+ WjrRt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t H t ^RI H t ]P!]4t]!RR04tR^PRR /tR R ltR R lt!RR]P,P.4t!RR]P,P24tRRltRR/RRlltRRRR/RRllt.ROtR#)z>Security policy for credential-bearing stdlib urllib requests.) annotationsN)CallableIterable)Anyacceptz user-agenthttphttpsic V^8dQhRRRR/#)urlstrreturnztuple[str, str, int | None])formats"NC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\urllib_security.py __annotate__rsyyCy7yc>\PPV4pVP;'gRP 4pVP pY!P ;'gRP 4PR4VeV3#\PV43#)z>Return a normalized (scheme, hostname, effective port) origin..) urllibparseurlparseschemelowerporthostnamerstrip_DEFAULT_PORTSget)r parsedrrs& r url_originr!s \\ " "3 'Fmm!!r ( ( *F ;;D OO))r00299#>HX xx^l^p^pqw^x xxrc V^8dQhRRRR/#)r keepzfrozenset[str]r Noner)rs"rrrs((.(T(rc\VP44F-wr#VP4V9gKVPV4K/ R#)zFDrop every header on *request* whose lowercased name is not in *keep*.N)list header_itemsr remove_header)requestr#name_values&& r_strip_headersr,s8W1134  ::9SafeCredentialRedirectHandler.__init__..-s 3lRk$CIOO4E4ERks&(N)r!_original_origin frozenset_cross_origin_safe_headers)selfr1r/s&&$r__init__&SafeCredentialRedirectHandler.__init__)s%!+< 8*33lRk3l*l'rc <\SV`WW4WV4pVfR#\\PP VP V44VP8wd\WpP4V#r5) superredirect_requestr!rrurljoinfull_urlr9r,r;) r<reqfpcodemsgheadersnewurl redirected __class__s &&&&&&& rrA.SafeCredentialRedirectHandler.redirect_request/s]W-ct'R   fll**3<<@ ATEZEZ Z :'F'F Gr)r;r9) __name__ __module__ __qualname____firstlineno____doc___CROSS_ORIGIN_SAFE_HEADERSr=rA__static_attributes__ __classcell__)rKs@rr.r.&sKmOim  rr.cJ]tRt^ ?r)r9N) rMrNrOrPrQfloat handler_orderr=r_ http_request https_requestrSrrrrVrV<s&D %LM9 LMrrVcV^8dQhRR/#)r r zssl.SSLContext | Noner)rs"rrrQs  !6 rc ^RIHpV!4R#)uTLS context for Hermes-owned urllib openers. None means "use urllib's default", which — with the OS trust store installed process-wide — already verifies against the platform's certificates. There is nothing to resolve here any more. install_truststoreN)agent.ssl_verifyrhrgs r_resolved_https_contextrjQs4 r ssl_contextcV^8dQhRR/#)r r1r r)rs"rrr^ssrcT\\PRR4pVfN\4p\PP!Vf.M \PP VR7.!p\\PRR4pVRJ;'dVRJp\VRR4Uu.uF`p\ V\PP4'dK/V'd\ Wd4'dKJ\P!V4NKb ppV'dVPV!VR74VP\V44VP\V44\PP!V!p\\VRR44Vn .VnV#uupi)aClone the installed opener's handlers, replacing redirect policy only. When ``ssl_context`` is provided, the cloned HTTPS handler is replaced with one bound to that context so per-provider TLS settings (``ssl_ca_cert`` / ``ssl_verify``) apply to this request. When it is None, Hermes-owned openers verify against the OS trust store; an application-installed opener's TLS policy is preserved unchanged. _openerN)context HTTPSHandlerhandlers addheadersr)getattrrr)rj build_openerrp isinstanceHTTPRedirectHandlercopyappendr.rVr&_hermes_initial_addheadersrr) r1rk installedro_https_handler_cls replace_httpshandlerrqsecureds &$ r$_secure_opener_from_installed_policyr^sS 48I)+NN//"fnnNiNiryNiNzM{}  Ft+NN0B$0NMy*b99G'6>>#E#EF :g#J  '9  *;?@ OO1,?@ OO0>?nn))84G*.gir.R)SG&G Ns',F%F% F%3F%opener_factoryc$V^8dQhRRRRRR/#)r r)r]timeoutrarzCallable[..., Any] | Noner)rs"rrrs(11 #11. 1rcVfY\VPVR7p\VRR4F/wrVVPV4'dKVP WV4K1 MV!\ VP44pVP WR7#)aOpen a request without forwarding credentials across origins. The default preserves an application-installed opener's proxy, TLS, cookies, custom protocol handlers, and instrumentation while replacing its redirect handler. ``opener_factory`` is an explicit test seam; security is never disabled based on global ``urlopen`` identity. ``ssl_context`` (an ``ssl.SSLContext``) overrides the HTTPS handler's TLS policy for this request only. It is used to honor a custom provider's ``ssl_ca_cert`` / ``ssl_verify`` on the ``/models`` discovery path, which otherwise falls back to the process-wide platform trust store (``agent.ssl_verify.install_truststore``). )rkry)rr)rrCrs has_header add_headerr.open)r)rrrkopenerr*values&$$$ ropen_credentialed_urlrs|(5g6F6FT_`"6+GLKD%%d++""4/M =g>N>N OP ;;w; 00r)r.rr!)rQ __future__rrwloggingssl urllib.parserurllib.requestcollections.abcrrtypingr getLoggerrMloggerr:rRrr!r,r)rvr. BaseHandlerrVrjrr__all__rrrrsD"  .   8 $','?@"gs+y(FNN$F$F,6>>#=#=* 4D115 1  1< Sr