+ Wj[a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIt^RIHt^RIHt^RIHtHt^RIHt]P4!]4tRtRtRYtRZt ^t!^t"R R lt#R R lt$R Rlt%Rt&Rs'R](R&RRlt)RRlt*RRlt+RRRR/t,RRlt-RRR R!/R"R#llt./t/R$](R%&^xt0R&t1R't2R(t3^t4R)t5R*t6R+t7/t8R,](R-&/t9R.](R/&] Pt!4t;R0R1lt]?!0R[m4t@R4R5ltAR6R7ltBR8R9ltCR:R;ltDR<R=ltER>R?ltFR@RAltGRBtHRCRDltIRERFltJRGRHltKRIRJ/RKRLlltLRMRNltMRORPltNRQRRltORSRTRURV/RWRXlltPR#)\zGitHub Copilot authentication utilities (credential order matches the Copilot CLI: COPILOT_GITHUB_TOKEN, GH_TOKEN, GITHUB_TOKEN, then ``gh auth token``).) annotationsN)Path)Optional) IS_WINDOWSwindows_hide_flagsatomic_json_writezIv1.b507a08c87ecfe98ghp_c V^8dQhRRRR/#)tokenstrreturnztuple[bool, str])formats"KC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\copilot_auth.py __annotate__r&s#*:cVP4pV'gR#VP\4'dR#VP\4'gRRRP \4 R23#R#)z5Validate that a token is usable with the Copilot API.FzOUnsupported GitHub token format for the Copilot API. Supported token prefixes: z, .)Fz Empty token)Fu3Classic Personal Access Tokens (ghp_*) are not supported by the Copilot API. Use one of: → `copilot login` or `hermes model` to authenticate via OAuth → A fine-grained PAT (github_pat_*) with Copilot Requests permission → `gh auth login` with the default device code flow (produces gho_* tokens))TOK)strip startswith_CLASSIC_PAT_PREFIX_SUPPORTED_PREFIXESjoin)r s&rvalidate_copilot_tokenr&s| KKME ## +,,_ _   / 0 0 ))-3F)G(H KL L rcV^8dQhRR/#)r rztuple[str, str]r)rs"rrr9srcRp\Fdp\P!VR4P4pV'gK2Rp\ V4wr4V'dW!3u#\ P RW4Kf V'd\ PR4R#\4pV'd(\ V4wr4V'g\RV 24hVR3#R#) uResolve a GitHub token suitable for Copilot API use → (token, source); ("", "") if none. Raises ValueError if only a classic PAT is available. FTz"Token from %s is not supported: %szCopilot env var(s) set but none held a supported token; skipping `gh auth token` fallback to honor explicit env-var intent (and avoid the subprocess cost on cold start, #60800).z7Token from `gh auth token` is not usable with Copilot. z gh auth token)rr) COPILOT_ENV_VARSosgetenvrrloggerwarningdebug_try_gh_cli_token ValueError)any_env_var_setenv_varvalvalidmsgr s rresolve_copilot_tokenr-9s O#ii$**, +C0  < ;WJ$ 4 5  E +E2 VWZV[\] ]o%% MrcV^8dQhRR/#)r rz list[str]r)rs"rrrYs  I rc^RIHp^RIHpHpV!R.V!4OV!4O5R7p.pVP F1pVP V9gKVPVP 4K3 V#)zTEvery present ``gh`` in probe order: PATH first, then Homebrew and ``~/.local/bin``.)locate_command) homebrew_dirsuser_local_bingh) known_dirs)hermes_platform.resolverr0#hermes_platform.resolver.known_dirsr1r2presentvalueappend)r0r1r2resseencands r_gh_cli_candidatesr=YsZ7Q *OMO*On>N*O PCD  ::T ! KK # Krgr@z"tuple[float, Optional[str]] | None_gh_cli_token_cachecV^8dQhRR/#r rNoner)rs"rrrnsrc RsR#)zJReset the ``gh auth token`` probe cache (used by tests and re-auth flows).N)r>rrr_invalidate_gh_cli_token_cacherCns rcV^8dQhRR/#r r Optional[str]r)rs"rrrts  = rc\P!4p\pVe"W^,, \8d V^,#\ 4pW3sV#)zYToken from ``gh auth token`` when available; the result (incl. a miss) is cached per TTL.)time monotonicr>_GH_CLI_TOKEN_CACHE_TTL_SECONDS_probe_gh_cli_token)nowcacher s rr&r&tsG .. C E S8^.MMQx  !E, LrcV^8dQhRR/#rEr)rs"rrrs]rc$\P!RR4P4p\PP 4UUu/uFwrVR9gKWbK pppVP RR4VP RR4\ 'd R\4/M/pV'dRV.M.p\4FpVRR .VOp\P!V3R R R R R RRRR^RVR\P/VBRR/BpTP ^8XgKUTP"P4'gKwTP"P4u# R#uuppi \\P3d"p \PRYi4Rp ? KRp ? ii;i)zHUncached ``gh auth token`` subprocess probe (see ``_try_gh_cli_token``).COPILOT_GH_HOSTrGH_PROMPT_DISABLED1GH_NO_UPDATE_NOTIFIER creationflagsz --hostnameauthr capture_outputTtextencodingzutf-8errorsreplacetimeoutenvstdincheckFz#gh CLI token lookup failed (%s): %sN>GH_TOKEN GITHUB_TOKEN)r!r"renvironitems setdefaultrrr= subprocessrunDEVNULLFileNotFoundErrorTimeoutExpiredr#r% returncodestdout) hostnamekv clean_env _popen_kwargs host_argsgh_pathcmdresultexcs rrKrKsyy*B/557H"$**"2"2"4^"4$!A]8]"4I^ -s3 0#6?Iz_&8&:;rM,4x("I%'4)4 ^^C\\4\RY\+4\>?\EN\*4*<*<\@M\UZ\F    !fmm&9&9&;&;==&&( (( !_":#<#<=  LL> M  s$ E E 7EF.F  F expired_tokenu, ✗ Device code expired. Please try again. access_deniedu ✗ Authorization was denied.c(V^8dQhRRRRRRRR/#)r urlr fieldsdictr[floatrr)rs"rrrs(00C000$0rc \PPV\PP V4P 4RRRRRR/R7p\PP W2R7;_uu_4p\P!VP4P44uuRRR4# +'giR#;i) Acceptapplication/json User-AgentHermesAgent/1.0z Content-Typez!application/x-www-form-urlencoded)dataheadersr[N) urllibrequestRequestparse urlencodeencodeurlopenjsonloadsreaddecode)rxryr[reqresps&&& r _post_formrs ..  &,,((0779-|=N!DF ! GC     5 5zz$))+,,./ 6 5 5 5s <2B99 C hostz github.comtimeout_secondsi,c$V^8dQhRRRRRR/#)r rr rr{rrFr)rs"rrrs$11 1271BO1rcVPR4p\RV R2R\RR/^4pTPR R 4pTPR R 4pTPRR 4p\TPR\4^4pT'd T'g\ R4R #\ RT RT R24\ RR RR7R\RTRR/p \P!4T,p \P!4T 8Ed\P!T\,4\RT R2T ^ 4p T PR4'd\ R4T R,#T PRR 4p T R8XdQT PR4p \T \\ 34;'dT ^8pT'd \T 4MT^,pT R!9d\ RR RR7KT 'gEK\ R\"PT RT 24,4R #\ R 4R # \d0p\P RT4\ RT 24R p?R #R p?ii;i \d\ RR RR7EKi;i)"z2Run the GitHub OAuth device code flow for Copilot./https://z/login/device/code client_idscopez read:userz+Failed to initiate device authorization: %su, ✗ Failed to start device authorization: Nverification_urizhttps://github.com/login/device user_coder device_codeintervalu* ✗ GitHub did not return a device code.z" Open this URL in your browser: z Enter this code:  z Waiting for authorization...T)endflush grant_typez,urn:ietf:params:oauth:grant-type:device_codez/login/oauth/access_tokenr access_tokenu ✓error slow_downu ✗ Authorization failed: u+ ✗ Timed out waiting for authorization.)authorization_pendingr)rstriprCOPILOT_OAUTH_CLIENT_ID Exceptionr#rprintgetmax_DEVICE_CODE_POLL_INTERVALrHrIsleep_DEVICE_CODE_POLL_SAFETY_MARGIN isinstanceintr{_DEVICE_CODE_TERMINAL_ERRORS)rrdomain device_datartrrrr poll_fieldsdeadlinersrserver_intervalis_nums$$ rcopilot_device_code_loginrs\[[ F 8F83E!F"-/FQ\!]_ac #'9;\] R0I//-4K;??:/IJANH i :; /0@/AB ){" ./ *$? 7 !OQK~~/1H .. X % 8==> (6(2K Lk[]^F ::n % % &M.) ) 7B' K $jj4O#u>VV?UVCVF/5s?+8a=I>z+dict[str, tuple[str, float, Optional[str]]] _jwt_cachez0https://api.github.com/copilot_internal/v2/tokenzvscode/1.104.1zGitHubCopilotChat/0.26.7g?z.copilot_jwt.jsonizdict[str, float]_exchange_failure_cachezdict[str, threading.Lock]_exchange_locksc V^8dQhRRRR/#)r fpr rzthreading.Lockr)rs"rrrs3>rc\;_uu_4\PV4pVf\P!4;p\V&VuuRRR4# +'giR#;i)N)_exchange_locks_guardrr threadingLock)rlocks& r_exchange_lock_forrsE  ""2& <)2)9 9D?2&    s 9A A$ gN@g @c V^8dQhRRRR/#)r raw_tokenr rr)rs"rrrs??#?#?rct\P!VP44P4R,#)zNShort fingerprint of a raw token for cache keying (avoids storing full token).:NN)hashlibsha256r hexdigest)rs&r_token_fingerprintrs( >>)**, - 7 7 9# >>rc V^8dQhRRRR/#)r pathrrzOptional[dict]r)rs"rrrs$>rcVP4'gR#VP4P\8d\P R\4R#\ P!VPRR74p\V\4'dV#R# \d"p\P RT4Rp?R#Rp?ii;i)uBounded read of the on-disk JWT store → dict, or None if missing/unusable (a store over the 1 MiB cap or non-dict can't balloon memory or get rewritten back out).Nz6Persisted Copilot JWT store exceeds %d bytes; ignoringz utf-8-sig)rXz.Failed to read persisted Copilot JWT store: %s) existsstatst_size_JWT_DISK_MAX_BYTESr#r%rr read_textrrzr)rloadedrts& r_read_jwt_storers ;;==  99;  !4 4 LLQ, .DNNKN@A#FD11v;t;  EsKs#=B=BB C$CCcV^8dQhRR/#)r rzOptional[Path]r)rs"rrrsrcj^RIHp\V!44\, # \dR#i;i)zAPath to the on-disk exchanged-JWT cache (profile-aware), or None.get_hermes_homeN)hermes_constantsrr_JWT_DISK_FILENAMErrs r_jwt_disk_pathrs04O%&);;; s # 22cV^8dQhRR/#)r verbr r)rs"rrrs  # rc\4pV'gR#V!V\V44# \d"p\P RY4Rp?R#Rp?ii;i)zZRun ``op(path, store_or_None)`` against the disk store; failures are logged, never raised.NzFailed to %s Copilot JWT: %s)rrrr#r%)roprrts&& r_with_jwt_storersI  D $-..  3T?s( AAAc V^8dQhRRRR/#)r rr rrAr)rs"rrr+s,,C,D,rcaV'gR#\V4o\PSR4\PSR4V3Rlp\ RV4R#)uDrop any cached exchanged JWT for ``raw_token`` (in-process + on-disk) — the runtime stale-credential recovery path for ``model_not_available_for_integrator`` 400s.NcH<VeSV9dVS\WRRR7R#R#R#)Nindentmoder)rstorers&&r_evict,evict_cached_exchanged_token.._evict5s*  ub d$U C"- rz evict cached)rrpoprr)rrrs& @revict_cached_exchanged_tokenr+sE  I &BNN2tD)D NF+rc V^8dQhRRRR/#)r rr rz*Optional[tuple[str, float, Optional[str]]]r)rs"rrr=s 4 4C 4$N 4rc(aV3Rlp\RV4#)uRPersisted exchanged JWT for ``fp`` → (api_token, expires_at, base_url), or None.c"<T;'g/PS4p\V\4'gR#VPRR4p\VPR^4;'g^4pV'dV'dW4VPR43#R#)N api_tokenr expires_atbase_url)rrrzr{)rrentryrrrs&& r_load"_load_jwt_from_disk.._load?st"!!"%%&&IIk2. 599\15::; AJz uyy'<=c_ccrzload persistedr)rrsf r_load_jwt_from_diskr=sd +U 33rc ,V^8dQhRRRRRRRRRR /#) r rr rrr{rrFrrAr)rs"rrrJs0 & &# &# &5 &M &^b &rc8aaaaVVVV3Rlp\RV4R#)z:Persist an exchanged JWT (0o600), pruning expired entries.c R<\P!4pT;'g/P4UUu/uFKwr4\V\4'gK\ VP R^4;'g^4V8gKIW4bKM pppRSRSRS/VS &\ WRRR7R#uuppi)rrrNrr)rHrbrrzr{rr) rrrLrlrmkeptrrrrs && r_save _save_jwt_to_disk.._saveLsiik#kkr002Q2TQ!T" ',QUU<-C-H-Hq'IC'O AD2 Q L*jRZ[R$T> QsB#B#1 B#?B#persistNr)rrrrrsffff r_save_jwt_to_diskrJs??Iu%rg@cV^8dQhRR/#)r r[r{r)rs"rrr\s5rcaaaa/o\P!4oRVVVV3Rllp\P!VRRR7pVP4VP S\ ,4VP 4'd,SP4\RS\ ,R R24hR S9d SR ,hR S9d \R 4hSR ,#) zurlopen() on a daemon thread, abandoned after timeout + _DNS_GRACE_SECONDS so a DNS/getaddrinfo hang cannot block the caller. Raises the worker's exception or TimeoutError.cV^8dQhRR/#r@r)rs"rr&_urlopen_bounded..__annotate__bs  T rc`<\PPSSR7pSP 4'd>\ P !\4;_uu_4TP4RRR4R#TSR&R# \dpTSR&Rp?R#Rp?ii;i +'giR#;i)rrtNr) rrr BaseExceptionis_set contextlibsuppressrclose)rrt abandonedboxrr[s r_worker!_urlopen_bounded.._workerbs >>))#w)?D     $$Y// 0 F  CJ  0/ s#!A>B> B BB B- zcopilot-token-exchangeT)targetnamedaemonz,copilot token exchange exceeded hard cap of z.0fzs (DNS/getaddrinfo hang?)rtrz1copilot token exchange worker died without result) rEventThreadstartr_DNS_GRACE_SECONDSis_aliveset TimeoutError)rr[r tr r sff @@r_urlopen_boundedr\sC!I   .FtTAGGIFF7' '(zz|| I%(::3??XZ[ [ |%j SNOO v;rc$V^8dQhRRRRRR/#)r r[r{rr rrzr)rs"rrr|s!22U222rc JRpRp\^\^,4Fjp\W4;_uu_4p\P!VP 4P 44pRRR4\PVR4Xu# \P!4V'd\"M\$,\V&\'R\ RV 24Vh +'giLw;i \dpTp\TRR4;'g\TRR4p T \9pT'd\PRT 4Rp?KT\8dG\T,p \PRT\Y4\P !T 4Rp?EKzRp?EKRp?ii;i) zGET the exchange with backoff for startup network races; raises ValueError on failure. Permanent rejections (401/403/404) skip the retry loop. Failures populate the negative cache (long TTL for permanent, short for transient); success clears it. NFcodestatusz7Copilot token exchange rejected (HTTP %s); not retryingzCCopilot token exchange attempt %d/%d failed (%s); retrying in %.1fsz$Copilot token exchange failed after z attempts: )range_EXCHANGE_MAX_ATTEMPTSrrrrrrrrgetattr!_EXCHANGE_PERMANENT_HTTP_STATUSESr#r%_EXCHANGE_BACKOFF_BASE_SECONDSrHr'_EXCHANGE_FAILURE_TTL_PERMANENT_SECONDS'_EXCHANGE_FAILURE_TTL_TRANSIENT_SECONDSr') rr[rlast_excpermanent_failureattemptrrrtrsleep_ss &&& r_fetch_exchange_with_retryr*|sW %)H2Q67 $!#//4zz$))+"4"4"670 # ' 'D 1K 8$#'))+3D/ 4#6B ;>#67 f % %#JrNM 8 *--b#6K yy{[ ((+K$))+,E(F'GqJK K .. E F9+"6 FZ-/?R ! SC &cB 7D"%I FGGtxx -223IItyy{T7IJ%I?I)UY?Z?ZIMM% & &B'--/66s;`b33 ' 2  X6JrNbZ: LLF ] ( **rc V^8dQhRRRR/#)r r r rrFr)rs"rrrs!!#!-!rc\P!RV4pV'gR#\P!RRVP^4^R7P R4p\P!RRV^R7pR V 2#) uUCopilot API base URL from the token's ``proxy-ep=proxy.`` field (→ ``api.``).z(?:^|;)\s*proxy-ep=([^;\s]+)Nz ^https?://r)countrz^proxy\.zapi.r)researchsubgroupr)r mproxy_eps& rrFrFsa 159A vvmR1=DDSIHvvk681=H hZ  rc V^8dQhRRRR/#)r rr rztuple[str, Optional[str]]r)rs"rrrs  S -F rcV'gVR3#\V4wrpW3# \d%p\PRT4TR3uRp?#Rp?ii;i)z``(api_token, base_url)`` from the exchange, or ``(raw_token, None)`` when it fails (accounts that don't need exchange keep working).Nz2Copilot token exchange failed, using raw token: %s)r:rr#r%)rr_rrts& rget_copilot_api_tokenrTsW $!7 !B h""  I3O$s AA A A is_agent_turnT is_visionFc$V^8dQhRRRRRR/#)r rUr,rVrzdict[str, str]r)rs"rrrs$   .2 ?M rc TR\RRRRRRRV'dR MR /pV'dR VR &V#) z4Build the standard headers for Copilot API requests.r?rrzCopilot-Integration-Idz vscode-chatz Openai-Intentzconversation-editsz x-initiatoragentusertruezCopilot-Vision-Request)rE)rUrVrs$$ rcopilot_request_headersr\s? 0,Pa7.0D,gFTG,2() Nr)gho_ github_pat_ghu_)COPILOT_GITHUB_TOKENr_r`>)Q__conditional_annotations____doc__ __future__rrrrloggingr!rKshutilrdrrH urllib.parserurllib.requestpathlibrtypingrhermes_cli._subprocess_compatrrutilsr getLogger__name__r#rrrr rrrr-r=rJr>__annotations__rCr&rKrrrrr/rCrErDr r#rrrrrrrr%r$ frozensetr"rrrrrrrrrr*r1r:r8rFrTr\)rds@rrssJ#   H#   8 $16G"#&@ "#(:>7> .!01_ /1R T011:=1j;= 7<!H"1 !$(-/)..0*/!(+/'*0'$-o$>!? " ,$ 4 &@2BRN(,N4!+H!  ! 5:  r