+
    jHàj-A  ã                  óÖ  € R t ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	H	t	H
t
Ht ^ RIHtHtHtHtHt ^ RIHtHtHtHtHtHtHt ]'       d   ^ RIHt ]P8                  ! R4      tR4tR]/R	 R
 lltR R lt R R lt!R R lt"R R lt#R R lt$R R lt%R R lt&RR/R R llt'RRRRR R!/R" R# llt(R R!R$R%/R& R' llt)R( R) lt*R* R+ lt+R, R- lt,R.]R/R%/R0 R1 llt-R2 R3 lt.R# )5zêMiniMax OAuth (user-code grant) login, refresh and runtime credentials.

Split out of ``hermes_cli/auth.py``; origin helpers are imported lazily per function so
``hermes_cli.auth.<helper>`` patches still intercept and no cycle forms.
)ÚannotationsN)ÚdatetimeÚtimezoneÚUTC)ÚAnyÚCallableÚDictÚOptionalÚTYPE_CHECKING)Ú	AuthErrorÚMINIMAX_OAUTH_GRANT_TYPEÚ"MINIMAX_OAUTH_REFRESH_SKEW_SECONDSÚMINIMAX_OAUTH_SCOPEÚ_FORM_JSON_HEADERSÚ_minimax_errÚhttpx)ÚProviderConfigzhermes_cli.authÚlimitc               ó$   € V ^8„  d   QhRRRRRR/# )é   Úresponseúhttpx.Responser   ÚintÚreturnÚstr© )Úformats   "Ú</home/ubuntu/.hermes/hermes-agent/hermes_cli/auth_minimax.pyÚ__annotate__r      s"   € ÷ ñ ¨>ð ÀSð Ðorñ ó    c               óŽ  € \        ^ \        V4      4      p \        V RR4      '       d;   V P                  pVRV \	        V4      V8”  d   RMR,           V P                  4        # . p^ pV P                  4        FP  pV'       g   K  VP                  VRV^,           V,
           4       V\	        VR
,          4      ,          pWA8”  g   KP   M	  RP                  V4      pVRV P                  V P                  ;'       g    RRR	7      pT\	        V4      V8”  d   RMR,           V P                  4        #   T P                  4        i ; i)zCReturn a bounded error body from a streamed MiniMax OAuth response.Úis_stream_consumedFNz...[truncated]Ú r   zutf-8Úreplace)Úerrorséÿÿÿÿ)Úmaxr   ÚgetattrÚtextÚlenÚcloseÚ
iter_bytesÚappendÚjoinÚdecodeÚencoding)r   r   r(   ÚchunksÚtotalÚchunkÚraws   &$     r   Ú_minimax_response_error_textr4      s  € ä�”3�u“:Ó€EðÜ�8Ð1°5×9Ò9Ø—=‘=ˆDØ˜˜�<´s¸4³yÀ5Ô7HÑ#3ÈbÕQð 	�‰Õð !ˆØˆØ×(Ñ(Ö*ˆEßÙØ�M‰M˜%Ð 3 %¨!¥)¨eÕ"3Ð4Ô5Ø”S˜ �“_Õ$ˆEØŽ}Ùñ +ð �h‰h�vÓˆØ�6�Eˆ{×!Ñ! (×"3Ñ"3×">Ð">°wÀyÐ!ÓQˆØ¬3¨s«8°eÔ+;Ñ'ÀÕDà�‰Õøˆ�‰Õús   —<D2 Á$AD2 Ã5D2 Ã>#D2 Ä2Ec          
     ó,   € V ^8„  d   QhRRRRRRRRR	R
/# )r   Úclientúhttpx.ClientÚurlr   Údataúdict[str, Any]Úheaderszdict[str, str]r   r   r   )r   s   "r   r   r   5   s1   € ÷ ñ ˜|ð °#ð Àð ÐYgð Ðlzñ r   c          	     ó’   € V P                  V P                  RWVR7      RR7      pVP                  ^È8X  d   VP                  4        V# )z?POST a MiniMax OAuth form without eagerly reading error bodies.ÚPOST©r9   r;   T)Ústream)ÚsendÚbuild_requestÚstatus_codeÚread)r6   r8   r9   r;   r   s   &&$$ r   Ú_minimax_post_formrD   5   sD   € à�{‰{˜6×/Ñ/°¸ÐPWÐ/ÓXÐaeˆ{Óf€HØ×Ñ˜sÔ"Ø�‰ŒØ€Or   c               ó   € V ^8„  d   QhRR/# )r   r   Útupler   )r   s   "r   r   r   =   s   € ÷ :ñ :˜Eñ :r   c                 ó&  € ^ RI p V P                  ^@4      R,          p\        P                  ! \        P
                  ! VP                  4       4      P                  4       4      P                  4       P                  R4      pWV P                  ^4      3# )zGGenerate (code_verifier, code_challenge_S256, state) for MiniMax OAuth.N:Né`   NÚ=)
ÚsecretsÚtoken_urlsafeÚbase64Úurlsafe_b64encodeÚhashlibÚsha256ÚencodeÚdigestr.   Úrstrip)rJ   ÚverifierÚ	challenges      r   Ú_minimax_pkce_pairrU   =   sn   € ãØ×$Ñ$ RÓ(¨Õ-€HÜ×(Ò(¬¯ª¸¿¹Ó8IÓ)J×)QÑ)QÓ)SÓT×[Ñ[Ó]×dÑdÐehÓi€IØ × 5Ñ 5°bÓ 9Ð9Ð9r   c               ó0   € V ^8„  d   QhRRRRRRRRRRRR	/# )
r   r6   r7   Úportal_base_urlr   Ú	client_idÚcode_challengeÚstater   r:   r   )r   s   "r   r   r   E   s<   € ÷ ñ ØðØ.1ðØ>AðØSVðØ_bðàñr   c               ó´  € \        V V R 2RRRVR\        RVRRRV// \        CR	\        \        P
                  ! 4       4      /CR
7      pVP                  ^È8w  d/   \        V4      p\        RT;'       g    VP                   2R4      hVP                  4       pR F  pW‡9  g   K  \        RV 2R4      h	  VP                  R4      V8w  d   \        RR4      hV# )z/oauth/codeÚresponse_typeÚcoderX   ÚscoperY   Úcode_challenge_methodÚS256rZ   zx-request-idr>   z$MiniMax OAuth authorization failed: Úauthorization_failedz&MiniMax OAuth response missing field: Úauthorization_incompletez-MiniMax OAuth state mismatch (possible CSRF).Ústate_mismatch)Ú	user_codeÚverification_uriÚ
expired_in)rD   r   r   r   ÚuuidÚuuid4rB   r4   r   Úreason_phraseÚjsonÚget)	r6   rW   rX   rY   rZ   r   ÚbodyÚpayloadÚfields	   &$$$$    r   Ú_minimax_request_user_codero   E   sô   € ô "ØØÐ
˜;Ð'à˜V [°)¸WÔFYØ˜nÐ.EÀvÈwÐX]ð
ð JÔ%ÐI ~´s¼4¿:º:»<Ó7HÑIô€Hð ×Ñ˜sÔ"Ü+¨HÓ5ˆÜÐAÀ$×B`ÐB`È(×J`ÑJ`ÐAaÐbÐdzÓ{Ð{Ø�m‰m‹o€GÛ@ˆØÖÜÐ!GÈÀwÐOÐQkÓlÐlñ Að ‡{�{�7Ó˜uÔ$ÜÐJÐL\Ó]Ð]Ø€Nr   c               ó$   € V ^8„  d   QhRRRRRR/# )r   rf   r   Únow_msr   Úboolr   )r   s   "r   r   r   ]   s!   € ÷ +ñ +°sð +Àsð +Ètñ +r   c               ó,   € \        V 4      V^,          8„  # )zMTrue if ``expired_in`` is plausibly a unix-ms absolute time (vs TTL seconds).)r   )rf   rq   s   &$r   Ú&_minimax_expired_in_looks_like_unix_msrt   ]   s   € äˆz‹?˜f¨�kÑ*Ð*r   c               ó$   € V ^8„  d   QhRRRRRR/# )r   rf   r   Únowr   r   Úfloatr   )r   s   "r   r   r   b   s!   € ÷ )ñ )°3ð )Àð )ÈUñ )r   c               óÎ   € \        V 4      p\        V\        VP                  4       R,          4      R7      '       d
   VR,          # VP                  4       \        ^V4      ,           # )zRReturn access-token expiry as unix seconds (MiniMax uses ms epoch or TTL seconds).iè  )rq   ç     @�@)r   rt   Ú	timestampr&   )rf   rv   r3   s   &$ r   Ú"_minimax_resolve_token_expiry_unixr{   b   sJ   € ä
ˆj‹/€CÜ-¨c¼#¸c¿m¹m»oÐPTÕ>TÓ:U×VÓVØ�V�|ÐØ�=‰=‹?œS  C›[Õ(Ð(r   c               ó    € V ^8„  d   QhRRRR/# )r   rf   r   r   r:   r   )r   s   "r   r   r   j   s   € ÷ ñ  sð ¨~ñ r   c                ó,  € \         P                  ! \        4      p\        \	        V 4      VR7      pRVP                  4       R\         P                  ! V\        R7      P                  4       R\        ^ \	        W!P                  4       ,
          4      4      /# )zX``obtained_at`` / ``expires_at`` / ``expires_in`` derived from a MiniMax ``expired_in``.©rv   Úobtained_atÚ
expires_at)ÚtzÚ
expires_in)	r   rv   r   r{   r   Ú	isoformatÚfromtimestampr&   rz   )rf   rv   Úexpires_at_unixs   &  r   Ú_minimax_expiry_fieldsr†   j   sj   € ä
�,Š,”sÓ
€CÜ8¼¸Z»ÈcÔR€Oà�s—}‘}“Ø”h×,Ò,¨_ÄÔE×OÑOÓQØ”c˜!œS ·=±=³?Õ!BÓCÓDðð r   c               ó8   € V ^8„  d   QhRRRRRRRRRRRR	R
RRR/# )r   r6   r7   rW   r   rX   rd   Úcode_verifierrf   r   Úinterval_mszOptional[int]r   r:   r   )r   s   "r   r   r   u   sX   € ÷ )]ñ )]Øð)]Ø.1ð)]Ø>Að)]àð)]à#&ð)]à47ð)]àFSð)]ð ñ)]r   c               óì  a€ \        V\        P                  ! \        4      R 7      p\	        RT;'       g    RR,          4      p\
        P
                  ! 4       V8  Ede   \        V V R2R\        RVRVRV/\        R	7      p	V	P                  ^È8w  d{   \        V	4      p
 V
'       d   \        P                  ! V
4      M/ oSP                  R
/ 4      ;'       g    / P                  R4      ;'       g    T
p\        RT;'       g    R 2R4      h V	P                   '       d   V	P                  4       M/ oSP                  R4      pVR8X  d   \        RR4      hVR8X  dO   \"        ;QJ d    V3R lR 4       F  '       d   K   RM	  RM! V3R lR 4       4      '       g   \        RR4      hS# \
        P$                  ! V4       EK  \        RR4      h  \         d    / o EL!i ; i  \         d    / o LÁi ; i)r~   g       @iÐ  ry   ú/oauth/tokenÚ
grant_typerX   rd   rˆ   r>   Ú	base_respÚ
status_msgzMiniMax OAuth error: ÚunknownÚtoken_exchange_failedÚstatusÚerrorz8MiniMax OAuth reported an error. Please try again later.Úauthorization_deniedÚsuccessc              3  óF   <"  € T F  pSP                  V4      x € K  	  R # 5i©N)rk   )Ú.0Úkrm   s   & €r   Ú	<genexpr>Ú&_minimax_poll_token.<locals>.<genexpr>˜   s   øé € Ð_Ñ/^¨!�w—{‘{ 1—~�~Ó/^ùs   ƒ!FTz<MiniMax OAuth success payload missing required token fields.Útoken_incompletez7MiniMax OAuth timed out before authorization completed.Útimeout)Úaccess_tokenÚrefresh_tokenrf   )r{   r   rv   r   r&   ÚtimerD   r   r   rB   r4   rj   ÚloadsÚ	Exceptionrk   r   r(   ÚallÚsleep)r6   rW   rX   rd   rˆ   rf   r‰   ÚdeadlineÚintervalr   Ú
error_textÚmsgr‘   rm   s   &$$$$$$      @r   Ú_minimax_poll_tokenr¨   u   s¹  ø€ ô
 2°*Ä(Ç,Â,ÌsÓBSÔT€HÜ�3˜×,Ð,¨°Õ6Ó7€Hä
�)Š)‹+˜Õ
 Ü%ØØÐ˜|Ð,àÔ6¸ÀYØ˜Y¨¸ðô 'ô
ˆð ×Ñ 3Ô&Ü5°hÓ?ˆJðß4>œ$Ÿ*š* ZÔ0ÀB�ð —;‘;˜{¨BÓ/×5Ð5°2×:Ñ:¸<ÓH×VÐVÈJˆCÜÐ!6°s×7GÐ7G¸iÐ6HÐIÐKbÓcÐcð	Ø)1¯¯¨�h—m‘m”o¸BˆGð —‘˜XÓ&ˆØ�WÔÜÐYÐ[qÓrÐrØ�YÔß“3Ô_Ñ/^Ó_—3—3’3Ô_Ñ/^Ó_×_Ò_Ü"Ð#aÐcuÓvÐvØˆNä�
Š
�8×ä
ÐPÐR[Ó
\Ð\øô' ô Ø“ðûô ô 	ØŠGð	ús*   Â G ÄG# ÄG# ÇG ÇG Ç#G3Ç2G3Ú
set_activeTc               ó$   € V ^8„  d   QhRRRRRR/# )r   Ú
auth_stater:   r©   rr   r   ÚNoner   )r   s   "r   r   r   ¡   s"   € ÷ %ñ %¨ð %Èð %ÐX\ñ %r   c          	     óª   € ^ RI HpHpHpHp V! 4       ;_uu_ 4        V! 4       pV! VRWR7       V! V4       RRR4       R#   + '       g   i     R# ; i)un  Persist MiniMax OAuth state to Hermes auth store (~/.hermes/auth.json).

``set_active=False`` rewrites credentials without making minimax-oauth the
active provider (``_save_provider_state_to_source``'s rule: a token refresh
rewrites credentials, not the user's choice of provider); only
``_minimax_oauth_login`` â€” the user just chose the provider â€” sets active.
)Ú_auth_store_lockÚ_load_auth_storeÚ_save_auth_storeÚ_store_provider_stateúminimax-oauth©r©   N)Úhermes_cli.authr®   r¯   r°   r±   )r«   r©   r®   r¯   r°   r±   Ú
auth_stores   &$     r   Ú_minimax_save_auth_stater¶   ¡   s?   € ÷ lÓkÙ	×	Õ	Ù%Ó'ˆ
Ù˜j¨/¸:Õ]Ù˜Ô$÷ 
×	×	Ò	ús   œAÁA	ÚregionÚglobalÚopen_browserÚtimeout_secondsç      .@c               ó(   € V ^8„  d   QhRRRRRRRR/# )	r   r·   r   r¹   rr   rº   rw   r   r:   r   )r   s   "r   r   r   °   s*   € ÷ 9ñ 9 Cð 9À$ð 9Ð`eð 9Ðqñ 9r   c                ó~  € ^ RI HpHpHpHpHpHpHp	 VR,          p
V R8X  d(   V
P                  R,          pV
P                  R,          pMV
P                  pV
P                  pV! 4       w  rÞpV! 4       '       d   Rp\        RV  R24       \        R	V 24       \        P                  ! \        P                  ! V4      R
R/RR7      ;_uu_ 4       pV! VWºP                  WïR7      pT	! \!        VR,          4      \!        VR,          4      T;'       d    V! 4       R7       VP#                  R4      p\        R4       \%        TYºP                  \!        VR,          4      T\'        VR,          4      Ve   \'        V4      MRR7      pRRR4       RRRV RVRVRV
P                  R\(        RXP#                  RR4      RVR,          R VR ,          R!VP#                  R!4      /
\+        VR,          4      CpV! V4       \        R"4       VP#                  R#4      ;p'       d   \        R$V 24       V#   + '       g   i     L¯; i)%z?Run MiniMax OAuth flow, persist tokens, return auth state dict.)ÚPROVIDER_REGISTRYÚ_can_open_graphical_browserÚ_is_remote_sessionrU   ro   r¶   Ú_print_device_code_instructionsr²   ÚcnÚcn_portal_base_urlÚcn_inference_base_urlFz#Starting Hermes login via MiniMax (z
) OAuth...zPortal: ÚAcceptzapplication/jsonT)rœ   r;   Úfollow_redirects)rW   rX   rY   rZ   re   rd   )r¹   r¥   zWaiting for approval...rf   N)rW   rX   rd   rˆ   rf   r‰   Úproviderr·   rW   Úinference_base_urlrX   r^   Ú
token_typeÚBearerr�   rž   Úresource_urlu#   âœ“ MiniMax OAuth login successful.Únotification_messagezNote from MiniMax: )r´   r¾   r¿   rÀ   rU   ro   r¶   rÁ   ÚextrarW   rÈ   Úprintr   ÚClientÚTimeoutrX   r   rk   r¨   r   r   r†   )r·   r¹   rº   r¾   r¿   rÀ   rU   ro   r¶   rÁ   ÚpconfigrW   rÈ   rS   rT   rZ   r6   Ú	code_dataÚinterval_rawÚ
token_datar«   r§   s   $$$                   r   Ú_minimax_oauth_loginrÕ   °   s*  € ÷ N÷  Nñ  NØ Õ0€GØ�„~Ø!Ÿ-™-Ð(<Õ=ˆØ$Ÿ]™]Ð+BÕCÑà!×1Ñ1ˆØ$×7Ñ7Ðá!3Ó!5Ñ€H˜á×ÒØˆä	Ð/°¨x°zÐ
BÔCÜ	ˆH�_Ð%Ð
&Ô'ä	�ŠœeŸmšm¨OÓ<ÀxÐQcÐFdØ'+÷
-õ 
-Ø06Ù.Ø O×?PÑ?PÐajô
ˆ	ñ 	(Ü�	Ð,Õ-Ó.´°I¸kÕ4JÓ0KØ%×GÐGÑ*EÓ*Gõ	
ð
 !—}‘} ZÓ0ˆÜÐ'Ô(ä(Ø O×?PÑ?PÜ˜) KÕ0Ó1ÀÜ˜9 \Õ2Ó3Ø-9Ò-Eœ˜LÔ)È4ô	
ˆ
÷
-ð* 	�OØ�&Ø˜?ØÐ0Ø�W×&Ñ&ØÔ$Ø�j—n‘n \°8Ó<Ø˜
 >Õ2Ø˜ OÕ4Ø˜
Ÿ™ ~Ó6ðô ! ¨LÕ!9Ó
:ð€Jñ ˜ZÔ(Ü	Ð
2Ô3Ø�n‰nÐ3Ó4Ð4€sÖ4ÜÐ# C 5Ð)Ô*ØÐ÷M
-÷ 
-ús   ÃB6H,È,H<	ÚforceFc               ó(   € V ^8„  d   QhRRRRRRRR/# )r   rZ   r:   rº   rw   rÖ   rr   r   r   )r   s   "r   r   r   ì   s.   € ÷ (ñ (¨ð (ÈEð (Ðaeð (ð  sAñ (r   c               óX  a€ ^ RI Hp V P                  R4      '       g   \        RRRR7      h \        P
                  ! V P                  RR4      4      P                  4       pV'       g(   V\        P                  ! 4       ,
          \        8”  d   V # \        P                  ! \        P                  ! V4      RR
7      ;_uu_ 4       p\        VV R,           R2RRRV R,          RV R,          /\        R7      pVP                  ^È8w  d{   \!        V4      pVP#                  4       o\$        ;QJ d    V3R lR 4       F  '       g   K   RM	  RM! V3R lR 4       4      p\        RT;'       g    VP&                   2RVR7      h RRR4       XP)                  4       p	V	P                  R4      R8w  d   \        RRRR7      h/ V CRV	R,          RV	P                  RV R,          4      /C\+        V	R,          4      Cp
V! V
RR7       V
#   \         d    R	p EL³i ; i  + '       g   i     Lž; i)zBRefresh MiniMax OAuth access token if close to expiry (or forced).)r¶   rž   z:MiniMax OAuth state has no refresh_token; please re-login.Úno_refresh_tokenT©Úreloginr€   r"   g        )rœ   rÆ   rW   r‹   rŒ   rX   r>   c              3  ó,   <"  € T F	  qS9   x € K  	  R # 5ir–   r   )r—   ÚmÚ
body_lowers   & €r   r™   Ú/_refresh_minimax_oauth_state.<locals>.<genexpr>  s   øé € ÐvÑ3u¨a˜zž/Ó3uùs   ƒFzMiniMax OAuth refresh failed: Úrefresh_failedNr‘   r”   z-MiniMax OAuth refresh did not return success.r�   rf   r³   )Úinvalid_grantÚrefresh_token_reusedÚinvalid_refresh_token)r´   r¶   rk   r   r   Úfromisoformatrz   r¡   rŸ   r   r   rÏ   rÐ   rD   r   rB   r4   ÚlowerÚanyri   rj   r†   )rZ   rº   rÖ   r¶   r€   r6   r   rl   rÛ   rm   Ú	new_staterÞ   s   &$$        @r   Ú_refresh_minimax_oauth_staterè   ì   sð  ø€ å8Ø�9‰9�_×%Ò%ÜÐWÐYkÐuyÔzÐzðÜ×+Ò+¨E¯I©I°lÀBÓ,GÓH×RÑRÓTˆ
÷ �j¤4§9¢9£;Õ.Ô2TÔTØˆä	�ŠœeŸmšm¨OÓ<Èt×	TÕ	TÐX^Ü%ØØÐ&Õ'Ð(¨Ð5Ø °¸eÀKÕ>PÐRaÐchÐixÕcyÐzÜ&ô	
ˆð ×Ñ 3Ô&Ü/°Ó9ˆDØŸ™›ˆJß“cÔvÑ3uÓv—c—c’cÔvÑ3uÓvÓvˆGÜØ0°×1OÐ1O¸×9OÑ9OÐ0PÐQÐScÐmtôð ð	 '÷ 
Uð  �m‰m‹o€GØ‡{�{�8Ó 	Ô)ÜÐJÐL\ÐfjÔkÐkðØ
ðà˜ Õ/Ø˜Ÿ™ _°e¸OÕ6LÓMñô ! ¨Õ!6Ó
7ð	€Iñ ˜Y°5Õ9ØÐøôC ô Ø‹
ðú÷
 
U×	Tús*   ®4H ÃA=HÅ&HÅ,HÈHÈHÈH)	c               ó$   € V ^8„  d   QhRRRRRR/# )r   rZ   r:   Úexcr   r   r¬   r   )r   s   "r   r   r     s'   € ÷ 
Zñ 
Z¸ð 
ZÈið 
ZÐ\`ñ 
Zr   c                óô   € ^ RI HpHp VP                  '       d   V P	                  R4      '       g   R# V! V RV4        V! V RR7       R#   \
         d"   p\        P                  RT4        Rp?R# Rp?ii ; i)z_Wipe dead tokens from auth.json after a terminal refresh failure (fail fast, no network retry).)r¶   Ú_quarantine_flat_oauth_staterž   Nr²   Fr³   z6MiniMax OAuth: failed to persist quarantined state: %s)r´   r¶   rì   Úrelogin_requiredrk   r¡   ÚloggerÚdebug)rZ   rê   r¶   rì   Ú	_save_excs   &&   r   Ú-_minimax_oauth_quarantine_on_terminal_refreshrñ     sb   € çVØ× × Ð  U§Y¡Y¨×%?Ò%?ÙÙ  ¨¸Ô=ðZá  °5×9øÜô ZÜ�‰ÐMÈy×YÒYûðZús   ¿
A ÁA7ÁA2Á2A7c               ó   € V ^8„  d   QhRR/# )r   r   r:   r   )r   s   "r   r   r   $  s   € ÷ ñ ˜nñ r   c                 óH  € ^ RI Hp HpHpHp V! \        V R
4      R7      ;_uu_ 4        V! R4      pV'       d   VP                  R4      '       g   \        RRRR7      h V! V4      uuR	R	R	4       #   \         d   p\        YE4       h R	p?ii ; i  + '       g   i     R	# ; i)uð  Load the MiniMax OAuth state and refresh it if near expiry; quarantine on terminal failure.

The whole read â†’ refresh â†’ save runs inside ``_auth_store_lock`` (reentrant, so the
inner ``_minimax_save_auth_state`` re-locks harmlessly): MiniMax refresh tokens are
single-use and rotate, so two concurrent consumers (main agent + an aux task) that
both see a near-expiry token would otherwise race â€” the loser replays the consumed
token, gets ``refresh_token_reused``, and the quarantine wipes the winner's fresh
tokens. Re-reading inside the lock makes the second caller see the first caller's
new expiry and skip its own refresh. The lock timeout outlives the refresh POST so
a waiter adopts the rotated pair instead of timing out (codex pattern).
)ÚAUTH_LOCK_TIMEOUT_SECONDSr®   rè   Úget_provider_auth_state)rº   r²   r�   zMNot logged into MiniMax OAuth. Run `hermes model` and select MiniMax (OAuth).Únot_logged_inTrÚ   Ng      4@)
r´   rô   r®   rè   rõ   r&   rk   r   r   rñ   )rô   r®   rè   rõ   rZ   rê   s         r   Ú_minimax_fresh_stater÷   $  s‘   € ÷ó ñ 
¬#Ð.GÈÓ*T×	UÖ	UÙ'¨Ó8ˆß˜EŸI™I n×5Ò5ÜØ_Ø¨ôð ð	Ù/°Ó6÷ 
VÒ	Uøô ô 	Ü9¸%ÔEØûð	ú÷ 
V×	UÐ	Uús/   ¨'BÁBÁA1Á1BÁ<BÂBÂBÂB!	c               ó   € V ^8„  d   QhRR/# )r   r   zCallable[[], str]r   )r   s   "r   r   r   B  s   € ÷ :ñ :Ð,=ñ :r   c                 ó.   € R R lp ^ RI HpHp V! W4      # )zÅZero-arg callable yielding a fresh MiniMax access token.

The Anthropic SDK caches ``api_key`` at construction; MiniMax tokens live ~15 minutes, so a
static bearer would start 401-ing mid-session.
c               ó   € V ^8„  d   QhRR/# )r   r   r   r   )r   s   "r   r   Ú8build_minimax_oauth_token_provider.<locals>.__annotate__H  s   € ÷ ñ �cñ r   c                 ód   € \        4       P                  R 4      p V '       g   \        RRRR7      hV # )r�   z6MiniMax OAuth state has no access_token after refresh.Úno_access_tokenTrÚ   )r÷   rk   r   )Útokens    r   Ú_provideÚ4build_minimax_oauth_token_provider.<locals>._provideH  s/   € Ü$Ó&×*Ñ*¨>Ó:ˆßÜÐWÐYjÐtxÔyÐyØˆr   )ÚMINIMAX_OAUTHÚtag_credential_source)Úagent.credential_sourcer  r  )rÿ   r  r  s      r   Ú"build_minimax_oauth_token_providerr  B  s   € õ÷ MÙ  Ó9Ð9r   Úmin_token_ttl_secondsÚas_token_providerc               ó$   € V ^8„  d   QhRRRRRR/# )r   r  r   r  rr   r   r:   r   )r   s   "r   r   r   R  s&   € ÷ ñ Ø!ðàðð ñr   c                óˆ   € \        4       pRRRV'       d   \        4       MVR,          RVR,          P                  R4      RR	/# )
ziReturn {provider, api_key, base_url, source}; string ``api_key`` by default (``hermes status`` contract).rÇ   r²   Úapi_keyr�   Úbase_urlrÈ   Ú/ÚsourceÚoauth)r÷   r  rR   )r  r  rZ   s   $$ r   Ú)resolve_minimax_oauth_runtime_credentialsr  R  sK   € ô
 !Ó"€Eà�OØ×;LÔ5Ô7ÐRWÐXfÕRgØ�EÐ.Õ/×6Ñ6°sÓ;Ø�'ð	ð r   c               ó    € V ^8„  d   QhRRRR/# )r   rÑ   r   r   r¬   r   )r   s   "r   r   r   `  s   € ÷ ñ ¨ð ¸4ñ r   c           	     ó  € ^ RI Hp  \        \        V RR4      ;'       g    R\        V RR4      '       * \        V RR4      ;'       g    RR	7       R#   \         d"   p\        T! T4      4       \        ^4      hRp?ii ; i)
z"CLI entry for MiniMax OAuth login.)Úformat_auth_errorr·   Nr¸   Ú
no_browserFrœ   r»   )r·   r¹   rº   )r´   r  rÕ   r'   r   rÎ   Ú
SystemExit)ÚargsrÑ   r  rê   s   &&  r   Ú_login_minimax_oauthr  `  ss   € å1ðÜÜ˜4 ¨4Ó0×<Ð<°HÜ$ T¨<¸Ó?Ô?Ü# D¨)°TÓ:×BÐB¸d÷	
øô
 ô ÜÑ Ó$Ô%Ü˜‹mÐûðús"   ˆA ¡&A ÁA ÁA>ÁA9Á9A>i @  )/Ú__doc__Ú
__future__r   ÚloggingrL   rN   rj   rŸ   rg   r   r   r   Útypingr   r   r   r	   r
   Úhermes_cli.auth_constantsr   r   r   r   r   r   r   r´   r   Ú	getLoggerrî   Ú_MINIMAX_OAUTH_ERROR_BODY_LIMITr4   rD   rU   ro   rt   r{   r†   r¨   r¶   rÕ   rè   rñ   r÷   r  r  r  r   r   r   Ú<module>r     sõ   ðñõ #ã Û Û Û Û Û ß ,Ñ ,ß ?Õ ?÷÷ ñ ÷
 Ý.Ø	×	Ò	Ð,Ó	-€à"+Ð ðÐKj÷ õ0õ:õõ0+õ
)õõ)]ðX%Èt÷ %ð9¨(ð 9Èð 9Ðhl÷ 9ðx(ÐTXð (Ðhm÷ (õV
Zõõ<:ð Ø$Fðà#÷÷r   