+
    „WÝjG,  ã                  ól  € R t ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	t
^ RIHtHtHt ^ RIHtHt ]P$                  ! ]4      tRR0tR R ltR	 R
 ltR R ltR R ltR R ltR R ltR R ltR R ltR R R lltR R lt]P@                  ! R]PB                  4      t"R R lt#R R lt$R# )!uÂ  Non-interactive HTTPS credentials for Hermes's internal git clones (private plugin/MCP/profile repos).

:func:`noninteractive_git_env` deliberately disables credential helpers, askpass and global git
config so a hostile repo cannot make our plumbing prompt or hang. The cost is that a *private*
repo the user can already clone from their shell fails inside ``hermes plugins install`` with
"could not read Username" (or hangs on a GUI askpass until the timeout). This module resolves a
credential up front, from sources the user already owns, and passes it to git as a one-shot
``http.<origin>/.extraheader`` in the environment â€” never in the URL and never in ``.git/config``,
so nothing is persisted into the installed checkout.

Resolution order for an ``https://`` URL:

1. ``GITHUB_TOKEN`` / ``GH_TOKEN`` (profile-scoped, GitHub hosts only).
2. ``gh auth token`` (GitHub hosts only; the gh CLI's own login).
3. ``git credential fill`` against the user's configured credential helpers (any host: GitLab,
   Bitbucket, self-hosted) with prompting disabled, so a stored credential is returned and a
   missing one fails in ~100 ms instead of asking.

The credential is attached only after an anonymous attempt is refused
(:func:`run_git_with_credential_fallback`), and a refused credential yields to the next one in
the list rather than ending the run â€” a stale ``GITHUB_TOKEN`` in ``.env`` otherwise shadows a
``gh auth login`` that still works. Most catalog repos are public, and a stale or
revoked stored token sent pre-emptively turns a clone that works anonymously into a 401 that git
can only answer with the prompt this module disables â€” "could not read Username for
'https://github.com': terminal prompts disabled".
)ÚannotationsN)ÚIteratorÚMappingÚOptional)Únoninteractive_git_envÚwindows_hide_flagsz
github.comzgist.github.comc               ó    € V ^8„  d   QhRRRR/# )é   ÚurlÚstrÚreturnúOptional[str]© )Úformats   "ÚNC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\git_credentials.pyÚ__annotate__r   .   s   € ÷ ñ �sð ˜}ñ ó    c                ó,  € \         P                  P                  V 4      pVP                  R 8w  g   VP                  '       g   R# RVP                  9   d   RVP                   R2MVP                  pVP
                  e   V RVP
                   2pRV 2# )ÚhttpsNÚ:Ú[Ú]zhttps://)ÚurllibÚparseÚurlsplitÚschemeÚhostnameÚport)r
   ÚparsedÚhosts   &  r   Ú_https_originr    .   s|   € Ü�\‰\×"Ñ" 3Ó'€FØ‡}�}˜Ô v§§ ÙØ%(¨F¯O©OÔ%;ˆQˆv�‰Ð˜qÑ!ÀÇÁ€DØ‡{�{ÒØ��q˜Ÿ™˜Ð&ˆØ�d�VÐÐr   c               ó   € V ^8„  d   QhRR/# ©r	   r   r   r   )r   s   "r   r   r   8   s   € ÷ Hñ H˜=ñ Hr   c                 óR   € ^ RI Hp  V ! R4      ;'       g    V ! R4      ;'       g    R# )é    ©Ú
get_secretÚGITHUB_TOKENÚGH_TOKENN)Úagent.secret_scoper&   r%   s    r   Ú_env_github_tokenr*   8   s%   € Ý-á�nÓ%×GÐG©°JÓ)?×GÐGÀ4ÐGr   c               ó   € V ^8„  d   QhRR/# r"   r   )r   s   "r   r   r   >   s   € ÷ )ñ )�}ñ )r   c                 óö  € \         P                  ! R 4      p V '       g   R#  \        4       pRVR&   R F  pVP                  VR4       K  	  \        P
                  ! V RR.RRRR^
\        P                  V\        4       R	R
7
      pTP                  ^ 8w  d   R# TP                  P                  4       ;'       g    R#   \        \        P                  3 d"   p\        P                  RT4        Rp?R# Rp?ii ; i)ÚghNÚ1ÚGH_PROMPT_DISABLEDÚauthÚtokenTúutf-8ÚreplaceF)	Úcapture_outputÚtextÚencodingÚerrorsÚtimeoutÚstdinÚenvÚcreationflagsÚcheckzgh auth token lookup failed: %s)r(   r'   )ÚshutilÚwhichr   ÚpopÚ
subprocessÚrunÚDEVNULLr   ÚOSErrorÚTimeoutExpiredÚloggerÚdebugÚ
returncodeÚstdoutÚstrip)r-   r:   ÚvarÚresultÚexcs        r   Ú_gh_cli_tokenrM   >   sÝ   € Ü	�Š�dÓ	€BßÙðÜ$Ó&ˆØ$'ˆÐ Ñ!ó 0ˆCØ�G‰G�C˜Öñ 0ä—’Ø�˜Ð!°$¸TÈGÐ\eØœj×0Ñ0°cÔI[ÓI]Ðejôlˆð ×Ñ˜AÔÙØ�=‰=×ÑÓ ×(Ð( DÐ(øô ”Z×.Ñ.Ð/ô Ü�‰Ð6¸Ô<Ýûðús   ¢A#B< Â<C8ÃC3Ã3C8c               ó   € V ^8„  d   QhRR/# r"   r   )r   s   "r   r   r   T   s   € ÷ 2ñ 2�}ñ 2r   c                 ó:   € \        4       ;'       g    \        4       # ©N)r*   rM   r   r   r   Ú_github_tokenrQ   T   s   € ÜÓ×1Ð1¤-£/Ð1r   c               ó    € V ^8„  d   QhRRRR/# )r	   Úoriginr   r   úOptional[tuple[str, str]]r   )r   s   "r   r   r   X   s   € ÷ ñ ˜Sð Ð%>ñ r   c                óê  € \         P                  ! R4      pV'       g   R# \        \        P                  4      pRVR&   RVR&   VP                  RR4       VP                  RR4       \        P                  P                  V 4      pR	VP                   R
2p \        P                  ! VRRRR.VRRRR^V\        4       RR7
      pTP"                  ^ 8w  d   R# \        R TP$                  P'                  4        4       4      pTP)                  R4      '       d   TP)                  RR4      TR,          3# R#   \        \        P                  3 d"   p\        P!                  RY4        Rp?R# Rp?ii ; i)zU``(username, password)`` from the user's own git credential helpers, never prompting.ÚgitNÚ0ÚGIT_TERMINAL_PROMPTÚNeverÚGCM_INTERACTIVEÚGIT_ASKPASSÚSSH_ASKPASSzprotocol=https
host=z

z-czcore.askPass=Ú
credentialÚfillTr2   r3   F)	Úinputr4   r5   r6   r7   r8   r:   r;   r<   z%git credential fill failed for %s: %sc              3  óX   "  € T F   pR V9   g   K  VP                  R ^4      x € K"  	  R# 5i)Ú=N)Úsplit)Ú.0Úlines   & r   Ú	<genexpr>Ú#_credential_fill.<locals>.<genexpr>o   s*   é € Ð[Ñ1K¨ÈsÐVZÉ{Ô$�$—*‘*˜S !×$Ð$Ó1Kùs   ‚	*�*ÚpasswordÚusernameÚ )r=   r>   ÚdictÚosÚenvironr?   r   r   r   Únetlocr@   rA   r   rC   rD   rE   rF   rG   rH   Ú
splitlinesÚget)rS   rV   r:   r   ÚrequestrK   rL   Úfieldss   &       r   Ú_credential_fillrr   X   sA  € ä
�,Š,�uÓ
€CßÙÜ
Œr�z‰zÓ
€CØ!$€CÐÑØ$€CÐÑà‡G�GˆM˜4Ô Ø‡G�GˆM˜4Ô Ü�\‰\×"Ñ" 6Ó*€FØ% f§m¡m _°DÐ9€GðÜ—’Ø�$˜¨°vÐ>ÀgÐ^bØ °	À2È3Ü,Ó.°eô=ˆð ×Ñ˜AÔÙÜÑ[°·±×1IÑ1IÔ1KÓ[Ó[€FØ‡z�z�*×ÒØ�z‰z˜* bÓ)¨6°*Õ+=Ð=Ð=Ùøô ”Z×.Ñ.Ð/ô Ü�‰Ð<¸fÔJÝûðús   Â-D6 Ä6E2ÅE-Å-E2c               ó    € V ^8„  d   QhRRRR/# )r	   r
   r   r   z%Iterator[tuple[str, tuple[str, str]]]r   )r   s   "r   r   r   u   s   € ÷ ñ ˜Sð Ð%Jñ r   c              #  ój  a"  € \        V 4      oSf   R# \        4       p. p\        P                  P	                  S4      P
                  \        9   d   VRR 3RR 3.,          pVP                  RV3R l34       V F0  w  r4V! 4       pVf   K  WQ9  g   K  VP                  V4       W53x € K2  	  R# 5i)a  ``(source, (username, password))`` for every credential the user owns for *url*'s host,
in precedence order and without duplicates. The remote decides which one works: an expired
``GITHUB_TOKEN`` left in ``.env`` must not shadow a live ``gh auth login`` (#115257).NúGITHUB_TOKEN/GH_TOKENc                 ó(   € \        \        4       4      # rP   )Ú_token_pairr*   r   r   r   Ú<lambda>Ú%iter_git_basic_auth.<locals>.<lambda>   s   € ´kÔBSÓBUÔ6Vr   zgh auth tokenc                 ó(   € \        \        4       4      # rP   )rw   rM   r   r   r   rx   ry   €   s   € ¬k¼-»/Ô.Jr   zgit credential helperc                 ó   <€ \        S 4      # rP   )rr   )rS   s   €r   rx   ry   �   s   ø€ Ô5EÀfÔ5Mr   )	r    Úsetr   r   r   r   Ú_GITHUB_HOSTSÚappendÚadd)r
   ÚseenÚsourcesÚsourceÚlookupr0   rS   s   &     @r   Úiter_git_basic_authr„   u   sª   øé € ô ˜3Ó€FØ‚~ÙÜ!$£€DØ€GÜ‡|�|×Ñ˜VÓ$×-Ñ-´Ô>ØÐ,Ñ.VÐWØ$Ñ&JÐKðMõ 	Mˆà‡N�NÐ+Ô-MÐNÔOÛ!‰ˆÙ‹xˆØÔ Ö 0Ø�H‰H�TŒNØ�,Ôó	 "ùs   ƒBB3ÂB3ÂB3c               ó    € V ^8„  d   QhRRRR/# )r	   r1   r   r   rT   r   )r   s   "r   r   r   ‰   s   € ÷ 8ñ 8�}ð 8Ð)Bñ 8r   c                ó   € V '       d   R V 3# R# )zx-access-tokenNr   )r1   s   &r   rw   rw   ‰   s   € ß(-Ð˜eÐ$Ð7°4Ð7r   c               ó    € V ^8„  d   QhRRRR/# )r	   r
   r   r   rT   r   )r   s   "r   r   r   �   s   € ÷ Lñ L ð LÐ(Añ Lr   c                ó:   € \        R \        V 4       4       R4      # )zV``(username, password)`` for *url*, or None for non-HTTPS URLs / no stored credential.c              3  ó*   "  € T F	  w  rVx € K  	  R # 5irP   r   )rc   Ú_sourcer0   s   &  r   re   Ú)resolve_git_basic_auth.<locals>.<genexpr>�   s   é € ÐDÑ+C™-˜'•Ó+Cùs   ‚N)Únextr„   )r
   s   &r   Úresolve_git_basic_authr�   �   s   € äÑDÔ+>¸sÔ+CÓDÀdÓKÐKr   c               ó(   € V ^8„  d   QhRRRRRRRR/# )	r	   r:   úMapping[str, str]r
   r   r0   rT   r   zdict[str, str]r   )r   s   "r   r   r   ’   s+   € ÷ ñ Ð(ð ¨sð Ø1ðØ=Kñr   c                ó”  € \        V 4      p \        V4      pVf   V # Vf   \        V4      pVf   V # \        P                  ! V^ ,           RV^,           2P                  4       4      P                  4       p\        V P                  RR4      ;'       g    ^ 4      pRV R2V RV 2&   RV 2V RV 2&   \        V^,           4      V R&   V # )	a3  Copy of *env* (a :func:`noninteractive_git_env` result) that authenticates HTTPS requests to
*url*'s origin via a ``GIT_CONFIG_*`` ``http.<origin>/.extraheader`` entry when a credential is
available (*auth*, else the first stored one); unchanged otherwise. The header lives only in
this process environment.r   ÚGIT_CONFIG_COUNTrW   zhttp.z/.extraheaderÚGIT_CONFIG_KEY_zAuthorization: basic ÚGIT_CONFIG_VALUE_)
rj   r    r�   Úbase64Ú	b64encodeÚencodeÚdecodeÚintro   r   )r:   r
   r0   rS   ÚencodedÚidxs   &&&   r   Úwith_git_authr›   ’   sØ   € ô ˆs‹)€CÜ˜3Ó€FØ‚~Øˆ
Ø‚|Ü% cÓ*ˆØ‚|Øˆ
Ü×Ò $ q¥' ¨!¨D°­G¨9Ð5×<Ñ<Ó>Ó?×FÑFÓH€GÜ
ˆc�g‰gÐ(¨#Ó.×3Ð3°!Ó
4€CØ%*¨6¨(°-Ð#@€Cˆ/˜#˜ÐÑ Ø'<¸W¸IÐ%F€CÐ
˜C˜5Ð!Ñ"Ü! #¨¥'›l€CÐÑØ€Jr   c               ó    € V ^8„  d   QhRRRR/# )r	   r:   r�   r   zset[str]r   )r   s   "r   r   r   ¨   s   € ÷ oñ oÐ(ð o¨Xñ or   c                óº   € V P                  4        UUu0 uF9  w  rVP                  R 4      '       g   K  VP                  R4      '       g   K7  VkK;  	  upp# u uppi )r“   zAuthorization:)ÚitemsÚ
startswith)r:   ÚkÚvs   &  r   Ú_auth_headersr¢   ¨   s>   € ØŸ)™)œ+Ôn™+‘$�!¨¯©Ð6I×)JŒAÈqÏ|É|Ð\l×Om�AˆA™+ÒnÐnùÓns   ”A´AÁAzwcould not read (?:username|password)|terminal prompts disabled|authentication failed|(?:error|status|http)[: ]+40[13]\bc               ó    € V ^8„  d   QhRRRR/# )r	   rK   úsubprocess.CompletedProcessr   Úboolr   )r   s   "r   r   r   µ   s   € ÷ Hñ HÐ)Dð HÈñ Hr   c                ó  € . pV P                   V P                  3 FG  p\        V\        4      '       d   VP	                  RRR7      pTP                  T;'       g    R4       KI  	  \        P                  RP                  V4      4      RJ# )z{True when a failed git run says the remote demands a credential (vs. a typo'd URL,
a missing commit, a network error, ...).r2   r3   )r7   ri   Ú
N)	ÚstderrrH   Ú
isinstanceÚbytesr—   r~   Ú_CREDENTIAL_REQUIRED_REÚsearchÚjoin)rK   ÚpartsÚstreams   &  r   Úis_credential_required_errorr°   µ   sr   € ð €EØ—=‘= &§-¡-Ó0ˆÜ�fœe×$Ò$Ø—]‘] 7°9�]Ó=ˆFØ�‰�V—\�\˜rÖ"ñ 1ô #×)Ñ)¨$¯)©)°EÓ*:Ó;À4ÐGÐGr   c               ó(   € V ^8„  d   QhRRRRRRRR/# )	r	   Úargvz	list[str]r
   r   r:   r�   r   r¤   r   )r   s   "r   r   r   À   s,   € ÷ +ñ +Ø
ð+Øð+Ø'8ð+à ñ+r   c               ó6  € VP                  R\        P                  4       \        V4      pVP	                  RR4       VP	                  RR4       \        P
                  ! V 3RV/VB pVP                  ^ 8X  g   V'       d   \        V4      '       g   V# \        W!4      pWR8X  d   V# \        P
                  ! V 3RV/VB p\        V4      p. p\        V4       Fë  w  r‰VP                  ^ 8X  g   \        V4      '       g    MÆ\        W!V	4      p
\        V
4      pW¶8:  d   VP                  V4       KY  Wk,          p\        P                  R\        V4      RP                  V4      ;'       g    RV4       \        P
                  ! V 3RV
/VB pVP                  ^ 8w  g   KÇ  \        V4      '       g   KÚ  VP                  V4       Kí  	  VP                  ^ 8w  dA   R	V9   d:   \!        VP"                  \$        4      '       d   V;P"                  R
,          un        V# )a¢  Run the git network verb *argv* against *url* anonymously; when the remote refuses with
the credential-required class, rerun with each credential the user owns for that host, in
precedence order, until one is accepted or the failure stops being about credentials. *env*
is a :func:`noninteractive_git_env`; *run_kwargs* must capture output so the refusal can be
classified. Empty *url* means no fallback (local verbs).r9   r[   Nr\   r:   z4%s rejected the credential from %s; retrying with %sz, zthe stored credentialru   zˆ
hint: the GITHUB_TOKEN/GH_TOKEN in your .env was rejected by GitHub; replace it or remove it (gh auth login is used when it is absent).)Ú
setdefaultr@   rB   rj   r?   rA   rG   r°   r›   r¢   r„   r~   rE   Úwarningr    r­   r©   r¨   r   )r²   r
   r:   Ú
run_kwargsrK   Úauth_envÚsentÚrejectedr‚   r0   Úcandidate_envÚheaderss   &&$,        r   Ú run_git_with_credential_fallbackr¼   À   sÆ  € ð ×Ñ˜'¤:×#5Ñ#5Ô6Ü
ˆs‹)€Cð ‡G�GˆM˜4Ô Ø‡G�GˆM˜4Ô Ü�^Š^˜DÑ8 cÐ8¨ZÑ8€FØ×Ñ˜AÔ§SÔ0LÈV×0TÒ0TØˆÜ˜SÓ&€HØ„ØˆÜ�^Š^˜DÑ= hÐ=°*Ñ=€FÜ˜Ó"€DØ€Hô ,¨CÖ0‰ˆØ×Ñ Ô!Ô)EÀf×)MÒ)MÙÜ% c°Ó5ˆÜ Ó.ˆØŒ?Ø�O‰O˜FÔ#ÙØ�ˆÜ�‰ÐMÜ$ SÓ)¨4¯9©9°XÓ+>×+YÐ+YÐBYÐ[aô	cä—’ ÑF¨-ÐF¸:ÑFˆØ×Ñ Ö!Ô&BÀ6×&JÔ&JØ�O‰O˜FÖ#ñ 1ð ×Ñ˜AÔÐ"9¸XÔ"EÌ*ÐU[×UbÑUbÔdg×JhÒJhØ�Šð `õ 	a�à€Mr   rP   )%Ú__doc__Ú
__future__r   r”   Úloggingrk   Úrer=   r@   Úurllib.parser   Útypingr   r   r   Úhermes_cli._subprocess_compatr   r   Ú	getLoggerÚ__name__rE   r}   r    r*   rM   rQ   rr   r„   rw   r�   r›   r¢   ÚcompileÚ
IGNORECASEr«   r°   r¼   r   r   r   Ú<module>rÈ      s¥   ðñõ6 #ã Û Û 	Û 	Û Û Û ß .Ñ .ç Tà	×	Ò	˜8Ó	$€àÐ0Ð1€õõHõ)õ,2õõ:õ(8õL÷
õ,oð Ÿ*š*ð+à‡M�MóÐ õH÷+r   