߲j+HUdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z mZddlmZddlmZmZmZmZmZddlmZmZddlmZmZmZmZmZm Z dd l!m"Z"ejFd Z$e%hd Z&d e'd <dZ(d*dZ)d+dZ*d*dZ+d,dZ,d-d.dZ-d/dZ. d0dZ/ d1dZ0 d2dZ1ddd3dZ2d4dZ3dddd d5dZ4 d6dZ5d7dZ6dd d! d8d"Z7 d9d#Z8 d:d$Z9d;d%Z:d d& daShared device-code / loopback-PKCE / browser / TLS helpers for interactive OAuth logins. Split out of ``hermes_cli/auth.py`` and re-exported there; origin helpers are imported lazily inside each function so ``hermes_cli.auth.`` patches still intercept (and no import cycle). ) annotationsN)BaseHTTPRequestHandler HTTPServer)Path)AnyCallableDict FrozenSetOptional)parse_qsurlparse) AuthErrorDEFAULT_NOUS_PORTAL_URL%DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDSDEVICE_CODE_GRANT_TYPEOAUTH_OVER_SSH_DOCS_URLhttpx)is_truthy_valuezhermes_cli.auth> www-browserw3mlynxlinksbrowshelinkslinks2zFrozenSet[str]_CONSOLE_BROWSER_NAMES) CLOUD_SHELL CODESPACESCODESPACE_NAMEGITPOD_WORKSPACE_IDREPL_ID STACKBLITZcttjdxs-tjdxstdtDS)u;Detect environments where loopback OAuth can't reach the local browser. Historically only SSH was checked, but #26923 surfaced that **browser-only remote consoles** (GCP Cloud Shell, GitHub Codespaces, AWS EC2 Instance Connect, Gitpod, Replit, etc.) hit the exact same problem — the user has a browser on their laptop but the loopback listener is bound on the remote VM that the laptop's browser can't reach. These environments typically don't set ``SSH_CLIENT`` / ``SSH_TTY``, so the SSH-only check left them with no guidance and no fallback. SSH_CLIENTSSH_TTYc3FK|]}tj|ywN)osgetenv).0vars @/home/ubuntu/.hermes/hermes-agent/hermes_cli/auth_device_flow.py z%_is_remote_session..<s>#ryy~>s!)boolr(r)any_REMOTE_IDE_ENV_VARSr,_is_remote_sessionr31sC  , ?299Y#7 ? >)=> > @@r2c|jr!|jjdnd}tjj |j t vS)Nr)stripsplitr(pathbasenamelowerr)valuetokens r,_names_console_browserr=?sI(- EKKM   !! $2E 77  E " ( ( *.D DDr2ctjjdd}|r t|rytj j drNttjjdxstjjd}|s|sy tj}t|ddxst|ddxsd}|xr t| S#t$rYywxYw) aReturn True only when a *graphical* browser is likely to open. On a headless Linux box ``webbrowser.open()`` often resolves to a text-mode browser that takes over the terminal. Heuristics: a ``$BROWSER`` naming a console browser refuses; on Linux a display server (``$DISPLAY`` / ``$WAYLAND_DISPLAY``) is required unless ``$BROWSER`` is set (a console one already returned False, so a set ``$BROWSER`` here is graphical). BROWSERr5FlinuxDISPLAYWAYLAND_DISPLAYnamer9) r(environgetr=sysplatform startswithr. webbrowser Exceptiongetattr) browser_env has_display controller candidates r,_can_open_graphical_browserrPDs**..B/K-k: ||w'2::>>)4Y GX8YZ ;^^%  FB/\7:zSU3V\Z\I?4Y? @@ sC!! C-,C-c ddl}|jxsd}tjdxstjdxsd}|d|S#t$rd}YDwxYw)zWBest-effort 'user@hostname' for the SSH tunnel hint; placeholders keep it valid syntax.rNz USERLOGNAMEz@)socket gethostnameOSErrorr(r))_sockethostnameusers r,_ssh_user_at_hostr[[sg! &&(9M 99V  @ ) 4 @DV1XJ  ! !sA AActjtj|j dj dddS)Nascii=)base64urlsafe_b64encoder(urandomdecoderstrip)lengths r,_pkce_code_verifierrffs;  # #BJJv$6 7 > >w G N Ns STXUX YYr2ctj|jdj}t j |j djdS)Nutf-8r]r^)hashlibsha256encodedigestr`rarcrd) code_verifierrls r,_pkce_code_challengernjsK ^^M009 : A A CF  # #F + 2 27 ; B B3 GGr2cDdddddGfddt}|fS)aGHandler class for an RFC 8252 loopback redirect plus the dict it fills in. Only a GET on *expected_path* is accepted (anything else is a 404 and leaves the result untouched), so a nonce embedded in the path acts as the CSRF ``state`` for authorization servers that do not echo an explicit ``state`` parameter. N)codestateerrorerror_descriptionc&eZdZdfd ZddZy)A_make_loopback_callback_handler.._LoopbackCallbackHandlerc t|j}|jk7r=|jd|j|jj dyt |j}D]}|j|dgd|<|jd|jdd|jdrdnd }|jj d d |d jd y)Nis Not found.rz Content-Typeztext/html; charset=utf-8rrfailedreceivedz

z authorization z+.

You can close this tab.rh) r r8 send_response end_headerswfilewriter queryrE send_headerrk)selfparsedparamskeyoutcome display_name expected_pathresults r,do_GETzH_make_loopback_callback_handler.._LoopbackCallbackHandler.do_GET{sdii(F{{m+""3'  "   /fll+F 9$jjtf5a8s  9   s #   ^-G H    "(/hzG JJ  "<.yI888>w Ir2cyr'r1)rformatargss r, log_messagezM_make_loopback_callback_handler.._LoopbackCallbackHandler.log_messages r2N)returnNone)rstrrrrr)__name__ __module__ __qualname__rr)rrrsr,_LoopbackCallbackHandlerruzs I( r2r)r)rrrrs`` @r,_make_loopback_callback_handlerros3'+TD_cdF#90 $V ++r2c Gddt} |||f|S#t$r}|d|d|d|||d}~wwxYw)uBind the loopback listener up front (``port=0`` = OS-assigned) so the redirect URI sent to the authorization server names a port we already own — no probe-close-rebind race.ceZdZdZy)8_bind_loopback_callback_server.._ReuseHTTPServerTN)rrrallow_reuse_addressr1r2r,_ReuseHTTPServerrs"r2rz"Could not bind callback server on :z: N)rrW)hostport handler_clserrbind_failed_coderexcs r,_bind_loopback_callback_serverrs\#:#ht k:: h6tfAdV2cUKM]^dgghs  =8=ctj|jddid}|jt j t d|z} t j |krk|ds|dr4||j|j|jd St jdt j |krk|j|j|jd |d |#|j|j|jd wxYw) zZServe *server* until the redirect lands in *result* or the deadline passes; always closes. poll_intervalg?T)targetkwargsdaemong@rprrg?)timeoutz7Authorization timed out waiting for the local callback.) threadingThread serve_foreverstarttime monotonicmaxshutdown server_closejoinsleep)serverrtimeout_secondsr timeout_codethreaddeadlines r,_serve_loopback_callbackrs    V%9%9?TWBXae fF LLN~~#c?";;H!nn)f~  C  JJsOnn)  C  G VV  C  s"D,,D4E)docs_urlc8ddlm}|sy t|}|jxsd|j }}|dvs|syd}t d|d|d |d |d |d td |rt d|t dtd|dy#t$rYywxYw)aPrint an SSH tunnel hint when a loopback-redirect OAuth flow runs on a remote host. The auth server redirects the browser to ``127.0.0.1:/callback``; when the browser is on another machine (the SSH case) the redirect needs a local port forward to reach us. r)r3Nr5>::1 127.0.0.1 localhostz<------------------------------------------------------------ u1 Remote session detected — SSH tunnel required z- Hermes is waiting for the OAuth callback on z but your browser is on a different machine. Run this command in a NEW terminal on your local machine BEFORE opening the URL: ssh -N -L z :127.0.0.1: z: Then open the authorize URL above in your local browser.zProvider docs: zSSH/jump-box guide: ) hermes_cli.authr3r rJrYrprintr[r) redirect_urirr3rrrdividers r,_print_loopback_ssh_hintrs 3  ,'&B $D 44DG WIH R77CnEfKvQ/@/B.CDC  CD $XJ/0 !8 9G9B GH s B BBctjdk(r) ddl}tj|j Sy#t $rYywxYw)zPlatform-aware default SSL verify for httpx clients. On macOS with Homebrew Python the system OpenSSL cannot find the system trust store, so pin certifi's bundle when importable; elsewhere defer to httpx's built-in default. darwinrNcafileT)rFrGcertifisslcreate_default_contextwhere ImportError)rs r,_default_verifyrsK  ||x  --W]]_E E     s'> A  A )insecure ca_bundle auth_statecZddlm}t|tr|j dni}t|tr|ni}| t |dnt |j ddd}|xsV|j dxsCt jdxs,t jd xst jd }|ry|r]t|}t jj|stjd ||Stj| S|S) Nr)rtlsFdefaultrrHERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLEuJCA bundle path does not exist: %s — falling back to default certificatesr)rr isinstancedictrErr(r)rr8isfileloggerwarningrr)rrrr tls_stateeffective_insecure effective_caca_paths r,_resolve_verifyrs0)3J)E u%2I' 48 bI4<4H%0 Y]]:u=u M  IY]];/ I299=O3P I 99_ % I)+3G)Hl#ww~~g& NN\ #$ $))99  r2c|j|dd|i|rd|ini}|j|j}gd}|Dcgc] }||vs| }}|rtddj ||Scc}w)zFPOST to the device code endpoint. Returns device_code, user_code, etc.z/api/oauth/device/code client_idscopedata) device_code user_codeverification_uriverification_uri_complete expires_inintervalz%Device code response missing fields: z, )postraise_for_statusjson ValueErrorr) clientportal_base_urlrrresponserrequired_fieldsfmissings r,_request_device_coders{{  129 LU'5)9 LNH  ==?DO*;QQd]q;G;@7AS@TUVV K._validateds  (JK K )r2cddlm}|t|jddxsdt|jdxsdS)Nr)device_flow_errorrrr5rszUnknown authentication error)hermes_cli.auth_error_copyrrrE) _responserrs r,_errorz_poll_for_token.._errorhsH@  !!'2.4" 5  !!"56X:X Y[ [r2c@jdtdS)Nz/api/oauth/token) grant_typerrr)rr)rrrrsr,z!_poll_for_token..ps. / 049*,-r2rctdS)Nz1Token endpoint returned a non-JSON error response) RuntimeError)_rs r,r z!_poll_for_token..xs\ ?&Ar2c,ttSr') TimeoutErrorr)rsr,r z!_poll_for_token..|s<(I/(Z2)rrr rr r)rDict[str, Any]rr)rrJ)rrr r)rrrrrrrrs```` r,_poll_for_tokenr'`sML[ & - !S0UVW"VA\ ] ]r2c t|jj}|dk(r|dvS|dvS#ttf$r|}Y wxYw)zB``input()`` a [Y/n]-style question; EOF/Ctrl-C count as *default*.y>r5r)yes>r)r*)inputr6r:EOFErrorKeyboardInterrupt)promptranswers r,_prompt_yes_nor0s\v$$&,,.*1C6% %SV|=SS ' (s'6A  A )show_auth_statecttd|rddlm}td|dtd|d|dy) NzLogin successful!r)display_hermes_homez Auth state: z /auth.jsonz Config updated: z (model.provider=))rhermes_constantsr3) provider_id config_pathr1_dhhs r,_print_login_successr9sB G @ tvhj12 {m+<[M KLr2)expired_noticec6ddlm} |}|jdd}t|trM|rK||dsBt d|dt dd r3|||jd |} t|| y |r t |y #t$rYy wxYw)uOffer to reuse still-valid stored OAuth credentials. Returns True when the user accepted. *resolve* attempts a refresh, so a resolved token should be valid — but double-check the expiry before telling the user "Login successful!". r)_update_config_for_providerapi_keyr5<z Existing z( credentials found in Hermes auth store.z!Use existing credentials? [Y/n]: r)rbase_urlTF) rr<rErrrr0r9r) r6resolve is_expiringrdefault_base_urlr:r<existingr=r7s r,!_offer_existing_oauth_credentialsrDs<  9,,y"- gs # GR8P Il^+ST UA3O9j:J!KM $[+>  . !     sA5B > B BB)rr.)r;rrr.)rr)@)reintrr)rmrrr)rrrrrz3tuple[type[BaseHTTPRequestHandler], dict[str, Any]]) rrrrFrztype[BaseHTTPRequestHandler]rCallable[..., AuthError]rrrr) rrrdict[str, Any]rfloatrrGrrrrH)rrrz str | Nonerr)rbool | ssl.SSLContext)rzOptional[bool]r Optional[str]rzOptional[Dict[str, Any]]rrJ) r httpx.ClientrrrrrrKrr&)rrrr) rrrrrr.rrrr.rr)rzCallable[[], 'httpx.Response']rrFrrFr z Callable[[Dict[str, Any]], None]r z'Callable[['httpx.Response'], Exception]rz7Callable[['httpx.Response', Dict[str, Any]], Exception]rzCallable[[], Exception]rr&)rrLrrrrrrrrFrrFrr&)r.rrrrr.)r6rr7rr1r.rr)r6rr@zCallable[[], Dict[str, Any]]rAzCallable[[str, int], bool]rrrBrr:rKrr.)=__doc__ __future__rr`riloggingr(rrFrrrI http.serverrrpathlibrtypingrrr r r urllib.parser r hermes_cli.auth_constantsrrrrrrutilsr getLoggerr frozensetr__annotations__r0r3r=rPr[rfrnrrrrrrrrrrr'r0r9rDr1r2r,rYs #   :;;+<<"   , - *34* @E A. ZH #,#,),#,8#,L h  h h'C hMe h h h W W .WDIWPhWWW(KOI:  #'4+/3@(4I2 +.;>GT$+$W[ %[[&)[<@[PS[[*.[4" ("9<"MP"6"?"F " ( " -; "J] ]+.];>]MP]]$'],:]>TEJMM#'M=AMNRM%)">+;>RU".2r2