+ Wja0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt ^RI H t ]P!] 4tRt^tRsR]R&Rs]P(3RRlltR R ltR R ltRR RlltRRltR#)uSCredentials and failure copy for the update check's api.github.com calls. The passive source check asks the REST API for a branch tip. Unauthenticated that budget is 60 requests/hour keyed on the *client IP*, so a shared exit (office NAT, VPN, proxy) exhausts it for everyone behind it and the check reports a 403 that read as "Hermes can't reach the update server". Authenticating moves the caller onto the token's 5,000/hour budget. Credential ladder: GITHUB_TOKEN, then GH_TOKEN, then ``gh auth token`` (the gh CLI's own login — the only rung most desktop users have, since a GUI-launched app inherits a minimal environment; its answer is cached per process so the check never spawns gh more than once), then anonymous. A token GitHub rejects (401) drops that request to anonymous. The token itself never reaches a log line or an error string. ) annotationsN)Optional Optional[str] _gh_cli_cacheFcV^8dQhRR/#returnr)formats"IC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\github_api.py __annotate__r !s]c\F8pVPV4;'gRP4pV'gK6Vu# R#)zLFirst non-blank env token, trimmed. A blank value falls through to the next.N)GITHUB_TOKEN_ENV_VARSgetstrip)envnamevalues& r github_token_from_envr!s9%$$"++- 5L& rcV^8dQhRR/#rr )r s"r r r *s}rc \'d\#Rs^RIHp\P !.R ORRRR\ \PV!4RR7 pTP^8XdTPP4MRpT;'gRs\# \\P3d"p\PRT4Rp?R#Rp?ii;i) T)windows_hide_flagszutf-8replaceF)capture_outputtextencodingerrorstimeoutstdin creationflagscheckz#gh CLI token lookup unavailable: %sNr)ghauthtoken)_gh_cli_probedrhermes_cli._subprocess_compatr subprocessrun_GH_CLI_TIMEOUT_SECONDSDEVNULLOSErrorSubprocessErrorloggerdebug returncodestdoutr)rresultexcr&s r _gh_cli_tokenr5*s~N@ #Dtg^g+:3E3EUgUi &,%6%6!%;FMM   !EMMTM  Z// 0 :C@s8BC.C  CcV^8dQhRR/#rr )r s"r r r >s66m6rc:\4;'g \4#)z7The credential for this request, or None for anonymous.)rr5r rr github_tokenr8>s " 5 5mo5rc(V^8dQhRRRRRRRR/#) rr4 BaseException authenticatedboolnowzOptional[float]r strr )r s"r r r Cs)"$"$"$t"$/"$eh"$rc\V\PP4'dVPpVP ;'g/p\ VR4pVR9dV^8Xd{\ VR4pRpVeO\Ybf\P!4MT, ^;,^<,4pV^8dV^8XdRMRV R2pV'd RV RV R 2#R V R V R 2#VR 8dRV R2#RV R 2#\V\PP4'dIVPp \V \4'gR\V 4P49dR#RV R2#\V\4'dR#RV 2#)uHOne line a user can act on instead of a generic "could not resolve" (#105855). A 403/429 with ``x-ratelimit-remaining: 0`` is the anonymous per-IP budget spent by every client behind one exit — the line names the fix the user actually has (a GITHUB_TOKEN) and the real reset time. Any other status is reported as what it is. zx-ratelimit-remainingzx-ratelimit-resetzwithin an hourzin about a minutez in about z minutesz:GitHub API rate limit reached for your GITHUB_TOKEN (HTTP u) — it resets .z$GitHub API rate limit reached (HTTP z): anonymous requests are limited to 60 per hour per network address, shared with everyone behind the same connection. It resets z:; setting GITHUB_TOKEN in the environment lifts the limit.izGitHub is having trouble (HTTP uE from api.github.com) — check githubstatus.com and try again later.zapi.github.com answered HTTP z timed outz0api.github.com did not answer within 10 seconds.z%Connection to api.github.com failed (u/) — check your connection, firewall or proxy.zapi.github.com: )ii) isinstanceurlliberror HTTPErrorcodeheaders _header_intinttimeURLErrorreason TimeoutErrorr>lower) r4r;r=statusrF remainingresetwhenminutesrKs &&& r describe_github_failurerSCs#v||--..++##)@A Z IN)<=E#D u{ LrQVXXYa<29Q,.iPWyX`DaDSTZS[[klpkqqrss:6(CggkflmOO P S=5fX>++ ,.vha88#v||,,-- fl + +{c&k>O>O>Q/QE6vh>mnn#|$$A cU ##rc V^8dQhRRRR/#)rrr>r z Optional[int]r )r s"r r r hss}rc\\VPVR44P44# \\ 3dR#i;i)rN)rHr>rr TypeError ValueError)rFrs&&r rGrGhsB3w{{4,-33566 z "s14A A ) GITHUB_TOKENGH_TOKEN)N)__conditional_annotations____doc__ __future__rloggingosr)rI urllib.errorrBtypingr getLogger__name__r/rr+r__annotations__r'environrr5r8rSrG)rZs@r resp#     8 $4# }#!jj(6 "$Jr