Yj)dZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z m Z m Z ddlmZmZddlmZddlmZmZmZmZmZmZddlmZdd lmZdd lmZdd l m!Z!m"Z"ddl#m$Z%dd l#m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3ej4e5Z6dedZ7dZ8dZ9dZ:e;hdZdZ?dZ@e@dZAdZBdZCdZDdZEeBeCeDeEhZFdZGdZHdZIdZJe;hd ZKdfd&ZLe Gd'd(ZMdgd*ZNdhd.ZOdid1ZPdjd4ZQdkd7ZRdld9ZSdmd=ZTdnd?ZUdodAZVdpdqdCZWdpdrdGZXdsdIZYdtdKZZdudLZ[ddMdvdOZ\dPZ]dwdTZ^GdUdVZ_dxdXZ`dydYZadzd[Zbdzd\Zcd]d^d{dbZdd|dcZed}ddZfdS)~z invalid_grant invalid_token token_revokedtoken_invalidatedunauthorized_clientrefresh_token_reusediQoauthapi_keymanualz :device_code fill_first round_robinrandom least_usedi,zcustom:> tlsscope client_id expires_in token_type obtained_at agent_key_id secret_sourceportal_base_urlagent_key_reusedsecret_fingerprintagent_key_expires_inagent_key_obtained_atproviderstrtokenr auth_typec|dkr1t|tr|drtSt|ptS)zHInfer pool auth metadata for token formats with one unambiguous meaning. anthropicz sk-ant-oat) isinstancerK startswithAUTH_TYPE_OAUTHAUTH_TYPE_API_KEY)rJrLrMs r*_normalize_pool_auth_typerTsS K uc " "   \ * *  y-- . ..ceZdZUded<ded<ded<ded<ded<ded<ded <d Zd ed <d Zd ed <d Zded<d Zded<d Zd ed<d Z d ed<d Z ded<d Z d ed<d Z d ed<d Z ded<d Zd ed<d Zd ed<d Zd ed<d Zd ed<dZded<d Zded<d Zd*d"Zed+d&Zd,d'Zed-d(Zed.d)Zd S)/PooledCredentialrKrJidlabelrMintprioritysource access_tokenN Optional[str] refresh_token last_statusOptional[float]last_status_at Optional[int]last_error_codelast_error_reasonlast_error_messagelast_error_reset_atbase_url expires_at expires_at_ms last_refreshinference_base_url agent_keyagent_key_expires_atr request_countDict[str, Any]extracl|ji|_t|j|j|j|_dSN)rqrTrJr]rMselfs r* __post_init__zPooledCredential.__post_init__s6 : DJ2 M   N  rUnamec|tvr|j|Stdt |jd|)N'z' object has no attribute ) _EXTRA_KEYSrqgetAttributeErrortype__name__)rurws r* __getattr__zPooledCredential.__getattr__sJ ;  :>>$'' 'Xd!4XXPTXXYYYrUpayloadr#'PooledCredential'cdt|D}fd|D}d|vr3t|dtrt|d|d<fdtD}||d<|dt jjdd|d d ||d t|d d |d t|d d|dd|i|S)Nc2h|]}|jdk |jS)rJrw.0fs r* z-PooledCredential.from_dict..s&KKK!af 6J6Jqv6J6J6JrUcDi|]}|v||S)r{rkrs r* z.PooledCredential.from_dict..s*GGGa!w,,7;;q>>,,,rUrbc:i|]}|v|||Srsrrs r*rz.PooledCredential.from_dict..s1___1qG||PQ H^GAJH^H^H^rUrqrXrYr\rMr[rr]rJr) rrPrK_parse_absolute_timestamprz setdefaultuuiduuid4hexr{rS SOURCE_MANUAL)clsrJr field_namesdatarqs ` r* from_dictzPooledCredential.from_dictsDKKvc{{KKK GGGG;GGG t # # 48H3I3(O(O #%>tDT?U%V%VD! "____ ___W  djll.rr2333 Xx!@!@AAA  %6777  A&&& -000 +++s--H----rUchd}i}t|D]6}|jdvr t||j}| |j|vr |||j<7|jD] \}}||||< t ||jS)N>r`rbrdrerfrg>rqrJ)rrwgetattrrqitemsrrJ)ru _ALWAYS_EMITresult field_defvaluervs r*to_dictzPooledCredential.to_dicts   "$ / /I~!666D).11E INl$B$B).y~&J$$&&  DAq}q 3FDMJJJrUc V|jdkr|j|jf|j|jffD]j\}}t |t rP|r)r>rir) rJrmrnr]rirPrKstripauth_mod_nous_invoke_jwt_is_usabler)rurLris r*runtime_api_keyz PooledCredential.runtime_api_keys =F " "!:;"DO4& ) )!z uc** )  )!;%dGT::#- )!;;==(((24$*+++rUcB|jdkr|jp|jS|jS)Nr)rJrlrhrts r*runtime_base_urlz!PooledCredential.runtime_base_urls' =F " "*;dm ;}rU)rwrK)rJrKrrpr#r)r#rp)r#rK)r#r^)r~ __module__ __qualname____annotations__r_r`rbrdrerfrgrhrirjrkrlrmrnrorqrvr classmethodrrpropertyrrrrUr*rWrWs MMM GGGJJJNNNMMMKKK#'M''''!%K%%%%&*N****%)O))))'+++++(,,,,,+/////"H"""" $J$$$$#'M''''"&L&&&&(,,,,,#I####*.....M E       ZZZZ ...[. KKKK*,,,X,*XrUrWfallbackct|}dD]V}||}t|tr*|r|cSW|S)N)emailpreferred_usernameupn)rr{rPrKr)rLrclaimskeyrs r*label_from_tokenrsh  & &F5!! 3 eS ! ! !ekkmm !;;== OrUentriesList[PooledCredential]rZc>td|DddzS)Nc3$K|] }|jV dSrsr[rentrys r* z!_next_priority..s$445444444rU)default)max)rs r*_next_priorityrs) 44G444b A A AA EErUr\boolc|pd}|tkp|tdS)Nr:)rlowerrrQ)r\ normalizeds r*_is_manual_sourcersJ,B%%''--//J  & T**?*?=@S@S@S*T*TTrU error_coderccD|dkrtS|dkrtStS)zHReturn cooldown seconds based on the HTTP status that caused exhaustion.i)EXHAUSTED_TTL_401_SECONDSEXHAUSTED_TTL_429_SECONDSEXHAUSTED_TTL_DEFAULT_SECONDS)rs r*_exhausted_ttlr s*S((S(( ((rUrrac||dkrdSt|ttfr$t|}|dkrdS|dkr|dz n|St|tr|}|sdS t|}n#t $rd}YnwxYw| |dkr|dz n|S t j|dd S#t $rYdSwxYwdS)zBest-effort parse for provider reset timestamps. Accepts epoch seconds, epoch milliseconds, and ISO-8601 strings. Returns seconds since epoch. NrrlJ)@@Zz+00:00) rPrZfloatrKr ValueErrorr fromisoformatr timestamp)rnumericraws r*rrs;  } t%#u&&L,, a<<4#*->#>#>wGK% kkmm 4 CjjGG   GGG   '.1B'B'B7V## O )#++c8*D*DEEOOQQ Q   44  4s$9B BB+9C%% C32C3messagecx|sdStjd|tj}|rTt|d}|ddkr|dz n|Stjd|tj}|r"t|dStjd|tj}|rKt |ddzt |dd zzStjd |tj}|r%t |ddzStjd |tj}|r%t |dd zSdS) Nz,quotaResetDelay[:\s\"]+(\d+(?:\.\d+)?)(ms|s)rmsrz?retry\s+(?:after\s+)?(\d+(?:\.\d+)?)\s*(?:sec|secs|seconds|s\b)z'resets?\s+in\s+(\d+)\s*hr\s+(\d+)\s*minr<<zresets?\s+in\s+(\d+)\s*hr\bzresets?\s+in\s+(\d+)\s*min\b)research IGNORECASErgrouprrZ)r delay_matchr sec_match hr_min_match hr_only_matchmin_only_matchs r*_extract_retry_delay_secondsr2s t)KWVXVcddKQk''**++!,!2!21!5!5!;!;!=!=!E!Euv~~5P \^egigtuuI)Y__Q''(((9GRTR_``LS<%%a(())D03|7I7I!7L7L3M3MPR3RRRIWWN1>''**++b00 4rU error_contextOptional[Dict[str, Any]]rpct|tsiSi}|d}t|tr+|r||d<|d}t|tr+|r||d<|dp)|dp|d}t |}|>.%||~~ 8 **G'30GMMOO0 '  9*%% ,   [ ) ) ,   ] + + 099O:gs#;#;:7CC  *"ikk,??O"!0 : rUrc|jtkrdStt|dd}||S|jr|jt |jzSdS)Nrg)r`STATUS_EXHAUSTEDrrrbrrd)rrs r*_exhausted_untilrbse ,,,t(8Mt)T)TUUH L#nU5J&K&KKK 4rUrwcv|ddS)z>Normalize a custom provider name for use as a pool key suffix. -)rrrrs r*_normalize_custom_pool_namerms, ::<<     ' 'S 1 11rUconfigc#K|t}|dS|d}t|ts$ ddlm}||}n#t $rYdSwxYw|sdS|D]V}t|ts|d}t|tsCt||fVWdS)zJYield (normalized_name, entry_dict) for each valid custom_providers entry.Ncustom_providersr)get_compatible_custom_providersrw) r+r{rPlistr(rr)rrKr)rrrrrws r*_iter_custom_providersrrs ~"$$ ~zz"455 & - -  I I I I I I>>vFF      FF  !77%&&  yy  $$$  )$//66666 77sA A"!A"rhr^ provider_namec|sdS|d}|r6t|}tD]\}}||kr t|cStD]c\}}t |dpdd}|r||kr t|cSddS)a~Look up the custom_providers list in config.yaml and return 'custom:' for a matching base_url. When provider_name is given, prefer matching by name first (solving the case where multiple custom providers share the same base_url but have different API keys). Falls back to base_url matching when no name match is found. Returns None if no match is found. N/rhr)rrstriprrCUSTOM_POOL_PREFIXrKr{)rhrnormalized_urlnormalized_name norm_namer entry_urls r*get_custom_provider_pool_keyr s  t^^%%,,S11N :5mDD 6 8 8 : : IuO++,9i99999,34466 5 *--344::<<CCCHH  6n44(5)55 5 5 5 4rU List[str]cXtdtfdDS)z?Return all 'custom:*' pool keys that have entries in auth.json.Nc3K|]P}|tt|tD|L|VQdSrs)rQrrPr{r)rr pool_datas r*rz-list_custom_pool_providers..sx >>, - - y}}S))4 0 0 cN  rU)r!sorted)rs@r*list_custom_pool_providersrsH$T**I    rUpool_keyc|tsdS|ttd}tD]\}}||kr|cSdS)zWReturn the custom_providers config entry matching a pool key like 'custom:together.ai'.N)rQrlenr)rsuffixr rs r*_get_custom_provider_configrso   1 2 2t c,--.. /F244 5   LLL  4rUcHt}|tS|d}t|tstSt ||dpd}|tvr|StS)z8Return the configured selection strategy for a provider.Ncredential_pool_strategiesr) r+STRATEGY_FILL_FIRSTr{rPrrKrrSUPPORTED_POOL_STRATEGIES)rJr strategiesstrategys r*get_pool_strategyrs  F ~""899J j$ ' '#"":>>(B//5266<<>>DDFFH,,, rU)rhpool_or_providercJt|dd}|t|tr|}ndSt|pd}t|pd}|r|sdS||krdS|dks|t sdS t|pd}n#t$rYdSwxYwt|pd|kS)aReturn whether a pool belongs to the requested runtime provider. Named custom endpoints intentionally use two identities: the live agent is ``custom`` while its pool is keyed ``custom:``. Accept that pair only when the runtime base URL resolves to the exact same custom pool key. Empty string identities fail closed. Legacy pool adapters without a ``provider`` attribute remain compatible; production pools are scoped. rJNTrFcustom) rrPrKrrrQrr r))r rJrhraw_pool_provider pool_provider provider_norm matched_pools r* credential_pool_matches_providerr'sF 0*dCC & , ,  0   4)/R006688>>@@MB''--//5577M  u %%t  (@(@AS(T(T u3HNCC uu |!r " " ( ( * * 0 0 2 2m CCs C C)(C)r provider_idstateNonec& tj}n#t$rYdSwxYw|dStjdrztjdd}|rXt |dz dz } |d|dkrdSn#t$rYdSwxYw tj|||d dS#t$r'}t d ||Yd}~dSd}~wwxYw) uPersist a rotated OAuth ``state`` into the global-root auth.json. Best-effort write-through for the multi-profile rotation hazard (#48415 / #43589): nous, openai-codex, and xai-oauth rotate the refresh_token on refresh, so when a profile pool refresh rotates a grant it resolved from the root fallback, the rotated chain must land back in root. Otherwise root keeps a now-revoked refresh token and every other profile reading the stale root grant dies with ``refresh_token_reused`` / ``invalid_grant`` once its access token expires. Only updates ``providers.`` in the root store; never touches the profile store (the caller already saved that). Swallows all errors — a failed write-through degrades to the pre-existing behavior (root stale), it must never break the profile's own successful save. Mirrors ``hermes_cli.auth._write_through_xai_oauth_to_global_root`` (which covers the non-pool xAI refresh path) for the credential-pool refresh path. NPYTEST_CURRENT_TESTHOMErz.hermesz auth.jsonF)strict set_activez8%s pool refresh: write-through to global root failed: %s) r_global_auth_file_pathr)osenvironr{r resolve _persist_provider_state_to_storeloggerdebug)r(r) global_path real_home_env real_rootexcs r*,_write_through_provider_state_to_global_rootr<s(577   z~~+,, vr22  ]++i7+EI &&e&44 8I8IQV8I8W8WWWFX      1              F            s6 $$.B33 CCC D)D  Dc<eZdZdIdZdJdZdJd ZdKd ZdLd ZdMdZdddNdZ dOdZ dPdQdZ dRd Z dRd!Z dRd"ZdRd#ZdRd$ZdSd%ZdTd'ZdUd)ZdTd*ZdVd+ZdLd,Zd-d-d.dWd1Zd2d3dXd4ZdLd5Zddd6dYd9ZdPdZd;Zd[d<ZdLd=Z dPd\d>ZdLd?Zd]dAZ d^dCZ!d_dGZ"dRdHZ#dS)`CredentialPoolrJrKrrc||_t|d|_d|_t ||_t j|_i|_ t|_ dS)Nc|jSrsrrs r*z)CredentialPool.__init__..3s%.rUr) rJr_entries _current_idr _strategy threadingLock_lock_active_leases%DEFAULT_MAX_CONCURRENT_PER_CREDENTIAL_max_concurrent)rurJrs r*__init__zCredentialPool.__init__1s]  w,H,HIII *.*844^%% .0DrUr#rc*t|jSrs)rrDrts r*has_credentialszCredentialPool.has_credentials:DM"""rUcDt|S)zCTrue if at least one entry is not currently in exhaustion cooldown.)r_available_entriesrts r* has_availablezCredentialPool.has_available=sD++--...rUc*t|jSrs)rrDrts r*rzCredentialPool.entriesArPrUOptional[PooledCredential]cXjsdStfdjDdS)Nc3<K|]}|jjk|VdSrs)rXrErrrus r*rz)CredentialPool.current..Gs2VVuTEU9U9UU9U9U9U9UVVrU)rEnextrDrts`r*currentzCredentialPool.currentDs; 4VVVV VVVX\]]]rUoldrWnewr*ctt|jD]"\}}|j|jkr ||j|<dS#dS)z4Swap an entry in-place by id, preserving sort order.N) enumeraterDrX)rur[r\idxrs r*_replace_entryzCredentialPool._replace_entryIsP#DM22  JCx36!!%( c""  rUN removed_idsrbOptional[List[str]]cRt|jd|jD|dS)Nc6g|]}|Srrrs r* z+CredentialPool._persist..S 8 8 8U]]__ 8 8 8rUra)r"rJrD)rurbs r*_persistzCredentialPool._persistPs> M 8 8$- 8 8 8#      rU status_codercnormalized_errorrpc|dkrdS|d}t|tsdS|t vS)uTDetect upstream-permanent OAuth failures that won't recover on TTL. Only fires for 401 responses whose error code/reason matches a known terminal OAuth state (token_invalidated, token_revoked, invalid_grant, etc.). Distinguishes permanent failures from transient ones like token_expired (refreshable) or generic 401 without a specific reason (could be a server-side glitch worth retrying). Returns False for non-401 status codes — 429 rate limits and 402 billing failures are transient by nature and should keep TTL semantics. rFr)r{rPrKrr_TERMINAL_AUTH_REASONS)rurjrkrs r*_is_terminal_auth_failurez(CredentialPool._is_terminal_auth_failureWs^ #  5!%%h//&#&& 5||~~##%%)???rUrrrc t|}|||rt}nt}t ||t j||d|d|d}|||||S)Nrrrr`rbrdrerfrg) rrn STATUS_DEADrrrr{r`ri)rurrjrrkterminal_statusupdateds r*_mark_exhaustedzCredentialPool._mark_exhaustedns 4MBB  ) )+7G H H /)OO.O '9;;'.228<</33I>> 0 4 4Z @ @    E7+++ rUc |jdks |jdkr|S ddlm}|}|s|S|dd}|dd}|dd}|jpd}|jpd}|s|r|r||ks|r||krztd |j t||p|j|p|j|p|j d d d d d d } | || | | Sn2#t$r%} td | Yd } ~ nd } ~ wwxYw|S) aSync a claude_code pool entry from ~/.claude/.credentials.json if tokens differ. OAuth refresh tokens are single-use. When something external (e.g. Claude Code CLI, or another profile's pool) refreshes the token, it writes the new pair to ~/.claude/.credentials.json. The pool entry's refresh token becomes stale. This method detects that and syncs. rO claude_coder)read_claude_code_credentials refreshTokenr accessToken expiresAtzDPool entry %s: syncing tokens from credentials file (tokens changed)N) r]r_rjr`rbrdrerfrgz(Failed to sync from credentials file: %s)rJr\agent.anthropic_adapterrwr{r]r_r6r7rXrrjr`rir)) rurrwcreds file_refresh file_access file_expires entry_access entry_refreshrsr;s r*+_sync_anthropic_entry_from_credentials_filez:CredentialPool._sync_anthropic_entry_from_credentials_files =K ' '5<=+H+HL' J L L L L L L0022E   99^R88L))M266K 99[!44L !-3L!/52M |  !, !.Js\!'4006=[[5F5F%(5R5R5R5R5R5RrUNzIPool entry %s: adopting xAI OAuth tokens rotated by another pool instancez7Failed to sync xAI OAuth entry from credential pool: %s)rJrYr!rPrrWrr]r_r6r7rXr`r))rur persistedstoredr;s ` r*%_sync_xai_oauth_entry_from_pool_storez4CredentialPool._sync_xai_oauth_entry_from_pool_store;sB =K ' 'L Y#7 #F#F  Ii..  %// yIIF#u'999'5+>>> _H##E6222 ? Y Y Y LLRTW X X X X X X X X Y sACA7C C=C88C=c|jdks jdkrS t5t}t |d}dddn #1swxYwY|sS|dd}|dd}|||d|d|d |d d }t fd |D}|r't d j ddddddd}|r||d<|r||d<|dr |d|d<|dr |d|d<|d r |d |d <|d r |d |d <tj } dD]} || } | | | | <tfd| i|} || || Sn2#t $r%} t d| Yd} ~ nd} ~ wwxYwS)aSync a Nous pool entry from auth.json if tokens differ. Nous OAuth refresh tokens are single-use. When another process (e.g. a concurrent cron) refreshes the token via ``resolve_nous_runtime_credentials``, it writes fresh tokens to auth.json under ``_auth_store_lock``. The pool entry's tokens become stale. This method detects that and adopts the newer pair, avoiding a "refresh token reuse" revocation on the Nous Portal. rrNr_rr]rirmrnrl)r]r_rirmrnrlc3PK|] \}}|dvot|d|kV!dS)NrN)r)rrrrs r*rzBCredentialPool._sync_nous_entry_from_auth_store..~sVCZ'NGE3,E,E,NrUz0Pool entry %s: syncing Nous state from auth.jsonrprBr@rCrHrFrIrqz,Failed to sync Nous entry from auth.json: %s)rJr\rrrr{anyrr6r7rXrrqrr`rir))rurrr)rrcomparable_updates should_syncr extra_updates extra_keyvalrsr;s ` r* _sync_nous_entry_from_auth_storez/CredentialPool._sync_nous_entry_from_auth_storebs^ =F " "elm&C&CL9 N!## A A-// ,Z@@ A A A A A A A A A A A A A A A  !IIor::M 99^R88L ,!.#ii 55"YY{33(- 2H(I(I&+ii0D&E&E "" "4":":"<"<K#  FH $(&*'+)-*.+/ 11  A4@M.1 C5BM/299\**F27 2EM,/99[))D16{1CM+.99344Z`` still holds the pre-refresh state. On the next ``load_pool()``, ``_seed_from_singletons()`` reads that stale state and can overwrite the fresh pool entry — potentially re-seeding a consumed single-use refresh token. Applies to any OAuth provider whose singleton lives in auth.json (currently Nous, OpenAI Codex, and xAI Grok OAuth). ``set_active=False`` on every write: a pool sync-back is a token-rotation side effect, not the user choosing a provider. Using ``_save_provider_state`` (which sets ``active_provider``) here would mean every Nous/Codex/xAI refresh in a multi-provider setup silently flips the ``active_provider`` flag — the next ``hermes`` invocation that defaults to the active provider (e.g. setup wizard, ``hermes auth status``) would land on whatever provider happened to refresh last, not whatever the user actually chose. rNrrr)rrr providersr]r_rirmrnrrlFr/rrkz3Failed to sync %s pool entry back to auth store: %s)r\rrr{rJrrPrrr]r_rirmrnrqrlr rkrr<r)r6r7) rurr_wt_provider_idwrite_through_to_rootr)rrrr;s r*%_sync_device_code_entry_to_auth_storez4CredentialPool._sync_device_code_entry_to_auth_storesZ4 <= ( ( FU d!##R R -// #$2!,###dm$$  )-_(=(=)z~~k::DAA"";/33ODDdC% =F**0VDDE}7R R R R R R R R 8-2,>E.)*E161Do.'?.3.>l+=-2_k*1S8=8R45&?33 $kooi88?/2E),/O6;6N23)*fePUVVVVV]n440^LLE%eT22eR R R R R R R R f#YYx00F%fd33kR R R R R R R R l.3-?F>**F272E/)C050Bn-)*neX]^^^^^]k110[IIE%eT22AR R R R R R R R B#YYx00F%fd33GR R R R R R R R H.3-?F>**F272E/)C050Bn-)*k5UZ[[[[[YR R R R R R R R \!,,,(_@'aR R R R R R R R R R R R R R R R R R f d d d LLNPTP]_b c c c c c c c c c dsL,B1L L,C L& L,3+L L,+A1L L,)+L L,!AL" L,/#L L,L##L,&L#'L,, M"6!MM"forcec|jtks|js|r||ddS|jdvr|jdkr|jn|j}t|5||}|jdkrN||ur'|}|s#| |s|cdddS| ||cdddS|j |j ks|j|jkr|cdddS| ||cdddS#1swxYwY| ||S)N)rrr)timeout_secondsr) rMrRr_rtrJrrr _single_use_refresh_lock_timeout_entry_needs_refresh_refresh_entry_implr])rurr sync_entrysynceds r*_refresh_entryzCredentialPool._refresh_entrysQ ?o - -U5H - 2$$UD1114 =9 9 9=N2266?  " $ E E G G E E$E**=N22U** &$)T-F-Fu-M-M)#( E E E E E E E E 33E3GG E E E E E E E E'5+===+u/BBB! E E E E E E E E//e/DD E E E E E E E E E E E E E E E E ''U';;;s$65D,8D,!D, D,,D03D0rc|jdkrdnd}tj|d}tt tjt |dzS)a0Lock timeout for single-use-refresh-token providers. Covers the configured refresh POST timeout plus a margin so a slow token endpoint cannot make the flock give up before the refresh resolves. Reads the provider's ``HERMES_*_REFRESH_TIMEOUT_SECONDS`` override. r$HERMES_CODEX_REFRESH_TIMEOUT_SECONDS"HERMES_XAI_REFRESH_TIMEOUT_SECONDSg@)rJr env_floatrrAUTH_LOCK_TIMEOUT_SECONDS)ruenv_varrefresh_timeout_secondss r*rz/CredentialPool._single_use_refresh_lock_timeoutDsg}.. 3 25  #+"4Wb"A"A (4 5 5 ) * *S 0   rUc  |jdkrddlm}||j|jd}t ||d|d|d }|jd kr[ dd lm}||d|d|dnx#t$r&}t d |Yd}~nMd}~wwxYwnC|jd krm| |}||ur|}tj |j|j}t ||d|d|d}n|jdkrm||}||ur|}tj|j|j}t ||d|d|d}nS|jdkrF||}||ur|}tj|||}n|S ny#t$ rk} t d|j|j| |jdkr|jd kr||}|j|jkr4t d ddlm}||j|jd}t ||d|d|dt,dd}|||| dd lm}||d|d|dn2#t$r%}t d|Yd}~nd}~wwxYw|cYd} ~ S#t$r%} t d| Yd} ~ n>d} ~ wwxYw||s!t d|cYd} ~ S|jdkr||}|j|jkrft dt |t,ddddd}|||||cYd} ~ Stj| r>t d t75t9} t;| dpi} t=| t>r:| dpi} t=| t>r tA| dpd!}tA|jpd!}|r||kr| "dd| "dd| | d<dtG| ddtA| d d!tIj%tLj'(d"| d#<tS| d| tU| dddn #1swxYwYn2#t$r%}t d$|Yd}~nd}~wwxYwd%|j+D}d&|j+D|_+|j,|jkrd|_,||'Yd} ~ dS|jd kr| |}|j|jkrft d(t |t,ddddd}|||||cYd} ~ Stj-| r>t d) t75t9} t;| d pi} t=| t>r:| dpi} t=| t>r tA| dpd!}tA|jpd!}|r||kr| "dd| "dd| | d<d tG| ddtA| d d!tIj%tLj'(d"| d#<tS| d | tU| dddn #1swxYwYn2#t$r%}t d*|Yd}~nd}~wwxYwd+|j+D}d,|j+D|_+|j,|jkrd|_,||'Yd} ~ dS|jdkr||}|j|jkr{t d-t |t,ddddd}|||||.||cYd} ~ Stj/| rt d. t75t9} t;| dp&|j0|j1|j2|j3|j4|j5d/} tA| dpd!}tA|jpd!}|r||krNtj6| | d 0tj7| | d 0tS| d| tU| dddn #1swxYwYn2#t$r%}t d1|Yd}~nd}~wwxYwtj8d2tj8hfd3|j+D}fd4|j+D|_+|j,|jkrd|_,||'Yd} ~ dS|9|dYd} ~ dSd} ~ wwxYwt |t,ddddd}|||||.||S)5NrOr)refresh_anthropic_oauth_pure hermes_pkce)use_jsonr]r_rj)r]r_rjrv)_write_claude_code_credentialsz7Failed to write refreshed token to credentials file: %srrk)r]r_rkrr) force_refreshz'Credential refresh failed for %s/%s: %sz8Retrying refresh with synced token from credentials file)r]r_rjr`rbrdzDFailed to write refreshed token to credentials file (retry path): %szRetry refresh also failed: %sz7Credentials file has valid token, using without refreshuDxAI OAuth refresh failed but auth.json has newer tokens — adoptingrpzIxAI OAuth refresh token is terminally invalid; clearing local token staterrcodeunknowncredential_pool_refresh_failureT)rJrrrrelogin_requiredatlast_auth_errorz,Failed to clear terminal xAI OAuth state: %sc2g|]}|jdk |jSrr\rXritems r*rgz6CredentialPool._refresh_entry_impl.. 1###$(;-77777rUc(g|]}|jdk |Srr\rs r*rgz6CredentialPool._refresh_entry_impl../%%%!%;-77777rUrauFCodex OAuth refresh failed but auth.json has newer tokens — adoptingzKCodex OAuth refresh token is terminally invalid; clearing local token statez.Failed to clear terminal Codex OAuth state: %sc2g|]}|jdk |jSrrrs r*rgz6CredentialPool._refresh_entry_impl..PrrUc(g|]}|jdk |Srrrs r*rgz6CredentialPool._refresh_entry_impl..TrrUu?Nous refresh failed but auth.json has newer tokens — adoptingzDNous refresh token is terminally invalid; clearing local token state)r?rErlrAr>r=)rz-Failed to clear terminal Nous OAuth state: %szmanual:c0g|]}|jv |jSrrrrsingleton_sourcess r*rgz6CredentialPool._refresh_entry_impl..s3###$(;*;;;;;;rUc&g|] }|jv |Srrrs r*rgz6CredentialPool._refresh_entry_impl..s1%%%!%;.??????rU):rJr{rr_r\endswithrrr)r6r7rrrefresh_codex_oauth_purer]r{rrefresh_xai_oauth_purer resolve_nous_runtime_credentialsrXr STATUS_OKr`rir$_is_terminal_xai_oauth_refresh_errorrrrrPrrKrpoprrnowrutc isoformatrrrDrE&_is_terminal_codex_oauth_refresh_errorr_is_terminal_nous_refresh_errorr?rErlrAr>r=_quarantine_nous_oauth_state_quarantine_nous_pool_entriesNOUS_DEVICE_CODE_SOURCErt)rurrr refreshedrsrwexcrr; retry_excrr)rrr clear_excrbrs @r*rz"CredentialPool._refresh_entry_implWsF } ++PPPPPP88'"\22=AA "!*>!:"+O"<"+O"< <=00fZZZZZZ66%n5%o6%o6 %fff %^`deeeeeeeef1.00 ??FF&&"E$=&' "!*>!:"+O"!>  +-- CCEJJ&&"E$;&' "!*>!:"+O"!>  &((>>uEE&&"E9"'??FF | | |  LLBDMSXS[]` a a a} ++ 0M0MII%PP'5+>>>LL![\\\QXXXXXX$@$@"0%+]%;%;M%J%J%%% #*")2>)B*3O*D*3O*D(1+/,0###++FG<<< w^^^^^^:: ). 9 )/ : )/ : )www"LL)oquvvvvvvvvw&$QQQ %DiPPPPPPPPQ226::"LL!Z[[[!MMMMMM} ++CCEJJ'5+>>>LL^&$-'+(,*.+/,0G''888MMOOO"NNNNNN @EE* LLc-//EE)9););J$8[$Q$Q$WUWE)%66E).8)<)<)B#-fd#;#;!E47 ?8S8S8YWY4Z4Z4`4`4b4bM478K8Qr4R4R4X4X4Z4ZM+8 %EM]4(H(H(H(. ?D(I(I(I:@h8C4;C4S4S7:3xx6W@D2:,x|2L2L2V2V2X2X D*D*.?(@)=ZV[(\(\(\(8(D(D(D+EEEEEEEEEEEEEEE,% JI##,0M###K%%)-%%%DM'5833+/(MMkM:::44444 }..??FF'5+>>>LL`&$-'+(,*.+/,0G''888MMOOO"NNNNNN B3GG* LLe-//EE)9););J$8^$T$T$ZXZE)%66E).8)<)<)B#-fd#;#;!E47 ?8S8S8YWY4Z4Z4`4`4b4bM478K8Qr4R4R4X4X4Z4ZM+8 %EM]4(H(H(H(. ?D(I(I(I:@h8F4;C4S4S7:3xx6W@D2:,x|2L2L2V2V2X2X D*D*.?(@)=ZY^(_(_(_(8(D(D(D+EEEEEEEEEEEEEEE,% Li##,0M###K%%)-%%%DM'5833+/(MMkM:::44444}&&>>uEE'5+>>>LL!bccc%$-'+(,*.+/,0G''888MMOOO>>wGGG"NNNNNN;C@@. LL!ghhha-//==)9););J$8V$L$L%-2_383H6;6N.3.>).',y QQE-0 /0J0J0Pb,Q,Q,W,W,Y,YM,/0C0Ir,J,J,P,P,R,RM#0 =M]4R4R ( E$)$'+L!"!"!"!" !) F$.$'+L!"!"!"!" !5Z O O O 0 < < <1===============2%aaa %TV_````````a!8D("BDD)%####,0M###K%%%%)-%%%DM'5833+/(MMkM:::44444   - - -44444y| | ! "# $    E7+++  227;;;sA+H/%BH C C;HCEH rA?rBN#%M N M8M3.N3M88N<r N1 N,'r,N113r$r*Br;r/r1Y?E1X<0 Y<Y YY Yr Y7Y2-r2Y77ArBr%r+/rd2)E1d& d2&d* *d2-d* .d21r2 e!<ere!!Ar>B&r$r*/rn:(C:n." n:.n2 2n:5n2 6n:9r: o)o$r$o))A6r%rrc|jtkrdS|jdkrE|jdSt |jt t jdzdzkS|jdkrt |jtS|jdkr1tj |jtj |jS|jdkrdSdS)NFrOirrr) rMrRrJrjrZrrr]rr_xai_access_token_is_expiring#_xai_proactive_refresh_skew_secondsrurs r*rz#CredentialPool._entry_needs_refreshs ?o - -5 =K ' '"*uu*++s49;;3E/F/F/PP P =N * *2"7  =K ' '9".Bs%PPP1Z9O9OQ9O9O9OrUra)rrDrMrSrrJr\r`rrqrrrrrrbDEAD_MANUAL_PRUNE_TTL_SECONDSrYrXr6warningreappendrrrr`rrsetri)rurrr cleared_anyentries_to_prune availablerrdead_at_labelexhausted_untilclearedrrs @r*rRz!CredentialPool._available_entriessikk &(,. ]e $e $E"333E -LLLII%PP&&"E"&K  '' 55).> -LLL>>uEE&&"E"&K  // 55).> -LLL??FF&&"E"&K  ,, 55).> -LLLCCEJJ&&"E"&K K//%U\22+#27aG +3=3P#P#P!&!<! Y"!3@y 7]f4 M )//999&*  $444"25"9"9".33H3H '%$-'+(,*.+/,0G''w777#E"&K "444U;; " //U/CC $!   U # # # #  Q-..JPPPP PPPDM  8 MM&6M 7 7 7rUTrc|d|}|s#d|_tddS|jt kr"t j|j|_S|jtkrbt|dkrOt|dtj dz}||j|_|S|jtkrt|dkr|dfd |jD}|tt|jdz d t%|D|_|j|_|pS|dj|_S) NTrz>credential pool: no available entries (all exhausted or empty)rc|jSrsro)rs r*rBz1CredentialPool._select_unlocked..TsrUrCrrc4g|]}|jjk|Srr)r candidaters r*rgz3CredentialPool._select_unlocked..]s)\\\Y9._s)ggg.#yWY===gggrU)rRrEr6inforFSTRATEGY_RANDOMr:choicerXSTRATEGY_LEAST_USEDrminrror`STRATEGY_ROUND_ROBINrDrr^rirZ)rurrrsrotatedrs @r*rzCredentialPool._select_unlockedGs++$+PP  #D  KKX Y Y Y4 >_ , ,M),,E$xD L >0 0 0S^^a5G5G '@'@AAAEe53F3JKKKG   w / / /$xD N >1 1 1c)nnq6H6HaLE\\\\$-\\\G NN753t}3E3E3IJJJ K K KggT]^eTfTfgggDM MMOOO$xD <<>>*U *!  8 rUcr|}||S|}|r|dndSNr)rZrR)rurZrs r*peekzCredentialPool.peekhs>,,..  N++-- (2y||d2rU)r api_key_hintrr^c|j5dr!tfd|jDd(|p| ddddSjpjdd}|||tfd|jD}|jtkr%t d|||j pdnt d||d|_|}|r1|jp|jdd}t d||cdddS#1swxYwYdS)Nc32K|]}|jk |VdSrsr)rrrs r*rz;CredentialPool.mark_exhausted_and_rotate..~s0SS11Bl1R1RQ1R1R1R1RSSrUrc3<K|]}|jjk|VdSrsr)rrrs r*rz;CredentialPool.mark_exhausted_and_rotate..s1>>qQTUX-=-=-=-=-=-=>>rUuxcredential pool: marking %s DEAD (status=%s, reason=%s) — permanently failed, will NOT re-enter rotation until re-authrz;credential pool: marking %s exhausted (status=%s), rotatingzcredential pool: rotated to %s)rIrYrDrZrrYrXrtr`rqr6rrerrE) rurjrrr updated_entry next_entry _next_labelrs ` @r*mark_exhausted_and_rotatez(CredentialPool.mark_exhausted_and_rotateosZ% % E  SSSS SSS} A$*?*?*A*A}% % % % % % % % [0EHRaRLF   ] C C C >>>>DM>>>M(K77SK)H)UI  QK $D ..00J K(.C*-2C  .sF&**58Q77$:NNNNNNrUcRj|jd|jfSr)rJr{rXr[)rrus r*rBz.CredentialPool.acquire_lease..s#4#6#:#:58Q#G#G"XrUrC)rIrJr{rErRrrX)rur!r below_cap candidateschosens` r* acquire_leasezCredentialPool.acquire_leasesZ   %595H5L5L]\]5^5^ab5b#M2#0 $          //dD/QQI         #,I'0>YJXXXXF.2-@-D-DVYPQ-R-RUV-VD  *%yD 9+                  s1C%C%.A*C%%C),C)c|j5|j|d}|dkr|j|dn |dz |j|<ddddS#1swxYwYdS)z/Release a previously acquired credential lease.rrN)rIrJr{r)rur!counts r* release_leasezCredentialPool.release_leases Z ? ?'++M1==Ezz#'' t<<<<5:QY#M2  ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?sA A  A$'A$cl|j5|cdddS#1swxYwYdSrs)rI_try_refresh_current_unlockedrts r*try_refresh_currentz"CredentialPool.try_refresh_currents} Z 8 85577 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8rcF|j5d}r"tfd|jDd}n*|p|d}| ddddS|j|_|cdddS#1swxYwYdS)aForce-refresh the entry that supplied ``api_key_hint``. Direct provider integrations may reload the pool after a request has already failed, so they cannot rely on ``current_id`` identifying the issuing credential. With no hint, select an entry without first doing the normal proactive refresh; the forced refresh below must consume a rotating refresh token exactly once. Nc32K|]}|jk |VdSrsr)rr rs r*rz6CredentialPool.try_refresh_matching..s=%$4 DD"DDDDrUFr)rIrYrDrZrrXrEr-)rurrs ` r*try_refresh_matchingz#CredentialPool.try_refresh_matchings-Z 8 8E O)-   N$*?*?*?*N*N} 8 8 8 8 8 8 8 8 %xD 5577! 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8sAB*BBBc|}|dS||d}| |j|_|S)NTr)rZrrXrE)rurrs r*r-z,CredentialPool._try_refresh_current_unlockedsG  =4''T'::  (|D rUrZc d}g}|jD][}|js|js|jr/|t |dddddd|dz }F||\|r||_||S)Nrrpr)rDr`rbrdrrri)rur* new_entriesrs r*reset_statuseszCredentialPool.reset_statusess ] * *E  *E$8 *E. s9   # e EL 1 1 1   rUc6g|]}|Srrfrs r*rgz/CredentialPool.remove_index..rhrUra)rrDrr^r"rJrXrE)rur6removeds r* remove_indexzCredentialPool.remove_indexs 199DM 2 2224-##EAI..  '0'?'?      M 8 8$- 8 8 8       wz ) )#D rUtargetr ?Tuple[Optional[int], Optional[PooledCredential], Optional[str]]c^t|pdsdSt|jdD]\}}|jkr||dfcSfdt|jdD}t |dkr|dd|dddfSt |dkr ddddfSrMt}d|cxkrt |jkrnn||j|dz dfSddd |d fSddd d fS) Nr)NNzNo credential target provided.r)startcg|]J\}}|jkF||fKSr)rYrr)rr_rrs r*rgz1CredentialPool.resolve_target..!sX   U{  ""((**ciikk99%L999rUrzAmbiguous credential label "z-". Use the numeric index or entry id instead.zNo credential #.zNo credential matching "z".)rKrr^rDrXrisdigitrZ)rur=r_r label_matchesr6rs @r*resolve_targetzCredentialPool.resolve_targets&,B%%'' @??#DM;;; ( (JCx3E4''''    ' Q???   }   " " #A& a(8(;TA A }   ! !pcpppp p ;;== :HHEE////S///////dmEAI6<<99999 9T=c=====rUct|t|j}|j|||S)Nr)rrrDrrirs r* add_entryzCredentialPool.add_entry1sFt}(E(EFFF U###  rU)rJrKrr)r#r)r#r)r#rU)r[rWr\rWr#r*)rbrcr#r*)rjrcrkrpr#rrs)rrWrjrcrrr#rW)rrWr#rW)rrWr#r*)rrWrrr#rU)r#rrrWr#r)rrrrr#r)rrr#rU)rjrcrrrr^r#rU)r!r^r#r^)r!rKr#r*)rr^r#rU)r#rZ)r6rZr#rU)r=r r#r>)$r~rrrMrOrSrrZr`rirnrtrrrrrrrrrrrrRrrr r(r+r.r1r-r5r<rErGrrUr*r>r>0s2EEEE####////####^^^^ >B      @@@@637 >2222h>>>>@8888t%%%%NFFFFPqdqdqdqdf%<%<%<%????8888 -188888:0">>>>2rUr>rc|g}t|D]%\}}|j|kr||&|r|dnd}t|ddr fdt|D|dd<||dt jjdd|dt||d| dp||t ||dS||}i} i} d t|D} | D]d\} } | d vs|  | dkr|jr| | vrt|| | kr| | | <8| t vr#|j | | kr| | | <e| s| r[| ri|j| | d <t%|fi| }|||<t'p)||kSt'S) Nrrc"g|] \}}|v | Srr)rr_rduplicate_indicess r*rgz!_upsert_entry..As(aaa UCO`D`D`eD`D`D`rUrXrr[rYTch|] }|j Srrrs r*rz _upsert_entry..Ms555qAF555rU>rXr[rq)r^r\rrrrrrrr{rWrrrrYrrzrqrrr)rrJr\rmatching_indicesr_r existing_idxexistingrr _field_namesrrrsrKs @r* _upsert_entryrQ8s(()) U <6 ! !  # #C ( ( (*:D#A&&L,QRR011baaaai.@.@aaa 4!1"1"!5666:~g'>'>???7GKK$8$8$BFCCC'11(GDDEEEt|$HMM55F8$4$4555Lmmoo + + U $ $ $  '>>hn>  ,  x%%..%* c" K  ~!!#&&%//%* c"R R  I%H%H-%HM' "(44m44 ' %&&Q(*:*:*<*<@Q@Q*QQ ! " ""rUc` |dkrdSdddddd td |Dd }td |D fd  }g||}dt|D}d}t|D]1\}}|j|kr!t|||||j<d}2|S)NrOFrrr)zenv:ANTHROPIC_TOKENzenv:CLAUDE_CODE_OAUTH_TOKENrrvzenv:ANTHROPIC_API_KEYc3BK|]}t|j|VdSrsrr\rs r*rz-_normalize_pool_priorities..qs2GG5'8'F'FGGGGGGGrUc|jSrsrrAs r*rBz,_normalize_pool_priorities..rs%.rUrCc3BK|]}t|j|VdSrsrVrs r*rz-_normalize_pool_priorities..us2KK5+.vs/ OOEL#k*:*: ; ; N K rUc$i|] \}}|j|Srr)rr_rs r*rz._normalize_pool_priorities..~s DDD:33DDDrUrT)rr^r[rrX) rJrmanual_entriesseeded_entriesordered id_to_idxchangedr9rrZs @r*_normalize_pool_prioritiesraes;u !'(!" KGGGGGG ( (NKKGKKK    N100GDD71C1CDDDIG(11 e >\ ) )+25<+P+P+PGIeh' (G NrUTuple[bool, Set[str]]c%d}t}t} ddlm}n#t$rd}YnwxYw|dkr ddlm}|ds||fSn#t$rYnwxYwt %dP%fd }|d }|d p |d } t|o| } | r9d|D} t| t|kr | |dd<d}||fSddl m } m } d| fd| ffD]\}}|r| dr|||r)| ||t||||t| dd| d| dt!| dd|dz} n|dkrt#|d}tt%|t&okt)| dpdp5t)| dpd}|r7|s5d|D} t| t|kr | |dd<d}|rB|r?||ds2| dt)| dpd}|p#t!| ddd}|t||didddtd| ddd | d d!| d!d"| d"d#| d#d$| d$d%| d%d&| d&d| dd'| d'd(| d(d)| d)d*| d*d+| d+d,| d,| d-t%| d.t&r| d.nd|d/z}n|d0kr dd1lm}m}|\}}|r||\}}d2|vrd3nd4|}|||sV| |t5j |}|p |r|jnd}|t||||t8|||d5z}n1#t:$r&}t<d6|Yd}~nd}~wwxYw|d7kr dd8lm }|d9}| d:d}|r| dd;}|||sq| ||t||||t|| d<| d=d| d>|d?z}n8#t:$r&}t<d@|Yd}~n d}~wwxYw|dAkr ddBlm!}|dA}|rP| dr:dC}|||s+| |d} ddDl"m"} | d!d}!|!r7tG| $|!%dEz}n#t:$rd}YnwxYwt)| d&dpd&dF}"|t||||t|d| d ||"| ddp#t!| dd|dGz}n#t:$r&}t<dH|Yd}~nld}~wwxYw|dIkrC||dr||fSt#|dI}t%|t&r| dJnd}#t%|#t&r|# dr| dt)| dpd}|t||ddt|# dd|# d dK| dL|p#t!|# ddddMz}n|dNkrt#|dN}t%|t&r| dJnd}#t%|#t&r|# drd}|||r||fS| |ddOlm'}$|$}"|t||||t|# dd|# d |"| dLt!|# dd|dMz}||fS)QNFris_source_suppressedcdSNFr_p_ss r*_is_suppressedz-_seed_from_singletons.._is_suppressed5rUrO)!is_provider_explicitly_configuredrrKr#cv|pt|dpdSr)r{ _get_secretr)r _env_files r*_env_valz'_seed_from_singletons.._env_vals5MM#&&D+c2*>*>D"KKMM MrUANTHROPIC_API_KEYANTHROPIC_TOKENCLAUDE_CODE_OAUTH_TOKENc$g|] }|jdv |S)>rvrrrs r*rgz)_seed_from_singletons..s0<'EEEEEErUT)rwread_hermes_oauth_credentialsrrvryrrxrz)r\rMr]r_rjrYrr]rmc$g|] }|jdv |S)>manual:device_coderrrs r*rgz)_seed_from_singletons..s0<'LLLLLLrUrrYr\rMr_rirAr>r?rErlrnrBr@rCrHrFrIr=)rIr=rYcopilot)resolve_copilot_tokenget_copilot_api_tokenghgh_clienv:r\rMr]rhrYzCopilot token seed failed: %sz qwen-oauth) resolve_qwen_runtime_credentials)refresh_if_expiringr6zqwen-clirjrh auth_file)r\rMr]rjrhrYz Qwen OAuth token seed failed: %sz minimax-oauth)get_provider_auth_stater5)rrr)r\rMr]r_rjrhrYz#MiniMax OAuth token seed failed: %srrz%https://chatgpt.com/backend-api/codexrk)r\rMr]r_rhrkrYr)DEFAULT_XAI_OAUTH_BASE_URLrrKr#rK)(rrhermes_cli.authre ImportErrorrmrrrr{rwrvr{addrQrRrrrPrrKrhermes_cli.copilot_authrzr{rrrlrSr)r6r7rrrrZrrrr)&rJrr`active_sourcesrrkrmrqanthropic_api_keyanthropic_oauth_envapi_key_path_explicitretainedrwrv source_namer|r)has_runtime_material custom_label seeded_labelrzr{rLr\ api_tokenenterprise_base_urlpconfigeffective_base_urlr;rrrj_dtrrhrrrps& @r*_seed_from_singletonsrsb G"uuN!##JJJJJJJJ      ;   I I I I I I44[AA /.. /    D &JJ  N N N N N N%H%899 H& ' ' N884M+N+N !%%6%R?R;R S S + #*H8}}G ,,% N* *gggggggg99;; < 88:: ;#    K =11 !>(K88"";///="-%4(- -(D(D).>)B)B).;)?)?!1%))M22N2NP[!\!\     , V  $Z88# ud # # EIIn--344::<<=uyy--344::<<     - #*H8}}G ,,%  * )* ..=2Y2Y*    } - - - uyy117R88>>@@L'+; ."--},,L }m#EIInb$A$A$UYY%?%?  !%))L"9"9  !%))L"9"9 UYYw// ;!7!7&uyy1B'C'C)%))4H*I*I ;!7!7+EII6L,M,M&"599]#;#;'(!%))L"9"9)*#EIIn$=$=+,+EII6L,M,M-.' 2D(E(E/0.3YY7N-O-O/9%))E:J:JD/Q/Q+++W[)5   GD Y   ? \ \ \ \ \ \ \ \1133ME6 1F1Fu1M1M. .*.&,,..*@*@hhoVoo %~h <<"&&{333/3H==G*=*6=E222'} #&1):,5(:%+    G ? ? ? LL8# > > > > > > > > ? \ ! !  B H H H H H H44OOOEIIi,,E #ii*== %~h <<"&&{333} #&1)8,1-2YY-G-G(- *b(A(A%*YY{K%H%H    G B B B LL;S A A A A A A A A B _ $ $! E ? ? ? ? ? ?++O<22 % %~h <<"&&{333$(M-<<<<<<#ii b99[,/0A0A#0F0F0P0P0R0RUY0Y,Z,ZM$---(, -"599-A2#F#F#L"MMTTUXYYH} #&1)8,1.,A-2YY-G-G-:(0%*YYw%;%;&?O % ." = ={@@     G  E E E LL> D D D D D D D D E ^ # # >(M 2 2 +N* *$Z@@(25$(?(?I8$$$T fd # #  >(B(B    } - - -uyy117R88>>@@L }+!0$*JJ~r$B$B%+ZZ%@%@ G$)IIn$=$=)l-=fjjY[>\>\^k-l-l   G [ %Z==(25$(?(?I8$$$T fd # #  >(B(B #F~h// /..   v & & & B B B B B B1H }$!0$*JJ~r$B$B%+ZZ%@%@ ($)IIn$=$=-fjj.L.LfUU   G N ""s( 88A A&%A&5B$V W %WW B=Z [Z??[A`5 A]65`56 ^`5^B.`55 a%?a  a%c |d}t}dd} ddlm}n#t$rd}YnwxYwdd td d fd}|dkr_|d}|rNd}|||r||fS|||t |||||d|tz}||fStj |} | r| j tkr||fSd} | j r#|| j  d} t| j} |dkrgd} | D]} || }|sd| }|||r"||| p| j} |dkrt!|| j| } n|dkrt#|| j| } |t |||||| || z}||fS)!NFrrKr#c,t}||d}tj|d}|dr|r|S|pt |dp|S)Nrzop://)rr{rr2r3rQro)renv_filerenv_vals r*_get_env_prefer_dotenvz._seed_from_env.._get_env_prefer_dotenvs::ll3##))++*..b))//11 >>' " " w N5k#r**5g5rUrrdcdSrgrrhs r*_is_source_suppressedz-_seed_from_env.._is_source_suppressedrlrUrr^c ddlm}||}n#t$rd}YnwxYw|r!t|ndS)Nr)get_secret_source)hermes_cli.env_loaderrr)rKr)rr source_labels r*_secret_source_for_envz._seed_from_env.._secret_source_for_envss ? ? ? ? ? ?,,W55LL   LLL ,8Bs<  &&(((dBs  ##)rMr\rLrhrMrpc<|||||d}|}|r||d<|S)NrrDr)r\rrLrhrMrrDrs r* _env_payloadz$_seed_from_env.._env_payloadsI"!  # # /.w77  5'4GO $rU openrouterOPENROUTER_API_KEYzenv:OPENROUTER_API_KEY)r\rrLrhrrrO)rsrtrrr~z kimi-codingzair)rrKr#r^) r\rKrrKrLrKrhrKrMrKr#rp)rrrerrSrrQrrr{rMbase_url_env_varrrapi_key_env_varsrlrr)rJrr`rrrrrLr\renv_urlenv_varsrrhrs @r*_seed_from_envrsG"uuN 6666,QQQQQQQ      CCCC+ (<&&';<<  -F$$Xv66 /..   v & & & } !00    G&&#H--G 'g'+<<<&&GO(()ABBII#NNG,--H;      &&w//  !!! 6 2 2  6"""8g8 } $ $-eW5OQXYYHH   ,UG4NPWXXH=    L!        N ""s  ..Tprune_env_sourcesrSet[str]rcd fd fd|D}t|t|krdS||dd<dS) NrrWr#rc|jdrSt|j|jp |jdkS)Nr~r)r\rQrrJ)rrs r* _is_prunablez1_prune_stale_seeded_entries.._is_prunableU sJ < " "6 * * %$ $ *%, G G -|}, rUcdg|],}t|js|jvs |*|-SrrV)rrrrs r*rgz/_prune_stale_seeded_entries..e sX  U\ * * <> ) )|E"" *  * ) )rUFTrH)r)rrrrrs `` @r*_prune_stale_seeded_entriesrO s       H 8}}G $$uGAAAJ 4rUc d}t} ddlm}n#t$rd}YnwxYwt |}|rt |dpd}t |dpdd}t |d pd}|rHd |} ||| s7| | |t||| | t|||p| d z} t} | r| d nd } t| trNt | dpd} t | dpdd} d}dD]V}| |}t|t r*|r|}nW| dkr\| rZ|rXt!| }||krCd} ||| s5| | |t||| | t|| dd z}n#t"$rYnwxYw||fS)zJSeed a custom endpoint pool from custom_providers config and model config.FrrdcdSrgrrhs r*rkz)_seed_custom_pool.._is_suppressed{ rlrUr6rrhrrwzconfig:rmodelNrJ)r6apir" model_config)rrrerrrKr{rrrrQrSr+rPrrr r))rrr`rrk cp_configr6rhrwr\r model_cfgmodel_providermodel_base_url model_api_keyrr matched_keys r*_seed_custom_poolrr sAG"uuNJJJJJJJ       ,H55IimmI..4"55;;==y}}Z006B77==??FFsKK9==((.B//5577  %t%%F!>(F33 ""6***="(%6(/$,!%      "$$+1;FJJw'''t i & &  z!:!:!@bAAGGIIOOQQN z!:!:!@bAAGGIIPPQTUUNM'  MM!$$a%%!''))$%GGIIME))n)):>JJ (**+F)>(F;; &**6222=#$"*0->0=,:)7  $ $        N ""s ))=F K KKcpdt}d|D}tfd|D}fd|D}tfd|D}|r\t d}t |tr|nd}t|} tr-t|\}} |p|p|} | t|| z} nYt|\} } t|\} }|p|p| p| } | t|| |zdz} | t|z} | r;d |D}t!d t#|d D||z t%|S)Nrch|]A}t|t|d,|dBSr)rPrr{rs r*rzload_pool.. sV  eT " "(-yy $rUc3jK|]-}t|tot||kV.dSrs)rPrrrrrJs r*rzload_pool.. s[!!  7D!! O 0( C Cw N!!!!!!rUcFg|]}t|Sr)rWrrs r*rgzload_pool.. s*XXX))(G<<XXXrUc 3K|]s}t|toYt|d|dt|dtkVtdS)r]rMN)rPrrTr{rSrs r*rzload_pool.. s''  7D!! 9 %  KK ' ' KK %6 7 7  [[&7 8 8  9''''''rUcredential_poolFrch|] }|j Srrrs r*rzload_pool.. s11158111rUc6g|]}|Srrfrs r*rgzload_pool.. s Z Z ZU]]__ Z Z ZrUc|jSrsr)rs r*rBzload_pool.. s4=rUrCra)rrr!rrr{rPrrrQrrrrrrar"rr>)rJ raw_entriesdisk_idsraw_needs_sanitizationrraw_needs_auth_normalization active_poolactive_entriescustom_changedcustom_sourcesr`singleton_changedr env_changed env_sourcesnew_idss` r* load_poolr sB%%''--//H&x00K H !!!!!#!!! YXXXKXXXG#&''''#'''$$ $<'((,,->?? 6@d6S6S]222Y]'+N';';$-..A):8W)M)M&(Z,HZN.wGGG/DXw/W/W,,#1(G#D#D [ " +     .   +#     -h@@@ 11111  Z Z&>X>X*Y*Y*Y Z Z Z 7*    (G , ,,rU)r#r$)rJrKrLr rMr r#rK)rLrKrrKr#rK)rrr#rZ)r\rKr#r)rrcr#rZ)rr r#ra)rrKr#ra)rrr#rp)rrWr#ra)rwrKr#rKrs)rr$)rhr^rr^r#r^)r#r)rrKr#r)rJrKr#rK)r r rJr^rhr^r#r)r(rKr)rpr#r*) rrrJrKr\rKrrpr#r)rJrKrrr#r)rJrKrrr#rb)rrrrrrr#r)rrKrrr#rb)rJrKr#r>)g__doc__ __future__rloggingr2r:rGrrr dataclassesrrrrrpathlibr typingr r r r rrhermes_constantsrr(ragent.secret_scoperroagent.credential_persistencerrrauthrrrrrrrrrrrrr r!r" getLoggerr~r6r+rrrq frozensetrmrrRrSrSOURCE_MANUAL_DEVICE_CODErrrrrrrrrrzrTrWrrrrrrrrrrr rrrr'rKr<r>rQrarrrrrrrUr*rsBB""""""  2222222222''''''''8888888888888888000000&&&&&&888888#""""""  8 $ $   #$$$(!- ,:::"$" ## ' i //// ggggggg gTFFFFUUUU ))))<.22222 777774<    (# #D#D#D#D#D#DL)*%4 4 4 4 nEEEEEEEEP(*#*#*#*#ZDD#D#D#D#N ~#~#~#~#J#      FF#F#F#F#R?-?-?-?-?-?-rU