+ lHj#4a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI H t ^RI H t Ht^RIHt^RIHtHt]P(!]4t] RRl4tR R lt] !R R 44t]P4!R RR7tR]R&RRltRRltR#)zDashboard-mediated callback bridge for MCP OAuth: the SDK still does discovery, DCR, PKCE, state validation and token exchange; this only moves the two human/browser callbacks from a loopback listener into the already-authenticated dashboard session.) annotationsN)contextmanager) dataclassfield)Iterator)parse_qsurlparsec V^8dQhRRRR/#)varzcontextvars.ContextVarreturnzIterator[None])formats">/home/ubuntu/.hermes/hermes-agent/tools/mcp_dashboard_oauth.py __annotate__rs..c#"VPV4pRxVPV4R# TPT4i;i5i)zGSet *var* to *value* for the block, restoring the previous value after.N)setreset)r valuetokens&& rcontextvar_setrs4 GGENE  % %sA,A?Ac V^8dQhRRRR/#)r exc BaseExceptionr strr )rs"rrrs**=*S*rcR\V4;'g\V4P#)z``str(exc)``, or the type name when it is empty (bare ``TimeoutError()``/``RuntimeError()``) so ``mark_error`` never records a blank cause.)rtype__name__)rs&rexception_messagers  s8 ) )tCy)))rc]tRt^%t$R]R&R]R&R]R&R]R&R]R&RtR ]R &]!]PR 7tR ]R &Rt R]R&Rt R]R&Rt R]R&]!] R 7t R]R&RtR]R&]!RRR7tR ]R&]!RRR7tR]R&]!RRRR7tR]R&]!RRRR7tR]R&]!]P(RRR7tR]R &]!]P(RRR7tR]R!&]!]P(RRR7tR]R"&]!]P0RRR7tR#]R$&R%R&ltR'R(ltR;R)R*lltR+R/R,R-lltRr0approved)rrqueryget ValueErrorr>r6 RuntimeErrorr._reopen_ended_attemptr7r/r;r)selfr@rDs&& rpublish_authorization_url,DashboardOAuthFlow.publish_authorization_url=s#,,-11'D6B1ELM M ZZZ~~~"#PQQ{{33**,"' %( "2DK  % % ) ) +ZZZsAC* A,C C* C' ! C*cV^8dQhRR/#r r rAr )rs"rrrBSs ! !t !rc \PRVPVPVP4RVnRVnRVnRVnVPP4RVn RVnR#)uReset an ended attempt so the next authorization URL mints a fresh state (caller holds ``self._lock``). The ended attempt's URL, state and spent authorization code are dropped — replaying them would hand the SDK a code the provider already burned.zQMCP OAuth: dashboard flow %s for '%s' ended (%s); re-minting for the next attemptNr-) loggerinfor"r#r.r/r7r9r:r<clearr0rLs&rrK(DashboardOAuthFlow._reopen_ended_attemptSsh  gLL$"2"2DKK A!%"# ""$   rc V^8dQhRRRR/#)r timeoutr+r rr )rs"rrrBas&&&&rc "\P!VPPV4GRjxL 'g \ R4hVP 'g \ VP;'gR4hVP #LR5i)Nz+Timed out waiting for MCP authorization URLz)MCP OAuth flow ended before authorization)asyncio to_threadr;wait TimeoutErrorr/rJr0rLrXs&&rwait_for_authorization_url-DashboardOAuthFlow.wait_for_authorization_urlasi&&t'@'@'E'EwOOOLM M%%%tzzXX-XY Y%%% Ps /BB BBB1Bissc ,V^8dQhRRRRRRRRRR/#)r coder$rDr0rar rAr )rs"rrrBhs4''!'*4'=G'NX' 'rc VP;_uu_4VPP4'd \R4hVPe,Ve(\ P !VPV4'g \R4hV'dW0nMV'd WV3VnMRVnVPP4RRR4R# +'giR#;i)uHand the browser redirect to the waiting flow; ``state`` must match exactly. ``iss`` (RFC 9207) is carried through — see ``tools.mcp_oauth._parse_redirect_query``. zOAuth callback already receivedNzOAuth callback state mismatchz,OAuth callback did not include code or error) r>r<is_setrIr7secretscompare_digestr:r9r)rLrcrDr0ras&$$$$rdeliver_callback#DashboardOAuthFlow.deliver_callbackhsZZZ##**,, !BCC""*em7CYCYZ^ZmZmotCuCu !@AA',$"&s!3'U$  $ $ &ZZZsA$C:C C+C C" c V^8dQhRRRR/#)r rXr+r z"tuple[str, str | None, str | None]r )rs"rrrB|s  u Ac rc "\P!VPPV4GRjxL 'g \ R4hVP 'd\ RVP 24hVPf5\ RVP RVP RVP: R24hVP#L5i)Nz(Timed out waiting for MCP OAuth callbackzOAuth authorization failed: zMCP OAuth flow for 'z.' ended without an authorization code (status=z, error=)) rZr[r<r\r]r:rJr9r#r.r0r^s&&rwait_for_callback$DashboardOAuthFlow.wait_for_callback|s&&t';';'@'@'JJJIJ J    !=d>R>R=STU U >> !&t'7'7&89;;-x ~Q@A A~~Ks/CB? CCA'CcV^8dQhRR/#rPr )rs"rrrBstrc VP;_uu_4VPR8Xd \R4hRVnRVnRRR4R# +'giR#;i)r0zOAuth flow already endedrFN)r>r.rJr0rUs&r mark_approved DashboardOAuthFlow.mark_approveds= ZZZ{{g%"#=>>$DKDJ ZZZs +A  A c$V^8dQhRRRRRR/#)r r0rr6r(r rAr )rs"rrrBs!'''4'D'rc VP;_uu_4VP;'gTVnVPR9d RRR4R#RVnT;'gRVnVPf VP fVPVnVP P4VPP4RRR4R# +'giR#;i)aFail the flow with *error*; the first reason wins. Waking the callback waiter makes the worker fail too, and its follow-on ``mark_error`` must not clobber the cause the user needs. ``cancelled`` marks a user cancellation, which ``publish_authorization_url`` refuses to re-mint (unlike an ordinary failure, which a retry may reopen). It is recorded even when the flow has already ended: the user's "no" outranks the recorded cause and keeps the handle terminal. r0NzLMCP OAuth flow failed before the callback was received (empty error message)>r0rF) r>r6r.r0r9r:r;rr<)rLr0r6s&&$r mark_errorDashboardOAuthFlow.mark_errorsZZZ!^^88yDN{{33Z"DKpp"pDJ~~%$*>*>*F'+zz$  % % ) ) +  $ $ &!ZZZs.C CA)C C! cV^8dQhRR/#)r r dictr )rs"rrrBsVV$Vrc  VP;_uu_4RVPRVPRVPRVPRVP /uuRRR4# +'giR#;i)r"r#r.r/r0N)r>r"r#r.r/r0rUs&rsnapshotDashboardOAuthFlow.snapshotsN ZZZt||]DA A/ cV^8dQhRR/#rPr )rs"rrrBs  $ rc :VPP4R#N)r=rrUs&rmark_worker_done#DashboardOAuthFlow.mark_worker_dones rcV^8dQhRR/#)r r r(r )rs"rrrBs**T*rc 6VPP4#r~)r=rerUs&r worker_doneDashboardOAuthFlow.worker_dones  ''))r)r9r:r/r6r0r7r.)g>@)gr@)&r __module__ __qualname____firstlineno____annotations__r)rtimer,r.r/r0listr1r3r6r7r9r: threadingEventr;r<r=Lockr>rMrKr_rhrmrqrurzrpropertyr__static_attributes__r rrr!r!%st L  ND dii8J8FC$(z(E:d3E:3OSE6It6!&t%!@NJ@;@TY`e;fI8f"'5u"MOZM,1)//X]di,j/j',Y__SX_d'eO_e$))//PU\a$bL/b!)..uSXYE>Y,, !&'[_'( '%'4V  **rr!mcp_dashboard_oauth_flow)r4z1contextvars.ContextVar[DashboardOAuthFlow | None]_current_dashboard_flowcV^8dQhRR/#)r flowr!r )rs"rrrs9919rc"\\V4#)zNMake *flow* the active dashboard OAuth flow for the block (ContextVar-scoped).)rr)rs&rdashboard_oauth_flowrs 14 88rcV^8dQhRR/#)r r zDashboardOAuthFlow | Noner )rs"rrrs))";)rc*\P4#r~)rrHr rrget_dashboard_oauth_flowrs " & & ((r)__conditional_annotations____doc__ __future__rrZ contextvarsloggingrfrr contextlibr dataclassesrrtypingr urllib.parserr getLoggerrrRrrr! ContextVarrrrr)rs@rrs># %(+   8 $*  L*L* L*^NYMcMcd~IMNNJN9 )r