`gjdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z m Z m Z ddlmZmZddlmZddlmZmZmZmZmZmZddlmZdd lmZdd lmZdd l m!Z!m"Z"ddl#m$Z%dd l#m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3ejhe5Z6d@d Z7dZ8dZ9dZ:e;hdZdZ?dZ@e@dZAdZBdZCdZDdZEeBeCeDeEhZFdZGdZHdZIdZJdZKe;hdZLdAd ZMe Gd!d"ZNdBd#ZOdCd$ZPdDd%ZQdEd&ZRdFd'ZSdGd(ZTdHd)ZUdId*ZVdJd+ZWdKdLd,ZXdKdMd-ZYdNd.ZZdOd/Z[dPd0Z\dd1 dQd2Z]d3Z^ dRd4Z_Gd5d6Z`dSd7ZadTd8ZbdUd9ZcdUd:Zdd;d< dVd=ZedWd>ZfdXd?Zgy)Yz invalid_grant invalid_token token_revokedtoken_invalidatedunauthorized_clientrefresh_token_reusediQoauthapi_keymanualz :device_code fill_first round_robinrandom least_usedi,gN@zcustom:> tlsscope client_id expires_in token_type obtained_at agent_key_id secret_sourceportal_base_urlagent_key_reusedsecret_fingerprintagent_key_expires_inagent_key_obtained_atc|dk(r't|tr|jdrtSt|xstS)zHInfer pool auth metadata for token formats with one unambiguous meaning. anthropicz sk-ant-oat) isinstancestr startswithAUTH_TYPE_OAUTHAUTH_TYPE_API_KEY)providertoken auth_types r(_normalize_pool_auth_typerRs; K uc "   \ * y-- ..ceZdZUded<ded<ded<ded<ded<ded<ded <d Zd ed <d Zd ed <d Zded<d Zded<d Zd ed<d Z d ed<d Z ded<d Z d ed<d Z d ed<d Z ded<d Zd ed<d Zd ed<d Zd ed<d Zd ed<dZded<d Zded<d Zd&d!Zed'd"Zd(d#Zed)d$Zed*d%Zy )+PooledCredentialrKrOidlabelrQintprioritysource access_tokenN Optional[str] refresh_token last_statusOptional[float]last_status_at Optional[int]last_error_codelast_error_reasonlast_error_messagelast_error_reset_atbase_url expires_at expires_at_ms last_refreshinference_base_url agent_keyagent_key_expires_atr request_countDict[str, Any]extrac|ji|_t|j|j|j|_yN)rorRrOr[rQselfs r( __post_init__zPooledCredential.__post_init__s6 :: DJ2 MM    NN rSc|tvr|jj|Stdt |j d|)N'z' object has no attribute ) _EXTRA_KEYSrogetAttributeErrortype__name__)rsnames r( __getattr__zPooledCredential.__getattr__sB ; ::>>$' 'qd!4!4 55OPTxXYYrSct|Dchc]}|jdk7s|j }}|Dcic]}||vs||j|}}d|vr$t|dtrt |d|d<t Dcic]}||vs|||||}}||d<|jdtjjdd|jd|jd||jdt|jd d |jdt|jd d |d d|i|Scc}wcc}wcc}w)NrOr`rorVrWrZrQrYrr[) rr|rxrJrK_parse_absolute_timestamprw setdefaultuuiduuid4hexrN SOURCE_MANUAL)clsrOpayloadf field_nameskdataros r( from_dictzPooledCredential.from_dictsD'-c{K!aff 6JqvvK K+6Ga!w,7;;q>!GG t # 48H3I3(O%>tDT?U%VD! "(3_1qG|PQ H^GAJ__W  djjl..r23 Xx!@A  %67  A& -0 +-H---LG`s'EE EE EEEc8hd}i}t|D]G}|jdvrt||j}||j|vs9|||j<I|jj D] \}}| |||<t ||j S)N>r^r`rbrcrdre>rorO)rr|getattrroitemsrrO)rs _ALWAYS_EMITresult field_defvaluervs r(to_dictzPooledCredential.to_dicts "$ /I~~!66D)..1E INNl$B).y~~&  / JJ$$& DAq}q  4FDMMJJrSc r|jdk(r|j|jf|j|jffD]\\}}t |t s|js(tj|t|dd|sL|jcSyt |jxsdS)Nnousr<)r<rgr) rOrkrlr[rgrJrKstripauth_mod_nous_invoke_jwt_is_usabler)rsrPrgs r(runtime_api_keyz PooledCredential.runtime_api_keys ==F "!:!:;""DOO4& )!z uc*  ;;%dGT:#- !;;=( )4$$*++rScl|jdk(r|jxs |jS|jS)Nr)rOrjrfrrs r(runtime_base_urlz!PooledCredential.runtime_base_urls- ==F "**;dmm ;}}rS)r|rK)rOrKrrnreturnz'PooledCredential')rrn)rrK)rr\)r{ __module__ __qualname____annotations__r]r^r`rbrcrdrerfrgrhrirjrkrlrmrortr} classmethodrrpropertyrrrrSr(rUrUsM G JNM K#'M='!%K%&*NO*%)O])'+}+(, ,+//"Hm" $J $#'M='"&L-&(, ,#I}#*.-.M3 E>  Z .. K*,,*rSrUct|}dD]F}|j|}t|ts%|j s6|j cS|S)N)emailpreferred_usernameupn)rrxrJrKr)rPfallbackclaimskeyrs r(label_from_tokenrsM  &F5! 3 eS !ekkm;;= ! OrSc0td|DddzS)Nc34K|]}|jywrqrY.0entrys r( z!_next_priority..s454s)default)max)entriess r(_next_priorityrs 4G4b AA EErSc|xsdjj}|tk(xs|jtdS)Nr:)rlowerrrL)rZ normalizeds r(_is_manual_sourcers@,B%%'--/J  & T**?*?=/QR@S*TTrSc:|dk(rtS|dk(rtStS)zHReturn cooldown seconds based on the HTTP status that caused exhaustion.i)EXHAUSTED_TTL_401_SECONDSEXHAUSTED_TTL_429_SECONDSEXHAUSTED_TTL_DEFAULT_SECONDS) error_codes r(_exhausted_ttlr!s$S((S(( ((rSc||dk(ryt|ttfrt|}|dkry|dkDr|dz S|St|tra|j }|sy t|}| |dkDr|dz S|S t j|jddjSy#t $rd}YPwxYw#t $rYywxYw)zBest-effort parse for provider reset timestamps. Accepts epoch seconds, epoch milliseconds, and ISO-8601 strings. Returns seconds since epoch. NrrlJ)@@Zz+00:00) rJrXfloatrKr ValueErrorr fromisoformatr timestamp)rnumericraws r(rr*s  } %#u&, a<#*->#>wKGK%kkm CjG  '.1B'B7V# O O ))#++c8*DEOOQ Q  G    s$ B.:2B?. B<;B<? C  C c4|sytjd|tj}|rCt|j d}|j dj dk(r|dz S|Stjd|tj}|rt|j dStjd|tj}|r;t |j ddzt |j dd zzStjd |tj}|rt |j ddzStjd |tj}|rt |j dd zSy) Nz,quotaResetDelay[:\s\"]+(\d+(?:\.\d+)?)(ms|s)rmsrz?retry\s+(?:after\s+)?(\d+(?:\.\d+)?)\s*(?:sec|secs|seconds|s\b)z'resets?\s+in\s+(\d+)\s*hr\s+(\d+)\s*minr:<zresets?\s+in\s+(\d+)\s*hr\bzresets?\s+in\s+(\d+)\s*min\b)research IGNORECASErgrouprrX)message delay_matchr sec_match hr_min_match hr_only_matchmin_only_matchs r(_extract_retry_delay_secondsrHsV ))KWVXVcVcdKk''*+!,!2!21!5!;!;!=!Euv~P5P \^egigtgtuIY__Q'((99GRTR_R_`L<%%a()D03|7I7I!7L3MPR3RRRIIWN>''*+b00 rSc<t|tsiSi}|jd}t|tr#|j r|j |d<|jd}t|tr#|j r|j |d<|jdxs$|jdxs|jd}t |}|4t|tr$t |}|tj|z}|||d<|S)Nreasonrreset_at resets_at retry_until)rJdictrxrKrrrtime) error_contextrrrrparsed_reset_atretry_delay_secondss r(_normalize_error_contextr_s mT * !#J   x (F&#6<<>%||~ 8 *G'3GMMO '  9*% ,   [ ) ,   ] + 09O:gs#;:7C  *"iik,??O"!0 : rSc|jtk7rytt|dd}||S|jr"|jt |j zSy)Nre)r^STATUS_EXHAUSTEDrrr`rrb)rrs r(_exhausted_untilrxs[ ,,(8Mt)TUH ##nU5J5J&KKK rSc^|jjjddS)z>Normalize a custom provider name for use as a pool key suffix. -)rrr)r|s r(_normalize_custom_pool_namers$ ::<    ' 'S 11rSc#@K| t}|y|jd}t|ts ddlm}||}|sy|D]D}t|ts|jd}t|ts6t||fFy#t $rYywxYww)zJYield (normalized_name, entry_dict) for each valid custom_providers entry.Ncustom_providersr)get_compatible_custom_providersr|) r)rxrJlistr&rr'rrKr)configrrrr|s r(_iter_custom_providersrs ~"$ ~zz"45 & -  I>vF  !7%& yy $$ )$/66 7    s)1BBA B BBBBcj|sy|jjd}|r.t|}tD]\}}||k(s t|cStD]T\}}t |j dxsdjjd}|sD||k(sJt|cSy)a~Look up the custom_providers list in config.yaml and return 'custom:' for a matching base_url. When provider_name is given, prefer matching by name first (solving the case where multiple custom providers share the same base_url but have different API keys). Falls back to base_url matching when no name match is found. Returns None if no match is found. N/rfr)rrstriprrCUSTOM_POOL_PREFIXrKrx)rf provider_namenormalized_urlnormalized_name norm_namer entry_urls r(get_custom_provider_pool_keyrs ^^%,,S1N 5mD 6 8 : IuO+,-i[99 : 346 5 *-34::<CCCH n4())5 56 rScBtdtfdDS)z?Return all 'custom:*' pool keys that have entries in auth.json.Nc3K|]?}|jtr(tj|tr |r|Aywrq)rLrrJrxr)rr pool_datas r(rz-list_custom_pool_providers..s@ >>, - y}}S)4 0 cN sAA)r!sorted)rs@r(list_custom_pool_providersrs'$T*I   rSc|jtsy|ttd}tD]\}}||k(s |cSy)zWReturn the custom_providers config entry matching a pool key like 'custom:together.ai'.N)rLrlenr)pool_keysuffixrrs r(_get_custom_provider_configr sP   1 2 c,-. /F24 5  L rSc t}|tS|jd}t|tstSt |j|dxsdj j}|tvr|StS)z8Return the configured selection strategy for a provider.credential_pool_strategiesr) r)STRATEGY_FILL_FIRSTrxrJrrKrrSUPPORTED_POOL_STRATEGIES)rOr strategiesstrategys r(get_pool_strategyrst  F ~""89J j$ '"":>>(B/526<<>DDFH,, rS)rfct|dd}|t|tr|}nyt|xsdjj }t|xsdjj }|r|sy||k(ry|dk7s|j t sy t|xsd}t|xsdjj |k(S#t$rYywxYw)aReturn whether a pool belongs to the requested runtime provider. Named custom endpoints intentionally use two identities: the live agent is ``custom`` while its pool is keyed ``custom:``. Accept that pair only when the runtime base URL resolves to the exact same custom pool key. Empty string identities fail closed. Legacy pool adapters without a ``provider`` attribute remain compatible; production pools are scoped. rONTrFcustom) rrJrKrrrLrrr')pool_or_providerrOrfraw_pool_provider pool_provider provider_norm matched_pools r( credential_pool_matches_providerrs 0*dC & , 0  )/R0668>>@MB'--/557M   % (@(@AS(T3HNC  |!r " ( ( * 0 0 2m CC s!C C*)C*rc tj}|ytjj dr[tjj dd}|r9t |dz dz } |jd|jdk(ry tj|||d y#t$rYywxYw#t$rYywxYw#t$r!}tjd ||Yd}~yd}~wwxYw) uPersist a rotated OAuth ``state`` into the global-root auth.json. Best-effort write-through for the multi-profile rotation hazard (#48415 / #43589): nous, openai-codex, and xai-oauth rotate the refresh_token on refresh, so when a profile pool refresh rotates a grant it resolved from the root fallback, the rotated chain must land back in root. Otherwise root keeps a now-revoked refresh token and every other profile reading the stale root grant dies with ``refresh_token_reused`` / ``invalid_grant`` once its access token expires. Only updates ``providers.`` in the root store; never touches the profile store (the caller already saved that). Swallows all errors — a failed write-through degrades to the pre-existing behavior (root stale), it must never break the profile's own successful save. Mirrors ``hermes_cli.auth._write_through_xai_oauth_to_global_root`` (which covers the non-pool xAI refresh path) for the credential-pool refresh path. NPYTEST_CURRENT_TESTHOMErz.hermesz auth.jsonF)strict set_activez8%s pool refresh: write-through to global root failed: %s) r_global_auth_file_pathr'osenvironrxr resolve _persist_provider_state_to_storeloggerdebug) provider_idstate global_path real_home_env real_rootexcs r(,_write_through_provider_state_to_global_rootr-s(557   zz~~+, vr2 ]+i7+EI &&e&4 8I8IQV8I8WWX  11     '       F     s;B.,%B=C . B:9B:= C C  C6C11C6ceZdZd*dZd+dZd+dZd,dZd-dZd.dZddd/d Z d0d Z d1 d2d Z d3d Z d3d Z d3dZ d3dZd3dZd4dZd5dZd6dZ d5dZd7dZd-dZdddd8dZd9dZddd:dZd-dZddd d;d Zd1dd$Zd-d%Z d?d&Z!d@d'Z"dAd(Z#d3d)Z$y)BCredentialPoolc||_t|d|_d|_t ||_t j|_i|_ t|_ d|_ y)Nc|jSrqrrs r(z)CredentialPool.__init__..Is %..rSr) rOr_entries _current_idr _strategy threadingLock_lock_active_leases%DEFAULT_MAX_CONCURRENT_PER_CREDENTIAL_max_concurrent_last_no_entries_log_at)rsrOrs r(__init__zCredentialPool.__init__GsT  w,HI *.*84^^% .0D 9=$rSc,t|jSrq)boolr5rrs r(has_credentialszCredentialPool.has_credentialsVDMM""rSc4t|jS)zCTrue if at least one entry is not currently in exhaustion cooldown.)rA_available_entriesrrs r( has_availablezCredentialPool.has_availableYsD++-..rSc,t|jSrq)rr5rrs r(rzCredentialPool.entries]rCrSc\jsytfdjDdS)Nc3VK|] }|jjk(s|"ywrq)rVr6)rrrss r(rz)CredentialPool.current..cs"VuTEUEU9UUV)))r6nextr5rrs`r(currentzCredentialPool.current`s'V VX\]]rSct|jD]/\}}|j|jk(s ||j|<yy)z4Swap an entry in-place by id, preserving sort order.N) enumerater5rV)rsoldnewidxrs r(_replace_entryzCredentialPool._replace_entryes?#DMM2 JCxx366!%( c" rSN removed_idsct|j|jDcgc]}|jc}|ycc}w)NrS)r"rOr5r)rsrTrs r(_persistzCredentialPool._persistls/ MM*.-- 8U]]_ 8# 8sA c|dk7ry|jd}t|tsy|jj t vS)uTDetect upstream-permanent OAuth failures that won't recover on TTL. Only fires for 401 responses whose error code/reason matches a known terminal OAuth state (token_invalidated, token_revoked, invalid_grant, etc.). Distinguishes permanent failures from transient ones like token_expired (refreshable) or generic 401 without a specific reason (could be a server-side glitch worth retrying). Returns False for non-401 status codes — 429 rate limits and 402 billing failures are transient by nature and should keep TTL semantics. rFr)rxrJrKrr_TERMINAL_AUTH_REASONS)rs status_codenormalized_errorrs r(_is_terminal_auth_failurez(CredentialPool._is_terminal_auth_failuressG # !%%h/&#&||~##%)???rSc @t|}|j||rt}nt}t ||t j ||j d|j d|j d}|j|||j|S)Nrrrr^r`rbrcrdre) rr[ STATUS_DEADrrrrxrRrV)rsrrYrrZterminal_statusupdateds r(_mark_exhaustedzCredentialPool._mark_exhausteds 4MB  ) )+7G H)O.O '99;'.228</33I> 0 4 4Z @  E7+ rSc |jdk7s|jdk7r|S ddlm}|}|s|S|j dd}|j dd}|j dd}|j xsd}|j xsd}|s|r|r||k7s|r||k7rtjd |jt||xs |j |xs |j |xs |jd d d d d d } |j|| |j| S|S#t$r!} tjd | Yd } ~ |Sd } ~ wwxYw) aSync a claude_code pool entry from ~/.claude/.credentials.json if tokens differ. OAuth refresh tokens are single-use. When something external (e.g. Claude Code CLI, or another profile's pool) refreshes the token, it writes the new pair to ~/.claude/.credentials.json. The pool entry's refresh token becomes stale. This method detects that and syncs. rI claude_coder)read_claude_code_credentials refreshTokenr accessToken expiresAtzDPool entry %s: syncing tokens from credentials file (tokens changed)N) r[r]rhr^r`rbrcrdrez(Failed to sync from credentials file: %s)rOrZagent.anthropic_adapterrdrxr[r]r%r&rVrrhrRrVr') rsrrdcreds file_refresh file_access file_expires entry_access entry_refreshr`r,s r(+_sync_anthropic_entry_from_credentials_filez:CredentialPool._sync_anthropic_entry_from_credentials_filesW ==K '5<<=+HL' J L02E  99^R8L))M26K 99[!4L !--3L!//52M| !< \]%B ZHH"!,!B0B0B"."E%2E2E"."E%2E2E $#'$(&*'+(, ##E73   J LLCS I I  JsD C*D E )EE c  |jdk7s|jdk7r|S t5t}t |d}dddt t s|S|jd}t |t s|S|jdd}|jdd}|jxsd}|jxsd}|r||k7s|r||k7rtjd|j||xs |jddddddd } |jd r|d | d <t|fi| } |j|| |j| S|S#1swYxYw#t $r!} tjd | Yd} ~ |Sd} ~ wwxYw) uSync a Codex device_code pool entry from auth.json if tokens differ. When a Codex OAuth access token expires (or the ChatGPT account hits its 5h/weekly quota), the pool entry gets marked ``STATUS_EXHAUSTED`` with a ``last_error_reset_at`` that can be many hours in the future. Meanwhile the user may run ``hermes model`` / ``hermes auth`` which performs a fresh device-code login and writes new tokens to ``auth.json`` under ``_auth_store_lock``. Without this sync the pool entry stays frozen until ``last_error_reset_at`` elapses — even though fresh credentials are sitting on disk — and every request fails with "no available entries (all exhausted or empty)". Mirrors the Nous/Anthropic resync paths above. Only applies to device_code-sourced entries; env/API-key-sourced entries have no auth.json shadow to sync from. openai-codex device_codeNtokensr[rr]zQPool entry %s: syncing Codex tokens from auth.json (refreshed by another process)r[r]r^r`rbrcrdreriz-Failed to sync Codex entry from auth.json: %srOrZrrrrJrrxr[r]r%r&rVrrRrVr' rsr auth_storer(rs store_access store_refreshrmrn field_updatesr`r,s r(!_sync_codex_entry_from_auth_storez0CredentialPool._sync_codex_entry_from_auth_stores" ==N *ellm.KL* O!# I-/ ,ZH IeT* YYx(Ffd+ !::nb9L"JJ;M!--3L!//52M ,!m}&D 5HH %1%2%Ie6I6I#'&*'+)-*.+/ 1 99^,49.4IM.1!%9=9##E73  U I IP O LLH# N N  O; E#EE#"E#CE#E E## F ,FF c  |jdk7s|jdk7r|S t5t}t |d}dddt t s|S|jd}t |t s|S|jdd}|jdd}|jxsd}|jxsd}|r||k7s|r||k7rtjd|j||xs |jddddddd } |jd r|d | d <t|fi| } |j|| |j| S|S#1swYxYw#t $r!} tjd | Yd} ~ |Sd} ~ wwxYw) aSync an xAI OAuth pool entry from auth.json if tokens differ. xAI OAuth refresh tokens are single-use. When another Hermes process (or another profile sharing the same auth.json) refreshes the token, it writes the new pair to ``providers["xai-oauth"]["tokens"]`` under ``_auth_store_lock``. Without this resync, our in-memory pool entry keeps the consumed refresh_token and the next ``_refresh_entry`` call would replay it and get a ``refresh_token_reused``-style 4xx. Only applies to entries seeded from the singleton (``device_code``); manually added entries are independent credentials with their own refresh-token lifecycle. xai-oauthrrNrsr[rr]zUPool entry %s: syncing xAI OAuth tokens from auth.json (refreshed by another process)rtriz1Failed to sync xAI OAuth entry from auth.json: %srurvs r(%_sync_xai_oauth_entry_from_auth_storez4CredentialPool._sync_xai_oauth_entry_from_auth_stores ==K '5<<=+HL' S!# F-/ ,ZE FeT* YYx(Ffd+ !::nb9L"JJ;M --3L!//52M ,!m}&D 5HH %1%2%Ie6I6I#'&*'+)-*.+/ 1 99^,49.4IM.1!%9=9##E73  O F FJ S LLLc R R  Sr|c|jdk7rS tfdt|jDd}t|tsSt j |j|}|jjk7s|jjk7r4tjdj|j||S S#t$r!}tjd|Yd}~Sd}~wwxYw)aAdopt a token pair rotated by another pool instance. Direct xAI integrations load a fresh ``CredentialPool`` for each request. Their in-memory locks therefore cannot protect xAI's single-use refresh token across concurrent requests or processes. This helper is called while the shared auth-store lock is held and re-reads the exact persisted row before a refresh POST is attempted. r~c3~K|]4}t|tr"|jdjk(r|6yw)rVN)rJrrxrV)rrrs r(rzGCredentialPool._sync_xai_oauth_entry_from_pool_store..fs7!'40W[[5F%((5Rs:=NzIPool entry %s: adopting xAI OAuth tokens rotated by another pool instancez7Failed to sync xAI OAuth entry from credential pool: %s)rOrKr!rJrrUrr[r]r%r&rVrRr')rsr persistedstoredr,s ` r(%_sync_xai_oauth_entry_from_pool_storez4CredentialPool._sync_xai_oauth_entry_from_pool_storeWs ==K 'L Y#7 #F  Ii. %// yIF##u'9'99''5+>+>> _HH##E62 ?  Y LLRTW X X  Ys9CBC D C<<Dc:|jdk7sjdk7rS t5t}t |d}dddsS|j dd}|j dd}|||j d|j d|j d |j d d }t fd |jD}|rtjd jddddddd}|r||d<|r||d<|j dr|d|d<|j dr|d|d<|j d r|d |d <|j d r|d |d <tj} dD]} |j | } | | | | <tfd| i|} |j| |j| S S#1swYxYw#t $r!} tjd| Yd} ~ Sd} ~ wwxYw)aSync a Nous pool entry from auth.json if tokens differ. Nous OAuth refresh tokens are single-use. When another process (e.g. a concurrent cron) refreshes the token via ``resolve_nous_runtime_credentials``, it writes fresh tokens to auth.json under ``_auth_store_lock``. The pool entry's tokens become stale. This method detects that and adopts the newer pair, avoiding a "refresh token reuse" revocation on the Nous Portal. rrrNr]rr[rgrkrlrj)r[r]rgrkrlrjc3PK|]\}}|dvxrt|d|k7yw)NrN)r)rrrrs r(rzBCredentialPool._sync_nous_entry_from_auth_store..s8CZ'NGE3,E,NNs#&z0Pool entry %s: syncing Nous state from auth.jsonr]r@r>rArFrDrGroz,Failed to sync Nous entry from auth.json: %s)rOrZrrrrxanyrr%r&rVrrorrRrVr')rsrrwr(ryrxcomparable_updates should_syncrz extra_updates extra_keyvalr`r,s ` r( _sync_nous_entry_from_auth_storez/CredentialPool._sync_nous_entry_from_auth_store~sV ==F "ellm&CL9 N!# A-/ ,Z@ A !IIor:M 99^R8L ,!.#ii 5"YY{3(- 2H(I&+ii0D&E " "4":":"<K FHH $(&*'+)-*.+/ 1  4@M.1 5BM/299\*27 2EM,/99[)16{1CM+.9934`` still holds the pre-refresh state. On the next ``load_pool()``, ``_seed_from_singletons()`` reads that stale state and can overwrite the fresh pool entry — potentially re-seeding a consumed single-use refresh token. Applies to any OAuth provider whose singleton lives in auth.json (currently Nous, OpenAI Codex, and xAI Grok OAuth). ``set_active=False`` on every write: a pool sync-back is a token-rotation side effect, not the user choosing a provider. Using ``_save_provider_state`` (which sets ``active_provider``) here would mean every Nous/Codex/xAI refresh in a multi-provider setup silently flips the ``active_provider`` flag — the next ``hermes`` invocation that defaults to the active provider (e.g. setup wizard, ``hermes auth status``) would land on whatever provider happened to refresh last, not whatever the user actually chose. rrNrrqr~)rrqr~ providersr[r]rgrkrlrrjFrrsriz3Failed to sync %s pool entry back to auth store: %s)rZrrrxrOrArJrrr[r]rgrkrlrorjr rirr-r'r%r&) rsrrw_wt_provider_idwrite_through_to_rootr(rrrsr,s r(%_sync_device_code_entry_to_auth_storez4CredentialPool._sync_device_code_entry_to_auth_storesu4 <<= ( U d!#R -/ #$2!,##dmm$  )-_(=)z~~k:DA"";/33ODdC% ==F*0VDE}7R R 8-2,>,>E.)**161D1Do.''.3.>.>l+-2__k*118=8R8R45&?3 $kkooi8?/2E), 3 //6;6N6N23)*fePUV]]n40^LE%eT2eR R f#YYx0F%fd3kR R l.3-?-?F>***272E2E/))050B0Bn-)*neX]^]]k10[IE%eT2AR R B#YYx0F%fd3GR R H.3-?-?F>***272E2E/))050B0Bn-)*k5UZ[YR R \!,(_@'aR R R f d LLNPTP]P]_b c c ds L3BL'5L3>BL'AL';L3"L'&L3/BL'0L39"L'L3$AL':L3L'L3'L0,L30L33 M'r| jdxsi} t=| t>rtA| jdxsdjC}tA|jxsdjC}|r||k(r| jEdd| jEdd| | d<dtG| ddtA| d d!tIjJtLjNjQd"| d#<tS| d| tU| dddn #1swYnxYwn,#t$r }tjd$|Yd}~nd}~wwxYw|jVDcgc]}|jd%k(r |j(ncc}w}}|jVDcgc]}|jd%k7r|ncc}wc}|_+|jX|j(k(rd|_,|j1|&Yd} ~ y|jd k(r|j|}|j|jk7rTtjd't |t,ddddd}|j/|||j1|cYd} ~ StjZ| r@tjd( t75t9} t;| d xsi} t=| t>r| jdxsi} t=| t>rtA| jdxsdjC}tA|jxsdjC}|r||k(r| jEdd| jEdd| | d<d tG| ddtA| d d!tIjJtLjNjQd"| d#<tS| d | tU| dddn #1swYnxYwn,#t$r }tjd)|Yd}~nd}~wwxYw|jVDcgc]}|jd%k(r |j(ncc}w}}|jVDcgc]}|jd%k7r|ncc}wc}|_+|jX|j(k(rd|_,|j1|&Yd} ~ y|jdk(r|j%|}|j|jk7retjd*t |t,ddddd}|j/|||j1|j]||cYd} ~ Stj^| r&tjd+ t75t9} t;| dxsE|j`|jb|jd|jf|jh|jjd,} tA| jdxsdjC}tA|jxsdjC}|r||k(rHtjl| | d -tjn| | d -tS| d| tU| dddn #1swYnxYwn,#t$r }tjd.|Yd}~nd}~wwxYwtjpd/tjph}|jVDcgc]}|j|vr |j(ncc}w}}|jVDcgc]}|j|vr|ncc}wc}|_+|jX|j(k(rd|_,|j1|&Yd} ~ y|js|dYd} ~ yd} ~ wwxYw)0NrIr)refresh_anthropic_oauth_pure hermes_pkce)use_jsonr[r]rh)r[r]rhrc)_write_claude_code_credentialsz7Failed to write refreshed token to credentials file: %srqri)r[r]rir~r) force_refreshz'Credential refresh failed for %s/%s: %sz8Retrying refresh with synced token from credentials file)r[r]rhr^r`rbzDFailed to write refreshed token to credentials file (retry path): %szRetry refresh also failed: %sz7Credentials file has valid token, using without refreshuDxAI OAuth refresh failed but auth.json has newer tokens — adoptingr]zIxAI OAuth refresh token is terminally invalid; clearing local token statersrcodeunknowncredential_pool_refresh_failureT)rOrrrrelogin_requiredatlast_auth_errorz,Failed to clear terminal xAI OAuth state: %srrrSuFCodex OAuth refresh failed but auth.json has newer tokens — adoptingzKCodex OAuth refresh token is terminally invalid; clearing local token statez.Failed to clear terminal Codex OAuth state: %su?Nous refresh failed but auth.json has newer tokens — adoptingzDNous refresh token is terminally invalid; clearing local token state)r=rCrjr?r<r;)rz-Failed to clear terminal Nous OAuth state: %szmanual:):rOrhrr]rZendswithrrr'r%r&r{rrefresh_codex_oauth_purer[rxrrefresh_xai_oauth_purer resolve_nous_runtime_credentialsrVro STATUS_OKrRrVr$_is_terminal_xai_oauth_refresh_errorrrrrJrrKrpoprrnowrutc isoformatrrr5r6&_is_terminal_codex_oauth_refresh_errorr_is_terminal_nous_refresh_errorr=rCrjr?r<r;_quarantine_nous_oauth_state_quarantine_nous_pool_entriesNOUS_DEVICE_CODE_SOURCEra)rsrrr refreshedr`rwexcrr, retry_excrwr(rsryrn clear_excitemrTsingleton_sourcess r(rz"CredentialPool._refresh_entry_implss F }} +P8''"\\22=A "!*>!:"+O"<"+O"< <<=0fZ6%n5%o6%o6.0 ??F&"E$==&&'' "!*>!:"+O"  +- CCEJ&"E$;;&&'' "!*>!:"+O"  &(>>uE&"E99"'??F ~ ! "# $  E7+  227;} %f %^`deefb|  LLBDMMSXS[S[]` a}} + 0MII%P''5+>+>>LL![\QX$@"00%+]]%;%;M%J% #*")2>)B*3O*D*3O*D(1+/,0#++FG< w^: ). 9 )/ : )/ : )w"LL)oquvvw&$Q %DiPPQ226:LL!Z[!M}} +CCEJ''5+>+>>LL^&$-'+(,*.+/,0G''8MMO"N @@ELLc-/E)9);J$8[$Q$WUWE)%6).8)<)B#-fd#;47 ?8S8YWY4Z4`4`4bM478K8K8Qr4R4X4X4ZM+8M]4(H(. ?D(I:@h8C4;C4S7:3x6W@D2:,,x||2L2V2V2X D*.?(@)=ZV[(\(8(D+EEE,% JI -1MM#$(;;-7##K# *.%!%;;-7%%DM''5883+/(MMkM: }}.??F''5+>+>>LL`&$-'+(,*.+/,0G''8MMO"N BB3GLLe-/E)9);J$8^$T$ZXZE)%6).8)<)B#-fd#;47 ?8S8YWY4Z4`4`4bM478K8K8Qr4R4X4X4ZM+8M]4(H(. ?D(I:@h8F4;C4S7:3x6W@D2:,,x||2L2V2V2X D*.?(@)=ZY^(_(8(D+EEE,% Li -1MM#$(;;-7##K# *.%!%;;-7%%DM''5883+/(MMkM:}}&>>uE''5+>+>>LL!bc%$-'+(,*.+/,0G''8MMO>>wG"N;;C@LL!gha-/=)9);J$8V$L%-2__383H3H6;6N6N.3.>.>).',yy QE-0 /0J0Pb,Q,W,W,YM,/0C0C0Ir,J,P,P,RM#0M]4R ( E E$)$'+L!" !) F F$.$'+L!" !5Z O 0 <1===2%a %TV_``a!88!("B"B!CD)% -1MM#$(;;*;;##K# *.%!%;;.??%%DM''5883+/(MMkM:   -y| sA*H9-H D;H9 H6H1,H91H66H99 r*B r%A4NMN N(N>NNN r* N;N61r%6N;;*r%%r*+Br%3r*9+r%% X/D;W3* X3W< 8X?r% X) X$r%$X))r%:"Yr%2Z  Ar%Br%r*+r% c$D;c c$c c$#r%$ d -dr%d  r%"er%e/.Ar%3Br% r*+r%> nDn nn nr% o'o=r%o4r%;!pr%2q  Ar%r%%r*c|jtk7ry|jdk(rF|jyt |jt t j dzdzkS|jdk(rt |jtS|jdk(r=tj|jtj|jS|jdk(ryy)NFrIirqr~r) rQrMrOrhrXrrr[rr_xai_access_token_is_expiring#_xai_proactive_refresh_skew_secondsrsrs r(rz#CredentialPool._entry_needs_refreshs ??o - ==K '""*u**+s499;3E/F/PP P ==N *2""7  ==K '99""< -LLII%P&"E"&K  ' 5)).> -LL>>uE&"E"&K  / 5)).> -LL??F&"E"&K  , 5)).> -LLCCEJ&"E"&K  K/%U\\2#227aG3=3P#P!&!<! Y"!33@y 7]f4 MM )//9&*   $44"25"9".33H %$-'+(,*.+/,0G''w7#E"&K444U; //U/C $!   U #Ke $L -.J(, P1Z9OQPDM  MM&6M 7Qs 0L&L&ctj}|j}| ||z tkry||_tj dy)a+Emit the empty-pool INFO line at most once per throttle window. Called on every selection while the pool is empty/exhausted. Without throttling this storms the Windows cross-process log lock and stalls the event loop (see NO_AVAILABLE_ENTRIES_LOG_THROTTLE_SECONDS). Nz>credential pool: no available entries (all exhausted or empty))r monotonicr>)NO_AVAILABLE_ENTRIES_LOG_THROTTLE_SECONDSr%info)rsrlasts r(_log_no_available_entriesz(CredentialPool._log_no_available_entriescsEnn++  t/X X '*$ TUrSTrc|jd|}|sd|_|jyd|_|jt k(r(t j|}|j|_|S|jtk(r[t|dkDrMt|d}t||jdz}|j|||j|_|S|jtk(rt|dkDr|d}|j Dcgc]}|j|jk7s| }}|j#t|t|j dz t%|Dcgc]\}}t||c}}|_|j'|j|_|j)xs|S|d}|j|_|Scc}wcc}}w) NTrrc|jSrqrm)rs r(r3z1CredentialPool._select_unlocked..s rSr4rrr)rEr6rr>r7STRATEGY_RANDOMr8choicerVSTRATEGY_LEAST_USEDrminrrmrRSTRATEGY_ROUND_ROBINr5rrNrVrL)rsrrrr` candidaterotatedrQs r(rzCredentialPool._select_unlockedqs++$+P #D   * * , (,$ >>_ ,MM),E$xxD L >>0 0S^a5G '@AEe53F3F3JKG   w /$xxD N >>1 1c)nq6HaLE26--\Y9<*U *!  88 ]gsG$1G$7G)c\|j}||S|j}|r|dSdSNr)rLrE)rsrLrs r(peekzCredentialPool.peeks7,,.  N++- (y|2d2rS)r api_key_hintc|j5drtfd|jDd"|jxs|j  dddyj xsj dd}|j||tfd|jD}|jtk(r'tjd|||jxsdntjd||d|_|j }|r3|j xs|j dd}tjd||cdddS#1swYyxYw)Nc3BK|]}|jk(s|ywrqr)rrrs r(rz;CredentialPool.mark_exhausted_and_rotate..sS11B1Bl1RQSsrc3VK|] }|jjk(s|"ywrq)rV)rrrs r(rz;CredentialPool.mark_exhausted_and_rotate..s >qQTTUXX-=>rJuxcredential pool: marking %s DEAD (status=%s, reason=%s) — permanently failed, will NOT re-enter rotation until re-authrz;credential pool: marking %s exhausted (status=%s), rotatingzcredential pool: rotated to %s)r:rKr5rLrrWrVrar^r^r%rrcrr6) rsrYrrr updated_entry next_entry _next_labelrs ` @r(mark_exhausted_and_rotatez(CredentialPool.mark_exhausted_and_rotatesMZZ% E S S} A$*?*?*A}% % [[0EHHRaLF   ] C >DMM>M((K7SK)H)H)UI  QK $D ..0J(..C*--2C  jj|ddzj|<|_|cdddSj dd}|s dddy|Dcgc]7}jj|j dj kr|9}}|r|n|}t|fd}jj|j ddzj|j <|j _|j cdddScc}w#1swYyxYw)a\Acquire a soft lease on a credential. If a specific credential_id is provided, lease that entry directly. Otherwise prefer the least-leased available credential, using priority as a stable tie-breaker. When every credential is already at the soft cap, still return the least-leased one instead of blocking. rrNTrchjj|jd|jfSr)r;rxrVrY)rrss r(r3z.CredentialPool.acquire_lease..s'4#6#6#:#:588Q#G"XrSr4)r:r;rxr6rErVr=r)rs credential_idrr below_cap candidateschosens` r( acquire_leasezCredentialPool.acquire_leases:ZZ 595H5H5L5L]\]5^ab5b##M2#0 $    //dD/QI  $-&&**588Q7$:N:NNI'0YJXF.2-@-@-D-DVYYPQ-RUV-VD   *%yyD 99+    s*7D1D1.D12.s'%$44 D"sFr)r:rKr5rLrrVr6r )rsrrs ` r(try_refresh_matchingz#CredentialPool.try_refresh_matchingsZZ 8E)-   N$*?*?*?*N} 8 8 %xxD 557! 8 8 8sA B # B  Bcx|j}|y|j|d}||j|_|S)NTr)rLrrVr6)rsrrs r(r z,CredentialPool._try_refresh_current_unlockedsB  =''T':  (||D rSc d}g}|jD]^}|js|js |jr'|j t |dddddd|dz }N|j |`|r||_|j |S)Nrr]r)r5r^r`rbrrrV)rsr new_entriesrs r(reset_statuseszCredentialPool.reset_statusess ]] *E  E$8$8EB @"@)@  @637 #0   >2h>@8t%%% %NFPqdf%?8 -18)8 #8:0">2rSr/c@g}t|D]&\}}|j|k(s|j|(|r|dnd}t|dd}|r&t|Dcgc] \}}||vs |c}}|dd||j dt j jdd|j dt||j d|jdxs||jtj||y||} i} i} t| D chc]} | j} } |jD]e\}}|dvs| |dk(r | jr|| vrt!| ||k7s3|| |<9|t"vsB| j$j||k7sa|| |<g| s| rT| ri| j$| | d <t'| fi| }|||<t)|xs!| j+|j+k7St)|Scc}}wcc} w) NrrrVrrYrWT>rVrYro)rNrZrrrrrrrrxrUrrr|rrWrrwrorrAr)rrOrZrmatching_indicesrQr existing_idxduplicate_indicesexistingrzrr _field_namesrrr`s r( _upsert_entryr-gs-() U <<6 !  # #C ()+;#A&L,QR01.7.@a UCO`D`ea 4!1!1"1!56:~g'>?7GKK$8$BFC'11(GDE|$HMM$*8$45qAFF5L5mmo + U $ $  '>hnn  , x%.%* c" K ~~!!#&%/%* c" + %H%H-%HM' "(4m4 ' %&Q(*:*:*<@Q*QQ ! ""Cb6s H+H%Hcl |dk7rydddddd td |Dd }td |D fd  }g||}t|Dcic]\}}|j|}}}d}t|D]4\} }|j| k7st || |||j<d}6|Scc}}w)NrIFrrr)zenv:ANTHROPIC_TOKENzenv:CLAUDE_CODE_OAUTH_TOKENrrczenv:ANTHROPIC_API_KEYc3LK|]}t|js|ywrqrrZrs r(rz-_normalize_pool_priorities..sG5'8'FG$$c|jSrqrr2s r(r3z,_normalize_pool_priorities..s %..rSr4c3LK|]}t|jr|ywrqr2rs r(rz-_normalize_pool_priorities..sK5+.s/ OOELL#k*: ; NN KK rSrT)rrNrVrYr) rOrmanual_entriesseeded_entriesorderedrQr id_to_idxchangedrr7s @r(_normalize_pool_prioritiesr=s; !'(!" KGGG (NKGK N100G1:71CD:33DIDG(1 e >>\ )+25<+PGIehh' (G N EsB0cf&d}t}t} ddlm}|dk(rI ddlm}|ds||fS t &dM&fd }|d}|d xs|d } t|xr| } | r?|D cgc]} | jd vr| } } t| t|k7r| |ddd }||fSdd l m } m }d|fd| ffD]\}}|s |jds|||r%|j||t||||t |jdd|jd|jdt#|jdd|dz}||fS|dk(rt%|d}tt'|t(xrZt+|jdxsdj-xs,t+|jdxsdj-}|r=|s;|D cgc]} | jdvr| } } t| t|k7r| |ddd }|r|r||ds|jdt+|jdxsdj-}|xst#|jddd}|t||didddt d|jddd|jdd|jdd|jdd |jd d!|jd!d"|jd"d#|jd#d|jdd$|jd$d%|jd%d&|jd&d'|jd'd(|jd(d)|jd)|jd*t'|jd+t(r|jd+nd|d,z}||fS|d-k(r dd.lm}m}|\}}|r||\}}d/|j5vrd0nd1|}|||sU|j|t7j|}|xs|r |j8nd}|t||||t:|||d2z}||fS|d4k(r dd5lm!}|d6}|jd7d}|rw|jdd8}|||s\|j||t||||t ||jd9|jd:d|jd;|d<z}||fS|d>k(r dd?lm"}|d>}|r|jdrd@}|||s|j|d} ddAl#m#}!|jdd}"|"r+tI|!jK|"jMdBz} t+|jd#dxsdjOdC}#|t||||t |d|jd| |#|jddxst#|jdd|dDz}||fS|dFk(r||dr||fSt%|dF}t'|t(r|jdGnd}$t'|$t(r|$jdr|jdt+|jdxsdj-}|t||ddt |$jdd|$jddH|jdI|xst#|$jddddJz}||fS|dKk(rt%|dK}t'|t(r|jdGnd}$t'|$t(r|$jdrd}|||r||fS|j|ddLlm(}%|%}#|t||||t |$jdd|$jd|#|jdIt#|$jdd|dJz}||fS#t$rd}YWwxYw#t$rYMwxYwcc} wcc} w#t<$r#}t>jAd3|Yd}~||fSd}~wwxYw#t<$r#}t>jAd=|Yd}~||fSd}~wwxYw#t<$rd} YwxYw#t<$r#}t>jAdE|Yd}~||fSd}~wwxYw)NNFris_source_suppressedcyNFr_p_ss r(_is_suppressedz-_seed_from_singletons.._is_suppressedrSrI)!is_provider_explicitly_configuredcfj|xst|dxsdjSr)rx _get_secretr)r _env_files r(_env_valz'_seed_from_singletons.._env_vals,MM#&D+c2*>D"KKM MrSANTHROPIC_API_KEYANTHROPIC_TOKENCLAUDE_CODE_OAUTH_TOKEN>rcrT)rdread_hermes_oauth_credentialsrrcrfrrerg)rZrQr[r]rhrWrr[rk>manual:device_coderrrrrWrZrQr]rgr?r<r=rCrjrlr@r>rArFrDrGr;)rGr;rWcopilot)resolve_copilot_tokenget_copilot_api_tokenghgh_clienv:rZrQr[rfrWzCopilot token seed failed: %sz qwen-oauth) resolve_qwen_runtime_credentials)refresh_if_expiringr4zqwen-clirhrf auth_file)rZrQr[rhrfrWz Qwen OAuth token seed failed: %sz minimax-oauth)get_provider_auth_stater3)rrr)rZrQr[r]rhrfrWz#MiniMax OAuth token seed failed: %srqrsz%https://chatgpt.com/backend-api/codexri)rZrQr[r]rfrirWr~)DEFAULT_XAI_OAUTH_BASE_URLrrKrrK))rrhermes_cli.authr@ ImportErrorrHrrArZrrhrdrPrxaddr-rMrrrJrrKrhermes_cli.copilot_authrSrTrrrjrNr'r%r&rYr\rrXrrrr])'rOrr<active_sourcesrwrFrHrLanthropic_api_keyanthropic_oauth_envapi_key_path_explicitrretainedrdrP source_namerir(has_runtime_material custom_label seeded_labelrSrTrPrZ api_tokenenterprise_base_urlpconfigeffective_base_urlr,rYr\rh_dtrrfrsr]rKs' @r(_seed_from_singletonsrqs, G"uN!#JJ ;   I4[A..B*J  N%%89 & ' N84M+N !%%6%R?R;R S $+<<'EEH8}G ,% N* *g9; < 8: ;#   K=1!(K8"";/="-%4(- -(D).>)B).;)?!1%))M22NP[!\    ~ N ""S V $Z8# ud # EIIn-34::<=uyy-34::<   -#*<<'LLH8}G ,%  ).=2Y   } - uyy17R8>>@L'+; ."-},L }m#EIInb$A$UYY%?  !%))L"9  !%))L"9 UYYw/ ;!7&uyy1B'C)%))4H*I ;!7+EII6L,M&"599]#;'(!%))L"9)*#EIIn$=+,+EII6L,M-.' 2D(E/0.3YY7N-O/9%))E:JD/Q599U+W[)5  G\ N ""Y Y  ? \13ME61Fu1M. .*.&,,.*@hVHo %h <"&&{3/33H=G*=*6=222'} #&1):,5(:%+   Gt N ""W \ !  B H4OEIIi,E#ii*= %h <"&&{3} #&1)8,1-2YY-G(- *b(A%*YY{K%H   Gz N ""[ _ $! E ?+O2% %h <"&&{3$(M-<#ii b9,/0A0A#0F0P0P0RUY0Y,ZM #599-A2#F#L"MTTUXYH} #&1)8,1.,A-2YY-G-:(0%*YYw%;&?O % ." ={@   Gl N ""G ^ # (M 2N* *$Z@(25$(?8$T fd # >(B   } -uyy17R8>>@L }+!0$*JJ~r$B%+ZZ%@ G$)IIn$=)l-=fjjY[>\^k-l  G` N ""C [ %Z=(25$(?8$T fd # >(B#Fh/..   v & B1H }$!0$*JJ~r$B%+ZZ%@ ($)IIn$=-fjj.LfU  G N ""w     HVb ? LL8# > >Z N ""] ?< B LL;S A A^ N ""a B.%-(, -& E LL> D DJ N ""M Esa'a:9b =bBb:BcAd Ac2%B d' a76a7: bb cb;;c c/ c**c/2 d=ddd d0 d++d0c ^d}t}dd} ddlm}ddtd dfd}|d k(rM|d }|r?d }|||r||fS|j ||t |||||d |t z}||fStj|} | r| jtk7r||fSd } | jr!|| jjd} t| j} |dk(rgd} | D]} || }|sd| }|||r|j || xs | j} |dk(rt!|| j| } n|dk(rt#|| j| } |t |||||| || z}||fS#t$rd}YwxYw)NFct}|j|dj}tjj|dj}|j dr|r|S|xst |dxs|S)Nrzop://)rrxrr!r"rLrJ)renv_filerenv_vals r(_get_env_prefer_dotenvz._seed_from_env.._get_env_prefer_dotenv sk:ll3#))+**..b)//1 >>' "wN5k#r*5g5rSrr?cyrBrrCs r(_is_source_suppressedz-_seed_from_env.._is_source_suppressed rGrSc| ddlm}||}|rt|j SdS#t$rd}Y*wxYw)Nr)get_secret_source)hermes_cli.env_loaderrzr'rKr)rrz source_labels r(_secret_source_for_envz._seed_from_env.._secret_source_for_env! sG ?,W5L-9s< &&(BdB L s - ;;)rQc6|||||d}|}|r||d<|S)NrXrBr)rZrrPrfrQrrBr}s r( _env_payloadz$_seed_from_env.._env_payload) s9"!  # /w7 '4GO $rS openrouterOPENROUTER_API_KEYzenv:OPENROUTER_API_KEY)rZrrPrfrrrI)rNrOrMrWz kimi-codingzair^)rrKrr\) rZrKrrKrPrKrfrKrQrKrrn)rr_r@r`rNrar-rrrxrQbase_url_env_varrrapi_key_env_varsrjrr)rOrr<rcrvrxrrPrZrnenv_urlenv_varsrrfr}s @r(_seed_from_envrs9G"uN 6,Q C+       (<&';< -F$Xv6..   v & }!00   G&&##H-G g''+<<&&G()A)ABII#NG,,-H;   &w/ y! 6 2 6"8g88 } $-eW5O5OQXYH  ,UG4N4NPWXH=    !     2 N ""}  sF F,+F,Tprune_env_sourcescdfd }|Dcgc]/}t|js|j|vs||s|1}}t|t|k(ry||ddycc}w)Nc|jjdrSt|j|jxs|jdk(S)NrWr)rZrLrrO)rrs r( _is_prunablez1_prune_stale_seeded_entries.._is_prunable sG << " "6 *$ $ *%,, G -||}, rSFTr&)rrZr)rrcrrrrgs ` r(_prune_stale_seeded_entriesr~ sm  $  U\\ * <<> )E" H 8}G $GAJ s4A c d}t} ddlm}t |}|rt |j dxsdj}t |j dxsdjjd}t |j d xsdj}|r>d |} ||| s0|j| |t||| | t|||xs| d z} t} | r| j d nd } t| trt | j dxsdjj} t | j dxsdjjd} d}dD]F}| j |}t|t s%|js6|j}n| dk(rK| rI|rGt!| }||k(r7d} ||| s,|j| |t||| | t|| dd z}||fS#t$rd}Y6wxYw#t"$rY||fSwxYw)zJSeed a custom endpoint pool from custom_providers config and model config.Frr?cyrBrrCs r(rFz)_seed_custom_pool.._is_suppressed rGrSr4rrfrr|zconfig:rXmodelNrO)r4apir model_config)rr_r@r`r rKrxrrrar-rNr)rJrrrr')rrr<rcrF cp_configr4rfr|rZr model_cfgmodel_providermodel_base_url model_api_keyrr matched_keys r(_seed_custom_poolr s\G"uNJ ,H5IimmI.4"5;;=y}}Z06B7==?FFsK9==(.B/557 tf%F!(F3""6*="(%6(/$,!%     "$+1FJJw't i & z!:!@bAGGIOOQN z!:!@bAGGIPPQTUNM' MM!$a%!'')$%GGIM   )n:>J (*+F)(F;&**62=#$"*0->0=,:)7  $  N ""}  v   N "" s1H;5C IIA#I; I  I  IIcxsdjjt}|Dchc]4}t|tr"|j dr|j d6}}t fd|D}|Dcgc]}tj|}}t fd|D}|rGtj d}t|tr|j nd} t| }jtr)t|\} } |xs|xs| } | t|| z} nOt|\} }t!|\}}|xs |xs| xs|} | t|||zdz} | t#|z} | rR|Dchc]}|j$}}t't)|d Dcgc]}|j+c}||z t-|Scc}wcc}wcc}wcc}w) NrrVc3`K|]%}t|txrt||k7'ywrq)rJrrrrrOs r(rzload_pool.. s=!  7D! O 0( Cw N O!s+.c 3K|]]}t|txrGt|jd|jdt|jdtk7_yw)r[rQN)rJrrRrxrNrs r(rzload_pool.. sh'  7D! 9 %  KK ' KK %6 7 [[&7 8  9 9'sA#A&credential_poolFrc|jSrqr)rs r(r3zload_pool..& s 4==rSr4rS)rrr!rJrrxrrUrrrArLrrrrqrr=rVr"rrr/)rO raw_entriesrdisk_idsraw_needs_sanitizationrrraw_needs_auth_normalization active_poolactive_entriescustom_changedcustom_sourcesr<singleton_changedr env_changed env_sourcesnew_idss` r( load_poolr s,B%%'--/H&x0K!  eT "uyy  $H !!#! MXX))(G<XGX#&'#'$ $'(,,->? 6@d6S2Y]'+N';$-.):8W)M&(Z,HZN.wGG/DXw/W,,#1(G#D [ " +     .   +#   -h@@)0158811 *0>X*Y ZU]]_ Z 7* (G ,,yYX2 [s9G/G4G9G> )rOptional[dict])rOrKrPr rQr rrK)rPrKrrKrrK)rr"rrX)rZrKrrA)rrarrX)rr rr_)rrKrr_)rr%rrn)rrUrr_)r|rKrrKrq)rr)rfr\rr\rr\)rz List[str])rrKrr%)rOrKrrK)rr rOr\rfr\rrA)r'rKr(rnrr$) rr"rOrKrZrKrrnrrA)rOrKrr"rrA)rOrKrr"rTuple[bool, Set[str]])rr"rczSet[str]rrArrA)rrKrr"rr)rOrKrr/)h__doc__ __future__rloggingr!r8r8rrr dataclassesrrrrrpathlibr typingr r r r rrhermes_constantsrr&ragent.secret_scoperrJagent.credential_persistencerrr_authrrrrrrrrrrrrr r!r" getLoggerr{r%r)rrr^ frozensetrXrrMrNrSOURCE_MANUAL_DEVICE_CODEr rrrrrrrrrrwrRrUrrrrrrrrrrrrr rrr<r-r/r-r=rqrrrrrrSr(rsCB"  22'880&8#"   8 $(   #$(!- ,o\:"$" ## '-1)  / gg gTFU )<.22 74< (# #D#D#D #D  #DL)*%4 4 +4  4 n^^B)*#ZDD#N ~#J#  #     FF#R?-rS