+ kHjyRt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI H t ^RI H t ^RIHt^RIHtHtHtHtHtHt^RIt^RIHt^RIHt^RIt]P>!] 4t!!R R ]"4t#R t$R t%R t&Rt'Rt(^t)Rt*]PV!R4t,RRlt-RRlt.RRlt/RRlt0RRlt1RRlt2RRlt3R R!lt4R"R#lt5R$R%lt6R&R'lt7R(RR)R/R*R+llt8R,RR-RR.RR(R/R/R0llt9R1R2lt:R3R4lt;R5R6ltRR<R=llt?R>R?/R@RAllt@R>R;/RBRClltARDREltBRFRGltCRHRIltD] !RJRK44tE] !RLRM7!RNRO44tFRP]$RQ]%/RRRSlltGRP]$RTRRURRVR/RWRXlltHRYR/RZR[lltIR\R]ltJR^R_ltKR`RaltLRbRcltMRP]$RdRLReR/RfRglltNRhRiltORjRkltPRlRmltQRnRoltRRpRqltSR)](RrRs/RtRulltTRvRwltURxRyltVRzR{ltWR|R}ltXR~RRRRRRR/RRlltYR~RRRRR/RRlltZRRlt[RRlt\RRlt]RRlt^RRlt_RRlt`RR/RRlltaRRL/RRlltb]c3RRlltdR# ]dRtELi;i)aMPhoton Dashboard API client + device-code login flow (pure Python, no spectrum-ts). Management calls hit ``https://app.photon.codes/api/...`` (OAuth 2.0 device flow, Bearer) like the official CLI. The dashboard project ``id`` *is* the Spectrum Cloud project id and Spectrum is always provisioned at create-time; the sidecar authenticates with ``(id, projectSecret)``. Storage: runtime SDK creds -> ``~/.hermes/.env``; management metadata -> ``auth.json`` under ``credential_pool.photon`` (device token), ``photon_project`` (ids + secret for offline status) and ``photon_user`` (numbers). ) annotationsN) b64encode) dataclass)Path)AnyCallableDictListOptionalTuple)get_scoped_secretget_hermes_homec]tRt^$tRtRtR#)PhotonDashboardAuthErrorzERaised when Photon rejects a device-flow token for the dashboard API.N)__name__ __module__ __qualname____firstlineno____doc____static_attributes__rB/home/ubuntu/.hermes/hermes-agent/plugins/platforms/photon/auth.pyrr$sOrrz photon-clizopenid profile emailzhttps://app.photon.codeszhttps://spectrum.photon.codesz Hermes Agentiz^\+[1-9]\d{6,14}$cV^8dQhRR/#)returnrr)formats"r __annotate__r6s+++rc$\4R, #)zJThe active profile's ``auth.json`` (shared with the rest of hermes-agent).z auth.jsonr rrr_auth_json_pathr 6s  { **rcV^8dQhRR/#)rrdict[str, Any]r)rs"rrr;s  N rc|\4pVP4'g/#VPRRR7;_uu_4p\P!V4;'g/uuRRR4# +'giR#;i \ \P 3d#p\PRY4/uRp?#Rp?ii;i)rz utf-8-sigencodingNzphoton: could not read %s: %s) r existsopenjsonloadOSErrorJSONDecodeErrorloggerwarning)pathfhes r _load_authr2;s  D ;;==  YYs[Y 1 1R99R=&&B2 1 1 1 T)) *6@ s:A> A* A>* A; 5A>;A>>B;B60B;6B;c V^8dQhRRRR/#)rdatar"rNoner)rs"rrrGs^rc R\4pVPPRRR7VPVP R\ P !4 R\P!4P 24p\ P!\V4\ P\ P,\ P,\P \P",4p\ P$!VRRR7pT;_uu_4\2P4!Y^RR7TP74\ P8!TP;44RRR4TP=T4R# \&d\(P*!\,4;_uu_4\ P.!T4RRR4M +'giM;i\(P*!\,4;_uu_4TP14RRR4h +'gih;ii;i +'giL;i \&dQ\(P*!\,4;_uu_4TP14RRR4h +'gih;ii;i) T)parentsexist_okz.tmp..wzutf-8r%N)indent sort_keys)r parentmkdir with_namenameosgetpiduuiduuid4hexr(strO_WRONLYO_CREATO_EXCLstatS_IRUSRS_IWUSRfdopen BaseException contextlibsuppressr+closeunlinkr)dumpflushfsyncfilenoreplace)r4r/tmpfdr0s& r _save_authrZGs  DKKdT2 ..DII;eBIIK=$**,:J:J9KL MC S2;;3bii?PTP\P\A\ ]B YYr3 1  R IIdqD 9 HHJ HHRYY[ ! D    ) ) HHRL* ) ) )   ) ) JJL* * ) R    ) ) JJL* * ) sy8F I AH8*I -H52G H5 G" *H5H! H5! H1 , H58 I I -J&8J J& J"  J&c$V^8dQhRRRRRR/#)rauthr"keyrFrrr)rs"rrrbs&@@n@3@3@rcVPR/4PV4;'g.p\V\4'dV'd V^,#R#)z;First entry of ``credential_pool.`` (a list), or None.credential_poolN)get isinstancelist)r\r]pools&& r _pool_firstrdbsC 88%r * . .s 3 9 9rD t,,47?4?rc$V^8dQhRRRRRR/#)rr]rFrecordr"rr5r)rs"rrrhs!CDrc^RIHpV!4;_uu_4\4pV.VPR/4V&\ V4RRR4R# +'giR#;i)zQReplace ``credential_pool.`` with ``[record]`` under the cross-process lock.)_auth_store_lockr_N)hermes_cli.authrhr2 setdefaultrZ)r]rfrhr\s&& r_store_pool_recordrkhsD0   |7=h)2.s34    s ,A  A cV^8dQhRR/#rr Optional[str]r)rs"rrrqs))=)rc6\4p\VR4;'g/pVPR/4PR/4pVPR4;'g+VPR4;'gVPR4pV'd \V4#R#)zFReturn the device-flow bearer token stored by ``login()`` or ``None``.photon providers access_tokentokenN)r2rdr`rF)r\entrylegacyrss rload_photon_tokenrvqs{   e$  $    s  5555cV^8dQhRR/#rr#tuple[Optional[str], Optional[str]]r)rs"rrrs y y"E yrc(\R4p\R4pV'd V'dW3#\\4R4pVfW3#T;'g+VPR4;'gVPR4T;'gVPR43#)zRuntime SDK creds ``(spectrum_project_id, project_secret)``: process env wins (``.env`` is loaded at gateway startup), then ``auth.json`` for offline/status.PHOTON_PROJECT_IDPHOTON_PROJECT_SECRETphoton_projectspectrum_project_id project_idproject_secret_get_scoped_secretrdr2r`)env_idenv_secrts rload_project_credentialsrs 3 4F !89G '  &6 7E }  P PUYY45 P P<9PRYRxRx]b]f]fgw]x xxrcV^8dQhRR/#rmr)rs"rrrsll=lrc\R4pV'dV#\\4R4;'g/pVPR4;'g+VPR4;'gVPR4#)uProject id for management API calls — prefers ``spectrum_project_id`` (on pre-backfill installs the old ``dashboard_project_id`` is diverged and 404s).PHOTON_DASHBOARD_PROJECT_IDrrdashboard_project_idrr)rrts rload_dashboard_project_idrse = >F   &6 7 = =2E 99* + k kuyy9O/P k kTYT]T]^jTkkrrr@c ,V^8dQhRRRRRRRRRR/#) rrrFrrrnr@rr5r)rs"rrrs4>>>14>'>6C>OS>rc RVRVR\\P!44/pTPRV3RV33UUu/uFwrVV'gKWVbK upp4\RV4\ W4R#uuppi)zWPersist project credentials to both .env (runtime) and auth.json (mgmt/offline status).rrryrr@rN)rzr{updaterk_persist_runtime_env)rrrr@rfkvs$$$$ rstore_project_credentialsrs 24DnVacfgkgpgpgrcsuF MM&<>R%SV\^bUc$dj$dDAhi414$djk'0,=ks A3 A3 phone_numberassigned_phone_numberuser_idc ,V^8dQhRRRRRRRRRR/#)rrrnrrrrr5r)rs"rrrs4 . ." .BO .  .9F .RV .rcV'g V'gR#R\\P!44/pTPRV3RV3RV3RV33UUu/uFwrVV'gKWVbK upp4\RV4R#uuppi)zEPersist non-secret Photon user numbers for offline ``status`` output.Nryrrrr photon_user)rzr{rrk)rrrrrfrrs$$$$ rstore_user_numbersrs  5)3tyy{+;0rcRRV 2/#) AuthorizationzBearer rr|s&r_bearerrs wug. //rc$V^8dQhRRRRRR/#)rrrFrrrr)rs"rrrs!//s/C/N/rcj\V RV 2P44PR4pRRV 2/#):asciirzBasic )rencodedecode)rrrss&& r_basicrs>  An%56==? @ G G PE veW- ..rc V^8dQhRRRR/#)rwhatrFrr5r)rs"rrrsBBBdBrc2\f\RV 24hR#)Nzhttpx is required for Photon)httpx RuntimeErrorrs&r_require_httpxrs }9$@AArr device loginc(V^8dQhRRRRRRRR/#)rr/rFrsrrrr)rs"rrrs.YYYSY3YSYrct\V4\P!\4 V 2\ V4RR7#)>@headerstimeout)rrr`rr)r/rsrs&&$r_dashboard_getrs/4 99)*4&175>SW XXrc ,V^8dQhRRRRRRRRRR/#) rr/rFbodyr"rsrrrr)rs"rrrs0#^C#WZrc\V4\P!\4 V 2V\ V4RR7pVP 4VP 4;'g/#)zFPOST to the dashboard, raise for HTTP errors, return the decoded body.rr)rr)rrpostrrraise_for_statusr))r/rrsrresps&&&$ r_dashboard_postrsP4 ::*+D62wu~_c dD 99;  "rc V^8dQhRRRR/#)rrrrrFr)rs"rrrs 6 6 6 6rcRp\P!\4;_uu_4VP4pRRR4\ V\ 4'dSRF-pVP V4'gK\W,4u# \P!VRR7R,#\VRR4;'gRpV'd VR,#R# +'giL;i)NT)r<:NiNtextrzno response body)errormessagedetail) rOrPrr)radictr`rFdumpsgetattr)rr4r]rs& r_response_error_detailrs D   Y ' 'yy{ ($1Cxx}}49~%2zz$$/55 4 $ * *D4:5#55 ( 's C C c$V^8dQhRRRRRR/#)rrractionrFrr5r)rs"rrr s&eeCeeerc h\VR^4pVR8d\RV RV R\V4 24hR#) status_codePhoton z failed: HTTP z: N)rrr)rrstatuss&& r_raise_for_statusr sB T=# .F }WVHN6("E[\`EaDbcddrc V^8dQhRRRR/#)rfnzCallable[[], None]rr5r)rs"rrrs    T rc\P!\4;_uu_4V!4RRR4R# +'giR#;iN)rOrPr)rs&r_safers'   Y ' '  ( ' ' 's 5 A cT]tRtRt$R]R&R]R&R]R&R]R&R]R &R]R &R tR #) DeviceCodeirF device_code user_codeverification_urirnverification_uri_completerz expires_inintervalrN)rrrr__annotations__rrrrrrs#N,,OMrrT)frozenc0]tRtRt$RtR]R&R]R&RtR#)_DeviceTokenCandidatei#z.__annotate__Isdrc2<S'd\S4R#R#r)r)r sr_pending poll_for_token.._pendingIs  *  rrr z$photon: device-token poll failed: %sr)rzPhoton returned 200 but no token candidate in the device-token response (expected access_token, data.access_token, accessToken, or set-auth-token).irrrr slow_downzPhoton login failed: zPhoton device token error: z-photon: device-token unexpected status %s: %s:NNzPhoton device login timed out)authorization_pendingr) expired_token access_denied)rrr{rr rr rsleeprr RequestErrorr-r.rrOrP TypeError ValueErrorr)rar!_device_response_token_candidatesrrrsr,r`r TimeoutError)rrrrr urldeadlinergrantrrr1r candidateserrs&$$$d rpoll_for_tokenr'<s ?#   5 6Cyy{gPPPP.__annotate__s!3##rcx<\VS4pVPR9d \V4hVP4V#))rFi)rrrr)r/rCrrss&& r_get#validate_photon_token.._gets9dE*   z )*84 4  rz/api/auth/get-sessionzKPhoton issued a device token, but the dashboard session lookup rejected it.userNzTPhoton issued a device token, but the dashboard session lookup did not recognize it./api/projects/zXPhoton device token was accepted for the session lookup but rejected by the project API.)r)rarr`r)rsrGr4rIsf rrrsz '] __c_c_e )$55488F 4D dD ! !& bd d uv Krc V^8dQhRRRR/#)rr%rbrrFr)rs"rrrsII4ICIrcV'g \R4hRpRpVF%p\VP4VPu# Ve5RP RV44;'gRp\ V RV R24VhVeVh\R4h \d,pTp\ T\ 4'd TpRp?KRp?KRp?ii;i) zBReturn the first candidate token that passes dashboard validation.zHPhoton returned 200 but no token candidate in the device-token response.Nz, c38"TFqPxK R#5ir)r).0cs& r -_validated_dashboard_token..s9jHHjsnonez@ Device login returned no project-valid dashboard token (tried: z).z.Photon did not return a usable dashboard token)rrrsrrarjoin)r%dashboard_error last_error candidateexcsourcess& r_validated_dashboard_tokenrYs eff:>O*.J  & !)// 2?? " "))9j99CCV&_`g_hhj k   G HH &J#788"%9 &s B  CB==C open_browser on_user_codec(V^8dQhRRRRRRRR/#)rrrFrZrr[z&Optional[Callable[[DeviceCode], None]]rr)rs"rrrs,9=8DGrcaa\VR7oS'd\VV3Rl4V'da\P!\4;_uu_4^RIpTP SP;'g SP^R7RRR4\SVR7p\\RVR7.4p\V4V# +'giLA;i)zRun the full device-code login flow, validate the token against the dashboard API before persisting it, and return it. ``on_user_code`` receives the :class:`DeviceCode`.)rc<S!S4#rr)rr[sr#login_device_flow..s l4(rN)newpollr-) r rrOrPr webbrowserr(rrr'rYrr})rrZr[rc first_tokenrsrs$$d @rlogin_device_flowres  3D ()   + +  OOD::SSd>S>SYZO [,!;K &(=VS^(_'` aEu L , +s 6C C c V^8dQhRRRR/#)rr4rrlist[dict[str, Any]]r)rs"rrrs  s 3 rc8a\V\4'dV#\V\4'dkRFdpVPV4o\S\4'dSu#\S\4'gKF\ V3RlR4R4pVfKbVu# .#)r4c3<"TF5p\SPV4\4'gK*SV,xK7 R#5ir)rar`rb)rNrinners& rrP_unwrap_list..s3B1XA",UYYq\4"@ (uQxx1Xs 'AAN)r4projectsuserslinesr?)rlrmrnr?)rarbrr`next)r4r]nestedrjs& @r _unwrap_listrqs$ $BCHHSME%&& %&&B1XBCGI%!MC Irc$V^8dQhRRRRRR/#)rr/rFrsrrgr)rs"rrrs"%%#%c%.B%rcn\WRR7pVP4\VP44#)rr)rrrqr))r/rsrs&& r_dashboard_listrts+ $B /D  $$rc$V^8dQhRRRRRR/#)rr4r"rrFrr5r)rs"rrrs&GGnGcGdGrcdVPR4'd\RV RVR, 24hR#)rrz failed: N)r`r)r4rs&&r_raise_on_error_keyrws2 xxWVHId7m_EFFrc V^8dQhRRRR/#)rrsrFrrgr)rs"rrrs333!53rc\RV4#)u7GET ``/api/projects`` — return the caller's projects. /api/projectsrtr|s&r list_projectsr|s ?E 22rc$V^8dQhRRRRRR/#)rrsrFr@rOptional[dict[str, Any]]r)rs"rrrs"33KrcT;'gRP4P4p\V4FCpVPR4;'gRP4P4V8XgKAVu# R#)z4First project whose name matches (case-insensitive).rr@N)r9r:r|r`)rsr@targetprojs&& rfind_project_by_namerscjjb   ! ' ' )Fe$ HHV  " " ) ) + 1 1 3v =K% rlocationz United Statesc(V^8dQhRRRRRRRR/#)rrsrFr@rrr"r)rs"rrrs, ?BYgrcRVRVRRRR/p\RW0RR7p\V\4'g \R 4h\ VR 4VP R 4RJd(\R VP R 4;'gT 24h\VP R4\4'd VR,MTpVP R4'g \R4hV#)zyPOST ``/api/projects`` and return the project (Spectrum is always provisioned; the request carries no ``spectrum`` flag).r@rtemplateF observabilityrzz project creationrz5Photon create-project returned an unexpected responsezcreate-projectsucceedzPhoton create-project failed: rr4idz1Photon create-project did not return a project id)rrarrrwr`)rsr@rrr4projects&$$ rcreate_projectrs#D*h ESbdijD ?D>Q RD dD ! !RSS./ xx e#;DHHYLY,9OS`nrc\R4\PV4'g\RV: 24h\ 4 RV R2pRRRV/pV'd\ P R4TPR V3R V3R V33U U u/uFwrV 'gKWbK up p 4\P!Wx\W4R R 7p \V R4V P4;'g/p \V R4V PR4;'gV PR4;'gT p \V \ 4'g \#R4hV #uup p i)zBPOST Spectrum Cloud ``/projects/{id}/users/`` and return the user.z user creationz4phone_number must be E.164 (e.g. +15551234567); got rrtypesharedrz?photon: send_invite is ignored by Spectrum shared-user creation firstNamelastNamerrrz create-userrIr4z2Photon create-user returned an unexpected response)rE164_REmatchrrr-debugrrrrrr)rwr`rarr)rrrrrrrr"rrrrr4rIs&&$$$$$ r create_userr;s-#$ == & &OP\O_`aa   j G UX_afWg"hn"h$!lm"hno ::cfZ.PZ^ _DdM* 99;  "Dm, 88F  7 7txx/ 7 74D dD ! !OPP Kos  E E c4V^8dQhRRRRRRRRRRRRR R /#) rrrFrrrrnrrrztuple[dict[str, Any], bool]r)rs"rrrQsD ? ? ?%( ?;> ?LY ? ?,9 ?E` ?rc J\WV4pVeVR3#\WW#WER7R3#)uIdempotently register a Spectrum user → ``(user, created)``; the official CLI does no dedup, so we add it to keep ``setup`` re-runnable.F)rrrrT)rr)rrrrrrexistings&&$$$$ rregister_user_if_absentrQs< "*lKH z !* 9:> ??rc V^8dQhRRRR/#)rrIr~rrnr)rs"rrr]s%%5%-%rcbV'dVPR4MRpV'd \V4#R#)zThe iMessage number a user texts to reach the agent (``assignedPhoneNumber``, the dashboard's "TEXTS ON" column). None when unset (freshly created user).assignedPhoneNumberN)r`rF)rIvals& ruser_assigned_liner]s(.2$((( )tC3s8$$rcV^8dQhRR/#rr)rs"rrrdshh>hrcl\\4R4p\V\4'dTM/pVP R4;'gVP R4pVP R4;'gVP R4pV'd \ V4M \ 4V'd \ V43#R3#)z>``(operator_phone_number, assigned_phone_number)`` for status.rrrrrN)rdr2rarr`rF_configured_operator_phone)rtrassigneds rload_user_numbersrds  m 4Et,,E"E IIn % A A=)AEyy01UUUYY?T5UHCJ%?%AT\3x= ggbf ggrc$V^8dQhRRRRRR/#)rrrFrrrr)rs"rrrms"S#Berc\4wr#V'd\WV4pM&\W4p\V4^8Xd V^,MRpRpV'dgVP R4p\ \ VP R4;'gR44p\PV4'dTp\V4p\4pV'g \4MRp V 'dHV'd@\WRR7p V 'd*V P R4'd\ V R,4p\!Y#V'd \ V4MRVR7W#3# \d!p \PRT 4Rp ? LJRp ? ii;i) zFRefresh cached user numbers from Photon without provisioning anything.NrrrF)create_if_missingz6photon: could not refresh iMessage line for status: %s)rrrr)rrrlenr`rrFrrrrrvget_imessage_linerr-rr) rrrrrIrmrdashboard_phone dashboard_iddashboard_tokenliner1s && rrefresh_user_numbersrms$')OE !*eD:6u:?uQxG ((4.*3txx /F/L/L"+MN == ) )#E%d+,.L19')tO< V$_V[\D//tM23E/6s7|DWce ?  V LLQST U U Vs'+E E E4E//E4cV^8dQhRR/#rmr)rs"rrrs;;M;rc\\R4;'gR4pV'd\PV4'dV#\R4;'gRp\ \\ P !RV44Uu.uF"p\PV4'gK VNK$ pp\V4^8Xd V^,#R#uupi)zDInfer the operator's E.164 number from existing Photon env settings.PHOTON_HOME_CHANNELrPHOTON_ALLOWED_USERSz[,\s]+N)r_get_config_env_valuerrmaprsplitr)homeallowednr%s rrrs 12GHNNB OD  d## #$:;AArG !1288Iw3OPePT[TaTabcTd!!PJe Oq0:a=:d:fs C"Cc V^8dQhRRRR/#)rr]rFrrnr)rs"rrrss}rcn^RIHpT!T4# \d\P!T4u#i;i)) get_env_value)rrrrAr)r]rs& rrrs63   yy~s !44c$V^8dQhRRRRRR/#)rrsrFrrrgr)rs"rrrs'GGcGsG/CGrc"\RV R2V4#)uOGET ``/api/projects/{id}/lines`` → ``[{id, platform, phoneNumber, status}]``.rJ/linesr{)rsrs&&r list_linesrs ^J FFrplatformimessagec(V^8dQhRRRRRRRR/#)rrsrFrrrr"r)rs"rrrs($$C$S$s$N$rcv\RV R2RV/V4p\VR4VPR4;'gT#)z:POST ``/api/projects/{id}/lines`` to provision a new line.rJrrzadd-liner)rrwr`)rsrrr4s&&$ radd_liners@ ^JX@VX] ^Dj) 88F  # #t#rrc(V^8dQhRRRRRRRR/#)rrsrFrrrrr~r)rs"rrrs,     7; G_ rc\R\W44R4pVf V'gV#\WRR7# \d"p\P RT4Rp?R#Rp?ii;i)zThe project's iMessage line, provisioning one if absent and ``create_if_missing``; None if there is none and provisioning failed.c3"TF6qPR4;'gRP4R8XgK2VxK8 R#5i)rrrN)r`r:)rNlns& rrP$get_imessage_line..s5p;z@R@X@XVX?_?_?aeo?o;sAA ANr)rz2photon: could not auto-provision iMessage line: %s)rorrrr-r.)rsrrrr1s&&$ rrrs^ pj;prv wD 0 J?? KQOs 9 A%A  A%c V^8dQhRRRR/#)remitrrr5r)rs"rrrs34rc0\4wr\4wr4RRR\4'dRMR,RV'dTMR,RV'dRMR,R V'dTMR ,R V'dTMR,.pV!R PV44R #)zPretty-print the credential status table via *emit*. Every secret-bearing read is reduced to a display literal here; the callback only ever receives the assembled banner, so no tainted value escapes to the caller.zPhoton iMessage statusuB──────────────────────z device token : u ✓ storedu'✗ missing (run `hermes photon setup`)z project id : u ✗ missingz project secret : z my number : u3✗ missing (run `hermes photon setup --phone ...`)z assigned number :  N)rrrvrS)rsidsecrrrowss& rprint_credential_summaryrs()HC')OE L"-//L5^ `"ScmD"cl}M"ue:op"(h@ij lD 4r)r)er __future__rr)loggingrArrJr{rCbase64r dataclassesrpathlibrtypingrrrr r r rrgateway.platforms._sharedr rhermes_constantsrrO getLoggerrr-rrDEFAULT_CLIENT_ID DEFAULT_SCOPErrDEFAULT_PROJECT_NAMEr r compilerr r2rZrdrkrvr}rrrrrrrrrrrrrrrrrrrr r'r r0r.rrYrerqrtrwr|rrrrrrrrrrrrrrrrprintrrrrrs#  !==N,   8 $P|P !& 37% **) * + 6@ )Y   yl>*.>FJ> .%) .RV .! .IM . O"VT0/ B YY PR 6e     $ E)EBOE$48*;48VZ48"48OS48nX\*Y (I0)@D;?(  % G 3 3ET". %\`#<@V[, ?\` ?# ?<@ ?%h:;G $Z$ >B  */A EsI I$#I$