߲jdZddlmZddlZddlZddlmZmZddlm Z ddl m Z m Z m Z mZmZddlmZmZmZmZmZmZmZdZd d dd Zdd Zdd ZdddddZy)u_OpenRouter OAuth PKCE login (``hermes auth add openrouter --type oauth``). Contract: https://openrouter.ai/docs/guides/overview/auth/oauth. The browser is sent to ``/auth?callback_url=...&code_challenge=...&code_challenge_method=S256``; the redirect carries ``?code=``; ``POST /api/v1/auth/keys`` swaps ``{code, code_verifier, code_challenge_method}`` for ``{"key": "sk-or-v1-..."}`` — a plain user-controlled API key, no refresh token. OpenRouter echoes no ``state`` parameter, so the CSRF nonce rides in the loopback callback PATH: a redirect to any other path is a 404 and never reaches the exchange. ) annotationsN)AnyDict) urlencode)OPENROUTER_AUTH_KEYS_URLOPENROUTER_AUTH_URLOPENROUTER_OAUTH_DOCS_URL_openrouter_errhttpx)_bind_loopback_callback_server_can_open_graphical_browser_is_remote_session_make_loopback_callback_handler_pkce_code_challenge_pkce_code_verifier_serve_loopback_callbackig4@)timeout_secondscv tjt||ddddi|}|j d k(rt d d d |j dk\rL|j jdt}t d|j d|r d|zddzd |j}t|tr,t|jdxsdjnd}|s t dd|S#t$r}t d|d|d}~wwxYw#t$r}t dd|d}~wwxYw)z\Exchange the authorization code for an API key; the key never enters a log or error message.S256)code code_verifiercode_challenge_methodz Content-Typezapplication/json)jsonheaderstimeoutz!OpenRouter code exchange failed: openrouter_token_exchange_failedNizrOpenRouter rejected the authorization code (invalid, already used, or older than 10 minutes). Run the login again. openrouter_token_exchange_deniedT)reloginiz&OpenRouter code exchange failed (HTTP z).z Response: z2OpenRouter code exchange returned a non-JSON body.!openrouter_token_exchange_invalidkeyz:OpenRouter code exchange response did not include a 'key'.)r postr Exceptionr status_codetextstrip_ERROR_BODY_LIMITr ValueError isinstancedictstrget)rrrresponseexcdetailpayloadr!s ?/home/ubuntu/.hermes/hermes-agent/hermes_cli/auth_openrouter.py_openrouter_exchange_coder2sv:: $}W],_#%78/Ss" #$FPTV Vs"$$&'9(9:4X5I5I4J" MkqS^_e^fQg z .0 0wy z .0 0p--/4>gt3L#gkk% &B ' - - /RTC  HJmo o J+ v A#GIklruuv p @Beglo pps/#C<D< DDD D8& D33D8cxddlm}td|d|dj}|s t dd|S)zeRemote/SSH: OpenRouter shows the code on screen when ``callback_url`` is omitted; the user pastes it.r)masked_secret_promptuRemote session detected — using OpenRouter's headless flow. Open this URL in a browser on any machine, authorize, then paste the code shown:  zAuthorization code: zNo authorization code entered.openrouter_auth_no_code)hermes_cli.secret_promptr4printr&r )auth_urlr4rs r1_openrouter_headless_coder::sP=  __g^hhj lm 6 7 = = ?D >@YZZ Kctjd}d|}t|d\}}tdd|td}d |j d |}t d td |i|} td | dt|r/tr% tj| } t| rdndtdt|||td} | jdr%t d| jdxs| ddt!| jdxsdj#} | s t dd| S#t$rd} YwxYw)Nz /callback/ OpenRouter) display_namez 127.0.0.1ropenrouter_callback_bind_failed)errbind_failed_codezhttp://127.0.0.1:? callback_urlz5Open this URL to authorize Hermes with OpenRouter: z Docs: Fz,Browser opened for OpenRouter authorization.z<2cSb2c(d'efH B8*JWpVq rs35 __X.F <Q S 23'_24H||G/ =P0Q0fU]^eUf/g h $& & x||F#)r * 0 0 2D XZstt K F s E EETgr@rQrc t}t|dd}tr$ttdt i|ddi}nt |||}tddt||iS) zSRun the PKCE flow and return ``{"api_key": ...}`` for the credential-pool add path.r)code_challengerrD key_labelz hermes-agentr[z>Exchanging the authorization code for an OpenRouter API key...api_key) rrrr:rrrZr8r2)rQrrparamsrs r1_openrouter_pkce_loginraesw')M 4] C^d eF(,?+@)LsvLsWbdrLsBtAu)vw(l\kl JK 0}E FFr;)rr+rr+rfloatreturnr+)r9r+rcr+)rPzDict[str, str]rQboolrrbrcr+)rQrdrrbrczDict[str, Any])__doc__ __future__rrKrNtypingrr urllib.parserhermes_cli.auth_constantsrrr r r hermes_cli.auth_device_flowr r rrrrrr'r2r:rZrar;r1rlse#"ffjjjZ^> >48RW Gr;