+
    lHàj»µ  ã                   óÜ  € R t ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIHt ^ RI	H
t
HtHt ^ RIHt ^ RIHtHt ^ RIHt ^ RIHtHtHtHtHtHtHtHtHtHtH t  ^ RI!H"t"H#t#H$t$H%t%H&t&H't'H(t( ^ R	I)H*t* ^ R
I+H,t, ^ RI-H.t/ ^ RI-H0t1 ^ RI-H2t3 ^ RI-H4t5 ]Pl                  ! R4      t7Rt8R R lt9R R lt:R R lt;R'R R llt<R R lt= ! R R]>4      t?R R lt@R R  ltAR! R" ltBR# R$ ltC ! R% R&4      tDR# )(a%  Transport bring-up for MCPServerTask: stdio spawn (OSV preflight, cached-npx swap, child PID
ledger + death-supervisor registration), Streamable HTTP / SSE connect (preflight, identity header, client certs, OAuth),
protocol negotiation and initial tool discovery. Split from tools/mcp_tool.py.N)Úasynccontextmanager)ÚDictÚOptionalÚSet)Únormalize_proxy_url)Úis_loopback_hostÚshould_bypass_proxy)Úruntime_cwd)ÚNonMcpEndpointErrorÚ_apply_identity_headerÚ_describe_http_failureÚ,_handshake_answered_with_unsupported_versionÚ_handshake_rejected_as_modernÚ_is_streamable_http_rejectionÚ_make_http_rejection_recorderÚ_make_mcp_body_cap_transportÚ_make_redirect_header_stripperÚ_resolve_client_certÚ_unwrap_exception_group)Ú_filter_mcp_childrenÚ_leader_start_timeÚ_orphan_stdio_pid_serversÚ_orphan_stdio_pidsÚ_stdio_pgidsÚ_stdio_pidsÚ_stdio_starttimes)Ú_core)Únode_abi_error)Úmcp_tool_config)Úmcp_tool_events)Úmcp_tool_lifecycle)Úmcp_tool_registrationztools.mcp_toolz¦{"jsonrpc":"2.0","id":"_probe","method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"hermes-probe","version":"0.1"}}}c                ó$   € V ^8„  d   QhR\         /# ©é   Úreturn©Ústr)Úformats   "Ú=/home/ubuntu/.hermes/hermes-agent/tools/mcp_tool_transport.pyÚ__annotate__r*      s   € ÷ Nñ N¤ñ Nó    c                óž   € V P                   P                  RR4      P                  R4      ^ ,          P                  4       P	                  4       # )zA``content-type`` header of *resp* without parameters, lowercased.zcontent-typeÚ Ú;)ÚheadersÚgetÚsplitÚstripÚlower©Úresps   &r)   Ú_content_type_baser6      s;   € à�<‰<×Ñ˜N¨BÓ/×5Ñ5°cÓ:¸1Õ=×CÑCÓE×KÑKÓMÐMr+   c                ó$   € V ^8„  d   QhR\         /# r#   ©Úbool)r(   s   "r)   r*   r*   $   s   € ÷ )ñ )”Tñ )r+   c                 óB   € ^ÈV P                   u;8*  ;'       d    R8  # u # )éÈ   i,  )Ústatus_coder4   s   &r)   Ú_is_2xxr=   $   s!   € Ø�$×"Ñ"×(Ô( SÑ(Ð(Ñ(Ð(r+   c                ó$   € V ^8„  d   QhR\         /# r#   ©Údict)r(   s   "r)   r*   r*   (   s   € ÷ >ñ >œ$ñ >r+   c                 ób   € V P                  4        UUu/ uF  w  rVf   K  WbK  	  upp# u uppi )zE*kwargs* minus the ``None`` values (optional httpx client arguments).)Úitems)ÚkwargsÚkÚvs   ,  r)   Ú_presentrF   (   s(   € à#Ÿ\™\œ^Ô=™^‘T�Q¨qŒDˆAŠD™^Ò=Ð=ùÓ=s   ”+¡+c                óR   € V ^8„  d   QhR\         R\         R\        \        ,          /# )r$   ÚurlÚserver_namer%   )r'   r   r@   )r(   s   "r)   r*   r*   -   s)   € ÷ "ñ "¤cð "ÔQTð "Ô^fÔgkÕ^lñ "r+   c                óJ  € \         P                  P                  V4      P                  ;'       g    RpV'       dH   \	        V4      '       g7   \        V4      '       g&   \         P                  P                  V4      '       d   R# \         P                  P                  4       p/ pR Fn  p\        VP                  V4      ;'       g    VP                  R4      4      p	V	'       g   K@  \        W P                  ! R	RV	RV/\        VR7      B 4      Wx R2&   Kp  	  T;'       g    R# )
u¾  Proxy transports for the caller-owned MCP HTTP client, or ``None`` for a direct connect.

httpx auto-detects proxies only when ``transport is None``
(``allow_env_proxies = trust_env and transport is None``). The wire-body cap is exactly that
custom transport, so HTTP_PROXY / HTTPS_PROXY and the OS (Windows-registry / macOS) proxy were
silently ignored for every HTTP/SSE MCP server: on a network that reaches the MCP host only
through a proxy, the connect failed with ``All connection attempts failed`` and the server was
parked. Rebuild httpx's own behaviour as explicit ``mounts`` â€” same source order (environment
first, then the OS proxy), ``NO_PROXY`` / platform bypass list respected, ``socks://``
normalized, and TLS settings identical to the transport they accompany.

NO_PROXY goes through ``agent.proxy_bypass.should_bypass_proxy`` â€” the one matcher the LLM
transport and the gateway adapters use (CIDR ranges and ``*.host`` forms the stdlib check
does not understand) â€” plus ``urllib.request.proxy_bypass`` for the OS bypass list
(Windows ``ProxyOverride`` / macOS exceptions). Loopback is never dialed through a proxy
(``agent.proxy_bypass.is_loopback_host``), NO_PROXY or not.

A mount wins over ``transport=`` for the URLs it matches, so each proxy transport is wrapped in
the same wire-body cap as the direct one. A proxy the installed httpx cannot build (e.g.
``socks://`` without socksio) raises here and surfaces as this server's connect error.
r-   NÚallÚproxyÚverify©Úcertz://)ÚhttpÚhttps© )ÚurllibÚparseÚurlsplitÚhostnamer   r   ÚrequestÚproxy_bypassÚ
getproxiesr   r0   r   ÚAsyncHTTPTransportrF   )
Ú	httpx_modrH   Ú
ssl_verifyÚclient_certrI   ÚhostÚproxiesÚmountsÚschemeÚ	proxy_urls
   &&&&&     r)   Ú_mcp_proxy_mountsrc   -   sö   € ô, �<‰<× Ñ  Ó%×.Ñ.×4Ð4°"€DßÔ# D×)Ò)Ô-@À×-EÒ-EÌÏÉ×IdÑIdÐei×IjÒIjÙÜ�n‰n×'Ñ'Ó)€GØ€FÛ#ˆÜ'¨¯©°FÓ(;×(QÐ(Q¸w¿{¹{È5Ó?QÓRˆ	ßÙä!=¸i×IeÒIeñ JNØðJNØ$.ðJNÜ2:ÀÔ2LñJNó "Oˆ�˜ˆ~Óñ $ð �>ˆ>�TÐr+   c                óF   € V ^8„  d   QhR\         \        ,          R\        /# )r$   Úpgidr%   )r   Úintr9   )r(   s   "r)   r*   r*   R   s   € ÷ ñ œ¤�ð ¬$ñ r+   c                óp   €  \         P                  ! V ^ 4       R#   \        \        \        3 d     R# i ; i)zDSignal 0 to the group succeeds iff any member is alive (POSIX only).TF)ÚosÚkillpgÚAttributeErrorÚ	TypeErrorÚOSError)re   s   &r)   Ú_pgroup_aliverm   R   s1   € ðÜ
�	Š	�$˜ÔÙøÜœI¤wÐ/ô Úðús   ‚ ›5´5c                   ó   € ] tR t^[tRtRtR# )ÚLiveEndpointUnavailablez?A declared runtime file did not provide a usable live endpoint.rR   N)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__Ú__static_attributes__rR   r+   r)   ro   ro   [   s   † ÝIr+   ro   c                óh   € V ^8„  d   QhR\         R\        \        \         \        3,          ,          /# )r$   rI   r%   )r'   r   Útupler@   )r(   s   "r)   r*   r*   _   s(   € ÷ !ñ !¤ð !¬´´s¼D°yÕ1AÕ(Bñ !r+   c                 ó
  € ^ RI Hp ^ RIHp ^ RIHp ^ RIHp ^ RIH	p V! V 4      pVP                  R8w  d   R# VP                  V 4      pVe    VP                  VP                  4       4      MRpVe&   V! VP                  V4      4      P                  4       MRp	V	f   \!        RV  R	24      hV	P"                  '       d   V! V	P"                  4       V	P"                  '       d   R
RV	P"                   2/M/ p
V	P$                  V
3# )é    )Úregister_vault_redaction_value)Údeclaration)Úfacts)ÚAppResolver)Úliveness_forÚserver_jsonNúMCP server 'z' has no usable live endpointÚAuthorizationzBearer )Úagent.redactrz   Úhermes_platformr{   Úhermes_platform.hostr|   Úhermes_platform.resolver.appr}   Útools.mcp_livenessr~   ÚkindÚlookupÚapp_forÚ	os_familyÚapp_definitionÚendpointro   ÚtokenrH   )rI   rz   r{   r|   r}   r~   ÚliveÚdeclÚ
definitionrŒ   r/   s   &          r)   Ú_live_endpointr‘   _   sÜ   € Ý;Ý+Ý*Ý8Ý/á˜Ó$€DØ‡y�y�MÔ!ÙØ×Ñ˜kÓ*€DØ48Ò4D�—‘˜eŸo™oÓ/Ô0È$€JØJTÒJ`‰{˜4×.Ñ.¨zÓ:Ó;×DÑDÔFÐfj€HØÒÜ%¨°[°MÐA^Ð&_Ó`Ð`Ø‡~‡~€~Ù& x§~¡~Ô6Ø?G¿~¿~¸~ˆ '¨(¯.©.Ð)9Ð :Ñ;ÐSU€GØ�<‰<˜Ð Ð r+   c                ó^   € V ^8„  d   QhR\         R\        R\        \         \        3,          /# ©r$   rI   Úconfigr%   )r'   r@   rw   )r(   s   "r)   r*   r*   t   s*   € ÷ ñ ¤ð ¬Tð ´e¼CÄ¸IÕ6Fñ r+   c                ó¨   € VR,          \        VP                  R4      ;'       g    / 4      r2\        V 4      pVe   Vw  r%VP                  V4       W#3# )zWURL + configured headers, overlaid by a ``server_json`` live endpoint's URL and bearer.rH   r/   )r@   r0   r‘   Úupdate)rI   r”   rH   r/   rŽ   Úlive_headerss   &&    r)   Ú_http_endpointr˜   t   sO   € à˜%•=¤$ v§z¡z°)Ó'<×'BÐ'BÀÓ"CˆÜ˜+Ó&€DØÒØ ÑˆØ�‰�|Ô$Øˆ<Ðr+   c                ó0   € V ^8„  d   QhR\         R\        /# )r$   r”   r%   )r@   rw   )r(   s   "r)   r*   r*   ~   s   € ÷ ñ œ$ð ¤5ñ r+   c                óø   € \         P                  ! V R,          \         P                  ! V P                  R4      4      4      w  rV P                  R4      pVf    \        P
                  ! 4       ;'       g    RpWV3# )z[(command, env, cwd) a stdio child is spawned with, resolved in the current profile's scope.ÚcommandÚenvÚcwdN)Ú_configÚ_resolve_stdio_commandÚ_build_safe_envr0   Ú_runtime_cwdÚresolve_context_cwd)r”   r›   rœ   r�   s   &   r)   Ú_stdio_launchr£   ~   si   € ä×1Ò1°&¸Õ2CÄW×E\ÒE\Ð]c×]gÑ]gÐhmÓ]nÓEoÓp�L€Gð �*‰*�UÓ
€CØ
‚{Ü×.Ò.Ó0×8Ð8°DˆØ˜ÐÐr+   c                ó^   € V ^8„  d   QhR\         R\        R\        \        \        3,          /# r“   )r'   r@   rw   ÚlistÚset)r(   s   "r)   r*   r*   Œ   s*   € ÷ 
.ñ 
.¤ð 
.¬dð 
.´u¼TÄ3¸YÕ7Gñ 
.r+   c                óÌ   € RV9   d<   \        W4      w  r#V Uu0 uF  qDP                  4       kK  	  ppV\        WV4      .V3# \        \	        V4      4      \        4       3# u upi )a¨  What a connection is opened with, resolved in the current profile's scope: stdio
``[command, env, cwd]``; HTTP ``[url, headers]`` after the live endpoint and the identity
header. The owner hashes this very list and an adopter recomputes it, so both digests are
built from one code path. Also returns the configured header names (HTTP only), captured
before the identity header is merged in, for the strict-redirect boundary.rH   )r˜   r3   r   r¥   r£   r¦   )rI   r”   rH   r/   ÚkeyÚconfigured_header_namess   &&    r)   Ú_connect_inputsrª   Œ   sf   € ð �„Ü% kÓ:‰ˆÙ:AÓ"B¹'°3§9¡9¦;¹'ÐÐ"BØÔ+¨KÀÓIÐJÐLcÐcÐcÜ”˜fÓ%Ó&¬«Ð-Ð-ùò #Cs   ™A!c            
       ó^  a € ] tR t^™t o RtR,tV 3R lR ltV 3R lR ltV 3R lR ltR t	R-V 3R
 lR llt
V 3R lR ltV 3R lR ltV 3R lR ltV 3R lR ltRRRRRRRRRR	/V 3R lR lltV 3R lR ltV 3R  lR! ltV 3R" lR# ltV 3R$ lR% ltV 3R& lR' ltR( tV 3R) lR* ltR+tV tR# ).ÚMCPServerTransportMixinzVMethods of :class:`tools.mcp_tool.MCPServerTask` (mixed in; relies on its attributes).c                ó    <€ V ^8„  d   QhRS[ /# r#   r8   )r(   Ú__classdict__s   "€r)   r*   Ú$MCPServerTransportMixin.__annotate__ž   s   ø€ ÷ 
Hñ 
H¡4ñ 
Hr+   c                óf   € \        V P                  RR4      pVRJ ;'       g    \        VRR4      RJ# )u1  False only when captured capabilities omit ``tools`` (prompt-/resource-only servers,
where ``tools/list`` raises -32601); True without capability info (legacy fallback).

Per the MCP spec, ``InitializeResult.capabilities.tools`` is non-None iff the server implements the
``tools/*`` request family. Prompt-only or resource-only servers omit it, and calling ``tools/list``
against them raises ``MCPError(-32601 Method not found)`` â€” which previously killed the connection
during discovery and made every keepalive fail. (Ported from anomalyco/opencode#31271.)
ÚcapabilitiesNÚtools)ÚgetattrÚinitialize_result)ÚselfÚcapss   & r)   Ú_advertises_toolsÚ)MCPServerTransportMixin._advertises_toolsž   s8   € ô �t×-Ñ-¨~¸tÓDˆØ�tˆ|×GÐGœw t¨W°dÓ;À4ÐGÐGr+   c                ó    <€ V ^8„  d   QhRS[ /# r#   r?   )r(   r®   s   "€r)   r*   r¯   ª   s   ø€ ÷ ñ ¡ñ r+   c                óò  € / pV P                   V P                  3 F,  pV'       g   K  VP                  VP                  4       4       K.  	  \        P
                  '       d*   \        P                  '       d   V P                  4       VR&   \        P                  '       d   V P                  4       VR&   \        P                  ! R4      '       d)   ^ RIHp ^ RIHp V! RV! 4       P                  R7      VR&   V# )z_ClientSession kwargs: client identity, sampling, elicitation, notification + logging callbacks.Úmessage_handlerÚlogging_callbackÚclient_info)ÚImplementation)Úget_version_infoúhermes-agent©ÚnameÚversion)Ú	_samplingÚ_elicitationr–   Úsession_kwargsr   Ú_MCP_NOTIFICATION_TYPESÚ_MCP_MESSAGE_HANDLER_SUPPORTEDÚ_make_message_handlerÚ_MCP_LOGGING_CALLBACK_SUPPORTEDÚ_make_logging_callbackÚ_client_session_acceptsÚ	mcp.typesr¾   Úhermes_cli.version_infor¿   Úbase_version)rµ   rC   Úhandlerr¾   r¿   s   &    r)   Ú_session_kwargsÚ'MCPServerTransportMixin._session_kwargsª   s¾   € àˆØŸ™¨×(9Ñ(9Ó:ˆGß‰wØ—‘˜g×4Ñ4Ó6Ö7ñ ;ô ×(×(Ð(¬U×-Q×-QÐ-QØ(,×(BÑ(BÓ(DˆFÐ$Ñ%Ü×0×0Ð0Ø)-×)DÑ)DÓ)FˆFÐ%Ñ&Ü×(Ò(¨×7Ò7å0Ý@Ù$2¸ÑP`ÓPb×PoÑPoÔ$pˆF�=Ñ!Øˆr+   c                ó    <€ V ^8„  d   QhRS[ /# )r$   Úconnect_timeout)Úfloat)r(   r®   s   "€r)   r*   r¯   »   s   ø€ ÷ +~ñ +~Áñ +~r+   c              ƒ  ó¾  a aaa"  € R VV3R lloVVV V3R lp\        S P                  ;'       g    / P                  RR4      4      P                  4       P	                  4       pVR9   d   V! RRR R	V4      G R
j  x€L
 # VR9   d   S! R4      G R
j  x€L
 # VR8w  d"   \
        P                  RS P                  V4       V! RRV3R lR4      G R
j  x€L
 #  LZ LE L5i)uÆ  Negotiate the protocol era (``initialize`` vs ``server/discover``; both expose
``.capabilities``). ``auto`` tries the legacy handshake FIRST, falling back to discover only
on a modern-only signal (-32022 / initialize -32601) â€” the reverse of the SDK's discover-first
mode, so handshake-era servers pay zero extra round-trips. ``stateless`` probes discover first
(one legacy retry on any error); ``legacy`` is handshake only. A TIMEOUT never falls back.c                ó$   € V ^8„  d   QhR\         /# )r$   Úmethodr&   )r(   s   "r)   r*   Ú@MCPServerTransportMixin._negotiate_session.<locals>.__annotate__Á   s   € ÷ 	Yñ 	Yœñ 	Yr+   c                 óR   <€ \         P                  ! \        SV 4      ! 4       SR 7      # )©Útimeout)ÚasyncioÚwait_forr³   )rØ   rÔ   Úsessions   &€€r)   ÚcallÚ8MCPServerTransportMixin._negotiate_session.<locals>.callÁ   s    ø€ Ü×#Ò#¤G¨G°VÔ$<Ó$>ÈÔXÐXr+   c              —   óš  <"  €  S! V 4      G R j  x€L
 #  L  \          Ed&   p\        T\        P                  4      '       g   T! T4      '       g   h \        P
                  ! TS	P                  T.TO5!    S! T4      G R j  x€L 
 u R p?#   \          d©   p\        T\        P                  4      '       g   T R8w  g   \        T4      '       g   h \        P                  RS	P                  T\        P                  4       \        P                  ! S	P                  S
4      SR7      G R j  x€L 
 u R p?u R p?# R p?ii ; iR p?ii ; i5i)NÚ
initializeuu   MCP server '%s': server/discover also failed (%s) â€” completing the handshake at %s, the version this client offeredrÛ   )Ú	ExceptionÚ
isinstancerÝ   ÚTimeoutErrorÚloggerÚinforÂ   r   r   ÚLATEST_HANDSHAKE_VERSIONrÞ   Ú&_complete_handshake_at_offered_version)ÚprimaryÚfallbackÚshould_fallbackÚlog_fmtÚ	log_extraÚexcÚfallback_excrà   rÔ   rµ   rß   s   &&&&*  €€€€r)   ÚattemptÚ;MCPServerTransportMixin._negotiate_session.<locals>.attemptÄ   s  øé € ðKÙ! '›]×*Ð*Ñ*øÜõ KÜ˜c¤7×#7Ñ#7×8Ò8ÁÐPS×@TÒ@TØÜ—’˜G T§Y¡Y°Ð@°iÔ@ðKÙ!% h£×/Ð/Õ/øÜ ô Kô # <´×1EÑ1E×FÒFÈ'ÐUaÔJaÜ#OÐPS×#TÒ#TØÜ—K‘Kð !IØJNÏ)É)ÐUaÜ %× >Ñ >ô@ô ")×!1Ò!1°$×2]Ñ2]Ð^eÓ2fØ:Iô"K÷ Kð K÷ Kò KûðKþðKüs‘   ƒE… �‘ ”E• —E£-EÁ%EÁ7BÂBÂBÂEÂEÂE ÂBD;Ä+D.Ä,D;Ä0E Ä1EÄ5EÄ6EÄ;E Å EÅEÅEÚprotocolÚautoÚdiscoverrã   c                 ó   € R # )TrR   )rð   s   &r)   Ú<lambda>Ú<MCPServerTransportMixin._negotiate_session.<locals>.<lambda>Û   s   € Átr+   uk   MCP server '%s': server/discover rejected (%s) despite protocol=%s â€” falling back to the legacy handshakeNu\   MCP server '%s': unknown protocol=%r â€” treating as 'auto' (valid: auto, stateless, legacy)c                 óB   <€ \        V 4      ;'       d    \        SR 4      # )rö   )r   Úhasattr)rð   rß   s   &€r)   rø   rù   å   s!   ø€ Ô2OÐPSÓ2T×2uÐ2uÔY`ÐahÐjtÓYuÐ2ur+   un   MCP server '%s': legacy handshake rejected (%s) â€” retrying via server/discover (2026-07-28 stateless server))Ú	statelessÚmodernz
2026-07-28)ÚlegacyÚ	handshake)r'   rž   r0   r3   r2   rç   ÚwarningrÂ   )rµ   rß   rÔ   rò   Úmoderà   s   fff  @r)   Ú_negotiate_sessionÚ*MCPServerTransportMixin._negotiate_session»   sñ   ûé € ÷	Yñ 	Y÷	Kð 	Kô* �D—L‘L×&Ð& B×+Ñ+¨J¸Ó?Ó@×FÑFÓH×NÑNÓPˆØÐ8Ô8Ù  ¨\Ñ;Kð"XØY]ó_÷ _ð _ð Ð*Ô*Ù˜lÓ+×+Ð+Ø�6Œ>Ü�N‰Nð >Ø?C¿y¹yÈ$ôPñ Ø˜*Ô&uØ|ó~÷ ~ð 	~ñ_ñ ,ñ
~ùs6   †A6CÁ<CÁ=CÂCÂ>CÃCÃCÃCÃCc           
   ƒ  ó  "  € ^ RI Hp \        P                  p\	        VRR4      p\        V4      '       d	   V! V4      MVP                  4       p\	        VRR4      ;'       g    VP                  RRR7      pVP                  VP                  VP                  W5VR7      R	7      VP                  4      G Rj  x€L
 pVP                  VP                  R
V/R7      4       VP                  VP                  4       4      G Rj  x€L
  V#  LP L5i)uÀ  Re-run the legacy ``initialize`` exchange the SDK already proved works against this server and
adopt its result pinned to the version WE offered (#113359). ``ClientSession.initialize()`` raises
on a ``protocolVersion`` outside its handshake set even though the server answered 200, and a
stateless server that echoes 2026-07-28 to every offer has no ``server/discover`` â€” so this is the
only way to reach ``notifications/initialized`` and ``tools/list``. Pinning to the offered version
keeps later requests legacy-shaped (envelope and MCP-Protocol-Version header), the form the
handshake itself just proved the server accepts. The returned result keeps the server's own
version for logging/diagnostics.)ÚtypesÚ_build_capabilitiesNÚ_client_inforÀ   Ú0rÁ   )ÚprotocolVersionr±   Ú
clientInfo)ÚparamsÚprotocol_version)r–   )Úmcpr  r   ré   r³   ÚcallableÚClientCapabilitiesr¾   Úsend_requestÚInitializeRequestÚInitializeRequestParamsÚInitializeResultÚadoptÚ
model_copyÚsend_notificationÚInitializedNotification)rµ   rß   r  ÚofferedÚ
build_capsr±   r½   Úresults   &&      r)   rê   Ú>MCPServerTransportMixin._complete_handshake_at_offered_versionè   s  é € õ 	Ü×0Ñ0ˆÜ˜WÐ&;¸TÓBˆ
Ü.6°z×.BÒ.B‘z 'Ô*È×H`ÑH`ÓHbˆÜ˜g ~°tÓ<×vÐvÀ×@TÑ@TÐZhÐruÐ@TÓ@vˆØ×+Ñ+Ø×#Ñ#¨5×+HÑ+HØ 'È{ð ,Ió ,\Ð#ó ]à×"Ñ"ó$÷ $ˆð 	�‰�f×'Ñ'Ð0BÀGÐ/LÐ'ÓMÔNØ×'Ñ'¨×(EÑ(EÓ(GÓH×HÐHØˆñ$ñ
 	Iùs,   ‚A DÁ#ADÂ7DÂ8A	DÄD
ÄDÄ
DFc                ó2   <€ V ^8„  d   QhRS[ RS[RS[RS[/# )r$   rÔ   ÚlabelÚmark_lifecycler%   )rÕ   r'   r9   )r(   r®   s   "€r)   r*   r¯   þ   s,   ø€ ÷ %ñ %¹Uð %Ù$'ð%Ù>Bð%ÙORñ%r+   c              ƒ  ól  "  € V P                  W4      G Rj  x€L
 V n        Wn        V'       d   V P                  4        V P	                  4       G Rj  x€L
  V P
                  P                  4        RV n        \        P                  ! V P                  4       RV n        \        P                  ! V 4      p V P                  4       G Rj  x€L
 pVe   VP                  4        T'       d)   TR8X  d"   \         P#                  RT P                  T4       T#  Lü LÃ LN  Te   TP                  4        i i ; i5i)a  Handshake, discover, publish readiness, then serve until a lifecycle event. Clears stale
breaker state but leaves the session UNPROVEN: flapping transports handshake fine and drop
moments later, so only keepalive/tool-call success clears the reconnect budget.NTFÚ	reconnectu@   MCP server '%s': reconnect requested â€” tearing down %s session)r  r´   rß   Ú_mark_lifecycle_startedÚ_discover_toolsÚ_readyr¦   Ú_ever_connectedr   Ú_reset_server_errorrÂ   Ú_session_provenÚ_eventsÚstart_refresh_taskÚ_wait_for_lifecycle_eventÚcancelrç   rè   )rµ   rß   rÔ   r  r  Úevents_taskÚreasons   &&&&&  r)   Ú_serve_sessionÚ&MCPServerTransportMixin._serve_sessionþ   sþ   é € ð
 (,×'>Ñ'>¸wÓ'X×!XˆÔØŒßØ×(Ñ(Ô*Ø×"Ñ"Ó$×$Ð$Ø�‰�‰ÔØ#ˆÔÜ×!Ò! $§)¡)Ô,ð   %ˆÔÜ×0Ò0°Ó6ˆð	%Ø×9Ñ9Ó;×;ˆFàÒ&Ø×"Ñ"Ô$ß�V˜{Ô*Ü�K‰KÐZÐ\`×\eÑ\eÐglÔmØˆñA "Yñ 	%ñ, <øàÒ&Ø×"Ñ"Õ$ð 'üsR   ‚D4—D˜:D4ÁDÁA"D4Â6D Ã	DÃ
D ÃD4Ã*+D4ÄD4ÄD ÄD1Ä1D4c                ó,   <€ V ^8„  d   QhRS[ RS[RS[ /# )r$   r  rÔ   r%   )r'   rÕ   )r(   r®   s   "€r)   r*   r¯   %  s$   ø€ ÷ 9ñ 9¹#ð 9ÑPUð 9ÑZ]ñ 9r+   c           
   ƒ  ó6  "  €  T;_uu_4       GRj  x€L
 p\         P                  ! V^ ,          V^,          3/ V P                  4       B ;_uu_4       GRj  x€L
 pV P                  WSV4      G Rj  x€L
 uuRRR4      GRj  x€L
  uuRRR4      GRj  x€L
  #  L‡ LD L, L L  + GRj  x€L 
 '       g   i     M; iRRR4      GRj  x€L 
  R#   + GRj  x€L 
 '       g   i     R# ; i  \         d   pT P                  T4      u Rp?# Rp?ii ; i5i)zºOpen *transport_cm*, wrap its streams in a ClientSession and serve it. Streams are indexed,
not unpacked (mcp 1.x yields a 3-tuple, 2.x a pair); a TaskGroup drop maps to ``"reconnect"``.N)r   ÚClientSessionrÑ   r-  ÚBaseExceptionGroupÚ_reconnect_or_reraise_group)rµ   Útransport_cmr  rÔ   Ú_streamsrß   Ú_egs   &&&&   r)   Ú_serve_transportÚ(MCPServerTransportMixin._serve_transport%  s¹   é € ð	9ß#—|‘| xÜ ×.Ò.¨x¸­{¸HÀQ½KÑbÈ4×K_ÑK_ÓKa×b×bÒbÐfmØ!%×!4Ñ!4°WÈuÓ!U×U÷ c×bÑb÷ $—|”|ÙbÙUñ cñ $ßb×b×bÐbú÷ $—|—|—|—|”|ûô "ô 	9Ø×3Ñ3°CÓ8Õ8ûð	9üs  ‚D„C0 ’B“C0 –ACÁBÁCÁB$	Á1BÁ2B$	Á5CÂB 
ÂCÂC0 ÂB"ÂC0 ÂDÂC0 ÂCÂB$	Â CÂ"C0 Â$B=Â*B-Â+
B=Â6B=Â8CÃ C0 ÃCÃC0 ÃDÃC-	ÃCÃ
C-	Ã%C-	Ã'C0 Ã+DÃ-C0 Ã0DÃ;DÄDÄDÄDÄDc                ó4   <€ V ^8„  d   QhRS[ S[,          RR/# ©r$   Únew_pidsr%   N©r¦   rf   )r(   r®   s   "€r)   r*   r¯   1  s#   ø€ ÷ $Gñ $G±±Cµð $G¸Tñ $Gr+   c                óÀ  € / p/ pV F1  p \         P                  ! V4      W$&   \        V4      pVf   K-  WSV&   K3  	  \        P                  ;_uu_ 4        \        P                  ! \        P                  WP                  4      4       \        P                  ! V4       \        P                  ! V4       RRR4       V F  p ^ RIHp V! VR4       K  	  \        P(                  ! RVP+                  4       4       R#   \         d    YBT&    Lê\        \        3 d     Lüi ; i  + '       g   i     Lw; i  \"         d    \$        P'                  RTRR7        Kž  i ; i)zºLedger the freshly spawned stdio children (pids, pgids, machine spawn ledger). pgids are
captured while alive (getpgid fails after exit; the sweep needs them for reparented descendants).N)Úregister_childz
mcp-helperz8spawn-ledger register_child failed for MCP helper pid %sT©Úexc_infoÚregister)rh   ÚgetpgidÚProcessLookupErrorrj   rl   r   r   Ú_lockr   r–   r@   ÚfromkeysrÂ   r   r   Úhermes_cli.process_identityr>  rä   rç   ÚdebugÚ_update_death_supervisorÚvalues)rµ   r;  Ú	new_pgidsÚ
new_startsÚpidÚstartÚ_pidr>  s   &&      r)   Ú_track_spawned_childrenÚ/MCPServerTransportMixin._track_spawned_children1  s  € ð %'ˆ	Ø%'ˆ
ÛˆCð	Ü!#§¢¨C£�	‘ô ' sÓ+ˆEØÔ Ø"'˜3“ñ ô  �[�[‹[Ü×ÒœtŸ}™}¨X·y±yÓAÔBÜ×Ò 	Ô*Ü×$Ò$ ZÔ0÷ ó
 ˆDðnÝFÙ˜t \Ö2ñ ô 	×&Ò& z°9×3CÑ3CÓ3EÖFøô9 &ô %ð
 "%˜#“Ü"¤GÐ,ô Ùðú÷ �[ûô ô nÜ—‘ÐWÐY]Ðhl�×mðnús<   ‹C<ÁA D#ÃD6Ã<D ÄD ÄD ÄD Ä#D3	Ä6#EÅEc                ó4   <€ V ^8„  d   QhRS[ S[,          RR/# r:  r<  )r(   r®   s   "€r)   r*   r¯   W  s#   ø€ ÷ Eñ E±#±cµ(ð E¸tñ Er+   c                ó.  € ^ RI Hp . p\        P                  ;_uu_ 4        V F»  p\        P
                  ! VR4       V! V4      '       g&   \        \        P                  ! V4      4      '       d,   \        P                  ! V4       V P                  \        V&   Kx  \        P
                  ! VR4      pVe   VP                  V4       \        P
                  ! VR4       K½  	  RRR4       \        P                  ! RV4       R#   + '       g   i     L); i)u¸   Drop the ledger entries; a child (or its pgroup) still alive means SDK teardown failed
(common on mid-way cancel on Linux: setsid() children escape) â€” mark it orphaned for the sweep.)Ú_pid_existsNÚ
unregister)Úgateway.statusrS  r   rD  r   Úpoprm   r   r0   r   ÚaddrÂ   r   Úappendr   rH  )rµ   r;  rS  Úreleased_pgidsrL  Údroppeds   &&    r)   Ú_release_spawned_childrenÚ1MCPServerTransportMixin._release_spawned_childrenW  sÁ   € õ 	/ð  "ˆÜ�[�[‹[Û�Ü—’  TÔ*á˜s×#Ò#¤}´\×5EÒ5EÀcÓ5J×'KÒ'KÜ&×*Ò*¨3Ô/Ø59·Y±YÔ-¨cÓ2ä*×.Ò.¨s°DÓ9�GØÒ*Ø&×-Ñ-¨gÔ6Ü%×)Ò)¨#¨tÖ4ñ  ÷ ô 	×&Ò& |°^ÖD÷ �[ús   ¡CDÄD	c                ó    <€ V ^8„  d   QhRS[ /# ©r$   r”   r?   )r(   r®   s   "€r)   r*   r¯   m  s   ø€ ÷ F9ñ F9¡tñ F9r+   c           
   ƒ  óÂ  "  € VP                  R4      e!   \        P                  RV P                  4       \        P
                  ! 4       '       g   \        RV P                   R24      hVP                  R4      pV'       g   \        RV P                   R24      h\        V P                  V4      w  r4\        P                  ! V4      V n        Vw  r%p\        P                  ! V P                  W!P                  R. 4      4      G Rj  x€L
 w  r'\        P                  ! Y'T;'       g    RTR	R
7      p ^ RIHp	 V	! 4        \$        P&                  ! \(        P*                  4      G Rj  x€L
  \(        P,                  ! 4       p
\/        4       p\0        P2                  ! V P                  4       \0        P4                  ! \0        P6                  ! 4       4      p \        P8                  ! WŒP:                  R7      ;_uu_4       GRj  x€L
 w  rÞ\=        \(        P,                  ! 4       V
,
          4      pV'       d   V P?                  V4       \/        V4      V n         \        PB                  ! WÞ3/ V PE                  4       B ;_uu_4       GRj  x€L
 p\G        VP                  R\        PH                  4      4      pV PK                  VVRR7      G Rj  x€L
 uuRRR4      GRj  x€L
  uuRRR4      GRj  x€L
  VPM                  ^ R7       V'       d   V PO                  V4       # #  EL  \          d    \        P#                  RRR7        EL
i ; i ELç ELO LË Lˆ Ly Li  + GRj  x€L 
 '       g   i     M; iRRR4      GRj  x€L 
  Mt  + GRj  x€L 
 '       g   i     M[; i  \          dK   p\Q        T P                  \$        P&                  ! TPL                  4      G Rj  x€L 
 4      pTe   TThh Rp?ii ; iTPM                  ^ R7       T'       d   T PO                  T4       R# R#   TPM                  ^ R7       T'       d   T PO                  T4       i i ; i5i)z%Run the server using stdio transport.Úidentity_headerNug   MCP server '%s': identity_header is only supported on HTTP/SSE transports â€” ignored for stdio serversr€   zp' requires the 'mcp' Python SDK, but it is not installed. Run `hermes setup` to install MCP support, then retry.r›   z' has no 'command' in configÚargsÚreplace)r›   ra  rœ   r�   Úencoding_error_handler)Ú attach_self_to_kill_on_close_jobz0job-object self-attach failed before stdio spawnTr?  )ÚerrlogrÔ   )r  rÛ   ))r0   rç   r   rÂ   r   Ú_ensure_mcp_sdkÚImportErrorÚ
ValueErrorrª   Ú_registrationÚ_identity_digestÚ_resolved_identityÚ_preflight_stdio_commandÚStdioServerParametersrF  rd  rä   rG  rÝ   Ú	to_threadÚ
_lifecycleÚ_kill_orphaned_mcp_childrenÚ_snapshot_child_pidsr¦   rž   Ú_write_stderr_log_headerÚ
_StderrTeeÚ_get_mcp_stderr_logÚstdio_clientÚsinkr   rO  Ú_stdio_child_pidsr1  rÑ   rÕ   Ú_DEFAULT_CONNECT_TIMEOUTr-  Úcloser[  r   )rµ   r”   r›   ÚinputsÚ_Úsafe_envÚ	stdio_cwdra  Úserver_paramsrd  Úpids_beforer;  ÚstderrÚread_streamÚwrite_streamrß   rÔ   rð   Ú	abi_errors   &&                 r)   Ú
_run_stdioÚ"MCPServerTransportMixin._run_stdiom  sv  é € à�:‰:Ð'Ó(Ò4Ü�N‰Nð OØPT×PYÑPYô[ä×$Ò$×&Ò&Ü ¨T¯Y©Y¨Kð 8lð ló mð mà—*‘*˜YÓ'ˆßÜ˜|¨D¯I©I¨;Ð6RÐSÓTÐTÜ# D§I¡I¨vÓ6‰	ˆä"/×"@Ò"@ÀÓ"HˆÔØ'-Ñ$ˆ˜9ä#×<Ò<¸T¿Y¹YÈ×Q[ÑQ[Ð\bÐdfÓQgÓh×h‰ˆÜ×3Ò3Ø¨H×,<Ð,<¸À)à#,ô.ˆð	\ÝTÙ,Ô.ô
 ×Ò¤
× FÑ FÓG×GÐGÜ ×5Ò5Ó7ˆô ›ˆä×(Ò(¨¯©Ô3Ü×#Ò#¤G×$?Ò$?Ó$AÓBˆð	9Ü×)Ò)¨-ÇÁ×L×LÕLÑPkÐQ\ô 0´
×0OÒ0OÓ0QÐT_Õ0_Ó`�ßØ×0Ñ0°Ô:Ü),¨X«�Ô&Ü ×.Ò.¨{ÑcÈD×L`ÑL`ÓLb×c×cÒcÐgnô ',¨F¯J©JÐ7HÌ%×JhÑJhÓ,iÓ&j�OØ!%×!4Ñ!4°W¸oÐ^bÐ!4Ó!c×c÷	 d×cÑc÷ M×LÑLð& �L‰L ˆLÔ#ßØ×.Ñ.¨xÕ8ð òk iøô ô 	\Ü�L‰LÐKÐVZˆL×[ð	\úò 	Hò Mñ dñ dñ	 dñ M÷ d×c×cÐcú÷ M×L×L×L×LÒLûô ô 	ä& t§y¡y¼×8IÒ8IÈ&Ï,É,Ó8W×2WÐ2WÓXˆIØÒ$Ø SÐ(Øûð	úð �L‰L ˆLÔ#ßØ×.Ñ.¨xÖ8ñ øð �L‰L ˆLÔ#ßØ×.Ñ.¨xÕ8ð üsl  ‚AQÁ1QÂBQÄL#Ä	QÄ)
QÄ4L& Å'QÅ(MÅ)A,QÇ-N' ÈMÈN' ÈBNÊ	MÊ
NÊAM	ËMËM	ËNËM
Ë NË$N' Ë1MË2N' Ë6.QÌ&"MÍQÍMÍQÍN' ÍNÍM	ÍNÍN' ÍM6Í#M&Í$
M6Í/M6Í1NÍ9N' ÎNÎN' Î
P. ÎN$	ÎNÎ
N$	ÎN$	ÎN' Î#P. Î$N' Î'O<Î23O7Ï%O(Ï&O7Ï7O<Ï<P. Ï?/QÐ..QÑQr/   Nr\   Tr]   rÜ   g      @Ústrict_redirect_headersc                óL   <€ V ^8„  d   QhRS[ RS[S[,          RS[RS[RS[RR/# )r$   rH   r/   r\   rÜ   r†  r%   N)r'   r   r@   r9   rÕ   )r(   r®   s   "€r)   r*   r¯   ·  sG   ø€ ÷ 3Oñ 3O±ð 3OÁ(É4Å.ð 3OÙ26ð3OÙZ_ð3Oá?Cð3OàPTñ3Or+   c             ƒ  óh  a "  €  ^ RI pR T 3R llpT'       d   \        T4      M/ p	TP                  ! RRT/\	        TR7      B p
\        YwP                  T4      TT	 Uu0 uF  q»P                  4       kK  	  upR7      p T! RRRR	TP                  T4      R
T
/\	        \        YqY4S P                  4      R7      B ;_uu_4       GRj  x€L
 pTP                  YR7      G Rj  x€L
 pTP                  R9   d   TP                  YR7      G Rj  x€L
 pT! T4      '       dV   TP                  T\        / T	CRRRR/CR7      G Rj  x€L
 p\!        T4      '       d   \#        T4      S P$                  9   d   TpRRR4      GRj  x€L
  T! X4      '       g   R# \#        T4      p\)        RS P                   RT RT RRP+                  S P$                  4       R2	4      h  \         d     R# i ; iu upi  EL* EL Lê L¶ L{  + GRj  x€L 
 '       g   i     L’; i  TP&                   d     R# i ; i5i)u2  Probe *url* before the SDK connects: a plain web page would make the SDK sit out the full
``connect_timeout`` before an opaque ``CancelledError``; this raises NonMcpEndpointError within
``timeout``. Allow-list based: only a 2xx with a definite non-MCP content type is rejected, and
only after a JSON-RPC ``initialize`` POST also fails to look like MCP (some servers serve a UI
on GET but speak MCP via POST). Anything else passes â€” the handshake stays the source of truth.
Own httpx client, OUTSIDE the SDK's anyio task group, so the error isn't group-wrapped.Nc                ó$   € V ^8„  d   QhR\         /# r#   r8   )r(   s   "r)   r*   ÚEMCPServerTransportMixin._preflight_content_type.<locals>.__annotate__Å  s   € ÷ 	Tñ 	T¤$ñ 	Tr+   c                 ó„   <€ \        V 4      p\        V 4      ;'       d#    \        V4      ;'       d    VSP                  9  # )N)r6   r=   r9   Ú_MCP_CONTENT_TYPES)r5   Úctrµ   s   & €r)   Ú_non_mcp_2xxÚEMCPServerTransportMixin._preflight_content_type.<locals>._non_mcp_2xxÅ  s6   ø€ ä# DÓ)ˆBÜ˜4“=×SÐS¤T¨"£X×SÐS°"¸D×<SÑ<SÑ2SÐSr+   rM   rN   ©Ústrictr©   Úfollow_redirectsTrÜ   Ú	transport)r`   )r/   zContent-Typezapplication/jsonÚAcceptz#application/json, text/event-stream)Úcontentr/   r€   z' at z returned Content-Type 'z)', not an MCP response (expected one of: z, u­   ). The URL most likely points at a web page rather than an MCP endpoint â€” check it resolves to a Streamable HTTP / SSE endpoint (e.g. https://host/mcp, not https://host/).rR   )i•  iõ  )Úhttpxrg  r@   rZ   rF   r   ÚURLr3   ÚTimeoutrc   rÂ   Úheadr<   r0   ÚpostÚ_PROBE_INITIALIZE_BODYr=   r6   rŒ  Ú	HTTPErrorr
   Újoin)rµ   rH   r/   r\   r]   rÜ   r†  Ú_httpxrŽ  Úprobe_headersÚprobe_transportr¨   Ú_build_clientÚclientr5   Ú	post_respÚct_bases   f&$$$$$          r)   Ú_preflight_content_typeÚ/MCPServerTransportMixin._preflight_content_type·  sQ  øé € ð	Û"÷	Tð 	T÷ *1œ˜Wœ°bˆð !×3Ò3Ñd¸:ÐdÌÐWbÔIcÑdˆÜ6Ø—J‘J˜s“OÐ,CÙ<IÓ$J¹M°S§Y¡Y¦[¹MÑ$JôLˆð	Ù$ñ kØ%)ðkØ39·>±>À'Ó3JðkØVeðkäÔ&7¸ÀZÐ^b×^gÑ^gÓ&hÔi÷k÷ kò kàntØ#Ÿ[™[¨˜[ÓD×D�Ø×#Ñ# zÔ1Ø!'§¡¨C Ó!G×G�Dá ×%Ò%Ø&,§k¡kØÔ%;ð!R =ð !R°.ÐBTØ!)Ð+Pñ!Rð '2ó 'S÷ !S�Iô ˜y×)Ò)Ô.@ÀÓ.KÈt×OfÑOfÔ.fØ(˜÷k÷ kñ  ˜D×!Ò!ÙÜ$ TÓ*ˆÜ! L°·±°¸5ÀÀÐE]Ð^eÐ]fð g*Ø*.¯)©)°D×4KÑ4KÓ*LÐ)Mð NNð#Nó Oð 	OøôK ô 	Úð	üò  %Kòkò EáGñ!S÷k÷ k÷ kò kûð ×Ñô 	Úð	üsû   ƒH2…G ‰H2šAH2ÁG-Á7H2Â AH ÃG2Ã	H ÃG>Ã"G5Ã#*G>ÄG8ÄG>Ä #G>ÅG:Å1G>Å5H Æ G<ÆH ÆH2ÆAH2ÇG*Ç&H2Ç)G*Ç*H2Ç2H Ç5G>Ç8G>Ç:G>Ç<H Ç>H	ÈHÈ
H	ÈH	ÈH ÈH2ÈH ÈH/È+H2È.H/È/H2c                ó&   <€ V ^8„  d   QhRS[ RS[/# )r$   Úegr%   )r2  r'   )r(   r®   s   "€r)   r*   r¯   ì  s   ø€ ÷ ñ Ñ.@ð ÁSñ r+   c                ód  € V P                   P                  4       '       gm   VP                  \        \        34      ^ ,          fI   VP                  \
        P                  4      ^ ,          f!   V P                  P                  4       '       g   Vh\        P                  RV P                  V4       R# )uä  Map an SDK transport TaskGroup failure to a clean ``"reconnect"``: HTTP/SSE stream pumps run in an anyio
TaskGroup, so a transient drop escapes as a ``BaseExceptionGroup`` that would otherwise park the server for
300s over a sub-second glitch. Re-raise when it is not one: shutdown in progress (``_shutdown_event`` is
set before cancel), KeyboardInterrupt/SystemExit or a real CancelledError in the group, or no live session
this attempt (``_ready`` unset â€” connect failures must back off, not hot-loop).

Streamable-HTTP / SSE transports run their stream pump inside an anyio TaskGroup. A transient stream
drop (idle timeout, brief backend blip, server-side TCP close) surfaces as a ``BaseExceptionGroup``
escaping the transport context manager. Left unwrapped it reaches ``run()``'s error path, which
applies exponential backoff and eventually *parks* the server for 300s and deregisters its tools â€” a
multi-minute tool outage for what is usually a sub-second glitch while the POST path stays healthy
(issue #66092).
- the group carries a ``KeyboardInterrupt`` / ``SystemExit`` â€” fatal signals must propagate to the
interpreter, never be converted into a reconnect; - the group carries a real ``CancelledError``
(task cancellation must propagate to asyncio, mirroring the ``run()`` guard for #9930); - we never
reached a live session this attempt (``_ready`` unset) â€” a connect/handshake failure SHOULD fall
through to ``run()``'s backoff rather than hot-loop reconnects against a broken endpoint.
uy   MCP server '%s': transport TaskGroup exited after a live session (%r) â€” reconnecting immediately instead of backing offr   )Ú_shutdown_eventÚis_setr1   ÚKeyboardInterruptÚ
SystemExitrÝ   ÚCancelledErrorr#  rç   rG  rÂ   )rµ   r¨  s   &&r)   r3  Ú3MCPServerTransportMixin._reconnect_or_reraise_groupì  s‡   € ð& × Ñ ×'Ñ'×)Ò)Ø—8‘8Ô.´
Ð;Ó<¸QÕ?ÒKØ—8‘8œG×2Ñ2Ó3°AÕ6ÒBØ—{‘{×)Ñ)×+Ò+ØˆHÜ�‰ð PØQU×QZÑQZÐ\^ô	`ár+   c                ó&   <€ V ^8„  d   QhRS[ RS[/# )r$   rH   r”   )r'   r@   )r(   r®   s   "€r)   r*   r¯     s   ø€ ÷ 
ñ 
¡Sð 
±$ñ 
r+   c                ó   € V P                   R8w  d   R#  ^ RIHp V! 4       P                  V P                  WP                  R4      4      #   \         d(   p\        P                  RT P                  T4       h Rp?ii ; i)z·OAuth 2.1 PKCE via the central MCPOAuthManager (one provider reused across reconnects and
CLI paths). Setup failures re-raise (after a warning) so only this server is reported failed.ÚoauthN)Úget_managerz#MCP OAuth setup failed for '%s': %s)	Ú
_auth_typeÚtools.mcp_oauth_managerr³  Úget_or_build_providerrÂ   r0   rä   rç   r   )rµ   rH   r”   r³  rð   s   &&&  r)   Ú_build_oauth_authÚ)MCPServerTransportMixin._build_oauth_auth  sf   € ð �?‰?˜gÔ%Ùð	Ý;Ù“=×6Ñ6°t·y±yÀ#ÇzÁzÐRYÓGZÓ[Ð[øÜô 	Ü�N‰NÐ@À$Ç)Á)ÈSÔQØûð	ús   •5A ÁA=Á"A8Á8A=c                ó2   <€ V ^8„  d   QhRS[ RS[RS[RS[/# )r$   rH   r/   rÔ   Ústrict_cfg_headers)r'   r@   rÕ   r9   )r(   r®   s   "€r)   r*   r¯     s*   ø€ ÷ .ñ .¡#ð .±ð .Áuð .ÙPTñ.r+   c                ól  a aaaa
€ V'       d   \        RS P                   R24      h\        P                  f   \	        RS P                   R24      hRSRT;'       g    RR\        V4      RR	/\        VR
7      Cp\        P                  ! 4       o
RV
VV VV3R llp	W˜R&   \        P                  ! R/ VB # )z>``sse_client`` context manager for ``transport: sse`` entries.r€   zA': strict_redirect_headers is not supported on the SSE transport.Nzt' requires SSE transport but mcp.client.sse.sse_client is not available. Upgrade the mcp package to get SSE support.rH   r/   rÜ   Ússe_read_timeoutç     Àr@©Úauthc                 óö   <€ SP                   ! R
R S/\        SR7      B pSP                  ! R
RRRVe   TMSP                  RRR7      R\	        SV4      /\        \        SSSSSP                  4      WR	7      B # )rM   rN   r’  TrÜ   g      >@r½  ©Úreadr“  )r`   r/   r¿  rR   )rZ   rF   ÚAsyncClientr˜  r   rc   rÂ   )	r/   rÜ   r¿  Úinner_transportÚ
_httpx_modr]   rµ   r\   rH   s	   &&& €€€€€r)   Ú_sse_client_factoryÚCMCPServerTransportMixin._sse_transport.<locals>._sse_client_factory'  s˜   ø€ Ø(×;Ò;ÑlÀ:ÐlÔQYÐ_jÔQkÑlˆOØ×)Ò)ñ 8Ø!%ð8à#*Ò#6™¸J×<NÑ<NÈtÐZ_Ð<NÓ<`ð8ô 7°zÀ?ÓSð8ô Ô"3°JÀÀZÐQ\Ð^b×^gÑ^gÓ"hØ#*ô7ñ	8ð 8r+   Úhttpx_client_factory)NNNrR   )rh  rÂ   r   Ú
sse_clientrg  rÕ   rF   Ú	sdk_httpx)rµ   rH   r/   rÔ   r\   r]   Ú
oauth_authrº  Ú
sse_kwargsrÆ  rÅ  s   ff&&ff&&  @r)   Ú_sse_transportÚ&MCPServerTransportMixin._sse_transport  sÌ   ü€ ÷ Ü˜|¨D¯I©I¨;ð 7Cð Có Dð Dä×ÑÒ#Ü ¨T¯Y©Y¨Kð 8Lð Ló Mð Mð
 " 3¨	°7·?°?¸dÀIÌuÐUdÓOeØ.°ðTÜ9AÀzÔ9RðTˆ
ô —_’_Ó&ˆ
÷	8ó 	8ð .AÐ)Ñ*Ü×ÒÑ- *Ñ-Ð-r+   c          
      ó8   <€ V ^8„  d   QhRS[ RS[RS[RS[RS[/# )r$   rH   r/   rÔ   rº  r©   )r'   r@   rÕ   r9   r¦   )r(   r®   s   "€r)   r*   r¯   2  s3   ø€ ÷  'ñ  '©cð  '¹Dð  'ÑSXð  'á7;ð 'áVYñ 'r+   c	           
     ó�  aaa€ \         P                  '       gR   V'       d   \        RV P                   R24      h\         P                  ! S3RVR\        V4      RV/\        VR7      B # \         P                  ! 4       p	\        W™P                  S4      WxR7      oV	P                  ! RRV/\        VR7      B p
R	R
RV	P                  \        V4      RR7      /V'       d   RV/M/ CRR\        V P                  4      ./R\        Wš4      /C\        \        V	SWEV P                  4      VR7      Co\         VVV3R l4       pV! 4       # )zŽStreamable HTTP context manager: mcp >= 1.24.0 gets a caller-owned httpx client; on the
deprecated API (mcp < 1.24.0) the SDK owns the client.r€   z}' requires mcp >= 1.24.0 to enforce the portable redirect-header boundary (strict_redirect_headers). Upgrade the mcp package.r/   rÜ   rM   r¾  r�  rN   r’  Tr½  rÁ  Úevent_hooksÚresponser“  )r`   r¿  c            
     ó`  <"  € S! R/ SB ;_uu_4       GR j  x€L
 p \         P                  ! SV R7      ;_uu_4       GR j  x€L
 pV5x € R R R 4      GR j  x€L
  R R R 4      GR j  x€L
  R #  LT L- L  + GR j  x€L 
 '       g   i     L1; i L(  + GR j  x€L 
 '       g   i     R # ; i5i)N)Úhttp_clientrR   )r   Ústreamable_http_client)rÔ  Ústreamsr¡  Úclient_kwargsrH   s     €€€r)   Ú_owned_client_streamsÚQMCPServerTransportMixin._streamable_http_transport.<locals>._owned_client_streamsM  sf   øé € á$Ñ5 }×5×5Ò5¸Ü ×7Ò7¸È×U×UÕUÐY`Ø!“M÷ V×U÷ 6×5Ó5ßU×U×UÔUú÷ 6×5×5Ó5üs˜   ƒB.˜A-™B.œ%BÁA/ÁBÁA3	ÁBÁA1ÁBÁB.Á&BÁ'B.Á/BÁ1BÁ3BÁ9A<Á:
BÂBÂBÂB.ÂB+	ÂBÂ
B+	Â#B+	Â%	B.rR   )r   Ú_MCP_NEW_HTTPrg  rÂ   Ústreamablehttp_clientrÕ   rF   rÊ  r   r—  rZ   r˜  r   Ú_http_rejectionr   rc   r   )rµ   rH   r/   rÔ   r\   r]   rË  rº  r©   r–  rÄ  rØ  r¡  r×  s   &f&&&&&&&   @@r)   Ú_streamable_http_transportÚ2MCPServerTransportMixin._streamable_http_transport2  sl  ú€ ô
 ×"×"Ð"ß!Ü! L°·±°ð <Xð #Xó Yð Yô ×.Ò.¨sñ L¸Gð LÌUÐSbÓMcð LÐlvð LÜ19¸zÔ1JñLð Lô —’Ó!ˆÜ6Ø—9‘9˜S“>Ð*<ôoˆð  ×2Ò2Ñc¸*ÐcÌÐVaÔHbÑcˆØ1°4¸ÀEÇMÁMÔRWÐXgÓRhÐotÀMÓDuð <ß:A 9¨gÑ"6Àrð<à,¨zÔ<YÐZ^×ZnÑZnÓ<oÐ;pÐ.qØ*Ô,HÈÓ,`ñ<ô "*Ô1BÀ5È#ÈzÐhl×hqÑhqÓ1rØ/9ô";ð	<ˆô 
ö	"ó 
ð	"ñ %Ó&Ð&r+   c                ó    <€ V ^8„  d   QhRS[ /# r^  r?   )r(   r®   s   "€r)   r*   r¯   T  s   ø€ ÷ Dañ Da¡dñ Dar+   c              ƒ  ój  "  € \         P                  ! 4        \         P                  '       g   \        RV P                   R24      h\        V P                  V4      w  r#\        P                  ! V4      V n        Vw  rE\        P                  RV P                  V4       / V n        \        ;QJ d    R V 4       F  '       g   K   RM	  RM! R V 4       4      '       g   \         P                  VR&   VP                  R\         P                  4      pWEWaP                  R	R4      \!        V P                  V4      V P#                  WA4      \%        VP                  R
4      4      3pVP                  R4      R8X  d3   V P'                  V P(                  ! V!  R\+        V4      4      G Rj  x€L
 # V P,                  '       dS   \        P/                  RV P                  4       V P'                  V P(                  ! V!  R\+        V4      4      G Rj  x€L
 # V P0                  ! . VOVN5!  p\         P2                  '       d   RMRp	 V P'                  W‰\+        V4      4      G Rj  x€L
 #  L» LY L  \4         Ed;   p
\7        Y P                  4      pT P8                  '       g!   TR,          '       g   \;        T
4      '       g8   T\=        \?        T
4      4      8w  d   \A        RT P                   RT R24      T
hh \        PC                  RT P                  T4        RT n        T P'                  T P(                  ! T!  R\+        T4      4      G Rj  x€L 
 u Rp
?
#   \4         dI   pT P8                  '       d   h RT n        \A        RT P                   RT R\?        T4       R24      ThRp?ii ; iRp
?
ii ; i5i)z<Run the server using HTTP/StreamableHTTP (or SSE) transport.r€   zw' requires HTTP transport but mcp.client.streamable_http is not available. Upgrade the mcp package to get HTTP support.z!MCP server '%s': connecting to %sc              3   óF   "  € T F  qP                  4       R 8H  x € K  	  R# 5i)úmcp-protocol-versionN)r3   )Ú.0r¨   s   & r)   Ú	<genexpr>Ú4MCPServerTransportMixin._run_http.<locals>.<genexpr>f  s   é € ÐLÁG¸S—9‘9“;Ð"8Ö8ÃGùs   ‚!TFrâ  rÔ   r\   r†  r“  ÚsseÚSSENz5MCP server '%s': using latched SSE fallback transportÚHTTPzlegacy HTTPz#': Streamable HTTP connect failed (Ú)uÎ   MCP server '%s': Streamable HTTP rejected the initial connect (%s) â€” retrying over SSE. If this connects, set `transport: sse` for this server in config.yaml to skip the failed attempt on future startups.zD': both Streamable HTTP and SSE transports failed (Streamable HTTP: z; SSE: z^). Check the URL points at an MCP endpoint, or pin `transport: sse` if the server is SSE-only.éÿÿÿÿ)"r   rf  Ú_MCP_HTTP_AVAILABLErg  rÂ   rª   ri  rj  rk  rç   rG  rÜ  Úanyré   r0   rx  r   r·  r9   r7  rÍ  rÕ   Ú_sse_fallbackrè   rÝ  rÚ  rä   r   r$  r   r'   r   ÚConnectionErrorr   )rµ   r”   rz  r©   rH   r/   rÔ   Úcommonr“  r  rð   Úhttp_detailÚsse_excs   &&           r)   Ú	_run_httpÚ!MCPServerTransportMixin._run_httpT  sX  é € ä×ÒÔÜ×(×(Ð(Ü ¨T¯Y©Y¨Kð 8Mð Mó Nð Nô
 +:¸$¿)¹)ÀVÓ*LÑ'ˆô #0×"@Ò"@ÀÓ"HˆÔØ‰ˆÜ�‰Ð8¸$¿)¹)ÀSÔIØ!ˆÔ÷ ‹sÑLÁGÓL�s�sŠsÑLÁGÓL×LÒLÜ.3×.LÑ.LˆGÐ*Ñ+Ø Ÿ*™*Ð%6¼×8VÑ8VÓWˆØ ·±¸LÈ$Ó1OÔQeÐfj×foÑfoÐqwÓQxØ×(Ñ(¨Ó5´t¸F¿J¹JÐG`Ó<aÓ7bðdˆà�:‰:�kÓ" eÔ+Ø×.Ñ.¨t×/BÒ/BÀFÑ/KÈUÔTYÐZiÓTjÓk×kÐkØ××Ðô �K‰KÐOÐQU×QZÑQZÔ[Ø×.Ñ.¨t×/BÒ/BÀFÑ/KÈUÔTYÐZiÓTjÓk×kÐkØ×3Ò3ÐU°VÐUÐ=TÓUˆ	Ü×-×-Ð-‘°=ˆð$	aØ×.Ñ.¨yÄÀÓAWÓX×XÐXñ lñ
 lñ YøÜõ "	aô 1°×6JÑ6JÓKˆKð ×$×$Ð$¨¨r¯
¬
Ô:WÐX[×:\Ò:\Ø¤#Ô&=¸cÓ&BÓ"CÔCÜ)¨L¸¿¹¸ð D.Ø.9¨]¸!ð+=ó >ØCFðGàÜ�N‰NðAð —	‘	˜;ô	(ð
aØ%)�Ô"Ø!×2Ñ2°4×3FÒ3FÈÑ3OÐQVÔX]Ð^mÓXnÓo×oÐoÕoøÜô aØ×'×'Ð'ØØ%*�Ô"Ü%Ø" 4§9¡9 +ð .)Ø)4¨°WÜ.¨wÓ7Ð8ð 9SðSóTð Zað	aûð	aþð5"	aüs¬   ‚C N3ÃN3Ã CN3Æ(I$Æ)N3Æ?AN3ÈI&È.N3È<N3ÉI* ÉI(É I* É#N3É&N3É(I* É*N0É6BN+Ì4MÍ
MÍMÍN0ÍN3ÍN(Í AN#Î#N(Î(N+Î+N0Î0N3c           	   ƒ  ó"  "  € RV n         V P                  f   R# V P                  4       '       g)   \        P	                  RV P
                  4       . V n        MƒV P                  ;_uu_4       GRj  x€L
  / V n        \        P                  ! V P                  P                  RV P
                  V P                  R7      G Rj  x€L
 V n        RRR4      GRj  x€L
  V P                  4        R#  L| L- L  + GRj  x€L 
 '       g   i     L1; i5i)a  Discover tools from the connected session. Capability-gated: prompt-/resource-only
servers raise ``MCPError(-32601)`` on ``tools/list``, which would abort the connection.

Skip the call when the server doesn't advertise the ``tools`` capability. (Ported from
anomalyco/opencode#31271.)
FNus   MCP server '%s': does not advertise 'tools' capability â€” skipping tools/list (prompts/resources remain available)r²   )Úcache_meta_out)Ú_ping_unsupportedrß   r·   rç   rè   rÂ   Ú_toolsÚ	_rpc_lockÚ_list_cache_metar   Ú_paginate_full_listÚ
list_toolsÚ$_register_discovered_tools_if_needed)rµ   s   &r)   r"  Ú'MCPServerTransportMixin._discover_toolsž  sÃ   é € ð "'ˆÔØ�<‰<ÒÙØ×%Ñ%×'Ò'Ü�K‰Kð SØTX×T]ÑT]ô_àˆD�Kà—~—~—~“~Ø(*�Ô%Ü$)×$=Ò$=Ø—L‘L×+Ñ+¨W°d·i±iÐPT×PeÑPeô%g÷ g�”÷ &—~ð 	×1Ñ1Ö3ñ	 &ñg÷ &—~—~’~üsf   ‚-D°A DÁ0C-Á1DÁ4AC3ÃC/Ã	C3ÃDÃC1ÃDÃ/C3Ã1DÃ3D	Ã9C<Ã:
D	ÄD	ÄDc                ó   <€ V ^8„  d   QhRR/# )r$   r%   NrR   )r(   r®   s   "€r)   r*   r¯   ³  s   ø€ ÷ @ñ @°dñ @r+   c                óÌ  € V P                   '       d   R# \        P                  ;_uu_ 4        \        P                  P	                  4        UUu. uF  w  rW J g   K  VNK  	  pppRRR4       X'       g#   V P
                  P                  4       '       g   R# \        P                  ! V P                  W P                  4      V n         \        P                  ;_uu_ 4        V FH  p\        P                  P                  V4      V J g   K(  \        P                  P                  VR4       KJ  	  RRR4       R# u uppi   + '       g   i     Lá; i  + '       g   i     R# ; i)a€  Publish freshly discovered tools when none are registered (initial registration normally happens in
``_discover_and_register_server``). Outage handling may clear ``_ready`` and deregister stale tools;
ownership via ``_servers`` authorizes publishing before readiness is restored so a revival (or a server
retained after a recoverable initial failure) never comes back with zero tools.N)Ú_registered_tool_namesr   rD  Ú_serversrB   r#  r«  ri  Ú_register_server_toolsrÂ   rž   r0   Ú_server_connect_errorsrV  )rµ   r¨   rŽ   Úowneds   &   r)   rü  Ú<MCPServerTransportMixin._register_discovered_tools_if_needed³  sã   € ð
 ×&×&Ð&ÙÜ�[�[‹[Ü*/¯.©.×*>Ñ*>Ô*@ÔQÑ*@™Y˜SÀDÀL—S�SÑ*@ˆEÑQ÷ ç˜TŸ[™[×/Ñ/×1Ò1ÙÜ&3×&JÒ&JÈ4Ï9É9ÐVZ×\hÑ\hÓ&iˆÔ#Ü�[�[‹[Û�Ü—>‘>×%Ñ% cÓ*¨dÕ2Ü×0Ñ0×4Ñ4°S¸$Ö?ñ ÷ ‰[ùó	 R÷ �[ú÷
 �[ˆ[ús5   ­"D?Á	D9
ÁD9
Á#D?Ã &EÄ$EÄ9D?Ä?E	ÅE#	)r$  rÜ  rù  rö  r   rk  r&  rí  rw  r÷  r´   rß   rR   )r-   F)rp   rq   rr   rs   rt   Ú	__slots__r·   rÑ   r  rê   r-  r7  rO  r[  r„  r¥  r3  r·  rÍ  rÝ  rò  r"  rü  ru   Ú__classdictcell__)r®   s   @r)   r¬   r¬   ™   só   ø‡ € Ù`à€I÷
Hð 
H÷ð ÷"+~ð +~òZ÷,%ò %÷N9ð 9÷$Gð $G÷LEð E÷,F9ð F9ðT3OÐSWð 3OØ9=ð3OØKOð3OØbeð3OàFK÷3Oò 3O÷jð ÷8
ð 
÷.ð .÷< 'ð  '÷DDað DaòT4÷*@ö @r+   r¬   )r-   )Ert   ÚloggingrÝ   rh   Úurllib.parserS   Úurllib.requestÚ
contextlibr   Útypingr   r   r   Úutilsr   Úagent.proxy_bypassr   r   Úagentr	   r¡   Útools.mcp_tool_errorsr
   r   r   r   r   r   r   r   r   r   r   Útools.mcp_tool_lifecycler   r   r   r   r   r   r   Útools.mcp_tool_commonr   Útools.mcp_tool_node_abir   r²   r   rž   r   r'  r    ro  r!   ri  Ú	getLoggerrç   r›  r6   r=   rF   rc   rm   rî  ro   r‘   r˜   r£   rª   r¬   rR   r+   r)   Ú<module>r     sÑ   ðñRó Û Û 	Û Û Ý *ß &Ñ &Ý %ß DÝ -÷ ^÷  ^÷  ^ñ  ^÷ k÷  kñ  kÝ 'Ý 2Ý ,Ý ,Ý 2Ý 8à	×	Ò	Ð+Ó	,€ðOð õ
Nõ
)õ>÷
"õJôJ˜oô Jõ!õ*õõ
.÷i@ó i@r+   