+ jHjZa0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI H t HtHt^RIHtHtHtHtHt^RIHt^RIHtHtHtHtHt^RIHtH t ]PB!R4t"R t#R t$R t%R R ut&t'RRRut(t)t*Rt+Rt,Rt-]!R4t.] !RR7!RR44t/!RR]4t0R\RRllt1RRlt2RRlt3R R!lt4R"R#lt5R$R%lt6R&R'lt7R(R)lt8R*R+lt9] !R,R-44t:] Pv!4tR/&]?!4t@R0]>R1&]P!R2R3R47tBR5]>R6&]PR74tDR8R9ltER:R;ltFR<R=ltGR>R?ltHR@RAltIRBRCltJRDREltKRFRGltLRHRIltMRJRKltNRLRMltORNROltPRPRQltQRRRSltRR]tS] PtURTRUltVRVRWltWRXRYltXRZR[ltYR#)^aNous free tier: the browser challenge the account service may put in front of a token exchange. NAS can answer ``POST /api/anonymous/token`` with **428** ``challenge_required`` and a list of challenges. Hermes implements exactly one primitive, ``browser-v1``: *open this portal URL, poll until it clears, exchange again*. Everything the page does (bot detection, an in-browser proof of work, an interactive fallback, its copy) belongs to the portal and changes without a Hermes release. Who opens the URL depends on the surface: * **desktop** (``HERMES_DESKTOP=1``): this process never opens anything. It publishes the challenge (``free_tier.challenge`` global event, and ``free_tier.status``'s ``challenge`` field for a client that connects later); the renderer hands it to the Electron main process, which loads it in a HIDDEN window and reveals that window only if the page asks for the human. * **terminal**: print the URL, and open the system browser when there is a graphical one to open. The wait runs OUTSIDE the auth-store and shared-store locks: the exchange that hit the 428 has already unwound (the exception left the ``with`` blocks), so a slow page never stalls a sibling profile or process. One challenge is worked at a time per process; a second thread that hits the same 428 waits for the first and then simply exchanges again (NAS hands a retried mint the same ticket, and a cleared credential a token). Only a caller someone is waiting on waits for a challenge. A background reader (the keepalive tick, a status paint) runs inside :func:`background_caller`: it still gets the challenge in front of a desktop client (so the hidden window can clear it before anyone needs a token) but never blocks, prints, or opens a browser. An *optional* challenge (``required: false`` on a successful exchange: the service is measuring, not enforcing) is only ever announced to a desktop client, never opened in a user's browser, and nothing waits on it. ) annotationsN) dataclassfieldreplace)AnyCallableDictOptionalTypeVar)urlparse)ANON_CHALLENGE_REQUIREDANON_FAILURE_COPYANON_SIGNIN_REQUIRED _anon_headers_mint_memo_key) AuthErrorhttpxzhermes_cli.authz browser-v1zfree_tier.challengeg^@g?g@g>@g @g@i,zBNous needs to run a quick check before starting your free session.TT)frozencd]tRt^Ht$R]R&R]R&R]R&R]R&R]R&^tR ]R &R R ltR tR#)BrowserChallengestrurlboolrequiredfloat expires_inintervalmessageintattemptcV^8dQhRR/#returndict[str, Any])formats">/home/ubuntu/.hermes/hermes-agent/hermes_cli/anon_challenge.py __annotate__BrowserChallenge.__annotate__QsffNfc  RRRVPRVPR\VP4RVPRVP /#)typebrowserrrrrr )rrrrrr )selfs&r( as_payloadBrowserChallenge.as_payloadQsD 5$((J c$//2It||YX\XdXdf fr+r&N)__name__ __module__ __qualname____firstlineno____annotations__r r0__static_attributes__r&r+r(rrHs2 HNO LGSffr+rc2a]tRt^VtRtRV3RlltRtV;t#)AnonChallengeRequiredzThe exchange needs a browser challenge first. Carries what :func:`run_with_challenge` needs to work it: the challenge, and the portal, credential and auth state (its ``tls`` block) to poll with.c ,V^8dQhRRRRRRRRRR /#) r# challengerportal_base_urlr anon_token auth_stater%r$Noner&)r's"r(r)"AnonChallengeRequired.__annotate__Zs3%%"2%%Y\%+%04%r+c z<\SV`VPR\RR7WnW nW0nW@nR#)nousTprovidercode retryableN)super__init__rr r;r<r=r>)r/r;r<r=r> __class__s&&$$$r(rHAnonChallengeRequired.__init__Zs6 **VBYeij".$$r+)r=r>r;r<)r2r3r4r5__doc__rHr7 __classcell__)rIs@r(r9r9Vsn%%r+r9c V^8dQhRRRR/#)r#rrr$rr&)r's"r(r)r)csAA3A)Ar+cl\\V4;'g\\,R\RR7#)zThe service will not serve this client without an account (or asked for something this version cannot do). Terminal for the process, like a closed gate.rBFrC)rserver_messager r)rs&r(signin_required_errorrPcs1 ^G,WW0ABV0Wbh.% AAr+c V^8dQhRRRR/#)r#valuerr$rr&)r's"r(r)r)js??#?#?r+c\V\4'gR#RPRPRV44P44p^\ V4u;8d \ 8:dV#R#)zUUser-facing copy the service sent, if it is plausibly that: a short single paragraph. c3T"TFqP4'dTMRxK R#5i)rUN) isprintable).0chs& r( !server_message..psLe.."2"2B;es&() isinstancerjoinsplitlen_MESSAGE_MAX_CHARS)rRtexts& r(rOrOjsY eS ! ! 88BGGLeLLRRT UDs4y6$664>6B>r+cV^8dQhRR/#r#r$rr&)r's"r(r)r)ws > > >r+c^RIHpHpV!4'dR#\PP R4pVeVP 4'dR#V!4'dR#R#)aV``gateway`` in the process that holds the messaging gateway's runtime lock (nobody is at its console) unless it is serving the local Desktop app, ``desktop`` for that and for the backend the desktop app spawned, else ``cli``. ``HERMES_DESKTOP`` alone is inherited by every terminal-pane shell, so desktop ownership needs the spawn credential.)is_desktop_owned_backendserves_local_desktop_nowdesktopzgateway.statusgatewaycli)hermes_cli.process_identityrerfsysmodulesgetowns_gateway_runtime_lock)rerfstatuss r(client_surfacerpwsQ _!! [[__- .F f>>@@0229==r+cV^8dQhRR/#r"r&)r's"r(r)r)sLL^Lr+c z^RIHpRRRV!4PR\4R\P R\ ./#)zThe self-reported ``client`` block on a token exchange. It sorts honest clients (which surface, which challenge primitives) for the service's rules; it proves nothing, by design.get_version_infonamez hermes-agentversionsurfaceplatform capabilities)hermes_cli.version_infort base_versionrprkrxBROWSER_CAPABILITYrss r( client_infor}s@9 NI/?/A/N/NPY[i[k  n7I6J LLr+cV^8dQhRR/#rcr&)r's"r(r)r)sXXCXr+c ^RIHpRV!4P R\4 R\P R\ P !4;'gR R2 #)rsz hermes-agent/z (z; unknown))rzrtr{rprkrxmachinerss r( user_agentrsV8,.;;<= !CLL>H4D4D4F4S4S)3TTU WXr+c$V^8dQhRRRRRR/#)r#rrr<r$rr&)r's"r(r)r)s&XXcXCXDXr+cf\V4\V4r2TPR9;'dtTPTP8H;'dS\TP4;'d6TPP 4TPP 48H# \dR#i;i)zA challenge URL is only ever opened on the portal the exchange itself went to: the response is network input, and "open this URL" must not become "open any URL".F)httpshttp)r ValueErrorschemernetloclower)rr<targetportals&& r( _same_originrs!#(A MM. . W W6==FMM3Q W WV]]# W W(. (;(;(=ATATAV(VX sB!! B0/B0c$V^8dQhRRRRRR/#)r#rRrdefaultrr$r&)r's"r(r)r)s!35r+c\V\4'g9\V\\34'd\P !V4'gV#\V4#N)r\rrrmathisfinite)rRrs&&r(_numberrs=%je &E&ET]][`MaMa <r+c$V^8dQhRRRRRR/#)r#payloadr%r<rr$Optional[BrowserChallenge]r&)r's"r(r)r)s"^cNhr+cVPR4p\V\4'gR#\VPR44;'g\pVEF$p\V\ 4'dVPR4R8wdK2VPR4p\V\ 4'd(VP4'd\WQ4'g\PR4K\WTPR4R J\\\\\!VPR 4\"444\\$\\&\!VPR 4R 444VR 7u# R#)zNThe first challenge in ``payload["challenges"]`` this client can run, or None. challengesNrr-r.rzBNous free tier: ignoring a challenge URL outside the portal originrFrrg@)rrrrr)rmr\listrOCHALLENGE_COPYdictrrWrloggerinformin_EXPIRES_MAX_SECONDSmax_EXPIRES_MIN_SECONDSr_EXPIRES_DEFAULT_SECONDS_POLL_MAX_SECONDS_POLL_MIN_SECONDS)rr<entriesrentryrs&& r(parse_browser_challengerskk,'G gt $ $W[[34FFG%&&%))F*;y*H ii#s##3??+<+r$rr&)r's"r(r)r)s2 8 8^ 8 8RU 8 . 83< 8r+cP\W4pVf \4#\WAVVR7#)zThe error for a 428 ``challenge_required``: a challenge to work, or (nothing offered that this version can run) the sign-in fallback.)r<r=r>)rrPr9)rr<r=r>r;s&$$$ r(challenge_errorrs2(AI$&& Xb,6 88r+c]tRt^t$Rt]!]PR7tR] R&Rt R] R&Rt R ] R &Rt R ] R &Rt R ] R &RtR#)_ProfileChallengezOne profile's challenge state, behind ``_state_lock``. ``work_lock`` serialises waits PER PROFILE (a sibling profile's wait must not queue behind it).)default_factoryzthreading.Lock work_lockNrpendinggrdeadline Optional[str]outcome gave_up_untilr&)r2r3r4r5rKr threadingLockrr6rrrrr7r&r+r(rrsDD %inn EI~E*.G '.He!G]!M5r+rzdict[str, _ProfileChallenge] _profileszset[str] _opened_urlsanon_challenge_backgroundF)rzcontextvars.ContextVar[bool] _backgroundc#"\PR4pRx\PV4R# \PT4i;i5i)zMark the enclosed token reads as background work (a keepalive tick, a status paint): a challenge is announced to a desktop client but never waited on, printed, or opened.TN)rsetreset)tokens r(background_callerrs9 OOD !E! % % sA4AA  AcV^8dQhRR/#)r#r$rr&)r's"r(r)r)sKK#Kr+c\;_uu_4\P\4\ 44uuRRR4# +'giR#;i)zSThis profile's record. Callers hold ``_state_lock`` for anything but ``work_lock``.N) _state_lockr setdefaultrrr&r+r(_profilers* ##N$46G6IJ s &A A c V^8dQhRRRR/#)r#recordrr$rr&)r's"r(r)r)s#(Br+cVP'd4VP\P!48:dRRuVnVnVP#r)rrtime monotonicrrs&r(_livers7 ~~~&//T^^-==)-t& >>r+cV^8dQhRR/#)r#r$zOptional[dict[str, Any]]r&)r's"r(r)r)s g g3 gr+c b\4p\;_uu_4\V4pVeVPR9d RRR4R#/VP 4CR\ P !VP\P!4, 4/CuuRRR4# +'giR#;i)aThe challenge this profile is waiting on, for ``free_tier.status`` (a client that connected after the event fired still learns it has a window to open). None once cleared or expired, or once the host said how its window ended (a window the user closed must not come back).Nr)Ntimeouterror) rrrrr0rceilrrr)rr;s r(pending_challengersxZF &M  6P P g)&&(f, &//TXTbTbTdBd8ef s"BA B B. cV^8dQhRR/#r#r$r?r&)r's"r(r)r)s444r+c\4p\;_uu_4RRuVnVnRRR4R# +'giR#;ir)rrrrrs r(_clear_pendingrs* ZF )-t& s 3 A c$V^8dQhRRRRRR/#)r#r;r new_attemptrr$r&)r's"r(r)r)s#'BRr+c0\4p\;_uu_4\V4p\P!4VP ,pVeVP VP 8wd#\V^R7VRuVnVn Vn MbV'dVP^,M VPp\WR7\WBP4uVnVn V'dRVn VPuuRRR4# +'giR#;i)aRecord *challenge* as the profile's pending one. A replay of the same ticket (a background read, a second 428) keeps the original deadline, attempt and host outcome; ``new_attempt`` (a foreground caller about to wait) bumps the attempt, which lets it reopen a window the user closed.N)r ) rrrrrrrrrrrr r)r;rrpreviousrr s&$ r(_recordrsZF =>>#i&:&::  x||y}}<>EiYZ>[]egk ;FNFOV^.9h&&*x?O?OG.5i.QSVW_apapSq +FNFO!%~~ sA:DA%D D c(V^8dQhRRRRRRRR/#)r#rrr rrr$rr&)r's"r(r)r)s(  S 3   r+c\4p\;_uu_4\V4pVeVPVP3W38wd RRR4R#W#nRRR4R# +'giR#;i)zA presentation hint: wakes a waiter to re-mint, never grants clearance locally. A late reply belongs to the attempt that opened the window, not to a newer retry.NFT)rrrrr r)rr rrr;s&&& r(record_host_outcomersWZF &M   0A0A Bsn T ! s/A#A## A4 c V^8dQhRRRR/#)r#r;rr$rr&)r's"r(r)r)&s33-3-3r+c.\4p\;_uu_4VPpVRJ;'d2VPVP3VPVP38HpV'd VP MRuuRRR4# +'giR#;ir)rrrrr r)r;rrmatchess& r( _host_outcomer&sb ZF ..%nn7;;*HY]]\e\m\mLn*n!(v~~d sAB+ B B cV^8dQhRR/#rr&)r's"r(r)r).sLL$Lr+c\4p\;_uu_4\P!4\,VnRRR4R# +'giR#;ir)rrrr_GAVE_UP_COOLDOWN_SECONDSrrs r(_give_upr.s/ ZF #~~/2KK s &A  A cV^8dQhRR/#)r#r$rr&)r's"r(r)r)4s7747r+c\4p\;_uu_4\P!4VP8uuRRR4# +'giR#;ir)rrrrrrs r(_gave_up_recentlyr4s/ ZF ~~&"6"66 s "A A cV^8dQhRR/#rr&)r's"r(r)r):sr+c\;_uu_4\P4\P4RRR4R# +'giR#;ir)rrclearrr&r+r(reset_for_testsr:s)  s )A A c V^8dQhRRRR/#)r#r;rr$rr&)r's"r(r)r)Cs)dr+c\PPR4pVfR#VP\VP 44R# \ \3d'p\PR\T4Rp?R#Rp?ii;i)a Broadcast to connected desktop clients. False when this process is not a gateway at all (``HERMES_DESKTOP`` is an env var, and a CLI the desktop spawned inherits it): importing the gateway here just to find nobody listening would also write an event frame to stdout.tui_gateway.serverNFz%s not broadcast: %sT) rkrlrm_broadcast_global_eventCHALLENGE_EVENTr0OSErrorrrdebug)r;serverexcs& r( _announcerCso[[__1 2F ~&& 8L8L8NO  Z   +_cB s$A BA??Bc V^8dQhRRRR/#r#r;rr$r?r&)r's"r(r)r)Tscc$4ccr+c^RIHpHpRpVP\9pV'gz\ 4R8wdkV!4'g^V!4'dQ^RIp\VPVP44pV'd \PVP4\RVP 2\ P"R7\RVP 2\ P"R7\V'g V'dR MR \ P"R7R# TP\3d!p\PRT4Rp?LRp?ii;i) r)_can_open_graphical_browser_is_remote_sessionFrhNz-could not open the challenge in a browser: %s filez Open: z (Opened in your browser.) z> (Open that link in any browser; this continues on its own.) )hermes_cli.auth_device_flowrrrrrp webbrowserropenErrorrrraddprintrrkstderr)r;rropened already_openrrs& r(_present_in_terminalr Ts[ F==L0L ^-:&((-H-J-J O*//)--89F    Y]] + By  ! "4 HY]]O $3::6 V| )PWZWaWac   '* O LLH# N N Os$DE5EEc V^8dQhRRRR/#rr&)r's"r(r)r)is $ $' $D $r+cL\4R8Xd\V4'dR#VP'd\P 4'dR#\ P P R4pVe&VP'd\V4'dR#\V4R#)aLGet the URL in front of something that can load it. The desktop backend hands every challenge to its hidden window. The stdio TUI gateway (whose stderr the TUI keeps as a log, never shows) hands its client a required one a foreground caller is waiting on: a background read there must not pop a browser any more than in a terminal.rgNr) rprrrrmrkrl_stdio_is_rpc_channelr )r;rs& r(presentrisp 9$9)=)=    !2!2 [[__1 2F f:::y?S?S#r+c(V^8dQhRRRRRRRR/#)r#clientz httpx.Clientr<rr=r$r&)r's"r(r)r)|s)<<<<>]^'4gz=RT (&& , ,1E1E1L"*"6"6#"=x}}4$.dD#9#9TXXh tF ,,6;); OOZ ( 7=sAC!#CD"C??Dc V^8dQhRRRR/#)r#rr9r$rr&)r's"r(r)r)s!!1!d!r+c^RIHp^RIHp\ 4'dR#VP p\ P!4\\VP4,pV!VPR7pRpV!RV4;_uu_4p\WpPVP4\9d RRR4R#\!VRR7;q0n\#V4\ P!4V8d\%V4e RRR4R#\'VP(4\WpPVP4pV\9d RRR4R#VR 8XgKV'dKRp\+4R 8wgK\-R \.P0R 7KRRR4\34R# +'giL;i) aWPresent *exc*'s challenge and poll until status or a host hint ends the wait. True = a result arrived; False = patience ran out. Re-mint is authoritative in either case. Called under the profile's work lock. A caller that queued behind another finds the ticket already settled on its first status read and returns without presenting anything.)_resolve_verify)_nous_http_clientF)r>g$@NTrneeds_interactionrgz5 Finish the quick check in your browser to continue.r)hermes_cli.authrhermes_cli.auth_nousr rr;rrrCHALLENGE_WAIT_SECONDSrr>rr<r=_WAITINGrrr_sleeprrprrkrr) rrr r;rverifytold_interactiverros & r(wait_for_challenger*sQ 06 I~~#&R>R"SSH 7F 4 ( (F  3 3S^^ DH T ) (%,I4$HH M nn)Y'3 ) ( 9%% &!&*=*=s~~NFX% ) (,,5E5E#' !#y0QX[XbXbc* )  J # ) (s2+F-:AF- AF-F-F-(F-;F-- F= c V^8dQhRRRR/#)r#causer9r$rr&)r's"r(r)r)s/Ir+c\VP4'dRM\\,p\ VR\RR7pWnV#)z+The quick check couldn't finish. Try again.rBTrC)rr;r r r __cause__)r,rrs& r(_still_pendingr/s>@Meoo@^@^<%&=> g5LX\ ]EO Lr+c V^8dQhRRRR/#)r#exchangezCallable[[], T]r$rr&)r's"r(r)r)s"""Q"r+cdV!4# \d pTpRp?MRp?ii;i\P4'g\4R8Xd,\ \ TP RR74\T4h\4P;_uu_4\T4RRR4M +'giM;iT!4# \d7p\ TP RR7Tn\4\T4hRp?i\d#pTP'g \4hRp?ii;i)a+Run *exchange*; if the service asks for a browser challenge, work it (outside every lock: the exception has already unwound them) and run *exchange* once more. A background caller (:func:`background_caller`) never waits: the challenge is announced so a desktop client can start clearing it, and the retryable error goes straight back. A second ``challenge_required`` is not looped on: it surfaces as a retryable error whose copy says what the user can do, the callers queued behind it fail fast for a while, and the next attempt resumes the same ticket.NrhFr!)r9rrmrprrr;r/rrr*rrrFr)r1rfirstagainrs& r(run_with_challenger5sz N, 9U;<U##    5!     z $"%//uE U##    sF   B(( B8 <C D/1C?? D/ D/ D**D/c$V^8dQhRRRRRR/#)r#rr%r<rr$r?r&)r's"r(r)r)s!99n9s9t9r+c\W4pVf \4R#VP'g*\4R8Xd\ \ VRR74R#R#R#)zA successful exchange may advertise a challenge nobody has to pass (the service is measuring before it enforces). Only a desktop client runs it, hidden; a terminal never opens a browser for something optional. Fire and forget.NrgFr!)rrrrprr)rr<r;s&& r(note_optional_challengesr8sH(AI    N$4 $A')78%B r+r)rr")Z__conditional_annotations__rK __future__r contextlib contextvarsloggingrrxrkrr dataclassesrrrtypingrrrr r urllib.parser hermes_cli.anon_authr r rrrhermes_cli.auth_constantsrr getLoggerrr|rr%rrrrrr`rrrrr9rPrOrpr}rrrrrrrrrr6rr ContextVarrcontextmanagerrrrrrrrrrrrrr rrr&sleepr'r*r/r5r8)r9s@r(rGs>#   1199!ee6   , -!' '*C$$GKUTYD*,D!U CL $ f f f %I %A? >LXX , 8  nn *, ', h-8,B,BC^hm,n )n !!K  g4 $ 3L 7 "c* $&<* , !H"J9r+