`gj< UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZddlmZddlmZddlmZmZmZdd lmZdd lmZmZej8eZd Zd Z d ede dZ!dZ"d8dZ#e dGddZ$dZ%dZ&dZ'dZ(dZ)d9dZ* d: d;dZ+e GddZ,iZ-de.d <ej^Z0dd$Z3ddddd% d?d&Z4d'Z5d@d(Z6d)d* dAd+Z7dddddd)d, dBd-Z8e Gd.d/Z9e9Z:ej^Z;dadEdFd4Z?ddd5d)d6 dGd7Z@y)HuBrowser sign-in flow for the Honcho memory provider — no CLI step. ``begin_authorization`` / ``complete_authorization`` are the transport-agnostic core: the code can arrive via the loopback listener here or a future ``hermes://`` handler. Endpoints are env-overridable with local-dev defaults because ``/authorize`` (dashboard) and ``/oauth/token`` (API) live on different origins. ) annotationsN) dataclass)BaseHTTPRequestHandler HTTPServerPath)Callable)parse_qs urlencodeurlparse)oauth)resolve_active_hostresolve_config_path 127.0.0.1i="http://: /callbackiXcddlm}|t|} dt|j|j zS#t $r|j cYSwxYw)u%Home-relative display string for the consent screen. The absolute path (username + home layout) never leaves the machine — it's only shown to the user. Collapse ``$HOME`` to ``~``; for a path outside home, send the bare filename rather than leak an arbitrary absolute path. rrz~/)pathlibrstr relative_tohome ValueErrorname)path_Pathps S/root/.hermes/venv/lib/python3.12/site-packages/plugins/memory/honcho/oauth_flow.py_display_config_pathr)sQ& c$iAc!-- 5666 vv s*AAAT)frozenc:eZdZUdZded<ded<ded<ded<y)OAuthEndpointsz7Resolved authorization-server URLs and client identity.r authorize_url token_url client_idscopeN)__name__ __module__ __qualname____doc____annotations__rr"r"9sANN Jr-r"zhttps://app.honcho.devz"https://api.honcho.dev/oauth/tokenzhttp://localhost:3000z!http://localhost:8000/oauth/tokenz hermes-agentcFtxrtfddDS)Nc3&K|]}|v ywNr,).0hurls r z#_is_loopback_url..PsQ!Q#XQs) localhostrz::1)boolany)r3s`r_is_loopback_urlr8Os 9 QQ/PQQQr-c ||7 ddlm}|j}|xs |j}||n |j}|xsdj dk(xs t|}|rtnt}|rtnt}|r|s|jdd}tjjd|jd}t!tjjd |d tjjd |tjjd t"tjjd dS#t $r |xsd}Y'wxYw)uResolve OAuth endpoints, zero-config by default. Keys off the host's honcho ``environment`` (production → cloud, local → localhost); a self-hosted ``base_url`` derives the token endpoint from the API host. Env vars override every field for unusual deployments. rHonchoClientConfig productionlocal/z /oauth/tokenHONCHO_OAUTH_DASHBOARDHONCHO_OAUTH_AUTHORIZE_URLz /authorizeHONCHO_OAUTH_TOKEN_URLHONCHO_OAUTH_CLIENT_IDHONCHO_OAUTH_SCOPEwrite)r#r$r%r&)plugins.memory.honcho.clientr;from_global_config environmentbase_url Exceptionlowerr8_LOCAL_DASHBOARD_CLOUD_DASHBOARD_LOCAL_TOKEN_URL_CLOUD_TOKEN_URLrstriposenvirongetr"_DEFAULT_CLIENT_ID)rHrIr;cfgis_localdefault_dashboard default_token dashboards rresolve_endpointsrZSs9h. 6 G$779C%8K#+#7xS\\H!r((*g5S9I(9SH,4(:J(0$6FM#??3/0 =  79JKRRSVWI jjnn%Ai[PZC[\**..!9=I**..!9;MNjjnn17;   6%5K 6s6EE$#E$c,eZdZUded<ded<ded<y)_Pendingrverifier redirect_urifloat created_atN)r'r(r)r+r,r-rr\r\vsMr-r\zdict[str, _Pending]_pendingctjd}tjt j |j jjdj}||fS)zDReturn (verifier, S256 challenge) for an authorization-code request.@=) secrets token_urlsafebase64urlsafe_b64encodehashlibsha256encodedigestrPdecode)r] challenges r_pkceros[$$R(H  0A!B!I!I!KL   Y r-ctjDcgc]\}}||jz tkDs| }}}|D]}tj |dycc}}wr0)raitemsr`_PENDING_TTL_SECONDSpop)nowsrexpiredstates r_prune_pendingrxsT%^^-[TQq||1CFZ1Zq[G[" UD!"\s AA)source config_pathrtc||tjn|}t\}}tjd}t5t |t |||t|<ddd|j||j|dd|d}|r||d<|r||d<|jd t||fS#1swYQxYw) aStart an authorization: return ``(authorize_url, state)`` and stash PKCE. ``source`` tags the authorize link with the initiating surface (``hermes-desktop`` / ``hermes-cli``) so the consent side can attribute connects and vary behavior per surface. ``config_path`` is a home-relative *display* string for the consent screen (never the absolute path); callers pass the actual write path separately to ``complete_authorization``. N )r]r^r`S256code)r%r^r&code_challengecode_challenge_method response_typerwryrz?) timerorerf _pending_lockrxr\rar%r&r#r ) endpointsr^ryrzrtr]rnrwparamss rbegin_authorizationrs $))+#C'Hi  ! !" %E as"H<\_`a(($#!'F!x +}%% &a &(9': ;U BB!aas !B22B;)rzhost apply_configrtc t5tj|d}ddd tdt j |j d|j||j|jdtj}|xs t} |xs t} t j| | ||j|j ||} ddlm} | t j#d| | S#1swYxYw) uExchange ``code`` for a grant and persist it. Raises on bad state/exchange. ``apply_config=False`` stores the tokens only, skipping the grant's config block — the CLI path, where settings stay wizard-owned. Nz&unknown or expired authorization stateauthorization_code) grant_typer%r~r^ code_verifier)r%token_endpointrrtr)reset_honcho_clientz(Honcho OAuth grant installed for host %s)rrarsrr _http_post_formr$r%r^r]_REFRESH_TIMEOUT_SECONDSrr install_grantrFrloggerinfo) rr~rwrzrrrtpendinggrantr target_hostcredrs rcomplete_authorizationrs ,,,ud+,ABB  ! !.",,#00$--   && E  /-/D/-/K     %% **!  DA KK:KH KC,,s C77Ds+Honcho connected
Connected to Honcho. You can close this tab and return to Hermes.
ciGfddt} tttf|}|fS#t$rttdf|}Y|fSwxYw)uSBind the one-shot callback server, returning it and its capture dict. Prefers :8765; if that's taken, falls back to an OS-assigned port. groudon's redirect matcher relaxes the port for loopback hosts, so the fallback still matches the seeded ``127.0.0.1`` redirect URI — the caller advertises the actual bound port. ceZdZfdZdZy)'_bind_loopback_server.._Handlerct|j}|jdk7r"|jd|jyt |j }|j dxsdgdd<|j dxsdgdd<|j dxsdgdd<|jd|jd d |j|jjty) Nrir~r=rrwerrorz Content-Typeztext/html; charset=utf-8) r r send_response end_headersr queryrS send_headerwfilerE_CALLBACK_HTML)selfparsedrcaptureds rdo_GETz._bind_loopback_server.._Handler.do_GETsdii(F{{k)""3'  "fll+F & 6 2 :rdA>HV !'G!4!<a @HW !'G!4!<a @HW    s #   ^-G H     JJ  ^ ,r-cyr0r,)rargss r log_messagez3_bind_loopback_server.._Handler.log_messages r-N)r'r(r)rr)rsr_Handlerrs  - r-rr)rr LOOPBACK_HOST LOOPBACK_PORTOSError)rserverrs @r_bind_loopback_serverrsg "H)&:]M:HE 8  :]A.9 8 :s0AAgr@timeoutc||_ tj|z}d|vrCtj|kr,|jd|vrtj|kr,|j |j drt d|dd|vr td|d|j ddfS#|j wxYw)zServe a single ``/callback`` GET on ``server`` and return ``(code, state)``. Replies with a close-this-tab page, then stops. Raises ``TimeoutError`` if no callback arrives within ``timeout``. r~rzauthorization denied: z)no OAuth callback received before timeoutrwr=)rr monotonichandle_request server_closerSr TimeoutError)rrrdeadlines rcapture_loopback_codersFN>>#g-H$)9H)D  ! ! #H$)9H)D ||G1(72C1DEFF XFGG F X\\'26 66 s AB??C)rzrryropen_urlrct\}}dtd|jdd}t} |xs t } t | ||t | \} ddl} | jtjfdd } | jt||| \}}|| k7r td t| ||| || S)uTDrive the full loopback flow: open browser → capture code → exchange → persist. ``open_url`` defaults to the system browser; tests inject a driver that follows the authorize redirect into the loopback callback. It always receives the authorize URL, so a CLI caller can also print it for browserless environments. rrr)ryrzNrcSr0r,)r#rsrz(authorize_via_loopback..Ss Xm-Dr-T)targetdaemonru0OAuth state mismatch — possible CSRF, aborting)rzrr)rrserver_addressrZrrr webbrowseropen threadingThreadstartrrr)rzrryrrrrrr^rrrwropenerr~returned_stater#s ` @rauthorize_via_loopbackr1s$-.FH]O1V-B-B1-E,FiPL!#I  /-/D.<t j r*tjtjdcdddSd\t_t_dddd fd }tj|ddat jtS#1swYHxYw) uLaunch the loopback flow in a daemon thread; returns the initial status. Idempotent while a flow is pending — a second call is a no-op so a double-clicked button can't open two browser tabs / bind :8765 twice. rrN)rzwaiting for browser consentc ttddy#t$r5}tj d|tdt |Yd}~yd}~wwxYw)NrrzHoncho connectedz%Honcho OAuth loopback flow failed: %sr)rrrJrwarningr)excrzrryrs r_runz,start_loopback_flow_background.._runsR + "{f^e f  %7 8 + NNBC H S * * +s A+AAzhoncho-oauth-loopbackT)rrr)returnNone) rrrrrwris_aliverrrrr)rzrryrrs```` rstart_loopback_flow_backgroundrs6!4!6K  (&(D Q ==I %,<;P;P;R$]]gnnEQQ)Q% w~Q ++##46MVZ[L  QQsAC?CC&)robjectrr)r3 str | Nonerr6)NN)rHrrIrrr")rtuple[str, str])rtr_rr) rr"r^rryrrzrrt float | Nonerr)rr"r~rrwrrz Path | Nonerrrr6rtrroauth.OAuthCredential)rz!tuple[HTTPServer, dict[str, str]])rrrdict[str, str]rr_rr)rzrrrryrrr6rzCallable[[str], None] | Nonerr_rr)rztuple[bool, str | None])rzdict[str, object])r=)rwrrrrr) rzrrrryrrr_rr)Ar* __future__rrgriloggingrQrerr dataclassesr http.serverrrrrtypingr urllib.parser r r plugins.memory.honchor rFrr getLoggerr'rrrLOOPBACK_REDIRECT_URIrrrr"rMrOrLrNrTr8rZr\rar+Lockrrorxrrrrrrrrrrrrrrr,r-rrs#   !:66'Q   8 $  !-- J   $,7*6 $R <@  .8  F   !# "  ".#C" #C#C#C  #C  #C  #C#CV $00 0 0  0  00 00hT!JGL7 7"07>C776 $-1// /  /  / + ///n   ,y~~ (, %,  T6 $"          r-