߲jSdZddlmZddlZddlmZmZddlmZm Z m Z m Z m Z ddl mZddlmZerddlmZmZej(eZd d Zd d Z dd Zy)uRPlugin-provider refresh support for the credential pool (#116408). A model-provider plugin makes its pooled OAuth rows refreshable by shipping ``ProviderProfile.refresh_credential(entry) -> Mapping | None``. The pool owns the locking, persistence and failure classification around that hook; the plugin owns only the token POST. This sibling module keeps that logic out of ``agent/credential_pool.py`` (near the size cap). Contract (documented in website/docs/developer-guide/model-provider-plugin.md): * the hook returns a mapping of rotated values — dataclass field names (``access_token``, ``refresh_token``, ``expires_at_ms`` …) replace the row's fields, every other key (``expires_in``, ``token_type``, ``scope`` — the natural token-endpoint shape) lands in ``entry.extra``; ``None``/empty = could not rotate and the pool benches the row like a failed refresh POST; * raising ``AuthError(..., relogin_required=True)`` (or a grant-dead OAuth code) is terminal: the row goes DEAD with a WARNING naming ``hermes auth add``; any other exception is transient and only benches the row. ) annotationsN)fieldsreplace) TYPE_CHECKINGAnyMappingOptionalTuple)_OAUTH_GRANT_DEAD_CODES) AuthError)CredentialPoolPooledCredentialc|s|St|}tt|Dchc]}|jc}ddhz }|j Dcic] \}}||vs ||}}}|j Dcic]\}}||vs |dk7s||}}}|ri|j ||d<|r t |fi|S|Scc}wcc}}wcc}}w)uMerge a ``refresh_credential`` return value into *entry*. Field names go through ``dataclasses.replace``; everything else is merged into ``extra`` (mirroring ``PooledCredential.from_dict``). Before this split a token-endpoint-shaped mapping with ``expires_in`` raised ``TypeError`` inside ``replace`` and the pool benched a row whose single-use refresh token the server had already rotated — the login was lost. providerextra)dictrtypenameitemsrr) entryresultmappingf field_nameskv field_updates extra_updatess A/home/ubuntu/.hermes/hermes-agent/agent/credential_pool_plugin.pyapply_plugin_refresh_resultr $s  !%fG#)$u+#67a1667:w:OOK&-mmoJdak9IQTJMJ&-mmobda+9MRSWaRaQTbMb!AEKK!A=!A g.;75 *M *FF 8Jbs#B< C!C< C CCc~t|tsyt|jxs|jxsdt vS)aTrue when retrying the same plugin refresh token cannot succeed. Plugins have no per-provider code table, so the predicate is the structural one every built-in flow shares: a structured ``AuthError`` that asks for a re-login, or one carrying a grant-dead OAuth code. Transport errors, 429/5xx-shaped ``RuntimeError`` and plain ``AuthError`` without that signal stay transient (EXHAUSTED for one cooldown). F) isinstancer boolrelogin_requiredcoder )excs r is_terminal_plugin_refresh_errorr(7s5 c9 % $$ % T#((.b=T)TTcddlm}|j|}|j|jk7rS|jxsdj r5t jd|jd|j|fi|fSt|r[t jd|j|jxs|jdd||j|j||y y ) usRecovery for a plugin hook that raised: adopt a peer's rotation, or quarantine a dead grant. Returns ``(handled, result)``; ``handled=False`` means the caller should bench the row as a transient failure. A peer process may have rotated the single-use token between our in-lock sync and the hook's POST — adopt that pair before classifying the failure. r)_MARK_OKr"uB%s refresh failed but the pool store has newer tokens — adoptingTz%s refresh token for %s is terminally invalid (%s); the credential leaves rotation. Re-run 'hermes auth add %s' to sign in again.N)TN)FN)agent.credential_poolr+_sync_entry_from_pool_store refresh_token access_tokenstriploggerdebugr_adoptr(warninglabelid_mark_dead_refresh_grant)poolrr'r+synceds rrecover_failed_plugin_refreshr;Ds/  - -e 4F u2228K8K8Qr7X7X7Z Y[_[h[hi[T[[48444',  < MM5;;6%((2A,T]] %%eS1 r))r'PooledCredential'rrreturnr<)r' BaseExceptionr=r$)r9z'CredentialPool'rr<r' Exceptionr=z)Tuple[bool, Optional['PooledCredential']])__doc__ __future__rlogging dataclassesrrtypingrrrr r hermes_cli.authr hermes_cli.auth_constantsr r-r r getLogger__name__r2r r(r;r)rrJsj(#'??3/F   8 $G& U #5