߲jUdZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZmZmZmZmZmZmZddlmZmZmZmZmZmZmZmZmZmZm Z ddl!m"Z"erdd l#m$Z$ejJd Z&d Z'd Z(d Z)dLdZ*dMdZ+dNdZ,dOdZ-dPdZ.dLdZ/ dQdZ0dRdZ1dddSdZ2 dT dUdZ3 dVddd dWdZ4 dT dXdZ5dddd dYdZ6d Z7dZd!Z8d[d"Z9d\d#Z:d$Z;Gd%d&e jxZ=d]d'Z>d^d(Z?d_d)Z@d`d*ZAd+d, dad-ZBdbd.ZCdcd/ZDddedd0 ddd1ZEded2ZFdfd3ZGd4ZHiZId5eJd6<ejZLdgd7ZMdhd8ZNdeHd9 did:ZOeHd; djd<ZPdkd=ZQdTdld>ZRdmd?ZSdnd@ZTdodAZUdLdBZVddCdpdDZWdEdFdqdGZXdrdHZY dsdIZZ dtdJZ[dudKZ\y)vaOpenAI Codex OAuth: token store, refresh, quota probe, device-code login. Tokens live in ~/.hermes/auth.json, NOT ~/.codex/: Hermes keeps its own Codex OAuth session separate from the Codex CLI / VS Code extension so one app's refresh-token rotation cannot invalidate the other's session. Split out of ``hermes_cli/auth.py``; origin helpers are imported lazily inside each function so ``hermes_cli.auth.`` patches still intercept (and no import cycle). ) annotationsN)suppress)Path) TYPE_CHECKINGAnyDictIteratorListOptionalTuple) _decode_jwt_claimsAUTH_LOCK_TIMEOUT_SECONDS AuthError'CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDSCODEX_OAUTH_CLIENT_IDCODEX_OAUTH_TOKEN_URLCODEX_OAUTH_USER_AGENTCODEX_RATE_LIMITED_CODEDEFAULT_CODEX_BASE_URL _codex_errhttpx) env_float)ProviderConfigzhermes_cli.authzGCodex auth is missing access_token. Run `{relogin}` to re-authenticate.zHCodex auth is missing refresh_token. Run `{relogin}` to re-authenticate.z=No Codex credentials stored. Run `{relogin}` to authenticate.cddlm}|dS)Nroauth_relogin_command openai-codex)agent.turn_failure_copyrrs :/home/ubuntu/.hermes/hermes-agent/hermes_cli/auth_codex.py_codex_relogin_commandr )s=  00c<ddlm}||}|dSt|S)zABest-effort parse of a ``Retry-After`` header into whole seconds.r)parse_retry_after_secondsN)agent.retry_utilsr#int)headersr#secondss r_parse_retry_after_secondsr(/s";'0G?44G 4r!c<t|xsdjS)N)strstrip)values r _strippedr.6s u{  ! ! ##r!c(ddlm}|D]}d||< y)z?Reset a pool entry's cooldown / last-error metadata to healthy.r)_POOL_STATUS_FIELDSN)hermes_cli.authr0)entryr0 status_fields r_clear_pool_entry_statusr4:s3+# "l#r!ct|jd}t|ttfxr6t |t j t dt|zkS)Nexpr)r get isinstancer%floattimemax) access_token skew_secondsr6s r_codex_access_token_is_expiringr>AsO \ * . .u 5C cC< ( dU3ZDIIK#aQTUaQbJcd  < .1W<7>-'8  ,n %2E/ " $0E. ! ' (r!F) set_active write_throughc"ddlm}m}m}m}m} m} m} || }|d5\} } }| r t| ni} t| jdtr| jdnd}| j||d|r5t|jrt|j| d<| d}}|r||||s |||d }}}| |d| | t|||| | || dddy#1swYyxYw) uSave Codex OAuth tokens to the auth store the grant was resolved FROM. Codex refresh tokens are single-use with rotation-family reuse detection. A profile without its own ``providers.openai-codex`` block reads root's grant via the fallback, so a refresh under that profile must rotate ROOT's chain — singleton AND ``credential_pool`` entries — or root keeps the consumed refresh token, the next process replays it and OpenAI revokes the whole family (#87503). Root-only write-back: a profile copy would shadow root and disable the write-through on the next refresh (#74339). Mirrors the xAI source-aware save. Only a token REFRESH passes ``write_through=True``: a fresh login or import under a profile is the profile's own grant and must not overwrite the root account it was borrowing. ``set_active=False`` stores credentials for a side tool (image gen) without making Codex the active inference provider. r)_auth_file_pathrR_provider_state_transaction _same_path_save_auth_store_store_provider_state _utc_now_zNrr]rH)r]rMrNlabelF)rv)rq target_path)r1ryrRrzr{r|r}r~rfr8r7updater+r,ru)r]rMrrvrwryrRrzr{r|r}r~rirj source_pathrq target_storers r_save_codex_tokensrs$===!| $^ 4@8XUK$U "$.eii.A4#HEIIh d " F S SZ%%' Z--/E'N$.k [4Z UdUf=g5E[4QS^`ez+LlNEjY &,Jc e;?#@@@s CDDcddlm}ddlm}ddlm}m}m}|sy|}|r4t|jdrt|jdsyt|xsd}|d5\} } } | xsijd } t| tr| ni} t| jdxsd|k7r tjd | dddy||} | r8||dd| fvr)tjd |t dddytjd |||dddt|S#1swYt|SxYw) awAdopt a valid Codex CLI token pair into Hermes auth, if available. Automatic adoption only; the interactive import offer in ``_login_openai_codex`` asks first and is not subject to ``auth.adopt_external_logins``. ``observed_access_token`` is the singleton access_token (or None) the caller saw when it decided the credential needs repair. Recovery repairs THAT credential and nothing else (#73667): a Codex Desktop/CLI login into another ChatGPT workspace must not replace it silently, and a concurrent explicit re-auth must not be overwritten, so the save is a compare-and-swap under the store lock. r)_codex_principal_identity)adopt_external_logins_enabled)_import_codex_cli_tokensrzrNr<rarr]zOCodex CLI recovery skipped (%s): the credential was re-authenticated meanwhile.zCodex CLI recovery refused (%s): the Codex CLI login belongs to a different ChatGPT workspace than the Hermes credential. Run `%s` to re-authenticate it.z3Codex auth recovered from Codex CLI auth.json (%s).)agent.credential_poolragent.credential_sourcesrr1rrzrr.r7r8rfloggerinfowarningr )reasonobserved_access_tokenrrrrzrimportedobserved_storerj_sourcestoredknowns r_recover_codex_tokens_from_clirs[@Fii ( *')H 8<<#?@(,,78./74H $^ 4%8P+2""8,%fd3 fjj0 1 9Th F KKikq r %% *(3 .x/GHQUW\P]] NNX.0 2%%  I6R8$% >% >s4A&E#9E%EE))relogin_requiredinvalid_json_relogin strict_strcp|fdfd } |j} t| ts |||i} | j d} |r#t| t r| jnd} n t| } | s||| | fS#t$r,} ||n|} ||dj| |d| | d} ~ wwxYw) aFParse a 200 token-refresh response; return ``(payload, stripped access_token)``. Each ``(message, code)`` pair keeps the provider's historical wording; ``{exc}`` in *invalid_json*'s message is formatted with the JSON error. *strict_str* rejects non-string access tokens; otherwise they are ``str()``-coerced. c"t|||S)N)rIcoder)r)messagerr[rIs r_errz+_refresh_payload_access_token.._errs8$QXYYr!Nr)excr<r*)rr+rr+r[rpreturnr) json Exceptionrer8rfr7r+r,r.) responserI invalid_jsoninvalid_responsemissing_accessrrrrpayloadrr[accesss ` r_refresh_payload_access_tokenrs7GZW--/ gt $  '() ) [[ (F#-fc#:6" N## F? W&:&B"H\<?))c)2LOWMSVVWsB B5 'B00B5)z[SSL:z_ssl.cUNEXPECTED_EOFclddl||j|jf}tfd|Dsy y)u<Actionable hint for device-login transport errors that look like TLS middlebox interference. OpenSSL 3.5+ advertises post-quantum hybrid groups (e.g. X25519MLKEM768) by default, and some intercepting middleboxes reject the resulting larger TLS 1.3 ClientHello — while curl, using a different TLS stack, still works, so the failure masquerades as a Codex outage (#106384). httpx wraps the ``ssl.SSLError`` in a ``ConnectError``/``ConnectTimeout`` whose text usually repeats the OpenSSL message; the cause chain is checked too in case it doesn't. rNc3K|]62tjxstfdtD8yw)Nc38K|]}|tvywN)r+).0markererrs r z._ssl_interop_hint...s,cFVs3x-?,cs)r8SSLErrorany_SSL_TROUBLE_MARKERS)rrssls @rrz$_ssl_interop_hint..s< CO 3 %c,cNb,c)ccs r!rc$t||_y)ashttpx response hook: refuse to buffer an auth body above ``_CODEX_AUTH_BODY_MAX_BYTES``. Runs before ``client.post()`` reads the body, so a hostile or broken endpoint/proxy answering 200 with megabytes of "JSON" is cut off at the cap instead of being fully buffered and parsed (#55253). Same cap for every status: error bodies are small diagnostics too. N)rr)rs r_cap_codex_response_bodyrns(1HOr!c tjdddtgii|}tt5ddlm}||ddd|S#1swY|SxYw)aBuild an ``httpx.Client`` for Codex OAuth/probe endpoints with Happy-Eyeballs racing and a 1 MiB response-body cap (``_cap_codex_response_body``). A host advertising AAAA records but blackholing IPv6 makes each serial connect eat the full timeout before IPv4 is tried (same failure mode as the chat transport). Best-effort: if the racing backend can't be installed (mocked client in tests), serial connect behavior remains. Same broken-IPv6 failure mode as the chat transport (#13834): a host that advertises AAAA records but blackholes IPv6 makes each serial connect attempt eat the full connect timeout before IPv4 is tried, so token refresh / device login / usage probes time out where the official Codex CLI (which races families per RFC 8305) works. event_hooksrr)enable_happy_eyeballs_on_clientNrE)rClientrrragent.process_bootstrapr)rrrs rrrxsU\\ Yz4L3M&N YRX YF ) 0K'/0 M0 Ms AAc:|d|dnd}t|tdS)Nz2Codex provider quota exhausted (429); retry after zs. Credentials are still valid.zfCodex provider quota exhausted (429). Credentials are still valid; retry after the usage limit resets.FrZ)rr) retry_afterrs r_codex_quota_exhausted_errorrs:  " =[MJ' ' .  g6 FFr!cddlm}d}d|jd} |j}t |t r|j d}t |t ri|j dxs|j d}||r|j}|j d }||rkd |j}nW||rO|j}|j d xs|j d }||rd |j}|d k(rd td}|dvxs|jdv} t||| S#t$rY@wxYw)zFDecode a non-200 Codex token-refresh response into a shaped AuthError.r)rYcodex_refresh_failedz'Codex token refresh failed with status .errorrtyperzCodex token refresh failed: error_descriptionrefresh_token_reusedzCodex refresh token was already consumed by another client (e.g. Codex CLI or VS Code extension). Run `codex` in your terminal to generate fresh tokens, then run `r^> invalid_grant invalid_tokeninvalid_requestr>rZ) r1rY status_coderr8rfr7r,rr r) rrYrrrerr_obj nested_code nested_msgerr_descrs r_codex_refresh_failure_errorr sm- !D78L8L7MQOG mmo c4 ggg&G'4(%kk&1HW[[5H  -&,,.D$[[3  , >    sDE EEg4@timeout_secondsc ddlm}m}~||s*ttj t ddttjtdt|dtd 5}|jtd d id |td }dddj dk(rt#t%t'|dd|j dk7r t)|t+|dddd\}}||j-|d} |j/d } || r| j-| d <| S#1swYxYw)z>Refresh Codex OAuth tokens without mutating Hermes auth state.r)rYr~rZrbT@application/json)Accept User-Agent)rr& Content-Type!application/x-www-form-urlencodedra) grant_typera client_id)r&dataNr&r)z*Codex token refresh returned invalid JSON.codex_refresh_invalid_json)z6Codex token refresh response was missing access_token."codex_refresh_missing_access_token)rIrrr)r<rarM)r1rYr~rrhrer rrrr;r9rrrrrrr(getattrr rr,r7) r<rar rYr~rrrefresh_payloadrefreshed_accessupdated next_refreshs rrefresh_codex_oauth_purers`:  '3::CYC[:\;TK K  c#u_'=>?-=ST V5Y_;; !N<_+`- 2455s"+ &wxD'I JL Ls"*844(E>Da2)3%O%)=;N;N;P" &G#&&7L\"#/#5#5#7 N755s 6#EE c \ddlm}m}m}t t t t |dz}|d|5\}}}|xsijd} t| tr| ni} t| jdt| jd} } | rF| rD| t|jdk7r'tjdi|| | d cd d d S |t|jdd xsd t|jdd xsd | } i|| d| dd }||dd d d |S#t$rI} t| d dst!dt| dd xsd| xsd }|s|cYd } ~ cd d d Sd } ~ wwxYw#1swYSxYw)aRefresh Codex access token using the refresh token. The whole re-read -> endpoint POST -> write-back runs inside the SOURCE store's transaction: two profiles borrowing the same root grant otherwise both submit the same single-use refresh token (each holds only its own profile lock) and OpenAI revokes the family. A waiter that finds root already rotated by its peer adopts the stored pair instead of replaying the consumed token. Both locks wait out a full endpoint timeout so the waiter adopts, not times out. r)rzrrr rr]r<rauKCodex refresh token already rotated by a peer — adopting the stored pair.r<raNr*r rFzrefresh_token rejected: r auth_errorrT)rw)r1rzrrr;r9rr7r8rfr.rrr+rrr)r]r rzrr lock_timeoutrrjrr stored_at stored_rt refreshedrrupdated_tokenss r_refresh_codex_auth_tokensr)sjiu679ORU9UVL $^\ B?F^vuV]+2""8,%fd3(N)CDiPVPZPZ[jPkFl9 yIfjj>Y4Z'Z KKe fTfTi)T ?? 0FJJ~r28b93vzz/[]?^?dbd;e /1I$99&/&?&79 >>=?> ) 3 2E:5*73+E+U*VW&/&749HO3?? ?> s=B F!$AE )F! F5F F F!FF!!F+c>ddlm}tjddj xs t t jdz }t |jdz }|jsy tj|jd jd }t|tr"|jd r|jd sy||d drt j#d |yt|S#t$$rYywxYw)zWRead ~/.codex/auth.json (Codex CLI file) tokens if valid and not expired; never writes.r)r> CODEX_HOMEr*z.codexz auth.jsonNz utf-8-sig)encodingr]r<rau7Codex CLI tokens at %s are expired — skipping import.)r1r>rBrCr,r+rhome expanduseris_filerloads read_textr7r8rfrdebugr)r> codex_home auth_pathr]s rrrs?<,224SDIIK(jAtCddt|d}tE|jd }tGdd}dfd }||rtIt7tJ|dz}||5|d}t|d}|tE|jd r tM||}tE|jd }dddt)|d|jd S#1swY:xYw#t$rc} | }sT| jrH| jd vr:tt| jxsd | }|r||jd d}Yd} ~ d} ~ wwxYw#1swYxYw) uResolve runtime credentials from Hermes's own Codex token store. ``read_only=True`` (status / doctor / pickers) reports the stored state as-is: no Codex CLI adoption, no token refresh, no auth-store write — and it wins over ``force_refresh``. A diagnostic that silently imports another program's rotating refresh token or spends one is a mutation the user never asked for (#68004). Falls back to the credential pool when the singleton (``providers.openai-codex.tokens``) has no usable access_token but the pool (``credential_pool.openai-codex``) does. This closes the divergence between the chat path (singleton-only via this function) and the auxiliary path (pool-first via ``_read_codex_access_token``). Without this fallback, a user whose tokens live only in the pool — for example after a manual pool seed, a partial re-auth, or pool-only restoration from a backup — gets a bare HTTP 401 ``Missing Authentication header`` from the wire instead of a usable credential. See issue #32992. r)rQr>_probe_codex_quota_restoredrkNFrU)rRrXrr]r<>r_r`rbr"r#rMrc) load_pool) api_key_hintr*credential_pool)rLrMuBCodex quota restored upstream — clearing stale pool cooldown(s).reset_atrZr\T$HERMES_CODEX_REFRESH_TIMEOUT_SECONDSc>rytxs xr |S)NF)rp)tokenr>r5r8r6r7s r_should_refreshz:resolve_codex_runtime_credentials.._should_refreshxs. M"b  `$CEK_$` br!r r zhermes-auth-store)rBr+rrp)'r1rQr>r:rkrRrXr7r8rfrrrrr+_pool_codex_access_tokenrr;try_refresh_matchingruntime_api_keyrO_codex_pool_rate_limit_status&_probe_codex_pool_entry_quota_restoredrr clear_codex_pool_quota_cooldownsr%r9r:rrrdrer r.rr;rr))r5r6r7r8rQr:rk read_errorrrrRrXrawrr pool_tokenr;r'pool_rate_limitr> in_futurer]r<refresh_timeout_secondsrCr$r>s```` @r!resolve_codex_runtime_credentialsrP&s&('+J D"HZ &E2D!# 7S+,<,>OUSUZZ[cd6@d6K377>2QU)6  7  |-/ - 7!.1FFT^F_I6?6K22QSJ (.sMqH}M) rate_limit usage_limitquotac3&K|]}|v ywrrE)rrS message_ls rrz._is_codex_rate_limit_shaped..sN!qI~NrU)z rate limitz usage limitrX)r+lowerr)rrrrZrTs @@r_is_codex_rate_limit_shapedr\sjfl+113SB5G5M5M5OHi   O M&LM M O N'MN NPr!c|jddk(xr:t|jd|jd|jdS)zFPool entry frozen by a 429/quota stop (as opposed to an auth failure). last_status exhaustedlast_error_codelast_error_reasonlast_error_message)r7r\)r2s r_entry_is_rate_limit_exhaustedrcsK 99] #{ 2 )7R #$eii0C&D &'8))r!i,z'Dict[str, Tuple[float, Optional[bool]]]_codex_quota_probe_cachecltj|jdjddS)Nzutf-8)hashlibsha256encode hexdigest)rBs r_codex_quota_probe_cache_keyrks* >>%,,w/ 0 : : t)|xsdt'|}X_||dk} n| jdk(rd} t5|| f||<ddd| S#1swYjxYw#1swY,xYwcc}w#t*$rt,j/ddd} Y[wxYw#1swY| SxYw)zAsk the Codex usage endpoint whether this account's quota is usable again. Probes are throttled per access token (module-local cache) so the hot selection path can fire this freely. r)rdrYNr)codex_account_headerszBearer rz codex-cli) Authorizationrrg$@r)r&rrVadditional_rate_limits)primary_windowsecondary_window used_percentggY@rFzCodex quota probe failedTexc_info)r1rdrYr.r rkr: monotonic_codex_quota_probe_lockr7agent.codex_headersrsrrprrr8rfr%r9r;rrr2)r<rJrqrdrYrB cache_keynowcachedresultrsr&rrrextrawindows worst_usedrVkeyuseds rr:r:snH l #E *51,U3I .. C :)--i8  3?6J"J!9:: 03Dk + : "F=&ug.:L%G)>u)EG  - Uzz"8"BGzTH U   3 &mmo+G{{<06B7%kk*BCIr;,eT* ,'-2-;,,G+/J% I AIC&NN3/52::>JD!$e 5%():sE$K%H I I %#e+  ! !S (F !rkr:r{r|r7rrrr2) r<rarqrdrBrefreshr~rrs r"_refresh_expired_codex_probe_tokenrs$9|,i .F7E 'Fua'P,U3I .. C )--i8  3?6J"J'w77   ;d K $ >36+ $Y / > > s6 B BB&C#C C#C C#C#cddlm}m}m}t |j d}t ||j d}|ru|d} |5|}tt|dD]@}|j d|j dk(s'|j|||nddd|syt||j d  S#1swY(xYw#t$rtjdd YMwxYw) z^``_probe_codex_quota_restored`` for a persisted pool entry, refreshing an expired token first.rrQrRr|r<rarrNz-Failed to persist refreshed Codex pool tokensTryrJ)rJ)r1rQrRr|r.r7rrornrrrr2r:)r2rQrRr|rBfreshri disk_entrys rrHrHsTT eii/ 0E .ueii6P QE n% Y!# -/ "3M*n4]"^J!~~d+uyy>"))%0(4    &uuyy7L MM   Y LLHSWL X Ys1C"ACC/C"CC"" DDcddlm}m}ddlm}m}m}d} |drdn|}||5||}tt|dD]B} |r"t| jdxsd|k7r't| s3t| |d z }D|r |||ddd|S#1swY|SxYw#t$rtjd d Y|SwxYw) aClear rate-limit cooldowns on persisted openai-codex pool entries. Called after the upstream quota is KNOWN to be restored (a ``/usage reset`` redemption or a positive live probe) so auth.json stops freezing credentials behind a stale ``last_error_reset_at``. With *access_token* only the matching entry clears; otherwise every rate-limited entry does (a redeemed banked reset restores the whole account; a still-exhausted entry just re-freezes with fresh metadata on its next 429). r)_borrowed_single_use_pool_root_profile_owns_pool_providerrrNrr<r*rz*Failed to clear Codex pool quota cooldownsTry)rrrr1rQrRr|rornr+r7rcr4rrr2) r<rrrQrRr|clearedtargetrir2s rrIrI(sbTTGR5^DJhJj & 1 A)&1J*=^+TU !C .(A(GR$HL$X1%8,U3qLG  !  @ A N A N R AD Q NRs5B6AB)B)B6)B3.B63B66 CCc#LK|xsdD]}t|ts|yw)NrE)r8rf)rrr2s rroroGs(B eT "Ks$$c Tddlm}m}ddlm} t j }t |dD]}|jd}||r t|s(||jd}|||kDsG|jd|jd ||jd |jd |j|jd |jd |jdd cS y#t$rtjddYywxYw)zReturn metadata for a pool-only Codex credential in quota cooldown. Reads through ``read_credential_pool`` so a named profile with no Codex rows of its own sees the global-root pool (the per-provider fallback every other pool read uses).rrYread_credential_pool_parse_absolute_timestamprr<last_error_reset_atNrrMrarbrarrJ) rrMr>rrr<rarrJz#Codex pool rate-limit lookup failedTry) r1rYrrrr:ror7rcr,rrr2)rYrrrr2rBr>s rrGrGMs D?Kiik&';N'KL 7EIIn-E '/Me/T0;P1QRH8c>"YYw/>AZ (EII>Q4R$yy)=>PUP[P[P]%*YY%?uyyQU % * 5 77 7  K :T J KsA+D >>+ ,D'1$'=dhh{#4G $/79T9r!c`ddlm}ddlm}m} t |dD]d}|j d}||j d}|duxr|tjkD}||sQ|rT|jcS y #t$rtjdd Yy wxYw) aFirst non-empty pool access_token not in an exhaustion cooldown window, else "". Fallback for ``resolve_codex_runtime_credentials`` when the singleton has no creds; reads through ``read_credential_pool`` so a profile inherits the global-root pool (#34143). rrrrr<rNz!Codex pool fallback lookup failedTryr*) rrr1rYrror7r:r,rrr2)rrYrr2rBr> in_cooldowns rrDrDns @C I&';N'KL %EIIn-E1;P1QRH"$.I8diik3IKU#K{{}$ %  I 84 H Is$A!B 2B 5B B B-,B-)force_new_logincddlm}m}m}m}m}m}m} m} ddl m } ~|s|d| |dtdry|} | ritd td |d d rI|| | dt} ttdtdtd| dyt| |}||d|jd| d|jdt} |d| dy)zOpenAI Codex login: device code by default, browser PKCE when opted in (``--browser`` / ``auth.codex_login_flow``). Tokens stored in ~/.hermes/auth.json.r)r>r!_offer_existing_oauth_credentials_print_login_success_prompt_yes_nor_update_config_for_providerrP)codex_oauth_loginrCodexz?Existing Codex credentials are expired. Starting fresh login...)resolve is_expiring display_namedefault_base_urlexpired_noticeNz:Found existing Codex CLI credentials at ~/.codex/auth.jsonzOHermes will create its own session to avoid conflicts with Codex CLI / VS Code.zCImport these credentials? (a separate login is recommended) [y/N]: n)defaultz=Credentials imported. Note: if Codex CLI refreshes its token,zrrrrrrrPhermes_cli.auth_codex_browserrrprintrFr7)argspconfigrr>rrrrrrrPr cli_tokens config_pathcredss r_login_openai_codexrsHHH@  , $E7g3\  ^ -/  N O c dU_bd":.9./J[\ UVTU*;-7UVW G d #EuX .(AB- *.DEGKdKr!r*duringcntt|dd}|d|dnd}td|d|tS)zYAuthError for a 429 from OpenAI's device-auth endpoints (throttle, not credential fault).r&Nz Try again in about zs.z' Wait a minute and run the login again.z7OpenAI is rate-limiting Codex login requests (HTTP 429)zJ. This is a temporary throttle on OpenAI's side, not a credential problem.)r(rrr)rrr wait_hints r_codex_login_rate_limited_errorrs] -WXy$-OPK2=2I {m2. 6  A&JSS\R] _ !!r!c d}td|dzD]}t|dd|iddid}|jd k7rnh||ks0tt |d d }t dt t||nd |zd }td|dtj|jd k(r t||jdk7rtd|jdd|j}t dt|jdd|d<|jddr|jdds tdd|S)uStep 1 of the Codex device flow: request a user code, retrying capped on HTTP 429. OpenAI rate-limits this request when login is attempted too often from one IP/account — retry with capped backoff (honoring ``Retry-After``) before surfacing an actionable message. rz!/api/accounts/deviceauth/usercoderrr)zFailed to request device codedevice_code_request_failed)rr&rrr&N<z:OpenAI is rate-limiting login requests (429); retrying in zs...rz$Device code request returned status rdevice_code_request_errorrinterval5 user_coder*device_auth_idz-Device code response missing required fields.device_code_incomplete)rangerrr(rr;minr%rr:rrrrr7)issuerr max_attemptsrresprdelay device_datas r_codex_request_device_codersk LL1,-  h7 8 Y?W#%78SU   s "  \ !4WT9d5STK3s+2I;qT[|\^`abE NugUYZ [ JJu   3-d33 3243C3C2DA FHce e))+K!!SS)I%JKK  ??; +;??CSUW3XHJbcc r!c Ld}d}tj}d} ttjd5}d} tj|z |krtj | |j |d||dd d i } d} | jdk(r| j}nC| jdvrtd| jdd tj|z |krddd| tdd|S#t$rd} t| std | t| d | | dz } | |k\rtd| d| t| d | tdYd} ~ 1d} ~ wwxYw#1swYxYw#t$rtdtdwxYw)zXStep 3 of the Codex device flow: poll until sign-in completes (403/404 = still pending).iNrrrz/api/accounts/deviceauth/token)rrrr)rr&z$Device auth polling request failed: device_code_poll_errorrz)Device auth polling request failed after z consecutive transport errors: z>Transient network error while waiting for sign-in; retrying...r>rz$Device auth polling returned status rz Login cancelled.z!Login timed out after 15 minutes.device_code_timeout)r:r{rrrrrrrrrrrrKeyboardInterrupt SystemExit) rrr poll_intervalmax_waitmax_consecutive_blipsstart code_resprconsecutive_blips poll_resprs r_codex_poll_authorization_codersH NN EI!  d(; < 2 ! .."U*X5 =) & !("@A0>YW!/1C D!,!FI"%&!((C/ ) 0I(( :$>y?T?T>UUVW0223.."U*X5 2B<>STT 5! 8=(B3%HYZ]H^G_`46;>?&*%(,AA(GHYGZ[2257H7M6NP46^` ` Mr!cddlm}dt}}t||}|d}t dt dt d|dt d t d|d t d t ||d ||d }t |||}|jdd|jdddt|dddS)zBRun the OpenAI device code login flow and return credentials dict.r)r~zhttps://auth.openai.comrz!To continue, follow these steps: z# 1. Open this URL in your browser:z z/codex/device z 2. Enter this code:z z/Waiting for sign-in... (press Ctrl+C to cancel)rr)rrrr<r*rar!rHz device-code)r]rJrMrNrL) r1r~rrrrrr7rF)r~rrrrrr]s r_codex_device_code_loginr's*13HIF,VY?KK(I ./ /0 M&!7 89 !" M)I ./ ;<.{+;< !*-/I0 9 MF#JJ~r:#ZZ<>$%z|R[  !!r!)rr+)r&rr Optional[int])r-rrr+)r2Dict[str, Any]rr)r<rr=r%rrp)rKr+rLr+rM Optional[str]rr)rSrprr)rVrprrr) rirr]Dict[str, str]rMrrqOptional[Dict[str, str]]rr)NN) r]rrMr+rr+rvrprwrprr)rr+rrrr)rrrIr+rTuple[str, str]rzOptional[Tuple[str, str]]rrrrprOptional[bool]rrprzTuple[Dict[str, Any], str])r BaseExceptionrr+)rrrrp)rr+rrrrrrr)rrrz'httpx.Client')rrrr)rrrr)r<r+rar+r r9rr)r]rr r9rr)rr) r5rpr6rpr7r%r8rprr)rrrrrrrrp)r2rrrp)rBr+rr+)rJrrr+)r<rrJrrqr9rr)r<rrarrqr9rOptional[Dict[str, Any]])r2rrr)r<rrr%)rrOptional[List[Any]]rzIterator[Dict[str, Any]])rr)rirrr+rr)rrrrprr)rrrr+rr)rr+rr+rr) rr+rr+rr+rr%rr)rr+rr+rrrr)rr)]r __future__rloggingrgrrB threadingr: contextlibrpathlibrtypingrrrr r r r hermes_cli.auth_constantsr rrrrrrrrrrutilsrr1r getLoggerrrgrhrdr r(r.r4r>rFrOrTrkrurrrrrrrrSyncByteStreamrrrrr rr)rrPr\rc&CODEX_QUOTA_PROBE_MIN_INTERVAL_SECONDSrd__annotations__Lockr|rkrpr:rrHrIrorGrnrDrrrrrrrEr!rrs#  LLL````.   , -fgU1 5$#e `P P P0=PBPP)-I0;?&(&((6&(FS&(7&(CG&(TDH(@5(@ (@*-(@=@(@(@,0(@ (@X=A'',9'E]'Z"$ -0@O/AP:H !; B=4"(),,42(G$?PHL##&)#?D#P^#L*Z.# GbYbY9=bYbYbY!/bYJP)*-&DFAF()..*B 59"H66$166M[6v#I""&)""Me"JN,> 4:,SX%LPRT ! @+ +$'+47+HK+P^+\ ,:?M:!r!