET_VALUES)rrcleaneds rBhas_usable_secretrjsZ eS ! !ukkmmG 7||j  u}}444u 4rc provider_idpconfigtuple[str, str]c|dkrj ddlm}m}|\}}|r||\}}||fSn=#t$r%}td|Yd}~nd}~wt $rYnwxYwdSddlm} |j D]6} | | pd } t| r| | fcS7 dd l m } | |} | r| ro| }|rYt!|d dpt!|d d}t#| }t|r|d |fSn#t $rYnwxYwdS) zDResolve an API-key provider's token and indicate where it came from.rprresolve_copilot_tokenget_copilot_api_tokenz#Copilot token validation failed: %sN)r7r7rr7 load_pool access_tokenruntime_api_keyzcredential_pool:)hermes_cli.copilot_authr r ValueErrorloggerwarningr@rrr[rGragent.credential_poolrhas_credentialspeekgetattrr3)rr r rtokensource api_token _base_urlexcrenv_varvalrpoolentrykeys rB _resolve_api_key_provider_secretr%vsi  \ \ \ \ \ \ \ \1133ME6 )'<'z'detect_zai_endpoint..sB    KK2GR I I2a5   rcci|]\}}|| SrYrY)rfrBs rBrOz'detect_zai_endpoint..s:::ha:::rcNF)wait) concurrent.futuresrHrIr ZAI_ENDPOINTSitemsresultr@doneshutdown) rhr*rHrIfuturesby_idresultsfuturerBrVrNr"s `` @rBdetect_zai_endpointr]sDCCCCCCC  #m*<*< = = =D "      #   ;:'--//:::-/"l7++ * *FFOE %%+GEN    $ * *RU|((**Ea5G##"2a5>)))) 5 !!!!$  & &B!ur!u~%% 5 !!!!   5 !!!!! 5 !!!!s=A E6BE BEBA E?$E:EE,c|r|S|s|St}t|dpi}|d}t|tr|dr|dd}|t j|ddkr)t d|d|dSt|}|rq|dr[t j|dd}|d|d d|d d|d d|d } t5t}t|dpi} || d<t|d| d t|dddn #1swxYwYn2#t$r%} td| Yd} ~ nd} ~ wwxYwtd|d |d|dSt d||S)aYReturn the correct Z.AI base URL by probing endpoints. If the user has explicitly set GLM_BASE_URL, that always wins. Otherwise, probe the candidate endpoints to find one that accepts the key. The detected endpoint is cached in provider state (auth.json) keyed on a hash of the API key so subsequent starts skip the probe. r|detected_endpointr2key_hashr7NzZ.AI: using cached endpoint %srOr6r=)r2 endpoint_idr6r=r`F set_activezHZ.AI: could not persist detected endpoint (%s); will re-probe next startz$Z.AI: auto-detected endpoint %s (%s)z.Z.AI: probe failed, falling back to default %s)_load_auth_store_load_provider_stategetrrbhashlibsha256encode hexdigestrrAr]_auth_store_lock_store_provider_state_save_auth_storer@rinfo) rhrr auth_storestatecachedr`detectedr_state_under_lockrs rB_resolve_zai_base_urlrus "##J U 3 3 9rE YY* + +F&$&FJJz$:$:&::j"-- w~gnn&6&677AACCCRCH H H LL96*;M N N N*% %#7++H$HLL,,$>'.."2"233==??D ,#<<b11\\'2..\\'2..    l!## - --// #7 E#J#J#Pb 8I !45&j%9IV[\\\\ ,,, - - - - - - - - - - - - - - - l l l NNegj k k k k k k k k l :HWaccount_missingno_usable_creditssubscription_expiredmember_spend_cap_exceededtemporarily_unavailablez Please retry in a few seconds.)rr|r3rrrr~#_format_nous_entitlement_auth_errorrs rBformat_auth_errorrs  eY ' '5zz"%((5zz A@@@@ z,,, >V # #6u== =hh z+++ >V # #6u== =VV zrrr >V # #6u== = z...8888 u::rccz ddlm}m}|d}||d}|r|Sn#t$rYnwxYw|dS)Nr&format_nous_portal_entitlement_messageget_nous_portal_account_infoT force_freshzNous model access capabilityz5 Check credits or billing in Nous Portal, then retry.)hermes_cli.nous_accountrrr@)rrr account_infors rBrrs         43EEE 88 *     N        J J JJs $( 55rrct|tsdS|}|sdStj|dddS)zJReturn a short hash fingerprint for telemetry without leaking token bytes.Nutf-8 )rr3rGrhrirjrk)rrs rB_token_fingerprintrsd eS ! !tkkmmG t >'..11 2 2 < < > >ss CCrcc|tjdd}|dvS)NHERMES_OAUTH_TRACEr7>1onyestrue)osgetenvrGr>)raws rB_oauth_trace_enabledrs8 )(" - - 3 3 5 5 ; ; = =C , ,,rc) sequence_ideventrfieldsrc tsdSd|i}|r||d<||tdt j|dddS)Nrrzoauth_trace %sTF sort_keys ensure_ascii)rupdaterror;dumps)rrrpayloads rB _oauth_tracersp  ! !&.G-!,  NN6 KK $*WSX"Y"Y"YZZZZZrcr cFtdz }tjdrpt jdz dz d} |d}n#t$r|}YnwxYw||krtd|d|S)N auth.jsonPYTEST_CURRENT_TEST.hermesFstrictz8Refusing to touch real user auth store during test run: zq. Set HERMES_HOME to a tmp_path in your test fixture, or run via scripts/run_tests.sh for hermetic CI-parity env.) rrenvironrgr homeresolver@ RuntimeError)rIreal_home_authresolveds rB_auth_file_pathrs   { *D  z~~+,, )++ 1K?HHPUHVV ||5|11HH   HHH  ~ % %G4GGG  KsA66 BBOptional[Path]c ddlm}|}n#t$rYdSwxYwt} |d|dkrdSn#t$r ||krYdSYnwxYw|dz S)aReturn the global-root auth.json when the process is in profile mode. Returns ``None`` when the profile and global root resolve to the same directory (classic mode, or custom HERMES_HOME that is not a profile). Used by read-only fallback paths so providers authed at the root are visible to profile processes that haven't configured them locally. See issue #18594 follow-up (credential_pool shadowing). rget_default_hermes_rootNFrr)hermes_constantsrr@rr)r global_root profile_homes rB_global_auth_file_pathrs<<<<<<--// tt"$$L   u  - -1D1DE1D1R1R R R4 S  ; & &44 ' &  $$s !!.A$$A:9A:rWct}||siStjdrytjdd}|rWt |dz dz } |d|dkriSn#t$rYnwxYw t|S#t$ricYSwxYw) a8Load the global-root auth store (read-only fallback). Returns an empty dict when no global fallback exists (classic mode, or the global auth.json is absent). Never raises on missing file. Seat belt: under pytest, refuses to read the real user's ``~/.hermes/auth.json`` even when HERMES_HOME is set to a profile path. The hermetic conftest does not redirect ``HOME``, so ``get_default_hermes_root()`` for a profile-shaped HERMES_HOME can still resolve to the real user's home on a dev machine. That would leak real credentials into tests. This guard uses the unmodified ``HOME`` env var (what ``os.path.expanduser('~')`` would resolve to), not ``Path.home()``, because ``Path.home`` is sometimes monkeypatched by fixtures that want to relocate the global root to a tmp path. NrHOMEr7rrFr) rexistsrrrgr rr@re) global_path real_home_env real_roots rB_load_global_auth_storers  )**K+"4"4"6"6  z~~+,, vr22  ]++i7+EI &&e&44 8I8IQV8I8W8WWWIX     ,,,  s$>/B// B<;B<C CCcDtdS)N.lock)r with_suffixrYrcrB_auth_lock_pathrAs    ( ( 1 11rczDict[str, threading.local]_auth_target_lock_holdersleftrightc |d|dkS#t$r ||kcYSwxYwNFr)rr@)rrs rB _same_pathrIsY||5|))U]]%]-H-HHH u}s-0AA target_paththreading.localc$ t|d}n#t$rt|}YnwxYwt5t|t jcdddS#1swxYwYdS)zCReturn a reentrancy tracker keyed to one canonical auth-store path.FrN)r3rr@_auth_target_lock_holders_guardr setdefault threadinglocal)rr$s rB_auth_lock_holder_forrPs+%%U%3344 + (LL(33C9J9JKKLLLLLLLLLLLLLLLLLLs!#&AA ,BB  B  lock_pathholdertimeout_secondstimeout_messagec#Kt|dddkr=|xjdz c_ dV|xjdzc_n#|xjdzc_wxYwdS|jddt)t "d|_ dVd|_n #d|_wxYwdSt rH|r|jdkr| dd | t rd nd d 5}tj td |z} tr?t j|tjtjznG|dt j|t jdnX#t*t,t.f$r=tj |krt1|tjd YnwxYwd|_ dVd|_trL t j|tjnD#t,t6f$rYn0wxYwt r` |dt j|t jdn#t,t6f$rYnwxYwn#d|_trJ t j|tjw#t,t6f$rYwwxYwt r` |dt j|t jdw#t,t6f$rYwwxYwwxYwddddS#1swxYwYdS)uCross-process advisory flock helper. Reentrant per-thread via ``holder.depth``. Falls back to a depth-only guard when neither ``fcntl`` nor ``msvcrt`` is available (rare). Callers supply their own ``threading.local`` so independent locks (e.g. profile auth.json vs shared Nous store) don't share reentrancy state — that would let one lock's reentrant acquisition silently skip the other's kernel-level flock. depthrr"NTparentsexist_okr-rencodingzr+za+?g?)rrparentmkdirfcntlmsvcrtrstatst_size write_textopentime monotonicmaxflockfilenoLOCK_EXLOCK_NBseeklockingLK_NBLCKBlockingIOErrorOSErrorPermissionError TimeoutErrorsleepLOCK_UNIOErrorLK_UNLCK)rrrr lock_filedeadlines rB _file_lockrZs3 vw""Q&&    EEE LLA LLLFLLA LLLLLL 4$777 }   EEEFLL1FL    4y''))4Y^^-=-=-E-J-JS7333 0D7 C Cy>##c#&?&?? ! !KK 0 0 2 2EMEM4QRRRRNN1%%%N9#3#3#5#5vJJJ#Wo> ! ! !>##x//&777 4      ! !   EEEFL K 0 0 2 2EMBBBB)D NN1%%%N9#3#3#5#5vJJJJ)D   FL K 0 0 2 2EMBBBB)D NN1%%%N9#3#3#5#5vJJJJ)D  3s>AB B&N<7B GN<AHN<H N<%K+)N<81I+)N<+J<N<?J N< AKN<K'$N<&K''N<+N,;1L-,N,-M >N,M  N, ANN,N( %N,'N( (N,,N<<OOrc#K||n t}||dn t}t|t ||d5dVddddS#1swxYwYdS)a\Cross-process advisory lock for one auth.json read/write transaction. ``target_path`` is required for profile-to-global write-throughs. A profile lock does not protect the distinct global auth store; each path therefore uses its own reentrancy tracker and kernel lock. Lock ordering invariant: when this lock is held together with ``_nous_shared_store_lock``, acquire ``_auth_store_lock`` FIRST (outer) and the shared Nous lock SECOND (inner). All runtime refresh paths follow this order; violating it risks deadlock against a concurrent import on the shared store. Nrz%Timed out waiting for auth store lock)rrrrr)rr auth_pathrs rBrlrls$ +6 O,>!E!EBi. G # # ' 6If -I-6#@66DBB B* ; ;;sB(A1D8 D3"B:9D3:'C$!D3#C$$A D3-D83D8rpc||n t}|jddt|t|d<t jtj |d<tj |ddz}| |j dtjd t!jj} tjt)|tjtjztjzt0jt0jz}tj|d d 5}|||tj|dddn #1swxYwYtA|| tjt)|jtj!}n#tD$rd}YnwxYw|C tj|tj#|n#tj#|wxYw |$r|%nO#tD$rYnCwxYw# |$r|%ww#tD$rYwwxYwxYw |&t0jt0jzn#tD$rYnwxYw|S) NTrr updated_at)indent .tmp.r8wrr)'rrrrr(rnowrutc isoformatr;r with_namerPrgetpiduuiduuid4hexrr3O_WRONLYO_CREATO_EXCLrS_IRUSRS_IWUSRfdopenwriteflushfsyncr rO_RDONLYrcloserunlinkchmod)rprrrtmp_pathfdhandledir_fds rBrnrns( +6 O> J  J K (J:8K : KK KK ,K;; LL/tuple[Optional[Dict[str, Any]], Optional[Path]]c|d}t|trG||}t|trt|tfSt }t }|re|d}t|tr;||}t|trt||fSdS)aReturn a provider state plus the auth.json path it came from. Most callers only need the state, but refresh paths that rotate single-use OAuth refresh tokens must write the updated token chain back to the same store they read. In profile mode ``_load_provider_state`` can read a global-root fallback state; persisting a rotated Nous refresh token only to the profile would leave the global/root store stale and cause the next process to replay an already-consumed refresh token. r NN)rgrrbrrr)rprr rqr global_storeglobal_providers global_states rB _load_provider_state_with_sourcerV:s{++I)T""2 k** eT " " 2;; 1 11 1(**K*,,L7'++K88 & - - 7+// < shared lock order. Nrr )rlrerVrrrgrrb) rrprq source_path active_path source_storesource_providers source_state raw_states rB_provider_state_transactionr^Xs   88%'' =    {&''  *[+"F"F e[0 0 0 0 88888888+ 6 6 6 8 8+K88L+// << L*D11 3,00== i..3#' ??LlK7 7 7 7 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8888888888888888888s=A D(D8A`` inside the profile, the profile state fully shadows the global state on the next read. See issue #18594 follow-up. )rV)rprrq _source_paths rBrfrfws;:{SSE< Lrcrqc|di}t|ts i|d<|d}|||<||d<dSNr r'rrrb)rprrqr s rB_save_provider_stateresX%%k266I i & &,"$ ;{+ "Ik$/J !!!rcrXc$t}||} |d|dk}n#t$r ||k}YnwxYw|r"t|||t |dSt |||ddS)z?Persist provider state back to the auth store it was read from.NFrTrc)rrr@rern _persist_provider_state_to_store)rprrqrXrY same_stores rB_save_provider_state_to_sourceris"##K! 0 (((66+:M:MUZ:M:[:[[ 000 K/ 0Ze<<<$$$$  s.AAATrcrdc|di}t|ts i|d<|d}|||<|r||d<dSdSrcrd)rprrqrdr s rBrmrmsl%%k266I i & &,"$ ;{+ "Ik4(3 $%%%44rcFct|5t|}t||t||t ||cdddS#1swxYwYdS)zFMerge one provider into a specific auth store under that store's lock.rrcN)rlrermrbrn)rrqrrdrps rBrgrgs k 2 2 2EE%k22    KK!      DDDEEEEEEEEEEEEEEEEEEsAAA"%A"ct5t}|dpds||d<t |ddddS#1swxYwYdS)a5Set ``active_provider`` to *provider_id* only when none is set yet. Used by ``hermes auth add`` OAuth paths that create credential-pool entries directly (no singleton ``providers.`` block). Adding the very first credential for a provider should make it the active provider so the setup wizard's ``_model_section_has_credentials()`` check (which consults ``get_active_provider()``) does not report "No inference provider configured". Subsequent adds for an already-active setup leave the user's chosen active provider untouched. r'r7N)rlrergrGrnrrps rBmark_provider_active_if_unsetrns   ))%'' 0117R>>@@ ),7J( ) Z ( ( ( ))))))))))))))))))sA A((A,/A,cv|pd}|tvp|tvSNr7)rGr>rr1r normalizeds rBis_known_auth_providerrss;#**,,2244J * * RjrrPr1rgrqs rBget_auth_provider_display_namerusT#**,,2244J&&& ,11 ! % %j+ > >>rcc|pd}|sdS|dvrdS|drdS t|n#t$rYdSwxYwdS)a.Return whether runtime resolution recognizes a provider identity. This is a capability check, not a credential check. It follows the same alias/plugin-aware normalization as ``resolve_provider`` while preserving special runtime identities that intentionally live outside the registry. r7F>moaautorrTzcustom:)rGr>rresolve_providerr|rqs rBis_runtime_provider_routablerzs#**,,2244J u<<<tY''t$$$$ uu 4s A A)(A)ct}|d}t|tsi}i}t }|r|dnd}t|tr|}|t|}|D]\\}}t|t r|s||} t| t r| rJt |||<]|S||} t| t r| rt | S||} t| t rt | ngS)uReturn the persisted credential pool, or one provider slice. In profile mode, the profile's credential pool is authoritative. If a provider has no entries in the profile, entries from the global-root ``auth.json`` are used as a read-only fallback — so workers spawned in a profile can see providers that were only authenticated at global scope. Profile entries always win: the global fallback only applies per-provider when the profile has zero entries for that provider. Once the user runs ``hermes auth add `` inside the profile, profile entries fully shadow global for that provider on the next read. Writes always go to the profile (``write_credential_pool`` is unchanged). See issue #18594 follow-up. r$N)rergrrbrrUlist) rrpr" global_poolrSmaybe_global_poolmergedgp_key gp_entriesexistingprovider_entriesglobal_entriess rBread_credential_poolrs "##J >>+ , ,D dD ! !"$K*,,L?KU (():;;;QU#T**(' d"-"3"3"5"5 . . FJj$// z zz&))H(D)) h !*--F6NN xx ,,"D))&.>&$%%% __[11N#-nd#C#C K4   Krc) last_statuslast_status_atlast_error_codelast_error_reasonlast_error_messagelast_error_reset_atr# disk_entryct|ts|S ddlm}m}m}m}m}|d}|||fvr|S|dpd} |dpd} | r | r| | kr|S||dpd} ||dpd} | | kr|S||kr:|| ||} | | tj kr|St|}tD]}||||<|S#t$r|cYSwxYw)uKeep a newer on-disk cooldown/quarantine over a stale in-memory one. ``write_credential_pool`` callers persist an in-memory snapshot that may predate another process marking the same credential exhausted or dead (last-writer-wins lost update). Without this merge, process B's later rewrite resurrects a rate-limited key as healthy and both processes resume hammering it. Adopt the on-disk status fields only when they are strictly more recent (by ``last_status_at``) AND still binding — a DEAD marker, or an EXHAUSTED cooldown that has not yet expired. Expired cooldowns are not resurrected, so the pool's own expiry-clear (which resets ``last_status_at`` to None) is never overridden. r)PooledCredential STATUS_DEADSTATUS_EXHAUSTED_exhausted_until_parse_absolute_timestamprrr7r) rrbrrrrrrrg from_dictr_POOL_STATUS_FIELDSr@)r#rrrrrrr disk_status mem_access disk_accessdisk_tsmem_tsuntil merged_entry status_fields rB_merge_disk_cooldown_stater9s" j$ ' ' #              !nn]33 {,<= = =L YY~..4"  nn^44:  + * *C*CL++JNN;K,L,LMMTQT**5995E+F+FGGN3 f  L * * *$$ **; CCE} 4 4 E{{ / F FL)3 )E)EL & &  s**D99D9>AD9?D92D99 EE) removed_idsentriesList[Dict[str, Any]]rOptional[Iterable[str]]c d|pdD}t5t}|d}t|tsi}||d<fd|D}|}t|t r|ng}d|D d|D} fd|D} |D][} t| ts| d} | r| | vs| |vr8| t| \| |<t|cd d d S#1swxYwYd S) aPersist one provider's credential pool under auth.json. This is the final disk-boundary guard for borrowed/reference-only credentials. Callers may pass raw dictionaries, so sanitize here even when ``PooledCredential.to_dict()`` already did the same work upstream. Re-read the on-disk pool under the same lock and merge entries present on disk but missing from ``entries``. Those were added by another process after the caller loaded its in-memory snapshot; without this merge a later rotation/exhaustion rewrite drops the concurrent credential. For entries present on BOTH sides, status fields are merged by ``last_status_at`` recency via ``_merge_disk_cooldown_state`` so a stale snapshot cannot erase a cooldown/quarantine another process just wrote. Pass ``removed_ids`` for entries the caller intentionally removed, so the merge does not resurrect them from the on-disk copy. ch|]}||SrYrY)rrids rB z(write_credential_pool..s999sS9s999rcrYr$c^g|])}t|trt|n|*SrY)rrbr)rr#rs rB z)write_credential_pool..sM   %&& 2 0 D D D,1   rcci|]B}t|t|d,|d|CSrOrrbrgrr#s rBrOz)write_credential_pool..sX   %&& ,199T?? IIdOOU   rcch|]A}t|t|d,|dBSrrrs rBrz(write_credential_pool..sV   %&& ,199T?? IIdOO   rcc g|]P}t|tr7t||dn|QSr)rrbrrg)rr#existing_by_idrs rBrz)write_credential_pool..sp( ( ( %&&  &~))%))D//::K    ( ( ( rcrON) rlrergrrbr|appendrrn)rrrremovedrpr"sanitized_entriesr existing_listnew_idsrrdisk_idrs` @rBwrite_credential_poolrrs0:9{0b999G   ',',%'' ~~/00$%% 1D,0J( )    !    88K(($.x$>$>FB   &      *    ( ( ( ( ( + ( ( ( ( Y YJj$//  nnT**G g00Gw4F4F MM>z;WW X X X X"[ ++O',',',',',',',',',',',',',',',',',',sDEEErct5t}|di}||g}||vr||t |ddddS#1swxYwYdS)z@Mark a credential source as suppressed so it won't be re-seeded.suppressed_sourcesN)rlrerrrnrrrp suppressed provider_lists rBsuppress_credential_sourcers   %%%'' **+?DD "--k2>>  & &   ( ( ($$$ %%%%%%%%%%%%%%%%%%sA#A??BBc t}|di}|||gvS#t$rYdSwxYw)z=Check if a credential source has been suppressed by the user.rF)rergr@)rrrprs rBis_source_suppressedrsa%'' ^^$8"==  R8888 uus;> A  A ct5t}|d}t|ts ddddS||}t|t r||vr ddddS|||s||d|s|ddt| ddddS#1swxYwYdS)zClear a suppression marker so the source will be re-seeded on the next load. Returns True if a marker was cleared, False if no marker existed. rNFT) rlrergrrbr|removepoprnrs rBunsuppress_credential_sourcers   %'' ^^$899 *d++   #{33 -.. & 2M2M V$$$ . NN; - - - 7 NN/ 6 6 6$$$s:C4/C4AC44C8;C8c>t}t||S)uReturn persisted auth state for a provider, or None. In profile mode, ``_load_provider_state`` already falls back to the global-root ``auth.json`` per-provider when the profile has no entry — so this is now a thin convenience wrapper. Profile state always wins when present. Writes (``_save_auth_store`` / ``persist_*_credentials``) are unchanged — they still target the profile only. This mirrors ``read_credential_pool``'s per-provider shadowing semantics so that ``_seed_from_singletons`` can reseed a profile's credential pool from global-scope provider state (e.g. a globally-authenticated Anthropic OAuth or Nous device-code session). See issue #18594 follow-up. )rerfrms rBget_provider_auth_staters"##J  K 8 88rccHt}|dS)z8Return the currently active provider ID from auth store.r')rergrps rBget_active_providerrs !##J >>+ , ,,rcc|pd t}|dpd}|r|krdSn#t$rYnwxYw ddlm}|}|d}t|trC|dpd}|krdSfd}|d }t|tr|d pgD]} || rdS||d rdS|d } t| trw| D]b} t| ts| d pgD]} || rdS|| d rdScn#t$rYnwxYwd h} t} | ddl m }|} | r?| j dkr4| jD],}|| vrtt!j|drdS- t%D]}t|tst'|dpd}|sc|drj|ddddd}|r%tt!j|drdS|dvs|drdSn#t$rYnwxYwdS)aReturn True only if the user has explicitly configured this provider. Checks: 1. active_provider in auth.json matches 2. model.provider in config.yaml matches 3. Provider-specific env vars are set (e.g. ANTHROPIC_API_KEY) This is used to gate auto-discovery of external credentials (e.g. Claude Code's ~/.claude/.credentials.json) so they are never used without the user's explicit choice. See PR #4210 for the same pattern applied to the setup wizard gate. r7r'Tr load_configr6r~ct|to>|dpdkS)Nr~r7)rrbrgrGr>)slotrrs rB_slot_matches_providerzAis_provider_explicitly_configured.._slot_matches_provider sL4&&OXXj))/R6688>>@@JN rcrwreference_models aggregatorpresetsrN) get_providerrhrzenv::r">manualr% hermes_pkce loopback_pkcemanual:F)rGr>rergr@rrrrbvaluesrhermes_cli.providersrrQr[rrrrr3rsplit)rrpactivercfg model_cfg cfg_providerrmoa_cfgrrpreset_IMPLICIT_ENV_VARSr rr r#rrrs @rB!is_provider_explicitly_configuredrs#**,,2244J %'' ..!2339r@@BBHHJJ  f **4      ( 111111kmmGGG$$ i & & %MM*55;BBDDJJLLLz))t      ''%.. gt $ $ $ $677=2  ))$// 44 %%gkk,&?&?@@ tkk),,G'4(( $%nn..$$F%fd33! & += > > D"((11$77(#'444(--fjj.F.FGG$#tt$      44##J//G555555,z**7$ 11/  G,,, 7B!7!788 tt  )*55  EeT** 8,,23399;;AACCF   ((  ))Hb1177Q??BHHJJ 07B1G1GHH 44SSS$$Y//TttT &       5sdAA?? B  B A;H& AH&#H&A>V G >>+ , , 6 6,0J( )G ;%%%%%%%%< $$$=%%%%%%%%%%%%%%%> 4s)DBD,DD D ct5t}d|d<t|ddddS#1swxYwYdS)z Clear active_provider in auth.json without deleting credentials. Used when the user switches to a non-OAuth provider (OpenRouter, custom) so auto-resolution doesn't keep picking the OAuth provider. Nr')rlrernrs rBdeactivate_providerrs   %%%'' (, $%$$$%%%%%%%%%%%%%%%%%%s#?AA provider_namecj ddlm}|}|sdSdg}|D]s}|jdkrdnd}|d|d |j|jr|jdnd}|r|d |td |S#t$rYdSwxYw) zReturn a helpful hint string when provider resolution fails. Checks for common config.yaml mistakes (malformed custom_providers, etc.) and returns a human-readable diagnostic, or empty string if nothing found. r)validate_config_structurer7uCConfig issue detected — run 'hermes doctor' for full diagnostics:rERRORWARNINGz [z] u → r4) rrseverityrrhint splitlinesjoinr@)rrissueslinesciprefix first_hints rB%_get_config_hint_for_unknown_providerrs ??????**,, 2VW 6 6B " w 6 6WWIF LL5v5555 6 6 646GC++--a00J 6 4 44555yy rrsB$B B$$ B21B2)explicit_api_keyexplicit_base_url requestedrrc  |pd}iddddddddddd dd dd d d d dd ddddddddddddddiddddddddddddd d!d"d!d#d$d%d$d&d$d'd(d)d(d*d+d,d+d-d+d.d/id0d/d1d/d2d3d4d3d5d6d7d6d8d6d9d6d:d;dd?d>d@d>dAdBdCdBdDdEdFdEidEdEdGdHdIdHdJdHdKdLdMdLdNdOdPdOdQdOdRdOdSdTdUdTdVdTdWdTdXdYdZdYd[d\d\d\d]d]d]d^d_d^d^d^d^d` } dadblm}|D]}|jD]}||vr |j||<n#t $rYnwxYw|||}|dckrdcS|d^krd^S|tvr|S|dkr6t|}dd|de} |r | df|z } n| dgz } t| dhi|s|rdcSdj} dadkl m } | pidl} t| tr}| dm} t| trS| tvr&| Sn2#t $r%} t dn| Ydj} ~ ndj} ~ wwxYwt%t'jdos!t%t'jdprdcS dadqlm}|dcrdcSn2#t $r%} t dr| Ydj} ~ ndj} ~ wwxYwdj} t1}|ds}|r-|tvr$t3|dtr|}n2#t $r%} t du| Ydj} ~ ndj} ~ wwxYwtD]n\}}|jdvkr|dwvr|jD]P}t%t'j|dxr,|r$||krt dy|||||ccSQo|rIt| tr2| r0| dmst dz||S dad{lm}|rdTSn#t@$rYnwxYwtd|d}i)~uX Determine which inference provider to use. Priority (when requested="auto" or None) — explicit user intent wins over a stale logged-in OAuth provider (#29285): 1. Explicit CLI api_key/base_url -> "openrouter" 2. config.yaml `model.provider` 3. OPENAI_API_KEY / OPENROUTER_API_KEY env vars -> "openrouter" 4. OpenRouter credential pool 5. Provider-specific API keys (GLM, Kimi, MiniMax, ...) -> that provider 6. auth.json `active_provider` (logged-in OAuth) — last-resort fallback 7. AWS Bedrock credential chain 8. Error (no provider configured) rxglmr|zz-aizz.aizhipugooglerxz google-geminizgoogle-ai-studiozx-airx.aigrokrkz x-ai-oauthz grok-oauthzxai-grok-oauthkimirzkimi-for-codingmoonshotzkimi-cnrz moonshot-cnsteprzstepfun-coding-planzarcee-airarceeaiz gmi-cloudrgmicloudzactual-computerractualcomputeraciz minimax-chinar minimax_cnzminimax-portalrzminimax-global minimax_oauthalibaba_codingrzalibaba-codingalibaba_coding_planclauderz claude-codegithubrpzgithub-copilotz github-modelsz github-modelzgithub-copilot-acpruzcopilot-acp-agent aigatewayrvercelzvercel-ai-gatewayopencoderzenz qwen-portalrlqwen-clihfrz hugging-facezhuggingface-hubmimorz xiaomi-mimotencentrtokenhubz tencent-cloud tencentmaasawsrz aws-bedrockzamazon-bedrockamazongorzopencode-go-subkilorrmrr) z kilo-codez kilo-gatewayrmz lm-studio lm_studioollama ollama_cloudvllmllamacppz llama.cppz llama-cpprrrzUnknown provider 'z'.z z` Check 'hermes model' for available providers, or run 'hermes doctor' to diagnose config issues.invalid_provider)rNrr6r~zACould not read config.yaml model.provider for auto-resolution: %sriOPENROUTER_API_KEYrz.Could not check OpenRouter credential pool: %sr' logged_inz+Could not pre-read active auth provider: %srh>rprmr7zProvider resolved to %r via %s, preempting your logged-in OAuth provider %r. If you meant to use the OAuth login, unset %s or set `model.provider` explicitly.zProvider resolved to logged-in OAuth provider %r because config.yaml `model` has no `provider` key. If you meant a different provider, set `model.provider` explicitly.has_aws_credentialszNo inference provider configured. Run 'hermes model' to choose a provider and model, or set an API key (OPENROUTER_API_KEY, OPENAI_API_KEY, etc.) in ~/.hermes/.env.no_provider_configured)!rGr>r raliasesrPr@rgrrr|rrrrbr3rrArrrrrrreget_auth_statusrUrQr[ragent.bedrock_adapterr$ ImportError)rrrrr_PROVIDER_ALIASES_lp_pp_alias _config_hintmsg _model_cfgr _cfg_providere _load_pool _oauth_active_store_maybepidr r r$s rBryrys(%v,,..4466J# u#e#%+U#4;U#(#+X#7I8# #u#'-e# [ ##/ # k # $4[ #  # 1- # BL] ## ##&34D#  #1)# G#'# U#'# 8#&6x#BG# #(4\# /#,<_#O^_n# /###2BCX# 4# +!# -k!#" )##".y##$ %#$%3I%#& m'#&.A-'#( \)#($,\)#(+#, |-#,&0-###,@L\-#. m/#.,]/#.=N}/#0 1#0(1#2 %3#2(23E3#4 +5#4.;>J\!!|Xx&&&VB6I66 J%J  J%-#L ML==MAN O %OO !R44 SSOptional[float]clt|tr|sdS|}|sdS|dr |dddz} t j|}n#t $rYdSwxYw|j |tj }| S)NZ+00:00tzinfo) rr3rGrr fromisoformatr@r>replacerr8 timestamp)rtextrKs rB_parse_iso_timestamprCs eS ! !t ;;==D t }}S$CRCy8#'-- tt }x|44     sA** A87A8expires_at_iso skew_secondsc\t|}|dS|tj|zkS)NT)rCr)rDrE expires_epochs rB _is_expiringrHs0(88Mt TY[[<7 88rc expires_inch t|}n#t$rd}YnwxYwtd|S)Nr)rr@r)rIttls rB_coerce_ttl_secondsrLsF*oo  q#;;  !!ct|tsdS|d}|r|ndS)NrE)rr3rGr?)rrs rB_optional_base_urlrOsC eS ! !tkkmm""3''G '774'rczapi.nousresearch.comzFrozenSet[str]_NOUS_STALE_PORTAL_HOSTS>portal.nousresearch.comr:r<_NOUS_PORTAL_ALLOWED_HOSTSr cL|d}t|tsdS|dpd}|rJt |}|jt vr/td|tt|d<dSdSdS)NrdrRr7z3auth: migrating stale nous portal_base_url %s -> %s) rgrrbrGrr=rPrrDEFAULT_NOUS_PORTAL_URL)r rdstoredrKs rBr-r-s == D dD ! !hh())/R 6 6 8 8F >&!! ?6 6 6 NNE/   '>D" # # #>> 6 6rczinference-api.nousresearch.com_ALLOWED_NOUS_INFERENCE_HOSTSrJct|tsdS|}|sdS t|}n#t$rYdSwxYw|jdkr"t d|jdS|jtvr"t d|jdS| dS)uValidate a Portal-returned inference URL against the host allowlist. Returns ``url`` (normalised by stripping trailing slashes) if it's a well-formed ``https:///...`` URL. Returns ``None`` if the URL is missing, malformed, non-https, or points at an unexpected host — letting the caller fall back to the configured default rather than persist or forward a poisoned value. Defense-in-depth: a compromised refresh response from the Portal API (MITM, malicious response injection) could otherwise redirect every subsequent proxy request — bearing the user's inference JWT — to an attacker-controlled endpoint. Validating scheme + host at the source closes that loop before the poisoned URL ever lands in ``auth.json``. The env-var override path (``NOUS_INFERENCE_BASE_URL``) bypasses this — env values come from the trusted OS user, not from the network, and the override is documented for staging/dev use. Co-authored-by: memosr NhttpszEnous: refusing non-https inference URL scheme %r from Portal responsezenous: refusing inference URL host %r from Portal response (not in allowlist); falling back to defaultrE) rr3rGrr@schemerrr=rVr?)rJrrKs rB)_validate_nous_inference_url_from_networkrZs, c3  tiikkG t'"" tt } S M   t ;;; : O   t >>#  sA AAcDttjdS)uReturn the user-set ``NOUS_INFERENCE_BASE_URL`` override, if any. This is the documented dev/staging escape hatch. The env source is trusted (the OS user set it themselves), so it is intentionally NOT gated by the network host allowlist — unlike Portal-returned URLs. Returns a trailing-slash-stripped non-empty string, or ``None`` when the env var is unset/blank. NOUS_INFERENCE_BASE_URLrOrrrYrcrB_nous_inference_env_overrider^ s bi(ABB C CCrcclttjdptjdS)uReturn the user/deployment-set Portal base URL override, if any. Mirrors ``_nous_inference_env_override()``: ``HERMES_PORTAL_BASE_URL`` / ``NOUS_PORTAL_BASE_URL`` are the documented dev/staging escape hatch for pointing Hermes at a non-production Nous Portal (e.g. a hosted agent provisioned on nous-account-service's `staging` environment, which stamps ``HERMES_PORTAL_BASE_URL=https://portal.staging-nousresearch.com`` into the container env). The env source is trusted (the OS user/deployment set it themselves), so — like the inference override — it must NOT be gated by ``_NOUS_PORTAL_ALLOWED_HOSTS``: that allowlist exists to reject an untrusted NETWORK-provided value (a poisoned portal_base_url persisted to auth.json), not a value the operator explicitly configured. Returns a trailing-slash-stripped non-empty string, or ``None`` when neither env var is set/blank. HERMES_PORTAL_BASE_URLNOUS_PORTAL_BASE_URLr]rYrcrB_nous_portal_env_overriderb s4"  *++Pry9O/P/P  rcct|tr|ddkriS|dd}|ddt |dzz dzzz } t j|d}tj | d}n#t$ricYSwxYwt|tr|niS)Nr8r2r"=rr) rr3countrrbase64urlsafe_b64decoderjr;r)decoder@rb)rrrclaimss rB_decode_jwt_claimsrj0 s eS ! !U[[%5%5%:%: kk#q!G sq3w<'>??CJJw//00  -- 56625s+AB:: C C  raw_scopeset[str]ct}t|trW|ddD]-}|}|r||.ndt|ttttfr<|D]9}t|tr"| t|:|S)N,r-) setrr3r@rrGaddr|rZ frozensetr _scope_values)rkscopespartritems rBrrrr= suuF)S!!3%%c3//5577 $ $DjjllG $ 7### $ IeS)< = =3 3 3D$$$ 3 mD11222 MrcrU expires_atmin_ttl_secondsrUrwrxct|}|sdSt|t|dzt|dz}t|vrdS|d}t dt |}t |t tfr+t|tj|zkrdSdSt||rd SdS) zDReturn None when the token can be used for inference, else a reason.access_token_not_jwtrUscpmissing_inference_invoke_scopeexprinvoke_jwt_expiringN%invoke_jwt_expiry_unknown_or_expiring) rjrrrgNOUS_INFERENCE_INVOKE_SCOPErrrr+rrH)rrUrwrxrirsr}skews rB_nous_invoke_jwt_statusrM s  & &F &%%e  7++ , , -  5)) * * + #&00// **U  C q#o&& ' 'D#U|$$ ::$)++, - -((tJ%%766 4rcc,t||||duS)Nrv)r)rrUrwrxs rB_nous_invoke_jwt_is_usablerj s1 !+      rcrrc||dn|}t||d|d}|dStd|dd|d ) NrrUrwrUrw8Nous Portal access token is not a usable inference JWT (z-). Re-authenticate with: hermes auth add nousrdTr})rgrr|)rqrrreasons rB!_assert_nous_inference_jwt_usabler| s *6)=EIIn % % %B B B) obtained_atrc |d}t|tr|sdSt jt j}|d}|r|}nY|d|kr,t|tr|r|}n|}t||d}t|}|1tdt|tj z n!t|d}|r ||d<||d<||d<d|d<||d<||d <d |d <||d<dS) Nragent_key_obtained_at agent_keyrwrrI agent_key_idagent_key_expires_atagent_key_expires_inFagent_key_reused)rgrr3rGrr7rr8r9rrCrrrrL) rqrrr7existing_obtained_ateffective_obtained_atrwrGrIs rB#_set_nous_agent_key_from_invoke_jwtr s 99^,,L lC ( ( 0B0B0D0D ,x| $ $C 99%<== 0 + +,.. +S 1 1 / & & ( ( /!5 # %lEIIl4K4KLLJ(44M  $ As=49;;.//000 d|DS)Nc,i|]\}}|tv||SrY)"_NOUS_EFFECTIVE_STATE_IGNORED_KEYS)rr$rs rBrOz2_nous_effective_provider_state.. s4    C 8 8 8 U 8 8 8rc)rUrqs rB_nous_effective_provider_stater s+  ++--   rcc t|}|d}t|ttfsdSt |t jt dt|zkS)Nr}Fr)rjrgrrr+rr)rrErir}s rB_codex_access_token_is_expiringr si  - -F **U  C cC< ( (u ::$)++Asrr3r?r@rArrBrCrDrEr;rrFrGr rrrJr)rrrLrMfhs rB_save_qwen_cli_tokensr s#%%I 4$777i   ""in#[#[29;;#[#[IY#[#[\\H  H  bj 29, t|#  B  Yr3 1 1 1 "R HHTZqDAAADH I I I HHJJJ HRYY[[ ! ! ! " " " " " " " " " " " " " " " x+++    "!!!    D     "!!!! "    D  sg"G9A(E-! G-E11G4E15G (F22 F?>F?G>(G.,G>. G;8G>:G;;G>expiry_date_msc t|}n#t$rYdSwxYwtjtdt|zdz|kS)NTr)rr@rr)rrE expiry_mss rB_qwen_access_token_is_expiringr4 se'' tt IKK#a\!2!233 3t ;y HHs   4@c t|ddpd}|stddd t jt ddd d|td | }n(#t$r}td |dd |d}~wwxYw|j dkr5|j }td|rd|ndzdd  | }n(#t$r}td|dd|d}~wwxYwt|tr7t|ddpdstddd|d} t|}n#t$rd}YnwxYwt|ddpdt|d|p|t|d|ddpdpdt|d|ddpdttjdzt!d|dzzd} t#| | S)N refresh_tokenr7z@Qwen OAuth refresh token missing. Re-run 'qwen auth qwen-oauth'.rlqwen_refresh_token_missingr!application/x-www-form-urlencodedr/r1Accept grant_typerrTr:rr*zQwen OAuth refresh failed: qwen_refresh_failedz9Qwen OAuth refresh failed. Re-run 'qwen auth qwen-oauth'. Response: z*Qwen OAuth refresh returned invalid JSON: qwen_refresh_invalid_jsonrz1Qwen OAuth refresh response missing access_token.qwen_refresh_invalid_responserIi`T token_typeBearer resource_urlzportal.qwen.airr")rrrr expiry_date)r3rgrGr|r>r?QWEN_OAUTH_TOKEN_URLQWEN_OAUTH_CLIENT_IDr@r@rBr;rrbrrrr) rrrresponserbodyrrIexpires_in_seconds refresheds rB_refresh_qwen_cli_tokensr< s ?B77=2>>DDFFM   N!-    : C, .!.1 $      /# / /!&     s""}""$$ G'+3#T### 5!&     --//  > > >!,      gt $ $ C NB0O0O0USU,V,V,\,\,^,^  ?!0    \**J) __ )))()GKK;;ArBBHHJJW[[-HHYMZZ``bb'++lFJJ|X4V4VWWc[cddjjllxpxGKK >Sc8d8deeyiyzzAACC49;;-..Q8J1K1Kd1RR I)$$$ sB )A77 BBB C55 D?DDF!! F0/F0credsct5t}i}|drt|d|d<t |d|t |ddddS#1swxYwYdS)aSet active_provider to qwen-oauth in auth.json. Qwen OAuth tokens live in the Qwen CLI credential file managed by _save_qwen_cli_tokens / resolve_qwen_runtime_credentials. This function only writes a minimal provider-state entry (base_url for display) and sets active_provider so that get_active_provider() and _model_section_has_credentials() detect the provider for the setup wizard and status commands. r2rlN)rlrergr3rern)rrprqs rB_mark_qwen_oauth_activer s   %%%'' " 99Z  7 #E*$5 6 6E* Zu===$$$ %%%%%%%%%%%%%%%%%%sAA::A>A>) force_refreshrefresh_if_expiringrefresh_skew_secondsrrrc t}t|ddpd}t |}|s%|r#t |d|}|rFt |}t|ddpd}|stdddtj dd d pt}d||d |dttd S) Nrr7rz?Qwen OAuth access token missing. Re-run 'qwen auth qwen-oauth'.rlqwen_access_token_missingrHERMES_QWEN_BASE_URLrEr)r~r2rhr expires_at_msr) rr3rgrGr5rrr|rrr?DEFAULT_QWEN_BASE_URLr)rrrrrshould_refreshr2s rB resolve_qwen_runtime_credentialsr sP # $ $Fvzz."55;<<BBDDL-((N i1i7 =8Q8QSghhI)&116::nb99?R@@FFHH   M!,    y/44::<<CCCHHaLaH M22,..//   rccJt} td}dt||d|d|ddS#t$r*}dt|t|dcYd}~Sd}~wwxYw) NT)rrrhr)r"rrrhrF)r"rr)rrr3rgr|)rrrs rBget_qwen_auth_statusr s#%%I 1TJJJYii))yy++"YY77        YXX         sAA.. B"8BB"B" List[str]c|pt}d|D}t}g}|D]0}||vr*||||1|S)Ncg|]}||SrYrY)rrts rBrz'_spotify_scope_list.. s : : :tT :d : : :rc)DEFAULT_SPOTIFY_SCOPErGrrorpr)rk scope_textrsseenorderedrUs rB_spotify_scope_listr s44;;==J : :z//11 : : :FUUDG""    HHUOOO NN5 ! ! ! NrccFdt|S)Nr-)rr)rks rB_spotify_scope_stringr s 88' 22 3 33rcexplicitcddlm}||d|dt|tr|dndf}|D]+}t |pd}|r|cS,tddd ) Nr get_env_valueHERMES_SPOTIFY_CLIENT_IDSPOTIFY_CLIENT_IDrTr7zPSpotify client_id is required. Set HERMES_SPOTIFY_CLIENT_ID or pass --client-id.r.spotify_client_id_missingr)rrrrbrgr3rGr|rrqr candidates candidaters rB_spotify_client_idr s0/////  011 )**",UD"9"9C +t J   io2&&,,..  NNN  Z (   rccddlm}||d|dt|tr|dndt f}|D]+}t |pd}|r|cS,t S)NrrHERMES_SPOTIFY_REDIRECT_URISPOTIFY_REDIRECT_URI redirect_urir7)rrrrbrgDEFAULT_SPOTIFY_REDIRECT_URIr3rGrs rB_spotify_redirect_urir s0/////  344 ,--%/t%<%<F .!!!$$ J  io2&&,,..  NNN  ''rccddlm}|dt|tr|dndt f}|D]>}t |pdd}|r|cS?t S)NrrHERMES_SPOTIFY_API_BASE_URL api_base_urlr7rE) rrrrbrgDEFAULT_SPOTIFY_API_BASE_URLr3rGr?rqrrrrs rB_spotify_api_base_urlr s//////  344%/t%<%<F .!!!$$J   io2&&,,..55c::  NNN  ''rccddlm}|dt|tr|dndt f}|D]>}t |pdd}|r|cS?t S)Nrr HERMES_SPOTIFY_ACCOUNTS_BASE_URLaccounts_base_urlr7rE) rrrrbrg!DEFAULT_SPOTIFY_ACCOUNTS_BASE_URLr3rGr?rs rB_spotify_accounts_base_urlr  s//////  899*4UD*A*AK %&&&t)J   io2&&,,..55c::  NNN  ,,rc@lengthctjtj|d}|dddSNasciirdrfurlsafe_b64encoderurandomrhr?rrs rB_spotify_code_verifierr+ C  "2:f#5#5 6 6 = =g F FC ::c??4C4  rc code_verifierctj|d}t j|ddSNrrrdrhrirjdigestrfrrhr?rrs rB_spotify_code_challenger0 X ^M0099 : : A A C CF  #F + + 2 27 ; ; B B3 G GGrcctjtj|d}|dddSrrrs rB_oauth_pkce_code_verifierr"5 rrcctj|d}t j|ddSrrrs rB_oauth_pkce_code_challenger$: r rcrTrcode_challenger c >t|d|||d|d}|d|S)NrS256)rT response_typerrUrqcode_challenge_methodr%z /authorize?)r)rTrrUrqr%r querys rB_spotify_build_authorize_urlr+? sH $!'(  E 3 3E 3 33rctuple[str, int, str]ct|}|jdkrtddd|jpd}|dvrtddd|jstd dd||j|jpd fS) NhttpzHSpotify PKCE redirect_uri must use http://localhost or http://127.0.0.1.r.spotify_redirect_invalidrr7>r:r<z?Spotify PKCE redirect_uri must point to localhost or 127.0.0.1.zBSpotify PKCE redirect_uri must include an explicit localhost port.rE)rrYr|r=portrI)rrKrAs rB_spotify_validate_redirect_urir1T s l # #F } V+    ? bD --- M+    ;  P+    fk0S 00rc expected_path3tuple[type[BaseHTTPRequestHandler], dict[str, Any]]cHdddddGfddt}|fS)N)rrqrerror_descriptionc&eZdZd fd Zd dZd S) ?_make_spotify_callback_handler.._SpotifyCallbackHandlerr4rct|j}|jkrE|d||jddSt |j}|ddgdd<|ddgdd<|ddgdd<|ddgdd<|d| d d |drd }nd }|j| d dS)Ns Not found.rrrqrr5r<r1ztext/html; charset=utf-8zW

Spotify authorization failed.

You can close this tab.zY

Spotify authorization received.

You can close this tab.r) rrI send_response end_headerswfilerErr*rg send_headerrj)rrKparamsrr2rVs rBdo_GETzF_make_spotify_callback_handler.._SpotifyCallbackHandler.do_GETu sidi((F{m++""3'''  """   ///fl++F#ZZ77:F6N$jj4&99!._SpotifyCallbackHandler.log_message s FrcNr4r)r@r3rAr r4r)r]r^r_r?rC)r2rVsrB_SpotifyCallbackHandlerr7t sL 3 3 3 3 3 3 3.      rcrE)r )r2rErVs` @rB_make_spotify_callback_handlerrFl sc! F"86 #F **rcf@rdict[str, Any]c t|\}}}t|\}}Gddt} |||f|}n.#t$r!} t d|d|d| dd| d} ~ wwxYwt j|jd d id } | tj td |z} tj | kr{|ds|dr@|| | | dStjd tj | k{| | | dnC#| | | dwxYwt ddd)NceZdZdZdS)4_spotify_wait_for_callback.._ReuseHTTPServerTN)r]r^r_allow_reuse_addressrYrcrB_ReuseHTTPServerrL s"rcrNz*Could not bind Spotify callback server on rrr.spotify_callback_bind_failedr poll_intervalg?T)rkwargsdaemon@rrrr*z?Spotify authorization timed out waiting for the local callback.spotify_callback_timeout)r1rFr rr|rThread serve_foreverstartrrrrX server_closerr) rrrAr0rI handler_clsrVrNserverrthreadrs rB_spotify_wait_for_callbackr] sD 6lCCD$8>>K#####:###!!4, <<  M M M M M M M/      V%9?TWBXae f f fF LLNNN~#c?";";;H!n))f~    C     JsOOOn))  C       C     I '   s*A A4A//A4(F5+FAG)previous_state token_payloadrequested_scoperr^cttjtj}t |dd}tj||ztj} t|pi} | |||||t|dp| t|ddpd pdt|ddpd t|d p| d pd | | |d d | S) NrIrrrUrrrr7r oauth_pkce) rTrr rrU granted_scoperrrrrwrIrQ) rr7rr8rLrgrrArbrr3rGr9) r_rTrr`r rr^r7rIrwrqs rB_spotify_token_payload_to_staterd s ,x| $ $C$]%6%6|Q%G%GHHJ' *(DVVVJ %2 & &E LL$.$ ]..w77J?KKQQSS-++L(CCOxPPVVXXd\dM--nbAAGRHHNNPP   o . . yy))    %''}} **,, !#& Lrcrc  tj|dddi|d|||d|}n(#t$r}td|dd |d}~wwxYw|jd kr5|j}td |rd |ndzdd |} t| tr7t| ddpdstddd | S)N /api/tokenr1rauthorization_code)rTrrrrrzSpotify token exchange failed: r.spotify_token_exchange_failedrrzSpotify token exchange failed.rr7rz7Spotify token response did not include an access_token.spotify_token_exchange_invalid) r>r?r@r|r@rBrGr;rrbr3rg) rTrrrr rrrdetailrs rB!_spotify_exchange_code_for_tokensrk su: , , ,#%HI&2 ,!. $      3c 3 30     s""$$&& ,)/7%V%%%R 90     mmooG gt $ $ C NB0O0O0USU,V,V,\,\,^,^  E1    Ns#& A AA c t|ddpd}|stddddt |}t |} t j|d d d id||d | }n(#t$r}td|dd|d}~wwxYw|j dkr6|j }td|rd|ndzddd| }t|tr7t|ddpdstddddt||t|t|dpt |t#||S)Nrr7z?Spotify refresh token missing. Run `hermes auth spotify` again.r.spotify_refresh_token_missingTr}rrfr1rrrzSpotify token refresh failed: spotify_refresh_failedrrz>Spotify token refresh failed. Run `hermes auth spotify` again.rrz9Spotify refresh response did not include an access_token.spotify_refresh_invalidrU)rTrr`r rr^)r3rgrGr|rr r>r?r@r@rBr;rrbrdrrr) rqrrrTr rrrjrs rB_refresh_spotify_oauth_staterp sB  /266<"==CCEEM   M0!     #///I2599: , , ,#%HI-!.& $      2S 2 2)     s""$$&& L)/7%V%%%R 9)!     mmooG gt $ $ C NB0O0O0USU,V,V,\,\,^,^  G*!      +*777EIIg..G2GHH+*511   s-!B B4B//B4ct5t}t|d}|stddddt |}|s%|r#t |d|}|r! t|}t|d|dt|n#t$r}|j r|d rd D]}| |dd|j pd t|d dtjt jd |d< t|d|dt|n2#t&$r%}t(d|Yd}~nd}~wwxYwd}~wwxYwdddn #1swxYwYt|ddpd} | stddddd| | t|ddpdt/|t|dp|dpdt1|t3||dt|d dpdd S)Nr.z>Spotify is not authenticated. Run `hermes auth spotify` first.spotify_auth_missingTr}rwFrcrrrrwrIrrefresh_failedruntime_refresh_failurer~rrrratlast_auth_errorz6Spotify OAuth: failed to persist quarantined state: %srr7z>Spotify access token missing. Run `hermes auth spotify` again.spotify_access_token_missingrrrcrUr) r~rrhrr2rUrTrrwr)rlrerfr|r5rHrgrprmrnrrrr3rr7rr8r9r@rrArGrrr) rrrrprqrr_k _save_excrs rB#resolve_spotify_runtime_credentialsr|L s   ''%'' $Z;; P"+!%  m,, Y"5 Y)%))L*A*ACWXXN   4U;;%j)UuUUUU ,,,,   'jEIIo,F,Fjk,, "d++++$- # <,<#&s88";,0&l8<88BBDD 00E+,j-j)UW\]]]](4444$jjj %]_hiiiiiiiij) ''''''''''''''''Ruyy44:;;AACCL   L/!     $%))L(;;GxHH)%00UYY//K599W3E3EKLLRRTT'e444-E:::ii --UYY;;ArBBHHJJ   saA-F)=1B/.F)/ F9BF?"E"!F" F,F F FFFF))F-0F-c td}|sddiS|d}t|ddpd}t |pt |d |dd |d |d |d p|d ||dt |dS)Nr.r"Frwrr7rrQrbrTrrcrUr)r"rQrTrrUrwrhas_refresh_token)rrgr3rGr5rH)rqrwrs rBget_spotify_auth_statusr s #I . .E $U##<((J /266<"==CCEEM-J|J/J/J+JKKYY{L99YY{++ .11?++Auyy/A/A  .11!-00   rcredirect_uri_hintcddlm}ttdtdtdttdtdtdttdtttd td td td td tdtd|tdtdtdtdtt s+ t jtn#t$rYnwxYw td }n2#ttf$rttdwxYw|s5ttdtdtd|d||r|tkr |d|ttdt|S)zWalk the user through creating a Spotify developer app, persist the resulting client_id to ~/.hermes/.env, and return it. Raises SystemExit if the user aborts or submits an empty value. r)save_env_valuezF======================================================================zSpotify first-time setupz=Spotify requires every user to register their own lightweightz>developer app. This takes about two minutes and only has to bezdone once per machine.z Full guide: zSteps:z 1. Opening z in your browser...z$ 2. Click 'Create app' and fill in:z1 App name: anything (e.g. hermes-agent)z Description: anythingz Redirect URI: z API/SDK: Web APIz$ 3. Agree to the terms, click Save.z9 4. Open the app's Settings page and copy the Client ID.z 5. Paste it below.zSpotify Client ID: zSpotify setup cancelled.zNo Client ID entered. See z for the full guide.z)Spotify setup cancelled: empty Client ID.rrz0Saved HERMES_SPOTIFY_CLIENT_ID to ~/.hermes/.env)rrprintSPOTIFY_DOCS_URLSPOTIFY_DASHBOARD_URL_is_remote_session webbrowserrr@inputrGEOFErrorKeyboardInterrupt SystemExitr)rrrs rB_spotify_interactive_setupr s 100000 GGG (OOO $%%% (OOO GGG IJJJ JKKK "### GGG +) + +,,, GGG (OOO D/ D D DEEE 0111 =>>> )*** 5"3 5 5666 ())) 0111 EFFF !!! GGG     O1 2 2 2 2    D 5)**0022 ' (555 34445 F  Q+;QQQRRRDEEEN-s333I.2NNN46GHHH GGG <=== GGG Js/F FF!F<r+rr_print_loopback_ssh_hintr_can_open_graphical_browserrrr@r]r+rrkr3rdrlrermrn)rAexisting_stateexplicit_client_idrTrrrUr r open_browserrr% state_nonce authorize_urlopenedcallbackrjr_ spotify_staterpsaved_tos rBlogin_spotify_commandr s,Y77=2N !{D99 &'9>JJ    3 # #'B B B .%dNDAAaEa    )~t)L)Ln]]L !'$">">"].BTBTU\B]B] ^ ^E2>BB(88Lt\5999L*,,M,];;N*,,"K0!%+ M *+++ # # #$$$ )< ) )*** UVVV GGG ./// - GGG 1/ 1 1222 GGG\4DEEEER.00R5P5R5RR _]33FF   FFF   R = > > > > P Q Q Q)gdIt<<EFFH||GD122Ghw6GB&BBCCC||G ++HIII5 f%%+ , ,!#+gdIt<<DEE M4!+! M   00%'' j)]uUUUU#J//000000000000000  %&&& %8 % %&&& :;;; '% ' '(((((s85 B> 44  5rc> www-browserw3mlynxlinksbrowshelinkslinks2_CONSOLE_BROWSER_NAMEScddl}dd}tjdd }|r ||rd Stjd rQttjd ptjd }|s|sd S |}n#t$rYd SwxYwt|dd pt|dd pd }|r ||rd SdS)uReturn True only when a *graphical* browser is likely to open. ``webbrowser.open()`` resolves to whatever the platform offers, and on a headless / CLI-only Linux box with no GUI browser installed that is often a text-mode browser (w3m/lynx/links) which launches inside the terminal and takes over the user's session. This guard distinguishes "a real windowed browser will pop up" from "a console browser will hijack the TTY", so callers can fall back to printing the URL instead. Heuristics: * Respect ``$BROWSER`` — if it names a known console browser, refuse. * On Linux, require a display server (``$DISPLAY`` / ``$WAYLAND_DISPLAY``) unless ``$BROWSER`` points at something graphical; no display server almost always means no GUI browser. * Ask ``webbrowser.get()`` what it resolved to and refuse when the underlying command is a known console browser. * macOS and Windows always have a usable default GUI browser. rNrr3r4r5c|r,|dnd}tj|}|t vS)Nrr7)rGrrrIbasenamer>r)rrbases rB_names_console_browserz;_can_open_graphical_browser.._names_console_browser s_,1KKMMA ##%%a((rw&&,,..---rcBROWSERr7FlinuxDISPLAYWAYLAND_DISPLAYrPrT)rr3r4r5) rrrrgsysplatformrr5r@r) _webbrowserr browser_env has_display controllerrs rBrrv sN&%$$$.... *..B//K--k::u |w'' JNN9 % % J8I)J)J   ; 5 __&& uu  FB''  :z2 . .   ++I66u 4s)B>> C  C c ddl}|pd}n#t$rd}YnwxYwtjdptjdpd}|d|S)zReturn best-effort 'user@hostname' for the SSH tunnel hint command. Falls back to placeholder tokens when the values cannot be determined so the hint is always syntactically valid even if not copy-pasteable. rNz USERLOGNAMEz@)socket gethostnamerrr)_socketr=r2s rB_ssh_user_at_hostr s !    &&((9M !!! ! 9V   @ ) 4 4 @D  X  s  ,,rr str | Nonec tsdS t|}n#t$rYdSwxYw|jpd}|j}|dvs|sdSd}t t |t dt |t d|t dt dt t d |d |d t t t d |rt d |t dtt |t dS)apPrint an SSH tunnel hint when running a loopback-redirect OAuth flow on a remote host. The auth server (Spotify, MCP servers, ...) will redirect the user's browser to ``127.0.0.1:/callback``. If the browser is on a different machine than the loopback listener (the usual SSH case), the redirect can't reach the listener without a local port forward. The hint is best-effort: silent if we don't think we're remote, or if we can't parse a host/port out of the redirect URI. Pass ``docs_url`` for a provider-specific guide; the generic OAuth-over-SSH guide is always shown after it. Nr7>r:r;r<z<------------------------------------------------------------u/Remote session detected — SSH tunnel requiredz,Hermes is waiting for the OAuth callback on z>+ , ,D dD ! !hh~&&G gt $ $ G+T22H+//??G4,,%&&  8$$ ] " "!%   + + + "&@EIIn55@""   "' !   ,n  3%2E/ "  1$0E. !#m"&#' %)!"&*"#'+#$$?,,rcr=c|Dtjtjdd}t 5t}t|dpi}t| dtr| dnd}||d<||d<d|d<|rEt| r$t| |d <t|d|t|||| t!|ddddS#1swxYwYdS) zCSave Codex OAuth tokens to Hermes auth store (~/.hermes/auth.json).Nr<r:rfrrchatgpt auth_moder=)r)rr7rr8r9r@rlrerfrrgrbr3rGrerrn)rrr=rprqrs rB_save_codex_tokensrs|HL11;;==EEhPSTT   %%%'' $Z@@FB > @ @ t KKEvNNNx   >>rcrc ~t|tr|stddddt jt dt|}t j|dtd 5}| td d id |td }dddn #1swxYwY|j dkrAtt|dd}|d|d}nd}t|dt d|j dkr d}d|j d}d} |} t| t$r| d} t| t$r| dp| d} t| tr(| r| }| d} t| tr+| rd| }nt| tr| r~| }| dp| d}t|tr+|rd|}n#t($rYnwxYw|d vrd} |d!krd"}d} |j d#vr| sd} t|d||  |}n&#t($r}td$dd%d|d}~wwxYw|d&}t|tr|std'dd(d||t+jt.jd)d*d+}|d }t|tr+|r||d <|S),z>Refresh Codex OAuth tokens without mutating Hermes auth state.rrfrTr}rSr/)r User-Agentr*r:r1rrrr:rNr:2Codex provider quota exhausted (429); retry after s. Credentials are still valid.fCodex provider quota exhausted (429). Credentials are still valid; retry after the usage limit resets.Fr<codex_refresh_failedz'Codex token refresh failed with status r8rrtyperzCodex token refresh failed: r5> invalid_grant invalid_tokeninvalid_requestrefresh_token_reusedzCodex refresh token was already consumed by another client (e.g. Codex CLI or VS Code extension). Run `codex` in your terminal to generate fresh tokens, then run `hermes auth` to re-authenticate.>z*Codex token refresh returned invalid JSON.codex_refresh_invalid_jsonrz6Codex token refresh response was missing access_token."codex_refresh_missing_access_tokenr<r:)rrr)rr3rGr|r>Timeoutrr+ClientCODEX_OAUTH_USER_AGENTr?CODEX_OAUTH_TOKEN_URLCODEX_OAUTH_CLIENT_IDr@rrrr;rbrgr@rr7rr8r9r@)rrrr*clientr retry_afterrrrerrerr_obj nested_code nested_msgerr_descrefresh_payloadrrefreshed_accessupdated next_refreshs rBrefresh_codex_oauth_purersM  mS ) ) 1D1D1F1F  X#3!     mCU?%;%;<<==G (0      ;; !#%HI-!.2                 "s"" 19d1S1STT  "/[/// G 6  #("     s""%SH:: & , , 4D4J4J4L4L  D#5!     )..00&,,.. X\22<<>>FFxQTUUG #&&77L,$$8););)=)=8#/#5#5#7#7 Ns= )CCC3F8K,, K98K9-M M% M  M%c  tt|ddpdt|ddpd|}nQ#t$rD}t |ddst dt |dd pd }|s|cYd }~Sd }~wwxYwt |}|d|d<|d|d<t||S) zzRefresh Codex access token using the refresh token. Saves the new tokens to Hermes auth store automatically. rr7rrHrFzrefresh_token rejected: rN auth_error)rr3rgr|rrrbr)rrrrrupdated_tokenss rB_refresh_codex_auth_tokensr 8s,  >2..4" 5 5  ?B//52 6 6+   s.66  1 SwsFD'A'A'Q\ S S    ),&\\N%.~%>N>"&/&@N?#~&&& sAA B)%9B$B)$B)ctjdd}|s#tt jdz }t |dz }|sdS tj | d}| d}t|tsdS| d }| d }|r|sdSt|d rtd |dSt|S#t"$rYdSwxYw) zTry to read tokens from ~/.codex/auth.json (Codex CLI shared file). Returns tokens dict if valid and not expired, None otherwise. Does NOT write to the shared file. CODEX_HOMEr7z.codexrNr!rrrrru7Codex CLI tokens at %s are expired — skipping import.)rrrGr3r r expanduseris_filer;r)r*rgrrbrrrAr@) codex_homerrrrrs rBrrds_ <,,2244J 1x/00 Z  ++-- ;I     t*Y00+0FFGGX&&&$'' 4zz.11  ?33  = 4 +< ; ;  LLI9   4F|| tts%AE.E +E9E EEc d} t}n#t$r}}|}t|ddr^t|dddvrKtt t|ddpd}|r||dd}nd}nd}Yd}~nd}~wwxYw|t }|rJtjd d  d pt}d ||d dddSt} | rjt | dpd  } | rt| | drtdt!t }|rJtjd d  d pt}d ||d dddS| d} t#| t$t&frA| t)jkr*t%| t)jz } d| d} nd} t| d t*d||tdd ddt-|d}t |dd pd  }t/dd}t1|}|s|rt3||}|rt5t7t't8|dz 5td!}t-|d}t |dd pd  }t1|}|s|rt3||}|rGt;||}t |dd pd  }dddn #1swxYwYtjd d  d pt}d ||d"|dddS)#uResolve runtime credentials from Hermes's own Codex token store. Falls back to the credential pool when the singleton (``providers.openai-codex.tokens``) has no usable access_token but the pool (``credential_pool.openai-codex``) does. This closes the divergence between the chat path (singleton-only via this function) and the auxiliary path (pool-first via ``_read_codex_access_token``). Without this fallback, a user whose tokens live only in the pool — for example after a manual pool seed, a partial re-auth, or pool-only restoration from a backup — gets a bare HTTP 401 ``Missing Authentication header`` from the wire instead of a usable credential. See issue #32992. NrFr>rrrrrrHERMES_CODEX_BASE_URLr7rErfr$rr~r2rhrrrrr2)r2uBCodex quota restored upstream — clearing stale pool cooldown(s).reset_atrrrr}rrTr$HERMES_CODEX_REFRESH_TIMEOUT_SECONDSrSrHrhermes-auth-store)rr|rrr3rg_pool_codex_access_tokenrrrGr?DEFAULT_CODEX_BASE_URL_codex_pool_rate_limit_status_probe_codex_quota_restoredrro clear_codex_pool_quota_cooldownsrrr+rrrbr r5rrlrAUTH_LOCK_TIMEOUT_SECONDSr )rrr read_errorrrr pool_tokenr2pool_rate_limit stale_tokenr remainingrrrrefresh_timeout_secondsrs rB!resolve_codex_runtime_credentialsr#sb"'+J!##     3*E 2 2 wsFD7Q7QV 8 8 6c'#vt:T:T:dXd6e6effH "*HLL>EEcJJ*)  +$%+ $&  899 .  o11.AAGRHHNNPPK :(,,Z88     X1222577   "92>>DDFFMMcRR21 %3$,#-"3(,%. '**:66H(S%L11 h6L6L49;; 677 3333 :',!&    !  M#%!     $x. ! !Fvzz."55;<<BBDDL'(NPRSS-((N ] 3]8G[\\ Q c%8Q2R2RTknqTq.r.r s s s Q Q%E222D$x.))Fvzz."==CDDJJLLL!-00N" e(; e!@Oc!d!d Q3F)rrrreason_l message_ls rB_is_codex_rate_limit_shapedr,s 6rr/r@r;rr+rr@rrA)rr2r0r cache_keyr7rrrVr:ri account_idrrrr% worst_usedr$useds rBrrFs6  " # # ) ) + +E t e $ $tu||G4455??AA#2#FI .  C ::)--i88  3?6J"J"J!9:::::::: 03Dk + :::::::::::::::"F .u..(%  $E**&**%BCCTJJ FJJ4b 9 9 = =>R S S S  j# & & ?:+;+;+=+= ?,6,<,<,>,>G( ) \$ ' ' ' U6zz"8"B"BGzTTH U U U U U U U U U U U U U U U  3 & &mmoo+G \228bJ*.J= E E"s++1r66~FFdS%L11E!$Z%63d !D!DJ%#e+  !S ( (F  /$ ??? !<>"344D2._parse_reset_ats9 =ERKK4 ec5\ * * PEllG!||t'.1B'B'B7V## O eS ! ! ++--C t **    "+25F+F+Fw''GS -ckk#x.H.HIISSUUU   tt ts$9B BB+9C%% C32C3Nr$rfrrr>rrr7rrr%r&r'r(r)rr=rr2)r=rrrrrr2z#Codex pool rate-limit lookup failedTr"rr r4r8) rlrergrrbr|rr3rGr>r@rrA) rCrpr"rr7r#rrrris_rate_limitedrs rBrrs0-K    , ,)++J , , , , , , , , , , , , , , ,~~/00$%% 4((>**'4(( 4ikk! ! EeT** IIn--EeS))  yy'';6699.//D#677=2>>DDFFF%))$899?R@@FFHHG &6)& F*&f$& 7* & !G+ & g% # &uyy1F'G'GHHH#C7++ % . 9 9$))$788 99%9:: % !IIj11   3! D KKK :T JJJJJK 4s9I"/ I"3I"3-I"&*I"GI""&J  J c t5t}dddn #1swxYwY|d}t|tsdS|d}t|t sdSdd }|D]D}||r7t |d dcSEn,#t$rt d d YnwxYwdS)aReturn the most-recent usable access_token from the openai-codex pool. Used as a fallback by ``resolve_codex_runtime_credentials`` when the singleton has no creds. Reads ``credential_pool.openai-codex`` entries directly from auth.json and picks the first non-empty access_token, preferring entries that are not currently in an exhaustion cooldown. Returns ``""`` when no usable entry is found (caller handles by raising the original AuthError). Nr$r7rfr#rWr4r5cHt|tsdS|d}t|tr|sdS|d}t|t t fr|tjkrdSdS)NFrrT)rrbrgr3rGrr+r)r#rrs rB _entry_usablez/_pool_codex_access_token.._entry_usable-seT** uIIn--EeS))  uyy!677H(S%L11 h6L6Lu4rcrz!Codex pool fallback lookup failedTr")r#rWr4r5) rlrergrrbr|r3rGr@rrA)rpr"rrHr#s rBrrs|I    , ,)++J , , , , , , , , , , , , , , ,~~/00$%% 2((>**'4(( 2     B BE}U## B599^R8899??AAAAA B B III 84 HHHHHI 2s?C+ C/C/-C"*CA CC&DDct|d}t|tr|dnd}t|trtt |ddpd}t |ddpd}|r|r|S|d}t|tr|dnd}t|t r|D] }t|tst |ddpd}t |ddpd}|r|st|pi}||t |dpd d |d<|d r|d |d <|d d |cSt|tr|ndS)zEReturn usable xAI OAuth state from provider state or credential pool.rkrNrr7rr$rr)rrrrrrb)rfrrbrgr3rGr|r) rprqrrrr$rr#rs rB_xai_oauth_state_from_storerJEs@ [ 9 9E$.ud$;$; EUYYx F&$6::nb99?R@@FFHH FJJ;;ArBBHHJJ  M L nn%677O ot , , K(((  '4    EeT** uyy<<BCCIIKKL /2 > > D"EEKKMMM } %+2&&F ,!.!%))L"9"9"EXFF  F8  yy(( C).>)B)B~&   k< 8 8 8MMMud++ 5555rcct|tr|dnd}t|tott |ddpdoCtt |ddpdS)Nrrr7r)rrbrgr5r3rG)rqrs rB"_xai_oauth_state_has_usable_tokensrLks$.ud$;$; EUYYx F64   E VZZ339r::@@BB C C E VZZ44:;;AACC D Drccx|r5t5t}dddn #1swxYwYnt}t|}t|s,tt }t|r|}|st dddd|d}t|tst ddddt|d d pd  }t|d d pd  }|st d dd d|st dddd||d|dpi|ddS)Nz`No xAI OAuth credentials stored. Select xAI Grok OAuth (SuperGrok / Premium+) in `hermes model`.rkxai_auth_missingTr}rzGxAI OAuth state is missing tokens. Re-authenticate with `hermes model`.xai_auth_invalid_shaperr7rzMxAI OAuth state is missing access_token. Re-authenticate with `hermes model`.xai_auth_missing_access_tokenzNxAI OAuth state is missing refresh_token. Re-authenticate with `hermes model`.xai_auth_missing_refresh_tokenr discoveryr)rrrRr) rlrerJrLrr|rgrrbr3rG)rrprqrUrrrs rB_read_xai_oauth_tokensrSts5 (    , ,)++J , , , , , , , , , , , , , , ,&'' ' 3 3E -e 4 4!23J3L3LMM -l ; ; ! E   n #!     YYx F fd # #  U )!     vzz."55;<<BBDDL ?B77=2>>DDFFM   [ 0!       \ 1!      .11YY{++1r .11   rc|d}t|to't|dtS)aTrue when this store has its OWN ``providers.xai-oauth`` block. Distinguishes a profile that genuinely shadows the root xAI grant from one that only *reads* root via ``_load_provider_state``'s fallback. Only the latter needs the refresh write-through below. r rk)rgrrb)rpr s rB _profile_has_own_xai_oauth_staterUsA{++I i & & W:immK6P6PRV+W+WWrcct}|dStjdrztjdd}|rXt |dz dz } |d|dkrdSn#t $rYdSwxYw td ||d dS#t $r&}t d |Yd}~dSd}~wwxYw) uPersist a rotated xAI OAuth ``state`` into the global-root auth.json. Best-effort write-through for the multi-profile rotation hazard (#43589): xAI rotates the refresh_token on every refresh, so when a profile session refreshes a grant it resolved from the root fallback, the rotated chain must land back in root. Otherwise root keeps a now-revoked refresh token and every other profile reading the stale root grant dies with ``invalid_grant`` once its access token expires. Only updates ``providers.xai-oauth`` in the root store; never touches the profile store (the caller already saved that). Swallows all errors — a failed write-through degrades to the pre-existing behavior (root stale), it must never break the profile's own successful save. Nrrr7rrFrrkrcz2xAI OAuth: write-through to global root failed: %s) rrrrgr rr@rgrrA)rqrrrrs rB'_write_through_xai_oauth_to_global_rootrWsF)**K  z~~+,, vr22  ]++i7+EI &&e&44 8I8IQV8I8W8WWWFX    P(          PPP I3OOOOOOOOOPs**.B B)(B)-C C2 C--C2rRrrrrdrRrc2|Dtjtjdd}t 5t}t|d\}}|i}||d<||d<||d<|r||d<|r||d <t} t|duo| duot|| } | rt|n"t|d|| t|ddddS#1swxYwYdS) uoPersist xAI OAuth tokens into the auth store. When *set_active* is True (default), also promote ``xai-oauth`` to ``active_provider`` — appropriate for intentional model/auth login. Pass ``set_active=False`` for side-tool credential bootstrap (TTS/setup, tools config, dashboard token save, token refresh) so inference routing is unchanged. Nr<r:rkrrrrRrrc)rr7rr8r9r@rlrerVrr5rrWrmrn) rrRrrrrdrprqrXr is_from_roots rB_save_xai_oauth_tokensr[s"|HL11;;==EEhPSTT   ))))%'' >    { =E h ,n&k  +!*E+   1$0E. !,..  t # 54' 5; 44   ) 4E : : : : "K:     Z ( ( (S))))))))))))))))))))))))))))))))))))sB*D  DDctt|trd|vrdS |d}t|dkrdS|d}|dt| dzzz }t jt j|d d}| d }t|ttfsdSt|tj td t|zkS#t$rYdSwxYw) Nr8Fr2r"rdrrrr}r)rr3rrr;r)rfrgrjrhrgrr+rrr@)rrEparts payload_b64rr}s rB_xai_access_token_is_expiringr_s* lC ( (C|,C,Cu ""3'' u::>>5Ah ss;///!344 *V5k6H6H6Q6QRRYYZabbcckk%  #U|,, 5SzzdikkC3|3D3D,E,EEFF uus(D)BD)'AD)) D76D7ct}t|trd|vr|S |d}t |dkr|S|d}|dt | dzzz }t jtj| d d}| d}t|ttfs|St|tjz }|d kr|S|d krtd |S|S#t $r|cYSwxYw) u.How far before JWT ``exp`` to proactively refresh xAI OAuth tokens. SuperGrok sessions can still ship multi-hour access tokens, where the gateway-oriented :data:`XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS` window makes sense. Device-code logins often return ~15-minute JWTs; applying the full hour-long skew to those forces a refresh on *every* credential resolution (chat turn, Imagine tool call, ``hermes auth status``, …), which burns single-use refresh tokens and races concurrent callers into ``invalid_grant`` quarantine. r8r2r"rdrrrr}ri r')%XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDSrr3rrr;r)rfrgrjrhrgrr+rminr@)rmax_skewr]r^rr}r!s rB#_xai_proactive_refresh_skew_secondsrd-sI5H lC ( (C|,C,C""3'' u::>>OAh ss;///!344 *V5k6H6H6Q6QRRYYZabbcckk%  #U|,, O#JJ, >>O   sH%% % s*)D1BD1.*D1D1/D11 E?Erc@t|}|jdkrtd|d|ddd|jpd}|std |d |ddd|d kr.|d std |d |ddd|S)uIRefuse any OIDC discovery endpoint that isn't HTTPS on the xAI origin. The OIDC discovery response is a long-lived, low-frequency request whose output is cached in ``~/.hermes/auth.json``. A single MITM during initial login could substitute a malicious ``token_endpoint``; that URL would then receive the refresh_token on every subsequent refresh — a permanent credential leak from a one-time MITM. Validating scheme + host pins the cached endpoint to the xAI auth origin (or a future ``*.x.ai`` subdomain if xAI migrates) so the cache poisoning loses its persistence guarantee. RFC 8414 §2 requires the issuer to be ``https://`` and SHOULD-keeps the token_endpoint on the same origin; we enforce both. ``x.ai`` is the bare apex, so we accept either exact host match or any ``.x.ai`` suffix. rXz(xAI OIDC discovery returned a non-HTTPS rr8rkxai_discovery_invalidrr7zxAI OIDC discovery z is missing a hostname: r.x.aiz host z is not on the xAI origin (expected x.ai or a *.x.ai subdomain). Refusing to use a cached endpoint that may have been substituted by a MITM during initial discovery; re-authenticate with `hermes model` to re-fetch.)rrYr|r=r>r)rJrrKrAs rB_xai_validate_oauth_endpointrhOs c]]F } Hu H H H H H (    O !r ( ( * *D   I% I I I I I (     v~~dmmG44~ K% K Kt K K K!(      Jrcfallbackc|pdd}|s|S t|}n.#t$r!td|||cYSwxYw|jdkrtd|||S|jpd}|std|||S|dkr4| dstd ||||S|S) uRefuse a non-xAI base_url for the OAuth-authenticated inference path. The xAI Grok OAuth bearer is a high-value, long-lived credential tied to the user's SuperGrok subscription. ``XAI_BASE_URL`` / ``HERMES_XAI_BASE_URL`` let users repoint the inference endpoint (handy for staging or a local proxy), but the env override is also a credential-leak vector: a tampered ``.env`` or hostile shell init that sets ``XAI_BASE_URL=https://attacker.example/v1`` would ship the OAuth access token to a third party on every request, silently. Pin the inference origin to ``api.x.ai`` (or any ``*.x.ai`` subdomain xAI may add). On rejection, fall back to the default and log a warning rather than raise — a bad env var should not deadlock authentication, but it should also never leak the bearer. ``value`` is the already-stripped, trailing-slash-trimmed candidate from env. Empty input returns ``fallback`` unchanged. r7rEz>Ignoring malformed xAI base_url override %r; using %s instead.rXznRefusing non-HTTPS xAI base_url override %r (xai-oauth bearer would be sent in cleartext); falling back to %s.zEIgnoring xAI base_url override %r with no hostname; using %s instead.rrguRefusing xAI base_url override %r — host %r is not on the xAI origin (expected x.ai or a *.x.ai subdomain). The xai-oauth bearer is only valid against xAI's inference API; sending it elsewhere would leak the credential. Falling back to %s.) rGr?rr@rrrYr=r>r)rrirrKrAs rB _xai_validate_inference_base_urlrkxsQ&"##%%,,S11I )$$  L x     } 9 x    O !r ( ( * *D  S x    v~~dmmG44~ 2 tX     s?(A*)A*c tjtddi|}n(#t$r}t d|dd|d}~wwxYw|jdkrt d |jd dd |}n(#t$r}t d |dd |d}~wwxYwt|tst d ddt|ddpd }t|ddpd }|r|st dddt|dt|d||dS)Nrr/)r:r*zxAI OIDC discovery failed: rkxai_discovery_failedrr<z#xAI OIDC discovery returned status r8z*xAI OIDC discovery returned invalid JSON: xai_discovery_invalid_jsonz2xAI OIDC discovery response was not a JSON object.xai_discovery_incompleteauthorization_endpointr7token_endpointz;xAI OIDC discovery response was missing required endpoints.r)rprq) r>rgXAI_OAUTH_DISCOVERY_URLr@r|r@r;rrbr3rGrh)rrrrrprqs rB_xai_oauth_discoveryrts 9 #12#     /# / / '      s"" I(2F I I I '    --//  > > > -      gt $ $  @ +    !-Er!J!J!PbQQWWYY%5r::@bAAGGIIN !   I +    !!7?WXXXX 7GHHHH"8(  s,! AAA0B B*B%%B*rqrrqc :~t|tr|stdddd|pt |d}t |dt jtdt|}t j |d d i 5}| |d d idt|d}dddn #1swxYwY|j dkrh|j}|j dkr td|rd|ndzdzdddtd|rd|ndzdd|j dv |} n(#t $r} td| dd| d} ~ wwxYwt| t"stddd dt| d!dpd} | std"dd#d| t| dp|t| d$pd| d%t| d&pd'pd't'jt*jd(d)d*} | S)+NzHxAI OAuth is missing refresh_token. Re-authenticate with `hermes model`.rkrQTr}rqrrrSrr/rr1rrrrTrrr<rz'xAI token refresh failed with HTTP 403.rr7uP This OAuth account is not authorized for xAI API access — xAI may be restricting API/OAuth use to specific SuperGrok tiers despite the in-app subscription being active. Re-logging in won't change that; set ``XAI_API_KEY`` and switch to ``provider: xai`` (API-key path) if available, or upgrade your subscription at https://x.ai/grok.xai_oauth_tier_deniedFzxAI token refresh failed.xai_refresh_failed>rrz)xAI token refresh returned invalid JSON: xai_refresh_invalid_jsonrz1xAI token refresh response was not a JSON object.xai_refresh_invalid_responserz4xAI token refresh response was missing access_token. xai_refresh_missing_access_tokenid_tokenrIrrr<r:)rrr}rIrr)rr3rGr|rtrhr>rrr+rr?XAI_OAUTH_CLIENT_IDr@rBr;r@rbrgrr7rr8r9r@) rrrqrr)r*rrrjrrrrs rBrefresh_xai_oauth_purers  mS ) ) 1D1D1F1F  V 1!     ##%%`)=o)N)NO_)`H !1ABBBBmCU?%;%;<<==G g:L/M N N N  RX;; #%HI-0!.                  s""$$&&  3 & &9-3;))))=EE%,!&     ')/7%V%%%R 9 %&2j@     --//  = = = +      gt $ $  ? /!     7;;~r::@bAAGGII   B 3!     )W[[99J]KKQQSS J//5266<<>>kk,//'++l33?x@@FFHHTH X\22<<>>FFxQTUU G Ns*?$C//C36C3.F F( F##F()rc  ttdpi}t|dpd}n#t$rd}YnwxYwt t|ddpdt|ddpd||}t |}|d|d<|d|d<|dr |d|d<|d  |d |d <|d r |d |d <t|d |i||d |d |S)Nrkrrerr7rrur}rIrrqrFrX)rfrer3rgr@rrbr[)rrqrrrqrrr s rB_refresh_xai_oauth_tokensrCs($%5%7%7EEK +..E2EFF (((' (& FJJ~r * * 0b11 FJJ + + 1r22%' I &\\N%.~%>N>"&/&@N?#}}Z  ;%.z%:z"}}\"".'0'>|$}}\""?'0'>|$#^4!~.     sAA AAc  t}t|d}t|ddpd}t dd}t|dpi}t|ddpd}t|ddpd} |t |nt|} t|} | s|rt|| } | r tttt|d z 5td }t|d}t|ddpd}t|dpi}t|ddpd}t|ddpd} |t |nt|} t|} | s|rt|| } | r|st|d} t||| | }t|ddpd}n=#t $r/} t#| r t%} t'| dpi}t|dpi}|dd|dd||d<d| jpdt| ddt-jt0jd|d<t7| d|d t9| n2#t:$r%}t<d|Yd}~nd}~wwxYwd} ~ wwxYwdddn #1swxYwYtAtCj"dd#dp9tCj"dd#dtH}d||d|dddS)Nrrr7"HERMES_XAI_REFRESH_TIMEOUT_SECONDSrrRrqrrSrHFr)rqrrrkrryruTrvrxrcz2xAI OAuth: failed to persist quarantined state: %sHERMES_XAI_BASE_URLrErrirrrer)%rSrbr3rgrGr rrdr5r_rlrr+rrtrr|$_is_terminal_xai_oauth_refresh_errorrerfrrrr7rr8r9rmrnr@rrArkrrr?DEFAULT_XAI_OAUTH_BASE_URL)rrrrrrr"rRrqreffective_skewrr_q_store_q_state _q_tokensr{r2s rB%resolve_xai_oauth_runtime_credentialsrnsa " # #D $x. ! !Fvzz."55;<<BBDDL'(LbQQTXXk**0b11I'7<<BCCIIKKNtxx339r::@@BBL + !!! 0 > > -((N U 3U6|^TT5 c%8Q2R2RTknqTq.r.r s s s4 4 )666D$x.))Fvzz."==CDDJJLLLTXXk228b99I /?!D!D!JKKQQSSNtxx;;ArBBHHJJL(3()))8FF  "-00N" ](; ]!>|^!\!\% %e%9:Q%R%RSc%dN"6'5%1(? F $'vzz."'E'E'K#L#L#R#R#T#TLL ;C@@'7'9'9H';Hk'R'R'XVXH(,X\\(-C-C-Ir(J(JI%MM.$???%MM/4@@@1:HX.,7(+(H4H+.s88*C48&.l8<&@&@&J&J&L&L ;;H%672(K^cdddd,X6666("LL TV_554 4 4 4 4 4 4 4 4 4 4 4 4 4 4 l0 ',,2244;;C@@ = 9^R ( ( . . 0 0 7 7 < <+H  %00)   sc6E QA L Q Q Q+C%PQ QP;6Q;QQQ  QQQbool | ssl.SSLContextctjdkr< ddl}tj|S#t $rYnwxYwdS)a~Platform-aware default SSL verify for httpx clients. On macOS with Homebrew Python, the system OpenSSL cannot locate the system trust store and valid public certs fail verification. When certifi is importable we pin its bundle explicitly; elsewhere we defer to httpx's built-in default (certifi via its own dependency). Mirrors the weixin fix in 3a0ec1d93. darwinrNcafileT)rrcertifisslcreate_default_contextwherer))rs rB_default_verifyrs` |x  NNN-W]]__EEE E    D  4s*= A  A insecure ca_bundle auth_staterrrct|tr|dni}t|tr|ni}|t|dn$t|ddd}|pP|dp;t jdp't jdpt jd}|rdS|rlt |}tj|s)t d |tStj | StS) NtlsFdefaultrrHERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLEuJCA bundle path does not exist: %s — falling back to default certificatesr)rrbrgr!rrr3rIisfilerrrrr)rrr tls_stateeffective_insecure effective_caca_paths rB_resolve_verifyrs\ *4J)E)EM u%%%2I' 488@ bI5=4H%0000 Y]]:u==u M M M  + == % % + 9' ( ( + 9_ % % + 9) * * u:l##w~~g&& % NN\   #$$ $)9999   rcr httpx.ClientrRc||dd|i|rd|ini}||gd}fd|D}|r%tdd|S) zFPOST to the device code endpoint. Returns device_code, user_code, etc.z/api/oauth/device/coderTrUrr% user_codeverification_uriverification_uri_completerIintervalcg|]}|v| SrYrY)rrQrs rBrz(_request_device_code..s;;;QQd]]q]]]rcz%Device code response missing fields: , )r?raise_for_statusr;rr)rrRrTrUrrequired_fieldsmissingrs @rB_request_device_coder s{{ 222  #(0b H  ==??DO<;;;/;;;GWU7ASASUUVVV KrccF|ptd}d|dS)aaActionable timeout text for Nous device-code login failures. A bare "Timed out waiting for device authorization" gives the user nothing to act on. The most common cause is Portal sign-in failing in the opened browser tab (including the server-side CAPTCHA loop from #20605), so point at the Portal login page and the retry command. rEa Timed out waiting for device authorization. Portal sign-in is required before the device code can be approved. If the browser showed a CAPTCHA / 'You did not pass CAPTCHA' error, finish signing in at the Portal in a normal browser tab, then retry: hermes portal Portal login: z/login)rTr?)rRportals rB!_nous_device_auth_timeout_messager%s;8!8 @ @ E EF * "  * * *rcrPc@tjtd|z}tdt|t}tj|kr$||dd||d}|jdkr)|} d| vrtd| S |} n1#t$r$| td wxYw| d d } | d krtj || d kr)t|dzd}tj || dpd} t| d| tt|)zDPoll the token endpoint until the user approves or the code expires.r"/api/oauth/token,urn:ietf:params:oauth:grant-type:device_coderrTr%rr<rz+Token response did not include access_tokenz1Token endpoint returned a non-JSON error responserr7authorization_pending slow_downr5zUnknown authentication errorr)rrrrb%DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDSr?r@r;rr@rrrgrrr) rrRrTr%rIrPrcurrent_intervalrr error_payload error_code descriptions rB_poll_for_tokenr8s~#a"4"44H1c-1VWWXX .  X % %;; 0 0 0L&*    3 & &mmooGW,, !NOOON T$MMOOMM T T T  % % ' ' 'RSS S T#&&w33 0 0 0 J' ( ( (   $ $"#3a#7<<  J' ( ( ( #''(;<<^@^ j99K99::: 8II J JJs 3C.C6znous_auth.jsonctjdd}|r!t|Sddlm}|dz S)uzResolve the directory that holds the shared Nous token store. Honors ``HERMES_SHARED_AUTH_DIR`` so tests can redirect it to a tmp path without touching the real user's home. Defaults to ``/shared/``, where ```` is what :func:`hermes_constants.get_default_hermes_root` returns — so Linux/macOS classic installs land at ``~/.hermes/shared/``, native Windows installs at ``%LOCALAPPDATA%\hermes\shared\``, and Docker / custom ``HERMES_HOME`` deployments at ``/shared/``. Sits outside any named profile so all profiles under the same root share the store. HERMES_SHARED_AUTH_DIRr7rrshared)rrrGr r rr)overriders rB_nous_shared_auth_dirrshy1266<<>>H+H~~((***888888 " " $ $x //rccTttz }tjdrrddlm}|dz tz d} |d}n#t$r|}YnwxYw||krtd|d|S) NrrrrFrzDRefusing to touch real user shared Nous auth store during test run: z@. Set HERMES_SHARED_AUTH_DIR to a tmp_path in your test fixture.) rNOUS_SHARED_STORE_FILENAMErrrgrrrr@r)rIrreal_home_sharedrs rB_nous_shared_store_pathrs " "%? ?D z~~+,, <<<<<< # # % % 03M M ''    ||5|11HH   HHH  ' ' 'ZZZZ  Ks&A== B  B c#K td}n#t$rdVYdSwxYwt|t|d5dVddddS#1swxYwYdS)a Cross-profile lock for the shared Nous OAuth store. Lock ordering invariant: if both this and ``_auth_store_lock`` need to be held, acquire ``_auth_store_lock`` FIRST. All runtime refresh paths follow this order. The one exception is ``_try_import_shared_nous_state``, which holds this lock alone for the entire refresh cycle so concurrent imports on sibling profiles can't race on the single-use shared refresh token; that helper must NOT be called with ``_auth_store_lock`` already held. rNz+Timed out waiting for shared Nous auth lock)rrrr_nous_shared_lock_holder)rrs rB_nous_shared_store_lockrs+--99'BB    5     s!&88A$$A(+A(c4t}|sdS|d}t|tr|sdS|d}t |dpd}t |dpd}|t|pdk}||k}|s|sdSdD] }||} | dvr| ||<!dS) zACopy fresher shared OAuth tokens into a profile-local Nous state.Frrwrr7) rrrrUrTrRrSrrw>Nr7T)_read_shared_nous_statergrr3rGrC) rqrshared_refresh local_refreshshared_access_explocal_access_exprefresh_changedfresher_accessr$rs rB_merge_shared_nous_oauth_staters. $ & &F uZZ00N nc * *.2F2F2H2HuIIo..M,VZZ -E-EFFM#+EIIl,C,CDDK$**,,M4GR0H0H0N0N0P0PPO&)99N >u    3  " "E#J 4rcc |d}|d}t|tr|sdSt|tr|sdSd|||dpd|dpt|dpt |d pt |d pt|d |d tj tj  d } t5t}|jddt#|||jdt)jdt-jj}t)jt|t(jt(jzt(jzt:jt:jz} t)j |dd5}|!tEj#|dd|$t)j%|&dddn #1swxYwYt)j'|| |(r|)nO#tT$rYnCwxYw# |(r|)ww#tT$rYwwxYwxYwdddn #1swxYwYtWdt|tY|dS#tZ$r&}t\/d|Yd}~dSd}~wwxYw)aoPersist a minimal copy of the Nous OAuth state to the shared store. Best-effort: any failure is swallowed after logging. The shared store is a convenience layer; the per-profile auth.json remains the source of truth. We deliberately omit the runtime ``agent_key`` compatibility field; the OAuth tokens are the cross-profile source of truth. rrNr"rrrUrTrRrSrrw) _schemarrrrUrTrRrSrrwr1Trr5r8r6rrr2rnous_shared_store_written)rIrefresh_token_fpz*Failed to write shared Nous auth store: %s)0rgrr3rGDEFAULT_NOUS_SCOPEDEFAULT_NOUS_CLIENT_IDrTDEFAULT_NOUS_INFERENCE_URLrr7rr8r9rrrrrr:rPrr;r<r=r>rr?r@rArrBrCrDrEr;rrFrGr r@rrJrrrr@rrA) rqrrrrItmprMrrs rB_write_shared_nous_staters"IIo..M99^,,L }c * *}/B/B/D/D |S ) )l.@.@.B.B$&ii --97##9'9YY{++E/E 99%677R;R#ii(<==[A[yy//ii --l8<00::<<  F!H $ & &  *,,D K  dT  : : : d # # #..DI!T!TBIKK!T!T$*,,BR!T!TUUCC bj(294 t|+B Yr3999*RHHTZqDIIIJJJHHJJJHRYY[[)))*************** 3%%%zz||% Dzz||% %D1               4  'T/ >>      HHH A3GGGGGGGGGHs!N7/C!M>L3(A%K L3K L3 K !L3:(L#"M># L0-M>/L00M>3M/5(MM/ M, )M/+M, ,M//M>2 N7>NN7N/N77 O'O""O'cl t}n#t$rYdSwxYw|sdS tj|d}n;#t tf$r'}t d||Yd}~dSd}~wwxYwt|tsdS| d}| d}t|tr|sdSt|tr|sdS|S)uReturn the shared Nous OAuth state if present and well-formed. Returns ``None`` when the file is missing, unreadable, malformed, or lacks required fields. Callers should treat ``None`` as "no shared credentials available — fall through to device-code". Nr!rz.Shared Nous auth store at %s is unreadable: %srr)rrrr;r)r*rrrrArrbrgr3rG)rIrrrrs rBrr6sM&(( tt <<>>t*T^^[^AABB Z  EtSQQQttttt gt $ $tKK00M;;~..L }c * *}/B/B/D/Dt |S ) )l.@.@.B.Bt Ns# (A""B3BBcD t5t} |n#t$rYnwxYwdddn #1swxYwYt d|dS#t $r&}t d|Yd}~dSd}~wwxYw)zBRemove the shared Nous OAuth store after a terminal token failure.Nnous_shared_store_clearedrz*Failed to clear shared Nous auth store: %s)rrrJFileNotFoundErrorrr@rrA)rrIrs rB_clear_shared_nous_staterTs H $ & &  *,,D  $                     0@@@@@@ HHH A3GGGGGGGGGHsYA/A5A AAAA A/AA/AA// B9BBrc|t|to'|jdko|jdvot |jS)z>True when retrying the same Nous refresh token cannot succeed.rd>rrrrr|r~rr5rrs rB_is_terminal_nous_refresh_errorrbsJ 3 "" ' LF " ' HR R ' % & & rcc|t|to'|jdko|jdvot |jS)uTrue when retrying the same xAI OAuth refresh token cannot succeed. ``xai_refresh_failed`` covers HTTP 400/401/403 from the token endpoint (invalid_grant, token revoked, refresh_token_reused). ``xai_auth_missing_refresh_token`` means the pool entry has no refresh token at all — retrying will never work. Both carry ``relogin_required=True``; transient failures (429, 5xx) do not. rk>ryrQrrs rBrrlsJ 3 "" ' LK ' ' HP P ' % & & rcc|t|to'|jdko|jdvot |jS)uTrue when retrying the same Codex OAuth refresh token cannot succeed. ``codex_refresh_failed`` covers HTTP 400/401/403 from the token endpoint (invalid_grant, token revoked, refresh_token_reused). ``codex_auth_missing_refresh_token`` means the pool entry has no refresh token at all — retrying will never work. Both carry ``relogin_required=True``; transient failures (429, 5xx) do not. rf>rrrrrrrs rB&_is_terminal_codex_oauth_refresh_errorr}sN 3 "" ' LN * ' H   ' % & & rcc z||j|d|dt|dd} t}t ||d< t j|}|j|d<|j|d<d|d <n#t$rd |d <YnwxYwn)#t$r}t||d <Yd }~nd }~wwxYwd }|d }t|trs|rq tj|} | j | t"j} | tjt"jk}n#t($rd }YnwxYw||d<t*dt/j|dd dD]} || d d|jt ||dtjt"jd|d<t7|t9d S)zKKeep routing metadata but remove dead OAuth material so it is not replayed.rTrr)rrrTrrauth_json_pathauth_json_sizeauth_json_mtimeTauth_json_existsFauth_json_stat_errorNrwr=token_already_expiredz6Nous OAuth state quarantined (terminal auth death): %sr) rrrwrIrrrrrrrrdrvrx)rrgrrr3rrrst_mtimerr@reprrrr?r>r@rr8r7rrrr;rrr9r!invalidate_nous_auth_status_cache) rqrrforensicrstralready_expiredexpires_at_rawrKr$s rB_quarantine_nous_oauth_staters$jYY{++ .11.uyy/I/IJJ  H 5#%% %(^^!" 1##B)+H% &*,+H& '+/H' ( (  1 1 1+0H' ( ( ( 1 555+/99'((((((5'+OYY|,,N.#&&#># #+N;;F}$x|<<$x|HL'A'AAOO # # #"OOO #(7H $% NN@ 8t%@@@     #t u:: l8<((2244   E V$$$%'''''sO B:6-B$#B:$B63B:5B66B:: C CC AE00 E?>E?c|d}t|tsdS|d}t|tsdSg}d}tdth}|D]F}t|tr|d|vrd}1||G|r||d<t d||j|S) zHRemove singleton-seeded Nous pool entries that contain dead OAuth state.r$FrdrrT!nous_pool_device_code_quarantined)rr)rgrrbr|NOUS_DEVICE_CODE_SOURCErrr) rprrr"rretainedrsingleton_sourcesr#s rB_quarantine_nous_pool_entriesrs >>+ , ,D dD ! !uhhvG gt $ $uHG02UO'O'OG  V  /z    Nrccn tt|dzt5t}|s ddddS|d|d|dpt |dpt |dpt|d pd |d pt|d |d dddddd }d d}t||d|}t|dddn #1swxYwYn#t$rw}tdt|jt|ddt!|rt#dt$d|Yd}~dSd}~wt($rI}tdt|jt$d|Yd}~dSd}~wwxYw|S)!uAttempt to rehydrate Nous OAuth state from the shared store. Reads the shared file (if present), runs a forced refresh using the stored refresh_token to produce a fresh inference JWT scoped to this profile, and returns the full auth_state dict ready for ``persist_nous_credentials()``. Returns ``None`` when no shared state is available or the rehydrate fails for any reason (expired refresh_token, portal unreachable, etc.) — caller should then fall through to the normal device-code flow. rSrHNrrrTrRrSrrrUrrwFrr rrrTrRrSrrUrrwrrr updated_staterW_reasonr3r4rc$t|dSr)r)r r s rB_persist_shared_refreshz>_try_import_shared_nous_state.._persist_shared_refresh2s(77777rcTrron_state_updatenous_shared_import_failedr) error_typer&shared_import_terminal_refresh_failurezShared Nous import failed: %s)r)r rWr r3r4r)rrrrrgrrTrrrefresh_nous_oauth_from_staterr|rrr]rrrrrAr@)rrrqr rrs rB_try_import_shared_nous_stater s 2 $S39NPi5j5j k k k 0 0,..F  0 0 0 0 0 0 0 0!' > : :!'O!H--H2c0||dd|id|d}|jdkr-|}d|vrtdd d d |S |}n%#t$r}td d d |d}~wwxYwt |dd}t |dpd } |dv} | } |dksd| vsd| vrd} d } t| d || )Nrzx-nous-refresh-tokenr)rrTrr<rz%Refresh response missing access_tokenrdrTr}zRefresh token exchange failedr~rrrr5>rrrrreusezreuse detecteduNous Portal detected refresh-token reuse and revoked this session. This usually means an external process (monitoring script, custom self-heal hook, or another Hermes install sharing ~/.hermes/auth.json) called POST /api/oauth/token with Hermes's refresh token without persisting the rotated token back. Nous refresh tokens are single-use — only Hermes may call the refresh endpoint. For health checks, use `hermes auth status` instead. Re-authenticate with: hermes auth add nous)r?r@r;r|r@r3rgr>) rrRrTrrrrrrrreloginlowereds rB_refresh_access_tokenrQs{{ ,,,'7)"  Hs""--//  ( (C%+/TXZZZ ZI  III7!'$@@@EH II }  /:: ; ;Dm''(;<<_@_``KPPG!!G %%%G););?OSZ?Z?Z 9  K&tg V V VVsA// B9B  B)rverifyrSr bool | strcxtj|}tj|ddi|5}||dddd|i}d d d n #1swxYwY|jd krd |j} |}t|d p|d p|}n2#t$r%} t d| Yd } ~ nd } ~ wwxYwt|dd|} | d} t| tsgSg} | D]} t| ts| d}t|trT|r@|}d|vr| |dd}| |tt| S)z6Fetch available model IDs from the Nous inference API.rr/r*r:rrEz/modelsr0r.r4Nr<z#/models request failed with status r5rz'Could not parse error response JSON: %srdmodels_fetch_failedrrrOhermesmidr3r4rZcj|}d|vrd|fSd|vrd|vrd|fSd|vrd|fSd|fS)Nopusrprosonnetr"r2)r>)r lows rB_model_priorityz*fetch_nous_models.._model_prioritysXiikk S==s8O C<rrrgr?r@r;r3r@rrAr|rr|rbrGr>rsortfromkeys)rSrhrrr*rrrrr2rr model_idsrumodel_idr r's rBfetch_nous_modelsr-smO,,G g:L/MV\ ] ] ] ag::!((-- 6 6 6$&9&9&9:                 s""RHN>N]R]^^KK G G G LLBA F F F F F F F F G f;PQQQQmmooG ;;v  D dD ! ! I " "$%%  88D>> h $ $ ")9)9 "..""C399;;&&   S ! ! !NNN'''  i(( ) ))s*3A--A14A1A C D &DD c *|d}t|tr|sdSt ||d|dt dt |S)NrFrUrrrv)rgrr3rGrrr)rqrxr$s rB_agent_key_is_usabler/s ))K C c3  syy{{u % ii  99344As?3344    rcz'tuple[float, str] | None'_RESOLVE_TOKEN_CACHErS)rrrrc  |s_|]t5t7t\}}tj|z tkr|cdddSdddn #1swxYwYt d5\}}}|st dddt} | r| d} nt| dptd} t| } | j r6| j tvr(td| | j t} t#| d pt$} t'||| } t)t+|d zt, 5t/|}| d }| d}t1|t"r|st dddt3| d|sf|rt5|d|||s6|4t5tj|fadddn #1swxYwY|cdddcdddSt1|t"r|st dddt7j|r|nd}t7j|ddi| 5} t=|| | |}nX#t $rK}t?|r6tA||dtC||dt5|d||d}~wwxYw dddn #1swxYwYtEj#tHj%}tM| d}|d |d <| dp||d<| dp| dpd|d<| dp| d|d<|'|d<||d<tEj(|)|ztHj%'|d<| |d<| |d <| dut1| t"r| ndd |d!<t5|d||tU||d }|s6|4t5tj|fadddn #1swxYwY|cdddcdddS#1swxYwY ddddS#1swxYwYdS)"zKResolve a refresh-aware Nous Portal access token for managed tool gateways.Nrd&Hermes is not logged into Nous Portal.TrrErRzSauth: ignoring invalid portal_base_url %r (host %r not in allowlist), using defaultrTrrSrHrr,No access token found for Nous Portal login.rwz2Session expired and no refresh token is available.r#rr/rrrRrTr$managed_access_token_refresh_failurerrIrrrUrrFrr)+_RESOLVE_TOKEN_CACHE_LOCKr0rr_RESOLVE_TOKEN_CACHE_TTL_Sr^r|rbr?rOrgrTrr=rRrrr3rrrrrrrrHrir>rrrrrrrr7rr8rLr9rrAr)rrrr cached_at cached_tokenrprqstate_source_pathenv_portal_overriderRparsed_portal_urlrTr merged_sharedrrr*rrrr7 access_ttlrs rBresolve_nous_access_tokenr?sE ( ) & ( (#/*>' <N$$y04NNN'  ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( %V , ,|1  8!% 899  :188==OO#599->#?#?@@+*fSkk  !) 9 9  ) :.?.HPj.j.ji#%6%?#: +..H2HII  (iTYZZZ $S39NPi5j5j k k kT T :5AAM 99^44L!IIo66MlC00   B#%)   , 7 79MNN $ a2:vuN_``` PI$52PP040@0@,/O,PPPPPPPPPPPPPPP#/T T T T T T T Q||||||||BmS11  H#%) m$POODQQG!#56  5%(7"+&3 !!!II !   6s;; e4!#I 6&#I 7z65Rcddd                  6,x|,,C,Y]]<-H-HIIJ$-n$=E. !%.]]?%C%C%T}E/ ""+-- "="="d'>HVVDE%L +:vuFW X X X $U + + +^,H H 1.HH,0N,<,I  T2 I$ $T2'I$ (T2, U AT2M!K54M5 M ?AM M M T2M T2!M "F T2+T  T2 T T2T T2 U 2T6 6U 9T6 :U  UUr rrUrrwrrrrrrrrrrr/Optional[Callable[[Dict[str, Any], str], None]]c *|||pt|ptd|ptd|pd|pt||| | t | | dd }t | | |}tj| r| nd}tj |ddi| 5}t| d | d | d  }|s|| d}t|tr|s+|td|dd|dtdddt||d|d|}t!jt$j}t)| d}|d |d <| dp||d<| dp| dpd|d<| d p| d |d <t+| d}|pt|d<||d<||d<t!j||zt$j|d <||t3|dt5|t7|dddn #1swxYwY|S) a Refresh Nous OAuth state without mutating auth.json directly. ``on_state_update`` is called after a successful access-token refresh. Callers that own persistent state can use it to save the newly rotated refresh token before later validation can fail. rErrrrr#rr/rrrUrwrNrrO) and no refresh token is available. Re-authenticate with: hermes auth add nousrdTr}z.No refresh token is available for Nous Portal.rrRrTr4rIrrSrrpost_refresh_access_token)rrTr?rrr5rr>rrrrgrr3r|rrr7rr8rLrZr9rrArbrr)rrrTrRrSrrUrrwrrrrrrrrqrr*rcurrent_invoke_jwt_statusrefresh_token_valuerr7r> refreshed_urls rBrefresh_nous_oauth_purerHms4%&8"8+F/FNNsSS1O5OWWX[\\ ,H,,"  4X"  E"h)PU V V VFmHOODIIG g:L/MV\ ] ] ]5'ag$; IIn % %))G$$yy..% % % ! , J5A"'))O"<"< 1377 ?R ,8#E5EEE"(6)-  D#%) . %&7 8 ,1 I ,x|,,C,Y]]<-H-HIIJ$-n$=E. !%.]]?%C%C%ZGZE/ ""+-- "="="d>'$$''+&&#'!   rc)r=cddlm}t|}|rEt|r$t||d<t 5t }t|d|t|dddn #1swxYwYt||d}td| DdS)u-Persist Nous OAuth credentials as the singleton provider state and ensure the credential pool is in sync. Nous credentials are read at runtime from two independent locations: - ``providers.nous``: singleton state read by ``resolve_nous_runtime_credentials()`` during 401 recovery and by ``_seed_from_singletons()`` during pool load. - ``credential_pool.nous``: used by the runtime ``pool.select()`` path. Historically ``hermes auth add nous`` wrote a ``manual:device_code`` pool entry only, skipping ``providers.nous``. When the runtime credential expired, the recovery path read the empty singleton state and raised ``AuthError`` silently (``logger.debug`` at INFO level). This helper writes ``providers.nous`` then calls ``load_pool("nous")`` so ``_seed_from_singletons`` materialises the canonical ``device_code`` pool entry from the singleton. Re-running login upserts the same entry in place; the pool never accumulates duplicate device_code rows. ``label`` is an optional user-chosen display name (from ``hermes auth add nous --label ``). It gets embedded in the singleton state so that ``_seed_from_singletons`` uses it as the pool entry's label on every subsequent ``load_pool("nous")`` instead of the auto-derived token fingerprint. When ``None``, the auto-derived label via ``label_from_token`` is used (unchanged default behaviour). Returns the upserted :class:`PooledCredential` entry (or ``None`` if seeding somehow produced no match — shouldn't happen). rrr=rdNc3:K|]}|jtk|VdSr)rr)rr2s rBrz+persist_nous_credentials..'s/JJqah2I&I&I&I&I&I&IJJrc) rrrbr3rGrlrerernrnextr)rr=rrqrpr"s rBpersist_nous_credentialsrMs7F0///// KKE ,U!!##,U))++g   %%%'' Z777$$$%%%%%%%%%%%%%%%U### 9V  D JJDLLNNJJJ   s+/B&&B*-B*c ddlm}|ddS#t$r&}td|Yd}~dSd}~wwxYw)zGBest-effort pool reseed after providers.nous changes; never fail login.rrrdz7Failed to sync Nous credential pool from auth store: %sN)rrr@rrA)rrs rB_sync_nous_pool_from_auth_storerO,s{U333333 & UUU NPSTTTTTTTTTUs AAA)rrrrc   !tjjddtd5\!st dddt d dDfd }|\}}}}dE !fd } t ||} tj|r|nd} tdt dtj | ddi| 5}  d}  d}t| tr| stt!|dzt"5t%rD d}  d}|\}}}}| ddddn #1swxYwYt| tr| st dddt'|  d d}|s|@tt!|dzt"5t%r| d}  d}|\}}}}t'|  d d}| d|s|rt|tr|s|pd }t d!|d"d|d#|rd n|pd$}td%|t|& t)| |||'}nQ#t$rD}t+|r/t-|d()t/|d()| d*d}~wwxYwt1jt4j}t9| d+}|}|dd<| dp|d<| d,p d,pd-d,<| dp dd<t;| d.}|pt<}t?p|}|d.<| d/<|d+<t1j!|"|zt4j0 d<d} d}td1|t|t|2| d3dddn #1swxYwYtG| 4tI| 5|d6<|d.<|d7<| dut| tr| ndd8d9<dddn #1swxYwY| d:dddn #1swxYwY rtK d;}t|tr|st d d?}tM|}|1t!d@tO|tQj(z n!t9 dA}d|| dB||tRtRt!p tUdC S)FaX Resolve Nous inference credentials for runtime use. Ensures access_token is a valid inference-scoped JWT, refreshing it when needed. Concurrent processes coordinate through the auth store file lock. Returns dict with: provider, base_url, api_key, key_id, expires_at, expires_in, source ("invoke_jwt"), and auth_path. Nrrdr2TrFr4tuple[str, str, str, str]ct dp.tjdptjdptd}t }|r|d}nbt|}|j}|j dko|dv}|j dkp|}|r |tvs|s#t d||t}tt d pt}tp|}t! d pt"}||||fS) z@Resolve every routing value that shared OAuth state can replace.rRr`rarEr.>r:r<rXzXauth: ignoring invalid portal_base_url %r (host %r or scheme not allowed), using defaultrSrT)rOrgrrrTr?rbrr=rYrRrrrZrr^r3r) portal_urlr;r< portal_host loopback_httptrusted_schemestored_inference_urleffective_inference_urleffective_client_idrqs rB#_resolve_effective_routing_metadatazMresolve_nous_runtime_credentials.._resolve_effective_routing_metadataUs#599->#?#?@@+9566+9344++fSkk #<"="= " 9077<< $,Z$8$8!/8 %,6B#'AA &,7H=$ 9"*DDD)ENNI"#  "9J :&uyy1E'F'FGG.. !-..F2F $#& +&&@*@## $'#  rcrr3rc ttkrtd|dS tdn8#t$r+}td|t |jd}~wwxYwtd|t dt d td tdS) Nnous_state_persist_skipped)rrrdnous_state_persist_failed)rrrnous_state_persistedrr)rrrrT) rrrir@rr]rrgrbr)rrrppersisted_staterrqstate_persistedr:s rB_persist_statez8resolve_nous_runtime_credentials.._persist_states5 /u551/BBCC0 +!  .z65J[\\\\   / +!#Cyy1    &'!3EIIo4N4N!O!O 2599^3L3L M M     #5kkO"O %U + + + + +sA A?&A::A?rr#nous_runtime_credentials_startr)rrrr/rrrSrH)runtime_shared_merge_missing_access_tokenr3rUrwr!post_shared_merge_access_unusablerrrCr}access_unusable refresh_start)rrrr4runtime_access_refresh_failurer'terminal_runtime_access_refresh_failurerIrrrSrrrefresh_success)rrprevious_refresh_token_fpnew_refresh_token_fprDrrrRrTrr&resolve_nous_runtime_credentials_finalrz*Failed to resolve a Nous inference API key server_errorrrrrr) r~r2rhkey_idrwrIrr state_path)r4rQrr3r4r)+r<r=r>r^r|rbrr>rrrrgrrr3rrrrrrrrrrr7rr8rLrZrr^r9rrArrrOrCrrNOUS_AUTH_PATH_INVOKE_JWTr)"rrrrrZrRstored_inference_base_urlrSrTrarr*rrrinvoke_jwt_statusrrefresh_reasonrrr7r>previous_refresh_tokenrGrhrwrGrIrpr_rrqr`r:s" @@@@@@rB resolve_nous_runtime_credentialsrv6s *,,"3B3'K $V , ,RA1  DD%+dDDD Du++: : : : : : B 0 / 1 1   %  % ,% ,% ,% ,% ,% ,% ,% ,% ,% ,% ,N!(iTYZZZ-? LMM ,#/ /0J0JKK    \'H>P3QZ` a a aQ ek 99^44L!IIo66MlC00 T T,$'#(=?X$Y$Y T T6e<< T',yy'@'@ (- /(B(B @?AA +5.%&'RSSS T T T T T T T T T T T T T T TlC00 H  H N)/$HHHH!8ii(( 99\22!!!  _ D 1 =,SSVAVXq=r=rsss^D^D5e<<L',yy'@'@ (- /(B(B @?AA +5.%,C("'))G"4"4',yy'>'>---) ''JKKK$MD(9(E)-== ] %6%I/F"+!M$*!M!M!M*0%+15 ###=J)wPaPvev$+(3#1-? -N-N  "(='-*3=)))II ) " " ">sCC Z <$)$'+K!"!"!"!" !>$.$'+K!"!"!"!" !//X Y Y Y! "'l8<88%8|9T9T%U%U 1>.09.0In-1:1O1O1`S`o..7mmL.I.I.pUYYWcMdMd.phpl+)2w)?)?)U599WCUCUg)RR[R_R_`tRuRu(v(v 4A4_E_18::W>W+7P23/2}}m,.8l+.6.DMMOOj8X\///#)++l+(-^'< (-o(> $-(3#16HI_6`6`1CM1R1R ''BCCC}^D^D^D^D^D^D^D^D^D^D^D^D^D^D^D@ .)     $)'    (7E# $*CE& '!*E+ "eO'1&#'>'>HVVDE%L]Q Q Q Q Q Q Q Q Q Q Q Q Q Q Q f ?@@@eRARARARARARARARARARARARARARARAh*')))ii $$G gs # #>7>D!'n>>> >122J(44M  $ As=49;;.//000 +A!B!B C C&))N++  +/+@/@/@AA   sB?W/5A(W AF=1 W =G W G BW C+U#MU# N" ?N N" "F5U# W #U' 'W *U' +AW  W/ W W/W W//W36W3c dddddddddS)NF)r"rRrSaccess_expires_atrr~inference_credential_presentcredential_sourcerYrYrcrB_empty_nous_auth_statusr{s)"! $"(-!   rcc  ddlm}|d}|r|stSt |}|stSdd}t || }t|d d }|stSt|d d }tt|d dpd }t|dd }t|o#| dpt|} t|dd} d } | rt|dd pt} | | t|dd p!t|dd pt|dd | r|nd t|dd t|dd t|dd| d| d S#t$rtcYSwxYw)zBest-effort status from the credential pool. This is a fallback only. The auth-store provider state is the runtime source of truth because it is what ``resolve_nous_runtime_credentials()`` refreshes. rrrdr#r r4tuple[float, float, int]ctt|ddpd}tt|ddpd}tt|ddpd}||| fS)Nrrrwpriorityr)rCrr)r# agent_exp access_exprs rB_entry_sort_keyz3_snapshot_nous_pool_status.._entry_sort_keyso,WU>HzH95 5rcr(rNrrQr7roauthr=r+rRrSruntime_base_urlr2rwrTpool: r"rRrSrrxrr~ryrzr)r#r r4r})rrrr{r|rrrr3rGr>r5rrTr@) rr"rrr# runtime_keyrrQris_portal_oauthr=portal_status_urls rB_snapshot_nous_pool_statusrsY 2)333333y   -4//11 -*,, ,t||~~&& -*,, , 6 6 6 6 G111e%6==  -*,, ,und;; {B77=2>>DDFFLLNN == |,,   ) ) @T--@-@ w 22   0$77+*  )0")%1Et"L"L#0u0$77#0uj$//,;ELL!( d!C!C$+E3I4$P$P!%m!4!4,0!0%eoo    )))&((((()s#4G0G(5GD8GG21G2z>)-o.A.A/.R.R)S)S48)5H8X)F)FHH#ii11   $       "S$(6H%)P)P$Q$Q%c6488               & ' ''s 5EI J2AJ-'J2-J2c  td}n#t$rd}YnwxYw|stS|d}t ||d|d}|d}t t |to,|do|p|d  }|dup$t |d o| }||d |d ||d|d t |d t |p|d ddd }|rLt |tr7d|d<|d|d<|dpd|d<|S)uRefresh-free Nous auth snapshot for read-only display surfaces. Unlike :func:`get_nous_auth_status`, this NEVER calls ``resolve_nous_runtime_credentials()`` and therefore never performs an OAuth refresh POST or consumes a single-use refresh token. It reports the persisted auth-store state, classifying the access token with a local invoke-JWT decode only. Use this from status panels, doctor checks, and polled dashboard endpoints. Explicit auth actions (login flows, portal operations that need a live credential) should keep using ``get_nous_auth_status()``. ``logged_in`` here means "a persisted login exists that the runtime can use or refresh": a currently-usable invoke JWT, or a refresh token that has not been terminally quarantined. It does not prove the refresh token is still accepted server-side — only a live resolve can do that. rdNrrUrwrrxrrrRrSrrrpauth_store_localrTrrrzre-login requiredr)rr@rrgrr5rrb)rqr jwt_reasonlast_errterminalr"rs rBget_nous_auth_status_localrDs$'//  ,)+++99^,,L(ii  99\**J yy*++H8T"" = LL+ , , =;?!;!; <H t# UYY ' '((9\  99%677#ii(<==$"YY|44 % *@ A A!%))O"<"<==(,  2EIIk22) ) *$  FIJx..I%)!"'||F33|",,y11H5Hw MrMvalidrc td}n#t$r tcYSwxYw|stS|d}t |t rF|dr1|ds|dst St|d|d|d tStS) uClassify the Nous bootstrap session for the dashboard /api/status probe. Returns one of: - ``"valid"`` — a usable Nous credential is present (login healthy). - ``"terminal"`` — the Nous session has taken a terminal auth failure (invalid_grant / quarantined / relogin required). This is the sole signal NAS acts on to re-mint a hosted-agent bootstrap session. - ``"unknown"`` — indeterminate (no Nous provider state, or a transient/ non-terminal error). Never triggers a re-mint. Determinable with NO working token — it reads local auth-store state only, which is exactly the condition a dead hosted box is in. This function is called by the frequently-polled public ``/api/status`` endpoint, so it must never resolve credentials or perform an OAuth refresh. ANTI-FLAP CONTRACT: only a *terminal* failure maps to "terminal". A normal mid-rotation blip, a transient network error, or a merely-expiring token must NOT report "terminal" (that would trigger a spurious NAS re-mint on a healthy box). We key "terminal" on the auth layer's own terminal signal (`relogin_required`) plus a persisted quarantine marker, never on a bare "not logged in". rdrxrrrrUrwr) rr@NOUS_SESSION_UNKNOWNrgrrbNOUS_SESSION_TERMINALrNOUS_SESSION_VALID)rqrs rBget_nous_session_validityrs 8$'// $$$####$ $##yy*++H(D!!)hll3E&F&F) .)) )UYY-G-G )( ( .!!ii  99\**   "! s &&c , ddlm}|d}|r/|r|}|wt |ddpt |dd}|rSt |dsCdt tt |d dd d t |d d |dSt}|r}dt t| d d d | d pd dt| dpd| dd Sn#t$rYnwxYw t}dt t| d | d| d| ddS#t$r6}dt tt |dcYd}~Sd}~wwxYw)zStatus snapshot for Codex auth. Checks the credential pool first (where `hermes auth` stores credentials), then falls back to the legacy provider state. rrrfNrrr7Trrrr=r+r"rprrrrhrzCCodex provider quota exhausted; retry after the usage limit resets.r) r"rprrr rate_limitedrrrrrrhFr"rpr)rrrselectrrr3rrrgrr@r#r|)rr"r#rhr%rrs rBget_codex_auth_statusrsu$ 333333y((  D((** KKMME E#4d;;:unb99#B7A#N#N%)&)/*;*;&<&<(/~t(L(L%."N'%)*L*L"N"N#* 788J !%"%o&7&7"8"8$.NN>$B$B!*LjnnW&=&=&JLL$("9"y11a` *z : :          133o//00!IIn55;//ii))yy++        o//00XX         s8B5E8B E EEA;G H+HHHc  ddlm}|d}|r|r|}|wt |ddpt |dd}|rSt |dsCdt tt |ddd d t |d d |d Sn#t$rYnwxYw t}dt t| d| d| d| dd S#t$r6}dt tt |dcYd}~Sd}~wwxYw)Nrrrkrrr7Trrerr=r+rrrrhFr) rrrrrr_r3rr@rrgr|)rr"r#rhrrs rBget_xai_oauth_auth_statusrs 333333y%%  D((** KKMME E#4d;;:unb99 #@!#L#L %)&)/*;*;&<&<(/~t(L(L&9"N'%)*L*L"N"N#*          577o//00!IIn55;//ii))yy++        o//00XX         s1B3B77 CCA;E F+E?9F?Fct|}|r |jdkrddiSd}d}t||\}}d}|jr,t j|jd}|dvrt||j |}n |r|}n|j }|dkrt|}|dko| ot|}t|p|||j |p|rdnd|t|p|dS) z>>`bH .-07Av|G,,,T+Px/B/B

rrrrrget_minimax_oauth_auth_statusr_get_azure_foundry_auth_statusrrgrQrr(r$r))rrr r$s rBr'r'ys80228b ? ? A A G G I IF $U## &((( #%%% $&&& (*** #%%%   ,... 3F;;;   -///##F++G37$ 11*6222\7$ 11 \ A A A A A A!4!4!6!6FKK K \ \ \!&FEZ[[ [ [ [ \  s"D55EEc6ddi} ddlm}m}|}n#t$ri}YnwxYwt |t r|dnd}d}d}t |t rt|d pd pd}t|d pd}||d <||d <|d kr dd l m }m }m } | } i} t |t r0t |d t r|d } || |} | |d<| j|d<d|d<d|d<t!| |d<| sd|d<nd|d<|S#t$r} d|d<d| |d<|cYd} ~ Sd} ~ wwxYw |dpd}n%#t$rt#jdd}YnwxYwt'||d<|S)uWReturn structural auth status for Azure Foundry. ``logged_in`` is structural, matching other non-OAuth provider status checks: * ``auth_mode == "entra_id"`` AND ``azure-identity`` is importable (we do NOT mint a token here; ``hermes doctor`` runs the live probe and reports whether the credential chain can acquire one). * ``auth_mode == "api_key"`` (default) AND ``AZURE_FOUNDRY_API_KEY`` is set with a usable value. Never invokes the Entra credential chain — keeps CLI startup latency flat regardless of token-service / az login state. r~rr)rrr6Nrhr7rr2entra_id)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULThas_azure_identity_installedentra) default_scopeazure_identity_installedrUnot_runcredential_probeFcredential_verifiedr"zwazure-identity not installed. Install with: pip install azure-identity (or rely on Hermes' lazy-install at first use).rzyazure-identity is installed; live credential validation is skipped here. Run `hermes doctor` to verify token acquisition.zazure-identity check failed: rr)rrrr@rrbrgr3rGr>agent.azure_identity_adapterrrrrrUr5rrr)rorrrrrr2rrr installed entra_cfgidentity_configrrhs rBrrs'8DNNNNNNNNkmm %/sD$9$9C   tIIH)T""@ k22?i@@FFHHNNPP]T] y}}Z006B77==??!DDJ"            5466II)T** /z)--:P:PRV/W/W /%g. 1;;4<O09D+ ,+1DM'0D# $*/D& ' $YD  2V XV K    %D ACAADMKKKKKK  9--.EFFL" 999)3R889)'22D Ks= ((B+F-- G7G G G G""HHcFt|}|r |jdkrtd|d|dd}d}t ||\}}|s|dkr t }|pd}d}|jr,tj|jd }|d vrt||j |}n|d krt||j |}n|d kr|r| d n|j } d dlm}m}|\}} |r(||\} } | pd } | r| }nQ#t"$r%} t$d| Yd} ~ n'd} ~ wwxYw|r| d }n|j }|dkrt)|}|dkrt+|}t-|t.r| s|j }|s |dkrt1|r t2}|pd}||| d |pddS)zwResolve API key and base URL for an API-key provider. Returns dict with: provider, api_key, base_url, source. rh Provider 'z' is not an API-key provider.r rr7rmrrr|rprErr z4Copilot base URL resolution fell back to default: %sNrrr~rhr2r)rrgrQr|r%LMSTUDIO_NOAUTH_PLACEHOLDERr\rrrGrrSrur?rr rr@rrAryrLrr3rCACTUAL_LOCAL_NOAUTH_PLACEHOLDER) rr rhrrr2r r raw_token_rrs rB$resolve_api_key_provider_credentialsrs  ##K00G  g'944 C C C C #    GJ:;PPGZ -{j00-,9 GB)G4b99??AA777)'73MwWW   ('2LgVV  ! ! +2Q7>>#&&&w7Q V        1022LIq (33I>> 8$N1133('H V V V LLOQT U U U U U U U U V .>>#&&-j  7AAh,X66 x % %.(..*:*:.- 3{h..3KH3U3U.12?  OOC(()   s:?D:: E)E$$E)ct|}|r |jdkrtd|d|d|jr,t j|jdnd}|s|j}t jddp(t jddpd }t jd d}|rtj |nd d g}|rtj |nd }|s+| dstd|d|d|d|d|p||ddS)z>Resolve runtime details for local subprocess-backed providers.rvrz&' is not an external-process provider.r rr7rrrprrrNrz(Could not find the Copilot CLI command 'zQ'. Install GitHub Copilot CLI or set HERMES_COPILOT_ACP_COMMAND/COPILOT_CLI_PATH.missing_copilot_clirurEprocess)r~rhr2rrAr)rrgrQr|r\rrrGrSrrr+rrr?)rr r2rrrArs rB-resolve_external_process_provider_credentialsr:s##K00G  g'+=== L L L L #    CJBZbry1266<<>>>`bH .- .3399;;  9' , , 2 2 4 4   y2B77==??H$, F5;x 7I2FD07Av|G,,,T  H$7$7 $E$E  ]w ] ] ] &       OOC((#.w   rc default_modelcFt5t}||d<t|dddn #1swxYwYt}|jddt |t}|d}t|trt|}nBt|tr+| rd| i}ni}||d<|r-| r| d|d <n|d dd d lm}|||r!|dd } | rd| vr||d<||d<t#||d |S)aUpdate config.yaml and auth.json to reflect the active provider. When *default_model* is provided the function also writes it as the ``model.default`` value. This prevents a race condition where the gateway (which re-reads config per-message) picks up the new provider before the caller has finished model selection, resulting in a mismatched model/provider (e.g. ``anthropic/claude-opus-4.6`` sent to MiniMax's API). r'NTrr6rr~rEr2r) clear_model_endpoint_credentialsr7Fr)rlrernrrrrrrgrrbr3rGr?rrrr) rrSrrp config_pathconfig current_modelrr cur_defaults rB_update_config_for_providerrfs   %%%'' (3 $%$$$%%%%%%%%%%%%%%% "##KTD999(555   FJJw''M-&&'' M3 ' 'M,?,?,A,A 3 3 5 56  'Ij(06688( 2 9 9# > > *  j$''' CBBBBB$$Y/// 1mmIr22  1c[00#0Ii F7Ok6U;;;; s#>AAcP t}n#t$rYdSwxYw|sdS|d}t|tsdS|d}t|t sdS|}|pdS)z?Return model.provider from config.yaml, normalized, if present.Nr6r~)rr@rgrrbr3rGr>)rr6r~s rB_get_config_providerrs "" tt t JJw  E eT " "tyy$$H h $ $t~~%%''H  ts  cv|sdSt|kS)z=Return True when config.yaml currently selects *provider_id*.F)rrGr>)rs rB_config_provider_matchesrs8 u  ! ![%6%6%8%8%>%>%@%@ @@rcc|sdS|}|tvot|S)z?Return True when logout should reset the model provider config.F)rGr>rrrqs rB'_should_reset_config_provider_on_logoutrsF u""$$**,,J * * S/G /S/SSrcc.t}|dvr|SdS)aFallback logout target when auth.json has no active provider. `hermes logout` historically keyed off auth.json.active_provider only. That left users stuck when auth state had already been cleared but config.yaml still selected an OAuth provider such as openai-codex for the agent model: there was no active auth provider to target, so logout printed "No provider is currently logged in" and never reset model.provider. >rdrkrfN)r)r~s rB$_logout_default_provider_from_configrs%$%%H888 4rcc.t}|s|St|t}|s|S|d}t |t rd|d<d|vr t|d<t||d|S)z5Reset config.yaml provider back to auto after logout.r6rxr~r2Fr) rrrrrgrrbrr)rrr6s rB_reset_config_providerrs!##K     (555   F  JJw  E%4"j    3E* k6U;;;; rcr~r2rhr,r~c ddlm}|||||}n#t$rd}YnwxYw|dSttdt|jtd t d}n&#ttf$rtYdSwxYw|d vS) zDPrompt before saving a model whose known pricing exceeds guardrails.r)expensive_model_warningrNTzH========================================================================zSwitch anyway? [y/N]: F>yr) hermes_cli.model_cost_guardrr@rrrrGr>rr)r,r~r2rhrrrs rB"_confirm_expensive_model_selectionrs GGGGGG))      t GGG (OOO '/ (OOO12288::@@BB x ( uu | ##s ''/3B##CCr+rpricing#Optional[Dict[str, Dict[str, str]]]unavailable_modelsOptional[List[str]]rSunavailable_messageconfirm_providerconfirm_base_urlconfirm_api_keyc :;<=>?@ddlm} m} |pg} pddk} dDfd } g}r|vr||D]}||vr||t |t | z}totfd |D>| rd nd }>rtd |Dd|znd?i;d @drq|D][} |}d}dx}}|r| | dd}| | dd}| dd}|r | |nd}|rd=| rx| | dd| dd| d}|.d}|\}}}|dkr | |nd}|dkr | |nd}nd\}}}||||||f;|<t@t|t|@t?@fd::fd} d}!d}">r8d}#d|#dd ?d!d"d @d#d$d @}$=r |$d#d%d <z }$|"|$d&zz }"|r|"d'z }" dd(l m }%:fd)|D}&|&d*|&d+|ptd,}'|}(|(s| rd-|'d.}(g})>rV|"dd/}*t|*d/kr-|)|*d/| r?| D]#}|)d0| |$|)d1|(d2|)rd|)nd}+dd3lm},g}-|D]:}| |}.|,|}/|-|/|kr|.n|.d!|/;|-d*|-d+|%d|&|!d4|+d|-5}0|0dkrdSt-|0t|kr| ||0S|0t|krJ t/d6}1n#t0t2f$rYdSwxYw|1r | |1ndSdS#t4t6t8t:jf$rYnwxYwdd7l m}2dd8l m!}3m"}4|"D]I}5d9|5vr4t-|5#d9|4d9|3j$d/:t-|5JttKt|d z}6tM|d/D]0\}7}t-d#|7d |6d:|2:|1t|}8t-d#|8d/zd |6d;t-d#|8d zd |6d<| r|ptd,}'|pd=|'d>}(t-t-d#|d?|(d2|| D](}t-d#dd |6d#|| ||)t- t/d@|8d zdA}9|9sdStO|9}0d/|0cxkr|8krnn| ||0d/z S|0|8d/zkr0t/d6}1|1r | |1ndS|0|8d zkrdSt-dB|8d zn2#tP$rt-dCYnt2t0f$rYdSwxYw)EaInteractive model selection. Puts current_model first with a marker. Returns chosen model ID or None. If *pricing* is provided (``{model_id: {prompt, completion}}``), a compact price indicator is shown next to each model in aligned columns. If *unavailable_models* is provided, those models are shown grayed out and unselectable, with an upgrade link to *portal_url*. r)_format_price_per_mtokcompute_sale_discountr7rdr r3r4rc>|sdSrt|sdS|S)Nr)r)r rrrs rB_confirmed_selectionz5_prompt_model_selection.._confirmed_selection(sG 4  $F %%# % % %   4 rcc3BK|]}|VdSrrg)rmrs rBrz*_prompt_model_selection..@s-&J&J!w{{1~~&J&J&J&J&J&Jrcr%r2c34K|]}t|VdSr)r)rr s rBrz*_prompt_model_selection..Ds( ( (SVV ( ( ( ( ( (rcrFzzNprompt completioninput_cache_readToriginal?)r7r7r7cs"|dfg}|kr|d|S |d\}}}}}}|du}d} |rd|d| z dfg} n |ddfg} d|dd |d} r | d |d z } g| | df}|r8|d |d d f|d |d|df|kr|d|S)uABuild a rich radiolist row: yellow ★/% , dim was, plain prices.N)u ← currently in useN)r7r7r7Nr7r7r2)u★ yellow z -%rz was rEdim)rrg)r segsinpoutcachepctwas_inpwas_outon_salestar_w name_segs price_part _price_cache cache_colr has_cache has_pricingname_col price_cols rB_label_segmentsz0_prompt_model_selection.._label_segments|s 36+Dm## <===K1=1A1A +2 2 .S%gwT/  7".(V+...57II !.8...56I??y????S?9????  4 3u3y3333 3J//Z./  ? KKsx0 1 1 1 KK5'55G55u= > > > -   KK8 9 9 9 rccTdd|DS)Nr7c3 K|] \}}|V dSrrY)rrB_styles rBrz:_prompt_model_selection.._label..s&EE ftEEEEEErc)r)r r-s rB_labelz'_prompt_model_selection.._labels.wwEE0D0DEEEEEErczSelect default model:z r4rr-InrOutCachez $/Mtoku ★ = on sale)curses_radiolistc&g|] }|SrYrY)rr r-s rBrz+_prompt_model_selection..s#;;;C??3'';;;rczEnter custom model namezSkip (keep current)rE Upgrade at z for paid modelsr"z u ── u ──)model_search_textr;)selectedcancel_returnsr searchable search_labelszEnter model name: )format_radio_item_ansi)Colorscoloru★z. z. Enter custom model namez. Skip (keep current)u6Unavailable models (requires paid tier — upgrade at )u── z Choice [1-z] (default: skip): zPlease enter 1-zPlease enter a number)r r3r4r))hermes_cli.modelsrrrGr>rr|r5anyrrgrhermes_cli.curses_uir5rTr?rextendrrhermes_cli.model_searchr8rrrrr)NotImplementedErrorr subprocessSubprocessErrorr=hermes_cli.colorsr>r?r@YELLOWr3 enumeraterr)Ar+rrrrSrrrrrr _unavailable sale_chromer rr  all_modelsname_pad any_on_sale_DIM_RESETpr r!r"rr cache_readrsalewas_prompt_raw was_out_rawr1 default_idx menu_titlepadheaderr5choices _upgrade_urlunavailable_footer desc_lines header_partrr8model_search_labelsr=haystackidxrr=r>r?line num_widthinchoicer-r'r(r)r*r+r,sA `` ``` @@@@@@@rB_prompt_model_selectionri s@ & &+L$)r002288::fDK        G&)33}%%%   g   NN3   gl!3!33JwJ3&J&J&J&Jz&J&J&J#J#JKKK&qqQH   ( (Z ( ( (!444x??  KMLIIIK D F%*" 3" 3C C  A"C " "Gg -,,QUU8R-@-@AA,,QUU<-D-DEEUU#5r:: >HP..z:::b% $I00h++lB//j))D '&* ;?8^[ .3332>BBB!$  +b0032;???!$ #-S%!$c5#w HL Is3xxS::IIs5zz22II  *Iq))IBFFFFFK)J ,UcU2UUUUUDU9UUUUUUUUU  2 171Y1111 1F fz))  , + +JB 999999;;;;7;;;0111,---"=&=EEcJJ 06688! Nl N!M|!M!M!M  !#  ?%**433K;!##!!+a.";";"="=>>>  G# 7 7!!"5s "5"56666   E*<EEE F F F/9Cdii +++t  >=====   CF3KKE((--H & &!S.C.C.C.C     ""#<===""#8999 #  #-    774  W  '' 55 5 CLL  344::<</0   tt 39C''///t Ct ,gz7Q R     <;;;;;////////%%'' D== $,,ueeE6=&A&A1EE F F F F $KKKKCG q())**IGQ''UU3 S1SySSSS%;%;OOCr7rrrfr2Login successful! Config updated: z (model.provider=openai-codex)Nz?Existing Codex credentials are expired. Starting fresh login...z:Found existing Codex CLI credentials at ~/.codex/auth.jsonzOHermes will create its own session to avoid conflicts with Codex CLI / VS Code.zCImport these credentials? (a separate login is recommended) [y/N]: rg>rrrrEz=Credentials imported. Note: if Codex CLI refreshes its token,zrrrrr|rrrrr?_codex_device_code_loginrru) rAr ror _resolved_keyrr cli_tokens do_importr2r_dhhs rB_login_openai_codexr|Ds g  8::H %LLB77M--- Y- YHghuwyHzHz YNOOO !"EFFLLNNTTVVEE "34   EEE ,,,"=nhll[eg}N~N~""KGGG-...Z{ZZZ[[[F -WXXX    D  -//   N O O O c d d d !"ghhnnppvvxx /0     L((":...9%k>kllK GGG <<<<<< -4466 - - -... J{ J J JKKKKKsOAD"3BDB,)D+B,,A DD D,+D,"3FF,+F,c~|s t}|dd}t|tr|rt |dst d t d}n#ttf$rd}YnwxYw|dvr[td|d t}t t d t d |d dSn#t$rYnwxYwt t d t dt tt|ddpd}t|dd }t!rd}t#||} t%| d| d| dd| ddt'ddtd| d t}t t d ddlm} t d| dt d |d dS)Nrhr7r(z:Existing xAI OAuth credentials found in Hermes auth store.rqr>r7rrrkr2rrrsz (model.provider=xai-oauth)z6Signing in to xAI Grok OAuth (SuperGrok / Premium+)...z,(Hermes creates its own local OAuth session)r*rrFrrrrRrrre)rRrrrr%rrtrrv)rrgrr3r_rrrGr>rrrrr|r+rr_xai_oauth_device_code_loginr[rrru) rAr rorrhrrrrrr{s rB_login_xai_oauthrs   <>>Hll9b11G'3'' G .s#===s#W*<*===h===G  L '8J8J L L &    Nrcctjtdt|z}tdt|}tj|kr||ddddt |d}|jdkrd|}|d std d d |dstdd d |S |} n4#t$r'| tdd d wxYwt| dpd} | dkrtj |5| dkr)t|dzd}tj |d| dp| dp|j} td| d d tdd d )Nr"rr/rrrrr<rz?xAI device-code token response did not include an access_token.rkxai_device_token_invalidrrz?xAI device-code token response did not include a refresh_token.zAxAI device-code token polling returned a non-JSON error response.xai_device_token_failedrr7rrrr5z&xAI device-code token polling failed: z/Timed out waiting for xAI device authorization.device_code_timeout)rrrrr?r~r@r;rgr|r@rr3rrbrB) rrqr%rIrPrrrrrrrs rB_xai_oauth_poll_device_tokenrs{~#aZ"9"99H1c-0011 .  X % %;;  C, M0*      3 & &mmooG;;~.. U(3 ;;// U(3 N $MMOOMM     % % ' ' 'S$.  **7339r:: 0 0 0 J' ( ( (   $ $"#3a#7<<  J' ( ( (    1 2 2   )) }   B[ B B *    9 "   s ;D1Er~rc Zt|}|d}tjtd|}tj|ddi5}t |}t |dp|d}t |d}t|d } t|d } ttd td |td ||retsWtrI tj |} n#t$rd} YnwxYw| rtdntdtdtd| dt||t |d| | } dddn #1swxYwYt | ddpd} t | ddpd}| r|st#dddt%t'jdddp9t'jdddt, }| |t | d!dpd| d t | d"pd#pd#d$|d|t/jt2jd%d&d'd(S))Nrqrrr/rrrrrIr To continue: 1. Open:  2. If prompted, enter code: F# (Opened browser for verification)< Could not open browser automatically -- use the URL above.$Waiting for approval (polling every r"s)...r%)rqr%rIrPrr7rz;xAI device-code token response was missing required tokens.rkrrrrErrr}rr)rrr}rIrr<r:zoauth-device-code)rrRrr2rr)rtr>rrrrr3rgrrrrrrr@rrGr|rkrrr?rrr7rr8r9r@)rrrRrqr*r device_dataverification_urlrrIrrrrrr2s rBrrEs %_55I/0NmCo6677G g:L/M N N N RX4V<<  OO7 8 8 /-.   K011 \233 {:.//  n .,../// :y::;;;  V 2 4 4 V9T9V9V V #)9::     V;<<<<TUUU LSH5E5ELLLMMM. )K 677!"    3               Bw{{>266<"==CCEEL OR88>B??EEGGM  }  I +    0 ',,2244;;C@@ = 9^R ( ( . . 0 0 7 7 < <+H)*GKK B77=2>>DDFF!++l33gkk,77C8DDJJLLXPX    X\22<<>>FFxQTUU%   s8CG+E?G E GEA,GG G c  ddl}d}t}d}d}td|dzD]} tjtjd5}||dd |id d i }dddn #1swxYwYn'#t$r}td |ddd}~wwxYw|j dkrn||krztt|dd}||nd|z} tdtt| d} td| d|| |M|j dkrBtt|dd}|d|dnd} td| dt"| |j dkr!||j nd} td| ddd|} | d d!} | d"d!}td#t| d$d%}| r|std&dd'td(td)td*|d+td,td*| d-td.d/}|}d} tjtjd5}||z |krz||||d0|| d1d d i }|j dkr|}n%|j d2vrztd3|j ddd4dddn #1swxYwYn,#t*$rtd5t-d6wxYw|td7dd8|d9d!}|d:d!}|d;}|r|stdd d?i@}dddn #1swxYwYn'#t$r}tdA|ddBd}~wwxYw|j dkrBtt|dd}|d|dnd} tdC| dt"|j dkrtdD|j dddE|}|dFd!}|dGd!}|stdHddIt1jdJd!dKpt8}||dL|t;jt>j !"dMdNdOdPdQS)RzBRun the OpenAI device code login flow and return credentials dict.rNzhttps://auth.openai.comrr"r#rTz!/api/accounts/deviceauth/usercoderTr1r/)r;r:zFailed to request device code: rfrrrr:r2r(z:OpenAI is rate-limiting login requests (429); retrying in zs...z Try again in about zs.z' Wait a minute and run the login again.zOpenAI is rate-limiting Codex login requests (HTTP 429). This is a temporary throttle on OpenAI's side, not a credential problem.r<r+z$Device code request returned status r8device_code_request_errorrr7device_auth_idr%r5z-Device code response missing required fields.device_code_incompletez!To continue, follow these steps: z# 1. Open this URL in your browser:z z/codex/device z 2. Enter this code:z z/Waiting for sign-in... (press Ctrl+C to cancel)iz/api/accounts/deviceauth/token)rr>rr9z$Device auth polling returned status device_code_poll_error Login cancelled.z!Login timed out after 15 minutes.rrgrz/deviceauth/callbackzADevice auth response missing authorization_code or code_verifier.device_code_incomplete_exchange)rrrrTrrrr:zToken exchange failed: token_exchange_failedzOpenAI is rate-limiting Codex login requests (HTTP 429) during token exchange. This is a temporary throttle on OpenAI's side, not a credential problem.zToken exchange returned status token_exchange_errorrrz.Token exchange did not return an access_token.token_exchange_no_access_tokenrrE)rrr<r:rz device-code)rr2rrr)#rrranger>rrr?r@r|r@rrrrbrrrrr;rgrrrrrrrGr?rrr7rr8r9r@)_timeissuerrTrD max_attemptsattemptrrrdelay wait_hintrrrrrPmax_waitrX code_resp poll_resprgrr token_resprrrr2s rBrwrws~ &F%I DLL1,-- emD&9&9::: f{{@@@%y1+-?@#                   7#77'.J    s " " E \ ! !4i..K $/#:KKW E3s5zz2..//E 2&+222    KK    D,330y$1O1OPP & 3; 2 2 2 2:   #  # #$*A      |t'3..%)%5!!9 <6 < < <#*E    ))++K R00I __%5r::N3{z3??@@AAM  N  ;#*B     ./// /000 8& 8 8 8999 !""" .) . . ./// ;<<<H OO  EI \%-"5"5 6 6 6 &//##e+h66 M***"KK===,:SS+-?@( (C// ) 0 0I*j88#Wy?TWWW!/6N               &  "###oo /#*?    #';R@@MM/266M222L  ]  O#*K     \%-"5"5 6 6 6 &%"6.$0!*%2 ()LM%  J                    +c + +#*A     $$0 J 4 0 0  & 3; 2 2 2 2:   4(1 4 4$*A     $$ Gj.D G G G#*@    __  F::nb11LJJ33M   <#*J     )2..4466==cBB " ! )*   X\22<<>>FFxQTUU   s'B A<0 B<B BB B B,B''B,='N$BN: NN  N N N)N;'Q?&Q3' Q?3Q77Q?:Q7;Q?? R# RR#i@)limitrhttpx.Responserctdt|}g}d}d} t|ddr=|j}|d|t ||krdndz|S|D]w}|s|dz|z }|dkrd}nat ||kr&||d|||z }d}n(|||t |z }xd |}t ||kr |d|}d}|j pd } | | d }||rdndz|S#|wxYw) zCReturn a bounded error body from a streamed MiniMax OAuth response.rFis_stream_consumedNz...[truncated]r7r"Trcrr@)errors) rrrrBrrI iter_bytesrrrrh) rrchunkstotal truncatedrBchunkr!rrs rB_minimax_response_error_textrW s 3u::  EF EI 815 9 9 R=D. !s-__!w{{1~~______rc)rrrzF$*Z000B    ;;{B//52::<HHVJC:(8y::(/F  )1>hmmoooBGG   GGG X&& W  J(/E  Y  ____/^_____ R,3EN H] **,, ! !` A y   s$#C<< D  D E11 F?Fct5t}t|d|t|ddddS#1swxYwYdS)zGPersist MiniMax OAuth state to Hermes auth store (~/.hermes/auth.json).rN)rlrerern)rrps rB_minimax_save_auth_stater!s   %%%'' Z*EEE$$$%%%%%%%%%%%%%%%%%%s/A  AArrrrc~td}|dkr|jd}|jd}n|j}|j}t \}}}t rd}t d|dt d|tjtj |d d id 5} t| ||j || } t| d} t| d} t t dt d| t d| |rAtr3tj| rt dnt d| d} | t#| nd}t dt%| ||j | |t#| d|}dddn #1swxYwYt'jt*j}t/t#|d|}t1dt#||z }d||||j t4|dd|d|d|d |t'j|t*j!|d" }t;|t d#|d$x}rt d%||S)&z?Run MiniMax OAuth flow, persist tokens, return auth state dict.rr'rrFz#Starting Hermes login via MiniMax (z ) OAuth...Portal: rr/T)r*r:follow_redirects)rRrTr%rqrrrrrrrrNzWaiting for approval...r)rRrTrrrrr7rrrrrrr) r~rrRrSrTrUrrrrrrwrIu#✓ MiniMax OAuth login successful.notification_messagezNote from MiniMax: )rrXrRrSrrrr>rrrrTr3rrrrgrrrr7rr8rrrArr9rr)rrrr rRrSrrrqr code_datarr interval_rawr token_datar7expires_at_unix expires_in_srr/s rB_minimax_oauth_loginr"!s  0G ~~!-(<=$]+BC!1$7!3!5!5Hi  B B B BCCC &_ & &''' emO<<');<'+ - - - 06. O'$E   y);<== +.//   n .,../// :y::;;;  V799 V/00 V;<<<<TUUU }}Z00 +7+Cc,'''  '(((( O'x9\233#    3               B ,x| $ $C8 J| $%%3Oq#o ?@@AAL$*0&$ nn\8<<">2#O4"~66}},_NNNXXZZ"J Z((( 2333nn3444s+ )C))*** s/D-G((G,/G,)rforcerc |dstdddd tj|dd}n#t $rd }YnwxYwt j}|s||z tkr|S|d }tj tj |d 5}t||d d|d |ddddd}|j dkr[t|}|tfddD} td|p|jdd|  dddn #1swxYwY|} | ddkrtddddtjt&j} t+t-| d| } t/dt-| | z } t1|}|| d| d|d| tj| t&j | d!t9||S)"zBRefresh MiniMax OAuth access token if close to expiry (or forced).rz:MiniMax OAuth state has no refresh_token; please re-login.rno_refresh_tokenTr}rwr7rrR)r*rrrTrwrr/rrr<c3 K|]}|vV dSrrY)rr  body_lowers rBrz/_refresh_minimax_oauth_state..!s?^^a!z/^^^^^^rc)rrinvalid_refresh_tokenzMiniMax OAuth refresh failed: rtNrrz-MiniMax OAuth refresh did not return success.rrrrr)rrrrwrI)rgr|rr?rAr@r"MINIMAX_OAUTH_REFRESH_SKEW_SECONDSr>rrrr@rr>rBrr;r7rr8rrrrbrr9rr)rqrrrwr7rRrrrrrnow_dtrr new_staters @rB_refresh_minimax_oauth_stateru!sp 99_ % %  H$+=PT    +EIIlB,G,GHHRRTT   )++C j3&*LLL -.O emO<<'+ - - -06%  , , ,-";/!&!7 !D,    "  3 & &/99DJ^^^^\^^^^^GQ1O9OQQ(/?!(  '':mmooG{{8 )) ;$+;!    \(, ' 'F8 GL !""Oq#o0@0@0B0BBCCDDLU I / _eO6LMM'')),_NNNXXZZ" Y''' s$:A&& A54A5 BE**E.1E.c|jr|dsdSdD]}||dd|jpdt |ddt jtj d|d < t|dS#t$r&}t d |Yd}~dSd}~wwxYw) aWipe dead tokens from auth.json after a terminal refresh failure. Shared by both the eager-resolve path and the lazy per-request token provider. Mirrors the Nous / xAI-OAuth / Codex-OAuth quarantine pattern so subsequent calls fail fast without a network retry. rNrsrrtruTrvrxz6MiniMax OAuth: failed to persist quarantined state: %s)rrgrrr3rr7rr8r9rr@rrA)rqrrzr{s rB-_minimax_oauth_quarantine_on_terminal_refreshr!s  UYY%?%?Z "d#,,s88+ l8<((2244   E Z ''''' ZZZ MyYYYYYYYYYZs B C $CC Callable[[], str]cdd}|S)uReturn a zero-arg callable that yields a fresh MiniMax access token. The Anthropic SDK caches ``api_key`` as a static string at construction time, so a session that resolves credentials once at startup will keep sending the same bearer until MiniMax's server returns 401 — typically ~15 minutes in, because MiniMax issues short-lived access tokens. Returning a *callable* instead of a string lets us hook into the existing Entra-ID bearer infrastructure in :mod:`agent.anthropic_adapter`: ``build_anthropic_client`` detects a callable and routes through ``_build_anthropic_client_with_bearer_hook``, which mints a fresh ``Authorization`` header on every outbound request. Each invocation re-reads the persisted state from ``auth.json`` and calls :func:`_refresh_minimax_oauth_state` — that helper is a no-op when the token still has more than ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS`` of life left, so the steady-state cost is one file read + one timestamp compare per request. Reading state fresh each time also means a refresh persisted by one process (CLI, gateway, cron) is immediately visible to every other process sharing the same ``auth.json``. r4r3c4td}|r|dstdddd t|}n##t$r}t ||d}~wwxYw|d}|stdddd|S) NrrMNot logged into MiniMax OAuth. Run `hermes model` and select MiniMax (OAuth). not_logged_inTr}z6MiniMax OAuth state has no access_token after refresh.no_access_token)rrgr|rr)rqrrs rB_providez4build_minimax_oauth_token_provider.._provide!s'88 EIIn55 #(QU   077EE    9% E E E   .)) H(/@SW  A A+A&&A+r4r3rY)rs rB"build_minimax_oauth_token_providerr!s.* Orc)min_token_ttl_secondsas_token_providerrr cNtd}|r|dstdddd t|}n##t$r}t ||d}~wwxYw|rt }n|d}d||dd d d S) uReturn {provider, api_key, base_url, source} for minimax-oauth. When ``as_token_provider`` is True, ``api_key`` is a zero-arg callable that mints a fresh access token per call (proactively refreshing if the cached token is within ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS`` of expiry). This is what the runtime provider path uses so that long sessions survive MiniMax's short access-token lifetime — see :func:`build_minimax_oauth_token_provider` for the rationale. The default (string ``api_key``) preserves the historical contract for diagnostic call sites like ``hermes status`` that just want to know whether a valid token exists right now. rrrrTr}NrSrErr)rrgr|rrrr?)rr rqrrhs rB)resolve_minimax_oauth_runtime_credentialsr "s" $O 4 4E   .11  $?T    ,U33 5eSAAA (9;;'#./66s;;   rctd}|r|dsdddS tj|dd}|t jz dk}n2#t $r%t|d}YnwxYw|d|dd |dd S) z3Return auth status dict for MiniMax OAuth provider.rrFrrwr7rrr)r"r~rrw)rrgrr?rArr@r5)rqrw token_valids rBrr."s #O 4 4E A .11A"@@@6+EIIlB,G,GHHRRTT !DIKK/14 666599^4455 6!#))Hh//ii --   sAB,B10B1ct|ddpd}t|dd }t|ddpd} t|||dS#t$r0}tt |t d d}~wwxYw) z"CLI entry for MiniMax OAuth login.rNrrFr*r#rr")rrr|rrr)rAr rrr*rs rB_login_minimax_oauthr@"s T8T * * 6hFt\5999LdIt,,4G g        $$%%%mmsA B+BB) rRrSrTrUrrrron_verificationr$Optional[Callable[[str, str], None]]c  td} |p.tjdptjdp| jd}|ptjdp| jd} |p| j}|p| j}tj |} |rdn|r|nd} trd}td| j d td ||rtd n|rtd |d tj | ddi| 5} t| |||}t|d}t|d}t!|d}t!|d}ttdtd|td||r5t#j|}|rtdntd| |||n#t&$rYnwxYwt)dt+|t,}td|dt/| ||t|d|| }dddn #1swxYwYt1jt4j}t9|dd!}||z}t?|d"p| }|| krtd#|id$|d"|d%|d&|d&p|d'|d'd(d)|d)d*|d*d+| d,t1j!|t4j- d|d.| dutE| tr| ndd/d0dd1dd2dd3dd4dd5d} tG||d6S#tH$r}|j%d7kr|d$tLd}tO|}tt|td8|d9ttd:tQdd}~wwxYw);zMRun the Nous device-code flow and return full OAuth state without persisting.rdr`rarEr\FTzStarting Hermes login via z...rz'TLS verification: disabled (--insecure)z$TLS verification: custom CA bundle (r@rr/r)rrRrTrUrrrIrrrrru= Could not open browser automatically — use the URL above.Nr"rrr%)rrRrTr%rIrPrrSz%Using portal-provided inference URL: rRrTrUrrrrrrwrrrrrrrrr)rrrz Subscribe here: z/billingzrrrrPrrr3rrrr@rrbrrrr7rr8rLrgrArOr9rrrr|rrTrr)rRrSrTrUrrrrrr requested_inference_urlr*rrrrrrIrreffective_intervalrr7token_expires_inrwresolved_inference_urlrrrSrs rB_nous_device_code_loginrN"s 'G # 9- . . # 9+ , , #  " fSkk   & 9. / / &  % fSkk  .W.I  "W]EmO,,G"*Ri1QTF  8w| 8 8 8999 &_ & &'''C 78888 C AYAAABBB g:L/MV\ ] ] ]- ag*+    {+FGHH K011 \233 {:.//  n .,../// :y::;;;  W_%566F W;<<<<UVVV  &  0)<<<<    !C2W$X$XYY N5GNNNOOO$+K 677!"    M- - - - - - - - - - - - - - - ^ ,x| $ $C*:>>,+J+JKK#33J:>>*>??@@ # "!888 N6LNNOOO?4 Y ((1E  jnn\8<<   >2  88 s}} h,ZHLIIISSUU & %#-fc#:#:D   T !" #$ %& D'( )J,, +        8. . .#!#:fSkk (,,G GGG 'NNN ;z;;; < < < GGG P Q Q QQ--   sQ,C"J HJ H)&J(H))A!JJJ P S'B%S  Sc tdpi}n#t$rYdSwxYw|d}t|tsdSt |vS)aReturn True if the currently-held Nous token carries ``billing:manage``. Reads the persisted ``scope`` string saved at login (``_save_provider_state`` stores ``token_data.get("scope") or scope``). A space-delimited match. Used by the lazy step-up: if False, the first billing call will 403 ``insufficient_scope`` anyway, but checking up front lets a surface skip a doomed round-trip. rdFrU)rr@rgrr3NOUS_BILLING_MANAGE_SCOPEr)rqrUs rBnous_token_has_billing_scoper"sx'//52 uu IIg  E eS ! !u $ 55s  "")rrrc tdpi}td}|d}t|tr|nd}g}|pt dgD]}|r||vr||t|vr|td |} t|dpd|dpd|d p|j | ||| } t5t} t| d| t| dddn #1swxYwY t!| n#t"$rYnwxYw t%n#t"$rYnwxYw| d} t| tot| vS) uRe-run the device flow requesting ``billing:manage`` and persist the result. The lazy step-up (plan D-A): triggered when a billing endpoint returns ``403 insufficient_scope``. Runs a fresh device-connect with ``inference:invoke tool:invoke billing:manage`` on the scope. The user must be an ADMIN/OWNER and select "Allow Remote Spending" in the portal for the minted token to actually carry the scope; otherwise the server silently downscopes and this returns False. Reuses the held credential's portal/inference URLs + client_id so the step-up targets the same deployment (incl. a preview via ``HERMES_PORTAL_BASE_URL`` set at the original login). Persists to the auth store + shared store + pool, exactly like ``_login_nous`` — but WITHOUT the model picker (this is a scope upgrade, not a fresh login). Returns True iff the new token carries ``billing:manage``. rdrUr7z tool:invoker-rRNrSrT)rRrSrTrUrrr)rrrgrr3rrrrrrrTrlrerernrr@rO) rrrpriorr  _raw_scope prior_scopertokrUrrpgranteds rBstep_up_nous_billing_scoper!"s]. $F + + 1rE'G7##J *:s ; ;C**KI!!##S(C]'S""  "3i''   S ! ! ! 112333 HHY  E( "344< 99%9::Bd))K((=G,=!''J   %%%'' Z<<<$$$%%%%%%%%%%%%%%%   ,,,,       '))))      nnW%%G gs # # T(AW]]__(TTs6*/E%%E),E)1F F FF!! F.-F.c  t|ddpd}tt|dd}t|ddp'tjdptjd} d}t }|r t }n#t $rd}YnwxYwt|rtd |ntd  td  }n#ttf$rd }YnwxYw|d vr0tdt|}|td|jtt|ddt|ddt|ddp|jt|ddt|dd |||}|d} t!5t#} | d} dddn #1swxYwYt!5t#} t'| d|t)| } dddn #1swxYwYt+|t-ttdtd| d} |dp|d}t/|t0r|st3ddd d!d"lm}m}m}m}m}m }|}tg}d#}|r|d}|d$%}|d&d#}|rY d!d'l!m"}m#}|d$%}||d()pd#}n#tH$rd#}YnwxYw||||\}}|||d$*\}}n||||\}}|d&d#}|r8td+tK|d,tM|||||d| |-}nR|rA|ptN(d.} td/t|pd0| d1ntd2nj#tH$r]}!t/|!t2rtS|!nt1|!}"ttd3|"Yd}!~!nd}!~!wwxYw|st!5t#} | r| | d<n| *ddt)| dddn #1swxYwYttd4td5dStWd| |6}#|r!tY|td7|td8|#d9dS#t$rtd:t[d;tH$r&}!td<|!t[d=d}!~!wwxYw)>z&Nous Portal device authorization flow.r*Nr#rFrrrz)Found existing Nous OAuth credentials at z,Found existing shared Nous OAuth credentialsz!Import these credentials? [Y/n]: r>r7rrz3Rehydrating Nous session from shared credentials...rHuKCould not refresh shared credentials — falling back to device-code login.rS inference_urlrTrUr)rRrSrTrUrrrrrSr'rdrrrrrz,No runtime API key available to fetch modelsrrr)get_curated_nous_model_idsget_pricing_for_providercheck_nous_free_tierpartition_nous_models_by_tier&union_with_portal_free_recommendations&union_with_portal_paid_recommendationsr7TrrRrzpaid Nous modelsr) free_tierzShowing u= curated models — use "Enter custom model name" for others.)rrrSrrrrrEz#No free models currently available.r7z to access paid models.z,No curated models available for Nous Portal.z?Login succeeded, but could not fetch available models. Reason: z:No provider change. Nous credentials saved for future use.z4 Run `hermes model` again to switch to Nous Portal.)rzDefault model set to: rsz (model.provider=nous)rrzLogin failed: r").rr5rrrrrrrrGr>rrrrrTrlrergrernrrOrr3r|rAr$r%r&r'r(r)rrrr@rrirTr?rrrrlr)$rAr rrrrr shared_pathrzrS _prior_storeprior_active_providerrprselected_modelrr$r%r&r'r(r)r+rrrr*_portal_for_recsrr _account_info_portal_urlrrrs$ rB _login_nousr3/#sdIt44<OGD*e4455Hk4(( & 9' ( ( & 9_ % %  )**  i #577  # # #"  # GGG FO+OOPPPPDEEE !"EFFLLNNTTVV /0     ,,,KLLL:$3 %ghhh  0 'lD A A#*4$#G#G!$ T::Og>OdGT22!(|U!C!CC /!#   J((<=    H H+--L$0$4$45F$G$G ! H H H H H H H H H H H H H H H   4 4)++J VZ @ @ @' 33H 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 !,,,')))  !""" )x))*** S _$..55W9W9WKk3// { B#(                  3244I GGG') "$ ) 226::10TBBB #->>2CR#H#H #1 )E(DQU(V(V(V BB -+=" " ,+%111.0+++1*P)O!7,<**&Iw5R4Q!7d5551I11*P)O!7,<**&Iw!nn%6;;G FpYpppqqq!8w'9&(;%+%7$/"""$ F:#:BB3GG;<<<)X-X4-X-X-XYYYYDEEE _ _ _0:3 0J0JX',,,PSTWPXPXG GGG ]T[]] ^ ^ ^ ^ ^ ^ ^ ^ _ "## - --// (<4IJ011NN#4d;;; ,,,  - - - - - - - - - - - - - - - GGG N O O O H I I I F1 &n     = ~ . . . ;>;; < < < F;FFFGGGGG  "###oo  $s$$%%%mms&,V5?B V5 BV5B5V53DV5DV5DB9V5$H: V5H  V5 H V5/I V5IV5!I"AV54B0Q0%#N Q0 NQ0NCQ0/V50 S:AS V5SV5*> 0;00111mm " "F  LF L&J&L&LF  3444A&II26::M6"" ;&9 ;  % " $ $ $ /}///000  A29-A#B#B A = > > > > >  A M N N N N N ? @ @ @ @ @ 9999:::::rc)r2r3r4r5)r2r3r4r3r)rhr3rr3rr3r4r3)rr rrr4r5)rr3r rNr4r )rhr3r)rZr*r+r4r,)rF)rhr3r*r+r4r,)rr@r4r5)r:r r4r)rr@r4r3)rr|r4r3)rr r4r)r4r5)rr3rrrr r4r)r4r )r4r)r4rW)rr rr r4r5)rr r4r)rr rrrr+rr3)rr+rrr)rrr4rW)rprWrrr4r )rprWrr3r4rP)rr3)rprWrr3r4r_)rprWrr3rqrWr4r) rprWrr3rqrWrXrr4r) rprWrr3rqrWrdr5r4r) rr3rqrWrr rdr5r4r )rr3r4r)rr3r4r5)rr3r4r3)rrr4rW)r#rWrr_rr3r4rW)rr3rrrrr4r )rr3rr3r4r)rr3rr3r4r5)rr3r4r_)r4r)rrr4r5rD)rr3r4r3)rrrrrrr4r3rD)rDr rErr4r5)rIr r4r)rr r4r)r rWr4r)rJrr4r)rr r4rW)rkr r4rl) rr rUr rwr rxrr4r) rr rUr rwr rxrr4r5)rqrWrr r4r)rr rrr4r)rr rr r4r)rqrWrrr4r)rqrWrr rrr4r)rqrWr4rW)rr rErr4r5)rrWr4r )rr rErr4r5)r)rrWrr+r4rW)rrWr4r)rr5rr5rrr4rW)rkrr4r)rkrr4r3rR)rrrqr_r4r3)rqr_r4r3)r )rrr4r3)rr3r4r3)rTr3rr3rUr3rqr3r%r3r r3r4r3)rr3r4r,)r2r3r4r3)rr3rr+r4rI)r_rWrTr3rr3r`r3r r3rr3r^r_r4rW)rTr3rr3rr3rr3r r3rr+r4rW)rqrWrr+r4rW)rr3r4r3)rr3rrr4r)rr5r4rW) rprWrr0rrrr,r4r)rr0rr3r=r3r4r)rr3r4r,)rr3rr3rr+r4rW)rr0rr+r4r0)r4r,)rr rr rr r4r5)r2rr4r3)rr r2rr0r+r4r1)rrr4r)r4r_)rprWr4r_)rqr_r4r5)rprWr4r5)rqrWr4r)rrWrRr_rr3rrrr3rdr5r4rrL)rr3rErr4r5)rr3r4r)rJr3rr3r4r3)rr3rir3r4r3)r#)rr+r4r0) rr3rr3rqr3rr+r4rW) rrWrqr3rr3rr+r4rW)rr5rr5rrr4rW)r4r)rr1rrrr_r4r) rrrRr3rTr3rUrr4rW)rRr3r4r3)rrrRr3rTr3r%r3rIrrPrr4rW)rr+)rqrWr4r5rp)rr@r4r5)rqrWrr|rr3r4r)rprWrr|rr3r4r5)rr+r4r_) rrrRr3rTr3rr3r4rW) rSr3rhr3rr+rrr4r)rqrWrxrr4r5) rr+rr1rrrrr4r3)"rr3rr3rTr3rRr3rSr3rr3rUr3rrrwrrrrrrr+rr1rrrr5rrAr4rW) rqrWrr+rr5rrAr4rW)rrWr=r) rr+rr1rrrr5r4rW)r4r)rr3r4rW)rr3rSr3rrr4r ) r,r3r~r3r2r3rhr3r4r5)r7NNr7r7r7r7r7)r+rrr3rrrrrSr3rr3rr3rr3rr3r4r)r,r3r4r)r rNror5r4r)rrrUr3r4rW) rrrqr3r%r3rIrrPrr4rW)rr+rr5r4rW)rrrrr4r3) rrrJr3rrWr:r0r4r)r4rZ) rrrRr3rTr3r%r3rqr3r4rW)rrrrr4r5)rrr7rr4r+)rrrRr3rTr3rr3rr3rrrrr4rW)rrWr4r)rr3rr5rr+r4rW)rqrWrr+rr5r4rW)rqrWrr|r4r)r4r)rrr r5r4rW)r rNr4r)rRrrSrrTrrUrrr5rr+rr5rrrrr4rW)rr5rr+rrr4r5(r` __future__rr;loggingrr+rrrrrfrhrGrrr<r contextlibr dataclassesrrrr http.serverr r pathlibr typingr r rrrrrr urllib.parserrrr>rrrrrrrragent.credential_persistencerutilsrrr r! getLoggerr]rrr@rr(rrTrrrrrrrq!ACCESS_TOKEN_REFRESH_SKEW_SECONDSNOUS_INVOKE_JWT_MIN_TTL_SECONDSrrrMINIMAX_OAUTH_CLIENT_IDrrMINIMAX_OAUTH_GLOBAL_BASEMINIMAX_OAUTH_CN_BASEMINIMAX_OAUTH_GLOBAL_INFERENCEMINIMAX_OAUTH_CN_INFERENCErrDEFAULT_GITHUB_MODELS_BASE_URLDEFAULT_COPILOT_ACP_BASE_URLDEFAULT_OLLAMA_CLOUD_BASE_URLrHDEFAULT_ACTUAL_LOCAL_BASE_URLSTEPFUN_STEP_PLAN_INTL_BASE_URLSTEPFUN_STEP_PLAN_CN_BASE_URLrr hermes_clir*_HERMES_CLI_VERSIONr'CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDSXAI_OAUTH_ISSUERrsr~XAI_OAUTH_SCOPErrarr&QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDSr rrrr)SPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDSrrrr1rarrrCrLrNrr r_list_providers_for_registryr,rPrQenv_varsrZ _api_key_varsrL _base_url_var display_namer2r&r-rrrrrr%rTrEr]ruryrrr|rrrrrrrrrrrrLockrrrrrlrernrVr^rfrerirmrgrnrsrurzrrrrrrrrrrrrrryrCrHrLrOrqrPrRr-rVrZr^rbrjrrrrrrrrrrrrrrrrrrrrrrrrrr rrr"r$r+r1rFr]rdrkrpr|rrrrrrrrrrrrrr rr#r,&CODEX_QUOTA_PROBE_MIN_INTERVAL_SECONDSr-r8r/rrrrrJrLrSrUrWr[r_rdrhrkrtrrrrrrrrrrrrrrrrrrrrrrrrrr-r/r6r0r7r?rHrrMrOrvr{rrrrrrrrrrrrrrrrr'rrrrrrrrrrrirlrnr|rrrrrw_MINIMAX_OAUTH_ERROR_BODY_LIMITrrrrrrrrrrrrr rrrrr!r3r6rYrcrBr^s&$#"""""   %%%%%%((((((((''''''''::::::::RRRRRRRRRRRRRRRRRRRR6666666666  DCCCCCCCMMMMMMOOOOOOOOOOOO  8 $ $LLLL EEEMMMM FFF <H%0,0'($'!"C()%@2@9G42!CA%'"3!@. 75 :"G F6=$=======$$$#$<':<<*-'&-PPP<R/DDD )-%9A),&$B!;H[A,/)\ "  y*1">@@@@6           h0 NN  %/5(    h0NN  "1 h0 ..  6,* !h00  4"5 1h0<..  "0 =h0H  5(& Ih0X~~  9M/ Yh0h>>  !$7/ ih0v nn  M=* wh0F >>  9G'    Gh0V>>  8@(   Wh0lnn  &7- mh0z~~  :-+ {h0J ^^  8-) Kh0Z >>  ;)'    [h0j nn  2,* kh0z~~  =-+ {h0h0J^^  0!19)!!9N(BDD   Kh0`  6\- ah0p~~  S/- qh0@>> *JM7 Ah0P..  ?0. Qh0`  8., ah0p >>  0)'    qh0@ nn  @,* Ah0P..  <0. Qh0`NN  720 ah0p>>   ;1/   qh0J  <., Kh0Z>>  =&& [h0j nn  :,* kh0z  @., {h0JNN  8,* Kh0Z~~  L+ [h0h0jn     $^  31 A h0h0h0hhhhZ  HHHHHH++--HH 8( ( (  =I % %S\ %  8b b b ppppppp gggggimnn &4nx!-SX"|*:cl*0b ' ' ' #(#k H HF...,=ch,G!&) H/H4   D D3    "    89      ))))r4gY(S o>o>orHICEvEvEvyNO  %%%%P/"/"/"/"/"d====@ 5 5 5 5./11111 111"     5 5 5 5BKKKK&DDDD---- >B[[[[[[,%%%%>!!!!H22229;::::"0)."2"2LLLLDDDDN6#'8B<B<B<B<B > > >.1: $;11 ,,,,^ D D D D, 6 6 6 6    &: @: *2"&      QQQQQ"&#;#;#;#;#;#;R!%      &/Y 0&&"CCCC66662>MsIIIIIEEEEEP%%%%* $ F @    6     44444 #&*0#&*(((((( ( ( ( ( ( - - - - -!!!!! HHHH !!!!! HHHH 4444*11110#+#+#+#+R#$$$$$$^04!!!!!!V",,,,,,d"======D $ I CCCCCCL&::::z\)\)\)\)DJ*3 * *    6666r     KO' ' ' ' ' ' d)-......j;? b,b,b,b,b,J%%%%%8    (" CCCCCCL))))XH $ G MMMMMM`,*-&DFFFFF().**0#"H RRRRRRj00000fHHHHV%%%%X#6#6#6#6L-1//////dXXXX(P(P(P(P\+/"&(<)<)<)<)<)<)~$D&&&&R5555p.....j! ______L ((((((Z $*. \\\\\\F( $#+/      N6&1K1K1K1KV.*9?,,0000(25N6    F@H@H@H@HF< H H H H".R(R(R(R(jF"DDDDDDN7W7W7W7W|" 6*6*6*6*6*6*r    &+IN,,377777  "## A NNNNNNp#!% $#*.!##GK#ddddddT"GK @ 888888vUUUU"## CCCCCCT    8)8)8)8)H#X\\\\\ # # # # # # # #B1(1(1(1(h<<<<F" 6 6 6 6 r> > > > B* * * * Z%%%%P<      FJJJJZNNNNb%%%%^$(<<<<<~$AAAATTTT    . $$$$$$H37.2!]]]]]@ "" GLGLGLGLGLGL\" AIAIAIAIAIAIN!''''''TFFFFV"CCCCCCLDDDDR#, 1%%%%%%P&&&&&''''T++++ ))))BBBBJ%%%%D!PPPPPPh8<EEEEEEPZZZZ2,,,,`%G#&&&&&&R$     &*(,#!#<@IIIIIIX6666(!<@ @U@U@U@U@U@UFIIIIX;;;;;;sICCCCC%$C%+D22D<;D<=CTT  T