+ WjHaRJt"0tRt^RIt^RIt^RIt^RIt^RIt^RIt^RIHtH t H t ^RI H t H t Ht]P!R4tRRRR/t]^kRKRR lltR R ltR R ltRRltRRltRRltRRRRRRRRRRRR/RRRR RRRR!RR"RR/RR#RR$RR%RR&RR'RR/RR(RR)RRRR*RR+RR/RR,RR-RRRR.RR/RR/RR0RR1RR%RR2RR3R]/RR4RR5RR%RR6RR7R]/RR8RR9RR%RR:RR;R]/3t]^k/t]^k]P4!4tR<R=ltR>R?ltR@RAlt]!R4RBRCl4t]!RD4RERFl4t ]!RG4RHRIl4t!R#)LzDashboard OAuth/login-status helpers: provider catalog, per-provider device pollers, Anthropic/Copilot/Claude-Code status probes. N)datetimetimezoneUTC)AnyDictOptionalzhermes_cli.web_server logged_inFsourcecRV^8dQhR\\,R\R\/#)valuevisiblereturn)rstrint)formats"OC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\web_server_oauth.py __annotate__rs% < <8C= <3 `` placeholder.z.u…N)callable isinstancercountrsplitlen)r r ss&& r_truncate_tokenrss z%55" E Awws|q HHS! R A'!1;Qxy\N';;rc V^8dQhR\R\R\\\3,R\\\3,/#)r r source_labelcredsrrdictr)rs"rrr#s;#Sc3hDQTVYQYNrcRRRVRVR\VPR44RVPR4R\VPR 44/#) rTr r! token_preview accessToken expires_at expiresAthas_refresh_token refreshToken)rgetbool)r r!r"s&&&r _token_statusr.#sNT8V^\=)ABeii ,.A4 R`HaCb rcFV^8dQhR\\\3,/#r rr$rr)rs"rrr+sc3hrc ^RIHpHpV!4pV'd.VP R4'd\ RRX!4 R2V4#Rp^RIHpVR,Pp^R I H p^R I HpVFTpV!V4;'g\P !V4pV'gK3R R R RRV V!V4 2R\#V4RRRR/u# \%\&4# \dRpLi;i \\3dLi;i)ubStatus for the "Anthropic Account" card: Hermes-managed PKCE file first, then the registry-ordered env vars (process env — where Bitwarden-sourced secrets land — then .env). Claude Code's ``~/.claude/.credentials.json`` is deliberately NOT read here; it has its own ``claude-code`` entry, and counting it here would shadow a real ANTHROPIC_API_KEY. )read_hermes_oauth_credentials_get_hermes_oauth_fileNr' hermes_pkcez Hermes PKCE ())PROVIDER_REGISTRY anthropic) get_env_value)format_secret_source_suffixrTr env_varr!r&r(r*F)ANTHROPIC_API_KEYANTHROPIC_TOKENCLAUDE_CODE_OAUTH_TOKEN)agent.anthropic_credentialsr3r4 Exceptionr,r.hermes_cli.authr7api_key_env_vars ImportErrorKeyErrorhermes_cli.configr9hermes_cli.env_loaderr:osgetenvrr$ _LOGGED_OUT) r3r4 hermes_creds env_var_orderr7r9r:varr s r_anthropic_oauth_statusrM+s e46  ((77]m=C>cFV^8dQhR\\\3,/#r0r1)rs"rrrLs$sCx.rc^RIHpHpV!4pV'dV!V4'd\RRV4#\ \ 4# \dLi;i)zClaude Code CLI credentials as their own entry, independent of the Anthropic card. Connected follows the same local validity gate as Anthropic resolution. A persisted access token that has already expired is not a usable login. )is_claude_code_token_validread_claude_code_credentialsclaude_code_cliz~/.claude/.credentials.json)r?rPrQr.r@r$rI)rPrQr"s r_claude_code_only_statusrSLsW   -. /66 !24QSXY Y      sA A A AAcFV^8dQhR\\\3,/#r0r1)rs"rrr_sT#s(^rc^RIHpV!R4;'g/p\VP R44p\VP R44pV'dVP R4;'gRpMEV'd<VP R4;'gVP R4;'gR pR V R 2pMR pR VRRRVRRRRRRRV/# \d/pLi;i)uStatus for copilot-acp. ``logged_in`` only on positive evidence (env token or known on-disk store); the CLI may hold its session in an OS keychain Hermes can't read, so the unverified state reads "managed by the Copilot CLI" — never signed out.)$get_external_process_provider_status copilot-acp auth_verified configured auth_sourcezCopilot credentials detectedresolved_commandcommandcopilotz#Managed by the GitHub Copilot CLI (r6z$GitHub Copilot CLI not found on PATHrr copilot_clir!r&Nr(r*F)rArVr@r-r,)rVstatusverifiedrYr!founds r_copilot_acp_statusrb_sH5mDJJFJJ/0Hfjj./Jzz-0RR4R  -.TT&**Y2GTT9DYtf% %  N   N s- B;B;B;B;%B;5B;; C  C idnousnamez Nous Portalflow device_code cli_commandzhermes auth add nousdocs_urlzhttps://portal.nousresearch.com status_fnz openai-codexzChatGPT or Codex Subscriptionzhermes auth add openai-codexz https://platform.openai.com/docsz qwen-oauthzQwen (via Qwen CLI)externalzhermes auth add qwen-oauthz#https://github.com/QwenLM/qwen-code minimax-oauthzMiniMax (OAuth)zhermes auth add minimax-oauthzhttps://www.minimax.io xai-oauthz%xAI Grok OAuth (SuperGrok / Premium+)zhermes auth add xai-oauthz@https://hermes-agent.nousresearch.com/docs/guides/xai-grok-oauthrWzGitHub Copilot (ACP)z copilot loginz"https://docs.github.com/en/copilotr8zAnthropic Accountzhermes auth add anthropicz.https://docs.claude.com/en/api/getting-startedz claude-codezAAnthropic OAuth: Required Extra Usage Credits to Use Subscriptionzclaude setup-tokenz+https://docs.claude.com/en/docs/claude-codec\V^8dQhR\\,R\\,/#)r profiler)rr)rs"rrrs"#8C=rcxT;'gRP4pV'dVP4R8XdR#V#)rcurrentN)rklower)r} requesteds& r_oauth_profile_namers0B%%'I  )Y6 rc$V^8dQhR\/#)r labelrf)rs"rrrsrcaV3RlpV#)aWrap a device-code poller body ``fn(session_id, sess)``: vanished session is a no-op, success marks ``approved``, any exception records ``error`` + ``error_message`` on the session instead of raising (the thread has no caller; the dashboard reads the status).cP<a\P!S4RVV3Rll4pV#)c(V^8dQhR\RR/#)r session_idrNrf)rs"rr1_oauth_poller..deco..__annotate__s 3 3s 3t 3rc<\;_uu_4\PV4pRRR4X'gR#S!W4\;_uu_4VR,R8gpV'gRVR&RRR4X'd"\P RSVR,V4R#\P RSV4R# +'giL;i +'giLe;i \ dsp^RIHp\PRSY4T!Y4\;_uu_4RTR&\T4TR &RRR4Rp?R# +'giRp?R#;iRp?ii;i) Nr_pendingapprovedz,oauth/device: %s login ended %s (session=%s)z-oauth/device: %s login completed (session=%s))note_oauth_failurez+%s device-code poll failed (session=%s): %serror error_message) _oauth_sessions_lock_oauth_sessionsr,_loginfor@-hermes_cli.observability.shared_metrics_setuprwarningr)rsesssettlederfnrs& rpoller+_oauth_poller..deco..pollers%%&**:6& 3:$))#8n 9G")3X * IILeUYZbUceopIIMuV`a&% *) 3\ JES]a"4+))%,DN,/FD)*))))  3sdB3CC)C9CC3 C  C C E$3ED9+E9 E EEE) functoolswraps)rrrsf rdeco_oauth_poller..decos*   3 3  30 r)rrsf r _oauth_pollerrs6 KrcVV^8dQhR\\\3,R\RR/#)r rstaterNr1)rs"rrrs.!I!IS#X!Is!It!Irc \VRR4pVR9dR#\;_uu_4VR8XdoVP;'gRVR&VP'd VPMRVR&\ VP 4VR&VPVR&RRR4R#VR 8XdR VR &RRR4R#VR 8Xd:R R uVR &VR&VP;'g VPVR&RRR4R#R VR &\VRR4;'g T;'gR VR&VPVR&\\VRR44VR&\\VR^4;'g^4VR&RRR4R# +'giR#;i)aaWrite one ``anon_auth.SignInState`` onto the dashboard session, under the sessions lock. The whole desktop mapping lives here: the state carries its own copy, so nothing below turns a reason into a string. ``completed`` deliberately leaves ``status`` on ``"pending"`` so the :func:`_oauth_poller` wrapper stamps ``"approved"`` when the poller returns. kindrN completed account_emailmodelhandoffhandoff_status cancelledr_ timed_outrtimeoutreasonr retryableF retry_after)codewaiting) getattrremail model_changedrlistrrdetailcopyr-r)rrrs&& r_record_sign_in_statersm 5&" %D ""   ; $)KK$7$74D !+0+>+>+>EKKDDM"5==1DO%*%9%9D! "    ; (DN    ; -4i *DNDN$)LL$>$>EJJD ! #  $!X "5HHHHX % _  U!CD[!'%"B"G"GaH]/    s<E0E09E0 E02$E0E02E0 E0AE00 F cVV^8dQhR\R\\\3,RR/#r rrrNr#)rs"rrrs)SS#X4rc VPR4pVfR#VFp\W4K \P!\4;_uu_4VP 4RRR4R# +'giR#;i \P!\4;_uu_4TP 4RRR4i +'gii;i;i)aDrain the sign-in the start route began: the one shared flow, rendered onto the session. The generator was created and advanced to its ``Code`` state by ``_start_nous_device_code``, so it is already holding the device code and its HTTP client. Nothing here is wrapped in ``_profile_scope``: that context manager holds a process-global lock and swaps module attributes across its ``yield``, and this loop can last the sign-in code's whole expiry. The generator scopes its own short config/auth-store sections instead. _sign_inN)r,r contextlibsuppressr@close)rrgenrs&& r_nous_sign_in_pollerrs ((: C {E !$ .  + + IIK, + + +Z  + + IIK, + + +s/A>A** A; >#C!B; 2 C; C CminimaxcVV^8dQhR\R\\\3,RR/#rr#)rs"rrrs),1,1,14S>,1d,1rc!^^RIHp^RIHpHpHpHpHp^RIpVR,VR,rVPVPR4RR/R R 7;_uu_4p V!WV VR ,VR ,VR ,VPR4R7p RRR4\P!\4p V!\X R,4V R7pRRRVPRR4RV RVRV RVRV PRR4RV R,RV R,RV PR4RV P!4R\P"!V\R7P!4R \%^\WP'4, 44/ pV!VPR!44;_uu_4\(;_uu_4VPR"4'dR"VR#&RRR4RRR4R#V!V4RRR4RRR4R# +'giELs;i +'giL.;i +'giR#;i)$aeMiniMax poller: PKCE-style ``code_verifier`` + ``user_code`` instead of Nous's ``device_code``. Builds the same auth_state as the CLI's ``_minimax_oauth_login`` and persists via ``_minimax_save_auth_state`` so the system ends up as after ``hermes auth add minimax-oauth``. Region is fixed to "global" here; cn-region operators use the CLI's ``--region cn``._profile_scope)_minimax_poll_token"_minimax_resolve_token_expiry_unix_minimax_save_auth_stateMINIMAX_OAUTH_GLOBAL_INFERENCEMINIMAX_OAUTH_SCOPENportal_base_url client_idg.@Acceptapplication/jsonT)rheadersfollow_redirects user_code code_verifierexpired_in_raw interval_ms)clientrrrr expired_inrr)nowproviderrzregionglobalinference_base_urlscope token_typeBearer access_token refresh_token resource_url obtained_atr()tz expires_inr}rr_)hermes_cli.web_server_profilesrrArrrrrhttpxClientTimeoutr,rrrr isoformat fromtimestampmax timestampr)rrrrrrrrrrrr token_datar expires_at_ts auth_states&& r_minimax_pollerrs >!%&7!8${:KY  d#h8J-K^b    (i;'tO7L,-488M;R   ,,s C6s:l;S7TZ]^MO$((8X.?<Y$jnn\8< >2O4 ~6s}}h,,]sCMMOc!S!@ABJ + , ," !xx $$!,X" - , %Z 0 " - ,3   8" ! - , ,s<3G4H*H HH "H4 H  H H H, xaicVV^8dQhR\R\\\3,RR/#rr#)rs"rrrGs.&A&A3&Ad38n&A&Arc4^RIHp^RIp^RIHpHpHpHpHpV!R4p VPVPR4RR/R7;_uu_4p V!WR,VR ,\^<\VR ,\P!4, 44\VR ,4R 7p RRR4R \X PR R4;'gR4P!4R\V PRR4;'gR4P!4R\V PRR4;'gR4P!4RV PR4R\V PR4;'gR4P!4;'gR/p V!VPR44;_uu_4\";_uu_4VPR4'dRVR&RRR4RRR4R#V!WRR\$P&!\(4P+4P-RR4R7V!R4V!RR 4RRR4RRR4R# +'giEL;i +'giL.;i +'giR#;i)z3Background poller for xAI's OAuth device-code flow.rN)_save_xai_oauth_tokens_xai_oauth_discovery_xai_oauth_poll_device_tokenmark_provider_active_if_unsetunsuppress_credential_sourceg4@rr)rrtoken_endpointrur(interval)rrur poll_intervalrrrid_tokenrrrr}rr_oauth_device_codeFz+00:00Z) discovery auth_mode set_active last_refreshr{)rrrrArrrrrrrrrtimerr,rkrrrrrreplace) rrrrrrrrrrrrtokenss && r_xai_device_pollerrFs> %T*I emmD1HFX;Y Z Z^d1 -=#>DQ^L_2s4 #5 #CDEUXY]^hYiUj  [ JNN>2>DD"EKKMZ^^OR@FFBGMMOC z26<<"=CCEjnn\2c*..6BB(CIIKWWx F + , ,.B.B 88K (DN  /C , ,  3FSX!c*446>>xM &k2 %[-@!/C , , [ Z Z/C.B , , ,s> AI;J I3 (J:AI3 J I0 3 J >J J c2V^8dQh/^\9d\\\3,;R&^\9d(\\\\3,R3,;R&^\9d,\\\\\3,3,;R&#)r rI._OAUTH_PROVIDER_CATALOGr)__conditional_annotations__r$rrtuple)rs"rrrsw"CBT#s(^B#^tCH~s23_^0/c4S>)*/_r))#r __doc__rloggingrrG threadingrrrrtypingrrr getLoggerrrIrr.rMrSrbrpr rLockrrrrrrrr)r s@rrs"  ,,&&01 +E8TB B <B&06 66=&-Pf2KG >6#BFM2J@b$ <!6 0*>c$  ?F$5v}3ZAY[fhln ; GQ^/SU`bfh  =&"8&*m]l5{DWY  ; 3VZXsA;Pgi =&"e Z(<> Meg97@.0/ ~~'D!IHv(y,1,1^u&A&Ar