߲jcC LUdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z m Z ddl m Z mZddlmZddlmZmZmZmZmZmZmZddlmZdd lmZdd lmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-erdd l.m/Z/ej`d Z1d Z2dddvdZ3dwdZ4dddxdZ5dydZ6dddddddZ7de8d<e9dhZ:de8d<dzdZ;d{dZde8d <d}d!Z?d~d"Z@dd#ZAdd$ZBdd%ZCdd&ZDdde+d' dd(ZEdde+d' dd)ZFdd*ZGdd+dd,ZHdd-ZIddd.ZJdd/ dd0ZKddd1 dd2ZLe9d3d4hZMdd5ZNd6ZOejZQdd7ZRdd8ZSe efdd9ZTdd:ZUd;ZVdd<ZWdd=ZXdd>ZYdd?ZZdd@Z[ddAZ\ddBZ] ddCZ^dDdEddFZ_ ddGZ` ddHZaddI ddJZbddKZcddLZdddMZedDdNdO ddPZfddQZgdRe$dddddDdddddS ddTZhdDdddU ddVZiddWddXZjddYZkddZZlGd[d\ZmdDddddd] dd^ZndDddddd] dd_Zodd`ZpddaZq ddbZrddcZsdddZtddeZudfZvdgZwdhZxddiZyddj ddkZzdddddNdDddddl ddmZ{ddnZ|dNdDddo ddpZ} ddqZ~ddrZddsZddtZdduZy)a Nous Portal OAuth: device-code login, refresh, shared-store mirroring, JWT selection, status. Split out of ``hermes_cli/auth.py``; origin helpers are imported lazily inside each function so ``hermes_cli.auth.`` patches still intercept (and no import cycle). ) annotationsN)contextmanagersuppress)datetimetimezone)Path) TYPE_CHECKINGAnyCallableDict FrozenSetListOptional)urlparse) _pool_entries)_decode_jwt_claimsAUTH_LOCK_TIMEOUT_SECONDS AuthErrorDEFAULT_NOUS_CLIENT_IDDEFAULT_NOUS_INFERENCE_URLDEFAULT_NOUS_PORTAL_URLDEFAULT_NOUS_SCOPEDEFAULT_NOUS_WELCOME_URL%DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDSNOUS_AUTH_PATH_INVOKE_JWTNOUS_BILLING_MANAGE_SCOPENOUS_DEVICE_CODE_SOURCENOUS_INFERENCE_INVOKE_SCOPENOUS_INVOKE_JWT_MIN_TTL_SECONDS _nous_errhttpx)ProviderConfigzhermes_cli.authz*Re-authenticate with: hermes auth add nousFno_refresh_tokencX|rdnd}td|d|dt|rddS|dS) aeShared ``relogin=True`` error for an access token that is not a usable inference JWT. With no refresh token the failure is a state-shape one (nothing to redeem), so it carries the terminal ``nous_auth_missing_refresh_token`` code the pool recognises instead of the JWT ``reason``, which would bench the row as a transient outage (#113718). z" and no refresh token is availablez8Nous Portal access token is not a usable inference JWT ()z. nous_auth_missing_refresh_tokenTrelogin)r _UNUSABLE_JWT_RELOGIN)reasonr$details 9/home/ubuntu/.hermes/hermes-agent/hermes_cli/auth_nous.py_unusable_invoke_jwt_errorr/&sX6F 12F  B6(!F8SU ! #-=)SW YYDJSW YYct|tr|jnd}|r5tj|j dj ddSdS)zJReturn a short hash fingerprint for telemetry without leaking token bytes.r&zutf-8N ) isinstancestrstriphashlibsha256encode hexdigest)tokencleaneds r._token_fingerprintr<4sH)%5ekkm2GGN7>>'..1 2 < < >s CXTXXr0) sequence_idc tjddjjdvryd|i}|r||d<|j |t j dtj|dd y) NHERMES_OAUTH_TRACEr&>1onyestrueeventr=zoauth_trace %sTF sort_keys ensure_ascii) osgetenvr5lowerupdateloggerinfojsondumps)rDr=fieldspayloads r. _oauth_tracerR:sl yy%r*00288:B\\&.G!,  NN6 KK $**WSX"YZr0ctj|j|ztjj S)z.ISO timestamp *ttl_seconds* after *now* (UTC).tz)r fromtimestamp timestamprutc isoformat)now ttl_secondss r. _iso_afterr\Ds-  ! !#--/K"?HLL Q [ [ ]]r0 agent_key agent_key_idagent_key_expires_atagent_key_expires_inagent_key_reusedagent_key_obtained_atDict[str, Any]_NOUS_EMPTY_AGENT_KEY_FIELDSzapi.nousresearch.comzFrozenSet[str]_NOUS_STALE_PORTAL_HOSTSc@ddlm}m}|d}|||xsdS)zUPortal entitlement notice for *capability* (fresh account data), "" when unavailable.r)&format_nous_portal_entitlement_messageget_nous_portal_account_infoT force_fresh) capabilityr&)hermes_cli.nous_accountrhri)rlrhri account_infos r._portal_entitlement_messageroQs%N/DAL 1,: V \Z\\r0ctt5tdx}r |cdddS ddd|dS#1swYxYw)NzNous model accessz5 Check credits or billing in Nous Portal, then retry.)r Exceptionro)errormessages r.#_format_nous_entitlement_auth_errorrtYsP ) 12EF F7 F FWI JJs 7Ac|jd}t|tsy|jdxsdj}|rAt |j t vr%tjd|tt|d<yyy)Nnousportal_base_urlr&z3auth: migrating stale nous portal_base_url %s -> %s) getr3dictr5rhostnamerfrLwarningr) providersrvstoreds r._migrate_stale_nous_portal_urlr~`sx == D dD !hh()/R 6 6 8F (6"++/GG A6Kb d"9 Hvr0zinference-api.nousresearch.comzwelcome-api.nousresearch.com_ALLOWED_NOUS_INFERENCE_HOSTScj|tvry|syt}|duxrt|j|k(S)uProduction hosts always; otherwise only the host the operator named in ``NOUS_INFERENCE_BASE_URL``. A non-production Portal's refresh response names that environment's inference gateway. The Portal-returned value is network provenance, so it does not get bearer-receive authority on its own — not even for a Nous-owned host: the operator's explicit override is the authority, and the network value is accepted exactly when it agrees with it. Then the persisted endpoint, the pricing scope and the proxy all follow the environment the operator chose, and the per-turn "refusing inference URL host" warning stops. TFN)r_nous_inference_env_overriderrz)rzoverrides r._nous_inference_host_allowedrts>00 +-H 4  KHX$6$?$?8$KKr0cpt|tr|jnd}|sy t|}|j dk7r!t jd|j yt|js!t jd|jy|jdS#t$rYywxYw)u Validate a Portal-returned inference URL against the host allowlist. Defense-in-depth: a compromised refresh response (MITM, response injection) could otherwise redirect every proxy request — bearing the user's inference JWT — to an attacker endpoint. r&NhttpszEnous: refusing non-https inference URL scheme %r from Portal responsezenous: refusing inference URL host %r from Portal response (not in allowlist); falling back to default/) r3r4r5rrqschemerLr{rrzrstrip)urlr;parseds r.)_validate_nous_inference_url_from_networkrs (S1ciikrG '"}} SU[UbUb d ' 8 : OO  >>#  s B)) B54B5cddlm}m} |D]}||}|s|cSy#|$r(tj ddj |YywxYw)uThe first set operator routing override among ``names`` (``NOUS_INFERENCE_BASE_URL``, ``HERMES_PORTAL_BASE_URL`` / its ``NOUS_PORTAL_BASE_URL`` alias), resolved through the profile secret scope, or None. ``get_secret`` already reads ``os.environ`` for a single-profile process, so the only time it raises is a multi-profile call that has lost its profile scope. That call has no authority to route on the launch profile's value — returning the ambient env there would send a secondary's tokens to the launch profile's Portal or inference host — so the override is simply absent. Absent is not free: default routing then applies, so a non-production deployment's token is spent against the production hosts. One WARNING per lost-scope event names the override; the downstream "ignoring invalid portal_base_url" line never says which caller lost its scope. r)UnscopedSecretError get_secretNunous: %s unreadable — no profile secret scope on a multiplexed call; treating the override as absent (default routing applies). The caller needs a profile scope binding.r)agent.secret_scoperrrLr{join)namesrrnamevalues r._scoped_operator_overridersdC  Dt$E    f HHUO  s   *A  A c0ddlm}|tdS)aUser-set ``NOUS_INFERENCE_BASE_URL`` override (trailing slash stripped) or None. Documented dev/staging escape hatch; the env source is trusted, so unlike Portal-returned URLs it is intentionally NOT gated by the network host allowlist. Read through the profile-aware resolver so a multiplexed profile uses its own override and never inherits the default profile's process-wide value (#65941). r_optional_base_urlNOUS_INFERENCE_BASE_URLhermes_cli.authrrrs r.rrs3 78QR SSr0c2ddlm}|tddS)aU``HERMES_PORTAL_BASE_URL`` / ``NOUS_PORTAL_BASE_URL`` override or None. Documented dev/staging escape hatch (e.g. hosted agents on the staging Portal). Trusted env source: must NOT be gated by ``_NOUS_PORTAL_ALLOWED_HOSTS``, which rejects untrusted NETWORK-provided values persisted to auth.json, not operator config. Read through the profile secret scope like ``_nous_inference_env_override``: it is reached on every routed turn (``_nous_effective_routing``), and a raw environ read would POST a multiplexed secondary's refresh token to the DEFAULT profile's Portal. rrHERMES_PORTAL_BASE_URLNOUS_PORTAL_BASE_URLrrs r._nous_portal_env_overriders3 78PRhi jjr0ct}t|tr8|jd|j ddj D|St|t tttfr|jd|D|S)Nc3BK|]}|js|ywN)r5).0parts r. z _scope_values..s[tdjjld[s, c3TK|] }t|tst|"ywr)r3r4 _scope_values)ritems r.rz _scope_values..s [ZPTVYEZ d+[s(() setr3r4rKreplacesplitlisttuple frozenset) raw_scopescopess r.rrsruF)S! [y'8'8c'B'H'H'J[[ M IeS)< = [ [\ Mr0scope expires_atmin_ttl_secondscddlm}t|}|syt|t|j dzt|j dz}t |vry|j d}t dt|}t|ttfr't|tj|zkrdSd S|||rd Sd S) zDReturn None when the token can be used for inference, else a reason.r) _is_expiringaccess_token_not_jwtrscpmissing_inference_invoke_scopeexpinvoke_jwt_expiringN%invoke_jwt_expiry_unknown_or_expiring) rrrrrxrmaxintr3floattime) r:rrrrclaimsrrskews r._nous_invoke_jwt_statusrs-  &F %E"]6::g3F%GGfjj/01F"&0/ **U C q#o& 'D#U|$(-c tyy{T7I(J$TPTT6B:t6T 2^Z^^r0c*ddlm}|||||duS)Nrrr)rr)r:rrrrs r._nous_invoke_jwt_is_usablers(8 " Uz? TW[ \\r0c`ddlm}|||jd|jdS)zW``_nous_invoke_jwt_status`` for *token* using *state*'s scope / expires_at (patchable).rrrr)rr)rrrx)stater:rs r._state_invoke_jwt_statusrs-7 " UYYw'EIIl4K MMr0 access_tokenc`||jdn|}t||}| t|y)Nr)rxrr/)rrr:r,s r.!_assert_nous_inference_jwt_usablers9)5)=EIIn %I(4M 1c-$))+5677 2 33r0cPt|}|jd}t|ttfrUt t 5tjt |tjjcdddSt|tr|SdS#1swYxYw)NrrT) rrxr3rrrrqrrVrrXrYr4)r:fallback_expires_atrrs r._nous_jwt_expires_atrs  &F **U C#U|$ i  S))%*FPPR S S",-@#"F PDP S Ss /shared/``. Outside any named profile so all profiles share it (``hermes --profile X auth add nous --type oauth`` one-tap imports it). Written on login AND every runtime refresh so the refresh_token stays current across profiles; a stale token just falls back to device-code. HERMES_SHARED_AUTH_DIRr&rget_default_hermes_rootshared)rHrIr5r expanduserhermes_constantsr)rrs r._nous_shared_auth_dirrJsEyy126<<>HH~((**8 " $x //r0c$ttz }tjj drNddlm}|dz tz jd} |jd}||k(rtd|d|S#t$r|}Y#wxYw) NPYTEST_CURRENT_TESTrrrF)strictzDRefusing to touch real user shared Nous auth store during test run: z@. Set HERMES_SHARED_AUTH_DIR to a tmp_path in your test fixture.) rNOUS_SHARED_STORE_FILENAMErHenvironrxrrresolverq RuntimeError)pathrreal_home_sharedresolveds r._nous_shared_store_pathrXs "%? ?D zz~~+,< # % 03M Mww^cwOd  ||5|1H ' 'V&XZ[ [ K  H sB BBc#Kddlm} tjd}||t |d5ddddy#t$rdYywxYw#1swYyxYww)zCross-profile lock for the shared Nous OAuth store. Lock ordering invariant: if both this and ``_auth_store_lock`` need to be held, acquire ``_auth_store_lock`` FIRST. All runtime refresh paths follow this order. r) _file_lockz.lockNz+Timed out waiting for shared Nous auth lock)rrr with_suffixr_nous_shared_lock_holder)timeout_secondsr lock_paths r._nous_shared_store_lockrlsm++-99'B  +_5 7   s=AAAA A A AAAAAc(t|dztS)Ng@)rrrs r._shared_lock_timeoutr s $&? @@r0)r refresh_token token_typer client_idrwinference_base_urlrr auth_method account_tier anon_tokenuser_idorg_idcddlm}m}m}|xsi}|j d}||sy||j dxsd}||j dxsd}|j t |j dxsdj k7}|s||kDsytD]} |j | } | dvs| || <y ) zACopy fresher shared OAuth tokens into a profile-local Nous state.r)rr_read_shared_nous_stater Frr&>Nr&T)rrrrrxr5r4_NOUS_SHARED_STATE_KEYS) rrrrrshared_refreshshared_access_explocal_access_exprefresh_changedkeyrs r._merge_shared_nous_oauth_staters\\ $ & ,"FZZ0N  (,VZZ -EFM#+EIIl,CDK$**,EIIo4N4TRT0U0[0[0]]O #47G#G& 3  "E#J r0c |jd|jd|jdxsd|jdxst|jdxst|jdxst|jdxs |jd d k(rtnt |jd |jd d dDcic]}|j|dvr|||c}Scc}w)zLThe defaulted OAuth core (tokens + routing + expiry) shared across profiles.rr r Bearerrr rwr r anonymousrr) rr r rr rwr rr)rrrrr)Nr&)rxrrrrr)srcrs r._nous_shared_shaper!s/#''/BZggl+7x!7%7WW[)C-C77#45P9P!gg&:;o(+ (>+(M $Smww}-SWW\=R -a ,ggaj * c!f9 , - - ,s C9c.ddlm}m}|jd}||jd}|s ||r||jdsyddit |d t j tjji} t5t}|||d dddtd tt| y#1swY*xYw#t$r }t j#d|Yd}~yd}~wwxYw)zPersist a minimal copy of the Nous OAuth state to the shared store. Best-effort: failures are logged and swallowed; per-profile auth.json stays the source of truth. r)r_save_private_jsonr rrN_schema updated_atT)rFnous_shared_store_written)rrefresh_token_fpz*Failed to write shared Nous auth store: %s)rrr#rxr!rrZrrXrYrrrRr4r<rqrLr)rrr#r is_guestrrexcs r._write_shared_nous_stater+s BIIo.MUYY|45H ]=9mEIIVdLe>f1>*51>hll8<<0::<>FH $ & =*,D tVt < =  'c$i/ > @ = = H A3GGHs0 C+ C6(C+C($C++ D4DDcddlm} t}|j sy t j |jd}t|tsy||jdxs0||jdxr||jd }|r|SdS#t$rYywxYw#ttf$r!}tjd||Yd}~yd}~wwxYw) zShared Nous OAuth state when present and well-formed, else None. None (missing / unreadable / malformed / lacking tokens) means "fall through to device-code". rrNz utf-8-sig)encodingz.Shared Nous auth store at %s is unreadable: %srrr )rrrris_filerNloads read_textOSError ValueErrorrLrr3ryrx)rrrQr* has_tokenss r.rrs .&( <<>**T^^[^AB gt $w{{<89dgkk.12b}W[[Q`Ea7b 7*d*  Z  EtSQs( B)%B8) B54B58C(C##C(c t5tjddddtd|y#1swYxYw#t$r }t j d|Yd}~yd}~wwxYw)zBRemove the shared Nous OAuth store after a terminal token failure.T) missing_okNnous_shared_store_clearedr,z*Failed to clear shared Nous auth store: %s)rrunlinkrRrqrLr)r,r*s r._clear_shared_nous_stater9sgH $ & > # % , , , = >0@ > > H A3GGHs+ A =A AA A2A--A2c ddlm}||j|jd|jdt |jdd} |}t ||d< t j|}|j|j|jd d }|jd} t| t rj| rh tj | } | j#| j$xst&j(tj*t&j(k}||d<|S#t$rd |d <YwxYw#t$r}t||d <Yd }~d }~wwxYw#t,$rd }YLwxYw)adRedaction-safe forensic record for a quarantine: fingerprints, sizes and booleans only. NEVER include a raw token/agent_key (credential-shaped literals get corrupted in logs). The 12-char SHA-256 prefix correlates to NAS's refreshTokenHash without leaking the secret; provenance is client_id + agent_key_id (Nous state has no session_id). r_auth_file_pathr r_r )r, error_coder r_r(auth_json_pathT)auth_json_sizeauth_json_mtimeauth_json_existsFrAauth_json_stat_errorNr)tzinfotoken_already_expired)rr<coderxr<r4rHstatrKst_sizest_mtimeFileNotFoundErrorrqreprr3r fromisoformatrrCrrXrZr2) rrrr,r<forensic auth_pathstr*already_expiredexpires_at_rawrs r._quarantine_forensicsrQsZ0 ;AW .1.uyy/IJ LH 5#% %(^!" 1#B OO!zz2;;Y]  _'+OYY|,N.#&> #++N;F%~~V]]5Rhll~S!)hll!; $]bceH'G*FG #t6vuVTE V$%'r0c$t|d}|ytdth}|Dcgc](}t|tr|j d|vr'|*}}t |t |k7}|r ||dd<t d||j|Scc}w)zHRemove singleton-seeded Nous pool entries that contain dead OAuth state.rvFzmanual:sourcecredential_pool!nous_pool_device_code_quarantined)r,r=)rrr3ryrxlenrRrE) auth_storerrr,entriessingleton_sourceseretainedremoveds r._quarantine_nous_pool_entriesrd&sJ/G0Gz/_try_import_shared_nous_state..Js9QRY9Zr0r force_refreshon_state_update error_typer=rE&shared_import_terminal_refresh_failurezShared Nous import failed: %s)nous_shared_import_failed)rrr+rgrhrr r!rqr3rrRtype__name__getattrr9rLr) rrrgrhrr refreshedr*is_authr+s @r._try_import_shared_nous_stater}6s )) $5I/5Z [ 0,.F 0 0 %?$V,%?;?Y]$)=%?E6d Z\I %Y / 0* + 0*  S), ' O48I4F4F O=D gc6489" O 6s; $%M N 4c:s?A< A/A<-A/%A</A94A<9A<< C<A-C77C<c|j|dd|id|d}|jdk(r$|j}d|vrtdd d |S |j}t |j d d}t |j dxsd } |dv} |dk(sd| jvrd} d } t| || #t$r}td d |d}~wwxYw)Nz/api/oauth/tokenzx-nous-refresh-tokenr ) grant_typer )headersdatarz%Refresh response missing access_token invalid_tokenTr)zRefresh token exchange failedrr invalid_granterror_description>rrrefresh_token_reusedrruNous Portal detected refresh-token reuse and revoked this session. This usually means an external process (monitoring script, custom self-heal hook, or another Hermes install sharing ~/.hermes/auth.json) called POST /api/oauth/token with Hermes's refresh token without persisting the rotated token back. Nous refresh tokens are single-use — only Hermes may call the refresh endpoint. For health checks, use `hermes auth status` instead. Re-authenticate with: hermes auth add nous)post status_coderNr rqr4rxrJ) clientrwr r responserQ error_payloadr*rE descriptionr*s r._refresh_access_tokenrXs{{  +,'7+) DFHs"--/  (C_^bc cP   }  /: ;Dm''(;<_@_`KPPG %%K4E4E4G)G 9  Kw 77) P7FCOPsC C#CC#cddlm}m}  |||||S#t$r1} | | r#t || |t || ||d} ~ wwxYw)zYRedeem the refresh token; on terminal failure quarantine state + pool, persist, re-raise.r)rrhrrwr r r7N)rrrhrrXrd) rr^rrwr r r,persistrrhr*s r._refresh_nous_or_quarantiner}s^ W $?i') )  *3 / (F C )*c& I I s  A,A  Ar cddlm}tjtj }||j d}|d|d<|j dxs||d<|j dxs|j dxsd|d<|j dxs|j d|d<|||d <|j|d <||d<t|||d <y ) aWrite a successful Nous token-refresh payload into *state* (tokens + expiry fields). *inference_base_url*, when given, is the healed network-provenance URL to persist alongside the rotated tokens (key order in auth.json is preserved from the original login shape). r)rrrr r rrNr rr) rrrrZrrXrxrYr\)rr{r r rrZ access_ttls r._apply_nous_refreshed_tokensrs4 ,,x|| $C$Y]]<%@AJ%n5E.&]]?;L}E/#-- 5\<9P\T\E,]]7+Auyy/AE'N%&8"#==?E-$E,$S*5E,r0cJt|jd}|xstS)u{Validated network-provenance inference URL from a refresh payload, healed to the default. A Portal URL rejected by the allowlist resets to the production default instead of leaving a previously-persisted bad host (e.g. a stale staging URL) in place — otherwise a poisoned auth.json re-validates to None on every refresh and silently re-uses the dead endpoint. r )rrxr)r{rs r._healed_nous_inference_urlrs$ 4IMMBV4W XC  ,,,r0c\tjtj|ddi|S)NAcceptzapplication/json)timeoutrverify)r!ClientTimeoutrrs r._nous_http_clientrs* << o.CU8V r0cZ|j}d|vrdnd|vrd|vrdnd|vrdnd}||fS)zUSort key: opus > pro > haiku/flash > sonnet (sonnet is cheap/fast; best model first).opusrprosonnetr%)rJ)midlowranks r._model_priorityrs? ))+C3A#(#:MA#o1 #;r0Trcpddlm}t||5}|j|j dddd|i}dddj d k7r]d |j } |j }t|jd xs|jd xs|}t|d|j jd} t| tsgSg} | D]`} t| tr| jdnd} || s/d| jvsB| j!| j#b| j%t&ttj)| S#1swYBxYw#t$r!} tjd | Yd} ~  d} ~ wwxYw)z6Fetch available model IDs from the Nous inference API.rrrz/models AuthorizationzBearer )rNrz#/models request failed with status rrrz'Could not parse error response JSON: %smodels_fetch_failedridhermesr)rrrrxrrrNr4rqrLrr r3rryrJappendr5sortrfromkeys)r api_keyrrrrrrerrrar model_idsrmodel_ids r.fetch_nous_modelsrs. ?F 3N]R]^K %:;; ==?  v &D dD ! I/%/d%;488D>  "xx~~7G'G   X^^- . / NNN'  i( ))-<< G LLBA F F Gs$+E>%AF >F F5F00F5c ddlm}|jd}||xr@t||jd|jdt dt |S)Nrrr^rr`r)rrrxrrr)rrrrs r._agent_key_is_usablersV- ))K C   6"< 599W%%)).;sRqahh:Q.QRs""N) rrr+agent.credential_poolrryr4r5nextr_)credsrrr+rrpools r.persist_nous_credentialsr*srV/ KE U!!#U))+g.U# V D RDLLNRTX YYr0cz ddlm}|dy#t$r }tj d|Yd}~yd}~wwxYw)zGBest-effort pool reseed after providers.nous changes; never fail login.rrrvz7Failed to sync Nous credential pool from auth store: %sN)rrrqrLr)rr*s r._sync_nous_pool_from_auth_storer>s8U3& U NPSTTUs :5:c:ddlm}m}||jdxstj d}t }|r|j d}nZt|}|j|j}}|dk(xs |dk(xr|dv}|r||vs|stjd||t}dd l m } t||jd xs| |rtnt } || t#xs| t%|jd xst&fS) a``(portal_url, stored_inference_url, effective_inference_url, client_id)`` from *state*. The stored inference URL is re-validated network-provenance (persisted); the effective one layers the runtime-only ``NOUS_INFERENCE_BASE_URL`` override on top and is never persisted. r)_NOUS_PORTAL_ALLOWED_HOSTSrrwrrhttp> 127.0.0.1 localhostzXauth: ignoring invalid portal_base_url %r (host %r or scheme not allowed), using defaultis_guest_stater r )rrrrxrrrrrzrrLr{hermes_cli.anon_authrrrrrr4r) rrr portal_urlenv_portal_overrideparsed_portal_url portal_hostrtrusted_schemerstored_inference_urls r._nous_effective_routingrGs- O$UYY/@%AB]F]eefijJ45(//4 $Z0/88:K:R:RV 7*L f  J0J!J k1KKSa NNAK )1J41 uyy)=> ? A _(6u(= $C] (*F*H*`L` EIIk " <&<= ??r0czeZdZdZ d dZddZddZdZddZddZ ddZ dd Z dd Z dd Z y )_NousRuntimeResolvea`Working set for one ``resolve_nous_runtime_credentials`` call. Holds the token pair + routing tuple that shared-store merges / refreshes replace mid-flight. ``persist`` skips writes where only derived TTL countdowns changed (keeps the mtime-keyed auth-status cache warm) and mirrors every real write to the shared store (best-effort). cN|||c|_|_|_||c|_|_||_t jjdd|_ t||_ d|_ |jd|_|jd|_|j!y)Nr2Frr )r^r _source_pathrsstale_access_tokenruuiduuid4hexr=ry_persisted_state persisted_anyrxrr _reload_routing)selfr^rstate_source_pathrsrrs r.__init__z_NousRuntimeResolve.__init__ts:DUL]6T%66CEW3D3.::<++CR0 $U "!IIn5"YY7 r0c`t|j\|_|_|_|_yr)rrrwstored_inference_base_urlr r rs r.rz#_NousRuntimeResolve._reload_routings'24::>  t=t?V r0c 2ddlm}m}|j}t |j }t ||k(rt d|j|y ||jd||jt d|j|t|jd t|jd  t||_d |_||y#t$r2}t d|j|t|jd}~wwxYw) Nr)_save_provider_state_to_sourcer+nous_state_persist_skipped)r=r,rvnous_state_persist_failed)r=r,runous_state_persistedr r)r=r,r(rT)rrr+rrrrRr=r^rrqrxryr<rxryr)rr,rr+r persistedr*s r.rz_NousRuntimeResolve.persists\ 243H3HI )% 0I = 54CSCS\b c   *4??FE4K\K\ ]  "0@0@/ /0JK.uyy/HI K!%U ! '  +9I9IRX9-- /   sC D$-DDc@tt|jS)Nr)rr rrs r. shared_lockz_NousRuntimeResolve.shared_locks&7KDL`L`7abbr0cdt|jtxrt|jSr)r3rr4rrs r.has_access_tokenz$_NousRuntimeResolve.has_access_tokens%$++S1Md4;L;L6MMr0cBt|j|jSr)rrrrs r.invoke_jwt_statusz%_NousRuntimeResolve.invoke_jwt_statuss' D4E4EFFr0ct|jsy|jjd|_|jjd|_|j y)zSAdopt fresher shared-store tokens (caller holds the shared lock). True when merged.Frr T)rrrxrr rrs r. merge_sharedz _NousRuntimeResolve.merge_sharedsJ-djj9 JJNN>:!ZZ^^O< r0c |j}|jrk|jr^t|trM|rJ||jk7r:|j )t d|jt|d|_yyyyyyy)uSkip the refresh when a peer already rotated the grant. Under the store lock: if the bearer that failed upstream is no longer the one on disk and the on-disk one is usable, adopt it — never re-POST the shared grant. Nrefresh_skipped_peer_rotatedrF) rrsrr3r4rrRr=r<)rr:s r.skip_refresh_if_peer_rotatedz0_NousRuntimeResolve.skip_refresh_if_peer_rotateds !!   4#:#:z%QT?UZ_T4449O9O9Q9Y .D.sDLL)RSr0)rr^rrwr r r,rrrr refresh_success)r=r,previous_refresh_token_fpnew_refresh_token_fprN)r3r r4r/rsrRr=r<rr^rrwr rrrr rrr)rrrrefresh_reasonr{previous_refresh_tokens` r.refreshz_NousRuntimeResolve.refreshsc$,,c2$:L:L,!4_tM M $11O8I8^M^  )9)9./0B0BC E0dooTZZ 00DNN,,5US U "&!3!3*DI)N&">"@"bDDbDb$ JJ 4#5#5#== ?!JJ~6!ZZ8 4+;+;N&89O&P!3D4F4F!G I 01r0cddlm}m}||jr|js|j ||j||jd|_|jjdxs |j|_txs |j|_ |jdy|js:|j5|jr|jdddd|jstdd d |j }|j!|js|y|j5|jr1|j }|jd |j!|js||j#||dddy#1swYxYw#1swYyxYw) zTMerge from the shared store / refresh until the access token is a usable invoke JWT.r)rrefresh_guest_stateNrr guest_exchange)runtime_shared_merge_missing_access_tokenz,No access token found for Nous Portal login.nous_auth_missing_access_tokenTr)!post_shared_merge_access_unusable)rrrrrsrrrxrrr rrrrr rr)rrrrrs r.ensure_usable_access_tokenz._NousRuntimeResolve.ensure_usable_access_tokensL $** %!!T%;%;%=%I#DJJ7$(JJ~$>!15@T1U1wY]YwYw.*F*H*jDLjLj' -. $$&!!# N$$&LL!LM N$$&>@`jnp p 224 ))+""&7&C      8  "$($:$:$<! @A113!!%6%B V%67  8 8 N N 8 8s"G "A"G GG"N)r^rdrrdrzOptional[Path]rsrr Optional[str]rrreturnNonerrr,r4rr)rrrr)r httpx.Clientrrrr)rrrr)ry __module__ __qualname____doc__rrrrrrrrrrrnr0r.rrlsu ( 1? Tb  4A TY ^b ?(,cNG '2B8r0rrrjrkrsrc>ddlm}m}m} t |||||S#|$r{}ddlm} ddlm} | dxsi} |t|jxsd| jd |j| k(r|d | t ||| cYd }~Sd }~wwxYw)a$Resolve Nous inference credentials for runtime use (refreshing under the auth-store lock). A guest whose ``anon_`` credential NAS no longer knows (reaped or claimed) is retired and a new identity is set up once, transparently -- the one client rule covering both reap and claim. r)AnonCredentialDeadclear_dead_guestensure_portal_identityr get_provider_auth_state)ANON_ACCOUNT_LOCKEDrvanon_credential_deadr) dead_tokenT)explicitrN)rrjrk) rr"r#r$!_resolve_nous_runtime_credentialsrr&r'r4rErx) rrjrkrsrr"r#r$dead_excr&r'deads r. resolve_nous_runtime_credentialsr.sbaU0+h)'0VUDUDFYcgh h! 0 1?T!(iTYZ ,#/// /0JK M6$ ? 46  * *6 2 -e#BRBR S #C$4$4#// S LL # 3 3s}}#&#@#@*62  4 4 <=->. ')ii $G gs #7DnUU12J(>(>7))N+:$Z;Q1RS+/+@/@A CC' 4 4>>s%A1G" A>G G"G G""G+c dddddddddS)NF) logged_inrwr access_expires_atr`has_refresh_tokeninference_credential_presentcredential_sourcernrnr0r._empty_nous_auth_statusrAOs"t4!4V[(-D JJr0c  ddlm  ddlm}|d}|r)|j rt |j ng}|s tSt| fd d fd }|d s tS|d |d }}t|d d xsd jj}t|xr|jdxs t|}|dd}||r|dxstnd|dxs|dxs|d|r|nd|d|dt|dd|d|d S#t$r tcYSwxYw)zBest-effort status from the credential pool. Fallback only: the auth-store provider state is the runtime source of truth because it is what ``resolve_nous_runtime_credentials()`` refreshes. r)rrrvc t|ddxsdt|ddxsdtt|ddxsd fS)Nr`rrpriorityr)rzr)rars r.rqz,_snapshot_nous_pool_status..csP ,BD!I J Qc L$!? @ GC J*/a 0 0,2r0rNct||Sr)rz)rdefaultentrys r.rqz,_snapshot_nous_pool_status..gs'%w*Gr0runtime_api_keyrr  auth_typer&oauthrunknownrwr runtime_base_urlr7rr`Tpool:) r<rwr rr=r`r>r?r@rZr)rrrrhas_credentialsrr_rArr4r5rJr startswithrrq) rrr_attrrr rIis_portal_oauthrrrGs @@r._snapshot_nous_pool_statusrRVsq 5)3 *.43G3G3I$t||~&r*, ,G"23H%&*, ,&*>&:Drr?r@rZr free_tier)rrrxrr3r4)rr<rZrrrs r._nous_status_from_staterU~s499^,L99^,L599=N3O#ii(<="YY|4 % *@ A!%))O"<=|(,\-SUYY{=S(T)V(2<(E 4#E* , ,r0cdddlm}m}|d}|s tSt |t |j dd} |}|dxs|}|jd|j dxs|j d|j d xs$|j d xs|j d |j d xs|j d |j d xs$|j d xs|j d t |j dddd|j dd|j dd |S#t$rI}|jdt|t t|ddt|dddYd}~|Sd}~wwxYw)zEUncached implementation of get_nous_auth_status(). See that function.r)r&r.rvrr^r<rZTrwr7r rr=r`r zruntime:rZportalr8) r<rwr r=r`r>r?r@rZr8Frelogin_requiredrEN)r<rrrYr=) rr&r.rRrUrrxrKrr4rz)r&r.r base_statusrrefreshed_stater*s r._compute_nous_auth_statusr\sY #F +E )++) eii78OK7021&9BU##$56\+//J[:\ *%9)<)<=Q)R9??#78##L1Y[__EX5Y ,';?+>+>?U+V;??#9:!%o&9&9/&J!K,0| 8X!> ?@EIIV^L_a b(  7S $WS2De%L M!#vt46 7 7  7sDE F/&>F**F/c|jd}t|tr5|jdr$|jds|jds|Sy)zThe persisted ``last_auth_error`` when it is a terminal quarantine with no credential left. Only terminal while there is no usable credential: if a later login repopulated tokens the stale marker must not keep reporting terminal. rVrYrr N)rxr3ry)rlast_errs r._terminal_quarantine_markerr_sH yy*+H8T"x||4F'GYY~.%))O2L r0cddlm} |d}|s tSt ||j d}t |}|duxs t|j dxr|du}t||d}|6|jd |j d |j d xsd |S#t$rd}YwxYw)u,Refresh-free Nous auth snapshot for read-only display surfaces. NEVER calls ``resolve_nous_runtime_credentials()`` (no refresh POST / single-use token spent); ``logged_in`` = usable invoke JWT, or a refresh token not terminally quarantined — not proof the server still accepts it. rr%rvNrr auth_store_localrWTrErszre-login required)rYr=rr) rr&rqrRrrxr_rrUrK)r&r jwt_reasonr^r<statuss r.get_nous_auth_status_localrds8'/ )++)%>1JKJ*51Ht#_eii.H)I)^hZ^N^I $UiHZ [F !hll6.B,,y)@-@  B M sB00 B>=B>validterminalrKcddlm} |d}|stSt |t St ||jdtStS#t$rd}YMwxYw)ubClassify the Nous bootstrap session for the dashboard /api/status probe. Local auth-store state only; polled frequently, so it never resolves or refreshes. ANTI-FLAP: only a *terminal* failure maps to "terminal" — a rotation blip, network error, or expiring token must NOT (that would trigger a spurious NAS re-mint on a healthy box). rr%rvNr) rr&rqNOUS_SESSION_UNKNOWNr_NOUS_SESSION_TERMINALrrxNOUS_SESSION_VALID)r&rs r.get_nous_session_validityrksn8'/ ###5)5$$uyy'@AI!!  sA AA) on_pool_missc vddlm} ddlm}||}|r|j rv|j }|Wt |ddxs t |dd} | r9|| ds0dt|t |d d|d t |d d | d S| |x} r| S |} dt|| jd | jd| jd| jdd S#t$rYfwxYw#t$r'} dt|t| dcYd} ~ Sd} ~ wwxYw)uStatus snapshot for a store-backed OAuth provider (Codex, xAI). Pool first (where `hermes auth` / `hermes model` store device_code tokens), then *on_pool_miss* for a pool-derived degraded status, then the legacy state via *resolve*. The pool read is an observation (``peek``), not a lease: ``select()`` refreshes an expiring single-use token and, when that speculative POST fails transiently, benches the entry with a persisted cooldown — every credential-gated listing (``/model`` picker, doctor) then shows the provider as unconfigured while the runtime resolver still serves it. Refreshing stays with the runtime resolver reached through *resolve*, whose failures persist nothing. rr;rNrHrr&T last_refreshrMrrK)r<r^rn auth_moderZrrorZrF)r<r^rr) rr<rrrNpeekrzr4rqrxr) provider_id is_expiringrorrlr<rrrGrdegradedrr*s r._pool_first_oauth_statusrtsS0 3% D((*IIKE E#4d;awun^`?a;w#:%)_=N9O(/~t(L%.$)'%)*L)M"N[b dd '-GX-G] S1B-C!IIn5;/599X;Nyy+ - -     ]"#o6G2HSVWZS[\\]s7BC9 C9AD9 DD D8D3-D83D8) rwr r r open_browserrrjrkon_verificationc ddlm} m} m} m} m} m}m}m}m }m }| d}|xs:tjdxs#tjdxs |jjd}|xs#tjdxs |jjd}|xs |j }|xs |j"}|rdn|r|nd }| rd}t%d |j&d t%d ||r t%d n|rt%d|dt)||5}|||||}t+|d}t+|d}t-|d}t-|d}||||d|!t/t05|||dddt3dt5|t6}t%d|d| |||t+|d||}dddt9j:t<j>}| jAdd}| |jAdxs|} | |k7rt%d| || ||jAdxs||jAd d!|d"|jAd#|jCtE|||||d$ tF}! ||!|d%S#1swY1xYw#1swYxYw#tH$r}"|"jJd&k(ro|!jAd'tLjd}#t%t%||"t%d(|#d)t%t%d*tOdd}"~"wwxYw)+zMRun the Nous device-code flow and return full OAuth state without persisting.r) PROVIDER_REGISTRYr_is_remote_sessionr_poll_for_token_print_device_code_instructions_request_device_coder1format_auth_errorrgrvrrrrFTzStarting Hermes login via z...zPortal: z'TLS verification: disabled (--insecure)z$TLS verification: custom CA bundle (r')rrwr rverification_uri_complete user_coderintervalu—)ru failure_dashNr%z$Waiting for approval (polling every zs)... device_code)rrwr rr poll_intervalr z%Using portal-provided inference URL: rr rrr ) rwr r rr rr rrrrl)rrssubscription_requiredrwz Subscribe here: z/billingz #"))LbBc #  " "FF3K  &bii(AB &  % %vvc{.W..I  "W]]E"*iTF  &w||nC 89 H_% &' 78  4YKqAB ?F 3$v*?iW\^ {+FGH K01 \23 {:./' ilQV X  &)$ = 0)< = C2W$XY 45G4HNO$?iK 67J"$ !$( ,,x|| $C*:>>,+JK:>>*>?@[D[!88 56L5MNO*BX)@)IE nn\8<">2#8}}jFV6W&/Ef/M( '(J , uN N1 = =$$L   88. .#(9;RSZZ[^_J G #C( ) &zl(; < G P QQ-   s?&A"K KA K6 KK KK M'#A?M""M'cddlm}m}tt5||dddtt5|dddy#1swY)xYw#1swYyxYw)zZMirror to the shared store + reseed the pool, swallowing all errors (same as _login_nous).r)rr+N)rrr+rrq)rrr+s r._mirror_nous_state_best_effortrvsRY ) - ,- ) *')**--**s A A AA)rurrvc \ddlm}m}m}m}|dxsi}|d}|j d} t | tr| jng} ttjg| xstgt} ||j dxsd|j dxsd|j dxs |jd j| ||| } |d| t!| | j d} t | txrt| jvS) a,Re-run the device flow requesting ``billing:manage`` (step-up on 403 insufficient_scope). The user must be ADMIN/OWNER and select "Allow Remote Spending" in the portal, else the server silently downscopes and this returns False. Persists like ``_login_nous`` minus the model picker. r)rxrrr&rvrrwNr r r)rwr r rrurrv)rrxrrr&rxr3r4rrryrrrr rr)rurrvrxrrr&priorr _raw_scope prior_scope requestedrgranteds r.step_up_nous_billing_scopers!!! $F + 1rE'G7#J(2:s(C*""$KT]]$T  656$T9R$TUVI( "34< 99%9:Bd))K(=G,=,=SXXiEX!?Tc eJ   3":.nnW%G gs # T(AW]]_(TTr0c ,ddlm}|jdxs|jd}t|tr|s t ddddlm}m}m }m }m }ddl m } m} m} |} |jd d } t!g}d }d }| rr| d }|d }| }|r#t#t$5t'd}ddd|r|n|}|| || \} }| }| | |d } | |k7}|r|| |d \} }| rDddlm}||}|r t!|t!dt-| d|| || |d ||S|r8| xst.j1d}t!dt!|xsd|dyt!dy#1swYxYw)aFetch the curated Nous model list (tier/policy-filtered) and run the interactive picker. Returns the selected model id, or None when the user skipped / nothing was selectable. Raises on any fetch failure so the caller can print the "Login succeeded, but..." notice. r)_prompt_model_selectionr^rz,No runtime API key available to fetch modelsr)get_curated_nous_model_idscheck_nous_free_tierpartition_nous_models_by_tier&union_with_portal_free_recommendations&union_with_portal_paid_recommendations)get_pricing_for_providernous_policy_allowed_idsrestrict_to_nous_policyrwr&FrvTrjzpaid Nous modelsN) rescue_empty)rT)nous_policy_notice)rczShowing u= curated models — use "Enter custom model name" for others.)pricingunavailable_modelsrunavailable_messageconfirm_providerconfirm_base_urlconfirm_api_keyrz#No free models currently available.z Upgrade at z to access paid models.z,No curated models available for Nous Portal.)rrrxr3r4r hermes_cli.modelsrrrrrhermes_cli.models_pricingrrrrrrqrormrr]rr)rr r runtime_keyrrrrrrrrr_portalrr_policy_narrowedrrT_policy_allowedunion_before_policyr_policy_notice_urls r._pick_nous_model_after_loginrs8..-O1OK k3 '{FXX +,Inn.3G G!*62(T: 13 )$ V&ABT&U# V 7@ 27 #9gw? 7"+IUYZ $6 ,I7d-4 )I)>+4DE  . ! s9~&': : ;' w;MZa 3f/N N22::3? 34 !P{4&8O%PQ  <= A V Vs 5 F  Fcddlm}m}ddlm}|}|r||ry t }tt|rd|nd|dd sytd t| }| td |S#t $rd}YZwxYw) aCodex-style auto-import: offer to rehydrate a Nous credential from another profile. Checks the shared store before launching a fresh device-code flow. Returns the refreshed auth state when the user accepted and the import succeeded, else None. r)_prompt_yes_norrNz)Found existing Nous OAuth credentials at z,Found existing shared Nous OAuth credentialsz!Import these credentials? [Y/n]: y)rFz3Rehydrating Nous session from shared credentials...ruKCould not refresh shared credentials — falling back to device-code login.) rrrrrrrrr})rrrrr shared_pathrs r._offer_shared_nous_importrs H3 $ &F ^F+-/  G { 5k] C=? =s K ?@.OJ [\   s A99 BBcddlm}m}m}|5|}|r||d<n|j dd||dddy#1swYyxYw)zUUndo the ``active_provider="nous"`` that ``_save_provider_state`` wrote during login.r)_auth_store_lock_load_auth_store_save_auth_storeactive_providerN)rrrrrW)prior_active_providerrrrr^s r._restore_active_providerrsPTT  %%' ,AJ( ) NN,d 3$ %%%s *AAc4ddlm}m}m}m}m}m}m}m} m } t|ddxsd} t|ddxs,tjdxstjd} t| } | j|t|d dt|d dt|d dxs |jt|d dt|d d | tt|dd| } | d}|5|j!d}ddd|d| }| | |t#t#dt#d|d} t%| |}|s,t/t#t#dt#dy|d||}||t#d|t#d|dy#1swYxYw#t&$rE}t)|t*r| |n t-|}t#t#d|Yd}~d}~wwxYw#t0$rt#dt3dt&$rd}ddlm}t8j;d |t#||t=t|d d!D] }t#|t3d"d}~wwxYw)#z&Nous Portal device authorization flow.r) rrrr_save_model_choicer_update_config_for_providerr+r}rNrerkHERMES_CA_BUNDLE SSL_CERT_FILEr inference_urlr r no_browserFrj)rwr r rrurrjrkr rrvzLogin successful!z Auth state: z?Login succeeded, but could not fetch available models. Reason: z:No provider change. Nous credentials saved for future use.z4 Run `hermes model` again to switch to Nous Portal.) default_modelzDefault model set to: z Config updated: z (model.provider=nous)z Login cancelled.)sign_in_failure_linesznous login failed: %r) service_hostr%)rrrrrrrrr+r}rzrHrIrr rrxrrrqr3rr4rKeyboardInterruptrhermes_cli.auth_error_copyrrLr _portal_host)argsrrrrrrrrr+r}rrkrr rsaved_toselected_modelr*rs config_pathrlines r. _login_nousrs555dIt4<Ok4( &BII6H,I & 99_ %5.?  0 'lD A#*4$#G!$ T:Og>O>OdGT2!(|U!CC /$wtZY^?_:`#%J((<=  N$4$6$:$:;L$M ! N.vzB ,')  !" xj)* _9*FXYN $%: ; G N O H I 1 &nF >* &~&678 ";-/EFG; N N _0:3 0J',PSTWPXG G ST[S\] ^ ^ _"  "#o D ,c2 )#LQUWceiIjAH  F;-H >0H /F84H ; H ;H?H H  H 'J3AJJcDt|xstjxsdS)Nzportal.nousresearch.com)rrrz)rs r.rrPs J9"9 : C C `G``r0)r,r4r$rrr)r:r rr)rDr4r=rrPr rr)rZrr[rrr4)rlr4rr4)rrrrr4)r|rdrr)rzrrr)rrrr)rr4rrr)rr rzset[str]) r:r rr rr rrrr) r:r rr rr rrrr)rrdr:r rr)rrdrr rr)rr rr rrr)r:r rr rr)rrdrrrr)rrdrr r=rrr)rrdrrd)rr)rr)rrrr)rrdrr)r rdrrd)rrdrr)rOptional[Dict[str, Any]]r)rrdrrrr,r4rrd)rrdrrrr,r4rr)r^rdrrrr,r4rr)rrrr) rrrwr4r r4r r4rrd)rrr^rdrrdrwr4r r4r r4r,r4rzCallable[[], None]rrd) rrdr{rdr r4r rrr)r{rdrr4)rrrr rr)rr4rr) r r4rr4rrrz bool | strrz List[str])rrdrrrr)"rr4r r4r r4rwr4r r4r r4rr4rrrrr^rr`rrrrjOptional[bool]rkrrsrrt/Optional[Callable[[Dict[str, Any], str], None]]rrd) r rdrrrsrrtrrrd)rrdrrr)rrdrztuple[str, str, str, str]) rrrjrrkrrsrrrrrd)rrd)rrdr<rrZr4rrd)rrdrr)rr4) rqr4rrzCallable[[str, int], bool]ror4rzCallable[[], Dict[str, Any]]rlz0Optional[Callable[[], Optional[Dict[str, Any]]]]rrd)rwrr rr rrrrurrrrjrrkrrv$Optional[Callable[[str, str], None]]rrd)rrdrr)rurrrrvrrr)rrdr r4rr)rr rr)rr"rr)rrrr4)r __future__rloggingr6rNrH threadingrr contextlibrrrrpathlibrtypingr r r r r rr urllib.parserhermes_cli.auth_codexrhermes_cli.auth_constantsrrrrrrrrrrrrrrr r!rr" getLoggerrLr+r/r<rRr\re__annotations__rrfrortr~rrrrrrrrrrrrrrrrrrlocalrrrrr rrr!r+rr9rQrXrdr}rrrrrrrrrrgrrrrr.r+rArRrUr\r_rdrjrirhrkrtrrrrrrrrrnr0r.rs1 #  /'PPP!/.   , -DIN YY >B[^tT dUY0[n[,56L5M+N.N]K:1:$";$1%~% L&48 T k!%:_ __25__?L_(!%:\ \\25\\?C\MUY14Q<@d d+8dDHd*37UY G  G,/ GER G^b G&/ >T/U%V"[.*9??, 0(5N$A F& - H4+0H#L(,  '0 =@ EI  ?CD"8"8.1"8>A"8RU"8"8J)7@N%(9<FI %3()-6 6&46EH6%6156,- HL**),*?D* *"+*<63;I[!%4#4!d_cGK))&))69)LO)),/)CF))4A) )UU48U&U2@U:!%#5(,3C3C0>3C3C483C&3C2@3ClJ%)P, ,)-,7:,?M,&D 8"  :FJ*]*]&@*]MP*] )*]C*]O]*]\)-RV#DW[!EVZ<@ K%KBOKK,9KPTKK.2KGTK: KFT K\*!4<@UU38U9UEIU>DD47D