`gjFdZddlmZddlZddlZddlZddlZddlZddl Zddl m Z dZ dZ ddZdddZdd d  dd Zd d  ddZddZy)u``hermes dashboard register`` — register a self-hosted dashboard OAuth client. Automates what a user otherwise does by hand: open the Nous Portal ``/local-dashboards`` page in a browser, click "register", copy the resulting ``agent:{id}`` OAuth client ID, and paste it into ``~/.hermes/.env`` as ``HERMES_DASHBOARD_OAUTH_CLIENT_ID``. This command: 1. Resolves a fresh Nous Portal access token from the existing login (``~/.hermes/auth.json``), refreshing it if needed. Fails fast with a "run `hermes setup`" hint when the user isn't logged in. 2. POSTs to ``{portal}/api/oauth/self-hosted-client`` with that bearer token, which creates a SELF_HOSTED agent client owned by the caller's org and returns the fully-formed ``agent:{id}`` client_id. 3. Writes ``HERMES_DASHBOARD_OAUTH_CLIENT_ID`` and (if absent) ``HERMES_DASHBOARD_PORTAL_URL`` into ``~/.hermes/.env`` idempotently. 4. Prints a post-register hint explaining that the OAuth gate only engages on a non-loopback bind. The portal endpoint is the NAS half of this feature (POST /api/oauth/self-hosted-client). The ``agent:`` prefix is applied server-side, so this client never needs to know the namespace convention. ) annotationsN)Optional)-amberboldbravebrightcalmclevercosmiccrispdreamyeagerelectricfancygentlegoldenhappyhiddenjollykeenlivelylucidlunarmellowmerrymightynimblenoblepolishedquietquirkyrapidserenesharpshinysilentsnappysolarsprystellarsunnyswifttidyvividvibrantwittyzesty)+ albatrossantelopebadgerbeaconcometcondorcypressdolphinemberfalconferretgalaxyglacierharborheronibexjaguarkestrellanternlynxmeadownebulaocelotorchidotterpantherpetrelquasarravenreefsparrowsummittundravortexwalruswillowyarrowkeplerteslacuriehopperturinglovelacecltjtdtjtS)z?Return a human-readable ``adjective_noun`` name (Docker-style)._)randomchoice_NAME_ADJECTIVES _NAME_NOUNSP/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/dashboard_register.py_generate_dashboard_namerf<s(mm,- .a k0J/K LLrdcdt|tr!|jr|jdS ddlm}m}|dxsi}|jd}t|tr!|jr|jdSt|jdS#t$rYywxYw)uResolve the portal base URL for the registration request. Precedence: 1. ``override`` — explicit ``--portal-url`` flag or ``HERMES_DASHBOARD_PORTAL_URL`` env (used for testing against a preview/staging portal). NOTE: the access token must be valid at this portal — it's minted by whatever portal you logged into, so an override only works if the token's issuer matches (e.g. you logged into the same staging/preview portal). 2. The ``portal_base_url`` stored on the Nous login — this is the portal that issued the token, so it's the correct default target. 3. The production default. /r)DEFAULT_NOUS_PORTAL_URLget_provider_auth_statenousportal_base_urlhttps://portal.nousresearch.com) isinstancestrstriprstriphermes_cli.authrirjget Exception)overriderirjstatebases re_resolve_portal_base_urlrxAs(C X^^%5s## 1T'/52yy*+ dC TZZ\;;s# #*+22377 101sAB# B## B/.B/g.@)existing_client_idtimeoutc |jdd}i}|r||d<|r||d<|r||d<tj|jd}tj j ||dd|d d d  } tj j| | 5} tj| jj} d d d t' t(r| jds t!d| S#1swY7xYw#tjj$r} d} tj| jj}|jdxs|jdxsd} n#t$rYnwxYw| jdk(r t!d| | jdk(rt!| xsd| t!d| j| r d| z| dz| d } ~ wtjj"$r!} t!d|d| j$| d } ~ wwxYw)uPOST to the portal's self-hosted-client endpoint and return the JSON body. When ``existing_client_id`` is provided (the client_id this install persisted on a prior run), it is sent so the portal updates that existing dashboard record in place instead of minting a duplicate — this is what makes re-running ``hermes dashboard register`` idempotent. The portal falls back to creating a fresh client if the id no longer resolves to a row in the caller's org (stale/deleted), so passing it is always safe. ``name`` may be ``None`` on the idempotent update path (re-run without an explicit ``--name``): omitting it tells the portal to keep the name it already stored rather than overwriting it. It is required on the create path; the caller guarantees a value there. Raises RuntimeError with a user-facing message on any non-2xx response or transport failure. rhz/api/oauth/self-hosted-clientnamecustom_redirect_uri client_idzutf-8POSTzBearer zapplication/json) Authorizationz Content-TypeAccept)datamethodheaders)rzNerror_descriptionerroriz[Nous Portal rejected the access token (401). Try `hermes auth add nous` to re-authenticate.izBYour account is not permitted to register a self-hosted dashboard.zPortal returned HTTP z: zCould not reach Nous Portal at z6Portal returned an unexpected response (no client_id).)rqjsondumpsencodeurllibrequestRequesturlopenloadsreaddecoder HTTPErrorrsrtcode RuntimeErrorURLErrorreasonrndict) access_tokenrlr|r}ryrzurlbodyrreqresppayloadexcdetailerr_bodys re_register_self_hosted_clientr]sc4 # #C ( ))F GCD V &9 "#.[ ::d  " "7 +D ..  &|n5.( ! C  ^^ # #C # 9 7Tjj!3!3!56G 7B gt $GKK ,DSTT NG 7 7 << ! ! zz#((*"3"3"56H 01<<(      88s?A  88s?XW #CHH: . &F8} 0  ,. 0   << -o->b M  sb;!D2DDD  DH>-G=0AF  G= FG=FA'G== H>H99H>r) public_urlcZddlm}|}|}ttd|dtdt|z|rtdt|z|rtdt|zttdt|rC dd lm}||j xsd } td td | d tdn!tdtdtdttdtd|dy#t$rd } YywxYw)z7Print the success summary + the gate-engagement caveat.r) get_env_pathz Wrote to :z% HERMES_DASHBOARD_OAUTH_CLIENT_ID=z HERMES_DASHBOARD_PORTAL_URL=z HERMES_DASHBOARD_PUBLIC_URL=u Heads up — Nous login only *engages* on a non-loopback bind. A plain `hermes dashboard` (localhost) leaves the gate off and serves locally without auth, which is fine for your own machine.urlparsez your-hostzB To require Nous login on your registered host, run the dashboardz2 bound publicly (it must be reachable at https://z ) and log inz at its /login page.zE To require Nous login (e.g. exposing on your LAN or a public host):z# hermes dashboard --host 0.0.0.0u0 …then log in at the dashboard's /login page.zI If the dashboard is already running, restart it to pick up the new env.z% Manage or revoke this dashboard at z/local-dashboardsN)hermes_cli.configrprintro urllib.parserhostnamert) r~rlr}wrote_portal_urlrrenv_path_cidrhosts re_print_post_register_hintrs/~H D G Kz #$ 1CI => 033GGH 03z?BC G  >  G  -/099H[D RS B4& UV %& UV 34 @A G S //@@QR D sD D*)D*c|ddlm}m}ddlm}m}m}|r tdtjd |}t|d d xstjjd }tt!|t"xr|j%} t'|} d } |d} t!| t"r| j%xsd } nd } t|dd } | r| } n| rd } n t)} t|dd } t+| | || }t#d}t#|jdxs| xsd}t| xr|| k(}|rtd|dntd|d |d|d}d}d } |d }| r|| k7}n| xr| j/d|k7}|r |d | d}d}d}|rD ddlm}||}|j4dvr'|j6r|j4d|j6}|rd } |d }||k7r |d |d}t9|| |||r|!y d!y #|$rR}t|ddrtdtd ntd |tjdYd }~Ud }~wt$r.}td |tjdYd }~d }~wwxYw#t$rd } Y1wxYw#t,$r.}td|tjdYd }~d }~wwxYw#t$r<}td|td|tjdYd }~d }~wwxYw#t$rd }YwxYw#t$rYwxYw#t$rd}YwxYw#t$rd }YwxYw#t$rYwxYw)"z?Register a self-hosted dashboard OAuth client with Nous Portal.r) AuthErrorresolve_nous_access_token) get_env_value is_managedsave_env_valueu✗ `hermes dashboard register` is not available in a managed/hosted install. The dashboard OAuth client is provisioned by the hosting platform.relogin_requiredFu'✗ You're not logged into Nous Portal.zC Run `hermes setup` (or `hermes auth add nous`) first, then retry.u2✗ Could not resolve a Nous Portal access token: N portal_urlHERMES_DASHBOARD_PORTAL_URL HERMES_DASHBOARD_OAUTH_CLIENT_IDr| redirect_uri)rrlr|r}ryu✗ Registration failed: r~ru✓ Updated dashboard ""u✓ Registered dashboard "u>✗ Failed to write HERMES_DASHBOARD_OAUTH_CLIENT_ID to .env: z5 Set it manually: HERMES_DASHBOARD_OAUTH_CLIENT_ID=rmrhTr)httphttpsz://HERMES_DASHBOARD_PUBLIC_URL)r~rlr}rr)rrrrrrrrrsysexitgetattrrtosenvironrsboolrnrorprxrfrrrqrrschemenetlocr)argsrrrrrrrportal_overridecustom_portal_suppliedrlry explicit_namer|r}resultr~registered_nameupdated_existingrdefault_portalexisting_portalshould_write_portalwrote_public_urlrrparsedexisting_public_urls recmd_dashboard_registerrs&DKK |  S   02 *dL$72::>>%<O"?C(D_-B-B-D/?O"*+MN$c*/557?4!D&$/M  ')!$= -%+ 31  F;'(I&**V,::;O>y,>> ''8:; *?*;1=>99E$6NO'(EF-@  QO$:$:3$?>$Q   8/ J# ,J  -12F}} 11fmm & c&--A " '"/0M"N  * , rs0#  M 1D)-SSS  S ' S & SS Sx 000' 0  0  0 0fErd