+ lHjVa0t$^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI H t H t ^RI H t HtHtHtHtHt^RIHt^RIHtHtHt^RIHt^RIHtHtHtHt^R I H!t!H"t"^R I#H$t$H%t%^R I&H't']PP!])4t*R t+R t,Rt-RRlt.RRlt/RRlt0RRlt1!RR4t2RRlt3RRlt4RRlt5] !RR 44t6!R!R"4t7R#R$lt8/t9R%]:R&&R'R(lt;/tR1R2lt?R3R4lt@R5R6ltAR7R8ltBR9R:ltCRnR;R<lltDRoR=R>lltER?R@ltFRARBltGRCRDltHRERFltIRGRHltJRIRJltKRKRLltLRMRNltMRORPltNRQRRltORSRTltPRURVltQRWRXltRRYRZltSR[]GR\]HR]]S/tTR[]SR\]JR]]N/tUR[]GR\]JR]]N/tVR[]PR\]QR]]R/tWR[]GR\]OR]]N/tXR^R_ltYR`RaltZRbt[RcRdlt\ReRflt]RgRhlt^RiRRjR/RkRlllt_R#)p) annotationsN) dataclassfield)AnyCallableDictListOptionalTuple)hermes_home_key)Actor SettleReason TargetState)operation_session_key)ConnectionOperationDetachedOperationIllegalTransitionTarget)Kind run_operation) hosted_namesmisrouted_to_mcp_error) tool_error>@uSettled once; do not re-ask on your own for any target the user skipped or that timed out, but a later request from the USER for that same app is not a re-ask — run it. Connected targets' tools are available now through tool_describe/tool_call and are named under tools_listing. A target with discovery_error is authorized but its tools are unavailable; retry discovery with manage_connections using that target's authorize or install action without asking for consent again.uQNo connection card is drawn for this turn. Show any connect_url to the user so they open it in a browser, then ask them to say when they are done. Connected targets' tools are available now through tool_describe/tool_call and are named under tools_listing. A target with discovery_error is authorized but its tools are unavailable; retry discovery with manage_connections using that target's authorize or install action without asking for consent again. Do not re-ask on your own for skipped or timed-out targets, but a later request from the USER for that same app is not a re-ask — run it.cV^8dQhRR/#return list[str])formats"9/home/ubuntu/.hermes/hermes-agent/tools/connectors/mcp.py __annotate__r#.s22 2c<^RIHp\RV!444#)r list_catalogc38"TFqPxK R#5iN)name).0es& r" !_catalog_names..1s1.Q&&.s)hermes_cli.mcp_catalogr'sortedr&s r"_catalog_namesr1.s3 1,.1 11r$cV^8dQhRR/#rr )r!s"r"r#r#4s''9'r$c.^RIHp\V!44#)rinstalled_servers)r/r5r0r4s r"_configured_namesr64s8 #% &&r$c$V^8dQhRRRRRR/#)ractionstrnamesrr Optional[str]r )r!s"r"r#r#:s!s9r$c a\4p\4pSR8Xd \T4M \T4pTUu.uF qfT9gK TNK ppT'gR#TUu.uFqfT9gK Yc9gKTNK ppT'dY\ 4;'g \4p TUu.uF qfT 9gK TNK p pT 'dRP T3RlT 44#SR8Xd\RRP T4 RRP T4;'gR R 2T'dR RP T4 R 2,#R ,#R S R RP T4 RS RRP T4;'gR R 2 T'dRRP T4 R 2,#R ,# \dpRT 2uRp?#Rp?ii;iuupiuupiuupi)z could not read the MCP catalog: Ninstall c3<<"TFp\SV4xK R#5ir))r)r+r*r8s& r"r-%validate_mcp_names..IsWYT264@@Ysz#unknown MCP server(s) for install: , z*. Install works for catalog entries only: z(empty catalog).z, Already configured (use enable/authorize): zunknown MCP server(s) for z: z. z+ works for servers already in mcp_servers: z(none configured)z" Catalog entries you can install: )r1r6 Exceptionsetrjoin) r8r:catalog configuredexcallowednunknownforeignhosted misrouteds f& r"validate_mcp_namesrP:s8 "&( % 1c'ls:G4%QG#3qq%G4 !N'Qg%5q!:Mqq'GN((35 '71;QQ 7 88WYWW W 1$))G2D1EF%%)YYw%7%L%L;L$MQ PZd=dii >S=TTUV n km n %VHBtyy/A.B"VHM##'99Z#8#O#O>r$c V^8dQhRRRR/#)rr*r9rboolr )r!s"r"r#r`xs::::r$c |\V4PpVPR8H;'dVP'*#)zA catalog entry whose own OAuth the card must run. Provider-mediated OAuth is not one: its token comes from ``hermes auth ``, so the plain probe covers it.oauth)r[rhtypeprovider)rjr*rhs&& r"installs_with_oauth#_CatalogBackend.installs_with_oauthxs2d#((yyG#99DMM(99r$c$V^8dQhRRRRRR/#)rr*r9ridict[str, str]rrr )r!s"r"r#r`~s!.Sr$c aaa a ^RIHpHpHo ^RIHpV!S4'*o RVV VV 3Rllp\ S4p\SVS4VPSV!V4SVR7# \dpS 'd S !RSRTR7hR p?ii;i) zInstall an OAuth entry through the card's flow. The configuration is built in memory and lands, together with the setup values, only when ``initialize`` accepts the token.)card_install_config is_installedrecord_mcp_installrpcV^8dQhRR/#rrNoner )r!s"r"r#9_CatalogBackend.start_install_oauth..__annotate__s ? ? ?r$cF<\S4S'd S!RSR4R#R#)rGsuccessN) _save_env)rifreshr*rsr"commit3_CatalogBackend.start_install_oauth..commits cN"9dI>r$)cfgri on_commitrGfailed)errorN) r/rrrrsrqr[_check_declaredrtrD) rjr*rirrrqrrYrIrrs &ff @@r"start_install_oauth#_CatalogBackend.start_install_oauth~s a`. && ? ? "4(E D% -??4-@-GS\b?c c "9dHCH   s2A"" B-BBc$V^8dQhRRRRRR/#rr*r9rirrrr )r!s"r"r#r`s!,,C,n,,r$c ^RIHpV!V4;_uu_4VPW4uuRRR4# +'giR#;i)zProbe the entry's in-memory configuration with ephemeral credentials; save both only after the server answered. A failure writes nothing, so a failed reinstall keeps the previous configuration. A first install is recorded once as an extension install.)recorded_catalog_installN)r/r_install)rjr*rirs&&& r"r=_CatalogBackend.installs. D %d + +==+, + + +s 3 A c$V^8dQhRRRRRR/#rr )r!s"r"r#r`s!S~)r$c >^RIHpHpHpHp^RIHpHp^RIH p H p \V4p \WV4V!V 4p V PP;'g.U u0uF"qP'gKV P kK$ pp VP#4F!wppW9gKV'gKV!WV4p K# T!/\%V!4;'g/4CVCV!4R7pV !W4;'g.Uu.uFp\'V^,4NK ppV!V4V !W4'g\)RV R24pRVnVh\-VP#4UUu/uFwppVV9gKVVbK upp4V#uup iuupi T!T4i;iuuppi)r)current_secret_scopecurrent_secret_scope_homereset_secret_scopeset_secret_scope)_inline_non_secret_valuer)_probe_single_server_save_mcp_server) profile_homerUz5' was rejected: suspicious command/args configurationconfig_rejected)agent.secret_scoperrrrr/rrhermes_cli.mcp_configrrr[rrhrirer*itemsdictr9 RuntimeErrorrXr)rjr*rirrrrrrrrrYrrk secret_nameskeyvaluetokentooltoolsrejectedkvs&&& r"r_CatalogBackend._installsw c cXPt$S)!%(05zz~~/C/C/CT/Cd  /C T))+JC&55.s?& ! 9t(*00b1 9S 9246 &/CD/N/T/TRT/TV/TdSa\/TEV u %**#av-b$cdH%6H "NCIIKEKDAq1 3D41a4KEF %UW u % Fs<F6F)F 8F =FF F 1F F Fc V^8dQhRRRR/#)rr*r9rrr )r!s"r"r#r`s   3  4  r$c f^RIHpHp^RIHpV!R4;_uu_4V!4pVP R4p\ V\4'd&\ VP V4\4'g\RV R24hRWa,R&V!V4RRR4R# +'giR#;i) zFlip ``enabled`` under the scope and lock the dashboard's toggle route uses (``PUT /api/mcp/servers/{name}/enabled``): the two read-modify-write paths run in one process, so an unserialised write here drops whichever landed first.) load_config save_config)config_write_scopeN mcp_serversrUz ' is not a configured MCP serverTenabled) rgrrhermes_cli.web_routers._commonrget isinstancerrW)rjr*rrrconfigserverss&& r"enable_CatalogBackend.enables ?E  % % ]Fjj/Ggt,,Jw{{4?PRV4W4W 1TF*J!KLL'+GM) $   & % % %s A6B B0 r N) __name__ __module__ __qualname____firstlineno____doc__rlrur}rr=rr__static_attributes__r r$r"r]r]gs.]c? : 0,>   r$r]c(V^8dQhRRRRRRRR/#) rr*r9rYrrirrrr )r!s"r"r#r#s( - -# -c - -4 -r$c^RIHpVPP;'g.Uu0uFqDPkK ppVF+pWe9d\ RV RV 24pRVnVhV!V4K- R#uupi)zConfiguring one MCP is not a general env-writing primitive: refuse the whole map before the first write if any key is undeclared or unwritable.)validate_env_var_name_for_writerUz,' does not declare the environment variable rVN)rgrrhrir*rWrX)r*rYrirrkdeclaredr undeclareds&&& r"rrsxB',zz~~';';';=';d ';H=  #av-YZ]Y^$_`J'7J $ ', >sA2c V^8dQhRRRR/#)rrirrrr )r!s"r"r#r#s''>'d'r$ch^RIHpVP4Fwr#V'gKV!W#4K R#)r)save_env_valueN)rgrr)rirrrs& r"rrs$0iik  5 3 &"r$cV^8dQhRR/#)rrrr )r!s"r"r#r#s#r$c\4#r))r]r r$r"_default_backendrs  r$c]tRt^t$RtRtR]R&]!]PR7t R]R&]!] R7t R]R &R t R ]R &R tR#)_WorkzWOne target's work in flight: an OAuth attempt the watcher polls, or a worker's outcome.Nrattempt)default_factoryzthreading.EventdonerrrCr9rr )rrrrrr__annotations__r threadingEventrlistrrrr r$r"rrs:aGS!)//BD/BT2E92E3Or$rcr]tRt^tRtRRltRRRlltRRltR R ltR R lt R Rlt RRlt Rt R#)_Runnerz6The backend plus the work for one operation's targets.c V^8dQhRRRR/#)rr8r9backendrr )r!s"r"r#_Runner.__annotate__s : :s :S :r$c HWnW nRVn/Vn/VnR#r))r8rop_idwork approved_env)rjr8rs&&&r"__init___Runner.__init__s$  $( &( 8:r$Nc ,V^8dQhRRRRRRRRR R /#) rtablezdict[str, Callable] operationrtargetrrizOptional[dict[str, str]]rrr )r!s"r"r#rs4??,?9L?V\?)?59?r$c LWP,!YY4;'g/4R#r))r8)rjrrrris&&&&&r"run _Runner.runs kk4FII2>r$c(V^8dQhRRRRRRRR/#) rrrrrcallzCallable[[], Any]rrr )r!s"r"r#r s1JJ2JFJJ[J`dJr$c  aaaaaSP'd.\PRSPSP4R#\ 4oSSP SP&RVVVVV3Rllp\P!\P!4PV3RRSP RSP 2R7P4R#) zRRun one blocking backend call on a worker thread; ``observe`` reports its outcome.z3mcp %s %s: not started, the operation settled firstNcV^8dQhRR/#rr )r!s"r"r##_Runner.spawn..__annotate__s ! !d !r$c<.pRpS!4;'g.Uu.uFp\V4NK ppSP'd.\P RSP SP4R#WuSnSn SPP4SPP4R#uupi \dp\TSS4pRp?LRp?ii;i)rCNz7mcp %s %s: outcome dropped, the operation settled first) r9rD_detailsettledloggerdebugr8r*rrrrEwake) rrr*rIrrrjrrs r"body_Runner.spawn..bodys!EE 304 " > tT >    V![[&++7%* "DJ IIMMO NN   ? 3T62 3s, B8B8B3B83B88 C CCTmcp--rargsdaemonr*) rrrr8r*rrrThread contextvars copy_contextrrt)rjrrrrrsffff @r"spawn _Runner.spawn s     LLNPTP[P[]c]h]h i w!% &++ ! !$  8 8 : > >dWUY $T[[M6;;-@ BBG%'r$c V^8dQhRRRR/#rrrrrr )r!s"r"r#r&s22!422r$c (V\VP&VPVnWnVPR8Xd.\ VP 4^8dVP V4R#VP FpVP\W4K R#) authorizeN) _RUNNERSrrr8lentargets_prepare_togetherr_PREPARErjrrs&& r"prepare_Runner.prepare&sm$(!__ " ;;+ %#i.?.?*@1*D  " "9 - ''F HHXy 1(r$c V^8dQhRRRR/#rr )r!s"r"r#r0s::+>:4:r$c  VPUu.uFXp\P!\P!4P VP \ W3RRVP 2R7NKZ ppVFpVP4K \P!4\,pVF8pVP\RV\P!4, 44K: R#uupi)aStart every OAuth flow at once and wait for the URLs once. Each flow blocks until its provider publishes an authorization URL, so a sequential prepare would keep the card empty for one wait per target. The wait bounds how long prepare blocks, not how long a provider may take: a row still pending afterwards is left to its own thread, which is the only writer of that row and ends with the URL or the flow's own failure. Failing it here as well would make two writers of one row, and a URL that arrives a moment later would have no row to land on. Each thread runs in its own copy of the calling thread's context: a named-profile turn binds its home through a contextvar, and the flow resolves ``mcp_servers`` and stores the token by that home.Tz mcp-prepare-rgN) r rrrrrrr*rttimePREPARE_WAIT_SECONDSrFmax)rjrrthreadsthreaddeadlines&& r"r_Runner._prepare_together0sV_UfUfhUf6##;+C+C+E+I+I*.((Hi)PY]+7 })EGUf hF LLN99;!55F KKCDIIK!78 9 hsAC(c V^8dQhRRRR/#rr )r!s"r"r#rFs;;!4;;r$c VPFdpVP'g0VP\P\P 39dKF\ VP,!WV4Kf R#r))r rstaterpending initiated_OBSERVEr8rs&& r"observe_Runner.observeFsP''F   FLL9L9LkNcNc8d$d T[[ !$6 : (r$cV^8dQhRR/#rr )r!s"r"r#rMstr$c VPe!\PVPR4\VRR4p\ VP P 44Fwr#VPeVfKVP\P8Xd%^RI H pV!VPP4K\VP\P\!V4/4V&K VP P#4R#)aThe operation is over. An attempt still waiting on the browser is stopped when the user ended the turn, and otherwise left to finish: the card closed, not the authorization. What it commits is picked up before the session's next turn (``adopt_late_connections``).Nrcancel_attempt)rr popgetattrrrrr settled_byr interrupttools.connectors.mcp_oauthr'flow_LATE_ATTEMPTS setdefault _late_keyclear)rjrr*rr's& r"close _Runner.closeMs :: ! LLT *D+t4 tyy01JD||#y'8##|'='==Et||001LPLL)))I*>CDI2 r$)r8rrrrrr)) rrrrrrrrrrr"r2rr r$r"rrs.@ :?J:2:,;r$rc V^8dQhRRRR/#)rrrrztuple[str, str]r )r!s"r"r#r#`sOO,OOr$cVVP;'g \4VP3#)uThe ``(profile, session)`` pairing ``live.open`` keys an operation by. ``profile_key`` is stamped there; the detached no-card path never opens, so fall back to the calling thread's home — ``close`` runs on the tool thread under the turn's profile scope.) profile_keyr session_key)rs&r"r0r0`s&  ! ! 6 6_%6 8M8M NNr$z%dict[tuple[str, str], dict[str, Any]]r.c V^8dQhRRRR/#)ragentrrrr )r!s"r"r#r#ns  # ) r$c*a \\VRR44p\4V3p\P V4pV'g.#.p\ VP 44FwrVVP4pVR,R8XdK%VPVR4VR,R8wgVP R4'dK^^RI H p^RI H p V!4P V4p \V \4'dV !WZ/4VPV4KK V'g\PVR4\VR R4o V'd!S eR S 9d.S OV 3RlV4OVnV# \ d\"P%R TR R 7EK3i;i)zRegister the servers whose authorization committed after their card had closed, and add them to the agent's toolset selection. Runs between turns, so the result that said "not connected" is followed by a turn in which the tools are there. session_idNstatusrapproveddiscovery_error_load_mcp_configregister_mcp_serversz&late MCP connection %s was not adoptedT)exc_infoenabled_toolsetsno_mcpc38<"TFqS9gK VxK R#5ir)r )r+rKrs& r"r-)adopt_late_connections..s-UAWDTaas )rr)r r.rrrpollr(tools.mcp_tool_configr@tools.mcp_tool_discoveryrBrrappendrDrrrD) r9r7rattemptsadoptedr*rsnapshotr@rBrrs & @r"adopt_late_connectionsrOnsc(|T(JKK  k *C!!#&H  Ghnn./ <<> H  *  T4 H  +x|| E%'++D1F&$''$d^4t$(0" 3%e/6G7&87+B!V7!V-U-U!V N X LLA4RVL W W Xs=AE**#FFzdict[str, _Runner]r c$V^8dQhRRRRRR/#)rr8r9rrrrr )r!s"r"r#r#s!:::c:W:r$c<\Y;'g \44#)uThe runner for one MCP operation. ``prepare`` binds it to the operation, so the card's answer and its Try again — both of which arrive on another thread — find the same work.)rr)r8rs&&r" open_runnerrRs 688&6&8 99r$CancelledErrorzKtool discovery was interrupted; run the same action again to list the tools TimeoutErrorz!the server did not answer in timec(V^8dQhRRRRRRRR/#) rrIrrunnerrrrrr9r )r!s"r"r#r#s( > > >g >v ># >r$c^RIHp\V4;'gW\V\4'd?\ P VPPVPP4MRp\ P WD4pVPP VP/4P4FpV'gK VPVR4pK! V!VRR7;'gR#)zThe user-facing text of a failure. Every value the card submitted for this target is replaced by exact match before the pattern redactor runs: an opaque credential has no recognizable shape, so only the runner knows what to remove.)redact_sensitive_textrz [REDACTED]T)force) agent.redactrXr9r BaseException _BARE_ERRORSr __class__rrr*valuesreplace)rIrVrrXtextrs&&& r"rrs3 s8 H H%c=99%(()?)?AWAWX?F   D 'D$$((b9@@B 5<<|4DC !T 2 = =g=r$c V^8dQhRRRR/#)rr*r9rr )r!s"r"r#r#sFFFFr$ch^RIHpV!V4pVe \VP;'gR4#R#)z]The manifest's ``post_install`` text for a catalog name; a custom configured server has none.rSrC)r/rTr9 post_install)r*rTrYs& r"_catalog_instructionsrds10 dOE,1,=3u!!''R (E2Er$c 0V^8dQhRRRRRRRRR R R R /#) rrrrrtoractorr fieldsrrrxr )r!s"r"r#r#s:  ( & k RW cf ko r$c VP!VPW#3/VBR# \dCTP'gh\P RTPTP 4R#i;i)aFMove one target from the prepare, worker-outcome or observe path. Continue on the RPC thread can settle the operation between any read of the target's state and this call. A settled operation has a frozen result, so the lost move is dropped rather than raised into the tool result; anything else is a real contract violation.Tz6mcp target %s: %s dropped, the operation settled firstF) transitionr*rrrrr)rrrfrgrhs&&&&,r"_moverks` V[[">v>     Mv{{\^\d\de s"A/,A/.A/c(V^8dQhRRRRRRRR/#) rrrrrdetailr9rrr )r!s"r"r#r#s/ W W( W& W# W$ Wr$cnVP'd#\PRVP4R#VP\ P 8Xd0VPVPRV\PR7R#RVn \W\ P \PVR7R#)znReport a failure, whatever the row was doing: a repeated failure has no state change to emit, only newer text.z;mcp target %s: failure dropped, the operation settled firstN) connect_urlrmrgrm) rrrr*rrrrefreshr backend_watcherrork)rrrms&&&r"_failrss RTZT_T_` ||{)))&++4eNcNcdF )[//1F1FvVr$c(V^8dQhRRRRRRRR/#) rrVrrrr*r9rztuple[list[str], str]r )r!s"r"r#r#s) 0 0 0 0s 0G\ 0r$c ^RIHp^RIHpV!4P V4p\ V\ 4'g\RV R24hV!W%/4\V4R3# \dp.\Y`T43uRp?#Rp?ii;i)zYRegister one committed server in the current profile scope and report its callable names.r?rAz$no committed MCP configuration for 'rUrCN) rIr@rJrBrrrr_registered_tool_namesrDr)rVrr*r@rBrrIs&&& r"_register_connectedrws~ 0:A!#''-&$''!EdV1MN Nd^,%d+R// 073///0sAA B* A=7B=Bc$V^8dQhRRRRRR/#)rr*r9 wait_secondsfloatrrr )r!s"r"r#r#s!EYr$c$^RIHp^RIHp^RIHp^RIHpV!V4p\P!4V,pRpVPRV 24p V 'g\P!4V8dV #WbP9dsVPPV4p V RJ;'d$\V R R4RJ;'d \V R 4p V 'dV #V'gV eV!V4'gV #Rp\P!R 4K) a'The server's callable names, read from the registry once its registration has finished. Registration is a no-op for a server the process already holds, and that includes one another task is still connecting: saving the configuration wakes the config watcher, which starts its own connect, so a large server (hundreds of tools) was reported with no tools three seconds before they were registered. A server that failed discovery earlier is parked with no tools and is woken once. A server that finished registering with no tools is a valid empty list.)mcp_tool)reconnect_mcp_server)_resolve_server_key)registryFTrNsessionrvg?)rr|tools.mcp_tool_loopr}tools.mcp_tool_scoper~tools.registryrrget_tool_names_for_toolset_server_connecting_serversrr)hasattrsleep) r*ry_corer}r~rrrwokenr:serverfinisheds && r"rvrvs(88' d #Cyy{\)H E 33d4&MB DIIK8+L .. .^^'',FT)>>gfi.NVZ.Z>>F$<=  .B4.H.H E 4r$c ,V^8dQhRRRRRRRRR R /#) rrrrrrrr>r9rrr )r!s"r"r#r#s9TT+TVTIT`cTmqTr$czRV/pV'dW4R&\W\P\P3/VBR#)rr>N)rkr connectedr rr)rrrr>extras&&&& r"_connectrs5$e,E#2  )[22E4I4ISUSr$c V^8dQhRRRR/#)rrrrr r )r!s"r"r#r# sWW6WeWr$cVP\P8Xd\P#\P #)z?Try again is the user's move; a first attempt is the backend's.)rrrr userrr)rs&r"_actorr s(););;5::VAVAVVr$c ,V^8dQhRRRRRRRRR R /# rrVrrrrrrirrrr )r!s"r"r#r#s2 1 1 1-@ 1& 1We 1jn 1r$c \V4p\VP4VnVPP VP4p\TR7TPTP&\Y\PYEP\TRR4R7R# \ d"p\Y\Y`T44Rp?R#Rp?ii;i)NrrmrCrorm)rrdr* instructionsrrurDrsrrrrkrr auth_urlr))rVrrrirgrrIs&&&& r" _start_oauthrs 6NE/ s%B## C.C  Cc ,V^8dQhRRRRRRRRR R /#rr )r!s"r"r#r#s2###-@#&#We#jn#r$c \VP4VnVPP VP4pYBnR# \ d"p\ Y\YPT44Rp?R#Rp?ii;i)zTThe install row waits pending; the card draws a field per credential it still needs.N)rdr*rrrlrDrsr)rVrrrirdrIs&&&& r" _declare_envrs^/ >..v{{;#  if!=>s%A A5A00A5c(V^8dQhRRRRRRRR/#) rrVrrrrirrr_r )r!s"r"r#r#)s/XXgXvXNXOcXr$c $VPPVP4pVUu.uFZpVPRR4'gKTP\ VPR4;'gR44'dKXVNK\ up#uupi)zThe declared credentials that still have no value. The install runs on a worker thread, where ``install_entry``'s prompt for a missing credential would block on stdin forever.rdTr*rC)rrlr*rr9)rVrrirrks&&& r"_missing_requiredr)s{~~**6;;7H% XXTxx D) 25''#dhhv>N>T>TRT:U2V DX XX XsB  'B 1B B c ,V^8dQhRRRRRRRRR R /#rr )r!s"r"r#r#1s9[[7[/B[F[Yg[lp[r$c aaa/SPPSP/4CVCo\SSS4pT'dZTSnTPSPSP\PRRPRT44 2R7R#SSPSP&\S4p.Sn\TS\P TRR7'gR#\#SS4'd\%STSS4R#SP'TSTTT3Rl4R# \d$p\ TS\ TSS44Rp?R#Rp?ii;i)Nz waiting for rAc3F"TFp\VR,4xK R#5i)r*N)r9)r+rks& r"r-!_start_install..=s9`X_PT#d6l:K:KX_s!rorgrmrCrpcP<SPPSPS4#r))rr=r*)r=rVrsr" _start_install..GsFNN,B,B6;;PX,Yr$)rrr*rrDrsrrlrqror rrrFrrkrr _installs_with_oauth_start_install_oauthr)rVrrrirZrIrgr=sf&f& @r"_start_installr1s-B&%%))&++r:BcBH#FFH=&&++63E3EUMbMb#/ 9`X_9`0`/a!b  d'/F $ 6NEF FK$9$95 L LFF++VYA LLF$YZ%  iff!=>s D++ E6EEc$V^8dQhRRRRRR/#)rrVrrrrrxr )r!s"r"r#r#Js!&Tr$c\VPPVP44# \dR#i;i)F)rxrr}r*rD)rVrs&&r"rrJs7FNN66v{{CDD s -0 ??c ,V^8dQhRRRRRRRRR R /#rr )r!s"r"r#r#Qs3 = = =5H =RX =, =15 =r$c VPPVPV4p\ TR7TP TP&TP'dR#TPTPTP\P\TRR4R7R# \dp\ YY%4Rp?R#Rp?ii;i)zThe row is already ``initiated``; publish the authorization link onto it. The same ``initiated`` + ``connect_url`` pair is what every card reads as its URL step.NrrmrCr) rrr*rD _fail_installrrrrqrr rrr))rVrrrirrIs&&&& r"rrQs..44V[[#F %W5FKK  fkkw/?/?uG\G\$Wh;= f5s&B## C. CCc ,V^8dQhRRRRRRRRR R /#) rrVrrrrrrrrrr )r!s"r"r#r#as2=='=.A=6=Z]=bf=r$c \P!\4;_uu_4VPP VP 4VnRRR4\ W\W0V44R# +'giL(;i)zA failed install asks for its fields again, so the card can reopen the form over the draft it kept. Nothing was saved, so every declared field is still missing.N) contextlibsuppressrDrrlr*rsr)rVrrrs&&&&r"rrasO   Y ' '$nn99&++F ( )WUF;< ( 's +A.. A> c ,V^8dQhRRRRRRRRR R /#rr )r!s"r"r#r#is2 8 8w 8+> 8 8Uc 8hl 8r$c X\V4p\W\PVRR7'gR#VPP VP 4\YTP 4wrg\YYg4R# \d"p\Y\YPT44Rp?R#Rp?ii;i)rCrpN) rrkrr rrr*rDrsrrwr)rVrrrirgrIrr>s&&&& r" _do_enableris 6NE K$9$95 L Lfkk*1ME Y7  if!=>s%A== B)B$$B)c ,V^8dQhRRRRRRRRR R /#rr )r!s"r"r#r#vs2 8 8 8-@ 8& 8We 8jn 8r$c BVPPVP4Uu.uF%qDPRR4'gKVR,NK' ppT'd0^RIHp\ YRRPT4 RT!4 R 24R#\T4p\Y4'dTPPTP/4p \T R 7TPTP&\Y\ P"YP$\'T R R 4R 7R#\Y\ P"T4TPP)TP/4\+YTP4wr\-YY4R#uupi \d"p\ Y\ Y`T44Rp?R#Rp?ii;i \d"p\ Y\ Y`T44Rp?R#Rp?ii;i \d"p\ Y\ Y`T44Rp?R#Rp?ii;i)zPOff the desktop nobody can fill a credential in, so a missing one is the answer.rdTr*N)display_hermes_homezset rAz in the environment or z/.env, then install againrrmrCr)rrlr*rrDrsrhermes_constantsrrFrrrrrrkrr rr)r=rwr) rVrrrirkrZrIrrgrrr>s &&&& r" _install_nowrvs,2NN,G,G ,Ts,TDX`X`akmqXr<4<<,Ts8 i4 '(:';;R$7$9#::S"U V 6NEF++ nn88bIG$)#9 FKK  i!6!6K[K[Wh3 5 )[22E:v{{B/1ME Y7;t  if!=>  )WS&%A B    if!=>s^'FF FF*&G&G2F GF;;G G/G**G/2 H=HHc(V^8dQhRRRRRRRR/# rrVrrrrrrrr )r!s"r"r#r#s*==7=/B=F=W[=r$c VPPVP4pVeVPfR#VPP 4pVPR4pVR9dR#VPP VPR4VR8XdcVPR4;'gRpV'd\ W.\W`V44R#\WVP4wrx\ WWx4R#VPR4;'gRp VPR8Xd\WW)4R#\W\WV44R#) Nr<r=rr>rCzthe authorization flow failedr=)r=r) rrr*rrHr(rrrwr8rrs) rVrrrrNr<r>rregistration_errorrs &&& r"_observe_oauthrs ;;??6;; 'D |t||+||  "H \\( #F ** KKOOFKK& ",,'89??R  YGOV,T U )s&&& r"rrs ;;??6;; 'D |499++-- KKOOFKK& zzz ==I % &VZZ @  iV!DE0ME Y7r$c ,V^8dQhRRRRRRRRR R /#rr )r!s"r"r#r#s9^^W^)<^f^Sa^fj^r$cR#)zSAuthorize needs no approval: the row's verb opens the link the flow already minted.Nr )rVrrris&&&&r"_nothingrsr$r r=rc V^8dQhRRRR/#)rrYzdict[str, Any]rrr )r!s"r"r#r#sUU~U.Ur$cVPR4p\V\4'd8VP4UUu/uFwr#\ V4\ V4bK upp#/#uuppi)ri)rrrrr9)rYrawrrs& r" _answer_envrsN ))E C7A#t7L7Lsyy{ 3{tqCFCFN{ 3TRTT 3s A!c$V^8dQhRRRRRR/#)rrrrr9rrr )r!s"r"r#r#s"$1$1/$1c$1d$1r$c \P!V4p\ V\ 4'g/p\ PVP4pVPR4;'gR EFp\ V\ 4'gKTP\VPR4;'gR4P4P44pVfKq\VPR4;'gR4P4pVR8XdV\W54pVP!VP\ P"\$P&3/V'dRV/M/BKVR8XgEK VfEKVP.\ P08Xd$VP3\4W\7V44EKRVP.\ P8\ P:39gEKVP3\<W\7V44EK VPR 4\>P@PB8Xd6VPD'g"VPG\>P@4R#R#R# \\3d/pELvi;i \(d/TP*'gTP,'ghEK\EK`i;i) zFold the card's ``connection.respond`` payload into the operation: a skip, an approval that starts the backend's work, and Continue. The card never reports an outcome, so any other claim moves nothing.r r*rCNr<skippedrmr=r*r )$jsonloads TypeErrorrWrrr rrrr9striplower_cancel_attemptrjr*rrr rrresolvedrrrr_APPROVErrexpired_RETRYr continue_r all_resolvedsettle)rranswerrVrYrr<kepts&& r" apply_answerrsC fd # # \\)// *FI&,,",%&& !!#eii&7&=&=2">"D"D"F"L"L"NO > UYYx(..B/557 Y #62D $$V[[+2E2EuzzK<@4(8bK z !f&8||{222 8Y E8JK+"4"4k6I6I!JJ 69k%6HI/-0zz,<#9#9#?#?? H^H^H^//0I_?; z "(% y/@/@/@0A s0I8 AJ8JJK /K K  K z{the authorization had already completed when this was canceled, so it was kept; run the same action again to list the toolsc$V^8dQhRRRRRR/#)rrVzOptional[_Runner]rrrr9r )r!s"r"r#r#s" > >- >v ># >r$cVe'VPPVPR4MRp\\VRR4RR4pVfR#^RIHpV!V4'd\ #R#)zStop the target's OAuth attempt so a late reply cannot be adopted. Returns the note for a cancel that lost the race: the attempt had committed, and a completed authorization stays.Nrr-rCr&)rr(r*r)r,r'AUTHORIZATION_KEPT)rVrrr-r's&& r"rrs[281C6;;??6;; -D 74D164 @D |9!/!5!5 =2=r$c$V^8dQhRRRRRR/#)rrrr:rrr;r )r!s"r"r#r#s"  (  } r$c\PVP4pVfR#VP'dR#VF0pVP V4pVfKVP \ W4K2 R#)zRe-run the named MCP targets on the open operation (the card's Try again): a fresh OAuth flow, a fresh install, a fresh enable. Returns an error message when the operation is not one this module is running.Nz(this operation has no MCP work to re-runz0this operation has settled; its result is frozen)r rrrrrr)rr:rVr*rs&& r"retryrs`\\)// *F ~9A!!$'   JJvy 1 r$c ,V^8dQhRRRRRRRRRR/#) rrVrr:rr8r9r7rr )r!s"r"r#r#(s133G3I3s3QT3Y\3r$c \VUu.uFp\VRV4NK upVR7pVPFpVP\WV4K VP RR7p\ ;QJd&RVP4F 'gK RM RM!RVP44'dRMRVR&\VR &\P!VRR 7#uupi) mcp)r7T) with_urlsc3Z"TF!qP\P8HxK# R#5ir))rrr )r+ts& r"r-"_no_card_result..-s *gUfPQ77k6K6K+KUfs)+Fr rr<note) ensure_ascii) rrr r_NO_CARDresultany NO_CARD_NOTErdumps)rVr:r8r7rKrrpayloads&&&& r"_no_card_resultr(s!U"KU6!UF#;U"KYdeI## 8Y/$.G'*s*gU^UfUf*gsss*gU^UfUf*g'g'g mvGH"GFO ::gE 22 #LsC tool_call_idrc4V^8dQhRRRRRRRRR RR R R R/#) rr:rr8r9connection_callbackz3Optional[Callable[[dict[str, Any]], Optional[str]]]r;r;rrrrr )r!s"r"r#r#2sO  M      r$c ~\W4pV'd \V4#\W4p\V4pVf \ WpW4#\ VU u.uFp \ V RV4NK up \VPVP\R7WVRR7VP4#uup i TP4i;i)Nr)rr"rF)r7rrwith_urls_in_result) rPrrRrrrrrrr"NOTEr2) r:r8rr;rrrrVr7rKs &&$$$$ r"run_mcp_operationr2s v -E %   )F' 3K"vfBB/4 5u!VAuf %u 5 d K# 3     6  s B*B%%/B*%B**B<r))r)rC)`__conditional_annotations__ __future__rrrrloggingrr dataclassesrrtypingrrrr r r rr tools.connectors.contractr rrtools.connectors.gateway.configrtools.connectors.operationrrrrtools.connectors.runrrtools.connectors.targetsrrrr getLoggerrrrrrr1r6rPr[r]rrrrrr0r.rrOr rRr\rrdrkrsrwrvrrrrrrrrrrrrrrrrrrr!rrrrrrrr)rs@r"rs""  (==,FFAhh4I%   8 $(= 2 ' Dd d N -'  ffRO9;5: H " !:c7 >F  W 0@TW 1#X[2 = = 8 8F=0' 8^ y,( S 9nh S |Y* U 4DhP_ ` y,* UU $1NJ > *3 #' r$