+ WjRt^RIHt^RIt^RIt^RIHtHt^RIH t ^RI H t H t H t HtHt^RIHtHtHtHtHtHtHtRtRR /R R lltR R ltRRltRRRR/RRlltR#)u_OpenRouter OAuth PKCE login (``hermes auth add openrouter --type oauth``). Contract: https://openrouter.ai/docs/guides/overview/auth/oauth. The browser is sent to ``/auth?callback_url=...&code_challenge=...&code_challenge_method=S256``; the redirect carries ``?code=``; ``POST /api/v1/auth/keys`` swaps ``{code, code_verifier, code_challenge_method}`` for ``{"key": "sk-or-v1-..."}`` — a plain user-controlled API key, no refresh token. OpenRouter echoes no ``state`` parameter, so the CSRF nonce rides in the loopback callback PATH: a redirect to any other path is a 404 and never reaches the exchange. ) annotationsN)AnyDict) urlencode)OPENROUTER_AUTH_KEYS_URLOPENROUTER_AUTH_URLOPENROUTER_OAUTH_DOCS_URL_openrouter_errhttpx)_bind_loopback_callback_server_can_open_graphical_browser_is_remote_session_make_loopback_callback_handler_pkce_code_challenge_pkce_code_verifier_serve_loopback_callbackitimeout_secondsg4@c(V^8dQhRRRRRRRR/#)codestr code_verifierrfloatreturn)formats"NC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\auth_openrouter.py __annotate__rs*CQVbec \P!\RVRVRR/RR/VR7pTP R 8Xd\ R R RR7hTP R8d[TP P4R \p\ RTP R2T'dRT 2,R 4hR,R 4hTP4p\T\4'd3\TPR4;'gR4P4MRpT'g \ RR4hT# \dp\ RT 2R 4ThR p?ii;i \dp\ RR4ThR p?ii;i)z\Exchange the authorization code for an API key; the key never enters a log or error message.rrcode_challenge_methodS256z Content-Typezapplication/json)jsonheaderstimeoutz!OpenRouter code exchange failed: openrouter_token_exchange_failedNizrOpenRouter rejected the authorization code (invalid, already used, or older than 10 minutes). Run the login again. openrouter_token_exchange_deniedT)reloginiz&OpenRouter code exchange failed (HTTP z).z Response: z2OpenRouter code exchange returned a non-JSON body.!openrouter_token_exchange_invalidkeyz:OpenRouter code exchange response did not include a 'key'.)r postr Exceptionr status_codetextstrip_ERROR_BODY_LIMITr" ValueError isinstancedictrget)rrrresponseexcdetailpayloadr*s&&$ r_openrouter_exchange_coder9sv:: $o}>UW],_#%78/Ss" #$FPTV Vs"$$&'9(9:4X5I5I4J" MkqS^_e^fQg z .0 0wy z .0 0p--/4>gt3L3L#gkk% &&B ' - - /RTC  HJmo o J+ v A#GIklruuv p @Beglo pps/&D#3E# E.D>>E E# EE#c V^8dQhRRRR/#)rauth_urlrrr)rs"rrr:s    rc^RIHp\RV R24V!R4P4pV'g \ RR4hV#)zeRemote/SSH: OpenRouter shows the code on screen when ``callback_url`` is omitted; the user pastes it.)masked_secret_promptuRemote session detected — using OpenRouter's headless flow. Open this URL in a browser on any machine, authorize, then paste the code shown:  zAuthorization code: zNo authorization code entered.openrouter_auth_no_code)hermes_cli.secret_promptr=printr/r )r;r=rs& r_openrouter_headless_coderB:sP=  __g^hhj lm 6 7 = = ?D >@YZZ Krc(V^8dQhRRRRRRRR/#) rauth_url_paramszdict[str, str] open_browserboolrrrrr)rs"rrrFs+~PTglqtrc\P!^4pRV 2p\VRR7wrV\R^V\RR7pRVP ^, V 2p\ R\R V/VC4 2p \R V R \ 24V'd=\4'd-\P!V 4p \V 'dR MR4\R4\WvV\RR7p V PR4'd0\ RV PR4;'g V R, 2R4h\!V PR4;'gR4P#4p V 'g \ RR4hV # \dR p Li;i)z /callback/ OpenRouter) display_namez 127.0.0.1openrouter_callback_bind_failed)errbind_failed_codezhttp://127.0.0.1:? callback_urlz5Open this URL to authorize Hermes with OpenRouter: z Docs: Fz,Browser opened for OpenRouter authorization.z<2cSb2c(d'efH B8*JWpVq rs355 __X.F <Q S 23'_24H||G/ =P0Q0f0fU]^eUf/g h $& & x||F#))r * 0 0 2D XZstt K F sE44 FFrETgr@c$V^8dQhRRRRRR/#)rrErFrrrzdict[str, Any]r)rs"rrres' G GD G% G\j Grc \4pR\V4RR/p\4'd%\\ R\ /VCRR/C4 24pM \ W0VR7p\R4R \WB4/#) zSRun the PKCE flow and return ``{"api_key": ...}`` for the credential-pool add path.code_challenger r!rN key_labelz hermes-agent)rErz>Exchanging the authorization code for an OpenRouter API key...api_key) rrr rBrrrbrAr9)rErrparamsrs$$ r_openrouter_pkce_loginries|')M 4] CE\^d eF(,?+@)LsvLsWbdrLsBtAu)vw(\kl JK 0E FFr)__doc__ __future__rrUrXtypingrr urllib.parserhermes_cli.auth_constantsrrrr r hermes_cli.auth_device_flowr r r rrrrr0r9rBrbrirrrrpsu#"ffjjjY]> > G4 GRW G Gr