+ iHjhRt^RIHt^RIt^RIt^RIHtHt^RIH t H t H t H t H t ^RIHt^RIHt] 'd ^RIHtHt]P*!]4tRtR R ltR R ltR RltRRltR#)uRPlugin-provider refresh support for the credential pool (#116408). A model-provider plugin makes its pooled OAuth rows refreshable by shipping ``ProviderProfile.refresh_credential(entry) -> Mapping | None``. The pool owns the locking, persistence and failure classification around that hook; the plugin owns only the token POST. This sibling module keeps that logic out of ``agent/credential_pool.py`` (near the size cap). Contract (documented in website/docs/developer-guide/model-provider-plugin.md): * the hook returns a mapping of rotated values — dataclass field names (``access_token``, ``refresh_token``, ``expires_at_ms`` …) replace the row's fields, every other key (``expires_in``, ``token_type``, ``scope`` — the natural token-endpoint shape) lands in ``entry.extra``; ``None``/empty = could not rotate and the pool benches the row like a failed refresh POST; * raising ``AuthError(..., relogin_required=True)`` (or a grant-dead OAuth code) is terminal: the row goes DEAD with a WARNING naming ``hermes auth add``; any other exception is transient and only benches the row. ) annotationsN)fieldsreplace) TYPE_CHECKINGAnyMappingOptionalTuple)_OAUTH_GRANT_DEAD_CODES) AuthError)CredentialPoolPooledCredentialic V^8dQhRRRR/#)entryr returnbool)formats"A/home/ubuntu/.hermes/hermes-agent/agent/credential_pool_plugin.py __annotate__r'suu"2utucVPRJ;'dG\VP4\\P!4R,4\,8*#)a-An expiry-stamped OAuth row (a plugin's, or Anthropic's) is due within the skew of ``expires_at_ms``. The token endpoint's ``expires_in`` is the only clock: many providers issue opaque bearers (Google's ``ya29.*``) with no JWT ``exp`` to decode, so without this a long session sends the dead bearer. Ni) expires_at_msinttime_EXPIRY_SKEW_MS)rs&rplugin_row_is_expiringr'sD   d * t ts53F3F/G3tyy{]aOaKbetKt/ttrc$V^8dQhRRRRRR/#)rrr resultrrr)rs"rrr0s(GG'7GGIYGrcV'gV#\V4p\\V44Uu0uFq3PkK upRR0, pVP 4UUu/uFwrVWT9gK WVbK pppVP 4UUu/uFwrVWT9gK VR8wgKWVbK pppV'd/VP CVCVR&V'd \ V3/VB#T#uupiuuppiuuppi)uMerge a ``refresh_credential`` return value into *entry*. Field names go through ``dataclasses.replace``; everything else is merged into ``extra`` (mirroring ``PooledCredential.from_dict``). Before this split a token-endpoint-shaped mapping with ``expires_in`` raised ``TypeError`` inside ``replace`` and the pool benched a row whose single-use refresh token the server had already rotated — the login was lost. providerextra)dictrtypenameitemsr"r) rrmappingf field_nameskv field_updates extra_updatess && rapply_plugin_refresh_resultr.0s  !%fG#)$u+#67#6a66#67:w:OOK&-mmoJoda9ITQToMJ&-mmoboda9MTRSWaRaTQToMb!AEKK!A=!A g.;75 *M *FF 8Jbs#C C!.C! C'C'"C'c V^8dQhRRRR/#)rexc BaseExceptionrrr)rs"rrrCs U U- UD Urc\V\4'gR#\VP4;'gVP;'gR\ 9#)aTrue when retrying the same plugin refresh token cannot succeed. Plugins have no per-provider code table, so the predicate is the structural one every built-in flow shares: a structured ``AuthError`` that asks for a re-login, or one carrying a grant-dead OAuth code. Transport errors, 429/5xx-shaped ``RuntimeError`` and plain ``AuthError`` without that signal stay transient (EXHAUSTED for one cooldown). F) isinstancer rrelogin_requiredcoder )r0s&r is_terminal_plugin_refresh_errorr7Cs= c9 % % $$ % T T#((..b=T)TTrc(V^8dQhRRRRRRRR/#) rpoolr rr r0 Exceptionrz'tuple[bool, Optional[PooledCredential]]r)rs"rrrPs, !18A,rc^RIHpVPV4pVPVP8wd`VP;'gRP 4'd6\ PRVP4RVP!V3/VB3#\V4'de\ PRVPVP;'gVPR,W P4VPW4R#R#) ucRecovery for a plugin hook that raised: adopt a peer's rotation, or quarantine a dead grant. Returns ``(handled, result)``; ``handled=False`` means the caller should bench the row as a transient failure. A peer process may have rotated the single-use token between our in-lock sync and the hook's POST — adopt that pair before classifying the failure. )_MARK_OKr3uB%s refresh failed but the pool store has newer tokens — adoptingTz%s refresh token for %s is terminally invalid (%s); the credential leaves rotation. Re-run 'hermes auth add %s' to sign in again.:NN)TN)FN)agent.credential_poolr<_sync_entry_from_pool_store refresh_token access_tokenstriploggerdebugr!_adoptr7warninglabelid_mark_dead_refresh_grant)r9rr0r<synceds&&& rrecover_failed_plugin_refreshrKPs/  - -e 4F u2228K8K8Q8Qr7X7X7Z7Z Y[_[h[hiT[[48444',,  < MM5;;66%((2,]] %%e1 r)__doc__ __future__rloggingr dataclassesrrtypingrrrrr hermes_cli.authr hermes_cli.auth_constantsr r>r r getLogger__name__rCrrr.r7rKrrrrUsV(# '??3/F   8 $uG& Ur