*jVSUdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl ZddlZddlmZmZddlmZmZmZddlmZddlmZddlmZ ddlZn #e$rdZYnwxYwdd lmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)ej*e+Z,ddZ-dZ.dZ/dZ0dZ1dZ2e3ddhZ4dZ5dZ6da7de8d<iZ9de8d<e j:Z;ddZid#d$dd%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEiZ?dFe8dG<dBdHiZ@dIe8dJ<e3hdKZAddMZBddOZCddRZDddTZEddUZFddVZGddYZHddZZIdd\ZJdd]ZKdd`ZLddcZMdddZNddgZOdddhddlZPddnZQddoZRddqZSddtZTddduZUddvZVddwddxZWdydzdd|ZXdydzdd~ZYddydzddZZddZ[dZ\dZ]e j:Z^ddZ_eddZ`ddZaddZbddZcddZdddZedddZfddZgddZhddZiddZjdS)zHermes Web UI -- provider management endpoints. Provides CRUD operations for configuring provider API keys post-onboarding. Closes #586 (allow provider key update) and part of #604 (model picker multi-provider support). ) annotationsN)contextmanager nullcontext)datetime timedeltatimezone)Path)SimpleNamespace)Any) _PROVIDER_DISPLAY_PROVIDER_MODELS_custom_provider_slug_from_name_get_label_for_model_models_from_live_provider_ids_read_live_provider_model_ids#_read_visible_codex_cache_model_ids_save_yaml_config_file get_configinvalidate_models_cache reload_config provider_idstrnameobjectreturnboolcDt|pd}t|pd}|r|sdSt|}|d|h}|r||||vS)zAReturn True when *provider_id* refers to a named custom provider.Fcustom:)rstriplowerradd)rrpidraw_nameslug candidatess 0/Users/bertmahoney/hermes-webui/api/providers.py_custom_provider_name_matchesr(2s kR & & ( ( . . 0 0C4:2$$&&,,..H hu *8 4 4D0h001J t * z https://openrouter.ai/api/v1/keyg@gA@gF@@ openai-codex anthropiczimport sys try: import ctypes, signal libc = ctypes.CDLL(None) libc.prctl(1, signal.SIGTERM) # PR_SET_DEATHSIG=1, SIGTERM=15 except Exception: pass z!threading.BoundedSemaphore | None_account_usage_probe_semaphorez-dict[tuple[str, str, str], tuple[float, Any]]_account_usage_status_cachethreading.BoundedSemaphorecPttjtatSN)r. threadingBoundedSemaphore$_MAX_CONCURRENT_ACCOUNT_USAGE_PROBESr)r'"_get_account_usage_probe_semaphorer7{s&%-)2)C 0* * & *)r)Nonec ddl}|d}|dtjdS#t $rYdSwxYw)Nr)ctypesCDLLprctlsignalSIGTERM Exception)r;libcs r'_account_usage_preexec_fnrBs_  {{4   1fn%%%%%      s9= A  A a@ import base64 import json import sys from concurrent.futures import ThreadPoolExecutor from datetime import datetime, timedelta, timezone from types import SimpleNamespace from urllib import request as urllib_request from agent.account_usage import fetch_account_usage _CODEX_DEFAULT_BASE_URL = "https://chatgpt.com/backend-api/codex" _CODEX_POOL_USAGE_TIMEOUT_SECONDS = 4.0 _CODEX_POOL_MAX_WORKERS = 6 def _iso(value): if value in (None, ""): return None if hasattr(value, "isoformat"): text = value.isoformat() return text.replace("+00:00", "Z") text = str(value).strip() return text or None def _snapshot_payload(snapshot): if snapshot is None: return None windows = [] for window in getattr(snapshot, "windows", ()) or (): windows.append({ "label": str(getattr(window, "label", "") or ""), "used_percent": getattr(window, "used_percent", None), "reset_at": _iso(getattr(window, "reset_at", None)), "detail": getattr(window, "detail", None), }) payload = { "provider": str(getattr(snapshot, "provider", "") or ""), "source": str(getattr(snapshot, "source", "") or ""), "title": str(getattr(snapshot, "title", "") or ""), "plan": getattr(snapshot, "plan", None), "windows": windows, "details": list(getattr(snapshot, "details", ()) or ()), "available": bool(getattr(snapshot, "available", bool(windows))), "unavailable_reason": getattr(snapshot, "unavailable_reason", None), "fetched_at": _iso(getattr(snapshot, "fetched_at", None)), } pool = getattr(snapshot, "pool", None) if isinstance(pool, dict): payload["pool"] = pool return payload def _snapshot_available(snapshot): if snapshot is None: return False try: return bool(getattr(snapshot, "available", False)) except Exception: return False def _number(value): if isinstance(value, bool) or value is None: return None if isinstance(value, (int, float)): return value try: text = str(value).strip() if not text: return None number = float(text) return int(number) if number.is_integer() else number except Exception: return None def _parse_dt(value): if value in (None, ""): return None if isinstance(value, (int, float)): try: return datetime.fromtimestamp(float(value), tz=timezone.utc) except Exception: return None text = str(value).strip() if not text: return None if text.endswith("Z"): text = text[:-1] + "+00:00" try: dt = datetime.fromisoformat(text) except ValueError: return None return dt if dt.tzinfo else dt.replace(tzinfo=timezone.utc) def _title_case_slug(value): cleaned = str(value or "").strip() if not cleaned: return None return cleaned.replace("_", " ").replace("-", " ").title() def _resolve_codex_usage_url(base_url): normalized = str(base_url or "").strip().rstrip("/") or _CODEX_DEFAULT_BASE_URL if normalized.endswith("/codex"): normalized = normalized[: -len("/codex")] if "/backend-api" in normalized: return normalized + "/wham/usage" return normalized + "/api/codex/usage" def _jwt_claims(token): if not isinstance(token, str) or token.count(".") != 2: return {} payload = token.split(".")[1] payload += "=" * ((4 - len(payload) % 4) % 4) try: claims = json.loads(base64.urlsafe_b64decode(payload.encode("utf-8")).decode("utf-8")) except Exception: return {} return claims if isinstance(claims, dict) else {} def _codex_usage_headers(access_token): headers = { "Authorization": "Bearer " + access_token, "Accept": "application/json", "User-Agent": "codex_cli_rs/0.0.0 (Hermes WebUI)", "originator": "codex_cli_rs", } auth_claim = _jwt_claims(access_token).get("https://api.openai.com/auth") account_id = None if isinstance(auth_claim, dict): account_id = auth_claim.get("chatgpt_account_id") if isinstance(account_id, str) and account_id.strip(): headers["ChatGPT-Account-ID"] = account_id.strip() return headers def _entry_value(entry, *names): for name in names: try: value = getattr(entry, name) except Exception: value = None if value in (None, ""): continue text = str(value).strip() if text: return text return None def _codex_snapshot_from_usage_payload(payload): if not isinstance(payload, dict): payload = {} rate_limit = payload.get("rate_limit") if not isinstance(rate_limit, dict): rate_limit = {} windows = [] for key, label in (("primary_window", "Session"), ("secondary_window", "Weekly")): window = rate_limit.get(key) if not isinstance(window, dict): continue used = _number(window.get("used_percent")) if used is None: continue windows.append(SimpleNamespace( label=label, used_percent=float(used), reset_at=_parse_dt(window.get("reset_at")), detail=None, )) details = [] credits = payload.get("credits") if isinstance(credits, dict) and credits.get("has_credits"): balance = _number(credits.get("balance")) if balance is not None: details.append("Credits balance: $" + format(float(balance), ".2f")) elif credits.get("unlimited"): details.append("Credits balance: unlimited") return SimpleNamespace( provider="openai-codex", source="usage_api", title="Account limits", plan=_title_case_slug(payload.get("plan_type")), windows=tuple(windows), details=tuple(details), available=bool(windows or details), unavailable_reason=None, fetched_at=datetime.now(timezone.utc), ) def _snapshot_windows_payload(snapshot): windows = [] for window in getattr(snapshot, "windows", ()) or (): label = str(getattr(window, "label", "") or "").strip() if not label: continue used_percent = _number(getattr(window, "used_percent", None)) remaining_percent = None if used_percent is not None: remaining_percent = max(0.0, min(100.0, 100.0 - float(used_percent))) windows.append({ "label": label, "used_percent": used_percent, "remaining_percent": remaining_percent, "reset_at": _iso(getattr(window, "reset_at", None)), "detail": getattr(window, "detail", None), }) return windows def _snapshot_details_payload(snapshot): return [ str(detail).strip() for detail in (getattr(snapshot, "details", ()) or ()) if str(detail).strip() ] def _safe_entry_label(entry, index): label = _entry_value(entry, "label", "source") or "" if not label: label = "Credential " + str(index) label = " ".join(str(label).split()) if len(label) > 64: label = label[:61].rstrip() + "..." return label def _safe_unavailable_reason(reason): text = " ".join(str(reason or "").split()) if not text: return None lowered = text.lower() sensitive_terms = ("access_token", "refresh_token", "authorization", "bearer ", "jwt", "secret") if any(term in lowered for term in sensitive_terms): return "Usage unavailable for this credential." return text[:180] def _entry_exhausted_ttl_seconds(error_code): code = str(error_code or "").strip() if code == "401": return 5 * 60 return 60 * 60 def _entry_pool_exhausted_until(entry): if str(_entry_value(entry, "last_status") or "").strip().lower() != "exhausted": return None reset_at = _parse_dt(getattr(entry, "last_error_reset_at", None)) if reset_at is not None: return reset_at status_at = _parse_dt(getattr(entry, "last_status_at", None)) if status_at is None: return None return status_at + timedelta(seconds=_entry_exhausted_ttl_seconds(_entry_value(entry, "last_error_code"))) def _entry_is_pool_exhausted(entry): exhausted_until = _entry_pool_exhausted_until(entry) return exhausted_until is not None and datetime.now(timezone.utc) < exhausted_until def _entry_pool_exhausted_reason(entry): code = _entry_value(entry, "last_error_code") reset_at = _entry_pool_retry_after(entry) reason = "Credential pool marked this credential exhausted" if code: reason += " after provider status " + code if reset_at: reason += "; retry after " + reset_at return reason + "." def _entry_pool_retry_after(entry): return _iso(_entry_pool_exhausted_until(entry)) def _fetch_codex_entry_snapshot(entry): access_token = _entry_value(entry, "runtime_api_key", "access_token") if not access_token: return None, False, "No runtime token available." base_url = _entry_value(entry, "runtime_base_url", "base_url") or _CODEX_DEFAULT_BASE_URL request = urllib_request.Request( _resolve_codex_usage_url(base_url), headers=_codex_usage_headers(access_token), ) with urllib_request.urlopen(request, timeout=_CODEX_POOL_USAGE_TIMEOUT_SECONDS) as response: payload = json.loads(response.read().decode("utf-8") or "{}") return _codex_snapshot_from_usage_payload(payload), True, None def _best_remaining_by_window(rows): best = {} for row in rows: if row.get("status") != "available": continue label = row.get("label") or "Credential" for window in row.get("windows") or []: if not isinstance(window, dict): continue window_label = str(window.get("label") or "").strip() remaining = _number(window.get("remaining_percent")) if not window_label or remaining is None: continue candidate = { "label": window_label, "remaining_percent": remaining, "used_percent": window.get("used_percent"), "reset_at": window.get("reset_at"), "detail": window.get("detail"), "credential_label": label, } current = best.get(window_label.lower()) # The normalized Codex account-limit payload currently exposes # percentages, not absolute request/token capacity. If absolute # remaining capacity becomes available, prefer it here. if current is None or float(remaining) > float(current.get("remaining_percent") or -1): best[window_label.lower()] = candidate return list(best.values()) def _next_reset_at(rows): best_dt = None best_text = None for row in rows: for window in row.get("windows") or []: if not isinstance(window, dict): continue reset_text = window.get("reset_at") dt = _parse_dt(reset_text) if dt is None: continue if best_dt is None or dt < best_dt: best_dt = dt best_text = _iso(dt) return best_text def _codex_pool_snapshot(entries, rows, queried): available_rows = [row for row in rows if row.get("status") == "available"] exhausted_rows = [row for row in rows if row.get("status") == "exhausted"] failed_rows = [row for row in rows if row.get("status") not in {"available", "exhausted"}] plans = [] for row in rows: plan = row.get("plan") if plan and plan not in plans: plans.append(plan) best_windows = _best_remaining_by_window(rows) pool = { "total_credentials": len(entries), "queried_credentials": queried, "available_credentials": len(available_rows), "exhausted_credentials": len(exhausted_rows), "failed_credentials": len(failed_rows), "plans": plans, "next_reset_at": _next_reset_at(rows), "best_remaining_by_window": best_windows, "credentials": rows, } details = [str(len(available_rows)) + "/" + str(len(entries)) + " credentials available"] if exhausted_rows: details.append(str(len(exhausted_rows)) + " exhausted") if failed_rows: details.append(str(len(failed_rows)) + " failed to load") if plans: details.append("Plans: " + ", ".join(plans)) plan = plans[0] if len(plans) == 1 else None windows = tuple( SimpleNamespace( label=window.get("label"), used_percent=window.get("used_percent"), reset_at=window.get("reset_at"), detail="Best of " + str(len(available_rows)) + " available credentials", ) for window in best_windows ) return SimpleNamespace( provider="openai-codex", source="usage_api_pool", title="Account limits", plan=plan, windows=windows, details=tuple(details), available=bool(available_rows), unavailable_reason=None if available_rows else "No Codex pool credentials returned available account limits.", fetched_at=datetime.now(timezone.utc), pool=pool, ) def _codex_pool_exhausted_row(entry, index): label = _safe_entry_label(entry, index) retry_after = _entry_pool_retry_after(entry) return { "label": label, "status": "exhausted", "plan": None, "windows": [], "details": [], "unavailable_reason": _entry_pool_exhausted_reason(entry), "retry_after": retry_after, "fetched_at": None, } def _probe_codex_pool_entry(item): index, entry = item label = _safe_entry_label(entry, index) did_query_count = 0 try: snapshot, did_query, reason = _fetch_codex_entry_snapshot(entry) if did_query: did_query_count = 1 except Exception as exc: snapshot = None reason = str(exc) windows = _snapshot_windows_payload(snapshot) if snapshot is not None else [] details = _snapshot_details_payload(snapshot) if snapshot is not None else [] snapshot_available = _snapshot_available(snapshot) status = "available" if snapshot_available else "unavailable" row = { "label": label, "status": status, "plan": getattr(snapshot, "plan", None) if snapshot is not None else None, "windows": windows, "details": details, "unavailable_reason": None if snapshot_available else _safe_unavailable_reason(reason or getattr(snapshot, "unavailable_reason", None)), "fetched_at": _iso(getattr(snapshot, "fetched_at", None)) if snapshot is not None else None, } return index, row, did_query_count def _fetch_codex_account_usage_from_pool(): try: from agent.credential_pool import load_pool pool = load_pool("openai-codex") entries = list(pool.entries()) if pool is not None and hasattr(pool, "entries") else [] if not entries: return None rows_by_index = {} probe_items = [] queried = 0 for index, entry in enumerate(entries, start=1): if _entry_is_pool_exhausted(entry): rows_by_index[index] = _codex_pool_exhausted_row(entry, index) else: probe_items.append((index, entry)) if probe_items: max_workers = min(_CODEX_POOL_MAX_WORKERS, len(probe_items)) with ThreadPoolExecutor(max_workers=max_workers) as executor: for index, row, did_query_count in executor.map(_probe_codex_pool_entry, probe_items): rows_by_index[index] = row queried += did_query_count rows = [rows_by_index[index] for index in range(1, len(entries) + 1)] return _codex_pool_snapshot(entries, rows, queried) except Exception: return None provider = sys.argv[1] api_key = sys.argv[2] or None try: snapshot = fetch_account_usage(provider, api_key=api_key) except Exception: snapshot = None if str(provider or "").strip().lower() == "openai-codex": pool_snapshot = _fetch_codex_account_usage_from_pool() if isinstance(getattr(pool_snapshot, "pool", None), dict): snapshot = pool_snapshot print(json.dumps(_snapshot_payload(snapshot))) openrouterOPENROUTER_API_KEYANTHROPIC_API_KEYopenaiOPENAI_API_KEYgoogleGOOGLE_API_KEYgeminiGEMINI_API_KEYzai GLM_API_KEYz kimi-coding KIMI_API_KEYdeepseekDEEPSEEK_API_KEYminimaxMINIMAX_API_KEYz minimax-cnMINIMAX_CN_API_KEY mistralaiMISTRAL_API_KEYzx-ai XAI_API_KEYxiaomiXIAOMI_API_KEYz opencode-zenOPENCODE_ZEN_API_KEYz opencode-goOPENCODE_GO_API_KEYz ollama-cloudOLLAMA_API_KEYlmstudio LM_API_KEYnvidiaNVIDIA_API_KEYdict[str, str]_PROVIDER_ENV_VAR)LMSTUDIO_API_KEYzdict[str, tuple[str, ...]]_PROVIDER_ENV_VAR_ALIASES> qwen-oauth copilot-acpnouscopilot xai-oauthr+r cp ddlm}|S#t$rtjdz cYSwxYw)z(Return the active Hermes home directory.rget_active_hermes_homez.hermes) api.profilesrk ImportErrorr homerjs r'_get_hermes_homerosZ'777777%%''' '''y{{Y&&&&'s  55env_pathci}|s|S |dD]}|}|r|dsd|vr2|dd\}}|dd||<n#t $ricYSwxYw|S)z&Read key=value pairs from a .env file.utf-8encoding#=r:"')exists read_text splitlinesr startswithsplitr@)rpvaluesrawlinekeyvalues r'_load_env_filersF ??   %%w%77BBDD F FC99;;D 4??3// 3d??C++JC"'++--"5"5c":":"@"@"E"EF399;;    F   MsCC C-,C-tokendict[str, Any]ct|tr|ddkriS|ddd}|ddt |dzz dzzz } t jtj| d d}n#t$ricYSwxYwt|tr|niS)a!Decode JWT claims for token-shape classification only. The signature is intentionally not verified because this helper is not an authorization decision: it only prevents a Codex OAuth JWT-shaped value from being treated as a raw OpenAI API key in provider-card detection. .r-r:rvrr) isinstancercountr}lenjsonloadsbase64urlsafe_b64decodeencodedecoder@dict)rpayloadclaimss r'_decode_jwt_claims_unverifiedrs eS ! !U[[%5%5%:%: kk#q!!!$G sq3w<z0_looks_like_codex_oauth_token..s'aasf}aaaaaar))chatgpt_account_idzhttps://api.openai.com/profile)rr r|rgetrrany)rr auth_claimrs @r'_looks_like_codex_oauth_tokenrs     " " $ $E E$$U++u *5 1 1F u9::J*d## t aaaa(`aaa a aar)ct|pd}|sdS|pddkrt|rdSdS)NrFrFT)rr r!r)rrtexts r'!_provider_value_counts_as_api_keyrsm u{   ! ! # #D ur  ""((**h66;XY];^;^6u 4r)c|pddkrdSg}t|}|rt dz }t |}||||tj|t|dpdD]Q}||||tj|Rt}|di}t|trvt|dpd}||kr(||d|d i} t| trS| |i} t| tr(|| d|d g} t| tr| D]} t| trt|| d r| d} t| trZ| d rE| d r0|tj| dd|| t%d|DS)aTrue when the bare OpenAI credential slot contains only a Codex OAuth JWT. Users who authenticate Codex can end up with a ChatGPT/Codex JWT in a legacy OPENAI_API_KEY-shaped location. That value should not make the bare OpenAI API provider appear as configured, and the Providers tab should not show an extra OpenAI card solely because of that Codex-only credential. rrFF.envr6modelproviderapi_key providerscustom_providersr${}r-c3RK|]"}tt|pdV#dS)rN)rr)rrs r'rz;_provider_has_shadowed_codex_oauth_value..)s7SS5,S"-=-=>>SSSSSSr))r r!rarrorappendosgetenvrcrrrrlistr(r|endswithr)rr~env_varrp env_valuesaliascfg model_cfgactive_provider providers_cfg provider_cfgrcpcp_keys r'(_provider_has_shadowed_codex_oauth_valuers r  ""((**h66uF##K00G,#%%.#H--  jnnW--... bi(())).22;CCIr , ,E MM*..// 0 0 0 MM")E** + + + + ,,C$$I)T""4immJ77=2>>DDFFLLNN k ) ) MM)-- 22 3 3 3GGK,,M-&&7$((b99 lD ) ) 7 MM,**955 6 6 6ww1266"D))*" * *B"d## *(EkSUSYSYZ`SaSa(b(b * **fc***v/@/@/F/F*6??[^K_K_*MM")F1R4L"9"9::::MM&))) SSFSSS S SSr)updatesdict[str, str | None]c>ddlm}ddl}|5g}|r< |d}n#t $rg}YnwxYwi}t|D]g\}}|}|rL| ds7d|vr3| ddd} ||| <ht|} g} | D]\} } | 0tj| d| |vr d| || <7t!| }|s[d |vsd |vrt#d |tj| <| |vr| d|| || <| | d|d | D} | rJ| r3| d dkr| d| | |jddd | }|r|d z }|j|jz}ddl}|t!|jdd\}} tj|dd5}|||tj|dddn #1swxYwYtj ||tj!||n5#tD$r( tj#|n#tH$rYnwxYwwxYw | |n#tH$rYnwxYwddddS#1swxYwYdS)u*Write key=value pairs to the .env file. Values of ``None`` cause the key to be removed. Preserves comments, blank lines, and original key order (#1164). New keys are appended at the end of the file with a blank-line separator. Holds ``_ENV_LOCK`` from ``api.streaming`` for the entire load → modify → write cycle to prevent TOCTOU races between concurrent POST /api/providers calls (each reading the same file baseline and overwriting the other's key). Also serialises os.environ mutations with streaming sessions. r) _ENV_LOCKNrrrsrurvr:  ,API key must not contain newline characters.cg|]}||Sr2r6)rls r' z#_write_env_file..esAAAa1====r)rrTparentsexist_okz.env_.tmpdirprefixsuffixw)% api.streamingrstatryrzr{r@ enumerater r|r}ritemsrenvironpopr ValueErrorrextendparentmkdirjoinS_IRUSRS_IWUSRtempfilemkstempfdopenwriteflushfsyncfilenochmodreplace BaseExceptionunlinkOSError)rprr_statexisting_linesexisting_key_indices_i_raw _stripped_existing_key_indices_key output_linesnew_keysrrcleancontent_mode _tempfile_tmp_fd _tmp_path_fs r'_write_env_filer,s(''''' OO$& ??   $ $!)!3!3W!3!E!E!P!P!R!R $ $ $!# $02!.11 E EHB I E!5!5c!:!: Esi?O?O,5OOC,C,CA,F,L,L,N,N)BD$%>?N++  !--// 2 2JC} sD)))...>BL!5c!:;JJ$$&&E u}}  !OPPP#BJsO***=@:J:J5:J:J 1#6773 0 0 0 01111BA<AAA   * ( R 0 6 6 8 8B > >##B'''    ) ) )dT:::))L))   tOG   -$$$$&..HO$$WV/   7C'::: &b!!! %%% & & & & & & & & & & & & & & & HY & & & Jy( + + + +     )$$$$          NN5 ! ! ! !    D ]OOOOOOOOOOOOOOOOOOsN(A N ANAH"NL)AK3' L)3K7 7L):K7 ;-L)(N) M4M M MMMMNM54N5 N?NNNNNcTt|}|rtdz }t|}||}t ||rdSt j|}t ||rdSt|dpdD]M}t |||rdSt |t j|rdSNt}|di}t|trt|dpd r|d} | rnt|  | kr%t ||drdS|di} t| tr| |i} t| tr[t| dpd r%t || drdS|d g} t| trc| D]`} t| trIt|| d r&t || drdSad S) uxCheck whether a provider has a configured API key. Checks (in order): 1. ``~/.hermes/.env`` for the known env var 2. ``os.environ`` for the known env var 3. ``config.yaml → model.api_key`` (only if provider is the active one) 4. ``config.yaml → providers..api_key`` 5. ``config.yaml → custom_providers[].api_key`` (for custom providers) rTr6rrrrrrrF)rarrorrrrrcrrrrr r!rr()rrrprenv_file_value env_valuerrrrrrrrs r'_provider_has_keyrs ##K00G#%%.#H-- #00 ,[. I I 4Ig&& ,[) D D 4/22;CCIr  E0jnnU>S>STT tt0bi>N>NOO tt  ,,C$$I)T""s9==+C+C+Ir'J'J'P'P'R'R#-- 33  s?3399;;AACC{GXGXGZGZZZ0immI>V>VWW tGGK,,M-&&$((b99 lD ) ) c,2B2B92M2M2SQS.T.T.Z.Z.\.\ 0l>N>Ny>Y>YZZ tww1266"D))$" $ $B"d## $0bffVnnMM$8bffYFWFWXX$#tt 5r) str | NonecR|pd}t|}|rbt dz }t |}||}t ||r#t|pdStj |}t ||r#t|pdSt|dpdD]}||}t ||r%t|pdcStj |}t ||r%t|pdcSt} | di} t| trt| dpd} t| dpd} | r| |krt || r| S| di} t| trs| |i}t|trHt|dpd}t ||r|S| d g}t|tr|D]}t|tst||d rt|dpd}|d rH|d r3tj |d ddpdcSt ||r|cSdS)zDReturn a configured provider API key without exposing it to callers.rrNr6rrrrrrrrr-r)r r!rarrorrrrrrcrrrrr(r|r)rrrprrrralias_file_value alias_valuerrr model_keyrr provider_keyrrrs r'_get_provider_api_keyrs$"++--3355K##K00G8#%%.#H-- #00 ,[. I I 7~&&,,..6$ 6Ig&& ,[) D D 2y>>''))1T 1.22;CCIr 8 8E)~~e44 0>NOO =+,,2244<<<<)E**K0kJJ 8;''--//74777 8 ,,C$$I)T""immJ77=2>>DDFFLLNN i006B77==??  K77<]^ikt>F$FFF4[&II"!MMM 4r)ct}|di}t|tsdSt |dpd}|pdS)Nrrr)rrrrrr r!)rrrs r'_active_provider_idrsv ,,C$$I i & &t9==,,23399;;AACCH  tr)r int | float | NonecTt|ts|dSt|ttfr|S t |}|sdSt|}|rt|n|S#ttf$rYdSwxYwr2) rrintfloatrr is_integer TypeErrorr)rrnumbers r' _quota_numberrs%%-t%#u&& 5zz!! 4t$//11=s6{{{v= z "tts#B3BB'&B'rdict[str, int | float | None]ct|tr0t|dtr|d}t|tsi}t|dt|dt|ddS)Ndatalimit_remainingusagelimit)rrr)rrrr)rs r'_sanitize_openrouter_quotars'4  "Z F0C0CT%J%J"&/ gt $ $(5F)G)GHHw{{73344w{{73344  r)c^|dvrdSt|trn|jr|n|tj}|tjddSt| }|pdS)N)Nr)tzinfoz+00:00Z) rrrrrutc astimezone isoformatrr )rdtrs r'_isoformat_utcrs t%""Nl JUU X\ (J(J}}X\**4466>>xMMM u::    D <4r)snapshotdict[str, Any] | NonecR|dSg}t|ddpdD]}tt|ddpd}|s7tt|dd}d}|.t dt ddt |z }||||tt|ddtt|d dpdpdd d t|d dpdD}tt|d dpdpd}tt|ddpdpd}tt|ddpdpdtt|ddpdpdtt|ddpdpd|||tt|dt|p|o| |tt|ddd } t|dd} t| tr| | d<| S)Nwindowsr6labelr used_percentgY@reset_atdetail)r"r#remaining_percentr%r&cg|]D}t|#t|ESr6)rr )rr&s r'rz5_serialize_account_usage_snapshot..<sR  v;;     F r)detailsplanunavailable_reasonrsourcetitleAccount limits available fetched_at) rr,r-r*r!r)r/r+r0pool) getattrrr rmaxminr rrrrr) rr!windowr"r#r'r)r*r+resultr1s r'!_serialize_account_usage_snapshotr7(st$&G(Ir228b  GFGR006B77==??  $WV^T%J%JKK    # #CUEE,>DDFFN$       xB77=2G wx,,2 3 3 9 9 ; ; CtDWX/CRHHNBOOUUWW_[_*b99?R@@FFHHPDgh"55;<<BBDDLWXw339r::@@BBVFV'(Kg>P9Q9QRRSSn\nXn0$WX|T%J%JKK  F 8VT * *D$v Mr)base_urlrrr9rc*ddlm}||||S)Nr)fetch_account_usager8)agent.account_usager;)rr9rr;s r'_agent_fetch_account_usager=Ts,777777  x(G L L LLr)rncttj}tt ||d<t t |dz D] \}}|r|||< t|pd }|r|r|||< ddl m }n#t$rd}YnwxYwg}|r"|t||dd} | r|| |r"tj||d<|S)N HERMES_HOMErrr) _AGENT_DIR PYTHONPATH)rrrrr rrrarr r! api.configr@r@rpathsepr) rnrrenvrrrr@pythonpath_partsexisting_pythonpaths r'_account_usage_subprocess_envrGZsq rz  CT$ZZC  %T$ZZ&%899??AA U  CH##X^$:$:$<$<$B$B$D$DEEG7G )))))))  "$1J000'',335 3444>JOO,<==L JsC CCct|tsdStd|dpdD}t |d|d|d|d|t|dpdt |d |d |d t|d tr|d nd S)Nc 3K|]x}t|tt|d|d|d|dVydS)r"r#r%r&)r"r#r%r&N)rrr r)rr5s r'rz5_account_usage_payload_to_snapshot..|s    fd # # **W%%N33ZZ ++::h''          r)r!r6rr,r-r*r)r/r+r0r1) rr,r-r*r!r)r/r+r0r1)rrtuplerr r)rr!s r'"_account_usage_payload_to_snapshotrKys0 gt $ $t  {{9--3     G Z(({{8$$kk'"" [[ gkk),,233w{{;//00";;';<<;;|,,$.w{{6/B/BD$I$I SW[[ t    r)tuple[str, str, str]cd}|r:tj|dd}|pdt t||fS)Nrrrignore)hashlibsha256r hexdigestr r!rr )rrnrkey_fingerprints r'_account_usage_cache_keyrSsnOX!.)J)JKKUUWW ^ " " $ $ * * , ,c$t**oo OOr) cache_keytuple[bool, Any]c:tj}t5t|}| ddddS|\}}||z t krd|fcdddSt|ddddn #1swxYwYdS)N)FNT)time monotonic _account_usage_status_cache_lockr/r _ACCOUNT_USAGE_CACHE_TTL_SECONDSr)rTnowcachedr0rs r'_get_cached_account_usager]s .  C )99,00;; >99999999 & H  ? ? ?> 99999999 $'' 4888999999999999999 ;sBB)BBBct|pd}t5|s't ddddSt tD])}|d|krt|d* ddddS#1swxYwYdS)Nrr)rr r!rYr/clearrr)r normalizedrs r'%invalidate_account_usage_status_cacheras [&B''--//5577J );;  ' - - / / / ;;;;;;;;344 ; ;C1v##+//T::: ; ;;;;;;;;;;;;;;;;;;sB3'>B33B7:B7ctjt5|[t|}||d ddddSt|d ddddS|ft|<fdtD}|D]}t|dtttkrOttd}t|dtttkOddddS#1swxYwYdS)Nr:c<g|]\}\}}|z tk|Sr6)rZ)rrr0 _snapshotr[s r'rz-_set_cached_account_usage..s=   0C0*iZ"BBB BBBr)c(t|dS)Nr)r/rs r'z+_set_cached_account_usage..s ;C @ Cr)rf) rWrXrYr/rrrr _ACCOUNT_USAGE_CACHE_MAX_ENTRIESr4)rTrr\expiredr oldest_keyr[s @r'_set_cached_account_usagerks .  C )>>  044Y??F!fQi&; >>>>>>>> ( + +It < < <  >>>>>>>>36x#I.    4O4U4U4W4W    7 7C ' + +C 6 6 6 6-..1QQQ+CCJ ( + +J = = = -..1QQQ>>>>>>>>>>>>>>>>>>s(EE:B=EE Erc H ddlm}n#t$rtjpd}YnwxYw t jt jt jdtdd}ttdr t|d<t j |d ttz||pd gfd t|||i|}nZ#t j$rt"d |YdSt$r!t"d |dYdSwxYw|jdkr#t"d||jdS t)j|jpd pd}n1#t(j$rt"d|YdSwxYwt3|S)Nr) PYTHON_EXEpython3TF)stdinstdoutstderrrtimeoutcheckfork preexec_fnz-crrDz$Account usage probe for %s timed outz+Account usage probe for %s failed to launchexc_infoz0Account usage probe for %s exited with status %snullz0Account usage probe for %s returned invalid JSON)rBrnr@sys executable subprocessDEVNULLPIPE)_ACCOUNT_USAGE_SUBPROCESS_TIMEOUT_SECONDShasattrrrBrun(_ACCOUNT_USAGE_PARENT_DEATHSIG_BOOTSTRAP_ACCOUNT_USAGE_SUBPROCESS_CODErGTimeoutExpiredloggerdebug returncoderrrqr JSONDecodeErrorrK)rrnrrnkwargsprocrs r'#_agent_fetch_account_usage_for_homers1))))))) 111^0y 1  ' o o@ " "  2v   =#f$r dd |dddddcYSwxYw) aReturn sanitized quota/rate-limit status for the active provider. OpenRouter keeps its documented key endpoint. OAuth-backed account usage providers reuse Hermes Agent's /usage account-limits abstraction so WebUI stays aligned with CLI/Gateway provider semantics. rFNrz!No active provider is configured.)rrrrrrr- rrCzcOpenAI/Anthropic rate-limit headers are a follow-up once WebUI captures provider response metadata. unsupportedz"Quota status is not available for z. Tno_keyzMOpenRouter quota status needs an OPENROUTER_API_KEY configured on the server.Bearer application/json AuthorizationAcceptheadersrsrrr/OpenRouter creditszOpenRouter quota status loaded.)rrrrrr"rr)ii invalid_keyz+OpenRouter rejected the configured API key.z3OpenRouter quota status is temporarily unavailable.) rr r!r rrr-_ACCOUNT_USAGE_PROVIDERSrrurllibrequestRequest_OPENROUTER_KEY_URLurlopen_PROVIDER_QUOTA_TIMEOUT_SECONDSreadrbytes bytearrayrrrrerror HTTPErrorcode TimeoutErrorURLErrorrrr)rrrrr&rreqresprrrexcrrs r'get_provider_quotarEsJ:244:AACCIIKKH    #:   %(83C3CC3M3M3S3S3U3UVVL+++-h gVVVV<v (#TLTTFTT   $L11G   $(f    . 0w00(   !  C( ^ # #C1P # Q Q UY))++C               5?eYEW5X5Xm$*SZZ00111^b^hil^m^m*733$(!)8    < !   "%(j"8"8m&& : 9F  $(         &,/1EwPZ [    $(#L       sI9&F<E4 F<EF<EA3F<<H8 G60H86?H87H8c|tvS)zACheck whether a provider uses OAuth/token flows (managed by CLI).)_OAUTH_PROVIDERS)rs r'_provider_is_oauthrs * **r)zcost-snapshotsimc.ttz S)zReturn the directory for cost-snapshot JSON files. Uses the Hermes home directory (profile-aware) so snapshots are isolated per profile, matching the existing STATE_DIR convention. )ro_COST_SNAPSHOTS_DIR_NAMEr6r)r'_cost_snapshots_dirrs    8 88r)c#pKt,t5dVdddn #1swxYwYdSt}|dd||dz }|dd5}tj|tjdVddddS#1swxYwYdS)zBSerialize cost snapshot read-modify-write across worker processes.NTrz.lockarrrs)fcntlrrropenflockLOCK_EX)rsnap_dir lock_path lock_files r'_cost_snapshot_file_lockrsB } ]]   EEE               "$$H NN4$N///h----I g . .) Iu}--- s)--:$B++B/2B/cNtjtd|dd} tj|t 5}|}dddn #1swxYwYtjt|ttfr| dn|}t|}d}t|trc|d|}t|tr8t!|d pd pd}|d |d |d S#t$$r t&ddYdSwxYw)zFetch current usage/limit from the OpenRouter ``/auth/key`` endpoint. Returns a dict with ``usage``, ``limit``, ``label`` on success, or ``None`` on any failure. Never raises; callers handle the None case. rrrrrNrrrr"rrr)rrr"z2OpenRouter key usage fetch failed for cost-historyTrw)rrrrrrrrrrrrrrrrrr r@rr)rrrrr sanitizedr"rs r'_fetch_openrouter_key_usagers . 0w00(   !  C ^ # #C1P # Q Q UY))++C               *JsUIDV4W4W`SZZ000]`aa.w77  gt $ $ E;;vw//D$%% EDHHW--344::<<D]]7++]]7++    ITX YYYtts6&E:A5) E:5A99E:<A9=C. s QvYr)rf)rryrzrrrrrrrrrrr rrsort)rpathrrrvalidentryrs r'_read_cost_snapshotsrs  h#5#5#5 5D ;;== nngn..z# T): 6  dD ! ! %%I i & & E   %&&  599V$$*++1133   !%))F"3"344"599W#5#566       JJ&&J''' Ls*AA87A8rct}|dd||dz }||d}tj|dd}dd l}|t |d |d d \}} tj|dd5} | || tj | d d d n #1swxYwYtj ||d S#t$r( tj|n#t $rYnwxYwwxYw)z:Persist daily snapshots for *provider* to disk atomically.Trr)rrFr-) ensure_asciiindentrNr_rrrrrrs)rrrdumpsrrrrrrrrrrrrr) rrrrrbodyrrrrs r'_write_cost_snapshotsrs"$$H NN4$N/// ((( (D#)<.Ds 6r)rfN) rr[rrstrftime_COST_SNAPSHOT_LOCKrrrrr_COST_SNAPSHOT_MAX_DAYSr)rrrtodayrupdatedrs r'_append_cost_snapshotr*s L & & / / ; ;E  %h / /  ,X66IG"  =E))$)E&M%*E'N"GE *  Q  %!O!OPPP NN22N 3 3 39~~ 777%'>&>&?&?@ !(I 6 6 6#                s6D BC>% D>D DD DDD window_daysr cRt||kr || dnt|}g}t|D]\}}d}|dkr|d||dz dut |dt ||dz dz }|dkrt |d}t |dkrd}nt |d}||d|d|d |S) aCompute daily deltas from cumulative usage snapshots. Each snapshot carries cumulative ``used``; the delta for a day is the difference between that day's cumulative value and the previous day's. The oldest day in the window has ``delta=None`` (no previous baseline). If the cumulative value drops, treat that day as the start of a fresh series (for example after an API-key rotation) and use the current value as that day's delta instead of emitting a negative spend bar. Nrrr:g& .>r$r)rrdelta)rrrrr absroundr)rrr5r6irrs r'_compute_deltasrLs9*-Y+)E)EY |}} % %4PY??F#%Ff%%  5 q55UYYv&&2va!e}7H7H7P7P7\%-((5Av1F+G+GGEqyyeFm,,5zzD  eQ &MIIf%%      Mr)daysc |pd}|sdddddS|dkrHtj||dd }d||dd d |d d Stjdd}t d}|s dd|dddd St|}|,td}t||}dd|dd||dddd S td|d|d}n;#t$r.t ddtd}YnwxYwt||}dd|dd|||d|dpddd S)uReturn daily cost-history snapshots with deltas for a provider. Currently only ``openrouter`` is supported. On each call the endpoint fetches the current cumulative usage from the OpenRouter ``/auth/key`` endpoint, appends/updates today's snapshot, and returns the last *days* snapshots with per-day deltas. Returns a dict matching the existing API style (``ok``, ``provider``, ``status``, ``message``, …). rFNmissing_providerz9Provider parameter is required. Use ?provider=openrouter)rrrrrCrrrz"Cost history is not available for z/. Only openrouter is supported in this release.)rrrrrr OpenRouterTrzMOpenRouter cost history needs an OPENROUTER_API_KEY configured on the server.rzLOpenRouter cost history is temporarily unavailable. Showing last known data.) rrrrrrrrr"rrrz.Failed to persist cost snapshot for openrouterrwr/r"rzOpenRouter cost history loaded.)r r!r rrr-rrrrrr@rr)rrrrrkey_infordeltass r'get_provider_cost_historyrms!r((**0022H  (R    <(,Xx7G7GS7Q7Q7W7W7Y7YZZ  (#yLyyy    %(|DDL#L11G  $(f    +733H)66  D11$(#e   7),8I8T[K\]] 777 EPT UUU(66 7Y - -F $g&&g&&>*>4   s-D 5EEc R)*g}ttjttjz}t }|di}t |tr'|||tt|D]}tj|| dd }t|}t|}d}d} |rd} ddlm} | |} t | tr.| d rd }| d d}n_|r/d }t | tr| d nd} n.d}t | tr| d nd} n#t"$r!t$d|d YnwxYw|rt(|} | rt+dz } t-| }t/||| rd}n3t/|t1j| rd}n d}t4|dpdD]S}t/|||rd}d }n)t/|t1j|rd}d }nT|sd }nd }n|t(vrddl}|d|ro ddlm} | |} t | tr7| d r"d }| d d}|dvr|nd}d }n#t"$rYnwxYw|dkr|st;|rt=tj|g}t?|}|dkr\tAd}tCD]}||vr|"|tG||}|r|}t?|}|dkr0tG|tAd}|r|}t?|}|dkrt ddl$m%}|dpg}|r3ddl&m')m(}||\}})fd|D}t?|}n*#t"$rt$dYnwxYw|d kr\ ddl$m%}|d pg}|rd!|D}t?|}n*#t"$rt$d"YnwxYwt |tr||i}t |tr|d#|vrx|d#}t |tr"|d$|Dz}n$t |t<r|d%|Dz}|dkrt?|}|"|||| o|t(v||| ||d& |d'g} t | t<r| D]}!t |!tr|!d(s.tS|!d(*}"tW|"}#|#st$,d)|"g}$t |!d#t<rd*|!d#D}$n'|!d+r|!d+|!d+d,g}$tS|!d-pd}%t[|%*}&|%.d.rS|%/d/r>|%d0d1} t[t1j| d*}&|"|#|"|&dd |&rd nd|$t?|$d2d*|d+i}'t |'tr|'d3**fd4}(|0|(5|*d6S)7aReturn a list of all known providers with their configuration status. Each entry contains: - ``id``: canonical provider slug - ``display_name``: human-readable name - ``has_key``: whether an API key is configured - ``configurable``: whether the key can be set from the WebUI - ``key_source``: where the key was found (``env_file``, ``env_var``, ``config_yaml``, ``oauth``, ``none``) - ``models``: list of known model IDs for this provider rrrnoneNoauthr)get_auth_status logged_inT key_source config_yamlrFz#hermes_cli auth check failed for %srwrenv_filerr6z^[a-z][a-z0-9_-]{0,63}$r>rDrrconfigrFr+rhrf)provider_model_ids)_format_nous_label_build_nous_featured_setc2g|]}d||dS)z@nous:idr"r6)rmidr s r'rz!get_providers..lsC .~~8J8J38O8OPPr)z1Failed to load Nous Portal models from hermes_clir\cg|]}||dSrr6)rrs r'rz!get_providers..{s KKKCS377KKKr)z/Failed to load LM Studio models from hermes_climodelscg|]}||dSrr6rks r'rz!get_providers..s &X&X&Xa!'<'<&X&X&Xr)cg|]}||dSrr6rs r'rz!get_providers..s &Q&Q&Qa!'<'<&Q&Q&Qr)) rrhas_key configurableis_oauthr auth_errorr models_totalrrz6Custom provider entry %r produced empty slug; skippingcLg|]!}t|t|d"Sr)r)rms r'rz!get_providers..s,SSSCFFSVV<<SSSr)rrrrrr-r)rrrr is_customrrrrc|dpd}|krd|fS|drd|fS|drd|fSd|fS) Nrrrrr:rr-)rr|)pr#rs r'_provider_sort_keyz)get_providers.._provider_sort_keysneeDkkR / ! !s8O >>) $ $ s8O 55   s8O3xr)rf)rr)1setr keysr rrrrupdatersortedrr-rrhermes_cli.authrr@rrrarorrrrrcrematchrrrrrrrhermes_cli.modelsr rBr r rr rwarningrr|rr)+r known_idsrrr#rrrrr_gasrrrpraliasedr_re_raw_ksrrlive_idsr live_models_provider_model_idsr  featured_ids_extras_pmilm_liver cfg_modelscustom_providers_cfgrcp_namecp_id cp_models cp_api_key cp_has_keyrr#r rs+ @@r' get_providersr@s' I%*,,--4D4I4K4K0L0LLI ,,CGGK,,M-&&/++--...%&&&i  B B (,S#++c32G2G2M2M2O2OPP %c**#C((  N  J  XCCCCCCcfd++ [ ;0G0G ["G!'L'!B!BJJ["/J8B648P8P!ZG!4!4!4VZJJ#G8B648P8P!ZG!4!4!4VZJ X X X BCRV WWWWW X 4 '++C00G ++--6+H55 4S*..:Q:QRR3!+JJ6sBIg!>sB!G!G!M2""">07;^0^0^WWdk #' D (??7?/WX[/\/\? &*333446{{  . 4^DDH:<< ) )h&&OOC(((8hGGK +$"6{{ +  8-k::K +$"6{{  &== RWWWWWW..v66<" 1WWWWWWWW,D,DX,N,N)L'#/F$'x==L R R R PQQQQQ R *   PHHHHHH$z**0b/KK7KKKF#&v;;L P P P NOOOOO P mT * * /(,,S"55L,-- /(l2J2J)(3 j$//R#&X&XjooFWFW&X&X&XXFF D11R#&Q&Qj&Q&Q&QQF &==#&v;;L( (LES4E-E $$)!      (77#5r::&--"&! ! Bb$'' rvvf~~ "V*oo++--G3G<">"@"@AA    '% %!/9Emmv# #I      O$$I)T""4#-- 33NN)N****  sK4B3G))'HHAN  N-,N-AS""$T T 0U$U+*U+c|}|sdddSt|rddtj||ddSt |}|sddtj||ddS|r9|}d|vsd |vrdd dSt |d krdd dStd z } t|||in^#t$r}dt|dcYd}~Sd}~wt$r-}t d|dd|dcYd}~Sd}~wwxYwtd|tj|||rdnddS)zSet or update the API key for a provider. Writes the key to ``~/.hermes/.env`` using the standard env var name. If ``api_key`` is None or empty, the key is removed. Returns a status dict with the operation result. FzProvider ID is required.)rrrxzP' uses OAuth authentication. Use `hermes model` in the terminal to configure it.zCannot configure API key for 'z7'. This provider does not have a known env var mapping.rrrzAPI key appears too short.rNz(Failed to write env file for provider %szFailed to save API key: Trremoved)rrraction)r r!rr rrarrorrrr@r exceptionr)rrrrprs r'set_provider_keyrFs;##%%++--K B&@AAA+&& L*.{KHHLLL    ##K00G  M6G6KKYd6e6eMMM   H--// 7??dgoo*XYY Y w<.api_key`` or top-level ``model.api_key`` when this provider is the active one). Returns a status dict with the operation result. Nr)rFr_clean_provider_key_from_config)rr6s r'remove_provider_keyrIs<k4 0 0F zz$5' 444 Mr)cDddlm} ddlm}|}n#t$rYdSwxYw|sdS ddl}d}|5|d}||}t|ts ddddS| di}t|trE| |i} t| tr| dr| d=d }| d i} t| trz| dre| d } | rNt|  |kr| d=d }| d g} t| trW| D]T} t| tr=t!|| d r| dr| d=d }U|rt#||dddn #1swxYwY|rt%dSdS#t$rt&d|YdSwxYw)uRemove provider API key entries from config.yaml. Handles three storage locations: 1. ``providers..api_key`` — per-provider key 2. ``model.api_key`` — top-level key (only if provider is active) 3. ``custom_providers[].api_key`` — custom provider entries Writes back to config.yaml only if something was actually removed. Uses ``_cfg_lock`` to prevent TOCTOU races. r) _cfg_lockNFrrrsrrTrrrrz4Failed to clean provider key from config.yaml for %s)rBrKr _get_config_pathr@ryyamlrz safe_loadrrrrr r!rr(rrrrE)rrK_config config_path_yamlchangedrrrrrrrrs r'rHrH0s^%$$$$$  %$$$$$..00      .^ ! 9! 9'''99C//#&&Cc4((  ! 9! 9! 9! 9! 9! 9! 9! 9 GGK44M-.. #,00bAA lD11#l6F6Fy6Q6Q#$Y/"G,,I)T** #y}}Y/G/G #"+-- ";";"#s?';';'A'A'C'C'I'I'K'K{O`O`ObOb'b'b!),"G #ww'92>> *D11 /*//B!"d++/8bffVnnUU/!vvi00/$&yM*. 9&{C888C! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9! 9L   OOOOO   ^^^OQ\]]]]]]^sP# 11 I6AI I6"F)I I6II6II66%JJ)rrrrrr)rr0)rr8)rr )rpr rr`)rrrr)rrrr)rrrrrr)rrrr)rpr rrrr8)rrrr)rr)rr rr)rr rr)rr rr)rr rr)rrr9rrrrr )rnr rrrrrr`)rr rr )rrrnr rrrrL)rTrLrrUr2)rrrr8)rTrLrr rr8)rrrnr rrrr )rrrrrr )rrrrrrrr)rrrrrr)rr)rrrr)rrrr)rrrrrr8)rrrrrrrr)rrrr rr)Nr)rrrr rr)rr)rrrrrr)rrrr)rrrr8)k__doc__ __future__rrrOrloggingrr>r|rzr3rW urllib.errorrurllib.request contextlibrrrrrpathlibr typesr typingr rrmrBr r rrrrrrrrr getLogger__name__rr(rrrrZrh frozensetrr5rr.__annotations__r/LockrYr7rBrrarcrrorrrrrrrrrrrrr7r=rGrKrSr]rarkrrrrrrrrrrrrrrrrr@rFrIrHr6r)r'ras#"""""     222222222222222222!!!!!!LLLL EEE                            8 $ $    9"%,0)#' #% $9nk%BCC()$. )$EIHHHHNPOOOO#19>#3#3 ****     b"R$%&$%$$% $%  $%   $%  = $%>$%"$% $%&$%"$% M$% $%*$%($%0$1$%D E$%F G$%$%$$$$^%99''''"6666$ b b b b)T)T)T)TX____D6666r0000f        ))))XIMdhMMMMMM >6PPPP    ;;;;;>>>>6]a.7.7.7.7.7.7bQVDY^!!!!!!H^ %^ ^ ^ ^ ^ ^ B++++,$in&&9999    B""""J2DBRRRRRpYYYYx7777t*I^I^I^I^I^I^sA$$A.-A.