+ lHj :aRt0tRt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI t ^RI t ^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RIHt^RIt^RIt^RIHtHt^RIHt^RI H!t!H"t"^RI#H$t$H%t%^RI&H't'^R I(H)t)^R I*H+t,H-t-]!'d^R I.H/t/^R I0H1t1H2t2H3t3H4t4] Pj!]64t7R t8!RR]94t:];!]Px]Pz]P|]P~04t@RRltAR]8/RRlltBRRltC] P!R4RJsE\'g]7PR4RtG/tH]^kRRltI^RIJHKtK!RR]94tLRsM]^k]P!RRR 7tO]P!R!R"R 7tP];!0Rm4tQR#tRRR$R%lltSR&R'ltT/tU]^k^tVR(R)ltWR*R+ltXR,R-ltYR.R/ltZR0R1lt[R2R3lt\R4R5lt]R6t^R7t_R8R9lt`R:R;ltaR<R=ltbR>R?ltc!R@RA4tdRRBRCllteRDREltfRFRGltgRHRIlthRJRKltiRLtjRMtkRRNROlltlRRPRQlltmRRRSltnRTRUltoRRVRWlltpRsq]^kRXR/RYRZlltrR[tsRtt];!R\R]04tuR^R_ltv.tw]^kR`RaltxRbRcltyRRdRelltzRfRglt{RhRilt|RjRklt}RRlRmllt~RnRoltRptRqtRRrRslltRtRuRvR/RwRxlltRyRzltR{R|ltR}R~ltRvR/RRlltRRRlltR# ]dRtELi;i ]dRtELi;i ]dRtKELi;i)a{MCP OAuth 2.1 client support: browser authorization-code flow with PKCE. The SDK's ``OAuthClientProvider`` does discovery, client identification, PKCE, exchange and refresh; this module supplies ``HermesTokenStorage`` (on-disk persistence), the localhost callback listener and ``build_oauth_auth()`` (legacy entry point). client_id is Hermes' Client ID Metadata Document URL (CIMD) when the server supports it, else RFC 7591 DCR. ``mcp_servers..oauth`` keys (all optional): client_id, client_secret, scope, redirect_port, redirect_uri (proxy callback), redirect_host, client_name, client_metadata_url, cimd, user_agent, timeout.) install_hintN) partialmethod)BaseHTTPRequestHandler HTTPServerPath) TYPE_CHECKINGAny)parse_qsurlparse)secure_parent_dir)atomic_json_write)contextvar_setget_dashboard_oauth_flow)OAuthClientProvider)OAuthClientInformationFullOAuthClientMetadata OAuthMetadata OAuthTokengN@c]tRt^ POST -> persist. Token files are written atomically (``_write_json``), so a reader never sees a torn file; the only cross-process hazard is the read-modify-write of a single-use refresh token. The damaging interleaving is: A: get_tokens() -> R1 B: get_tokens() -> R1 A: POST R1 -> 200, receives R2 B: POST R1 -> 400, credential already burned B: clear_tokens() -> user is logged out of a live session No lock scoped to one file read or write can prevent it: the fence must be held across the POST. It lives in a ``.refresh.lock`` sibling of the token file so the holder can still read/write the tokens normally. Entered from the SDK's coroutine-driven auth flow, so the wait is an ``asyncio.sleep`` poll on a non-blocking lock: a peer's slow network round trip must not freeze every other task on this event loop. No in-process lock layer is needed: an advisory lock on a fresh descriptor already excludes sibling tasks and threads of the same process. Acquisition failure RAISES. Degrading to "proceed unlocked" would reintroduce the exact race. Returns the locked descriptor; the caller hands it back to ``release_refresh_fence`` from its own exit path (the SDK drives the refresh as a generator, so no single ``with`` block can span the critical section). mkdir_under_hermes_homezrefresh fence unavailable (z): Nz;refresh fence unsupported: no flock/msvcrt on this platformz.refresh fence unavailable on this filesystem: z!refresh fence held by a peer for z.0fzs ()g?)r*hermes_constantsr1parentr osopenO_RDWRO_CREATOSErrorrnametime monotonicfcntlflockLOCK_EXLOCK_NBmsvcrtlockingLK_NBLCKerrno_FENCE_CONTENTION_ERRNOSasynciosleep BaseExceptionclose)r#r+ lock_pathr1fdexcdeadlines&$ r acquire_refresh_fencerOQs:#4(I < 0 01)$ WWY BJJ 6 >~~')H *$KKEMMEMM$AB 'NN2v:  .U! "))..)9SE B  ( *99$<<.HN>>#x/-;GC=INNK[[\] mmD)))) *    s G5AD -G5 G AD:G5/D:?G5 D: D7D22D77G5: G A5G:F=;GGG  G#G22G5c(V^8dQhR\RR/#)r"rLr$Nr.)r%s"r r&r&s  c d rc >\e'\P!V\P4M.\e'\P!V\P ^4\P!\ 4;_uu_4\P!V4RRR4R# \ dLPi;i +'giR#;i \P!\ 4;_uu_4\P!T4RRR4i +'gii;i;i)zRUnlock and close a descriptor returned by ``acquire_refresh_fence``. Never raises.N) r>r?LOCK_UNrBrCLK_UNLCKr: contextlibsuppressr6rJ)rLs&r release_refresh_fencerWs    KKEMM *   NN2v 2  ) ) HHRL* )    * ) )Z  ) ) HHRL* ) ) )sQ-B!C.B!B2! B/,C.B//C2 C #D)D D D Dmcp8MCP OAuth types not available -- OAuth MCP auth disabledc0V^8dQhR\R\/#r"r;r$strr )r%s"r r&r&s""S"S"rc\'gG^RIHp^RIHpVP\R&\ R,Fp\ W#4\V&K \PV4# \\3dG\P\P\ 44Rs \PR4Lki;i)zmSDK OAuth class *name*, importing the SDK on first call; None when unavailable (a broken SDK is probed once).)authr:NNFrY) _SDK_CLASSES mcp.clientr_ mcp.sharedr_SDK_CLASS_NAMESgetattr ImportErrorAttributeErrorupdatedictfromkeys_OAUTH_AVAILABLEloggerdebugget)r; _client_auth _shared_auth_names& r _sdk_classrrs < U 7 72>2R2RL. /)"--&-l&B U#.   D !! ^, U    .> ? @$  LLS T UsAA((AB?>B?)AnyUrlc]tRt^tRtRtR#)OAuthNonInteractiveErrorzHRaised when OAuth requires browser interaction in a non-interactive env.rNrrrr rurusRrru_oauth_interactive_enabledT)default_oauth_interactive_forcedF__hermes_user_skipped__cTV^8dQhR\\,R,R\/#)r" hermes_homeNr$r]r)r%s"r r&r&s'^^d T 1^T^rc^^RIHp\VeV4R, #V!44R, #)u<``HERMES_HOME/mcp-tokens/`` — per-profile token directory.)get_hermes_homez mcp-tokens)r4r~r)r{r~s& r _get_token_dirrs,0 {6 NQ] ]]OV^8dQhR\R\R,/#)r"portr$NrQ)r%s"r r&r&strcZ\P!\P\P4pVPRV34TP 4^,p\\4\8dm\R\4R4pTfMP\P!\4;_uu_4\PT4P 4RRR4KT\T&T# \dTP 4T'dR#hi;i +'giK;i)zBind ``127.0.0.1:port`` (0 = ephemeral) and park it until the waiter adopts it; None if taken. The cap evicts ephemeral parks only: losing a pinned CIMD port (the only ones the published document declares) mid-flow would reopen the race. 127.0.0.1Nc3>"TFq\9gKVxK R#5iN) _CIMD_PORTS).0ps& r !_bind_reserved..sP&7K;O11&7s  )socketAF_INET SOCK_STREAMbindr:rJ getsocknamelen_reserved_sockets_MAX_RESERVED_SOCKETSnextrUrVpop)rsockbound stale_ports& r _bind_reservedrs ==);); [rcXR;r\V4p\V\4'dVPR4MRp\V\\ 34'dTMRFp\ \V44pVPVPrTf/TPR8XdTP'd \T4pTPR8H;'dTPR8H;'dTR9p TeKT 'gKTfK\T4pK W3# \\3dKi;i)z``(https proxy URI, loopback callback port)`` from the cached client registration (None when absent): a DCR ``client_id`` is bound to its registered redirect URI, so a new random port under it gets ``redirect_uri does not match any registered URIs``.N redirect_urishttpshttp /callbackr> localhostr)rrrirnlistrr r]hostnamerrrschemenetlocr#r.) rurirrurisrawparsedparsed_hostname parsed_portis_loopback_callbacks & r _cached_redirectr!sC w 'D(24(>(>488O $DD!$u 66tB> c#h'F,2??FKK[ ;6==G3 c(C%}}6 H H6;;+;U H HZinH[H <00[5L{#D? 9:&   s+DD)(D)c$V^8dQhR\/#rbool)r%s"r r&r&8s4rc\PP4'gR#\ P R8wdR#^RIp^RIpTP!\PP44pTP4p\TPPPTP!T4TP#T444# \\3dR#i;i \$dR#i;i)agA human can type on stdin. ``isatty()`` alone is wrong on Windows: the CRT reports True for a DEVNULL / detached / CREATE_NO_WINDOW stdin (the gateway's), so a background process looked interactive and launched browser OAuth flows nobody could finish. Confirm with the console API there: ``GetConsoleMode`` fails on anything that is not a real console handle.FntTN)sysstdinisattyrgrr6r;ctypesrB get_osfhandlefilenoc_ulongrwindllkernel32GetConsoleModec_void_pbyref Exception)rrBhandlemodes r _stdin_is_consoler8s yy!!" ww$%%cii&6&6&89~~FMM**99&//&:QSYS_S_`dSefgg J ' s$#CBC,C)(C), C;:C;c$V^8dQhR\/#rr)r%s"r r&r&Nsrc\P4'gR#\P4'dR#\4#)z9True if we can reasonably expect to interact with a user.FT)rvrnrxrrrr _is_interactiverNs/ % ) ) + + $$&&  rc(V^8dQhR\RR/#)r"leadr$Nr)r%s"r r&r&Ws   C  D  rcB\4'g\V R24hR#)aERaise ``OAuthNonInteractiveError`` unless interactive; *lead* is the boundary-specific first sentence. ``lead`` is the boundary-specific first sentence; this helper appends the shared, actionable ``hermes mcp login`` next-step so the guidance wording lives in one place across every non-interactive OAuth boundary (#57836). zd Run `hermes mcp login ` interactively to (re)authorize, then restart or reload the gateway.N)rru)rs&r _raise_if_non_interactiverWs*   &fx y   rc"\\R4#)aZTreat the context as interactive despite no TTY (GUI-driven auth: the user IS present, just not on stdin). Crosses the MCP event-loop thread like ``suppress_interactive_oauth``. Opens the browser + localhost callback flow that the TTY heuristic would otherwise refuse. Same ContextVar propagation story as suppress_interactive_oauth() (#35927). T)_contextvar_setrxrrr force_interactive_oauthrds 4d ;;rc"\\R4#)uDisable stdin-based OAuth prompts for the current context; ContextVar-based so a background-discovery thread's suppression reaches the coroutine on the MCP event-loop thread. Uses a ContextVar so the suppression propagates from a background-discovery thread onto the coroutine scheduled (via run_coroutine_threadsafe) on the dedicated MCP event-loop thread — where the OAuth callback actually runs (#35927). A threading.local would not cross that thread boundary. F)rrvrrr suppress_interactive_oauthrns 5u ==rc$V^8dQhR\/#rr)r%s"r r&r&ysPP4Prc\PPR4'g&\PPR4'dR#\PR8Xg;\ \R4'd'\P !4P R8XdR#\\PPR4;'g \PPR 44#) z,True if opening a browser is likely to work. SSH_CLIENTSSH_TTYFrunameDarwinTDISPLAYWAYLAND_DISPLAY)r6environrnr;hasattrrsysnamerrrr _can_open_browserrys zz~~l##rzz~~i'@'@ ww$72w//BHHJ4F4F(4R  y)NNRZZ^^V^8dQhR\R\R,/#)r"r#r$Nrri)r%s"r r&r&sTdTkrcVP4'gR#\P!VPRR74# \P\ 3d"p\ PRY4Rp?R#Rp?ii;i)zCRead a JSON file, returning None if it doesn't exist or is invalid.Nz utf-8-sig)encodingzFailed to read %s: %s)existsjsonloads read_textJSONDecodeErrorr:rlwarning)r#rMs& r rrs\ ;;==zz$..+.>??  ' *.:s%AA<A77A<c4V^8dQhR\R\RR/#)r"r#datar$Nr)r%s"r r&r&s!;;d;$;4;rcp^RIHpV!VP4\V4\ WR\ R7R#)uOAuth tokens/client info at 0600 from creation, parent tightened to 0700 (``secure_parent_dir`` refuses ``/``, top-level dirs and the install tree — #25821, #93050).r0r2)rrwN)r4r1r5r r r])r#rr1s&& r _write_jsonrs'9DKK(dduc:rc0V^8dQhR\R\/#)r"modelr$)r ri)r%s"r r&r&s<HermesTokenStorageizPersist OAuth state as ``HERMES_HOME/mcp-tokens/`` + ``.json`` (tokens), ``.client.json`` (client info), ``.meta.json`` (server metadata), ``.cimd-off`` (CIMD refused).r{NcD<V^8dQhRS[RS[S[,R,/#)r" server_namer{Nr|)r% __classdict__s"r r&HermesTokenStorage.__annotate__s$..C.td9J.rcn\V4VnVe \V4MRVnRVnRVnR#r)r _server_namer _hermes_home loaded_issuer _bound_issuer)selfr r{s&&$r __init__HermesTokenStorage.__init__s5*;71<1HD-d*.)-rc&<V^8dQhRS[RS[/#)r"r)r$r|)r%r s"r r&r sRRCRDRrcV\VP4VP V 2, #r)rrr)rr)s&&r _pathHermesTokenStorage._paths(d//0d6G6G5H3QQQrz.jsonz .client.jsonz .meta.jsonz .cimd-offc:<V^8dQhRS[S[S[S[3,/#r)rr)r%r s"r r&r s#PPeD$$45Prc`VP4VP4VP43#r) _tokens_pathr _meta_pathrs&r _state_pathsHermesTokenStorage._state_pathss(  "D$:$:$OOOrc,<V^8dQhRS[RS[RS[/#)r"r#sdk_namelabel)rr])r%r s"r r&r s"$#crc  \V4pVeC\V\4'g-\P RW \ V4P 4R#Ve \V4MRpVe=VR8Xd6\V\4'd VPR4'd ^RI H pTpVfR#Ve V!V4VPV4# \\\3dfpTp\TR4'd0RRP!R TP#R R 744,p\P R Y T4Rp?R#Rp?ii;i) zRead *path* into SDK model *sdk_name*; None if absent, no SDK, or corrupt. ``fixup(data)`` may rewrite the raw dict before validation.Nz.s3>cBaQCHHSaeeE2&6788Bas<>F) include_inputz Corrupt %s at %s -- ignoring: %s)rrrirlrtyperrrrntools.mcp_oauth_devicer%model_validaterrKeyErrorrr*r&) r#r!r"fixuprclsr%rMdetails &&&& r _load_modelHermesTokenStorage._load_models!$  JtT$:$: NNY T (;(; =&*&6j"D OO ; 4QU@V@VHH<== B%C ;   $K %%d+ +Ix0 FsH%%1DII>cBE**[`*Ba>c5cc NN=uF S s6CEAD==Ec$<V^8dQhRS[RR/#r"rr$Nr)r%r s"r r&r s O Ot O Orc  8VPRR4pVe5\\V\P!4, ^44VR&R#VP R4e\ P !\\\4;_uu_4VP4P4P\VR,4,p\\V\P!4, ^44VR&RRR4R#R# +'giR#;i)aJRewrite ``expires_in`` to seconds remaining from the stored absolute ``expires_at`` (not an SDK field, so stripped): a relative value reloaded after restart would make ``is_token_valid()`` True for tokens that expired while down. Legacy files without it use the file mtime, clamped to zero (self-heals on the next ``set_tokens``). expires_atN expires_in) rr.maxr<rnrUrVr:rrrstatst_mtime)rrabsolute_expiryimplied_expirys&& r _rebase_expires_in%HermesTokenStorage._rebase_expires_ins ((<6  &!$S499;)F%J!KD  XXl # /$$WiDD!%!2!2!4!9!9!;!D!Ds4P\K]G^!^%(^diik-I1)M%N\"ED0DDDs A2D D c$<V^8dQhRS[RR/#r9r)r%r s"r r&r s&&&$&rcVVPRR4VnVPV4R#) hermes_issuerN)rrrB)rrs&&r _fixup_loaded_tokens'HermesTokenStorage._fixup_loaded_tokenss#!XXot< %rc<V^8dQhRR/#)r"r$zOAuthToken | Noner)r%r s"r r&r shh"5hrcp"RVnVPVP4RRVP4#5i)Nrtokens)rr6rrGrs&r get_tokensHermesTokenStorage.get_tokenss3! 1 1 3\8TMfMfggs46c"<V^8dQhRRRR/#)r"rKrr$Nr)r%r s"r r&r s E E| E Erc"\V4pVPR4e`\P!\\ 4;_uu_4\ P !4\VR,4,VR&RRR4VP'd!VPVR&VPVn \VP4V4\PRVP4R# +'giL~;i5i)r<Nr;rFzOAuth tokens saved for %s)rrnrUrVrrr<r.rrrrrlrmr)rrKpayloads&& r set_tokensHermesTokenStorage.set_tokenssf% ;;| $ 0$$Y ;;(, c',:O6P(P %<    '+'9'9GO $!%!3!3D D%%'1 0$2C2CD <;s%AD0C.8DAD. C> 9Dc2<V^8dQhRS[R,RR/#)r"issuerNr$r)r%r s"r r&r s==#*==rc HV'd\V4VnR#RVnR#)zCSet the authorization-server issuer stamped on future token writes.N)r]r)rrTs&&r bind_issuerHermesTokenStorage.bind_issuers,2S[rc$<V^8dQhRS[RR/#)r"rTr$Nr)r%r s"r r&r s ) )3 )4 )rc X\VP44pVeVPR4'dR#\V4VR&\ VP4V4\T4Tn R# \ d-p\ PRTPT4Rp?R#Rp?ii;i)zBackfill ``hermes_issuer`` onto a pre-binding token file: adopt the currently discovered issuer once instead of forcing a re-login, so the *next* read is protected.NrFz+Could not stamp issuer on tokens for %s: %s) rrrnr]rr:rlrmrr)rrTrrMs&& r stamp_issuerHermesTokenStorage.stamp_issuers$++-. <488O44  #F _  ))+T 2![  LLFHYHY[^ _  sA22 B)=!B$$B)c<V^8dQhRR/#r"r$Nr)r%r s"r r&r sIITIrc \VP44pVeVPR4'gR#VPRR4VPRR4RVn\ VP4V4\PRTP4R# \ d-p\PRTPT4Rp?R#Rp?ii;i)zDrop the refresh token (and its issuer record) from disk, keeping the access token: the unexpired access token may still be used, but a refresh token must never go to a different issuer than the one that granted it.N refresh_tokenrFz(Could not strip refresh token for %s: %szpRemoved issuer-mismatched refresh token for %s (re-authorization will be required when the access token expires)) rrrnrrrr:rlrrr)rrrMs& r strip_refresh_token&HermesTokenStorage.strip_refresh_tokens$++-. 4HermesTokenStorage.get_client_info..(s(G(G(MNr)r6rrr)rrrqsf @r get_client_info"HermesTokenStorage.get_client_info$s]   " " $&BM NP   ..0+d2C D s VP4P4#)z?True when this server has refused our metadata document before.)rrrs&r cimd_rejected HermesTokenStorage.cimd_rejectedHs'')0022r keep_metadataFc$<V^8dQhRS[RR/#)r"rr$Nr)r%r s"r r&r Ls&&t&&rc VP4VP4VP4.V'dRMVP43OFpVP RR7K R#)zDelete all stored OAuth state for this server; ``keep_metadata`` spares ``.meta.json`` so a re-login can still announce the discovered ``authorization_endpoint`` when the authorization server's metadata document cannot be re-fetched (#115329).T missing_okNr)rrrrunlink)rrrs&$ r removeHermesTokenStorage.removeLsY ##%t'='='?AYAYA[D'Bdoo.?-ADA HHH %Drc6<V^8dQhRS[S[S[3,/#r)rir]bytes)r%r s"r r&r Vs$sEz*rc /pVP4FJp\P!\4;_uu_4VP 4WP &RRR4KL V# +'giKa;i)zfilename -> bytes of the existing state files; ``restore()`` it to undo a ``remove()`` after a failed re-auth so a valid token survives.N)rrUrVr: read_bytesr;)rsnaprs& r snapshotHermesTokenStorage.snapshotVsY"$""$A$$W-- ||~VV .-% .--s A## A4 only_if_absentc@<V^8dQhRS[S[S[3,RS[RR/#)r"rrr$N)rir]rr)r%r s"r r&r _s1SSS%Z 0STSVZSrc V'dy\;QJd*RVP44F 'gK RM RM!RVP444'd#\PRVP4R#VP 4V'gR#\ VP4p^RIH pV!V4VP4FwrV\P!\W5, 4\P\P,\P ,\"P$\"P&,4p\P(!VR4;_uu_4pVP+V4RRR4K R# +'giK;i \,d#p \P/RYY4Rp ? EKRp ? ii;i) zGRevert to a snapshot without overwriting a concurrent successful write.c3@"TFqP4xK R#5ir)r)rr#s& r r-HermesTokenStorage.restore..as!PS_IRUSRS_IWUSRfdopenwriter:r) rrr token_dirr1fnamerrLfhrMs &&$ r restoreHermesTokenStorage.restore_s. cc!PD>+KE SWWS!23R[[2::5MPRPZPZ5Z\`\h\hkokwkw\wxYYr4((BHHTN)(,)(( SEuRR Ss7B!F)5FF) F& F)&F)) G4GGc <V^8dQhRS[/#rr)r%r s"r r&r ssDrc VP4pVP4'gR#VPVPR,4pVP VP 44VPRR7VP4PRR7\PRVPVP4R# \ d!p\PRY4Rp?LRp?ii;i)a Discard a dead DCR client (``invalid_client`` at the token endpoint) plus stale ``meta.json`` so the SDK re-registers next flow; tokens are kept (a valid refresh token survives if re-registration never completes). Keeps one ``.bak``. True if a client file was removed.Fz.bakz'Could not back up client info at %s: %sNTrzMCP OAuth '%s': cached client registration rejected as invalid_client; removed client.json + meta.json (backup at %s) to force re-registration) rr with_namer; write_bytesrr:rlrrrr)r client_pathbackuprMs& r poison_client_registration-HermesTokenStorage.poison_client_registrationss,,. !!##&&{'7'7&'@A X   {557 8 d+   D 1 V   v{{ , X NNDk W W Xs C C5C00C5c <V^8dQhRS[/#rr)r%r s"r r&r s,,4,rc >VP4P4#)z0True if we have tokens on disk (may be expired).)rrrs&r has_cached_tokens$HermesTokenStorage.has_cached_tokenss  "))++rc <V^8dQhRS[/#r)r)r%r s"r r&r s  % rc 6.pVP4VP43FFpVP4pVPVPVP VP 34KH \V4# \dTPR4Kti;i)z\``stat()`` of the token and client files: what any re-authorization rewrites. No bytes read.N) rrr>rp st_mtime_nsst_sizest_inor:r)rstampr#sts& r credential_stamp#HermesTokenStorage.credential_stamps&&($*@*@*BCD FYY[ bnnbjj"))DE DU|  # T" #sA88BB)rrrrr)%rrrrrrrrrrrrr staticmethodr6rBrGrLrQrVrZr`rkrtryr~rrrrrrrrrr__classdictcell__)r s@r rrstg.T..RR!0L%e^<ul3J'{;PP> O O&& hh E E== ) )II$JJ GG VV Q Q33&e&&SESS((,,  rrcXV^8dQhR\R\R,R\R,/#)r"codestateNissr)r%s"r r&r&s.DDSDtD#*DrcL^RIHpT!YTR7# \dY3u#i;i)zRedirect parameters in the shape the installed SDK expects: mcp 2.0's ``callback_handler`` returns an ``AuthorizationCodeResult`` (the SDK reads ``.state``/``.iss`` off it); older SDKs take a tuple.)AuthorizationCodeResult)rrr)mcp.shared.authrrf)rrrrs&&& r _authorization_code_resultrs2; #s CC {s ##cRV^8dQhR\R\\\3,/#)r"queryr$)r]rir )r%s"r r&r&s&TTTc3hTrcv\V4pRUu/uFq"VPVR.4^,bK up#uupi)zcode/state/error/iss from a redirect query string. ``iss`` (RFC 9207 issuer) is kept: mcp 2.0 rejects a response omitting it when the server advertised ``authorization_response_iss_parameter_supported``.N)rrerrorr)r rn)rparamsks& r _parse_redirect_queryrs<e_F1R S1RAvzz!dV$Q' '1R SS Ss#6c0V^8dQhR\R\/#)r"resultr$rc)r%s"r r&r&sRR$R4Rrc^VPR4RJ;'gVPR4RJ#) auth_codeNrrj)rs&r _result_takenrs, ::k "$ . Q Q&**W2ET2QQrcFV^8dQhR\\\3,/#r)rr/ri)r%s"r r&r&sdDj 1rcDaRRRRRRRR/o!V3RlR\4pVS3#)z]Fresh ``(HandlerClass, result_dict)`` per flow so concurrent flows don't stomp on each other.rNrrrcb<a]tRtRtoV3RlV3RlltR V3RlRlltV3RlRltRtVtR #) (_make_callback_handler.._Handleric<V^8dQhRR/#r]r)r%r s"r r&5_make_callback_handler.._Handler.__annotate__s K KD Krcb<\\VP4P4p^pVR,'gVR,'gRRr2M\ S4'dRpMmSP VR,VR,VR,VR,R7VR,'dR M*R \ P!VR,;'gR 4 R 2pVPV4VPR R4VP4VPPRV R2P44R#)rriz

Not Found

zZ

Authorization already received

You can close this tab and return to Hermes.

rrrrrrzT

Authorization Successful

You can close this tab and return to Hermes.

z'

Authorization Failed

Error: unknownz

z Content-Typeztext/html; charset=utf-8z zN)rr r#rrrhhtmlescape send_response send_header end_headerswfilerencode)rrstatusbodyrs& r do_GET/_make_callback_handler.._Handler.do_GETs*8DII+>+D+DEFF&>>&// #$8v&&s vfWoU[\cUdjpqvjw xrxysAsAnFt{{SYZaSbSoSofoGpFqquv   v &   ^-G H     JJ  |D6@GGI Jrc*<V^8dQhRS[RS[RR/#)r"rsizer$Nr)r%r s"r r&rs' Z ZC ZS Z4 Zrc\PRVP\VP4P4R#)zOAuth callback: %s %sN)rlrmcommandr r#)rrrs&&&r log_request4_make_callback_handler.._Handler.log_requests& LL0$,,@S@X@X Yrc*<V^8dQhRS[RS[RR/#)r"fmtargsr$Nr\)r%r s"r r&rs" ; ;3 ;s ;t ;rc>\PRW,4R#)zOAuth callback: %sN)rlrm)rrrs&&*r log_message4_make_callback_handler.._Handler.log_messages LL-sz :rrN)-r) rrrrrrrrr)r rs@r _Handlerrs' K K& Z Z ; ;rr)r)rrs @r _make_callback_handlerrs4)4$uVZ[F;);4 V rc(V^8dQhR\RR/#)r"rr$Nr)r%s"r r&r&s [ [4 [D [rc\PP4pT;'gRP 4pT'd\T4'dR#TP4\9d'\TR&\R\PR7R#RT9dTPR^4^,MTp\TPR44pTR,'g-TR,'g\R \PR7R#\T4'dR#TP#TR,TR ,TR,TR ,R 7TR,'d\R \PR7R#R# \\\ 3dR#i;i \ \ 3d \R\PR7R#i;i)uRead one stdin line as an OAuth redirect (full URL, bare query, or a ``_SKIP_TOKENS`` word that exits without auth) into *result*. Parse failures, EOF and interrupts are swallowed — best-effort fallback racing the HTTP listener, which stays primary.Nrirz OAuth skipped. Run `hermes mcp login ` later to authenticate, or set ``enabled: false`` on that server in config.yaml to disable persistently.file?uA Could not parse pasted input as an OAuth redirect — ignoring.ruD Pasted input did not contain ``code=`` or ``error=`` — ignoring.rrru8 Got authorization code from paste — completing flow.)rrreadlineKeyboardInterruptr:rrrlower _SKIP_TOKENS_USER_SKIPPED_SENTINELprintstderrsplitr removeprefixrrh)rlinerrs& r _paste_callback_readerrsgyy!!# JJB   D =(( zz||#0w  _  %(D[DJJsA q !dE&u'9'9#'>? &>>&// T[^[e[efV MMF6N&/PW^dej^kMl f~~ HszzZ3 w 3  " QX[XbXbcs#E>7F>FF,G  G u Remote session detected. After you authorize, the provider redirects to {redirect_uri} which forwards to the callback listener on this machine — no SSH tunnel needed. u Remote session detected. After you authorize, the provider redirects to http://{host}:{port}/callback which only the listener on THIS machine can receive. Two options: 1. Easiest — when your browser shows a connection error after authorizing, copy the full URL from the address bar and paste it at the prompt below. The pasted ``code=...&state=...`` is enough to complete the flow. 2. Or forward the port first in a separate terminal: ssh -N -L {port}:127.0.0.1:{port} @ then open the URL above and let it redirect normally. See: https://hermes-agent.nousresearch.com/docs/guides/oauth-over-ssh c hV^8dQhR\R\R\R,R\R,RR/#)r"authorization_urlr redirect_uriN redirect_hostr$)r]r.)r%s"r r&r& s>,,,"%,584Z,PSVZPZ, ,rc\RV R2\PR7\P!R4'g\P!R4'd{V'd1\\ P VR7\PR7MBV'd;\\P T;'gRVR7\PR7\4'gR pMOR p\P!\4;_uu_4\P!V4pR R R 4V'dR MR p\RV R2\PR7R # +'giL=;i)zKPrint the URL (always, as the fallback) and open the browser when possible.zL MCP OAuth: authorization required. Open this URL in your browser:  rrr)rr)hostru8Headless environment detected — open the URL manually.FNzBrowser opened automatically.u8Could not open browser — please open the URL manually.z (z) )r rr r6getenv_SSH_HINT_PROXYr%_SSH_HINT_LOOPBACKrrUrVr webbrowserr7)rrrrnoteopeneds&&&& r _announce_authorization_urlr s \]n\ooq ry|zDzDE yy"))I"6"6  /((l(C#** U  $++1M1M+TX+Y`c`j`j k   I   + +__%67F,28.>x CvS/ +, +s E E% cXV^8dQhR\R\R,R\R,/#)r"rrNr)r.r])r%s"r r&r&s,C$JVY\`V`rc"aaaRVVV3RllpV#)aRedirect handler closing over this flow's port (a closure, not ``_oauth_port``, keeps concurrent flows isolated). ``redirect_uri`` is a configured proxy callback (None for loopback) and only tailors the hint; ``redirect_host`` is the loopback hostname the provider will actually redirect to (see :func:`_resolve_redirect_uri`). Using a closure instead of reading the module-level ``_oauth_port`` avoids cross-server state pollution when multiple MCP servers run OAuth concurrently (fixes #44588). c(V^8dQhR\RR/#)r"rr$Nr)r%s"r r&,_make_redirect_handler..__annotate__&sZZ3Z4Zrc<"\4pVeVPV4GRjxL R#\R4\VSSS4R#L!5i)NzvMCP OAuth requires browser authorization but no interactive session is available (non-interactive/background context).)rpublish_authorization_urlrr)rdashboard_flowrrrs& r _redirect_handler1_make_redirect_handler.._redirect_handler&sS13  % ::;LM M M  " E  $$5t\=Y Ns#A A"A r)rrrr$sfff r _make_redirect_handlerr&sZZ$ rc<V^8dQhR\R\R\/#)r"r handler_clsr$)r.r/r)r%s"r r&r&;s!4Jrcd\RV3VRR7p\PVR4pVe8VPP 4W3P 4uVnVnMRVnVP4VP4V# \dp\RT RT R24ThRp?ii;i) uBind the callback listener on *port*, adopting a parked reserved socket (closes the select→bind TOCTOU window). ``allow_reuse_address`` is set BEFORE binding (a no-op afterwards) so a lingering TIME_WAIT socket from a previous flow cannot block the next.rF)bind_and_activateNTzOAuth callback port z is already in use (zk). Close any other in-progress login, or set a free `oauth.redirect_port` in the server config, then retry.) rrrrrJrserver_addressallow_reuse_address server_bindserver_activater:ru)rr(serverreservedrMs&& r _start_callback_serverr1;s[$/PUV$((t4   MM   !3;=Q=Q=S 0FM60)-F &     M &"4&(V^8dQhR\R\R,/#)r"rcimd_urlNrir])r%s"r r&r&Qs"__d_cDj_rc2VR,\8Xd \R4hVR,'d\RVR, 24hVR,f#V'dRV R2MRp\RV,4h\VR,VR ,VP R 44#) zHTurn a filled/empty result dict into the SDK's callback value, or raise.r user_skippedzOAuth authorization failed: rz If the browser showed an invalid-client error instead of an approval prompt, the authorization server rejected Hermes' Client ID Metadata Document (z); set ``cimd: false`` under that server's ``oauth:`` block in config.yaml to authorize via dynamic client registration instead.riuqOAuth callback timed out — no authorization code received. Ensure you completed the browser authorization flow.rr)rru RuntimeErrorrrn)rr3hints&& r _callback_outcomer9Qs g00&~66 g9&/9JKLL k"  DDL:Nm m ' CG G   &f[&96'?FJJW\L] ^^rcJV^8dQhR\R\R,R\/#)r"rr3Nr+)r.r]r-)r%s"r r&r&cs%777sTz757rcaaaVVV3RlpV#)aCallback waiter bound to one flow's port. ``timeout`` is where ``oauth.timeout`` applies (mcp 2.0 dropped the provider's own). ``cimd_url`` only tailors the timeout message: a server refusing the document aborts at the authorization endpoint, so no redirect arrives and a bare "timed out" would hide the cause. Raises ``OAuthNonInteractiveError`` on timeout or when non-interactive. Closing over the port (instead of reading the module-level ``_oauth_port``) keeps concurrent OAuth flows isolated: flow A's waiter listens on flow A's port even when flow B's ``_configure_callback_port`` overwrites the legacy global afterwards (#34260, the callback-side sibling of the #44588 redirect-handler fix). c<"\4pVe(S'g \VP4GRjxL !#\R4\ 4wr\ SV4p\ P!VPRR/RR7P4\4'dMVfI\R\PRR7\ P!\V3RR7P4R pVS8d;\V4'g*\ P"!R 4GRjxL VR , pKAVP%4VP'4\)VS4#EL)L> TP%4TP'4i;i5i) NzOAuth callback requires an interactive session but none is available (non-interactive/background context); skipping browser authorization without binding a callback listener. poll_intervalg?T)targetkwargsdaemonz Or paste the redirect URL here (or the ``?code=...&state=...`` portion) and press Enter. Type ``skip`` + Enter to continue without this server:)rflush)r>rr@g?)rrwait_for_callbackrrr1 threadingThread serve_foreverstartrr rr rrrGrHshutdown server_closer9)r#r(rr/elapsedr3rr+s r _wait$_make_callback_waiter.._waitnsJ13  %d.^5U5U5W/WX X " \ ]56 'k:  4 4ot=T]abhhj   !7 IZZt -   $:&SW X ^ ^ ` "G#M&,A,AmmC(((3 OO     ! 22K0X@) OO     !s?FFEB:F.1E E E /-FE "FFr)rr3r+rKsfff r _make_callback_waiterrMcs*3X Lrr{cXV^8dQhR\R\\,R,RR/#)r"r r{Nr$r|)r%s"r r&r&s+>>S>#*t:K>W[>rcf\WR7P4\PRV4R#)z8Delete stored OAuth tokens and client info for a server.)r{zOAuth tokens removed for '%s'N)rrrlr)r r{s&$r remove_oauth_tokensrPs"{<CCE KK/=rzKhttps://nousresearch.github.io/hermes-agent/docs/oauth/client-metadata.jsonrrc0V^8dQhR\R\/#)r"urlr$r]r)r%s"r r&r&s n nC nD nrc^RIHpV!V4'gR#\V4p\VP;'g VP 4pT;'gTP;'gq\;QJd?RTPPR44F'gK R'*# R'*#!RTPPR444'*# \ \3dR#i;i)uTrue when *url* is usable as a CIMD client_id on the installed SDK (ImportError = SDK predates CIMD → DCR only). The SDK checks only https + non-root path; userinfo, fragments and dot segments are rejected here because they fail mid-browser-flow as an opaque invalid-client page.)is_valid_client_metadata_urlFc3*"TF qR9xK R#5i)r(N>r(..r)rsegs& r r%_is_valid_cimd_url..s6lUkck7IUks/T) mcp.client.auth.utilsrUr rusernamepasswordrfrfragmentrr#r )rRrUr has_userinfos& r _is_valid_cimd_urlr`sF+C00#FOO>>v? llll336lU[U`U`UfUfgjUk6l33 mm3 mm36lU[U`U`UfUfgjUk6l3l mm  $sC"CCC43C4c2V^8dQhR\R,/#r]rQ)r%s"r r&r&sEEtErc\F6pV\9gK\V4fK\PV4Vu# \'d\^,#R#)uReserve a pinned CIMD callback port, or None when none is usable. Holding the bound socket makes contention cooperative: a sibling finds the bind refused and moves down the range. Once every pinned port belongs to this process the range wraps rather than falling back to DCR — a reused port only bites if both servers authorize at the same moment (reported by the waiter); DCR may be unsupported entirely. Holding the bound socket until ``_wait_for_callback`` adopts it does the same job here as ``_reserve_callback_port`` does for ephemeral ports (#22161): a fixed port is just as stealable in the minutes between selection and the browser redirect arriving. N)r_assigned_cimd_portsrrp)rs r _pick_cimd_portrdsL + +t0D0P ' ' -K';&:  "DDrc>V^8dQhR\R,R\/#)r"rNr$)rr)r%s"r r&r&s$qq#5#<qqrcVeVP4MRpTRJ;'d\ TRR4RJ# \\\3dR#i;i)uTrue when cached metadata shows this server doesn't advertise CIMD. The SDK decides CIMD vs DCR in its 401 branch — after Hermes must fix the redirect URI — so cached metadata closes the gap; only a genuinely unknown server pays the optimistic pin.NF%client_id_metadata_document_supportedT)rrgrrre)rr|s& r _server_declined_cimdrhs]4;4G7..0T 4  p pGH6]_c$dlp$pp Iz 2s3A  A czV^8dQhR\R\R,R\\\3,R,/#r"cfgrNr$)rirrr]r.)r%s"r r&r&s8111(:T(A1USVX[S[__cMc1rc0VPR4;'g\pVPR4RJ;'Eg@\V4'*;'Eg'VPR4;'Eg VPR4;'gVPR4;'gVPR4;'gRR8g;'g\4R J;'gVPR 4;'gVPR 4;'goVPR 4;'gR \9;'gE\ V4R J;'g0VR J;'dVP 4;'g \V4pV'dR M \4pVfR #W$3#)u ``(client_id URL, pinned callback port)``, or None to use DCR. Each ineligibility case means the redirect URI is not one the document declares, the client identity is already settled, or the server is known not to want a document — a metadata URL would be rejected.client_metadata_urlcimdF client_idre client_namerfrhNr redirect_portrr) rn_CIMD_CLIENT_METADATA_URLr`r_CIMD_REDIRECT_HOSTSrrrhrd)rkrrR ineligiblers&& r _maybe_use_cimdrus ''' ( E E,EC 5 * *!#& & * * 77;  * *$'77?#; * * 77= ! * * '*gg.J&K&U&UvZ`%` * * $ %T 1 * * 77> " * *'*ggo&> * * GGO $ 3 3 V^8dQhR\R\R,/#)r"rkr$Nr4)r%s"r r&r&s"FF$F3:FrcVPR4p\V\4'd'VP4'dVP4#R#)zConfigured ``oauth.user_agent`` for token-endpoint requests (exchange + refresh only, never MCP traffic or discovery), or None; a null/empty YAML value never sends a blank header. No other headers are configurable (secrets would land in config.yaml). user_agentN)rnrr]r)rkuas& r token_request_user_agentr~s9  B#B,,288:EErc0V^8dQhR\R\/#)r"configr$)rir-)r%s"r r&r& s A A$ A5 ArcRRlpVPR4;'g/p\V!VPR4R4V!VPR4R4R,4#) uvConnect bound for an interactive OAuth login probe (CLI ``hermes mcp login``, dashboard and Desktop re-auth): the server's ``connect_timeout`` or its ``oauth.timeout`` callback window (default 300 s) plus 15 s headroom for the token exchange, whichever is longer. A fixed 315 s floor here made raising ``oauth.timeout`` alone a no-op — the probe timed out first (#116278).c0V^8dQhR\R\/#)r"rwr$)r-)r%s"r r&+login_connect_timeout..__annotate__s5rc`\R\V44# \\3dTu#i;i)rB)r=r-rr)valuerws&&r _seconds'login_connect_timeout.._secondss1 sE%L) ):& N s --oauthconnect_timeoutrBr+r@g.@)rnr=)rr oauth_cfgs& r login_connect_timeoutr sY   7#))rI x #45s; i0%84? AArcJV^8dQhR\R\R,R\/#rj)rirr.)r%s"r r&r&s())$)1Cd1J)VY)rct\4p\VPR4;'dVPR44pVe8V'g0^VR&VPR4;'g VPVR&^#\ V4wrEV'd+VPR4'gV'g W@R&^VR&^#\ W4pVe VwVR&pMb\ VPR^44;'gT;'g \4pV\9d!V\9d\PV4WpR&Vs V#)udResolve the callback port into ``cfg['_resolved_port']`` (0 = non-loopback URI). Precedence: dashboard flow / cached https redirect URI → CIMD pinned port (sets ``cfg['_cimd_url']``) → ``oauth.redirect_port`` → cached registration port → fresh ephemeral port (the only parked one). Also sets the legacy ``_oauth_port``. NOTE: also sets the legacy module-level ``_oauth_port`` so existing calls to ``_wait_for_callback`` keep working. The legacy global is the root cause of issue #5344 (port collision on concurrent OAuth flows); replacing it with a ContextVar is out of scope for this consolidation PR. rorq_resolved_portrrx) rrrnrrrur.rrrcrp _oauth_port)rkrr#pinned_loopback cached_uri cached_portrnrs&& r _configure_callback_portrs./N377;/LLCGGO4LMO!/ ! !ggn5TT9T9TN.w7J#''.11/(N !  3 (D !%K$377?A./ZZ;ZZBXBZ ; 4/C#C ' ' -!K Krc<V^8dQhR\R\R\/#)r"rkrr$)rir.r])r%s"r r&r&Fs&jjtj3j3jrcxVPR4;'g#RVPR4;'gR RV R2#)a#Configured ``redirect_uri`` (proxy) or ``http://:/callback``; the single derivation so client metadata and pre-registered info stay identical. ``redirect_host`` only changes the hostname (some WAFs reject a literal ``127.0.0.1``); the listener still binds ``127.0.0.1``.rzhttp://rr:rrj)rkrs&&r _resolve_redirect_urirFs@ 77> " i i0H0W0WK/XXYZ^Y__h&iirz Claude Codez mcp:connectcXV^8dQhR\R,R\R,R\/#)r"r N server_urlr$rS)r%s"r r&r&Ss/eecDjeS4Ze[_erc^RIHpHpT;'gRP4pV!VR4'gV!VR4'd RV9dR#RT;'gRP49;'dV'*;'g RV!V49#)z    " " $CS/227LSR]7^7^cimpcp {((b//1 1 d d3w7c7c'M^_bMcBcdrr rircVV^8dQhR\R\R\R,R\/#)r"rkr rNr$r4)r%s"r r&r&]s0tSSVY]S]imrc.\W4'dVPR4'g/\VR&\P RT;'gT\4VPR4'g \ VR&VPR4;'gRVR&V#)uMutate *cfg* with provider-specific OAuth workarounds (before building client metadata / pre-registering); returns *cfg*. Only fills keys the user left unset — explicit values win.rpufMCP OAuth '%s': Figma DCR allowlist — registering as client_name=%r (override via oauth.client_name)scoperfrg)rrn_FIGMA_DCR_CLIENT_NAMErlr_FIGMA_DEFAULT_SCOPE)rkr rs&$$r apply_oauth_provider_defaultsr]sK44ww}%%!7C  KKx))z+A Cwww/CL-0GG4P,Q,i,iUi () Jrc(V^8dQhR\RR/#)r"rkr$rr)r%s"r r&r&ns<<<)>6($k CGG$6A'CO www#&w< <**?;; <.5**?;; %r); discarded tokens minted under the previous client. Re-authorize with: hermes mcp login %s)rrrrirnrrrrr:rlrrr;)rrrexisting old_client_idremovedr#rMs&&& r #_invalidate_tokens_on_client_changers-'3356H1;Hd1K1KHLL-QUM ];oA^AfAfbfl}mFmFBFAGG%%'););)=>{{}}  F KKMG ? J  -@T@T V F NN^`g`t`tvzvvBE F F Fs;D  E ,EE c8V^8dQhR\R\RRRR/#)r"rrkclient_metadatarr$N)rri)r%s"r r&r&s1ZZ'9ZZWlZquZrc VPR4pV'gR#\R4p\WVPR44RVR\WR,4.RVPRVP R VP /R Uu/uF$qQPV4'gKWQV,bK& upCp\VP4\VPV444\PR W0P4R#uupi) z=If cfg has a pre-registered client_id, persist it to storage.roNrrerrrrrfz$Pre-registered client_id=%s for '%s')rerpr)rnrrrrrrrfrrrr1rlrmr)rrkrroinfo_clskey info_dicts&&& r _maybe_preregister_clientrs $I 67H'CGGO.sN*MQL*MTF'uk' does not support automatic client registration — the registration request returned 404 (typical for Google's hosted Gmail/Drive MCP servers and other providers without RFC 7591 dynamic client registration). Create an OAuth client for this provider and add it under config.yaml as `oauth: {client_id: ..., client_secret: ...}`, then re-run: hermes mcp login 403 forbiddenc3,<"TF qS9xK R#5irrrs& r rrs F"EQL"EruF' is Figma's remote MCP — DCR is allowlisted by exact client_name ("zK" and "Codex" work; most other names 403). Hermes defaults to client_name: z} automatically. If you set oauth.client_name yourself, change it to one of those, or clear it and re-run: hermes mcp login u<' only allows pre-approved OAuth clients — it rejected client registration (403), so no browser flow can start. Options: set oauth.client_name to a name the provider allowlists, add a pre-registered client (oauth: {client_id: ..., client_secret: ...}), or use the provider's stdio / API-key / local server instead.)registdcrzdynamic client>r 403 forbiddenhttp 403: forbidden) r]rtools.mcp_oauth_providerr startswithrrrr)r rMrmsgrlooks_like_registrationrs&&$ @r !humanize_oauth_registration_errorrsh c(CiikG@ ~~-..  +0K74JN*MNN*MNNN }abm`m o p %|EE{g/E66  F"E F F"E FF 5 5 ==?S S 5 5 SL 3 3[G3 #K44 }()*256VVaUb d e K=* *+rcNV^8dQhR\R\R\R,RR/#)r"r r oauth_configNr$zOAuthClientProvider | None)r]ri)r%s"r r&r&s3FF#F3FdTkF]yFrc \'d\R4f%\PR\ R4 2V4R#^RIHpHpV!WV4wrV\4'g)VP4'g\RV RV R24hV!WVR R 7p\f-^R IH p\R V\R43R RR\R\/4s \RRV/VB#)u``httpx.Auth`` OAuth handler for an MCP server; None if the SDK lacks OAuth. Legacy API — new code uses :func:`tools.mcp_oauth_manager.get_manager` so state is shared across config-time, runtime and reconnect paths.rNzHMCP OAuth requested for '%s' but SDK auth types are not available. Run: rX)build_provider_kwargsprepare_oauth_configzMCP OAuth for 'z': non-interactive environment and no cached tokens found. The OAuth flow requires browser authorization. Run `hermes mcp login z[` interactively first to complete initial authorization, then cached tokens will be reused.T)ssh_proxy_hint)HermesProviderMixinHermesOAuthClientProviderrzMSDK provider plus Hermes' token-endpoint fixes (see ``HermesProviderMixin``).r_hermes_loggerrr)rkrrrlrrrrrrrrurrr/r) r rrrrrkrr?rs &&& r build_oauth_authrs  z*?@Ha&u-.01< >T' NLC   W%>%>%@%@&k]+EEPMRH HI I#3 EF (@$()DGZ\fg|\}F~ f ($4fA>%?! % E Ef EErc\V^8dQh/^\9d\\\3,;R&^\9d\R,;R&^\9d%\\\ P 3,;R&^\9d \;R&^\9d\ \,;R&#)r"raNrrrrc)__conditional_annotations__rir]r r.rr)r%s"r r&r&sOOb"!d38n!cOdS4ZeOh104V]]*+0iOx&%3%yOF%$d3i$GOr)rrrrr>nqsnoquitskipcancelr)NN)Nr)ililililil)rrpmrrGrU contextvarsrErimportlib.utilutil_importlib_utilrloggingr6rrr>rrDr<r functoolsrr>rfrB http.serverrrpathlibrtypingrr urllib.parser r r4r rr tools.mcp_dashboard_oauthrrrmcp.client.authrrrrrr getLoggerrrl_REFRESH_FENCE_TIMEOUT_SECONDSr7r frozenset EWOULDBLOCKEAGAINEACCESEDEADLKrFr*rOrW find_specrkrmrdrarrpydanticrsrur ContextVarrvrxrrrrrrrrrrrrrrrrrrrrrrrrrrrrr&r1r9rMrrPrrrrsr`rcrdrhruryr~rrrrrrrrrrrrr&)rs@r rsDO (   #;%+.#a3jj   8 $ "& , %e&7&7u||UZUbUb%cd;G@^GT &#,,U34? LLKL~! !"$ S|S  )334PZ^_'223NX]^HI 2^G/10. 4.,  <>P;< yyzDTRB [L\ P",(<,_$7v"&%>d>j2  +{!;< n&#%$E"q107F A)Xj'$e2`d"<4V<Z$#+LP#+LFFy% E FH Fs6K-K=L - K:9K:= L  L  LL