+ jHj̔a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIH t ^RI H t H t H t HtHt^RIHt^RIHt]P(!R4t]!0R?m4tR@tRAtRR ltR R ltR R ltRRltRRltRRltRBt .t!R]"R&/t#R]"R&Rt$RRlt%RRlt&RRlt'RR lt(R!R"lt)R#R$lt*R%R&lt+R'R(lt,R)R*lt-R+R,lt.R-R.lt/R/R0lt0RCR1R2llt1R3R4lt2R5R6lt3R7R8lt4R9R:lt5!R;R<4t6R=R>lt7R#)DaSingle-use OAuth grant hygiene: strip cloned grants from profiles, heal forked grants. Split out of ``hermes_cli/auth.py`` and re-exported there; origin helpers are imported lazily inside each function so ``hermes_cli.auth.`` patches still intercept (and no import cycle). ) annotationsN)Path)AnyDictListOptionalTuple)_decode_jwt_claims)file_signaturezhermes_cli.authc V^8dQhRRRR/#blockdict[str, Any]return)formats"A/home/ubuntu/.hermes/hermes-agent/hermes_cli/auth_oauth_grants.py __annotate__r's999N9cXVPR4p\V\4'dV#T#)tokens)get isinstancedict)rrs& r _block_tokensr's' YYx F--6858rc$V^8dQhRRRRRR/#)r provider_idstrentryrrboolr)rs"rrr-s&XXsX3X4Xrc\V4'gR#VR8g;'g<\\VPR4;'gR4P 44#)Fnous refresh_token)_is_oauth_pool_payloadr rrstrip)rrs&&r_is_forkable_pool_rowr'-sI "% ( ( & W WDUYY-G-M-M2)N)T)T)V$WWrc V^8dQhRRRR/#)r rrrr r)rs"rrr7sJJ#J$Jrc\V\4'gR#\VPR4;'gR4P 4P 4R8H;'gw\ \VPR4;'gR4P 44;'g4\VPR4;'gR4PR4#)F auth_typer$oauthr# access_tokenz sk-ant-oat)rrrrr&lowerr startswith)rs&rr%r%7s eT " " EIIk " ( (b)//1779WD I I EIIo.44"5;;= > I I uyy(..B / : :< HJrc$V^8dQhRRRRRR/#)r snapshot_storer live_storerr)rs"rrrBs)KK"K0>KKrc T a^RIHpHp\P!V4pVP R4pVP R4p\ EFo\V\4'dVP S4MRp\V\4'g.p\V\4'dVP S4MRp\V\4'g.pVU u.uFp \SV 4'gKV NK p p \;QJdV3RlV4F 'gK RM RM!V3RlV44p V 'g V 'gK\V\4'g/;qTR&VU u/uFmp \V \4'gK\V P R4\4'gKBV P R4'gK[V P R4V bKo p p V P4U U u/uFwr\SV 4'gKWbK pp p V U u.uFWp \V P R4\4'dV P R4'dKA\P!V 4NKY pp .p\4pVEFHp\V\4'dVP R4MRp \V \4'dV 'dV P V 4MRp\SV4p\SV4pV'dpVeV V9dKVPV 4V'd#VP!V!VVSV!V4R74M%VP!\P!V44KV'dCV V9dKVPV 4VP!\P!V44EK7VP!V4EKK VP4U U u.uF$wrV V9gK\P!V 4NK& pp p VV,V,VS&EK VP R 4pVP R 4p\"EF?o\V\4'dVP S4MRp\V\4'dVP S4MRp\V\4;'d$\%\'V4P R 44p\V\4;'d$\%\'V4P R 44pV'g V'gK\V\4'g/;pVR &\V\4'd\P!V4VS&EK-VP)SR4EKB V#uup iuup iuup p iuup iuup p i) agRestore historical auth state without reviving spent single-use OAuth generations. Snapshot metadata may be restored onto a live grant only when its stable row id proves the lineage. Historical single-use refresh material with no live counterpart is dropped because there is no local evidence that it is still redeemable. Current live grants always survive. )_credential_token_pair_merge_pool_row_generationcredential_poolNc3<<"TFp\SV4xK R#5iN)r').0rowrs& r Hmerge_snapshot_auth_preserving_live_single_use_grants..^s" ?L !+s 3 3}sTFid) base_pair providersr#)hermes_cli.authr3r4copydeepcopyr!SINGLE_USE_REFRESH_POOL_PROVIDERSrrlistr'anyritemssetaddappend_DEVICE_CODE_BLOCK_PROVIDERSr rpop)r0r1r3r4restored snapshot_pool live_pool live_rows snapshot_rowsr9 live_grantssnapshot_has_grantslive_rows_by_idrow_idlive_grants_by_idlive_without_idmerged_snapshot consumed_ids snapshot_rowlive_row live_is_grantsnapshot_is_grant live_onlysnapshot_providerslive_providerssnapshot_block live_blocksnapshot_has_refreshlive_has_refreshrs&& @r5merge_snapshot_auth_preserving_live_single_use_grantsrcBsS}}^,HLL!23M01I88 2? &&|4Q*X 1668 8 \) DMM# 8  &5y%@?%R k"s9v"k2^^K0N33 ,d33  " "; / .$//   { +  ~t , I I]>266GH  z4 ( E E]:.22?CD $,< ,d339; ; +!6 j$ ' '.2mmJ.G { +  " "; 5;4> Oe    d sHV+VV<"V#V<V'VV>VV V$,V$c V^8dQhRRRR/#)r r9rrr r)rs"rrrs@@n@@rch\VPR4;'gR4PR4#)sourcer$ hermes_pkce)rrendswith)r9s&r _is_pkce_rowris) swwx &&B ' 0 0 ??rc V^8dQhRRRR/#)r profile_dirrrrr)rs"rrrsLLdL~Lrc ^RIHpHpR.R.R./p\V4p\FbpW, pVP 4'gVP 4'd+VP4VR,PV4KbKd VR, pVP 4'gV#^R I H pV!4R, pV!Wh4'g.VP4'dVPV4'dV#\"P$!TP'R R 74p \+T \,4'gT#R p T P/R4p \+T \,4'd\1T 4Fp T P/T 4p T \29g\+T \04'gK7T Uu.uFp\5Y4'dKTNK pp\7T4\7T 48wgKvRp TR,PT 4T'dYT &KYK T P/R4p\+T\,4'dv\8Fkp TP/T 4p\+T\,4'gK,\;T4P/R4'gKNTT TR,PT 4Rp Km T 'gT#T!YR7T# \d\PRY@RR7EKi;i \ dTu#i;i \\"P(3dR p ELi;iuupi \ d\PRTRR7T#i;i)uRemove forked single-use OAuth grants from a freshly cloned profile. Called after any path that copies credential files between profiles (``hermes profile create --clone-all``, the dashboard/TUI ``mirror_credentials`` flow). API-key pool rows are kept — a static key is safe to duplicate. Returns ``{"pool": [...provider ids], "providers": [...], "files": [...]}`` of what was stripped. Never raises: a clone must not fail because hygiene could not run — the caller logs the summary. ) _same_path_save_auth_storepoolr>filesz"Could not remove cloned %s from %sTexc_info auth.json)get_default_hermes_root utf-8-sigencodingNFr5r# target_pathz6Failed to strip cloned single-use OAuth grants from %s)r?rmrnr SINGLE_USE_OAUTH_SINGLETON_FILESis_file is_symlinkunlinkrHOSErrorloggerdebughermes_constantsrtexistssamefile Exceptionjsonloads read_textJSONDecodeErrorrrrrCrBr'lenrIr)rkrmrnstrippednametarget auth_pathrtroot_auth_pathstorechangedrorentriesekeptr>rs& r$strip_cloned_single_use_oauth_grantsrs= &KWbIH{#K0# a~~6#4#4#6#6 !((.$71k)I      <02[@ i 0 0  ! ! # # (:(:>(J(JO 9.. .DE eT " "G 99& 'D$:Khh{+G#DD%gt44&Tw!.CK.SAAwDT4yCL( '' 4(,%)& +&I)T""8KMM+.E%&&=+?+C+CO+T+Tk*%,,[9 8 `6 Ou a LL=t[_L ` ` a  T)) *U. ` DiZ^  ` O`se+K(K*7K/"K/9K/<&L)L&L&9 L+#K,+K,/ K?>K?L#"L#+#MM list[str]_oauth_heal_noticeszdict[str, tuple[Any, ...]]_oauth_heal_clean_markszoauth_heal_clean.jsonc V^8dQhRRRR/#)r fingerprinttuplerrCr)rs"rrr4s//U/t/rcV\P!\P!V44#)zbThe fingerprint as it reads back from JSON (tuples become lists), so the on-disk compare is exact.)rrdumps)rs&r _json_shaper4s ::djj- ..rcV^8dQhRR/#)r rOptional[Path]r)rs"rrr:s^rcz^RIHpV!4PR, \, # \dR#i;i)z?Where the persisted clean marks live, or None when unavailable._auth_file_pathcacheN)r?rparent_OAUTH_HEAL_CLEAN_MARK_FILENAMErrs r_oauth_heal_clean_mark_pathr:s63 '''14SSS s (+ ::c V^8dQhRRRR/#)r rrrzOptional[list]r)rs"rrrDs8838>8rc\4pVfR#\P!VPRR74p\ T\ 4'gR#TPT4p\ T\4'dT#R# \dR#i;i)uThe stored clean-mark fingerprint for ``provider_id``, or None. Pure cache read: any problem at all (absent, unreadable, corrupt, wrong shape) means "no mark", which falls through to the locked heal — the pre-existing behaviour. It must never raise into a credential path. Nrurv) rrrrrrrrrC)rpathdatastoreds& r!_persisted_oauth_heal_fingerprintrDs} ' (D |zz$..+.>? dD ! ! XXk "F--6747 s&A;; B  B c$V^8dQhRRRRRR/#r rrrrrNoner)rs"rrrXs& ] ] ]% ]D ]rcp\4pVfR#^RIHp\P!VP RR74p\V\4'g/pVP4UUu/uF7wrV\V\4'gK\V\4'gK5WVbK9 ppp\V4pVPV4V8XdR#YV&^RIHp V !VP 4V!W'RR7R# \ d/pLi;iuuppi \ d\"P%RTR R 7R#i;i) zRecord ``provider_id`` as clean for this exact fingerprint. Best-effort by design: a failed write only means the next process re-runs the heal, which is what it did before this cache existed. N)atomic_json_writerurv)mkdir_under_hermes_homei)modez1%s: could not persist the forked-OAuth clean markTrq)rutilsrrrrrrrrErrCrrrrrrr) rrrrexistingkeyvaluemarksnew_markrs && r_persist_oauth_heal_clean_markrXs ' (D |]+ zz$..+."FGH(D))H)1)9 )9:3#s# (25$(? CJ)9  {+ 99[ !X - %k< ,$E2 H   ] ?W[  ]]sQD&C5+D*D D!D'$D &D5 DDD D#D54D5c$V^8dQhRRRRRR/#rr)rs"rrr{s!===%=D=rc.V\V&\W4R#)z0Stamp the clean mark both in memory and on disk.N)rr)rrs&&r_mark_oauth_heal_cleanr{s+6K(";mrc^RIHp\V\4'gR#VP R4VP R43Fp\ V4pV'gKVP R4p\V\4'dVP R4MRpWSP R4VP R43F%pV!V4'gKVP 4uu# K R#) uStable account identity for an OAuth row when the token carries one. Codex / xAI access tokens are JWTs with ``sub`` / ``email`` / ``chatgpt_account_id`` claims; Anthropic ``sk-ant-oat`` tokens carry none (None → lineage rests on id / token material).  _nonempty_strNr,id_tokenzhttps://api.openai.com/authchatgpt_account_idsubemail)r?rrrrr r&)rrtokenclaimsnestedaccountrs& r_oauth_identityrs . eT " "))N+UYYz-BC#E* 9:6@6N6N&**12TXzz%0&**W2EFEU##{{}$G D rc V^8dQhRRRR/#)r rrrfloatr)rs"rrrs  N u rc^RIHpRUu.uFq PV4NK pp\R\ W44RR7pVR8Xd<\ VPR44PR4pV!V4;'gRpV#uupi)zBest-effort 'how recently was this pair issued' score (epoch seconds). A rotation always issues a later-expiring access token, so ``expires_at`` ordering identifies the live copy; ``last_refresh`` and the JWT ``exp`` claim are fallbacks. )_parse_absolute_timestampc38"TFq'gK VxK R#5ir7r)r8tss& rr:#_oauth_freshness..sJCrrCs  g)defaultr,exp) expires_at_ms expires_at last_refresh)agent.credential_poolrrmaxmapr )rrkstampsbestrs& r_oauth_freshnessrs @$S T$Sqiil$SF T JS!:CJTW XD s{ >!:;??F(-44 K UsBc$V^8dQhRRRRRR/#)r profile_rowr root_rowszlist[dict[str, Any]]rz Optional[int]r)rs"rrrs$,@ERrc^RIHp\V4UUu.uFwr4\V4'gKVNK pppV'gR#VP R4pVF-pV'gK W,P R4V8XgK+Vu# RFOpVP V4pV!V4'gK$VF%pW,P V4V8XgK!Vuu# KQ R#uuppi)zIndex of the root OAuth row that shares a grant lineage with *profile_row*. Only a copied row ID or shared token material establishes lineage. The same account/client can issue multiple independent grants; identity is not proof. rNr<)r#r,)r?r enumerater%r) rrrir candidatespidrp_vals && r_find_root_counterpartrs. )) 4R 48Nq8Q!! 4JR  //$ C  39<##D)S0H1$U## A|$- 1 Ss CCc$V^8dQhRRRRRR/#)r rrwinnerrr)rs"rrrs!  . . ^ rc^RIHp\V4p\F4pVP V4e W,W4&K"VP VR4K6 VP \PV44V#)zGReturn *target* carrying *winner*'s token pair, status markers cleared.)_POOL_STATUS_FIELDSN)r?rr_OAUTH_TOKEN_FIELDSrrJupdatefromkeys)rrrmergedrs&& r_adopt_oauth_materialrsZ3 &\F" ::c? & +FK JJsD ! #  MM$-- 345 Mrc V^8dQhRRRR/#)r rrrOptional[dict[str, Any]]r)rs"rrrs 0 0D 0%= 0rc\P!VPRR74p\ T\ 4'd9\TPR4;'gR4P4'gR#RTPR4RTPR4R TPR 4/# \\3dR#i;i) zDRead a ``.anthropic_oauth.json`` as a pool-row-shaped dict, or None.rurvN accessTokenr$r,r# refreshTokenr expiresAt) rrrr~ ValueErrorrrrrr&)rrs& r_singleton_as_rowrszz$..+.>? dD ! !TXXm-D-J-J)K)Q)Q)S)S/.1+. 00 Z s&B--CCc V^8dQhRRRR/#r rrrrr)rs"rrrsS=UrcV\9dR#\V4# \d\P RTRR7R#i;i)aOne-time heal for installs that ALREADY forked a single-use grant into a profile. Forked copies are one credential with several owners: whichever profile rotated last holds the only live refresh token and every other copy (root included) is spent. Runs at profile ``load_pool()`` time for ``SINGLE_USE_REFRESH_POOL_PROVIDERS``: finds profile rows sharing LINEAGE with a root row (same pool id or shared token material), keeps the freshest rotation, writes it into ROOT when root's is older, and strips the profile's copy so the profile borrows root from then on. Idempotent; never touches API-key rows; never deletes a row with no root counterpart (an independent ``hermes -p

auth add`` grant, or the only surviving copy); reads only the two auth.json files the root fallback already reads. Returns ``{"adopted", "stripped_ids", "files", "providers_block"}`` when something healed, else None. Never raises. Nz%s: forked-OAuth heal skippedTrq)rB$_heal_forked_single_use_oauth_grantsrrr)rs&r#heal_forked_single_use_oauth_grantsrsE;;3K@@  4kD Qs #AAc ,V^8dQhRRRRRRRRRR /#) r profile_storer root_storerrlineage_provenr rzOptional[bool]r)rs"rrrs4%%!%/=%LO%%%3%rca a VPR4VPR4rT\V\4'd\V\4'gR#VPV4VPV4rv\V\4'd?\V4PR4'd\V\4'd V'gR#RRlpV!V4V!V4uo o V'gE\;QJd V V 3RlR 4F 'gK RM RM!V V 3RlR 44'gR#\ S 4\ S 48p V 'd\V4WR&WBV #) aBConsolidate a forked ``providers.`` device-code block into root. *lineage_proven* carries the pool-row verdict: a profile row that matched root by copied id or shared tokens proves the fork even after both sides rotated past token equality. Root's ``load_pool()`` re-seeds its ``device_code`` row FROM this block, so leaving root's block on the spent pair would undo the pool-row heal on the next root load. Returns None when nothing matched, False when the profile copy was dropped (root already newest), True when the profile copy was fresher and was adopted into root. r>Nr#c V^8dQhRRRR/#r r)rs"rr1_heal_forked_provider_block..__annotate__sSS^SSrcB/\V4CRVPR4/C#)r)rr)rs&r_flat*_heal_forked_provider_block.._flats"R-&R .8QRRrc3<"TFApSPV4;'d$SPV4SPV48HxKC R#5ir7)r)r8rp_flatr_flats& rr:._heal_forked_provider_block..s@&4C  3>>FJJsOvzz#>>4s A ,A TF)r,r#)rrrrrDr) rrrr p_providers r_providersp_blockr_blockr adoptedrrs &&&& @@r_heal_forked_provider_blockrs  -00=z~~k?Z {D ) )jd.K.K"{3[__[5QW w % %-*@*D*D_*U*U7D))gS7^U7^NFF ##&4&###&4&##v&)9&)AAG#'=   Nrc V^8dQhRRRR/#)r prrz#Optional[tuple[int, int, int, int]]r)rs"rrr#s:::$G:rcvVeVP4MRpTe \T4#R# \dR#i;i)uFile signature from ONE stat, or None when absent — a torn pair from two stats could leave a persisted clean mark matching a store rewritten between them.N)statr~r )rsts& r _stat_sigr#sBQVVXD"$>" 9T9 s ) 88c$V^8dQhRRRRRR/#)r rrrrrztuple[Any, list[Any]]r)rs"rrr-s"88n838;P8rcVPR4p\V\4'dVPV4MRpT\V\4'dV3#.3#)uY``(store["credential_pool"], its provider_id rows-or-[])`` — pool may be None/non-dict.r5N)rrrrC)rrrorowss&& r _pool_rowsr!-sL 99& 'D$.tT$:$:488K D D$// 77R 77rc(V^8dQhRRRRRRRR/#) r auth_storerrr source_pathrrr r)rs"rrr4s, 4 4" 414 4CQ 4VZ 4rc^RIHpHpV!4p\VRJ;'d/VRJ;'d#V!W%4;'d\ W4^,4#)zTrue when a profile that owns its own pool rows would seed ``providers.`` from ROOT. Seeding that state re-copies root's single-use refresh token into the profile's pool, which is the fork #100339 forbids; the singleton seeders skip it.)_global_auth_file_pathrmN)r?r&rmr r!)r#rr$r&rm global_roots&&& rowned_profile_reads_root_stater(4s^ C(*K 4 3 3Kt$; 3 3 ;@d 3 3 z / 2 44rc$V^8dQhRRRRRR/#)r rr candidaterrr)rs"rrrAs)II I'5I:RIrcZ\V4\V48pV'd \W4#R#)zQ*target* carrying *candidate*'s pair when the candidate rotated later, else None.N)rr)rr*freshers&& r_adopt_if_fresherr-As,y),  3HDHrc]tRtRtRtRRltRRltRRltR R ltR R lt R Rlt RRlt ] RRl4t RRltRtR#) _HealPassiHzGOne heal pass over a profile store vs the root store for *provider_id*.cV^8dQhRR/#)r root_singletonrr)rs"rr_HealPass.__annotate__Ks Q Q~ Qrc WuVnVnW0nRRR.R.RR/VnR;VnVnRVn\W4wVnVn \W#4wVn Vn VPUu.uFp\V4'gKVNK upVn W@nVe)VP4'd\!V4VnR#RVnR#uupi)rF stripped_idsrpproviders_blockN)rrrsummaryprofile_changed root_changedrr!p_poolp_rowsr_poolr_rowsr%r_oauthr1rrroot_singleton_row)selfrrrr1rs&&&&& r__init___HealPass.__init__Ks.;+DO& unb'2?PRW(Y 388t0##-m#I  T[#-j#F  T[#';;L;a2H2K;L ,)n.C.C.E.E n - KO Ms 7CCc$V^8dQhRRRRRR/#)r idxintr9rrrr)rs"rrr2Zs!??3?^??rc \VPV,V4pVe'W0PV&R;VnVPR&R#R#NTr)r-r<r8r6)r?rCr9rs&&& r_adopt_root_row_HealPass._adopt_root_rowZsD"4;;s#3S9  %KK :> >D  Y 7 rc V^8dQhRRRR/#)r r9rrrr)rs"rrr2`s+++D+rc h\VPV4pVeW nRVPR&R#R#rF)r-r>r6)r?r9rs&& r_adopt_root_singleton_HealPass._adopt_root_singleton`s3"4#:#:C@  &, #&*DLL # rcV^8dQhRR/#r rrr)rs"rrr2fs888rc .pVPFp\VPV4'gVPV4K2\ W P 4pVeRVnVPW24M[VPR4R8Xd3VPe%VP'gVPV4MVPV4KVPR,PVPR44RVn K VP'dm\VP\ 4'dKV'dWPVP&R#VPP#VPR4R#R#R#)NTrfrgr4r<)r:r'rrHrr<rrGrr>r=rKr6r7rr9rrJ)r? kept_rowsr9 match_idxs& rheal_pool_rows_HealPass.heal_pool_rowsfs)! ;;C()9)93??  %.sKK@I$&*#$$Y4"m38O8O8[dhdpdpdp**3/  % LL ( / / >#'D )*    Jt{{D$A$A09 D,,-  0 0$7 %B rcV^8dQhRR/#rNr)rs"rrr2sCCTCrc VP\9dR#\VPVPVPVP 4pVe9R;VnVPR&V'dR;VnVPR&R#R#R#)NTr5r) rrIrrrrr7r6r8)r? block_results& rheal_provider_block_HealPass.heal_provider_blocks~   #? ? 2   1A1A4CVCVX  #EI ID 4<<0A#B>BB!DLL$; $rc V^8dQhRRRR/#)r profile_singletonrrrr)rs"rrr2sRRR4Rrc VeVP4'gR#^RIHpVPeV!WP4'dR#\ V4p\ VP 4;'gVPRJpVe V'gR#VPeVPV4M;\R\VP44R4pVeVPWS4VP4VPR,PVP 4R# \"d\$P'RTRR7R#i;i)N)_is_same_auth_storec3v"TF/wr\V4'gK\V4'gK+VxK1 R#5ir7)r%rir8rrs& rr:3_HealPass.heal_profile_singleton..s0C5tq*1-2>q/5s 99 9rpzcould not remove %sTrq)rr?r\r1rr r=r>rKnextrr<rGr}r6rHrr~rr)r?rZr\p_singleroot_has_grantrCs&& rheal_profile_singleton _HealPass.heal_profile_singletons"  $,=,D,D,F,F 7    */BCTViVi/j/j $%67dll+RRt/F/Fd/R  >   " " .  & &x 0Cy5CDHJC$$S3 R  $ $ & LL ! ( ():)?)? @ R LL.0ADL Q Rs+_HealPass.sync_root_singleton_with_pkce_row..s9 P141&q)./eeHo.NQ1s >> >T) r6r1r>r`rr<rrr8)r?pkce_idxpkce_row row_fresh single_freshs& r!sync_root_singleton_with_pkce_row+_HealPass.sync_root_singleton_with_pkce_rows LL # #(;(;(G''3  P9T[[1 PQUW   ;;x($X. '(?(?@  #&;Drr6N)__name__ __module__ __qualname____firstlineno____doc__r@rGrKrRrWrcrmpropertyrqr{__static_attributes__rrrr/r/HsMQ Q? + 8:CR:%0ZZ B Brr/c V^8dQhRRRR/#rr)rs"rrrsYYcY>VYrc 8^RIHpHpHpHpHpHpHpHpH p V!4p V fR#\PPR4'dQ\PPRR4p V 'd)V!V \V 4R, R, 4'dR#V!4p V Pp VR8HpV'd V R , MRpV'dV PR , MRp\V 4\!V 4\!V4\V 4\!V 4\!V43pVPV4V8XdR#\#V4\%V48XdVW`&R#V^,fV^,f\'VV4R#V!W4'd%\'VV4\(P+R W 4R#V!4;_uu_4V P-4'd V!V 4MR //pV!V R 7;_uu_4V P-4'd V!V 4MR //p\/VVVV4pVP14VP34VP5V4VP6'g \'VV4RRR4RRR4R#VP94VP:pVP<'dV\?VP@\B4'dVPDVP@V&MVVPD/VR &V !VV R 7VPFpVR,'dRVeNVeJ^RI$H%pT!VPR4;'gRVPR4VPR4VR7VPL'd!V P-4'd V !VV R 7RRR4RRR4XPOV PP4p\(PSV4VPUV4X# +'giL[;i +'giLf;i)) r_auth_store_lockr&_load_auth_storer\rrrmrnNPYTEST_CURRENT_TESTHOMEr$z.hermesrs anthropic.anthropic_oauth.jsonz3%s: forked-OAuth heal skipped, %s is the root storer>rxr5r)_write_hermes_oauth_credentialsr,r#r)r)+r?rrr&rr\rrrmrnosenvironrrrrrrrrrrrr/rRrWrcrqrmr6r8rr;rr<r>agent.anthropic_credentialsrr7r{rinforH)rrrr&rr\rrrmrn root_path real_home_env profile_path profile_home is_anthropicrZr1rrrrunr6 singleton_rowrmessages& rrrsZ'(I zz~~+,, vr2 Z 4 3F3RU`3`aa"$L&&L+-LBN '>>TXCOY%%(??UYN L9\2I>O4P I ),i.GK"";/;>)5Q/:,1~+a."8{K8<33 {K8 JKf   .:.A.A.C.C \ *+WYIZ  ) 4 48A8H8H8J8J))4Q\^`PaJM:{NSC     # # %  & &'8 9999&{K@5    1 1 3kkGcjj$//.1jjCJJ{+5@#**4MJ01 C22My!!n&@]E^W/!%%n5;;]=N=N=_!%%o6~O"""|':':'<'< LI15 8jj**+G KKw' N95 4  sP;4P /BO6 0P -O6 0A/O6 'O6 :O6 O6  O6 #P 6 P P  P >r"r xai-oauth openai-codex)r)rrr")r,r#rrr)F)8__conditional_annotations__r __future__rr@rloggingrpathlibrtypingrrrrrhermes_cli.auth_constantsr rr getLoggerr frozensetrBrzrIrr'r%rcrirrr__annotations__rrrrrrrrrrrrrrrrr!r(r-r/r)rs@rrs #  338    , -%..`$a!$> E9 XJKZ@L^T"$Y#7938#:/ 8( ]F= * 2  0.%P:8 4IJBJBZYr