+ WjTa0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI HtHt^RIHt^RIHtHtHtHtHt^RIHtHt^RIHtHtHtHtH t H!t!^RI"H#t#^R I$H%t%]PL!R 4t'](!0RDm4t)R ]*R &REt+R Rlt,RRlt-RRlt.RRlt/RFRRllt0RRlt1RRlt2RRlt3RRlt4RR/R R!llt5R"R#lt6R$RR%RR&R/R'R(llt7R)R*lt8R+R,lt9R-R.R/R0/R1R2llt:!R3R4];4tRGR:R;llt?R<R=lt@R>R0/R?R@lltARAR/RBRClltBR#)HaShared device-code / loopback-PKCE / browser / TLS helpers for interactive OAuth logins. Split out of ``hermes_cli/auth.py`` and re-exported there; origin helpers are imported lazily inside each function so ``hermes_cli.auth.`` patches still intercept (and no import cycle). ) annotationsN)BaseHTTPRequestHandler HTTPServer)Path)AnyCallableDict FrozenSetOptional)parse_qsurlparse) AuthErrorDEFAULT_NOUS_PORTAL_URL%DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDSDEVICE_CODE_GRANT_TYPEOAUTH_OVER_SSH_DOCS_URLhttpx)DeviceCodeExpired)is_truthy_valuezhermes_cli.authzfrozenset[str]_CONSOLE_BROWSER_NAMEScV^8dQhRR/#returnbool)formats"OC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\auth_device_flow.py __annotate__r2s @ @D @c\\P!R4;'gc\P!R4;'gE\;QJd(R\4F'gK R4# R4#!R\444#)u#Detect environments where loopback OAuth can't reach the local browser. Historically only SSH was checked, but #26923 surfaced that **browser-only remote consoles** (GCP Cloud Shell, GitHub Codespaces, AWS EC2 Instance Connect, Gitpod, Replit, etc.) hit the exact same problem — the user has a browser on their laptop but the loopback listener is bound on the remote VM that the laptop's browser can't reach. These environments typically don't set ``SSH_CLIENT`` / ``SSH_TTY``, so the SSH-only check left them with no guidance and no fallback. SSH_CLIENTSSH_TTYc3N"TFp\P!V4xK R#5iN)osgetenv).0vars& r %_is_remote_session..=s>)=#ryy~~)=s#%TF)rr%r&any_REMOTE_IDE_ENV_VARSrrr_is_remote_sessionr-2sz  , ? ?299Y#7 ? ? 3>)=>33 @@  @@ >)=> > @@rc V^8dQhRRRR/#)rvaluestrrrr)rs"rrr@sEE#E$ErcVP4'd&VP4P4^,MRp\PP V4P 4\ 9#))stripsplitr%pathbasenamelowerr)r/tokens& r_names_console_browserr:@sK(- EKKM   !! $2E 77  E " ( ( *.D DDrcV^8dQhRR/#rr)rs"rrrEsAATArc`\PPRR4pV'd\V4'dR#\P P R4'db\\PPR4;'g \PPR44pV'g V'gR#\P!4p\TRR4;'g\TRR4;'gRpT;'d \T4'*# \dR#i;i) aReturn True only when a *graphical* browser is likely to open. On a headless Linux box ``webbrowser.open()`` often resolves to a text-mode browser that takes over the terminal. Heuristics: a ``$BROWSER`` naming a console browser refuses; on Linux a display server (``$DISPLAY`` / ``$WAYLAND_DISPLAY``) is required unless ``$BROWSER`` is set (a console one already returned False, so a set ``$BROWSER`` here is graphical). BROWSERr3FlinuxDISPLAYWAYLAND_DISPLAYnamer7) r%environgetr:sysplatform startswithr webbrowser Exceptiongetattr) browser_env has_display controller candidates r_can_open_graphical_browserrNEs**..B/K-k:: ||w''2::>>)4YY GX8YZ ;^^%  FB/\\7:zSU3V\\Z\I??4Y? @@ sD D-,D-cV^8dQhRR/#)rrr0r)rs"rrr\s  3 rc^RIpVP4;'gRp\P!R4;'g!\P!R4;'gRpV RV 2# \dRpLTi;i)zWBest-effort 'user@hostname' for the SSH tunnel hint; placeholders keep it valid syntax.Nz USERLOGNAMEz@)socket gethostnameOSErrorr%r&)_sockethostnameusers r_ssh_user_at_hostrZ\sp! &&(99M 99V  @ @ ) 4 @ @DV1XJ  ! !sA%A%% A54A5c V^8dQhRRRR/#)rlengthintrr0r)rs"rrrgsZZZSZrc\P!\P!V44P R4P R4R,#)ascii=:NN)base64urlsafe_b64encoder%urandomdecoderstrip)r\s&r_pkce_code_verifierrggs8  # #BJJv$6 7 > >w G N Ns STX YYrc V^8dQhRRRR/#)r code_verifierr0rr)rs"rrrksHHHHrc\P!VPR44P4p\P !V4P R4PR4#)zutf-8r_r`)hashlibsha256encodedigestrbrcrerf)rirns& r_pkce_code_challengeroksK ^^M009 : A A CF  # #F + 2 27 ; B B3 GGrc$V^8dQhRRRRRR/#)r expected_pathr0 display_namerz3tuple[type[BaseHTTPRequestHandler], dict[str, Any]]r)rs"rrrps$#,#,#,),#,8#,rcLaaaRRRRRRRR/o!VVV3RlR\4pVS3#)a7Handler class for an RFC 8252 loopback redirect plus the dict it fills in. Only a GET on *expected_path* is accepted (anything else is a 404 and leaves the result untouched), so a nonce embedded in the path acts as the CSRF ``state`` for authorization servers that do not echo an explicit ``state`` parameter. codeNstateerrorerror_descriptionc:<]tRt^{tRVVV3RlltRRltRtR#)A_make_loopback_callback_handler.._LoopbackCallbackHandlercV^8dQhRR/#)rrNoner)rs"rrN_make_loopback_callback_handler.._LoopbackCallbackHandler.__annotate__|s B BD Brc 2<\VP4pVPS8wd?VPR4VP4VPP R4R#\ VP4pSF pVPVR.4^,SV&K" VP^4VPRR4VP4SR,'dRMRpVPP RS R V R 2P44R#) is Not found.Nz Content-Typeztext/html; charset=utf-8rvfailedreceivedz

z authorization z+.

You can close this tab.) r r6 send_response end_headerswfilewriter queryrC send_headerrm)selfparsedparamskeyoutcomerrrqresults& rdo_GETH_make_loopback_callback_handler.._LoopbackCallbackHandler.do_GET|sdii(F{{m+""3'  "   /fll+F$jjtf5a8s    s #   ^-G H    "(//hzG JJ  "<.yI888> Brc$V^8dQhRRRRRR/#)rrr0argsrrr{r)rs"rrr|s!  c # $ rc R#r$r)rrrs&&*r log_messageM_make_loopback_callback_handler.._LoopbackCallbackHandler.log_messages rrN)__name__ __module__ __qualname____firstlineno__rr__static_attributes__)rrrqrsr_LoopbackCallbackHandlerry{s B B(  rr)r)rqrrrrsfd @r_make_loopback_callback_handlerrps<%dGT7DJ]_cdF#90 $V ++rc 0V^8dQhRRRRRRRRR RR R /#) rhostr0portr] handler_clsztype[BaseHTTPRequestHandler]errCallable[..., AuthError]bind_failed_coderrr)rs"rrrsF h h  h h'C hMe h h hrc !RR\4pV!W3V4# \dpT!RT RT RT 2T4ThRp?ii;i)uBind the loopback listener up front (``port=0`` = OS-assigned) so the redirect URI sent to the authorization server names a port we already own — no probe-close-rebind race.c]tRt^tRtRtR#)8_bind_loopback_callback_server.._ReuseHTTPServerTrN)rrrrallow_reuse_addressrrrr_ReuseHTTPServerrs"rrz"Could not bind callback server on :z: N)rrV)rrrrrrexcs&&&$$ r_bind_loopback_callback_serverrsZ#:#h k:: h6tfAdV2cUKM]^dgghs  >9>c 0V^8dQhRRRRRRRRR R R R/#) rserverrrdict[str, Any]timeout_secondsfloatrr timeout_coder0rr)rs"rrrsFWW W .WDIWPhWWWrc\P!VPRR/RR7pVP4\P !4\ RV4,p\P !4V8dkVR,'gVR,'d5VVP4VP4VPRR 7#\P!R4KVP4VP4VPRR 7V!R V4h TP4TP4TPRR 7i;i) zZServe *server* until the redirect lands in *result* or the deadline passes; always closes. poll_intervalg?T)targetkwargsdaemong@rtrv?)timeoutz7Authorization timed out waiting for the local callback.) threadingThread serve_foreverstarttime monotonicmaxshutdown server_closejoinsleep)rrrrrthreaddeadlines&&$$$ r_serve_loopback_callbackrs   V%9%9?TWBXae fF LLN~~#c?";;H!nn)f~~  C  JJsO*  C  G VV  C  s(DDD D4Edocs_urlc$V^8dQhRRRRRR/#)r redirect_urir0rz str | Nonerr{r)rs"rrrs'II3IZISWIrcx^RIHpV!4'gR#\V4pTP;'gRTP rTTR 9g T'gR#Rp\ RT RT RT RT RT R \4 R 2 4T'd\ R T 24\ R \ RT R24R# \dR#i;i)aPrint an SSH tunnel hint when a loopback-redirect OAuth flow runs on a remote host. The auth server redirects the browser to ``127.0.0.1:/callback``; when the browser is on another machine (the SSH case) the redirect needs a local port forward to reach us. )r-Nr3 u1 Remote session detected — SSH tunnel required z- Hermes is waiting for the OAuth callback on z but your browser is on a different machine. Run this command in a NEW terminal on your local machine BEFORE opening the URL: ssh -N -L z :127.0.0.1: z: Then open the authorize URL above in your local browser.zProvider docs: zSSH/jump-box guide: > localhost::1 127.0.0.1z<------------------------------------------------------------) hermes_cli.authr-r rHrXrprintrZr)rrr-rrrdividers&$ r_print_loopback_ssh_hintrs 3   ,'&&B $ 44DG WIH R77CnEfKvQ/@/B.CDC  CD $XJ/0 !8 9G9B GH s B** B98B9cV^8dQhRR/#)rrbool | ssl.SSLContextr)rs"rrrs.rc^RIHpHpV!4pVfV!4#\PR8Xd\ P !VR7#R#)aPlatform-aware default SSL verify for httpx clients. On macOS with Homebrew Python the system OpenSSL cannot find the system trust store, so pin certifi's bundle when importable; elsewhere defer to httpx's built-in default. The bundle is resolved through ``agent.ssl_verify``, the one place that re-derives a path an install-environment rotation deleted: the Nous credential exchange builds its context here, and in a long-lived gateway it can be the first TLS client constructed after the rotation. )certifi_bundle_pathplatform_ssl_contextdarwincafileT)agent.ssl_verifyrrrDrEsslcreate_default_context)rrbundles r_default_verifyrs@K "F ~$%% ||x))88 rinsecure ca_bundle auth_statec(V^8dQhRRRRRRRR/#) rrzOptional[bool]r Optional[str]rzOptional[dict[str, Any]]rrr)rs"rrrs,3@(4Irc^RIHp\V\4'dVP R4M/p\V\4'dTM/pVe\ VRR7M\ VP RR4RR7pT;'glVP R4;'gS\ P!R4;'g5\ P!R4;'g\ P!R 4pV'dR#V'de\V4p\ PPV4'g\PR V4V!4#\P!VR 7#V!4#) r2)rtlsFdefaultrrHERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLEuJCA bundle path does not exist: %s — falling back to default certificatesr)rr isinstancedictrCrr%r&r0r6isfileloggerwarningrr)rrrr tls_stateeffective_insecure effective_caca_paths$$$ r_resolve_verifyrs(0)3J)E)E u%2I' 488 bI4<4H%0 Y]]:u=u M  I IY]];/ I I299=O3P I I 99_ % I I)+3G)Hl#ww~~g&& NN\ #$ $))99  rc ,V^8dQhRRRRRRRRRR /#) rclient httpx.Clientportal_base_urlr0 client_idscoperrrr)rs"rrrs4 +.;>GTrc TPV R2RV/V'dRV/M/CR7pVP4VP4p.ROpVUu.uF qwV9gK VNK ppV'd\RRP V4 24hV#uupi)zFPOST to the device code endpoint. Returns device_code, user_code, etc.z/api/oauth/device/coderrdataz%Device code response missing fields: z, ) device_code user_codeverification_uriverification_uri_complete expires_ininterval)postraise_for_statusjson ValueErrorr) rrrrresponserrequired_fieldsfmissings &&&& r_request_device_coder s{{  129 LU'5)9 LNH  ==?DO*;/Qd]qq/G;@7AS@TUVV Ki;i) zPrint the shared "To continue" device-code block and optionally open the browser. Callers decide *whether* to open (remote-session / graphical-browser gating differs per provider); *failure_dash* keeps each provider's historical hint wording. z To continue:z 1. Open: z 2. If prompted, enter code: NFz# (Opened browser for verification)z' Could not open browser automatically z use the URL above.)rrGopenrH)rrrrropeneds&&$$$ r_print_device_code_instructionsr's G . K() *+ *9+ 67 !12  34 7 ~EXYZ " sA99B BBc]tRtRtRtRtR#)DeviceFlowCancellediAzGThe caller's ``cancelled`` hook fired while the token poll was waiting.rN)rrrr__doc__rrrrrrAsQrrc$V^8dQhRRRRRR/#)rsecondsr cancelledOptional[Callable[[], bool]]rr{r)rs"rrrEs#     2N  SW  rc.Vf\P!V4R#\P!4V,pV!4'gHV\P!4, pV^8:dR#\P!\RV44KT\ 4h)zXSleep *seconds*; with a hook, in <= 1 s ticks so a cancel ends the poll within a second.Nr)rrrminr)rrwake remainings&& r_cancellable_sleepr%Esf 7 >> g %Dkk4>>++ >  3sI&'  rrc<V^8dQhRRRRRRRRRR R R R R RRRR/ #)rrzCallable[[], httpx.Response]rr]rvalidate_successz Callable[[dict[str, Any]], None]on_non_json_errorz%Callable[[httpx.Response], Exception]on_errorz5Callable[[httpx.Response, dict[str, Any]], Exception] on_timeoutzCallable[[], Exception]rr rrr)rs"rrrSsm9v9v &9v7:9vKN9v69v=9vD 9v ( 9v 5Q 9v ]k 9vrc \P!4\^V4,pTp Rp ^p \P!4V8dVeV!4'd \4hV!4p V P^8XdV P 4p V!V 4V #V P 4pR^r\TPR4;'gR4pTR 8Xd=\\T \RT\P!4, 44T4KTR 8Xd"\T ^,^4p \Y4EK T!Y4hV!4V 'd\R V 24hRh \ dT PpTR 9g0TR8g)TR8XdT PPR4'd^RI H pTp T!T P4pTe\\T T4^<4p M%\\T ^,T ^,^4^<4p \\R\Y\P!4, 44T4EKT P4T!T 4hi;i) uRFC 8628 device-code polling loop shared by the Nous and xAI flows. ``authorization_pending`` sleeps and retries; ``slow_down`` grows the interval by 1s (cap 30s). A non-JSON 408/429/5xx, or a 403 carrying ``x-vercel-mitigated`` (edge/WAF mitigation, never a real OAuth error), backs off — honoring ``Retry-After``, capped at 60s and at the device-code deadline — instead of aborting a login the user may still be approving. Every other error, a non-JSON error body, and the deadline become provider-specific exceptions via the supplied factories so each caller keeps its exact error contract. *cancelled* is checked before every request and during every wait; once it fires the poll raises :class:`DeviceFlowCancelled`. gNiizx-vercel-mitigated)parse_retry_after_secondsrvr3authorization_pending slow_downztoken endpoint answered HTTP >)rrrr status_coderrHheadersrCagent.retry_utilsr,r"r%rr0ConnectionError)rrrr'r(r)r*rrcurrent_interval edge_backoff unavailablerpayload error_payloadstatusr, retry_after error_codes&$$$$$$$ r_poll_device_token_genericr=Ss ~~#a"44H$LK .. X %  Y[[%' '6   3 &mmoG W %N .$MMOM"%(k**7399r: 0 0 s#3ShIY>Y5Z[]f g   $"#3a#7<  / ; x// ,_j_/L[M-Z[uptu7 .))F#v}cMh&6&6&:&:;O&P&PG$ 78H8HI *#&s+;['I2#NL#&sY,Z#[]fg  % % '#H- - .sEA I*BIIc8V^8dQhRRRRRRRRRRR RR R R R /#)rrrrr0rrrr]rrr rrr)rs"rrrsL +.;>MP$'4P\jrc aaaaRRlpRRlp\VVVV3RlV\^\V\44WxRV3RlVR7#) zIPoll the Nous token endpoint until the user approves or the code expires.c V^8dQhRRRR/#)rr8rrr{r)rs"rr%_poll_for_token..__annotate__sLL>LdLrc*RV9d \R4hR#) access_tokenz+Token response did not include access_tokenN)r)r8s&r _validate"_poll_for_token.._validates  (JK K )rcV^8dQhRR/#)rrrHr)rs"rrrAs[[I[rc^RIHpT!\VPRR4;'gR4\VPR4;'gR44#)r2)device_flow_errorrvr3rwzUnknown authentication error)hermes_cli.auth_error_copyrHr0rC) _responser9rHs&& r_error_poll_for_token.._errorsN@  !!'2.44" 5  !!"56XX:X Y[ [rc D<SPS R2R\RSRS/R7#)z/api/oauth/token grant_typerrr)rr)rrrrsr!_poll_for_token..s3 / 04k9{,-rc\R4#)z1Token endpoint returned a non-JSON error response) RuntimeError)_rs&rrOrPs \ ?&Arc,<\\S44#r$)rr)rsrrOrPs,-N-_`r)rrr'r)r(r*r)r=rr"r) rrrrrrrrDrKs ffff&&& r_poll_for_tokenrUsLL[ & - !S0UVW"Aa rc$V^8dQhRRRRRR/#)rpromptr0rrrr)rs"rrrs&TT3TCTDTrc\V4P4P4pVR8XdVR9#VR9# \\3dTpL&i;i)zB``input()`` a [Y/n]-style question; EOF/Ctrl-C count as *default*.y>r3rYyes>rYrZ)inputr4r8EOFErrorKeyboardInterrupt)rWranswers&$ r_prompt_yes_nor_s\v$$&,,.*1C6% %SV|=SS ' (s':AAshow_auth_statec(V^8dQhRRRRRRRR/#) r provider_idr0 config_pathrr`rrr{r)rs"rrrs2MMM#'M=AMNRMrc\4\R4V'd^RIHp\RV!4 R24\RV RV R24R#)zLogin successful!)display_hermes_homez Auth state: z /auth.jsonz Config updated: z (model.provider=)N)rhermes_constantsre)rbrcr`_dhhs&&$ r_print_login_successrisB G @ tvhj12 {m+<[M KLrexpired_noticec4V^8dQhRRRRRRRRRRR R R R /#) rrbr0resolvezCallable[[], dict[str, Any]] is_expiringzCallable[[str, int], bool]rrdefault_base_urlrjrrrr)rs"rrrsH">+;>RU".2rc~^RIHpV!4pVPRR4p\V\4'dbV'dZV!V^<4'gK\ RV R24\ RRR7'd&V!WPR V44p \W 4R #R #V'd \ V4R # \dR #i;i) uOffer to reuse still-valid stored OAuth credentials. Returns True when the user accepted. *resolve* attempts a refresh, so a resolved token should be valid — but double-check the expiry before telling the user "Login successful!". )_update_config_for_providerapi_keyr3z Existing z( credentials found in Hermes auth store.z!Use existing credentials? [Y/n]: rYrbase_urlTF) rrprCrr0rr_rir ) rbrlrmrrrnrjrpexistingrqrcs &$$$$$ r!_offer_existing_oauth_credentialsrts<  9,,y"- gs # # GR8P8P Il^+ST UA3OO9j:J!KM $[> P   . !     s)6B-B-AB-B- B-- B<;B<>w3mlynxlinksbrowshelinkslinks2 www-browser) CLOUD_SHELL CODESPACESCODESPACE_NAMEGITPOD_WORKSPACE_IDREPL_ID STACKBLITZ)@r$)C__conditional_annotations__r __future__rrbrkloggingr%rrDrrrG http.serverrrpathlibrtypingrrrr r urllib.parser r hermes_cli.auth_constantsr rrrrrrIrutilsr getLoggerr frozensetr__annotations__r,r-r:rNrZrgrorrrrrrr rrrHrr%r=rUr_rirt)rs@rrs] #   :;;+<<9!   , - *34* @E A. ZH #,L h W(I$I:("&CG+/2$+"[VZ[ %[4R)R  9v TX 9vx@TMDIM%)r