+ WjKa0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIH t ^RI H t H t H t H t ^RIHt^RIHtHtHtHt^RIHt^RIHtHtHtHtHtHtHt]P>!R 4t R t!R t"R t#R t$R t%Rt&Rt'Rt(Rt)Rt*Rt+!RR]4t,RR/RRllt-Rt.Rt/Rt0Rt1Rt2Rt3Rt4R t5R!t6R"t7]8!].]1]2]704t9]8!]4]504t:R#t;].R$]; 2]/R%]; 2]0R&]1R']6R(]7R)]2R*]; 2]3R+]4R,]5R-/ tR2R3lt?R4R5lt@R6R7ltAR8R9ltBR:R;ltCR<R=ltDR>R?ltERR@RAlltFRBRCltGRDREltHRFRGltIRHRIltJ]8!RJ04tKRKtLRLRMltMRNROltNRPRQltORRRSltPRTRUltQRVRWltRRXRYltSR],]33R]].3R]].3R],]33R],]23R]]/3R]]/3R]]13R]]03R]]/3/ tTRZ]UR[&]]V]W]3,.]3,tXR\R/R]R^lltYR_R`ltZRaRblt[RcRdlt\ReR/RfRgllt]RhRilt^RjRklt_RlRmlt`RnRoltaRpRqltbRtcRrtd] !RsRt44te/tfRu]URv&RwRxltgRyRzlthR{R|ltiR}R~ltjRRltkRRltlRRltmRRRR/RRlltnR](RRRR/RRlltoRRltpRR/RRlltqRtr]8!0Rm4ts]8!RR04ttRtuRRRRRRRR/tvRtwRtxRtyRtzRt{RRlt|RRRRRR/RRllt}RRRllt~RRRR/RRlltRRltRRltRtRRltRRltRRltRRltRtRRltRRltRRltRt^RIHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHt^RIHtHtHtHtR#)uNous free-tier identity: the ``anonymous`` auth method of the ``nous`` provider. The identity is created in two places: by the desktop's first install, which claims the welcome trial (``hermes_cli.welcome_trial``), and on the first hosted connector action for anyone without a Nous identity (``tools.connectors.gateway.config.ensure_guest_identity``, gated by ``guest_allowed``). Either mints an anonymous Nous account (``POST /api/anonymous/create``); its ``anon_`` credential is later exchanged for short-lived JWTs (``POST /api/anonymous/token``). The result is persisted as the singleton ``providers.nous``. Only a guest stamped with the trial claim carries inference (:func:`free_inference_active`), on every surface of the install once the desktop claimed it: chats, cron, side agents, workers, the CLI. Every other guest serves connectors and managed tools. In the resolver ladder (``resolve_provider``) a guest that carries inference sits directly above the implicit AWS Bedrock chain (NS-829): any explicit provider (env key, ``model.provider``, OpenRouter pool, a logged-in ``active_provider``) beats it, and the ladder never creates one. Only two mechanics differ from an OAuth login and both are isolated behind ``is_guest_state``: token acquisition (re-exchange the ``anon_`` credential; there is no refresh token) and routing (the welcome inference host, single model ``nous/welcome``). Users are never shown the words guest / anonymous / account for this state: surfaces say "Nous · free tier". Two user-facing verbs reach the same flow, both keeping the identity's connectors: ``hermes auth upgrade`` in a terminal and ``/login`` inside a chat. Lifecycle lives in ONE primitive, :func:`_reconcile_and_provision`: adopt what the shared store already holds, else mint under the shared-store lock. :func:`ensure_portal_identity` (connectors) and the welcome-trial claim are its only callers; nothing else calls :func:`mint_guest`. ) annotationsN) dataclass)datetime timedeltatimezoneUTC)Path)AnyCallableDictOptional)parse_retry_after_seconds) AuthErrorDEFAULT_NOUS_PORTAL_URLDEFAULT_NOUS_WELCOME_URLNOUS_INFERENCE_INVOKE_SCOPEWELCOME_CLAIM_FLAG_decode_jwt_claimshttpxzhermes_cli.auth anonymousz nas-anonymousz nous/welcomezx-anonymous-api-secretHERMES_ANON_API_SECRETHERMES_PREVIEW_FULL_CONNECTORS@uNous · free tierzRRun `hermes auth upgrade` to sign in with a Nous account, or /login inside a chat.ztYou're not signed in. Free inference and connectors are always on. Run `hermes auth` to sign in with a Nous account.c]tRt^DtRtRtR#)AnonCredentialDeadzNAS no longer knows this ``anon_`` credential (reaped, or claimed into a real account). The one client rule for reap AND claim: mark dead, re-mint on the next need. N)__name__ __module__ __qualname____firstlineno____doc____static_attributes__rHC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\anon_auth.pyrrDsr"r retry_afterc(V^8dQhRRRRRRRR/#)messagestrcoder$zOptional[float]returnrr)formats"r# __annotate__r,Ks/mmsm#mmR[mr"c*\WW!\9R7#)zgAn ``AuthError`` for a free-tier failure *code*; terminal-ness is the code's (``ANON_TERMINAL_CODES``).r)r$ retryable)rANON_TERMINAL_CODES)r'r)r$s&&$r# _anon_errr1Ks W[XkLk llr"anon_gate_closedanon_gate_pausedanon_rate_limitedanon_pow_requiredanon_account_lockedanon_credential_deadanon_unreachableanon_server_erroranon_challenge_requiredanon_signin_requiredzSigning in is free.z3This version can't be used without a Nous account. z8Using Hermes without signing in is paused for a moment. ziLots of people are getting started right now. Try again in {wait}. Signing in is free and skips the wait.zThe Nous server asked for a proof of work, but that isn't implemented in your Agent yet. Sign in with a Nous account to continue.z7Finish the quick check in your browser, then try again.zPFree guest access isn't available here. Sign in with a Nous account to continue.z0This session can't continue without signing in. z0Your session ended. A new one starts on its own.zSThe Nous service couldn't be reached. Check your internet connection and try again.z5The Nous service had a hiccup. Try again in a moment.c V^8dQhRRRR/#)r&secondsr r*r(r)r+s"r#r,r,sEE3E3Er"c\R\T;'g^44pV^8:dR#V^Z8dR#VR8dR\ V^<, 4 R2#\ VR, 4pV^8:dR#RV R2# \\3dRpLei;i) zA rounded, spoken duration for user copy: "a few seconds", "about a minute", "about 5 minutes", "about an hour". Never a raw second count.z a few secondszabout a minuteizabout z minutesz about an hourz hours)maxfloat TypeError ValueErrorround)r=shourss& r# friendly_waitrGs U7<yZ^@_ ``r"cV^8dQhRR/#r&r*Optional[dict[str, Any]]r)r+s"r#r,r,s4r"c^RIHpHpV!V!4R4# \d"p\P RT4Rp?R#Rp?ii;i)zXThe profile's ``providers.nous`` state without locking or network (status/picker reads).)_load_auth_store_load_provider_staterVz guest: auth store unreadable: %sN)hermes_cli.authr{r|rZr[r\)r{r|excs r#current_nous_staters=F#$4$6??  7=s  A?AcV^8dQhRR/#rQr)r+s"r#r,r,s0040r"c(\\44#N)rhrrr"r# has_guestrs ,. //r"cV^8dQhRR/#rQr)r+s"r#r,r,s&&$&r"c^RIHpV!4#)a This activity is work for the Desktop app on this machine: a request from, or a turn of a chat created by, a connection ``process_identity.local_desktop_client`` accepted. Never an SSH, URL or cloud backend, a shell the desktop launched, or the gateway's other clients.serves_local_desktop_now)hermes_cli.process_identityrrs r#on_local_desktop_backendrsE # %%r"c V^8dQhRRRR/#rbr)r+s"r#r,r,s____r"cVf \4MTp\V4;'d*VP\4RJ;'d \ 4#)zThe welcome trial carries inference: a guest that claimed it and guests still allowed. Only the claim is the local Desktop's (``welcome_trial``); once claimed, every surface of the install runs on it. *state* defaults to the profile's.T)rrhrLrr`rgs&r#free_inference_activers?%*M  uE % ^ ^UYY/A%Bd%J ^ ^}^r"cV^8dQhRR/#r&r*r(r)r+s"r#r,r,s::S:r"c2\4'd\#R#)aThe last rung of model resolution, below every model the user named (``model.default``, a cron or task pin): ``nous/welcome`` while the welcome trial carries inference, else ''. Never written to config.yaml, so it stops applying the moment the user configures a real model.rt)r GUEST_MODELrr"r# trial_modelrs011;9r9r"cV^8dQhRR/#rQr)r+s"r#r,r,s##t#r"c\4#)aeTrue when the profile's Nous identity is a guest that carries inference here. Profile-level: use for status, picker and notice surfaces. Routing decisions (which model a request may carry) must use :func:`route_is_welcome_host` on the SELECTED runtime instead: a credential-pool entry can pick a paid Nous key while the profile singleton is still a guest. )rrr"r#has_free_tier_accountrs  ! ""r"c V^8dQhRRRR/#rbr)r+s"r#r,r,sFF3F4Fr"cH\V4;'d\V4'*#)zA guest that does not carry inference here: it serves connectors and managed tools only, so inference, account and status readers treat the profile as not signed in.)rhrrgs&r#guest_without_free_tierrs  % E E)>u)E%EEr"cV^8dQhRR/#rQr)r+s"r#r,r,sJJJr"cH^RIHp\4;'d V!R4R8H#)resolve_providerautorV)r}rrrs r#free_tier_routers!0 " I I'7'?6'IIr"zwelcome-api.nousresearch.comHERMES_EXTRA_WELCOME_HOSTScV^8dQhRR/#)r&r*zfrozenset[str]r)r+s"r#r,r,sHH~Hr"cT\PP\4;'gRpVP R4Uu0uF8qP 4'gKVP 4P 4kK: ppV'd\\V4,#\#uupi)zY``WELCOME_HOSTS`` plus any ``HERMES_EXTRA_WELCOME_HOSTS`` entries (lowercased hostnames).rt,) osenvironrLEXTRA_WELCOME_HOSTS_ENVsplitstriplower WELCOME_HOSTS frozenset)rawpartextras r# welcome_hostsrsn **..0 1 7 7RC.1iin Mnd !TZZ\   !nE M/4=9U+ +G-G Ns B%"B%c(V^8dQhRRRRRRRR/#)r&rjr base_urlmodelr*r)r+s"r#r,r,s(  #  S S r"cVR8XdF\V4'd5V'd'V\8wd\PR\V4\#V#)aJModel policy at agent START: on the Nous welcome host the model is ``nous/welcome``; anywhere else the caller's model stands. Used once, when the route is first finalized. Mid-conversation route changes go through :func:`route_can_serve_model` instead: a conversation's model is never silently rewritten by a credential rotation. rVz7Nous free tier: using %s instead of configured model %s)route_is_welcome_hostrr[inforjrrs&&&r#pin_model_for_routers? 63H== Uk) KKQS^`e f Lr"c(V^8dQhRRRRRRRR/#)r&rjr rrr*rRr)r+s"r#r,r,s(--C-3-s-t-r"cfVR8wg\V4'gR#V'*;'g V\8H#)aEligibility for a credential ROTATION: the welcome host serves only ``nous/welcome``, so a conversation on any other model must not be rotated onto it (and a ``nous/welcome`` conversation may move to the portal host, which serves it too). Non-Nous routes are always eligible.rVT)rrrs&&&r#route_can_serve_modelrs/6!6x!@!@9 , ,,,r"c V^8dQhRRRR/#)r&rr r*rRr)r+s"r#r,r,s # #C #D #r"c^RIHpT!\T;'gR44P;'gRP 4pT\ 49# \ dR#i;i)aThe routing predicate for the free tier: the welcome host serves exactly ``nous/welcome``. Keyed on the resolved endpoint, never on profile state, so a paid pool credential routed to the portal host keeps its model even when a guest singleton exists beside it. )urlparsertF) urllib.parserr(hostnamerrCr)rrhosts& r#rrs[ &X^^,-66<<"CCE =? "" sAAA A! A!c$V^8dQhRRRRRR/#)r&rrr rr*rRr)r+s"r#r,r,)s&IIIIIr"c>\V4;'d \V4#)zCThe request went to the free tier's host on a free-tier credential.)rrv)rrrs&&r# on_free_modelr)s  * H H/A%/HHr"cV^8dQhRR/#rr)r+s"r#r,r,.s;;S;r"cx\PP\4;'gRP 4#)rt)rrrLANON_SECRET_ENVrrr"r# anon_secretr.s& JJNN? + 1 1r 8 8 ::r"cV^8dQhRR/#)r&r*zdict[str, str]r)r+s"r#r,r,2s~r"c\^RIHpRRRV!4/p\4;p'd W!\&V#)r) user_agentz content-typezapplication/jsonz user-agent)hermes_cli.anon_challengerrANON_SECRET_HEADER)rheaderssecrets r# _anon_headersr2s141<NGv&,"# Nr"zdict[tuple, tuple] _NAS_REFUSALS overridesc(V^8dQhRRRRRRRR/#) r&responsezhttpx.Responseactionr(rzOptional[dict[tuple, _Verdict]]r*dict[str, Any]r)r+s"r#r,r,Ls,999),99X99r"c&VP4p\V\4'g/p\ VP R4;'gR4pVP pVR9dV#VPR4'dRpV'd>VP WT34;'gVP VR34pV'd V!V4h\P WT34;'g?\P VR34;'g VR8Xd \\3M \\3wrxV\8Xd%\PRYV'dRV 2MR4\VP4p V!\!WR7WV\"9R7h \d/pEL}i;i) errorrtpow_NzNous free tier %s failed (%s%s)z: r$r.))jsonrCr]r^r(rL status_code startswithrrANON_POW_REQUIREDrMr[rr rrOr0) rrrpayloadrstatusbuildclsr)r$s &$$ r#_raise_for_anon_statusrLsh--/ gt $ $  G$** +E  ! !F   vo.OO)--2O . ""F?3ll}7H7H&RV7Xll7<i!23YXiLjC    5vW\E7|bde+H,<,<=K >T$77 99) sE?? FFcV^8dQhRR/#r&r*rr)r+s"r#r,r,iskk>kr"c\PP\4;'gRP 4pVR9dRVR9/#/#)zThe ``/api/anonymous/create`` body: ``{"preview_full_connectors": bool}`` when the env var is ``1`` / ``true`` or ``0`` / ``false``, else ``{}``.rtpreview_full_connectors)1true0false)rr)rrrLPREVIEW_FULL_CONNECTORS_ENVr)rs r#mint_request_bodyrisG ::>>5 6 < <" C C EC@CGb@b %sm'; <jhjjr"c$V^8dQhRRRRRR/#)r&client httpx.Clientportal_base_urlr(r*rr)r+s"r#r,r,ps!  | c n r"cpVPVPR4 R2\4\4R7p\ VRR7pVP R4p\ V\4'dVPR4'g5\PR4\\\,\4hV#) z```POST /api/anonymous/create`` -> ``{user_id, org_id, token, idle_ttl_days}``. Token shown once./z/api/anonymous/createrrzsign-up)rtokenanon_z-Nous free tier sign-up returned no credential)postrstriprrrrLr]r(rr[rr1rKrM)rrrrrs&& r# mint_guestrps{{  ! !# & ''<=}]n]prH$Xi@G KK E eS ! !)9)9')B)B CD)*;<>OPP Nr"c V^8dQhRRRR/#)r&rr r*rRr)r+s"r#r,r,sFFcFdFr"c^RIHp\V4pV!VPR44V!VPR44,p\ V4;'d \ V9#)zc*token* carries a scope claim and it lacks ``inference:invoke`` (a scopeless JWT reads as today's).) _scope_valuesscopescp)hermes_cli.auth_nousrrrLrRr)rrclaimsscopess& r#is_connectors_onlyrsM2  &F 6::g. /- 5@Q2R RF < E E7vEEr" skew_secondsc$V^8dQhRRRRRR/#)r&rcr rz Optional[int]r* Optional[str]r)r+s"r#r,r,s' K K K} KP] Kr"caa^RIHo\V\4'gR#T\ V4'dVP R4MR3pVUu.uFmp\V\4'gK\VP R4\ 4'gKBVR,'gKSVR,VP R43NKo pp\VV3RlV4R4pT;'gV'dSfV^,^,#R#uupi)aThe bearer a connectors / managed-tools call sends: the profile's token (for a guest the inference one, a superset), else a guest's connectors-only token, preferring one that outlives *skew_seconds*. ``None`` also accepts an expiring token (availability probes).) _is_expiringNconnectors_token access_token expires_atc3b<"TF$wrS!TS;'g^4'dK VxK& R#5i)rNr).0rexprrs& r# (held_connectors_token..s'Z:5\#|GXGXWX5Ys / / /)r}rr]r^rhrLr(next)rcrslotsrEheldlivers&d @r#held_connectors_tokenrs- eT " " ^E5J5JEII01PT UE>C ee!T" 5'1!%%2G'M 5RSTbRcRc 5Q~ l 3 4eD e ZZ\` aD  J J$<+?DGAJJTJ es C?("C? C? C?c 0V^8dQhRRRRRRRRRRR R/#) r&rrrr( anon_token auth_staterpurposer*r)r+s"r#r,r,s>&& &+.& ``{access_token, expires_in, inference_base_url, ...}``. Raises :class:`AnonCredentialDead` on 404 ``unknown_token`` / 401 (reaped or claimed), and :class:`~hermes_cli.anon_challenge.AnonChallengeRequired` (carrying what the status poll needs: portal, credential, and the *auth_state* whose ``tls`` block the mint used) on a browser challenge. )anon_challengerz/api/anonymous/tokenrrrrc V^8dQhRRRR/#r&bodyrr*rr)r+s"r#r,'exchange_anon_jwt..__annotate__saaa9ar"c.<SPVSSSR7#))rrr)challenge_error)rrrrrs&r# challenge$exchange_anon_jwt..challenges'-- /jU_.a ar"c V^8dQhRRRR/#rr)r+s"r#r,rsII^I Ir"cD<SPVPR44#)r')signin_required_errorrL)rrs&r#signin!exchange_anon_jwt..signins33DHHY4GHHr"c V^8dQhRRRR/#)r&_bodyrr*rr)r+s"r#r,rsRR^R Rr"c@\\\,\4#r)r1rKr)r)s&r# proof_of_work(exchange_anon_jwt..proof_of_works*+<=?PQQr"ztoken exchange)rrr z/Nous free tier token exchange returned no token)challenge_required)r-rr-N)signin_required)r0 access_denied) hermes_clirrrr client_inforr]rLr(r[rr1rKrMrnote_optional_challenges) rrrrrrr!r&r+rrs &ffd$ @r#exchange_anon_jwtr6s *{{  ! !# & '';OPP gn5 6 6//I Nr"c$V^8dQhRRRRRR/#)r&rcr exchangedr*Noner)r+s"r#r,r,s" % %> %n %QU %r"c^RIHpVR,p\V4p\P!\ 4pVP R4p\V\\34'd'\P!\V4\ R7pM5T\\VP R4;'gR4R7,p\V4'dRVRVP4/VR &R #V!VP R 44;'g\pVP R 4;'g+VP R 4;'gVP R 4p \V \\ 34'dRP#RV 44p TP%TRT VP4VP4\'^\Wu, P)444\+VP R4;'g\,4R7WR &RF&p VP V 4'gKW,W &K( VP/RR 4R #)zWrite a fresh exchange result into a guest state in place: an inference token (token, expiry, routing) into the state itself, a connectors-only one into ``connectors_token`` beside it.))_validate_nous_inference_url_from_networkr r )tz expires_ini)r=r rNinference_base_urlrr c38"TFp\V4xK R#5ir)r()r rEs& r#r*apply_exchange_to_state..s/AQsBearerrm)r  token_typer obtained_atr r=rm refresh_token)user_idorg_id)rr;rrnowrrLr]intrA fromtimestamprr isoformatrlisttuplejoinupdater@ total_secondsr(ropop) rcr8r;r rrHr r  inference_urlrkeys && r#apply_exchange_to_staterTsO^,L  -F ,,s C **U C#U|$$++E#J3? 9S|1L1S1SPS-TUU ,''%3\>@ABN3HH7HI K #0 $ ==  "EJ% IIot$r"cV^8dQhRR/#rr)r+s"r#r,r,sPP#Pr"cV^RIHpV!4;'g\PR4#)r_nous_portal_env_overrider)rrXrrrWs r#_portal_base_urlrYs"> % ' B B+B J J3 OOr"c V^8dQhRRRR/#)r&rcr r*rr)r+s"r#r,r,s\\\ \r"c\V\4'gR#\V4'dVPR4#VPR4#)zStable identity of a Nous credential: the anon_ token for a guest, the refresh token for an account. Used to decide whether two stores hold the SAME identity.NrrE)r]r^rhrLrgs&r#_shared_identity_keyr\s; eT " "&4U&;&;599\ "[?A[[r"c ,V^8dQhRRRRRRRRR R/#) r&rrportalr( auth_storer welcome_claimrRr*r)r+s"r#r,r,s1s $)7r"ch^RIHpHp^RIHp\ W4pR\ R\RVR,R\RVPR 4R VPR 4R VPR 4R VPR 4\V/ pV!VR VRR7V!V4V!V4\PR4V#)a[Mint under the caller's locks. The identity is persisted as soon as ``create`` succeeds, BEFORE the exchange: a 429 or timeout on the exchange must not lose a credential NAS still honours (the next attempt exchanges the stored one instead of minting again). *welcome_claim* is written in that same save, so a claimed guest is never left unstamped.)_store_provider_state_save_auth_store)_write_shared_nous_staterermrr client_idrrrFrG idle_ttl_daysrVF set_activez&Nous free tier ready (identity minted))r}rbrcrrdrrfroANON_CLIENT_IDrrLrr[r) rr^r_r`rbrcrdmintedrcs &&&$ r# _mint_lockedrks H=  'F'9JfWo{N6==-6::i((FJJx4HO4M E*feFZ U# KK89 Lr"N@ct]tRtRt$RtR]R&R]R&R]R&R]R &R]R &^tR ]R &R RltRRltRt R#) MintFailureizEWhy the last mint for a profile failed and when the next one may run.r(r)r'rRr/rAr$ not_beforerIattemptscV^8dQhRR/#)r&r*rAr)r+s"r#r,MintFailure.__annotate__see5er"c VP'gR#\R\VP\P !4, ^44#)r?)r/r@rDrotime monotonicselfs&r# remainingMintFailure.remainings6...sdc#uT__t~~O_=_ab7c.ddr"cV^8dQhRR/#rr)r+s"r#r,rr#sUUNUr"c  RVPRVPRVPRVP'd&\P!VP 44/#^/#)zThe wire shape every status RPC carries: ``{error_code, error, retryable, retry_after}`` with ``retry_after`` the seconds still to wait (whole, rounded up). error_coderr/r$)r)r'r/mathceilrxrvs&r# as_payloadMintFailure.as_payload#sUdii$,, T^^dnnntyy)9:U URSU Ur"rN) rrrrr __annotations__rprxrr!rr"r#rnrns<O I LOHce UUr"rnzdict[str, MintFailure]_mint_failurescV^8dQhRR/#rr)r+s"r#r,r,-sKKKr"c6^RIHpHpV!4fR#V!4#)rget_hermes_home_overridehermes_home_keyrt)hermes_constantsrrrs r#_mint_memo_keyr-sJ)+32J9JJr"cV^8dQhRR/#)r&r*zOptional[MintFailure]r)r+s"r#r,r,2s00#80r"c<\P\44#r)rrLrrr"r#_mint_failure_for_profiler2s   n. //r"cV^8dQhRR/#r&r*r9r)r+s"r#r,r,6s//T/r"cB\P\4R4R#r)rrQrrr"r#_clear_mint_failurer6s~'.r"cV^8dQhRR/#rr)r+s"r#r,r,:s4r"c.\P4R#r)rclearrr"r#reset_mint_memo_for_testsr:sr"cV^8dQhRR/#rxr)r+s"r#r,r,>s5535r"cJ\4pV'dVP4#R#)zThe most recent mint failure for this profile as a wire payload, or None (never failed, or cleared by a later success / retirement).N)rr)failures r#last_mint_failurer>s"()G#*7   44r"c V^8dQhRRRR/#)r&r~ BaseExceptionr*rr)r+s"r#r,r,Es9r"c |\V\4'dVP'dV#\\\ 3pV\ P\ P3,p\W4'd\M\p\\V,V\VRR4R7pWnV# \dLVi;i)a Every mint failure as one ``AuthError`` with a code: the portal's own refusals already are; the wire's (timeout, DNS, refused connection) and anything else get a code here. Pure: *exc* is never mutated (an uncoded ``AuthError`` is re-raised as a server-error twin).r$Nr)r]rr) TimeoutErrorConnectionErrorOSErrorrTimeoutExceptionTransportErrorrZANON_UNREACHABLErMr1rKru __cause__)r~ transportr)wrappeds& r#classify_mint_exceptionrEs#y!!chhh 8I !7!79M9M NN  *#99 ?PD)$/73P]_cCdeG N    s'B-- B;:B;c V^8dQhRRRR/#)r&errrr*rnr)r+s"r#r,r,VsI+r"c d\VP;'g\4p\4pV'd%VPV8XdVP^,M^pV\ 9pV'gR\ R4reMVPpV'd \ V4M*\\V\\44^, ,pV\8Xd\V\4p\RV4p\P!4V,p\!V\V4WEWcR7pV\"\%4&V#)r?infg?)r)r'r/r$rorp)r(r)rMrrpr0rAr$_MINT_RETRY_LADDERminlenANON_GATE_PAUSEDr@_MINT_PAUSED_MIN_WAITrtrurnrr) rr)previousrpr/rJrohintedrs & r#_note_mint_failurerVs sxx,,, -D(*H(0X]]d5Jx  1$PQH//I e j &uV},>s8SQcMd?ehi?i,j # #t23D3~^^%, tSX%/DG'.N>#$ Nr"forceFr`c(V^8dQhRRRRRRRR/#)r&timeout_secondsrArrRr`r*ryr)r+s"r#r,r,js*-#-#-#t-#,0-#=U-#r"c d^RIHpHpHpHpHpHp^RIHp H p H p H p \4p V!4;_uu_4V!4pV!VR4pV !\VR4R7;_uu_4V !4pV'dr\V4\V48wdY\V4pV!VRV\!V4'*R7V!V4\"P%R4VuuRRR4uuRRR4#V'd'V'g V !V4VuuRRR4uuRRR4#\'4pV'd@V'g8\(P*!4VP,8dRRR4RRR4R#V!RRRR 7pV !VV4;_uu_4p\/VWVR 7uuRRR4uuRRR4uuRRR4# +'giM;;i \0d+p\3T4p\5T4TnTTJdhTThRp?ii;iRRR4M +'giM;iRRR4R# +'giR#;i) aThe lifecycle body, run under profile lock THEN shared lock (the documented order). 1. The shared store is the identity of record for this Hermes root. If it holds an identity that differs from the profile's, the profile adopts it (a stale guest never outlives a sibling profile's sign-in, and never overwrites it). 2. Otherwise the profile's own identity stands. 3. Nothing anywhere: mint, persisting the credential before exchanging it. )_auth_store_lockr{r|rcrb_resolve_verify)_nous_http_client_nous_shared_store_lock_read_shared_nous_staterdrVr)rrgz+Nous identity adopted from the shared storeN)insecure ca_bundler)r`)r}rr{r|rcrbrrrrrrdrYr@r\r^rhr[r\rrtrurorkrZrr mint_failure)rrr`rr{r|rcrbrrrrrdr^r_ profile_statesharedrcrverifyrr~rs$$$ r#_reconcile_and_provisionrjs00gg  F   %' ,Z@ $S#5N O O,.F.v6:N}:]]V %j&%P^_dPeLef , JKP O  ,];$P O   01Gu)9G reconcile with the shared store -> mint. Locks are taken profile first, then shared, matching every other Nous path. Blocking, bounded by ``timeout_seconds``. A failed mint is memoised with a cooldown (``MintFailure``): until it passes, and for a terminal code forever, this returns None without touching the portal. ``force=True`` is the user's own retry: it makes exactly one attempt regardless of the cooldown. Every failure raises an ``AuthError`` whose ``code`` is one of the ``ANON_*`` codes and whose ``retry_after`` / ``retryable`` say what a caller may do next. zLensure_portal_identity: only explicit creators may call this (explicit=True)N)rrr`rz,Nous free tier not set up (%s, attempt %d%s)z, next try in z.0frEz , not retried)drain)rCr`rrrtrurorrZrrurr[rr)rpr/r$rhermes_cli.guest_handoffr) rrrr`rrcr~rnotedrs $$$$ r#ensure_portal_identityrs2 ghh ??')Gu%7%9%9dnn>NQXQcQc>c (7DF 2  L %c*^T2MM6H6M BEJJPUP^P^AFnU%6%6s$;1=Ve g : s7 B!! D3,A"D.D..D3c(V^8dQhRRRRRRRR/#)r&rcrrrrr(r*r)r+s"r#r,r,s*%%~%|%QT%Y\%r"cHVR8Xd \V4'g\RRRR7hVPR4p\V\4'd V'g!\ \ \,\R7h^RIH p\W!V4W0VR 7p\W4VR ,#) aIToken-acquisition seam for a guest: re-exchange the ``anon_`` credential in place and return the minted token. Every caller names its *purpose*: ``"connectors"`` for connector and managed-tool bearers, ``"inference"`` only for a guest that carries the welcome trial. The portal URL is the resolver's canonical one (env override, else the validated stored URL, else the default), never a raw stored value on its own. Raises :class:`AnonCredentialDead` when NAS no longer knows the credential; the caller owns re-minting (:func:`ensure_portal_identity` after :func:`clear_dead_guest`). inferencez&Hermes is not logged into Nous Portal.rVnous_auth_missing)rjr)r)r))_nous_portal_base_url)rrr ) rrrLr]r(rrKANON_CREDENTIAL_DEADr}rr6rT)rcrrrrr8s&&$ r#refresh_guest_staters+&;E&B&B@6Xkll<(J j# & &j !23G!HOcdd5!%e,jT[]IE- ^ $$r" dead_tokenc$V^8dQhRRRRRR/#)r&reasonr(rrr*r9r)r+s"r#r,r,s&aaSaa$ar"c ^RIHpHpHpHpHp^RIHpHpH p V!4;_uu_4V!4p V!V R4p \V 4'dT;'gV PR4p V PR4V 8XdVV!V R4PRR4V!V R4PRR4V PR4R8XdRV R&V!V 4MTp V!4;_uu_4V !4p V 'd0\V 4'dV PR4V 8Xd V!V4RRR4RRR4\4\PR V4R# +'giL:;i +'giLE;i) a@Drop a dead guest so the next need re-mints. Only the identity that actually failed is removed: a stale profile whose credential NAS rejected must not erase a sibling profile's newer sign-in or replacement guest from the shared store. When *dead_token* is None the profile's current guest is treated as the failed one. )rr{r|rc_store_section)_clear_shared_nous_staterrrVr providersNcredential_poolactive_providerzENous free-tier identity retired (%s); a new one is set up on next use)r}rr{r|rcrrrrrrhrLrQrr[r)rrrr{r|rcrrrrr_rcrrs&$ r#clear_dead_guestrs(ddoo   %' $Z8 % 99%))L"9Eyy&%/z;7;;FDIz+<=AA&$O>>"34>48J01 ,E $ & &,.F//FJJ|4LPU4U(0' " KKWY_` ' &  s**E&BE&"?E !E& E# E&& E6 zx-nous-model-switchmodel_not_freefeature_not_freeanon_on_paid_hostnamed_on_welcome_host tier_disabledsession_expiredzThis install is set to use a different Nous server (NOUS_INFERENCE_BASE_URL). Unset it to use the free model, or sign in. {signin}z2This Nous account needs to reconnect. {model_hint}zhUsing Hermes without signing in is switched off right now. Sign in to keep chatting, it's free. {signin}zHermes couldn't renew its connection to the free model. Send your message again, or sign in to keep chatting, it's free. {signin}zTo sign in: /login.z"To sign in: `hermes auth upgrade`.z'Run /model and pick the Nous row again.z/Run `hermes model` and pick the Nous row again.zbThe free model is having trouble responding right now. Try sending your message again in a minute.c V^8dQhRRRR/#)r&rr r*ryr)r+s"r#r,r,2sPPP(@Pr"c |\V\4'gR#VPR4p\V\4'd V\9dR#VPR4pVR9d\ ^\ \V444M^pVPR4p\V\4'd>VUu.uF0p\V\4'gKV'gK%\V4NK2 upM.pVPR4pRTRTRTR\V\4'dV/#R/# \\3d^pLi;iuupi)aThe structured welcome-tier refusal in a gateway 429 body, or None for any other shape. Returns ``{"reason", "retry_after", "alternates", "upgrade_url"}`` with ``retry_after`` an int of whole seconds (0 when the gateway sent none) and ``alternates`` a list of model ids. Nrr$rt alternates upgrade_url)Nrt) r]r^rLr(WELCOME_REFUSAL_REASONSr@rIrArBrCrL)rr raw_retryr$raw_alternatesarrs& r#parse_welcome_refusalr2s dD ! ! XXh F fc " "f4K&K'I7@ 7Rc!Sy!123XY XXl+NQ[\jlpQqQq.M.QJq#4F&1&#a&.MwyJ((=)K fm[, *[#*F*F; PPLN PP z " Ns$'D 1D9D9D9 D65D6rrtin_chatTdoorc ,V^8dQhRRRRRRRRRR/#) r&refusalrrr(rrRrr*r)r+s"r#r,r,Is8bb.bCbtbbfbrubr"cV'dV'd\M\MRp\VPR4;'gR4pVPR4;'g.pV'd V^,M\p\ VPR4;'g^4pV^8d \ V4MRp VR8Xd(V'dV R2MRp V R V R V 2P4#VR 8XdR V 2P4#VR 8XdRV RV 2P4#VR8XdRV RV 2P4#VR8XdRV RV 2P4#RV 2P4#)uGUser copy for a structured welcome-tier refusal: what happened and the one way forward. Never guest / anonymous / claim; ``in_chat`` picks ``/login`` over the terminal verb. ``door=False`` leaves the "To sign in: …" tail off, for a surface that renders the sign-in as a button beside the sentence (the desktop's error card).rtrrr$za little whilerz isn'tzThat model isn'tz. available without signing in, so Hermes uses z# for now. Sign in for more models. rzGThat isn't available without signing in. Sign in to use it, it's free. at_capacityzlChatting without signing in is really busy right now. Sign in to skip the queue, it's free, or try again in z. admission_closedzaChatting without signing in is full right now. Sign in to keep going, it's free, or try again in rate_limitedzNYou've used up the allowance for chatting without signing in. It refreshes in z-. Sign in for a bigger allowance, it's free. zBHermes couldn't send that without signing in. Signing in is free. ) _SIGNIN_CHAT_SIGNIN_TERMINALr(rLrrIrGr) rrrrr&rrservesretryrJwhats &$$$ r#welcome_refusal_copyrIs~ AEgl+;"F X&,," -F\*00bJ(Z]kF  M*//a 0E#(19= 2BD !!#(%.@&FvhO,,2856>DXGHN Q OPVx X _ _ aar"c(V^8dQhRRRRRRRR/#)r&rr r'rr*rr)r+s"r#r,r,gs(#smr"caVR9dR#\T;'gR4P4o\V3Rl\4R4pVfVR8Xd\ V4'dR#V#)aWhich host cross-refusal a gateway 400/403 is; None for any other error. ``"anon_on_paid_host"``: a free-tier JWT reached the paid host. ``"named_on_welcome_host"``: an account or API key reached the free tier's host. ``"tier_disabled"``: the tier is dark (``WELCOME_MODE=off``). Each is deterministic for the request: retrying cannot help. ``"session_expired"``: the 403 names the bearer (``invalid jwt``); a fresh credential heals it. The dark-tier 403 is keyed on the ROUTE, not the message: the gateway's permission error carries only its generic sentence (the detail stays in its logs), so any 403 answered by the welcome host means the tier refused this install. The message needles remain for gateways that do spell it out, and for the two wrong-host 400s.r0Nrtc3><"TFwrVS9gKVxK R#5irr)r needlekindtexts& r#r(welcome_route_refusal..vsT*A,&Vt^*As  r)ir0)r(rr_WELCOME_ROUTE_REFUSALSr)rr'rrrs&&& @r#welcome_route_refusalrgs[Z w}}"  # # %D T*ATVZ [D |# *?*I*I Kr"c(V^8dQhRRRRRRRR/#)r&rr(rrRrr*r)r+s"r#r,r,|s/SSSSdSSY\Sr"c\PV4;'gRpTP\V'dV'd\M\ MRV'd\ M\R7P4#)z3Hermes couldn't reach the free model on this route.rt)rr& model_hint) _WELCOME_ROUTE_COPYrLr+rrr_MODEL_HINT_CHAT_MODEL_HINT_TERMINALr)rrrrNs&$$ r#welcome_route_refusal_copyr|sS"&&t,ee0eH ?? %aew|L\km'.#4H  JJP&(Sr"c$V^8dQhRRRRRR/#)r&rrr rr*rr)r+s"r#r,r,s!S3=r"cVfR#RpVP\4pVf4\VR4'd"\RVP 44R4p\ T;'gR4P4pT'gR#\ \TRR4;'gR4pY48XdR#YC3Tn T# \ dR#i;i \ dR#i;i)aRecord the gateway's ``x-nous-model-switch`` header on *agent* for the next call, if present. The header arrives on a NAMED account's response that asked for ``nous/welcome`` (the gateway served the backing model and billed it normally): the free tier's model no longer belongs in this install's configuration. Recorded here, applied by :func:`apply_model_switch` between calls so a response still streaming is never re-labelled under itself. Returns the backing id. Nitemsc3r"TF-wr\V4P4\8XgK)VxK/ R#5ir)r(rMODEL_SWITCH_HEADER)r kvs& r#r$note_model_switch..s&a3q6<<>M`;`!!s&7 7rtr) rLr hasattrrr rZr(rru_nous_pending_model_switch)rrrvaluebacking requesteds&& r#note_model_switchrs E /0 =WWg66a acghE%++2$$&G GE7B/5526I,5+?( N  s$A B6,C6 CC CCc V^8dQhRRRR/#)r&rrr r*rr)r+s"r#r,r,s''c'm'r"c Z\VRR4pV'gR#RVnVwr#\\VRR4;'gR4V8wdR#Y0nW#3Vn\ P RW#4^RIHpV!4PR4p\V\4'dTM\V\4'dRV/M/p\VPR4;'gR4P4V8XdF^RI HpT!R \\VR R4;'gR4VR 7\ P R W#4\TRR4p \#T 4'dT !RT RT R24T#T# \d!p\ P!R T4Rp?LXRp?ii;i \dT#i;i)aMove *agent* (and the config default, when it still names the switched id) to the backing model the gateway named. Returns the new model, or None when nothing was pending. Runs once per recorded header, between calls. The conversation keeps its history; only the id the next request carries changes, so a promoted account stops relying on the gateway's reverse map. The config write is the same one a sign-in completion uses, so ``hermes model`` and the gateway's config re-read agree with the live session. rNrrtz?Nous gateway asked to switch %s -> %s; applied for this sessionrTdefault_update_config_for_providerrVr) default_modelz#Config default model moved %s -> %sz+model switch: config default left as is: %s_buffer_statusz Model is now z (your account's model; z is the free tier's).)rurr(r_nous_model_switchr[rrYrUrLr]r^rr}rrZr\callable) rrpendingrrrUr model_cfgrr~rs & r#apply_model_switchr!se94@G '+E$ I 75'2 & , ,"-:K!*3E KKQS\f I:"$((1%c400C:VY[^K_K_ 37Geg y}}Y'--2 . 4 4 6) C C 'GE:r:@@bAQX Z KK=y RU,d 3F  ]7)+CI;Ncd e N7N I BCHHI    N s7/A,E-;E-#E-F- F8FF F*)F*guest_notice_showncV^8dQhRR/#rQr)r+s"r#r,r,sSSdSr"c\4p\V4;'d$\VP\44'*#)zZTrue when a guest identity exists and the one-time availability notice has not been shown.)rrrRrLGUEST_NOTICE_FLAGrgs r#guest_notice_pendingr&s/  E  ' R RUYY?P5Q0R,RRr"cV^8dQhRR/#rQr)r+s"r#r,r,s999r"c$\\4RJ#)zPersist ``guest_notice_shown`` on the guest's ``providers.nous`` state (whichever store holds it). Returns True when a flag was written; False when there is no guest to mark.N)set_guest_flagr%rr"r#mark_guest_notice_shownr*s + ,D 88r"c V^8dQhRRRR/#)r&flagr(r*ryr)r+s"r#r,r,s   !9 r"c ^RIHpV!R4;_uu_4wr#p\V4'dVf RRR4R#VPV4'd VuuRRR4#/VCVR/Cp\ W#V4RRR4V# +'giX#;i)zSet *flag* on the guest's ``providers.nous`` state in whichever store holds it, and return the updated state; None when there is no guest.)_provider_state_transactionrVNT)r}r.rhrL_save_guest_state)r,r.r_rc source_paths& r#r)r)s< $V , ,0PKe$$ (; - , 99T?? - , &5%$%*[9 - L - , LsA<A<A<A<< B c(V^8dQhRRRRRRRR/#)r&r_rrcr0rr*r9r)r+s"r#r,r,s0 @ @. @ @VZ @_c @r"c^RIHpHpHpHpHpV!W#!44'dW!VR4R&V!V4R#V!V4pW!VR4R&V!WR7R#)zdWrite the guest's ``providers.nous`` back to the store it was read from (the caller holds its lock).)_auth_file_pathr{ _same_pathrcrrrV) target_pathN)r}r3r{r4rcr) r_rcr0r3r{r4rcr source_stores &&& r#r/r/sToo+011:?z;/7$' 4 rVrrrerrCrBr rErDr tlsF)r force_refreshre)r}r;r<r=r>rr?r@rArrHrrLr>rrKUPGRADED_AUTH_METHOD)r9rrerrrr;r<r=r>r?r@rArHttlrRrcs&$$$$$ r#_account_state_from_tokenrFs srll ,,s C jnn\1= >C:>>*>?@ D D V $ 7 7 > >s C ?,@-Y)@)I)IEjnn\8< >2OZ^^TcEds}} j6JLZ] %f-  O 2N  OE *%`e fE/E- Lr"c V^8dQhRRRR/#)r& account_staterr*r)r+s"r#r,r,s2-2-2->2-r"c^RIHpV!4PR4p\ T\4'dTM\ T\4'dRT/M/p\TPR4;'gR4P4pT\8Hp\TPR 44pT'gT'gRTRR/#TpT'd1^R I H p \T !4PR4;'gR4p^R IHp T !R \TPR4;'gR4T'dTMRT;'dT'*R7RTRR/# \d'p\P RT4RRRR/uRp?#Rp?ii;i \d#p\PR T4RpRp?LRp?ii;i \d'p\P RT4RTRR/uRp?#Rp?ii;i)aAfter a sign-in from the free tier persisted the account: move the config off the free tier's route. Picking the free-tier row may have written ``model.default: nous/welcome`` and ``model.base_url`` = welcome host. An account cannot keep either: the welcome host refuses account tokens, and the portal host serves ``nous/welcome`` as a paid model. When the config is on the free tier's route, ``model.base_url`` becomes the account's inference host and ``model.default`` the recommended default for the account's tier (:func:`hermes_cli.models.recommended_nous_default_model`, the same pick as ``GET /api/model/recommended-default``), through the same config write a plain Nous login uses. A config on the user's own model and host is left alone. Every sign-in completion (CLI ``hermes auth upgrade``, the desktop poller) calls this once, after ``persist_nous_credentials``. Returns ``{"model": str, "changed": bool}``: ``model`` is the default the config now carries (``""`` when it carries none); ``changed`` says whether this call wrote it. Never raises: a failed pick or write is logged and reported as ``changed: False`` so the sign-in itself still counts. rTrzCsign-in completion: config unreadable, default model left as is: %srtchangedFNrr)recommended_nous_default_modelz7sign-in completion: recommended default unavailable: %srrVr>)r clear_defaultz:sign-in completion: could not update the default model: %sT)rYrUrLrZr[warningr]r^r(rrrhermes_cli.modelsrKr\r}r) rHrUrr~r currenton_welcome_modelon_welcome_hostrrKrs & r#settle_after_upgraderRs"7/"$((1"#t,,zRUWZG[G[Is3CacI)-- *00b1779G+-+IMM*,EFO )U33 ED 68<?EE2F#3%*885y : UIt ,,= /\^abY../  LLRTW XE  4SUXY)U334skE !E?0E?8%F/ F/, F/8 F/ E<E71E<7E<? F, F''F,/ G :GG G cV^8dQhRR/#rr)r+s"r#r,r,Ns!!!r"c^RIHpV!V/VB#)zMKeep both the sign-in module seam and the device-flow seam live at call time.)_poll_for_token)hermes_cli.auth_device_flowrU)argskwargspolls*, r#rUrUNsC    r"c^RIHpV!V/VB#)zLKeep the existing auth_nous persistence seam behind the sign-in entry point.)persist_nous_credentials)rr[)rWrXpersists*, r#r[r[TsH D #F ##r")AlreadySignedIn CancelledCode CompletedFREE_TIER_RATE_LIMIT_CARDFREE_TIER_RATE_LIMIT_CHATFailedLOGIN_BUSY_ELSEWHERE LOGIN_COMMAND LOGIN_DM_ONLYLOGIN_NOT_ALLOWEDLOGIN_STARTING SignInStateTimedOutUPGRADE_ALREADY_SIGNED_INUPGRADE_CANCELLEDUPGRADE_DO_NOT_SHAREUPGRADE_NOT_COMPLETEDUPGRADE_NO_DEFAULT_CHATUPGRADE_NO_DEFAULT_TERMINAL UPGRADE_STARTUPGRADE_TIMED_OUTUPGRADE_WAITINGUPGRADE_WAITING_UP_TOWaiting_default_persist_guardformat_wait_line run_sign_in)drain_sign_in_copyrender_sign_in_clirender_sign_in_cli_code upgrade_guestr) unknown_token)r}N)invalid_shared_secret)rN)r0account_locked)r0anonymous_accounts_disabled)r0 circuit_openr/)iN)itemporarily_disabled)g.@rlgr@>rrrrr))zanonymous accounts must user)z+serves anonymous hermes agent accounts onlyr)z#anonymous accounts are not acceptedr)z invalid jwtr)__conditional_annotations__r __future__rloggingr}rrt dataclassesrrrrrpathlibrtypingr r r r agent.retry_utilsr rnrrrrrrr getLoggerr[rfrirorrrrGUEST_MINT_TIMEOUT_SECONDSFREE_TIER_LABEL UPGRADE_HINTFREE_TIER_NOT_SIGNED_INrr1ANON_GATE_CLOSEDrANON_RATE_LIMITEDrANON_ACCOUNT_LOCKEDrrrMANON_CHALLENGE_REQUIREDANON_SIGNIN_REQUIREDrr0ANON_UNREACHABLE_CODES_SIGNIN_IS_FREErKrGrOr`rhrprvrrrrrrrrrrrrrrrrrrrr^r(_Verdictrrrrrr6rTrYr\rkrrrnrrrrrrrrrrrrr rWELCOME_TIER_GATE_REASONSrrrrrrFREE_TIER_OUTAGE_COPYrrrrrr!r%r&r*r)r/rDrFrRrUr[hermes_cli.anon_sign_inr]r^r_r`rarbrcrdrerfrgrhrirjrkrlrmrnrorprqrrrsrtrurvrwrxhermes_cli.anon_sign_in_cliryrzr{r|)rs@r#rs6# !77007   , -  -+ ? %c 8 mm,&%''+-%'3-')<>R!TU#$46G#HI(KOK\]PQ`Pab@MVlKOK\]LkN  E"StS -Tga 0&_:#F J 9:; 7H - #I ;/1EF)-."Y0@$A$&:;02EF(96F*GI'78)./)./!I/?#@ % !  T#s(^$i/ 09[_9:k "F Kt K&R %FP \>) UU U,*,&+K 0/5"(-#e-#38-#`00J0Z_00f%0aaP,#]_&'79K&LMPQEc % 7<HGP.b"bVZbimb<*STSPTS<'Z)S 9  @$+02-j! $<r"