+ jHj_p Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RIH t ^RI H t H t H t Ht^RIHt^RIHtHt^RIHtHtHtHtHtHtHtHtHtHtHtH t ^RI!H"t"]'d^R I#H$t$]PJ!R 4t&R t'R R lt(RRlt)RRlt*RRlt+RR/RRllt,RRlt-RRRRRRRRR R/R!R"llt.R#R$lt/RQR%R&llt0R'R(lt1R)R*lt2R+R,lt3R-R.lt4R/R0lt5RRR1R2llt6R3R4lt7R5RR6R7/R8R9llt8RR/R:R;llt9R<R=lt:R>R?lt;R@RARBRRCR/RDRElltRLRMlt?R6R7RNR/RORPllt@R#)SzxAI Grok OAuth: token store, discovery, refresh, device-code login. Split out of ``hermes_cli/auth.py``; origin helpers are imported lazily per function so ``hermes_cli.auth.`` patches still intercept and no cycle forms. ) annotationsN)Path)AnyDictOptional TYPE_CHECKING)urlparse)_load_auth_store_maybe_locked_refresh_payload_access_token) AUTH_LOCK_TIMEOUT_SECONDS AuthErrorDEFAULT_XAI_OAUTH_BASE_URLDEVICE_CODE_GRANT_TYPE%XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDSXAI_OAUTH_CLIENT_IDXAI_OAUTH_DEVICE_CODE_URLXAI_OAUTH_DISCOVERY_URLXAI_OAUTH_SCOPE_FORM_JSON_HEADERS_xai_errhttpx) env_float)ProviderConfigzhermes_cli.authz$Re-authenticate with `hermes model`.c V^8dQhRRRR/#)valuerreturnstr)formats"8/home/ubuntu/.hermes/hermes-agent/hermes_cli/auth_xai.py __annotate__r! s$$#$#$cH\T;'gR4P4#))rstrip)rs&r _cleanr& s u{{  ! ! ##r"c V^8dQhRRRR/#)rtokensrrztuple[str, str]r)rs"r r!r!$sSSSSr"c\V\4'gR#\VPR44\VPR443#)zV``(access_token, refresh_token)`` stripped; empty strings when *tokens* is not a dict. access_token refresh_token)r$r$) isinstancedictr&getr(s&r _token_pairr0$s; fd # # &**^, -vfjj6Q/R RRr"c V^8dQhRRRR/#)r auth_storedict[str, Any]rOptional[dict[str, Any]]r)rs"r r!r!+s66N6?W6r"c ^RIHpV!VR4p\V\4'd,\ \ VP R444'dV#VP R4p\V\4'dVP R4MRp\V\4'dTMR Fp\ V4wrgV'd V'gK"\T;'g/4pRTRTR\VP R4;'gR 4/VR&VP R 4'dVP R 4VR &VPR R 4Vu# \V\4'dV#R#)zEReturn usable xAI OAuth state from provider state or credential pool.)_load_provider_state xai-oauthr(credential_poolNr*r+ token_typeBearer last_refresh auth_mode oauth_pkcer) hermes_cli.authr6r,r-allr0r.listr setdefault) r2r6stater8entriesentryr*r+mergeds & r _xai_oauth_state_from_storerF+s+4 [ 9E%3{599X3F'G#H#H  nn%67O2<_d2S2So!!+.Y]G&w552=&1%&8# = ekkr" L/= #eii 5AAB x 99^ $ $%*YY~%>F> "+|4 >ud++555r"c V^8dQhRRRR/#)rrBr4rboolr)rs"r r!r!EsMM.FM4Mr"cx\V\4;'d$\\VP R444#r/)r,r-r?r0r.)rBs&r "_xai_oauth_state_has_usable_tokensrJEs* eT " L Ls;uyy7J+K'LLr"_lockTc V^8dQhRRRR/#)rrKrHrr3r)rs"r r!r!IsT^r"c F^RIHp\\V44p\ V4'g$\V!44p\ V4'dTpV'g\ RRRR7hVP R4p\V\4'g\ R\ 2RRR7h\V4wrVVR 3VR 33F(wrxV'dK\ R V R \ 2R V 2RR7h RTRVP R4RVP R4;'g/RVP R4/#))_load_global_auth_storez`No xAI OAuth credentials stored. Select xAI Grok OAuth (SuperGrok / Premium+) in `hermes model`.xai_auth_missingTreloginr(z#xAI OAuth state is missing tokens. xai_auth_invalid_shaper*r+zxAI OAuth state is missing z. xai_auth_missing_r; discovery redirect_uri) r>rOrFr rJrr.r,r-_RELOGINr0) rKrOrB global_stater(r*r+rfields $ r _read_xai_oauth_tokensrZIs'7 '(Ee(L ME -e 4 423J3LM -l ; ; E  n   YYx F fd # #599^C\ r"c V^8dQhRRRR/#)rrBr3rNoner)rs"r r!r!dsPP>PdPr"c^RIHpHpV!4pVfR#\PP R4'd!\PP RR4MRpV'dE\ V4R, R, pVPRR 7VPRR 78XdR#V!R WRR 7R# \dR#i;i \d"p\PR T4Rp?R#Rp?ii;i) aIBest-effort persist of a rotated xAI grant into the global-root auth.json. xAI rotates refresh_token on every refresh, so a profile that refreshed a root-resolved grant must write the chain back to root. Touches only root ``providers.xai-oauth``; swallows all errors (root-stale is better than breaking the profile's own save). )_global_auth_file_path _persist_provider_state_to_storeNPYTEST_CURRENT_TESTHOMEr$z.hermesz auth.jsonF)strictr7 set_activez2xAI OAuth: write-through to global root failed: %s) r>r^r_osenvironr.rresolve Exceptionloggerdebug)rBr^r_ global_path real_home_env real_rootexcs& r '_write_through_xai_oauth_to_global_rootrodsY(*K35**..AV2W2WBJJNN62.]_M')3kA  ""%"0I4E4EU4E4SSTP(eUZ[    P I3OOPs*?'B7* C 7 CC C5C00C5rUrVr$r;r<oauth_device_coderdc4V^8dQhRRRRRRRRR RR R R R /#)rr(r3rUr4rVrr;z Optional[str]r<rdrHrr\r)rs"r r!r!sH)) )*B)Y\))36)) )r"c ^RIHpHpHpHp Hp Hp Hp Hp H pVfV !4pV!4;_uu_4V!4pV !VR4wppVeTM/pVPWVR7V'dVVR&V'dVVR&V!4pVeVeV !VV4'd V!V4MV !VRVVR7V !V4RRR4R# +'giR#;i)zPersist xAI OAuth tokens; *set_active* also promotes ``xai-oauth`` to ``active_provider``. Pass ``set_active=False`` for side-tool bootstrap (TTS/setup, tools config, dashboard, refresh) so inference routing is unchanged. ) _auth_store_lockr^_load_auth_store _load_provider_state_with_source _same_path_save_auth_store_store_provider_state _utc_now_zroNr7)r(r;r<rUrVrc) r>rsr^rtrurvrwrxryroupdate)r(rUrVr;r<rdrsr^rtrurvrwrxryror2rB source_path global_roots&$$$$$ r _save_xai_oauth_tokensr}sggg!|   %' >j+V{* F S !*E+  $0E. !,.  "{'>:k[fCgCg 3E : !*k5Z X Z (%    sAB?5"B?B?? C c V^8dQhRRRR/#)rr*rrzOptional[float]r)rs"r r!r!s  s  r"c \V\4'dRV9dR#VPR4p\V4^8dR#V^,R\V^,4)^,,,p\P !\ P!VPR44PR44PR4p\V\\34'd \V4#R# \dR#i;i)zL``exp`` claim of a JWT-shaped access token, or None when absent/undecodable..N=asciizutf-8exp)r,rsplitlenjsonloadsbase64urlsafe_b64decodeencodedecoder.intfloatrh)r*parts payload_b64rs& r _xai_jwt_exprs lC ( (C|,C""3' u:>AhU1X(:!;; jj11+2D2DW2MNUUV]^_ccdij'c5\::uSzDD s!C3B,C31C33 DDc$V^8dQhRRRRRR/#)rr*r skew_secondsrrrHr)rs"r r!r!s&NNN3NtNr"c\V4pVRJ;'d3V\P!4\^\V44,8*#)N)rtimemaxr)r*rrs&& r _xai_access_token_is_expiringrs: | $C d? M MsdiikC3|;L4M&MMMr"c V^8dQhRRRR/#)rr*rrrr)rs"r r!r!s H Hc Hc Hr"c\p\V4pVfV#V\P!4, p^Tu;8dR8:dMM \^xV4#T#)zProactive-refresh lead time before JWT ``exp``. Device-code logins often return ~15-minute JWTs; the full hour-long skew would refresh on every resolution, burning single-use refresh tokens and racing callers into ``invalid_grant``. i )rrrmin)r*max_skewr remainings& r #_xai_proactive_refresh_skew_secondsrsK 5H | $C {diik!I!"Y!9'!93sH GxGr"c V^8dQhRRRR/#)rhostrrrHr)rs"r r!r!s44c4d4r"c>VR8H;'gVPR4#)zQ``x.ai`` is the bare apex, so an exact match or any ``.x.ai`` suffix is accepted.zx.aiz.x.ai)endswith)rs&r _is_xai_origin_hostrs 6> 3 3T]]733r"c V^8dQhRRRR/#)rurlrrztuple[Optional[str], str]r)rs"r r!r!s  # "; r"c\V4pVP;'gRP4pVPR8wdRV3#V'gRV3#\ V4'gRV3#RV3#)un``(problem, host)`` — problem is ``"scheme"``, ``"host"``, ``"origin"`` or None when *url* is HTTPS on x.ai.r$httpsschemeroriginN)rhostnamelowerrr)rparsedrs& r _xai_url_problemrsg c]F OO ! !r ( ( *D }}~ t| t $ $~ :r"c$V^8dQhRRRRRR/#)rrrrYrr)rs"r r!r!s!55c5S5S5r"c \V4wr#VfV#RRV RV: R2RRV RV: R2RRV R V: R 2/V,p\VR 4h) uRefuse a discovery endpoint that isn't HTTPS on the xAI origin. Discovery is cached in auth.json, so one MITM at login could plant a ``token_endpoint`` that receives the refresh_token forever; pinning scheme + host (RFC 8414 §2) removes that. rz(xAI OIDC discovery returned a non-HTTPS z: rrzxAI OIDC discovery z is missing a hostname: rz host z is not on the xAI origin (expected x.ai or a *.x.ai subdomain). Refusing to use a cached endpoint that may have been substituted by a MITM during initial discovery; re-authenticate with `hermes model` to re-fetch.xai_discovery_invalid)rr)rrYproblemrmessages&$ r _xai_validate_oauth_endpointrs %S)MG Ignoring malformed xAI base_url override %r; using %s instead.rznRefusing non-HTTPS xAI base_url override %r (xai-oauth bearer would be sent in cleartext); falling back to %s.rzEIgnoring xAI base_url override %r with no hostname; using %s instead.uRefusing xAI base_url override %r — host %r is not on the xAI origin (expected x.ai or a *.x.ai subdomain). The xai-oauth bearer is only valid against xAI's inference API; sending it elsewhere would leak the credential. Falling back to %s.)r%rstriprrhriwarning)rr candidaterrs&$ r _xai_validate_inference_base_urlrs "##%,,S1I (3 ( 9   O F ^`it O  2 X   O+ WYbms B#CCc V^8dQhRRRR/#)rtimeout_secondsrrzdict[str, str]r)rs"r r!r! s%>r"c \P!\RR/VR7pTP ^8wd\ RTP R2R4hTP 4p\T\4'g \ R R 4hRUu/uFqD\TPT44bK pp\TP44'g \ R R 4hTP4Fwrg\YvR 7K T# \dp\ RT 2R4ThRp?ii;i \dp\ RT 2R 4ThRp?ii;iuupi)Acceptapplication/json)headerstimeoutzxAI OIDC discovery failed: xai_discovery_failedNz#xAI OIDC discovery returned status rz*xAI OIDC discovery returned invalid JSON: xai_discovery_invalid_jsonz2xAI OIDC discovery response was not a JSON object.xai_discovery_incompletez;xAI OIDC discovery response was missing required endpoints.rY)authorization_endpointtoken_endpoint)rr.rrhr status_coderr,r-r&r?valuesitemsr)rresponsernpayloadk endpointsrYrs& r _xai_oauth_discoveryr sI]994xI[>\fuvs"**4`Ia y! " "TVpqqoo' $S6(  ]4SE:A3p3p3pr"c <^RIHpHpHp?V!V4'g\ R\ 2RRR7hVP 4;'gV!V4R,p\VRR7\P!\R\V444p\P!VR R /R 7;_uu_4p V PVR R /RRR\RV/R7p RRR4X P^8wdyV P P 4p V 'dRV 2MRp V PR8Xd\ RV ,R,RRR7h\ RV ,RV PR9R7h\#V RR RRR!R"R7wr/\%WV4CRV!4/C# +'giL;i)#rN) _nonempty_strryrz$xAI OAuth is missing refresh_token. xai_auth_missing_refresh_tokenTrQrr@rrrrz Content-Typez!application/x-www-form-urlencoded grant_typer+ client_idrdataN Response: r$iz'xAI token refresh failed with HTTP 403.uP This OAuth account is not authorized for xAI API access — xAI may be restricting API/OAuth use to specific SuperGrok tiers despite the in-app subscription being active. Re-logging in won't change that; set ``XAI_API_KEY`` and switch to ``provider: xai`` (API-key path) if available, or upgrade your subscription at https://x.ai/grok.xai_oauth_tier_deniedFzxAI token refresh failed.xai_refresh_failedr7)provider invalid_jsoninvalid_json_relogin strict_strinvalid_responsemissing_accessr;>)z.xAI token refresh returned invalid JSON: {exc}xai_refresh_invalid_json)z1xAI token refresh response was not a JSON object.xai_refresh_invalid_response)z4xAI token refresh response was missing access_token. xai_refresh_missing_access_token)r>rryrrrWr%rrTimeoutrrClientpostrrtextr r)r*r+rrrryrendpointrclientrdetailsuffixrrefreshed_accesss&&$$ r refresh_xai_oauth_purer,sPO  ' '28* =?_im  ##%``)=o)NO_)`H!1ABmmCU?%;<=G g:L/M N NRX;; ~/RS>QSbdqr  O s"$$&+1;vh'r   3 &9FBEE(   '& 02FPXPdPdhrPr  !>;c"uns !G p&w-P oR`blbn ooI O Ns .!F  F c ,V^8dQhRRRRRRRRRR/#) rr(r3rrrVrrrr)rs"r r!r!bs4 /2BE]br"c t^RIHpHpHpV!V!4R4;'g/p\ VP R4;'gR4pV!\VP R44\VP R44WR7p \V4p V R,V R&V R,V R&V P R4'd V R,V R&V P R 4e V R ,V R &V P R 4'd V R ,V R &\V R V/VV R ,VR R7V # \ dRpLi;i)rN)rtr6rr7r<rpr*r+)rrrrr9rr;F)rUrVr;r<rd) r>rtr6rrr.rhr&r-r}) r(rrVrrtr6rrBr< refreshedupdated_tokenss &$$$ r _refresh_xai_oauth_tokensrbs8_^($%5%7EKK +.EE2EF 'vzz.)*F6::o3N,O%I&\N%.~%>N>"&/&@N?#}}Z  %.z%:z"}}\".'0'>|$}}\""'0'>|$#3^"DS_~.)PU ) (' (sD'D'D'' D76D7c V^8dQhRRRR/#)rrnr rr\r)rs"r r!r!sUUiUDUr"c^RIHpHpHpHpHpV!4pV!VR4;'g/p\ VPR4;'g/4pVPRR4VPRR4WR&V!RVRRR 7VR &V!VRVR R 7V!V4R# \d"p \PR T 4Rp ? R#Rp ? ii;i)zClear dead xAI tokens after a terminal (400/401/403) refresh failure so later sessions fail fast. Best-effort: persistence failures are logged and swallowed; the caller re-raises regardless. )_last_auth_error_markerrtr6rwrxr7r(r*Nr+runtime_refresh_failurer)reason default_codelast_auth_errorFrcz2xAI OAuth: failed to persist quarantined state: %s) r>rrtr6rwrxr-r.poprhrirj) rnrrtr6rwrxstorerBr(save_excs & r _quarantine_xai_oauth_tokensrs IIU "$UK8>>Beii)//R0 >4( ?D)!h#: %>Ma$   e[%EJ U I8TTUs#BBAB C&CCcV^8dQhRR/#)rrrr)rs"r r!r!ssr"c\\P!RR4P4P R4;'g5\P!RR4P4P R4\ R7#)HERMES_XAI_BASE_URLr$r XAI_BASE_URL)r)rregetenvr%rr rr"r _xai_oauth_inference_base_urlr s^ + ',224;;C@uuBIIn^`DaDgDgDiDpDpqtDu+ r" force_refreshFrefresh_if_expiringrefresh_skew_secondsc(V^8dQhRRRRRRRR/#)rrrHrrz Optional[int]rr3r)rs"r r!r!s.///9=/'//r"c Raaa^RIHpHpHpHpRVVV3Rllp\ 4p\ VR,4p \R^4p V!V4'dV!\\\4V R,4R7;_uu_4\ RR 7p\ VR,4p V!V4'dx\\ VPR 4;'g/4PR 44;'gV!V 4R ,p V!W\VPR 44V R 7p RRR4RRR\4R\V PR44RRRVPR4RR/# \d p T!T 4'd \T 4hRp ? ii;i +'giLz;i)rN)rs$_is_terminal_xai_oauth_refresh_errorrrc V^8dQhRRRR/#)rrr3rrHr)rs"r r!;resolve_xai_oauth_runtime_credentials..__annotate__s  n  r"c<\VR,PR44pSe \S4M \V4p\ S4;'g\ S;'d \ W44#)r(r*)r&r.rrrHr)rr*skewrrrs& r _should_refresh>resolve_xai_oauth_runtime_credentials.._should_refreshshd8n00@A )=)IC$ %4\B M"  d  U U$A,$U'  r"r("HERMES_XAI_REFRESH_TIMEOUT_SECONDSr)rF)rKrUrrV)rrVrNrr7base_urlapi_keyr*sourcezhermes-auth-storer;r<rp)r>rsrrrrZr-rrrr r&r.r rr ) rrrrsrrrrrr(refresh_timeout_secondsrrns ddd r %resolve_xai_oauth_runtime_credentialsrs~HH   " #D $x. !F'(LbQt c%8Q2RTknqTq.r s s)6D$x.)Ft$$4 5 ; ;<@@AQRSWW+,CDEUV6FSWS[S[\jSkLl(?Ft( K136&**^45%0(  !;C@@4S9t ss7AF F0F#E)) F4FFF F& force_new_loginc$V^8dQhRRRRRR/#)rpconfigrr rHrr\r)rs"r r!r!s'"I"IN"I"IY]"Ir"cJ^RIHpHpHpHpHpHpHp ?V'gV!RV\R\R7'dR#\4\R4\R4\4\\VRR4;'gR 4p \VR R 4'*p V!4'dR p V!WR 7p \V R ,V PR4V PRR4V PR4RR7V !RR4V!RV PR\44p V!RV RR7R#)rN)_is_remote_session!_offer_existing_oauth_credentials_print_login_success_update_config_for_provider_xai_oauth_device_code_loginrunsuppress_credential_sourcer7z xAI OAuth)rg is_expiring display_namedefault_base_urlNz6Signing in to xAI Grok OAuth (SuperGrok / Premium+)...z,(Hermes creates its own local OAuth session)rr no_browserF)r open_browserr(rUrVr$r;rp)rUrVr;r< device_coderT)show_auth_state)r>r$r%r&r'r(rr)rr printrgetattrr}r.)argsr"r r$r%r&r'r(rr)rr.creds config_paths&&$ r _login_xai_oauthr6slll @51 3     G BC 89 GGD)T:BBdCOt\599L ( dE h599[#9YY~r2>AZ%!m<-k599ZQk;lmKk4Hr"scopec$V^8dQhRRRRRR/#)rr httpx.Clientr7rrr3r)rs"r r!r!s"<3]kr"cVP\\R\RV/R7pVP^8wd\\ RVP R2VP 'd)RVP P4 2,R4hR,R4hVP4pR pVUu.uF qUV9gK VNK ppV'd\ RR PV4 2R 4hV#uupi) rr7rz%xAI device-code request failed (HTTP z).rr$device_code_request_failedz)xAI device-code response missing fields: z, device_code_invalid)r/ user_codeverification_uriverification_uri_completerinterval) rrrrrrrr%rjoin)rr7rrrequiredkeymissings&$ r _xai_oauth_request_device_coderEs{{!+=[RegnpuDvHs"3H4H4H3I L8@ X]]00234 O (  KM O (  mmoGvH&=hsW*s 'C$4C$c 0V^8dQhRRRRRRRRRRR R /#) rrr9rrr/rr poll_intervalrr3r)rs"r r!r! s>    -0 ?B PS   r"c aaa^RIHpRRlpRRlpV!VVV3Rl\V4\^\V44VRVRR 7#) rN)_poll_device_token_genericc V^8dQhRRRR/#)rrr3rr\r)rs"r r!2_xai_oauth_poll_device_token..__annotate__s>dr"cpRF/wrVPV4'dK\RV RV R2R4h R#)r*z/xAI device-code token response did not include  rxai_device_token_invalidN))r*an)r+a)r.r)r field_namearticles& r _validate/_xai_oauth_poll_device_token.._validatesC#S J;;z**EgYaPZ|[\].$Tr"cV^8dQhRR/#)rrrhr)rs"r r!rKs9r"cVPR4;'g&VPR4;'g VPp\RV 2R4p\VPR4;'gR4VnV#)error_descriptionerrorz&xAI device-code token polling failed: xai_device_token_failedr$)r.rrroauth_error_code)r error_payload descriptionerrs&& r _error,_xai_oauth_poll_device_token.._errorsp#''(;<kk @Q@QRY@Zkk^f^k^k ? }MOhi"=#4#4W#=#C#CD r"c P<SPS\R\R\RS/R7#)rrr/r)rrrr)rr/rsr ._xai_oauth_poll_device_token..s- $6 6 EXZgitu r"c\RR4#)zAxAI device-code token polling returned a non-JSON error response.rYr)_rs&r rarb%sX OQj& r"c\RR4#)z/Timed out waiting for xAI device authorization.device_code_timeoutrdrr"r rarb)s 8$UWlmr")rrGvalidate_successon_non_json_erroron_error on_timeout)r>rIrr)rrr/rrGrIrSr^sfdd$$ r _xai_oauth_poll_device_tokenrl sN; & z?!S/0" m  r"r.c$V^8dQhRRRRRR/#)rrrr.rHrr3r)rs"r r!r!-s#UQUaor"c ,^RIHpHpHpHpHpHpV!V4p\P!\RV44p \P!V RR/R7;_uu_4p \V 4p \V R,4p T!\V PR4;'g V R,4\V R ,4T;'dV!4'*;'dV!4R R 7\R \^V 4 R 24V!WR,\V R,4\V R,4V R7p RRR4\!X 4wrV'd V'g \#RR4hR\%WV4RVRRR\'4RV!4RR/# +'giL^;i)rN)_can_open_graphical_browserr$_print_device_code_instructionsryrrlrrrrr@r?r>r=T)r.swallow_open_errorsz$Waiting for approval (polling every zs)...rr/r)rr/rrGNz;xAI device-code token response was missing required tokens.rNr(rUrVr$rr;rzoauth-device-code)r>ror$rpryrrlrrrrrErrr.r1r0rrr )rr.ror$rpryrrlrUrr device_datar@rr*r+s$$ r r(r(-siqq$_5ImmCo67G g:L/M N NRX4V< {:./'   ;<__ L^@_ `  K( )%dd.@.B*BddGbGd $  4SH5E4FeLM. -=#>K 67C T`HaDb"  O #.g"6L }TVpqq*7-PYJ@]@_ h0C ' O NsA#F?FAF F )rN)g.@)A__doc__ __future__rloggingrrrerpathlibrtypingrrrr urllib.parserhermes_cli.auth_codexr r hermes_cli.auth_constantsr r r rrrrrrrrrutilsrr>r getLoggerrirWr&r0rFrJrZror}rrrrrrrrrrrrr rr6rErlr(rr"r r}ss # 55!^ .   , - 1$S64MD6P6)EI)_a)"&)9L))D N H4 5,D*3pDF3p!3plHJ>U2/"/@D/*./d"Iu"IJ$ FTX\r"