+ jHjsza0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI H t H t ^RIHtHt^RIHt^RIHtHtHt]P,!R4tRowttttttR t]!]]04t R t!R t"R t#Rpt$Rqt%Rrt&Rswt't(t)t*t+]!0Rtm4t,RRRRRR/t-R](R](/],Uu/uFq]*bK upCt.]P^!4t0]P^!4t1]P^!4t2]Pft4] !RR44t5RRlt6RRlt7RRlt8RRlt9R R!lt:] R"R#l4t;R$R%/R&R'lltR,R-lt?R.R/lt@R0R1ltAR2R3ltB] R4R5l4tCR6R7ltDR8R9ltER:R;ltFR<R=ltGR>R?ltHR tIR tJ]P!4tL]P!4tNRsOR@]PRA&RBRCltQRuRDRElltRRFRGltSRHRIltT] RJRKl4tURL]"/RMRNlltVRORPltWRQRRltXRSRTltYRURVltZRWRXlt[RYRZlt\R[R\lt]R]R^lt^R_R`lt_RaRblt`RcRdltaReRfltbRgRhltcRiRjltdRkRllteRmRnltfR#uupi)vaGuest handoff: after a Nous account replaces the free tier, move the free tier's apps into it. The account service moves a free-tier identity's connected apps (and its preview cohort) into a signed-in account with one call, ``POST /api/anonymous/claim {"token": ""}``, authorized by the account's own ``hermes-cli`` Bearer token. Hermes never asks first: the move just happens after the account is saved, and the result (the account email, what moved, what needs reconnecting) is shown afterwards. Sign-in code knows nothing about this; two halves keep it that way: - :func:`note_replacement` runs at the lowest write seams (``auth._store_provider_state`` and ``auth_nous._write_shared_nous_state``), under the caller's auth-store locks, whenever a non-guest Nous state replaces a guest. It writes a pending record and does no network. Records sit beside the shared Nous store, keyed by a hash of the ``anon_`` credential and bound to the destination account, so profiles that share one free-tier identity share one record and one claim. - :func:`drain` runs the claim outside every lock: when a shared-store write finishes, when a :func:`deferred` block exits, after a free-tier reconcile, and on each Nous keepalive tick (a retry left by an earlier process). The synchronous run is bounded (``SYNC_BUDGET_SECONDS``) so a CLI or the desktop sees a result; what is still retrying resumes on a later run. The apps only ever go to the record's destination: every attempt is reserved in one locked read-modify-write that also proves the Bearer about to be sent belongs to that destination. User copy never says guest / anonymous / claim. ) annotationsN)contextmanager) dataclassfield)UTCdatetime)Path)AnyIteratorOptionalzhermes_cli.authpausedzguest_handoff.jsong$@.@N@client_not_allowedaccount_lockedretry_window_endedzKThis sign-in can't receive them. Sign in again with `hermes auth add nous`.zThis Nous account is locked.z6Hermes kept trying for nearly two weeks, then stopped. unknown_tokenalready_retiredcN]tRt^Mt$Rt]!]R7tR]R&] RRl4t Rt R#) HandoffBatchzBWhat one :func:`drain` did: the public view of each record it ran.)default_factorylist[dict[str, Any]]resultscV^8dQhRR/#)return Optional[str])formats"=/home/ubuntu/.hermes/hermes-agent/hermes_cli/guest_handoff.py __annotate__HandoffBatch.__annotate__Ts``}`c <\RVP4R4#)c3d"TF&qPR4'gKVR,xK( R#5i) account_emailNget).0rs& r -HandoffBatch.account_email..Us$XAAW'Q''s00N)nextr)selfs&rr%HandoffBatch.account_emailSsXXZ^__r"rN) __name__ __module__ __qualname____firstlineno____doc__rlistr__annotations__propertyr%__static_attributes__rr"rrrMs)L$)$$?G !? ``r"rcV^8dQhRR/#)rrfloatr)rs"rr r Xser"c,\P!4#N)timerr"r_nowr=Xs 99;r"c V^8dQhRRRR/#)repochr9rstrr)rs"rr r \s===#=r"cV\P!V\R7P4#))tz)r fromtimestampr isoformat)r?s&r_isorE\s  ! !%C 0 : : <>*++G4 5 ? ? A# FFr"cV^8dQhRR/#)rrr@r)rs"rr r ds3r"c^RIHpV!4#)hermes_home_key)hermes_constantsrSrRs r _home_keyrUds0  r"cV^8dQhRR/#)rrrr)rs"rr r isAAtAr"cB^RIHpV!4P\4#)rQ_nous_shared_store_path)hermes_cli.auth_nousrY with_nameHANDOFF_FILENAMErXs r _records_pathr]is< " $ . ./? @@r"c(V^8dQhRRRRRRRR/#) rpathrholderzthreading.localtimeout_secondsr9rIterator[None]r)rs"rr r os(o.r"c#"^RIHpV!WVRVP 24;_uu_4RxRRR4R# +'giR#;i5i)rQ) _file_lockzTimed out waiting for N)hermes_cli.authrdname)r_r`rards&&& r_lockrgns5* D/5KDII;3W X X  Y X X Xs&A 7 A  A  A healFc$V^8dQhRRRRRR/#)rr_rrhboolrdict[str, Any]r)rs"rr r us&SSStSSr"c\P!VPRR74p\V\4'dVPR4MRpR ^R\V\4'dV/#//# \d/pLW\dO\ P RTT'dRMR4T'd!TPTPR44/pLi;i) zThe records file. An unparseable one reads as empty; *heal* (writers, under the records lock) moves it aside to ``.corrupt`` first, so a bad file neither blocks a sign-in nor loses its data.z utf-8-sig)encodingz0Free-tier handoff records at %s are unreadable%sz; moved aside to .corruptz .json.corruptrecordsN_schema) jsonloads read_textFileNotFoundError ValueErrorloggerwarningreplace with_suffix isinstancedictr')r_rhdataros&$ r_loadr}us zz$..+.>?&0d%;%;dhhy!G q) 7D0I0IW RRr RR  I46:2 D  LL))/: ; s)&A00 C?CC"C2"CCc$V^8dQhRRRRRR/#)rr_rr|rkrNoner)rs"rr r s!333N3t3r"c&^RIHpV!WRR7R#)rQ)_save_private_jsonT) sort_keysN)rer)r_r|rs&& r_savers2tT2r"c$V^8dQhRRRRRR/#)rr_rkeyr@rOptional[dict[str, Any]]r)rs"rr r s"  $ S -E r"cJ\VPR4\R4;_uu_4\VRR7pV!VR,P V44pVe-\ \ 44VR&WCR,V&\W4VuuRRR4# +'giR#;i)zApply *change(record) -> record | None* to one record under the records lock and return what was written (None: nothing written). The innermost lock: the hook takes it under the auth-store locks, and it never holds another lock itself.z.lockr T)rhroN updated_at)rgry_records_lock_holderr}r'rEr=r)r_rchanger|records&&& r_updaters t(*> E ET%Y++C01  #'.__annotate__s/Nr"c<Vf%R\RSRSR^R.R\\44/pM.VR,\9dVP R4'gSVR&SVR,9dVR,P S4V#)NrrG destinationattemptsprofiles created_at)PENDINGrEr=_ACTIVEr'append)rrGrhomes&rr note_replacement..changesz >w j-Q\ !Z\4<QF G_ ' :0F0F$/F= ! vj) ) :  % %d + r"z4Nous sign-in replaced the free tier; handoff %s (%s)rNN)hermes_cli.anon_authrrzr{r'rr@r] RuntimeErrorrUrrNrvinfo) rrrr_rrrGrrs && @@@rrrs 4 ( # #~c':':*SRVBWBW&ll<8(377>CZ:[J j# & &j  ;DT:j16 :F KKFw:&r*, s C88 DDcV^8dQhRR/#)rrrjr)rs"rr r sBB4Br"c^^RIHpHp\VPR^4'dR#VP ;_uu_4\ VPP44pRRR4\;QJdRX4F 'gK R# R#!RX44# +'giLD;i)rQ)auth auth_nousdepthTNc3<"TFp\VR^4xK R#5i)rN)getattr)r(r`s& rr*$_holds_auth_locks..sAvwvw**sF) hermes_clirrr_nous_shared_lock_holder_auth_target_lock_holders_guardr4_auth_target_lock_holdersvaluesany)rrholderss r_holds_auth_locksrsy*y117A>> - - -t55<<>? . 3AA33A3A3AA AA . -s $B B, cV^8dQhRR/#)rrzIterator[HandoffBatch]r)rs"rr r s $ $( $r"c#."\4p\\R^4^,\nVx\;P^,un\ 4pVeVP VnR#R# \;P^,uni;i5i)zHold every drain on this thread until the block exits, then drain once (outside the caller's lock): a surface that saves a sign-in under its own lock wraps the save in this.holdsN)rr_localrdrainr)batchrans rdeferredrsh NE67A.2FL   'C      s,BA3AB3BBcV^8dQhRR/#)rrzOptional[HandoffBatch]r)rs"rr r s  % r"c\\R^4'g(\\RR4'g\4'dR#R\n\ \ \ R7R7R\n# R\ni;i)znRun this profile's due records now. None when a lock or a :func:`deferred` block on this thread holds it back.rrunningFNT)budget_seconds)r)rrrrrrun_dueSYNC_BUDGET_SECONDSrr"rrrsVvw""gfi&G&GK\K^K^FNG;N$OPs A22 A?c V^8dQhRRRR/#)rdeadliner9rr)rs"rr r s'''5'r"c:V\P!4, #r;)r< monotonic)rs&r _remainingrs dnn& &&r"c V^8dQhRRRR/#)rrrkrrjr)rs"rr r sDD~D$Dr"cVPR4pV\9;'gLV\8H;'d;VPR4\9;'d\ VPR44#)ahA record a run may still attempt: active, or Failed on a code that is not final (an older build closed transient failures after 8 attempts; those re-arm here, on any run: a sign-in, ``hermes auth status``, ``hermes auth upgrade``, the retry worker). The retry window is checked when the attempt is reserved, so a record past it is closed, not silently skipped.rerrorrG)r'rFAILED _FINAL_CODESrj)rrs& r _retryablersk JJw E G  D D!C!CFJJw4G|4[!C!C$(L)A$BDr"c$V^8dQhRRRRRR/#rrrknowr9rrjr)rs"rr r s&SSSeSSr"cv\V4;'d(\VPR4;'g^4V8*#)next_attempt_at)rr9r')rrs&&r_duers1 f  R R% 3D(E(J(J"Ks"RRr"c$V^8dQhRRRRRR/#rr)rs"rr r s!11.1u11r"c\P!\VPR444P 4pY\ ,8# \ dR#i;i)rT)r fromisoformatr@r' timestampruRETRY_WINDOW_SECONDS)rrcreateds&& r _window_endedrsS((VZZ -E)FGQQS 00 00 stDz$JahY]nrsL/ <(":. <(":.sABA/B/BBrc V^8dQhRRRR/#)rrr9rrr)rs"rr r \su?Sr"c \4p\4\4r2\ T4R,P 4UUu.uF2wrEY%P RR49gK\YS4'gK0TNK4 ppp\P!4T,p.pTF9p\T4^8:dT#\YT4;p fK(TPT 4K; T# \d.u#i;iuuppi)zAttempt every active, due record of this profile within *budget_seconds*. Returns their public views; a record the budget did not reach stays as it is for a later run.rorr) r]rrUr=r}itemsr'rr<rr_run_oner) rr_rrrrduerrviews $ rrr\s TV#"'+i"8">">"@ H"@;3jjR00 59&5F 3"@C H~~.0HG h 1 $  NT1 1D > NN4  N   Hs# CC/!C/4C/ C,+C,c V^8dQhRRRR/#)rrrkrrr)rs"rr r ps a an a1I ar"c ^RIHp^RIHpV!R4p\ V\ 4'd&V!V4'gVP R4'gR#VP R4pV'd\VR,4V8XdV#R#)zThe profile's account when it is the record's destination; None while the profile still holds a guest (the save never landed) or holds another account (retries bind to the destination).rget_provider_auth_staterrNr)rrrer&rzr{r'r)rrr&accountrs& r_account_bound_tor(psj47%f-G gt $ $w(?(?w{{SaGbGb**]+K!hw~/F&G;&V7`\``r"c(V^8dQhRRRRRRRR/# rr_rrr@rr9rrr)rs"rr r |s)  4 c U 7O r"c r\V4R,PV4pVe\V4fR#\VP \ R,4\ \R\V444;_uu_4\WV4uuRRR4# +'giR#;i \dR#i;i)roNz .claim.lock皙?) r}r'r(rgr[r\_claim_lock_holdermaxr _claim_locked TimeoutError)r_rrrs&&& rr r |s 4[ # ' ' ,F ~*62: 4>>"2]"BCEWsJx0133 H53333 s0AB'< B B' B$ B'$B'' B65B6c(V^8dQhRRRRRRRR/#) rr_rrr@bearer_subjectrrz$Optional[tuple[dict[str, Any], int]]r)rs"rr r s)7747c7=7Ei7r"c`aa.oRVV3Rllp\WV4pS'd VS^,3#R#)alReserve one attempt in a single locked read-modify-write: the record is still retryable and due, inside its retry window, and bound to the very account whose Bearer is about to be sent. Returns ``(record, attempts before this one)``, or None when nothing may be sent now. A record past its window is closed as Failed instead; one an older build failed is re-armed.c V^8dQhRRRR/#)rrrrr)rs"rr _reserve..__annotate__s E E/ E4L Er"c <\4pVe0\W4'dS'dVPR4S8wdR#\W4'd/VCR\RR/C#\ VPR4;'g^4pSP V4/VCRVR,\8Xd\MVR,RV^,R\V4/C#)Nrrrrrlast_attempt_at) r=rr'rrintrRETRYINGrE)rrpriorr2reserveds& rr_reserve..changesf N$v"3"3%M)Bn)T  % %MfMgvw8LM MFJJz*//a0E&E'vg&/H8fU\oEAI'8$s)E Er"N)r)r_rr2rrr;s&&f @r_reserver=s: H E ET 'F$,FHQK 6$6r"c(V^8dQhRRRRRRRR/#r*r)rs"rr r s)"""3"%"p\PRTR ,TP4\T4uRp?#Rp?ii;i)rQr% AuthErrorFTroNforcerz6Free-tier handoff (%s): account token unavailable (%s)rrGrr,rz%Free-tier handoff attempt %d (%s): %srcR<VPR4S^,8Xd /VCRS/C#R#)rNr&)r)r:s&r_claim_locked..s2QUU:EVZ_bcZcEc)AA)Az5)A)mim)mr"c"<\VSSSS4#r;)_apply)r)outcomepayloadr: retry_afters&rrErFsfQ+W\.]r"cohort_carriedg?grr)rer&rrAr}r'r public_view_bearerrvrcoder=r_postminCLAIM_TIMEOUT_SECONDSr._REAUTHr_CLAIMED_refresh_account_tokenr9r=r9_sleep)r_rrr&rArCcurrentbearerexc reservationrrrIrJr:rKs&&& @@@@rr/r/s!73 E +i(,,S1 ?j2a7+2;w' < < (5*X2FGF h 1 $w' 't(6*:;  uT{9599#>II'J J# (- < &*A&*I*O*OR-s3 88L/MN)P%+  ;UQYBQXQ\Q\]dQeQpQpipq g e Dm nE $]^ h 7;;/?#@D#H "3sJx4H+I J3fjj):;@@qADFJK '?h &$*X2F*Fv& &t 1 ( KKPRUVXRY[^[c[c dw' ' (sIJ!$2JJ!J!c$V^8dQhRRRRRR/#)rrCrjrr9rr@r)rs"rr r s& G Gd GU Gs Gr"c .^RIHp^RIHpVP;_uu_4VP P \4R4RRR4VPV4;_uu_4V!VR7;_uu_4V'd,VPV\R7uuRRR4uuRRR4#VPVR7uuRRR4uuRRR4# +'giL;i +'giM;iRRR4R# +'giR#;i)rQ)r)_nous_shared_store_lockN)ra)rarefresh_skew_seconds) rrrZr]_RESOLVE_TOKEN_CACHE_LOCK_RESOLVE_TOKEN_CACHEpoprU_auth_store_lockresolve_nous_access_token_FORCE_REFRESH_SKEW)rCrrr]s$$ rrNrNs< ' ' ' !!%%ik48 (   w ' ')@QX)Y)Y 11'`s1t*Z)Y ' '--g-F*Z)Y ' ' ( ' *Z)Y ' ' ' 's;%C'D9C&  D-C& > D C# & C6 1D D c V^8dQhRRRR/#rr)rs"rr r s__u__r"c^RIHp\RVR7R# Td"p\P RT4Rp?R#Rp?ii;i)zVThe account's token picks up the carried cohort only on its next mint, so mint it now.r@TrBzBFree-tier handoff: account token refresh after the move failed: %sN)rrArNrvr)rrArYs$ rrUrUs:3_dG, _ XZ]^^_s ?:?c ,V^8dQhRRRRRRRRRR /#) rrGr@rXr'rkrr9rz+tuple[str, dict[str, Any], Optional[float]]r)rs"rr r s8jjcj3jjjHjr"c r^RIHp^RIHp^RIHpHp^RIHp^RI H p V!RRVR7p V !W:4;_uu_4p V PV!V4PR4 R 2/V!4CR R V 2/CR V/R 7p RRR4X P#4p\'T\(4'dTM/p\+X P,T4Y!T P.43# +'giLc;i TPd+p \RRR\T 4P /R3uRp ? #Rp ? ii;i \$d/pLi;i)rQ)parse_retry_after_seconds) _anon_headers)_nous_portal_base_url_resolve_verify)httpx)_nous_http_clientN)insecure ca_bundle auth_state/z/api/anonymous/claim authorizationzBearer token)headersrqr unreachabledetail)agent.retry_utilsrirrjrerkrlrrmrZrnpostrstrip HTTPError_RETRYtyper/rqrurzr{ _classify status_coderu)rGrXr'rrirjrkrlrmrnverifyclientresponserYrJs&&&$ rrPrPs);2F/6 ddw OFT w / /6{{(188=>>RSP=?POwvh=OPX_akWl#nH0 --/$GT22gG X))7 3W>WX`XhXh>i ii0 / ??T$s):L:LMtSST sLC(=C:C(D& C% C(%C((D#9DD#D#& D65D6c$V^8dQhRRRRRR/#)rstatusr8rJrkrr@r)rs"rr r s&BBcBNBsBr"cV^8Xd#VPR4R8Xd\#\#VR8Xd\#\P\ VPR4;'gR4\4#)rclaimedirrn)r'rTr|rS _REFUSALSr@)rrJs&&rr~r~sW }";;x0I=xI6I } ==W[[177R8& AAr"c 0V^8dQhRRRRRRRRRR R R/#) rrrkrIr@rJrKzOptional[float]prior_attemptsr8rr)rs"rr r s9>C.Wf#1r"cXVR,\8XdV#/VCRVPR4RR/CpV\8XEd\VPR4\4'dVPR4MRpTP \RRVPR4RVPR4RT;'g/PR4;'gR R \ T;'g/PR 4;'g.4R \ T;'g/PR 4;'g.4R VPR 4R J/R7MV\8Xd8TP \VPR4R8H;'gV^8R7M}V\8XdVP \R7M[\\V\\4^, 4,pTP \\4V'dTMT,R7VR,\\39dVP!RR4V#)rrrN connectorsr%destination_org_idconnectors_kindkindunknownmoved_toolkitsdropped_toolkitsrLT)rrresultr)rprobably_movedr)rrrG)CLAIMEDr'rTrzr{updater4_GONEGONE_FAILr_BACKOFF_SECONDSrQlenr9r=ra)rrIrJrKrrladders&&&&& rrHrHs g'! O OW!57H$ OF(2 0r"cVPR4;'g/pVPR4pRVPR\4RVPR4RVPR4RVPR.4RVPR.4R\VPR44R VPR 4R V'd.\^\ \ V4\ 4, 44M^R VPR 4/ #) z7The wire shape the surfaces read; never the credential.rrrr%rrrrrrKr)r'IDLErjr.r8r9r=)rrnext_ats& rrMrMs ZZ ! ' 'RFjj*+GGT*OVZZ=X6::&78&**%5r:.<sc!%% 2E2K2K.Lr")rr) r}r]rrrrUr'rr.)rorr)mines rhandoff_statusr1s (3::< ;D @w!!%% B*?"?AAwD @  c$$LM NN  As(BBBBBc V^8dQhRRRR/#)rrGr@rrr)rs"rr r ?s22c2&>2r"c\\44R,P\V44pT'd \ T4#R# \dR#i;i)zThe handoff of one free-tier credential (as :func:`handoff_status` reads it), or None when no record exists. A pure read: what a sign-in reports when its own run attempted nothing (another process held the claim, or the budget ran out first).roN)r}r]r'rNrr)rGrs& r record_statusr?sP}' 266z*7MN"(:f 1T1 s2A AAc V^8dQhRRRR/#)rrrkrr)rs"rr r Js555>5r"c$/VCR\V4/C#)zaA status as the desktop reads it: the fields, plus the user copy for them (:func:`result_lines`).lines) result_lines)rs&r wire_statusrJs 4f 4g|F3 44r"c V^8dQhRRRR/#rrrkrz list[str]r)rs"rr r OsIr"c"\V4pVPR4pVR 9;'dVPR4pVPR4\8Xd;V'g3VR8wd,RVPR4;'gR RV^, 2V^&V#) z?User copy for a non-idle handoff (``hermes auth status nous``).rrrconflictz Signed in as r% your accountz. movedswapped)rr'r)rrr moved_somes& r status_linesrOs  E ::' (D--NN&**=M2NJ zz'g%jTZ=O"6::o#>#P#P."QQSTYZ[T\S]^a Lr"c V^8dQhRRRR/#rr)rs"rr r Ys   I r"c4VPR4pVPR4;'gRpVPR4;'g.VPR4;'g.rCV\9dR.#V\8XdR.#V\8XdV\P\ VPR4;'gR 44pR V'd R V 2,.#R ,.#V\ 8XdVPR 4'dR .#R.#V\8wd.#VPR4pVR9d#V'dRV RRPV4 R2.pMVR8XdV R2.pMVR9dR.pMR.pV'd(VPRV RRPV4 R24V#)zoWhat a handoff did, for the line after "Signed in as ..." (every sign-in surface) and for :func:`status_lines`.rr%rrrzRMoving your free-tier apps to this account; Hermes keeps trying in the background.zkYour free-tier apps are set to move to another Nous account. Sign in to that account to finish moving them.rrnz'Your free-tier apps could not be moved. rz0Your free-tier apps were probably moved already.z(Nothing left to move from the free tier.rzYour apps moved to z: z, .rz? already had its own apps, so the free-tier apps stayed behind.z%There were no free-tier apps to move.z+Any free-tier apps are in this account now.z Reconnect in r)nonerr) r'rrr _FAILURE_COPYr@rrrr)rrwhererdroppedreasonrrs& rrrYs JJw E JJ ' 9 9>EZZ 0177RDV9W9]9][]7 dee )* * ""3vzz'':'@'@b#AB9Vq\\]]Y[\]] }FLjjQaFbFbBA A?A A  ::' (D ##&ugR %0@/ACD  7YZ[ - -89>? }UG2dii.@-ACD Lr")idlependingretryingrgonefailedi#)g@@r rgr@g @g @iʚ;)rrretryfailreauth>rinvalid_requestrr)r)g__conditional_annotations__r3 __future__rrJrqloggingrr< contextlibr dataclassesrrrrpathlibrtypingr r r getLoggerrvrrr9rrrr frozensetrr\rrRrrrdrTrr|rrSrrrlocalrr-rsleeprVrr=rErNrUr]rgr}rrrrrrrrrrrrrrLockrEventrrr5rrrrr rr(r r=r/rNrUrPr~rHrMrrrrrr)rOrs0@rrs0#  %("**   , -1k.gx$  Wh' ('&?+W'%jk g4R U-u +,|tU{|,  !(__&    `` `=G A  SeS"3 %J,DB $ $ 'DS1"~~  -1*1  "(( / / ':( a 70"J G_j.B< 0 O25  k-s H8