1 line
2.0 MiB
Plaintext
1 line
2.0 MiB
Plaintext
{"repo": "adityakumar41/arcen-agent", "files": {"arcen_cli/auth.py": {"41d6a8164c24506a38253f69334701ad2e137204": {"t": 1785595167.1401117, "n": 308010, "h": "5a37e8a8d2c76c58", "c": "\"\"\"\nMulti-provider authentication system for Arcen Agent.\n\nSupports OAuth device code flows (Removed provider Portal, future: OpenAI Codex) and\ntraditional API key providers (OpenRouter, custom endpoints). Auth state\nis persisted in ~/.arcen/auth.json with cross-process file locking.\n\nArchitecture:\n- ProviderConfig registry defines known OAuth providers\n- Auth store (auth.json) holds per-provider credential state\n- resolve_provider() picks the active provider via priority chain\n- resolve_*_runtime_credentials() handles token refresh and runtime keys\n- logout_command() is the CLI entry point for clearing auth\n\nRemoved provider authentication paths:\n- Invoke JWT (preferred): use a scoped access_token directly for inference.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport logging\nimport os\nimport shutil\nimport shlex\nimport ssl\nimport stat\nimport sys\nimport base64\nimport hashlib\nimport subprocess\nimport threading\nimport time\nimport uuid\nimport webbrowser\nfrom contextlib import contextmanager\nfrom dataclasses import dataclass, field\nfrom datetime import datetime, timezone\nfrom http.server import BaseHTTPRequestHandler, HTTPServer, ThreadingHTTPServer\nfrom pathlib import Path\nfrom typing import Any, Callable, Dict, FrozenSet, List, Optional, Tuple\nfrom urllib.parse import parse_qs, urlencode, urlparse\n\nimport httpx\n\nfrom arcen_cli.config import get_arcen_home, get_config_path, read_raw_config\nfrom arcen_constants import OPENROUTER_BASE_URL, secure_parent_dir\nfrom agent.credential_persistence import sanitize_borrowed_credential_payload\nfrom utils import atomic_replace, atomic_yaml_write, is_truthy_value\n\nlogger = logging.getLogger(__name__)\n\ntry:\n import fcntl\nexcept Exception:\n fcntl = None\ntry:\n import msvcrt\nexcept Exception:\n msvcrt = None\n\n# =============================================================================\n# Constants\n# =============================================================================\n\nAUTH_STORE_VERSION = 1\nAUTH_LOCK_TIMEOUT_SECONDS = 15.0\n\n# Legacy Removed provider Portal constants are kept only for backward-compatible auth-store\n# cleanup helpers. The provider is not registered or offered in Arcen Agent.\nDEFAULT_REMOVED_PROVIDER_PORTAL_URL = \"\"\nDEFAULT_REMOVED_PROVIDER_INFERENCE_URL = \"\"\nDEFAULT_REMOVED_PROVIDER_CLIENT_ID = \"\"\nREMOVED_PROVIDER_INFERENCE_INVOKE_SCOPE = \"inference:invoke\"\nDEFAULT_REMOVED_PROVIDER_SCOPE = \"\"\nREMOVED_PROVIDER_DEVICE_CODE_SOURCE = \"device_code\"\nREMOVED_PROVIDER_AUTH_PATH_INVOKE_JWT = \"invoke_jwt\"\nACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120 # refresh 2 min before expiry\nREMOVED_PROVIDER_INVOKE_JWT_MIN_TTL_SECONDS = ACCESS_TOKEN_REFRESH_SKEW_SECONDS\nDEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS = 1 # poll at most every 1s\nDEFAULT_CODEX_BASE_URL = \"https://chatgpt.com/backend-api/codex\"\nDEFAULT_XAI_OAUTH_BASE_URL = \"https://api.x.ai/v1\"\nMINIMAX_OAUTH_CLIENT_ID = \"78257093-7e40-4613-99e0-527b14b39113\"\nMINIMAX_OAUTH_SCOPE = \"group_id profile model.completion\"\nMINIMAX_OAUTH_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:user_code\"\nMINIMAX_OAUTH_GLOBAL_BASE = \"https://api.minimax.io\"\nMINIMAX_OAUTH_CN_BASE = \"https://api.minimaxi.com\"\nMINIMAX_OAUTH_GLOBAL_INFERENCE = \"https://api.minimax.io/anthropic\"\nMINIMAX_OAUTH_CN_INFERENCE = \"https://api.minimaxi.com/anthropic\"\nMINIMAX_OAUTH_REFRESH_SKEW_SECONDS = 60\nDEFAULT_QWEN_BASE_URL = \"https://portal.qwen.ai/v1\"\nDEFAULT_GITHUB_MODELS_BASE_URL = \"https://api.githubcopilot.com\"\nDEFAULT_COPILOT_ACP_BASE_URL = \"acp://copilot\"\nDEFAULT_OLLAMA_CLOUD_BASE_URL = \"https://ollama.com/v1\"\nSTEPFUN_STEP_PLAN_INTL_BASE_URL = \"https://api.stepfun.ai/step_plan/v1\"\nSTEPFUN_STEP_PLAN_CN_BASE_URL = \"https://api.stepfun.com/step_plan/v1\"\nCODEX_OAUTH_CLIENT_ID = \"app_EMoamEEZ73f0CkXaXp7hrann\"\nCODEX_OAUTH_TOKEN_URL = \"https://auth.openai.com/oauth/token\"\nCODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nXAI_OAUTH_ISSUER = \"https://auth.x.ai\"\nXAI_OAUTH_DISCOVERY_URL = f\"{XAI_OAUTH_ISSUER}/.well-known/openid-configuration\"\nXAI_OAUTH_CLIENT_ID = \"b1a00492-073a-47ea-816f-4c329264a828\"\nXAI_OAUTH_SCOPE = \"openid profile email offline_access grok-cli:access api:access\"\nXAI_OAUTH_REDIRECT_HOST = \"127.0.0.1\"\nXAI_OAUTH_REDIRECT_PORT = 56121\nXAI_OAUTH_REDIRECT_PATH = \"/callback\"\nXAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nQWEN_OAUTH_CLIENT_ID = \"f0304373b74a44d2b584a3fb70ca9e56\"\nQWEN_OAUTH_TOKEN_URL = \"https://chat.qwen.ai/api/v1/oauth2/token\"\nQWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nDEFAULT_SPOTIFY_ACCOUNTS_BASE_URL = \"https://accounts.spotify.com\"\nDEFAULT_SPOTIFY_API_BASE_URL = \"https://api.spotify.com/v1\"\nDEFAULT_SPOTIFY_REDIRECT_URI = \"http://127.0.0.1:43827/spotify/callback\"\nSPOTIFY_DOCS_URL = \"https://arcen-cli.arcenpay.com/docs/user-guide/features/spotify\"\nSPOTIFY_DASHBOARD_URL = \"https://developer.spotify.com/dashboard\"\nSPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\n\nXAI_OAUTH_DOCS_URL = \"https://arcen-cli.arcenpay.com/docs/guides/xai-grok-oauth\"\nOAUTH_OVER_SSH_DOCS_URL = \"https://arcen-cli.arcenpay.com/docs/guides/oauth-over-ssh\"\nDEFAULT_SPOTIFY_SCOPE = \" \".join((\n \"user-modify-playback-state\",\n \"user-read-playback-state\",\n \"user-read-currently-playing\",\n \"user-read-recently-played\",\n \"playlist-read-private\",\n \"playlist-read-collaborative\",\n \"playlist-modify-public\",\n \"playlist-modify-private\",\n \"user-library-read\",\n \"user-library-modify\",\n))\nSERVICE_PROVIDER_NAMES: Dict[str, str] = {\n \"spotify\": \"Spotify\",\n}\n\n# Google Gemini OAuth (google-gemini-cli provider, Cloud Code Assist backend)\nDEFAULT_GEMINI_CLOUDCODE_BASE_URL = \"cloudcode-pa://google\"\nGEMINI_OAUTH_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 60 # refresh 60s before expiry\n\n# LM Studio's default no-auth mode still requires *some* non-empty bearer for\n# the API-key code paths (auxiliary_client, runtime resolver) to treat the\n# provider as configured. This sentinel is sent only to LM Studio, never to\n# any remote service.\nLMSTUDIO_NOAUTH_PLACEHOLDER = \"dummy-lm-api-key\"\n\n\n# =============================================================================\n# Provider Registry\n# =============================================================================\n\n@dataclass\nclass ProviderConfig:\n \"\"\"Describes a known inference provider.\"\"\"\n id: str\n name: str\n auth_type: str # \"oauth_device_code\", \"oauth_external\", \"oauth_minimax\", or \"api_key\"\n portal_base_url: str = \"\"\n inference_base_url: str = \"\"\n client_id: str = \"\"\n scope: str = \"\"\n extra: Dict[str, Any] = field(default_factory=dict)\n # For API-key providers: env vars to check (in priority order)\n api_key_env_vars: tuple = ()\n # Optional env var for base URL override\n base_url_env_var: str = \"\"\n\n\nPROVIDER_REGISTRY: Dict[str, ProviderConfig] = {\n \"openai-codex\": ProviderConfig(\n id=\"openai-codex\",\n name=\"OpenAI Codex\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_CODEX_BASE_URL,\n ),\n \"openai-api\": ProviderConfig(\n id=\"openai-api\",\n name=\"OpenAI API\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.openai.com/v1\",\n api_key_env_vars=(\"OPENAI_API_KEY\",),\n base_url_env_var=\"OPENAI_BASE_URL\",\n ),\n \"xai-oauth\": ProviderConfig(\n id=\"xai-oauth\",\n name=\"xAI Grok OAuth (SuperGrok / Premium+)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_XAI_OAUTH_BASE_URL,\n ),\n \"qwen-oauth\": ProviderConfig(\n id=\"qwen-oauth\",\n name=\"Qwen OAuth\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_QWEN_BASE_URL,\n ),\n \"google-gemini-cli\": ProviderConfig(\n id=\"google-gemini-cli\",\n name=\"Google Gemini (OAuth)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_GEMINI_CLOUDCODE_BASE_URL,\n ),\n \"lmstudio\": ProviderConfig(\n id=\"lmstudio\",\n name=\"LM Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"http://127.0.0.1:1234/v1\",\n api_key_env_vars=(\"LM_API_KEY\",),\n base_url_env_var=\"LM_BASE_URL\",\n ),\n \"copilot\": ProviderConfig(\n id=\"copilot\",\n name=\"GitHub Copilot\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_GITHUB_MODELS_BASE_URL,\n api_key_env_vars=(\"COPILOT_GITHUB_TOKEN\", \"GH_TOKEN\", \"GITHUB_TOKEN\"),\n base_url_env_var=\"COPILOT_API_BASE_URL\",\n ),\n \"copilot-acp\": ProviderConfig(\n id=\"copilot-acp\",\n name=\"GitHub Copilot ACP\",\n auth_type=\"external_process\",\n inference_base_url=DEFAULT_COPILOT_ACP_BASE_URL,\n base_url_env_var=\"COPILOT_ACP_BASE_URL\",\n ),\n \"gemini\": ProviderConfig(\n id=\"gemini\",\n name=\"Google AI Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"https://generativelanguage.googleapis.com/v1beta\",\n api_key_env_vars=(\"GOOGLE_API_KEY\", \"GEMINI_API_KEY\"),\n base_url_env_var=\"GEMINI_BASE_URL\",\n ),\n \"zai\": ProviderConfig(\n id=\"zai\",\n name=\"Z.AI / GLM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.z.ai/api/paas/v4\",\n api_key_env_vars=(\"GLM_API_KEY\", \"ZAI_API_KEY\", \"Z_AI_API_KEY\"),\n base_url_env_var=\"GLM_BASE_URL\",\n ),\n \"kimi-coding\": ProviderConfig(\n id=\"kimi-coding\",\n name=\"Kimi / Moonshot\",\n auth_type=\"api_key\",\n # Legacy platform.moonshot.ai keys use this endpoint (OpenAI-compat).\n # sk-kimi- (Kimi Code) keys are auto-redirected to api.kimi.com/coding\n # by _resolve_kimi_base_url() below.\n inference_base_url=\"https://api.moonshot.ai/v1\",\n api_key_env_vars=(\"KIMI_API_KEY\", \"KIMI_CODING_API_KEY\"),\n base_url_env_var=\"KIMI_BASE_URL\",\n ),\n \"kimi-coding-cn\": ProviderConfig(\n id=\"kimi-coding-cn\",\n name=\"Kimi / Moonshot (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.moonshot.cn/v1\",\n api_key_env_vars=(\"KIMI_CN_API_KEY\",),\n ),\n \"stepfun\": ProviderConfig(\n id=\"stepfun\",\n name=\"StepFun Step Plan\",\n auth_type=\"api_key\",\n inference_base_url=STEPFUN_STEP_PLAN_INTL_BASE_URL,\n api_key_env_vars=(\"STEPFUN_API_KEY\",),\n base_url_env_var=\"STEPFUN_BASE_URL\",\n ),\n \"arcee\": ProviderConfig(\n id=\"arcee\",\n name=\"Arcee AI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.arcee.ai/api/v1\",\n api_key_env_vars=(\"ARCEEAI_API_KEY\",),\n base_url_env_var=\"ARCEE_BASE_URL\",\n ),\n \"gmi\": ProviderConfig(\n id=\"gmi\",\n name=\"GMI Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.gmi-serving.com/v1\",\n api_key_env_vars=(\"GMI_API_KEY\",),\n base_url_env_var=\"GMI_BASE_URL\",\n ),\n \"minimax\": ProviderConfig(\n id=\"minimax\",\n name=\"MiniMax\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimax.io/anthropic\",\n api_key_env_vars=(\"MINIMAX_API_KEY\",),\n base_url_env_var=\"MINIMAX_BASE_URL\",\n ),\n \"minimax-oauth\": ProviderConfig(\n id=\"minimax-oauth\",\n name=\"MiniMax (OAuth \\u00b7 minimax.io)\",\n auth_type=\"oauth_minimax\",\n portal_base_url=MINIMAX_OAUTH_GLOBAL_BASE,\n inference_base_url=MINIMAX_OAUTH_GLOBAL_INFERENCE,\n client_id=MINIMAX_OAUTH_CLIENT_ID,\n scope=MINIMAX_OAUTH_SCOPE,\n extra={\"region\": \"global\", \"cn_portal_base_url\": MINIMAX_OAUTH_CN_BASE,\n \"cn_inference_base_url\": MINIMAX_OAUTH_CN_INFERENCE},\n ),\n \"anthropic\": ProviderConfig(\n id=\"anthropic\",\n name=\"Anthropic\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.anthropic.com\",\n api_key_env_vars=(\"ANTHROPIC_API_KEY\", \"ANTHROPIC_TOKEN\", \"CLAUDE_CODE_OAUTH_TOKEN\"),\n base_url_env_var=\"ANTHROPIC_BASE_URL\",\n ),\n \"alibaba\": ProviderConfig(\n id=\"alibaba\",\n name=\"Qwen Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://dashscope-intl.aliyuncs.com/compatible-mode/v1\",\n api_key_env_vars=(\"DASHSCOPE_API_KEY\",),\n base_url_env_var=\"DASHSCOPE_BASE_URL\",\n ),\n \"alibaba-coding-plan\": ProviderConfig(\n id=\"alibaba-coding-plan\",\n name=\"Alibaba Cloud (Coding Plan)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://coding-intl.dashscope.aliyuncs.com/v1\",\n api_key_env_vars=(\"ALIBABA_CODING_PLAN_API_KEY\", \"DASHSCOPE_API_KEY\"),\n base_url_env_var=\"ALIBABA_CODING_PLAN_BASE_URL\",\n ),\n \"minimax-cn\": ProviderConfig(\n id=\"minimax-cn\",\n name=\"MiniMax (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimaxi.com/anthropic\",\n api_key_env_vars=(\"MINIMAX_CN_API_KEY\",),\n base_url_env_var=\"MINIMAX_CN_BASE_URL\",\n ),\n \"deepseek\": ProviderConfig(\n id=\"deepseek\",\n name=\"DeepSeek\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.deepseek.com/v1\",\n api_key_env_vars=(\"DEEPSEEK_API_KEY\",),\n base_url_env_var=\"DEEPSEEK_BASE_URL\",\n ),\n \"xai\": ProviderConfig(\n id=\"xai\",\n name=\"xAI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.x.ai/v1\",\n api_key_env_vars=(\"XAI_API_KEY\",),\n base_url_env_var=\"XAI_BASE_URL\",\n ),\n \"nvidia\": ProviderConfig(\n id=\"nvidia\",\n name=\"NVIDIA NIM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://integrate.api.nvidia.com/v1\",\n api_key_env_vars=(\"NVIDIA_API_KEY\",),\n base_url_env_var=\"NVIDIA_BASE_URL\",\n ),\n \"opencode-zen\": ProviderConfig(\n id=\"opencode-zen\",\n name=\"OpenCode Zen\",\n auth_type=\"api_key\",\n inference_base_url=\"https://opencode.ai/zen/v1\",\n api_key_env_vars=(\"OPENCODE_ZEN_API_KEY\",),\n base_url_env_var=\"OPENCODE_ZEN_BASE_URL\",\n ),\n \"opencode-go\": ProviderConfig(\n id=\"opencode-go\",\n name=\"OpenCode Go\",\n auth_type=\"api_key\",\n # OpenCode Go mixes API surfaces by model:\n # - GLM / Kimi use OpenAI-compatible chat completions under /v1\n # - MiniMax models use Anthropic Messages under /v1/messages\n # - Qwen 3.7 uses Anthropic Messages under /v1/messages\n # Keep the provider base at /v1 and select api_mode per-model.\n inference_base_url=\"https://opencode.ai/zen/go/v1\",\n api_key_env_vars=(\"OPENCODE_GO_API_KEY\",),\n base_url_env_var=\"OPENCODE_GO_BASE_URL\",\n ),\n \"kilocode\": ProviderConfig(\n id=\"kilocode\",\n name=\"Kilo Code\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.kilo.ai/api/gateway\",\n api_key_env_vars=(\"KILOCODE_API_KEY\",),\n base_url_env_var=\"KILOCODE_BASE_URL\",\n ),\n \"huggingface\": ProviderConfig(\n id=\"huggingface\",\n name=\"Hugging Face\",\n auth_type=\"api_key\",\n inference_base_url=\"https://router.huggingface.co/v1\",\n api_key_env_vars=(\"HF_TOKEN\",),\n base_url_env_var=\"HF_BASE_URL\",\n ),\n \"xiaomi\": ProviderConfig(\n id=\"xiaomi\",\n name=\"Xiaomi MiMo\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.xiaomimimo.com/v1\",\n api_key_env_vars=(\"XIAOMI_API_KEY\",),\n base_url_env_var=\"XIAOMI_BASE_URL\",\n ),\n \"tencent-tokenhub\": ProviderConfig(\n id=\"tencent-tokenhub\",\n name=\"Tencent TokenHub\",\n auth_type=\"api_key\",\n inference_base_url=\"https://tokenhub.tencentmaas.com/v1\",\n api_key_env_vars=(\"TOKENHUB_API_KEY\",),\n base_url_env_var=\"TOKENHUB_BASE_URL\",\n ),\n \"ollama-cloud\": ProviderConfig(\n id=\"ollama-cloud\",\n name=\"Ollama Cloud\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_OLLAMA_CLOUD_BASE_URL,\n api_key_env_vars=(\"OLLAMA_API_KEY\",),\n base_url_env_var=\"OLLAMA_BASE_URL\",\n ),\n \"bedrock\": ProviderConfig(\n id=\"bedrock\",\n name=\"AWS Bedrock\",\n auth_type=\"aws_sdk\",\n inference_base_url=\"https://bedrock-runtime.us-east-1.amazonaws.com\",\n api_key_env_vars=(),\n base_url_env_var=\"BEDROCK_BASE_URL\",\n ),\n \"azure-foundry\": ProviderConfig(\n id=\"azure-foundry\",\n name=\"Azure Foundry\",\n auth_type=\"api_key\",\n inference_base_url=\"\", # User-provided endpoint\n api_key_env_vars=(\"AZURE_FOUNDRY_API_KEY\",),\n base_url_env_var=\"AZURE_FOUNDRY_BASE_URL\",\n ),\n}\n\n# Auto-extend PROVIDER_REGISTRY with any api-key provider registered in\n# providers/ that is not already declared above. New providers only need a\n# plugins/model-providers/<name>/ plugin — no edits to this file required.\ntry:\n from providers import list_providers as _list_providers_for_registry\n for _pp in _list_providers_for_registry():\n if _pp.name in PROVIDER_REGISTRY:\n continue\n if _pp.auth_type != \"api_key\" or not _pp.env_vars:\n continue\n # Skip providers that need custom token resolution or are special-cased\n # in resolve_provider() (copilot/kimi/zai have bespoke token refresh;\n # openrouter/custom are aggregator/user-supplied and handled outside\n # the registry — adding them here breaks runtime_provider resolution\n # that relies on `openrouter not in PROVIDER_REGISTRY`).\n if _pp.name in {\"copilot\", \"kimi-coding\", \"kimi-coding-cn\", \"zai\", \"openrouter\", \"custom\"}:\n continue\n _api_key_vars = tuple(v for v in _pp.env_vars if not v.endswith(\"_BASE_URL\") and not v.endswith(\"_URL\"))\n _base_url_var = next((v for v in _pp.env_vars if v.endswith(\"_BASE_URL\") or v.endswith(\"_URL\")), None)\n PROVIDER_REGISTRY[_pp.name] = ProviderConfig(\n id=_pp.name,\n name=_pp.display_name or _pp.name,\n auth_type=\"api_key\",\n inference_base_url=_pp.base_url,\n api_key_env_vars=_api_key_vars or _pp.env_vars,\n base_url_env_var=_base_url_var or \"\",\n )\n # Also register aliases so resolve_provider() resolves them\n for _alias in _pp.aliases:\n if _alias not in PROVIDER_REGISTRY:\n PROVIDER_REGISTRY[_alias] = PROVIDER_REGISTRY[_pp.name]\nexcept Exception:\n pass\n\n\n# =============================================================================\n# Anthropic Key Helper\n# =============================================================================\n\ndef get_anthropic_key() -> str:\n \"\"\"Return the first usable Anthropic credential, or ``\"\"``.\n\n Checks both the ``.env`` file (via ``get_env_value``) and the process\n environment (``os.getenv``). The fallback order mirrors the\n ``PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars`` tuple:\n\n ANTHROPIC_API_KEY -> ANTHROPIC_TOKEN -> CLAUDE_CODE_OAUTH_TOKEN\n \"\"\"\n from arcen_cli.config import get_env_value\n\n for var in PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars:\n value = get_env_value(var) or os.getenv(var, \"\")\n if value:\n return value\n return \"\"\n\n\n# =============================================================================\n# Kimi Code Endpoint Detection\n# =============================================================================\n\n# Kimi Code (kimi.com/code) issues keys prefixed \"sk-kimi-\" that only work\n# on api.kimi.com/coding. Legacy keys from platform.moonshot.ai work on\n# api.moonshot.ai/v1 (the old default). Auto-detect when user hasn't set\n# KIMI_BASE_URL explicitly.\n#\n# Note: the base URL intentionally has NO /v1 suffix. The /coding endpoint\n# speaks the Anthropic Messages protocol, and the anthropic SDK appends\n# \"/v1/messages\" internally — so \"/coding\" + SDK suffix → \"/coding/v1/messages\"\n# (the correct target). Using \"/coding/v1\" here would produce\n# \"/coding/v1/v1/messages\" (a 404).\nKIMI_CODE_BASE_URL = \"https://api.kimi.com/coding\"\n\n\ndef _resolve_kimi_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Kimi base URL based on the API key prefix.\n\n If the user has explicitly set KIMI_BASE_URL, that always wins.\n Otherwise, sk-kimi- prefixed keys route to api.kimi.com/coding/v1.\n \"\"\"\n if env_override:\n return env_override\n # No key → nothing to infer from. Return default without inspecting.\n if not api_key:\n return default_url\n if api_key.startswith(\"sk-kimi-\"):\n return KIMI_CODE_BASE_URL\n return default_url\n\n\n\n_PLACEHOLDER_SECRET_VALUES = {\n \"*\",\n \"**\",\n \"***\",\n \"changeme\",\n \"your_api_key\",\n \"your_api_key_here\",\n \"your-api-key\",\n \"placeholder\",\n \"example\",\n \"dummy\",\n \"null\",\n \"none\",\n}\n\n\ndef has_usable_secret(value: Any, *, min_length: int = 4) -> bool:\n \"\"\"Return True when a configured secret looks usable, not empty/placeholder.\"\"\"\n if not isinstance(value, str):\n return False\n cleaned = value.strip()\n if len(cleaned) < min_length:\n return False\n if cleaned.lower() in _PLACEHOLDER_SECRET_VALUES:\n return False\n return True\n\n\ndef _resolve_api_key_provider_secret(\n provider_id: str, pconfig: ProviderConfig\n) -> tuple[str, str]:\n \"\"\"Resolve an API-key provider's token and indicate where it came from.\"\"\"\n if provider_id == \"copilot\":\n # Use the dedicated copilot auth module for proper token validation\n try:\n from arcen_cli.copilot_auth import resolve_copilot_token, get_copilot_api_token\n token, source = resolve_copilot_token()\n if token:\n return get_copilot_api_token(token), source\n except ValueError as exc:\n logger.warning(\"Copilot token validation failed: %s\", exc)\n except Exception:\n pass\n return \"\", \"\"\n\n from arcen_cli.config import get_env_value\n for env_var in pconfig.api_key_env_vars:\n # Check both os.environ and ~/.arcen/.env file\n val = (get_env_value(env_var) or \"\").strip()\n if has_usable_secret(val):\n return val, env_var\n\n # Fallback: try credential pool (e.g. zai key stored via auth.json)\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(provider_id)\n if pool and pool.has_credentials():\n entry = pool.peek()\n if entry:\n key = getattr(entry, \"access_token\", \"\") or getattr(entry, \"runtime_api_key\", \"\")\n key = str(key).strip()\n if has_usable_secret(key):\n return key, f\"credential_pool:{provider_id}\"\n except Exception:\n pass\n\n return \"\", \"\"\n\n\n# =============================================================================\n# Z.AI Endpoint Detection\n# =============================================================================\n\n# Z.AI has separate billing for general vs coding plans, and global vs China\n# endpoints. A key that works on one may return \"Insufficient balance\" on\n# another. We probe at setup time and store the working endpoint.\n# Each entry lists candidate models to try in order — newer coding plan accounts\n# may only have access to recent models (glm-5.1, glm-5v-turbo) while older\n# ones still use glm-4.7.\n\nZAI_ENDPOINTS = [\n # (id, base_url, probe_models, label)\n (\"global\", \"https://api.z.ai/api/paas/v4\", [\"glm-5\"], \"Global\"),\n (\"cn\", \"https://open.bigmodel.cn/api/paas/v4\", [\"glm-5\"], \"China\"),\n (\"coding-global\", \"https://api.z.ai/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"Global (Coding Plan)\"),\n (\"coding-cn\", \"https://open.bigmodel.cn/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"China (Coding Plan)\"),\n]\n\n\ndef detect_zai_endpoint(api_key: str, timeout: float = 8.0) -> Optional[Dict[str, str]]:\n \"\"\"Probe z.ai endpoints to find one that accepts this API key.\n\n Returns {\"id\": ..., \"base_url\": ..., \"model\": ..., \"label\": ...} for the\n first working endpoint, or None if all fail. For endpoints with multiple\n candidate models, tries each in order and returns the first that succeeds.\n \"\"\"\n for ep_id, base_url, probe_models, label in ZAI_ENDPOINTS:\n for model in probe_models:\n try:\n resp = httpx.post(\n f\"{base_url}/chat/completions\",\n headers={\n \"Authorization\": f\"Bearer {api_key}\",\n \"Content-Type\": \"application/json\",\n },\n json={\n \"model\": model,\n \"stream\": False,\n \"max_tokens\": 1,\n \"messages\": [{\"role\": \"user\", \"content\": \"ping\"}],\n },\n timeout=timeout,\n )\n if resp.status_code == 200:\n logger.debug(\"Z.AI endpoint probe: %s (%s) model=%s OK\", ep_id, base_url, model)\n return {\n \"id\": ep_id,\n \"base_url\": base_url,\n \"model\": model,\n \"label\": label,\n }\n logger.debug(\"Z.AI endpoint probe: %s model=%s returned %s\", ep_id, model, resp.status_code)\n except Exception as exc:\n logger.debug(\"Z.AI endpoint probe: %s model=%s failed: %s\", ep_id, model, exc)\n return None\n\n\ndef _resolve_zai_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Z.AI base URL by probing endpoints.\n\n If the user has explicitly set GLM_BASE_URL, that always wins.\n Otherwise, probe the candidate endpoints to find one that accepts the\n key. The detected endpoint is cached in provider state (auth.json) keyed\n on a hash of the API key so subsequent starts skip the probe.\n \"\"\"\n if env_override:\n return env_override\n\n # No API key set → don't probe (would fire N×M HTTPS requests with an\n # empty Bearer token, all returning 401). This path is hit during\n # auxiliary-client auto-detection when the user has no Z.AI credentials\n # at all — the caller discards the result immediately, so the probe is\n # pure latency for every AIAgent construction.\n if not api_key:\n return default_url\n\n # Check provider-state cache for a previously-detected endpoint.\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"zai\") or {}\n cached = state.get(\"detected_endpoint\")\n if isinstance(cached, dict) and cached.get(\"base_url\"):\n key_hash = cached.get(\"key_hash\", \"\")\n if key_hash == hashlib.sha256(api_key.encode()).hexdigest()[:16]:\n logger.debug(\"Z.AI: using cached endpoint %s\", cached[\"base_url\"])\n return cached[\"base_url\"]\n\n # Probe — may take up to ~8s per endpoint.\n detected = detect_zai_endpoint(api_key)\n if detected and detected.get(\"base_url\"):\n # Persist the detection result keyed on the API key hash.\n key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:16]\n state[\"detected_endpoint\"] = {\n \"base_url\": detected[\"base_url\"],\n \"endpoint_id\": detected.get(\"id\", \"\"),\n \"model\": detected.get(\"model\", \"\"),\n \"label\": detected.get(\"label\", \"\"),\n \"key_hash\": key_hash,\n }\n _save_provider_state(auth_store, \"zai\", state)\n logger.info(\"Z.AI: auto-detected endpoint %s (%s)\", detected[\"label\"], detected[\"base_url\"])\n return detected[\"base_url\"]\n\n logger.debug(\"Z.AI: probe failed, falling back to default %s\", default_url)\n return default_url\n\n\n# =============================================================================\n# Error Types\n# =============================================================================\n\n# Error code marking upstream rate-limit / usage-quota exhaustion (HTTP 429).\n# Such failures are transient and re-authenticating cannot resolve them, so\n# they must be kept distinct from missing/expired-credential errors.\nCODEX_RATE_LIMITED_CODE = \"codex_rate_limited\"\n\n\nclass AuthError(RuntimeError):\n \"\"\"Structured auth error with UX mapping hints.\"\"\"\n\n def __init__(\n self,\n message: str,\n *,\n provider: str = \"\",\n code: Optional[str] = None,\n relogin_required: bool = False,\n ) -> None:\n super().__init__(message)\n self.provider = provider\n self.code = code\n self.relogin_required = relogin_required\n\n\ndef is_rate_limited_auth_error(error: Exception) -> bool:\n \"\"\"True when an :class:`AuthError` represents upstream rate-limiting / quota\n exhaustion rather than missing or invalid credentials.\n\n These failures are transient — re-authenticating cannot resolve them — so\n callers should surface a \"retry later\" notice and prefer a fallback chain\n instead of prompting the operator to run ``arcen auth``.\n \"\"\"\n return (\n isinstance(error, AuthError)\n and not error.relogin_required\n and error.code == CODEX_RATE_LIMITED_CODE\n )\n\n\ndef _parse_retry_after_seconds(headers: Any) -> Optional[int]:\n \"\"\"Best-effort parse of a ``Retry-After`` header into whole seconds.\n\n Supports the delta-seconds form (e.g. ``\"120\"``). HTTP-date forms and\n missing/unparseable values return ``None`` rather than guessing.\n \"\"\"\n if headers is None:\n return None\n try:\n raw = headers.get(\"retry-after\")\n except Exception:\n return None\n if raw is None:\n return None\n try:\n seconds = int(str(raw).strip())\n except (TypeError, ValueError):\n return None\n return seconds if seconds >= 0 else None\n\n\ndef format_auth_error(error: Exception) -> str:\n \"\"\"Map auth failures to concise user-facing guidance.\"\"\"\n if not isinstance(error, AuthError):\n return str(error)\n\n # Rate-limit / quota errors are not credential problems — never append the\n # \"re-authenticate\" remediation, which would mislead the operator.\n if is_rate_limited_auth_error(error):\n return str(error)\n\n if error.relogin_required:\n return f\"{error} Run `arcen model` to re-authenticate.\"\n\n if error.code == \"subscription_required\":\n if error.provider == \"removed_provider\":\n return _format_removed_provider_entitlement_auth_error(error)\n return \"No active paid subscription found. Please purchase/activate a subscription, then retry.\"\n\n if error.code == \"insufficient_credits\":\n if error.provider == \"removed_provider\":\n return _format_removed_provider_entitlement_auth_error(error)\n return \"Subscription credits are exhausted. Top up/renew credits, then retry.\"\n\n if error.code in {\"subscription_expired\", \"no_usable_credits\", \"account_missing\"}:\n if error.provider == \"removed_provider\":\n return _format_removed_provider_entitlement_auth_error(error)\n\n if error.code == \"temporarily_unavailable\":\n return f\"{error} Please retry in a few seconds.\"\n\n return str(error)\n\n\ndef _format_removed_provider_entitlement_auth_error(error: AuthError) -> str:\n try:\n from arcen_cli.removed_provider_account import (\n format_removed_provider_portal_entitlement_message,\n get_removed_provider_portal_account_info,\n )\n\n account_info = get_removed_provider_portal_account_info(force_fresh=True)\n message = format_removed_provider_portal_entitlement_message(\n account_info,\n capability=\"Removed provider model access\",\n )\n if message:\n return message\n except Exception:\n pass\n return f\"{error} Check credits or billing in Removed provider Portal, then retry.\"\n\n\ndef _token_fingerprint(token: Any) -> Optional[str]:\n \"\"\"Return a short hash fingerprint for telemetry without leaking token bytes.\"\"\"\n if not isinstance(token, str):\n return None\n cleaned = token.strip()\n if not cleaned:\n return None\n return hashlib.sha256(cleaned.encode(\"utf-8\")).hexdigest()[:12]\n\n\ndef _oauth_trace_enabled() -> bool:\n raw = os.getenv(\"ARCEN_OAUTH_TRACE\", \"\").strip().lower()\n return raw in {\"1\", \"true\", \"yes\", \"on\"}\n\n\ndef _oauth_trace(event: str, *, sequence_id: Optional[str] = None, **fields: Any) -> None:\n if not _oauth_trace_enabled():\n return\n payload: Dict[str, Any] = {\"event\": event}\n if sequence_id:\n payload[\"sequence_id\"] = sequence_id\n payload.update(fields)\n logger.info(\"oauth_trace %s\", json.dumps(payload, sort_keys=True, ensure_ascii=False))\n\n\n# =============================================================================\n# Auth Store — persistence layer for ~/.arcen/auth.json\n# =============================================================================\n\ndef _auth_file_path() -> Path:\n path = get_arcen_home() / \"auth.json\"\n # Seat belt: if pytest is running and ARCEN_HOME resolves to the real\n # user's auth store, refuse rather than silently corrupt it. This catches\n # tests that forgot to monkeypatch ARCEN_HOME, tests invoked without the\n # hermetic conftest, or sandbox escapes via threads/subprocesses. In\n # production (no PYTEST_CURRENT_TEST) this is a single dict lookup.\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_auth = (Path.home() / \".arcen\" / \"auth.json\").resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_auth:\n raise RuntimeError(\n f\"Refusing to touch real user auth store during test run: {path}. \"\n \"Set ARCEN_HOME to a tmp_path in your test fixture, or run \"\n \"via scripts/run_tests.sh for hermetic CI-parity env.\"\n )\n return path\n\n\ndef _global_auth_file_path() -> Optional[Path]:\n \"\"\"Return the global-root auth.json when the process is in profile mode.\n\n Returns ``None`` when the profile and global root resolve to the same\n directory (classic mode, or custom ARCEN_HOME that is not a profile).\n Used by read-only fallback paths so providers authed at the root are\n visible to profile processes that haven't configured them locally.\n\n See issue #18594 follow-up (credential_pool shadowing).\n \"\"\"\n try:\n from arcen_constants import get_default_arcen_root\n global_root = get_default_arcen_root()\n except Exception:\n return None\n profile_home = get_arcen_home()\n try:\n if profile_home.resolve(strict=False) == global_root.resolve(strict=False):\n return None\n except Exception:\n if profile_home == global_root:\n return None\n # No pytest seat belt here: this is a pure read-only path, and\n # ``_load_global_auth_store()`` wraps the read in a try/except so an\n # unreadable global file can never break the profile process. The\n # write-side seat belt still lives on ``_auth_file_path()`` where it\n # belongs (that's what protects the real user's auth store from being\n # corrupted by a mis-configured test).\n return global_root / \"auth.json\"\n\n\ndef _load_global_auth_store() -> Dict[str, Any]:\n \"\"\"Load the global-root auth store (read-only fallback).\n\n Returns an empty dict when no global fallback exists (classic mode,\n or the global auth.json is absent). Never raises on missing file.\n\n Seat belt: under pytest, refuses to read the real user's\n ``~/.arcen/auth.json`` even when ARCEN_HOME is set to a profile\n path. The hermetic conftest does not redirect ``HOME``, so\n ``get_default_arcen_root()`` for a profile-shaped ARCEN_HOME can\n still resolve to the real user's home on a dev machine. That would\n leak real credentials into tests. This guard uses the unmodified\n ``HOME`` env var (what ``os.path.expanduser('~')`` would resolve to),\n not ``Path.home()``, because ``Path.home`` is sometimes monkeypatched\n by fixtures that want to relocate the global root to a tmp path.\n \"\"\"\n global_path = _global_auth_file_path()\n if global_path is None or not global_path.exists():\n return {}\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_env = os.environ.get(\"HOME\", \"\")\n if real_home_env:\n real_root = Path(real_home_env) / \".arcen\" / \"auth.json\"\n try:\n if global_path.resolve(strict=False) == real_root.resolve(strict=False):\n return {}\n except Exception:\n pass\n try:\n return _load_auth_store(global_path)\n except Exception:\n # A malformed global store must not break profile reads. The\n # profile's own auth store is still authoritative.\n return {}\n\n\ndef _auth_lock_path() -> Path:\n return _auth_file_path().with_suffix(\".lock\")\n\n\n_auth_lock_holder = threading.local()\n\n\n@contextmanager\ndef _file_lock(\n lock_path: Path,\n holder: threading.local,\n timeout_seconds: float,\n timeout_message: str,\n):\n \"\"\"Cross-process advisory flock helper.\n\n Reentrant per-thread via ``holder.depth``. Falls back to a depth-only\n guard when neither ``fcntl`` nor ``msvcrt`` is available (rare).\n Callers supply their own ``threading.local`` so independent locks\n (e.g. profile auth.json vs shared Removed provider store) don't share reentrancy\n state — that would let one lock's reentrant acquisition silently skip\n the other's kernel-level flock.\n \"\"\"\n if getattr(holder, \"depth\", 0) > 0:\n holder.depth += 1\n try:\n yield\n finally:\n holder.depth -= 1\n return\n\n lock_path.parent.mkdir(parents=True, exist_ok=True)\n\n if fcntl is None and msvcrt is None:\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n return\n\n # On Windows, msvcrt.locking needs the file to have content and the\n # file pointer at position 0. Ensure the lock file has at least 1 byte.\n if msvcrt and (not lock_path.exists() or lock_path.stat().st_size == 0):\n lock_path.write_text(\" \", encoding=\"utf-8\")\n\n with lock_path.open(\"r+\" if msvcrt else \"a+\", encoding=\"utf-8\") as lock_file:\n deadline = time.monotonic() + max(1.0, timeout_seconds)\n while True:\n try:\n if fcntl:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)\n else:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_NBLCK, 1)\n break\n except (BlockingIOError, OSError, PermissionError):\n if time.monotonic() >= deadline:\n raise TimeoutError(timeout_message)\n time.sleep(0.05)\n\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n if fcntl:\n try:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_UN)\n except (OSError, IOError):\n pass\n elif msvcrt:\n try:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_UNLCK, 1)\n except (OSError, IOError):\n pass\n\n\n@contextmanager\ndef _auth_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-process advisory lock for auth.json reads+writes. Reentrant.\n\n Lock ordering invariant: when this lock is held together with\n ``_removed_provider_shared_store_lock``, acquire ``_auth_store_lock`` FIRST\n (outer) and the shared Removed provider lock SECOND (inner). All runtime\n refresh paths follow this order; violating it risks deadlock\n against a concurrent import on the shared store.\n \"\"\"\n with _file_lock(\n _auth_lock_path(),\n _auth_lock_holder,\n timeout_seconds,\n \"Timed out waiting for auth store lock\",\n ):\n yield\n\n\ndef _load_auth_store(auth_file: Optional[Path] = None) -> Dict[str, Any]:\n auth_file = auth_file or _auth_file_path()\n if not auth_file.exists():\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n try:\n raw = json.loads(auth_file.read_text())\n except Exception as exc:\n corrupt_path = auth_file.with_suffix(\".json.corrupt\")\n try:\n import shutil\n shutil.copy2(auth_file, corrupt_path)\n except Exception:\n pass\n logger.warning(\n \"auth: failed to parse %s (%s) — starting with empty store. \"\n \"Corrupt file preserved at %s\",\n auth_file, exc, corrupt_path,\n )\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n if isinstance(raw, dict) and (\n isinstance(raw.get(\"providers\"), dict)\n or isinstance(raw.get(\"credential_pool\"), dict)\n ):\n raw.setdefault(\"providers\", {})\n return raw\n\n # Migrate from PR's \"systems\" format if present\n if isinstance(raw, dict) and isinstance(raw.get(\"systems\"), dict):\n systems = raw[\"systems\"]\n providers = {}\n if \"removed_provider_portal\" in systems:\n providers[\"removed_provider\"] = systems[\"removed_provider_portal\"]\n return {\"version\": AUTH_STORE_VERSION, \"providers\": providers,\n \"active_provider\": \"removed_provider\" if providers else None}\n\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n\ndef _save_auth_store(auth_store: Dict[str, Any]) -> Path:\n auth_file = _auth_file_path()\n auth_file.parent.mkdir(parents=True, exist_ok=True)\n # Tighten parent dir to 0o700 so siblings can't traverse to creds.\n # No-op on Windows (POSIX mode bits not enforced); ignore failures.\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_file)\n auth_store[\"version\"] = AUTH_STORE_VERSION\n auth_store[\"updated_at\"] = datetime.now(timezone.utc).isoformat()\n payload = json.dumps(auth_store, indent=2) + \"\\n\"\n tmp_path = auth_file.with_name(f\"{auth_file.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n try:\n # Create with 0o600 atomically via os.open(O_EXCL) + fdopen to close\n # the TOCTOU window where default umask (often 0o644) briefly exposed\n # OAuth tokens to other local users between open() and chmod().\n # Mirrors agent/google_oauth.py (#19673) and tools/mcp_oauth.py (#21148).\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as handle:\n handle.write(payload)\n handle.flush()\n os.fsync(handle.fileno())\n atomic_replace(tmp_path, auth_file)\n try:\n dir_fd = os.open(str(auth_file.parent), os.O_RDONLY)\n except OSError:\n dir_fd = None\n if dir_fd is not None:\n try:\n os.fsync(dir_fd)\n finally:\n os.close(dir_fd)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n # Restrict file permissions to owner only\n try:\n auth_file.chmod(stat.S_IRUSR | stat.S_IWUSR)\n except OSError:\n pass\n return auth_file\n\n\ndef _load_provider_state(auth_store: Dict[str, Any], provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return a provider's persisted state.\n\n In profile mode, falls back to the global-root ``auth.json`` when the\n profile has no entry for ``provider_id``. This mirrors the per-provider\n shadowing already used by ``read_credential_pool``: workers spawned in a\n profile can see providers (e.g. ``removed_provider``) that were only authenticated at\n global scope. Once the user runs ``arcen auth login <provider>`` inside\n the profile, the profile state fully shadows the global state on the next\n read. See issue #18594 follow-up.\n \"\"\"\n providers = auth_store.get(\"providers\")\n if isinstance(providers, dict):\n state = providers.get(provider_id)\n if isinstance(state, dict):\n return dict(state)\n\n # Read-only fallback to the global-root auth store (profile mode only;\n # returns empty dict in classic mode so this is a no-op).\n global_store = _load_global_auth_store()\n if global_store:\n global_providers = global_store.get(\"providers\")\n if isinstance(global_providers, dict):\n global_state = global_providers.get(provider_id)\n if isinstance(global_state, dict):\n return dict(global_state)\n return None\n\n\ndef _save_provider_state(auth_store: Dict[str, Any], provider_id: str, state: Dict[str, Any]) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n auth_store[\"active_provider\"] = provider_id\n\n\ndef _store_provider_state(\n auth_store: Dict[str, Any],\n provider_id: str,\n state: Dict[str, Any],\n *,\n set_active: bool = True,\n) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n if set_active:\n auth_store[\"active_provider\"] = provider_id\n\n\ndef is_known_auth_provider(provider_id: str) -> bool:\n normalized = (provider_id or \"\").strip().lower()\n return normalized in PROVIDER_REGISTRY or normalized in SERVICE_PROVIDER_NAMES\n\n\ndef get_auth_provider_display_name(provider_id: str) -> str:\n normalized = (provider_id or \"\").strip().lower()\n if normalized in PROVIDER_REGISTRY:\n return PROVIDER_REGISTRY[normalized].name\n return SERVICE_PROVIDER_NAMES.get(normalized, provider_id)\n\n\ndef read_credential_pool(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Return the persisted credential pool, or one provider slice.\n\n In profile mode, the profile's credential pool is authoritative. If a\n provider has no entries in the profile, entries from the global-root\n ``auth.json`` are used as a read-only fallback — so workers spawned in a\n profile can see providers that were only authenticated at global scope.\n\n Profile entries always win: the global fallback only applies per-provider\n when the profile has zero entries for that provider. Once the user runs\n ``arcen auth add <provider>`` inside the profile, profile entries\n fully shadow global for that provider on the next read.\n\n Writes always go to the profile (``write_credential_pool`` is unchanged).\n See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n\n global_pool: Dict[str, Any] = {}\n global_store = _load_global_auth_store()\n maybe_global_pool = global_store.get(\"credential_pool\") if global_store else None\n if isinstance(maybe_global_pool, dict):\n global_pool = maybe_global_pool\n\n if provider_id is None:\n merged = dict(pool)\n for gp_key, gp_entries in global_pool.items():\n if not isinstance(gp_entries, list) or not gp_entries:\n continue\n # Per-provider shadowing: profile wins whenever it has ANY entries.\n existing = merged.get(gp_key)\n if isinstance(existing, list) and existing:\n continue\n merged[gp_key] = list(gp_entries)\n return merged\n\n provider_entries = pool.get(provider_id)\n if isinstance(provider_entries, list) and provider_entries:\n return list(provider_entries)\n # Profile has no entries for this provider — fall back to global.\n global_entries = global_pool.get(provider_id)\n return list(global_entries) if isinstance(global_entries, list) else []\n\n\ndef write_credential_pool(provider_id: str, entries: List[Dict[str, Any]]) -> Path:\n \"\"\"Persist one provider's credential pool under auth.json.\n\n This is the final disk-boundary guard for borrowed/reference-only\n credentials. Callers may pass raw dictionaries, so sanitize here even when\n ``PooledCredential.to_dict()`` already did the same work upstream.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n pool[provider_id] = [\n sanitize_borrowed_credential_payload(entry, provider_id)\n if isinstance(entry, dict) else entry\n for entry in entries\n ]\n return _save_auth_store(auth_store)\n\n\ndef suppress_credential_source(provider_id: str, source: str) -> None:\n \"\"\"Mark a credential source as suppressed so it won't be re-seeded.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.setdefault(\"suppressed_sources\", {})\n provider_list = suppressed.setdefault(provider_id, [])\n if source not in provider_list:\n provider_list.append(source)\n _save_auth_store(auth_store)\n\n\ndef is_source_suppressed(provider_id: str, source: str) -> bool:\n \"\"\"Check if a credential source has been suppressed by the user.\"\"\"\n try:\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\", {})\n return source in suppressed.get(provider_id, [])\n except Exception:\n return False\n\n\ndef unsuppress_credential_source(provider_id: str, source: str) -> bool:\n \"\"\"Clear a suppression marker so the source will be re-seeded on the next load.\n\n Returns True if a marker was cleared, False if no marker existed.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\")\n if not isinstance(suppressed, dict):\n return False\n provider_list = suppressed.get(provider_id)\n if not isinstance(provider_list, list) or source not in provider_list:\n return False\n provider_list.remove(source)\n if not provider_list:\n suppressed.pop(provider_id, None)\n if not suppressed:\n auth_store.pop(\"suppressed_sources\", None)\n _save_auth_store(auth_store)\n return True\n\n\ndef get_provider_auth_state(provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return persisted auth state for a provider, or None.\n\n In profile mode, ``_load_provider_state`` already falls back to the\n global-root ``auth.json`` per-provider when the profile has no entry —\n so this is now a thin convenience wrapper. Profile state always wins\n when present. Writes (``_save_auth_store`` / ``persist_*_credentials``)\n are unchanged — they still target the profile only. This mirrors\n ``read_credential_pool``'s per-provider shadowing semantics so that\n ``_seed_from_singletons`` can reseed a profile's credential pool from\n global-scope provider state (e.g. a globally-authenticated Anthropic\n OAuth or Removed provider device-code session). See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n return _load_provider_state(auth_store, provider_id)\n\n\ndef get_active_provider() -> Optional[str]:\n \"\"\"Return the currently active provider ID from auth store.\"\"\"\n auth_store = _load_auth_store()\n return auth_store.get(\"active_provider\")\n\n\ndef is_provider_explicitly_configured(provider_id: str) -> bool:\n \"\"\"Return True only if the user has explicitly configured this provider.\n\n Checks:\n 1. active_provider in auth.json matches\n 2. model.provider in config.yaml matches\n 3. Provider-specific env vars are set (e.g. ANTHROPIC_API_KEY)\n\n This is used to gate auto-discovery of external credentials (e.g.\n Claude Code's ~/.claude/.credentials.json) so they are never used\n without the user's explicit choice. See PR #4210 for the same\n pattern applied to the setup wizard gate.\n \"\"\"\n normalized = (provider_id or \"\").strip().lower()\n\n # 1. Check auth.json active_provider\n try:\n auth_store = _load_auth_store()\n active = (auth_store.get(\"active_provider\") or \"\").strip().lower()\n if active and active == normalized:\n return True\n except Exception:\n pass\n\n # 2. Check config.yaml model.provider\n try:\n from arcen_cli.config import load_config\n cfg = load_config()\n model_cfg = cfg.get(\"model\")\n if isinstance(model_cfg, dict):\n cfg_provider = (model_cfg.get(\"provider\") or \"\").strip().lower()\n if cfg_provider == normalized:\n return True\n except Exception:\n pass\n\n # 3. Check provider-specific env vars\n # Exclude CLAUDE_CODE_OAUTH_TOKEN — it's set by Claude Code itself,\n # not by the user explicitly configuring anthropic in Arcen.\n _IMPLICIT_ENV_VARS = {\"CLAUDE_CODE_OAUTH_TOKEN\"}\n pconfig = PROVIDER_REGISTRY.get(normalized)\n if pconfig and pconfig.auth_type == \"api_key\":\n for env_var in pconfig.api_key_env_vars:\n if env_var in _IMPLICIT_ENV_VARS:\n continue\n if has_usable_secret(os.getenv(env_var, \"\")):\n return True\n\n return False\n\n\ndef clear_provider_auth(provider_id: Optional[str] = None) -> bool:\n \"\"\"\n Clear auth state for a provider. Used by `arcen logout`.\n If provider_id is None, clears the active provider.\n Returns True if something was cleared.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n target = provider_id or auth_store.get(\"active_provider\")\n if not target:\n return False\n\n providers = auth_store.get(\"providers\", {})\n if not isinstance(providers, dict):\n providers = {}\n auth_store[\"providers\"] = providers\n\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n\n cleared = False\n if target in providers:\n del providers[target]\n cleared = True\n if target in pool:\n del pool[target]\n cleared = True\n\n if auth_store.get(\"active_provider\") == target:\n auth_store[\"active_provider\"] = None\n cleared = True\n\n if not cleared:\n return False\n _save_auth_store(auth_store)\n return True\n\n\ndef deactivate_provider() -> None:\n \"\"\"\n Clear active_provider in auth.json without deleting credentials.\n Used when the user switches to a non-OAuth provider (OpenRouter, custom)\n so auto-resolution doesn't keep picking the OAuth provider.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = None\n _save_auth_store(auth_store)\n\n\n# =============================================================================\n# Provider Resolution — picks which provider to use\n# =============================================================================\n\n\ndef _get_config_hint_for_unknown_provider(provider_name: str) -> str:\n \"\"\"Return a helpful hint string when provider resolution fails.\n\n Checks for common config.yaml mistakes (malformed custom_providers, etc.)\n and returns a human-readable diagnostic, or empty string if nothing found.\n \"\"\"\n try:\n from arcen_cli.config import validate_config_structure\n issues = validate_config_structure()\n if not issues:\n return \"\"\n\n lines = [\"Config issue detected — run 'arcen doctor' for full diagnostics:\"]\n for ci in issues:\n prefix = \"ERROR\" if ci.severity == \"error\" else \"WARNING\"\n lines.append(f\" [{prefix}] {ci.message}\")\n # Show first line of hint\n first_hint = ci.hint.splitlines()[0] if ci.hint else \"\"\n if first_hint:\n lines.append(f\" → {first_hint}\")\n return \"\\n\".join(lines)\n except Exception:\n return \"\"\n\n\ndef resolve_provider(\n requested: Optional[str] = None,\n *,\n explicit_api_key: Optional[str] = None,\n explicit_base_url: Optional[str] = None,\n) -> str:\n \"\"\"\n Determine which inference provider to use.\n\n Priority (when requested=\"auto\" or None):\n 1. active_provider in auth.json with valid credentials\n 2. Explicit CLI api_key/base_url -> \"openrouter\"\n 3. OPENAI_API_KEY or OPENROUTER_API_KEY env vars -> \"openrouter\"\n 4. Provider-specific API keys (GLM, Kimi, MiniMax) -> that provider\n 5. Fallback: \"openrouter\"\n \"\"\"\n normalized = (requested or \"auto\").strip().lower()\n\n # Normalize provider aliases\n _PROVIDER_ALIASES = {\n \"glm\": \"zai\", \"z-ai\": \"zai\", \"z.ai\": \"zai\", \"zhipu\": \"zai\",\n \"google\": \"gemini\", \"google-gemini\": \"gemini\", \"google-ai-studio\": \"gemini\",\n \"x-ai\": \"xai\", \"x.ai\": \"xai\", \"grok\": \"xai\",\n \"xai-oauth\": \"xai-oauth\", \"x-ai-oauth\": \"xai-oauth\",\n \"grok-oauth\": \"xai-oauth\", \"xai-grok-oauth\": \"xai-oauth\",\n \"kimi\": \"kimi-coding\", \"kimi-for-coding\": \"kimi-coding\", \"moonshot\": \"kimi-coding\",\n \"kimi-cn\": \"kimi-coding-cn\", \"moonshot-cn\": \"kimi-coding-cn\",\n \"step\": \"stepfun\", \"stepfun-coding-plan\": \"stepfun\",\n \"arcee-ai\": \"arcee\", \"arceeai\": \"arcee\",\n \"gmi-cloud\": \"gmi\", \"gmicloud\": \"gmi\",\n \"minimax-china\": \"minimax-cn\", \"minimax_cn\": \"minimax-cn\",\n \"minimax-portal\": \"minimax-oauth\", \"minimax-global\": \"minimax-oauth\", \"minimax_oauth\": \"minimax-oauth\",\n \"alibaba_coding\": \"alibaba-coding-plan\", \"alibaba-coding\": \"alibaba-coding-plan\",\n \"alibaba_coding_plan\": \"alibaba-coding-plan\",\n \"claude\": \"anthropic\", \"claude-code\": \"anthropic\",\n \"github\": \"copilot\", \"github-copilot\": \"copilot\",\n \"github-models\": \"copilot\", \"github-model\": \"copilot\",\n \"github-copilot-acp\": \"copilot-acp\", \"copilot-acp-agent\": \"copilot-acp\",\n \"opencode\": \"opencode-zen\", \"zen\": \"opencode-zen\",\n \"qwen-portal\": \"qwen-oauth\", \"qwen-cli\": \"qwen-oauth\", \"qwen-oauth\": \"qwen-oauth\", \"google-gemini-cli\": \"google-gemini-cli\", \"gemini-cli\": \"google-gemini-cli\", \"gemini-oauth\": \"google-gemini-cli\",\n \"hf\": \"huggingface\", \"hugging-face\": \"huggingface\", \"huggingface-hub\": \"huggingface\",\n \"mimo\": \"xiaomi\", \"xiaomi-mimo\": \"xiaomi\",\n \"tencent\": \"tencent-tokenhub\", \"tokenhub\": \"tencent-tokenhub\",\n \"tencent-cloud\": \"tencent-tokenhub\", \"tencentmaas\": \"tencent-tokenhub\",\n \"aws\": \"bedrock\", \"aws-bedrock\": \"bedrock\", \"amazon-bedrock\": \"bedrock\", \"amazon\": \"bedrock\",\n \"go\": \"opencode-go\", \"opencode-go-sub\": \"opencode-go\",\n \"kilo\": \"kilocode\", \"kilo-code\": \"kilocode\", \"kilo-gateway\": \"kilocode\",\n \"lmstudio\": \"lmstudio\", \"lm-studio\": \"lmstudio\", \"lm_studio\": \"lmstudio\",\n # Local server aliases — route through the generic custom provider\n \"ollama\": \"custom\", \"ollama_cloud\": \"ollama-cloud\",\n \"vllm\": \"custom\", \"llamacpp\": \"custom\",\n \"llama.cpp\": \"custom\", \"llama-cpp\": \"custom\",\n }\n # Extend with aliases declared in plugins/model-providers/<name>/ that aren't already mapped.\n # This keeps providers/ as the single source for new aliases while the\n # hardcoded dict above remains authoritative for existing ones.\n try:\n from providers import list_providers as _lp\n for _pp in _lp():\n for _alias in _pp.aliases:\n if _alias not in _PROVIDER_ALIASES:\n _PROVIDER_ALIASES[_alias] = _pp.name\n except Exception:\n pass\n normalized = _PROVIDER_ALIASES.get(normalized, normalized)\n\n if normalized == \"openrouter\":\n return \"openrouter\"\n if normalized == \"custom\":\n return \"custom\"\n if normalized in PROVIDER_REGISTRY:\n return normalized\n if normalized != \"auto\":\n # Check for common config.yaml issues that cause this error\n _config_hint = _get_config_hint_for_unknown_provider(normalized)\n msg = f\"Unknown provider '{normalized}'.\"\n if _config_hint:\n msg += f\"\\n\\n{_config_hint}\"\n else:\n msg += \" Check 'arcen model' for available providers, or run 'arcen doctor' to diagnose config issues.\"\n raise AuthError(msg, code=\"invalid_provider\")\n\n # Explicit one-off CLI creds always mean openrouter/custom\n if explicit_api_key or explicit_base_url:\n return \"openrouter\"\n\n # Check auth store for an active OAuth provider\n try:\n auth_store = _load_auth_store()\n active = auth_store.get(\"active_provider\")\n if active and active in PROVIDER_REGISTRY:\n status = get_auth_status(active)\n if status.get(\"logged_in\"):\n return active\n except Exception as e:\n logger.debug(\"Could not detect active auth provider: %s\", e)\n\n if has_usable_secret(os.getenv(\"OPENAI_API_KEY\")) or has_usable_secret(os.getenv(\"OPENROUTER_API_KEY\")):\n return \"openrouter\"\n\n # Auto-detect API-key providers by checking their env vars\n for pid, pconfig in PROVIDER_REGISTRY.items():\n if pconfig.auth_type != \"api_key\":\n continue\n # GitHub tokens are commonly present for repo/tool access but should not\n # hijack inference auto-selection unless the user explicitly chooses\n # Copilot/GitHub Models as the provider. LM Studio is a local server\n # whose availability isn't implied by LM_API_KEY presence (it may be\n # offline, and the no-auth setup uses a placeholder value), so it\n # also requires explicit selection.\n if pid in {\"copilot\", \"lmstudio\"}:\n continue\n for env_var in pconfig.api_key_env_vars:\n if has_usable_secret(os.getenv(env_var, \"\")):\n return pid\n\n # AWS Bedrock — detect via boto3 credential chain (IAM roles, SSO, env vars).\n # This runs after API-key providers so explicit keys always win.\n try:\n from agent.bedrock_adapter import has_aws_credentials\n if has_aws_credentials():\n return \"bedrock\"\n except ImportError:\n pass # boto3 not installed — skip Bedrock auto-detection\n\n raise AuthError(\n \"No inference provider configured. Run 'arcen model' to choose a \"\n \"provider and model, or set an API key (OPENROUTER_API_KEY, \"\n \"OPENAI_API_KEY, etc.) in ~/.arcen/.env.\",\n code=\"no_provider_configured\",\n )\n\n\n# =============================================================================\n# Timestamp / TTL helpers\n# =============================================================================\n\ndef _parse_iso_timestamp(value: Any) -> Optional[float]:\n if not isinstance(value, str) or not value:\n return None\n text = value.strip()\n if not text:\n return None\n if text.endswith(\"Z\"):\n text = text[:-1] + \"+00:00\"\n try:\n parsed = datetime.fromisoformat(text)\n except Exception:\n return None\n if parsed.tzinfo is None:\n parsed = parsed.replace(tzinfo=timezone.utc)\n return parsed.timestamp()\n\n\ndef _is_expiring(expires_at_iso: Any, skew_seconds: int) -> bool:\n expires_epoch = _parse_iso_timestamp(expires_at_iso)\n if expires_epoch is None:\n return True\n return expires_epoch <= (time.time() + skew_seconds)\n\n\ndef _coerce_ttl_seconds(expires_in: Any) -> int:\n try:\n ttl = int(expires_in)\n except Exception:\n ttl = 0\n return max(0, ttl)\n\n\ndef _optional_base_url(value: Any) -> Optional[str]:\n if not isinstance(value, str):\n return None\n cleaned = value.strip().rstrip(\"/\")\n return cleaned if cleaned else None\n\n\n# Allowlist of hosts the Removed provider Portal proxy is willing to forward inference\n# JWTs to. Sending a bearer anywhere else would leak it.\n#\n# This is consulted only for URLs coming from the NETWORK side (Portal\n# refresh responses). User-controlled env-var overrides\n# (REMOVED_PROVIDER_INFERENCE_BASE_URL) bypass validation — that's the documented\n# dev/staging escape hatch and the env source is already trusted (the\n# user set it themselves).\n_ALLOWED_REMOVED_PROVIDER_INFERENCE_HOSTS: FrozenSet[str] = frozenset({\n \"\",\n})\n\n\ndef _validate_removed_provider_inference_url_from_network(url: Optional[str]) -> Optional[str]:\n \"\"\"Validate a Portal-returned inference URL against the host allowlist.\n\n Returns ``url`` (normalised by stripping trailing slashes) if it's a\n well-formed ``https://<allowlisted-host>/...`` URL. Returns ``None``\n if the URL is missing, malformed, non-https, or points at an\n unexpected host — letting the caller fall back to the configured\n default rather than persist or forward a poisoned value.\n\n Defense-in-depth: a compromised refresh response from the Portal API\n (MITM, malicious response injection) could otherwise redirect every\n subsequent proxy request — bearing the user's inference JWT — to an\n attacker-controlled endpoint.\n Validating scheme + host at the source closes that loop before the\n poisoned URL ever lands in ``auth.json``.\n\n The env-var override path (``REMOVED_PROVIDER_INFERENCE_BASE_URL``) bypasses\n this — env values come from the trusted OS user, not from the\n network, and the override is documented for staging/dev use.\n\n Co-authored-by: memosr <mehmet.sr35@gmail.com>\n \"\"\"\n if not isinstance(url, str):\n return None\n cleaned = url.strip()\n if not cleaned:\n return None\n try:\n parsed = urlparse(cleaned)\n except Exception:\n return None\n if parsed.scheme != \"https\":\n logger.warning(\n \"removed_provider: refusing non-https inference URL scheme %r from Portal response\",\n parsed.scheme,\n )\n return None\n if parsed.hostname not in _ALLOWED_REMOVED_PROVIDER_INFERENCE_HOSTS:\n logger.warning(\n \"removed_provider: refusing inference URL host %r from Portal response \"\n \"(not in allowlist); falling back to default\",\n parsed.hostname,\n )\n return None\n return cleaned.rstrip(\"/\")\n\n\ndef _decode_jwt_claims(token: Any) -> Dict[str, Any]:\n if not isinstance(token, str) or token.count(\".\") != 2:\n return {}\n payload = token.split(\".\")[1]\n payload += \"=\" * ((4 - len(payload) % 4) % 4)\n try:\n raw = base64.urlsafe_b64decode(payload.encode(\"utf-8\"))\n claims = json.loads(raw.decode(\"utf-8\"))\n except Exception:\n return {}\n return claims if isinstance(claims, dict) else {}\n\n\ndef _scope_values(raw_scope: Any) -> set[str]:\n # OAuth token responses normally return a space-separated string. Keep\n # collection support for JWT ``scp`` claims and older stored test fixtures.\n scopes: set[str] = set()\n if isinstance(raw_scope, str):\n for part in raw_scope.replace(\",\", \" \").split():\n cleaned = part.strip()\n if cleaned:\n scopes.add(cleaned)\n elif isinstance(raw_scope, (list, tuple, set, frozenset)):\n for item in raw_scope:\n if isinstance(item, str):\n scopes.update(_scope_values(item))\n return scopes\n\n\ndef _removed_provider_invoke_jwt_status(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = REMOVED_PROVIDER_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> Optional[str]:\n \"\"\"Return None when the token can be used for inference, else a reason.\"\"\"\n claims = _decode_jwt_claims(token)\n if not claims:\n return \"access_token_not_jwt\"\n scopes = (\n _scope_values(scope)\n | _scope_values(claims.get(\"scope\"))\n | _scope_values(claims.get(\"scp\"))\n )\n if REMOVED_PROVIDER_INFERENCE_INVOKE_SCOPE not in scopes:\n return \"missing_inference_invoke_scope\"\n exp = claims.get(\"exp\")\n skew = max(0, int(min_ttl_seconds))\n if isinstance(exp, (int, float)):\n if float(exp) <= (time.time() + skew):\n return \"invoke_jwt_expiring\"\n return None\n if _is_expiring(expires_at, skew):\n return \"invoke_jwt_expiry_unknown_or_expiring\"\n return None\n\n\ndef _removed_provider_invoke_jwt_is_usable(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = REMOVED_PROVIDER_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> bool:\n return (\n _removed_provider_invoke_jwt_status(\n token,\n scope=scope,\n expires_at=expires_at,\n min_ttl_seconds=min_ttl_seconds,\n )\n is None\n )\n\n\ndef _assert_removed_provider_inference_jwt_usable(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n) -> None:\n token = state.get(\"access_token\") if access_token is None else access_token\n reason = _removed_provider_invoke_jwt_status(\n token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if reason is None:\n return\n raise AuthError(\n \"Removed provider Portal access token is not a usable inference JWT \"\n f\"({reason}). Re-authenticate with: arcen auth add removed_provider\",\n provider=\"removed_provider\",\n code=reason,\n relogin_required=True,\n )\n\n\ndef _log_removed_provider_invoke_jwt_selected(\n *,\n access_token: Any,\n sequence_id: Optional[str] = None,\n) -> None:\n logger.info(\"Removed provider inference auth: using NAS invoke JWT\")\n _oauth_trace(\n \"removed_provider_invoke_jwt_selected\",\n sequence_id=sequence_id,\n access_token_fp=_token_fingerprint(access_token),\n )\n\n\ndef _removed_provider_jwt_expires_at(token: Any, fallback_expires_at: Any = None) -> Optional[str]:\n claims = _decode_jwt_claims(token)\n exp = claims.get(\"exp\")\n if isinstance(exp, (int, float)):\n try:\n return datetime.fromtimestamp(float(exp), tz=timezone.utc).isoformat()\n except Exception:\n pass\n return fallback_expires_at if isinstance(fallback_expires_at, str) else None\n\n\ndef _set_removed_provider_agent_key_from_invoke_jwt(\n state: Dict[str, Any],\n *,\n obtained_at: Optional[str] = None,\n) -> None:\n access_token = state.get(\"access_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n return\n now = datetime.now(timezone.utc)\n existing_obtained_at = state.get(\"agent_key_obtained_at\")\n if obtained_at:\n effective_obtained_at = obtained_at\n elif (\n state.get(\"agent_key\") == access_token\n and isinstance(existing_obtained_at, str)\n and existing_obtained_at.strip()\n ):\n effective_obtained_at = existing_obtained_at\n else:\n effective_obtained_at = now.isoformat()\n expires_at = _removed_provider_jwt_expires_at(access_token, state.get(\"expires_at\"))\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"expires_in\"))\n )\n if expires_at:\n state[\"expires_at\"] = expires_at\n state[\"expires_in\"] = expires_in\n state[\"agent_key\"] = access_token\n state[\"agent_key_id\"] = None\n state[\"agent_key_expires_at\"] = expires_at\n state[\"agent_key_expires_in\"] = expires_in\n state[\"agent_key_reused\"] = False\n state[\"agent_key_obtained_at\"] = effective_obtained_at\n\n\ndef _select_removed_provider_invoke_jwt(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n sequence_id: Optional[str] = None,\n) -> None:\n if isinstance(access_token, str) and access_token.strip():\n state[\"access_token\"] = access_token\n _set_removed_provider_agent_key_from_invoke_jwt(state)\n _log_removed_provider_invoke_jwt_selected(\n access_token=state.get(\"access_token\"),\n sequence_id=sequence_id,\n )\n\n\n_REMOVED_PROVIDER_EFFECTIVE_STATE_IGNORED_KEYS = frozenset({\n # These are derived from expires_at/JWT exp and naturally tick down between\n # reads. Persisting only these changes makes auth.json noisy and defeats\n # the mtime-keyed auth-status cache.\n \"expires_in\",\n \"agent_key_expires_in\",\n})\n\n\ndef _removed_provider_effective_provider_state(state: Dict[str, Any]) -> Dict[str, Any]:\n return {\n key: value\n for key, value in state.items()\n if key not in _REMOVED_PROVIDER_EFFECTIVE_STATE_IGNORED_KEYS\n }\n\n\ndef _codex_access_token_is_expiring(access_token: Any, skew_seconds: int) -> bool:\n claims = _decode_jwt_claims(access_token)\n exp = claims.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n\n\ndef _qwen_cli_auth_path() -> Path:\n return Path.home() / \".qwen\" / \"oauth_creds.json\"\n\n\ndef _read_qwen_cli_tokens() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n if not auth_path.exists():\n raise AuthError(\n \"Qwen CLI credentials not found. Run 'qwen auth qwen-oauth' first.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_missing\",\n )\n try:\n data = json.loads(auth_path.read_text(encoding=\"utf-8\"))\n except Exception as exc:\n raise AuthError(\n f\"Failed to read Qwen CLI credentials from {auth_path}: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_read_failed\",\n ) from exc\n if not isinstance(data, dict):\n raise AuthError(\n f\"Invalid Qwen CLI credentials in {auth_path}.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_invalid\",\n )\n return data\n\n\ndef _save_qwen_cli_tokens(tokens: Dict[str, Any]) -> Path:\n auth_path = _qwen_cli_auth_path()\n auth_path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_path)\n # Per-process random temp suffix avoids collisions between concurrent\n # writers and stale leftovers from a crashed prior write.\n tmp_path = auth_path.with_name(f\"{auth_path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed tokens\n # at process umask (typically 0o644). See #19673, #21148.\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(tokens, indent=2, sort_keys=True) + \"\\n\")\n fh.flush()\n os.fsync(fh.fileno())\n atomic_replace(tmp_path, auth_path)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n return auth_path\n\n\ndef _qwen_access_token_is_expiring(expiry_date_ms: Any, skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS) -> bool:\n try:\n expiry_ms = int(expiry_date_ms)\n except Exception:\n return True\n return (time.time() + max(0, int(skew_seconds))) * 1000 >= expiry_ms\n\n\ndef _refresh_qwen_cli_tokens(tokens: Dict[str, Any], timeout_seconds: float = 20.0) -> Dict[str, Any]:\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Qwen OAuth refresh token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_token_missing\",\n )\n\n try:\n response = httpx.post(\n QWEN_OAUTH_TOKEN_URL,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": QWEN_OAUTH_CLIENT_ID,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh failed: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n body = response.text.strip()\n raise AuthError(\n \"Qwen OAuth refresh failed. Re-run 'qwen auth qwen-oauth'.\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh returned invalid JSON: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_json\",\n ) from exc\n\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Qwen OAuth refresh response missing access_token.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_response\",\n )\n\n expires_in = payload.get(\"expires_in\")\n try:\n expires_in_seconds = int(expires_in)\n except Exception:\n expires_in_seconds = 6 * 60 * 60\n\n refreshed = {\n \"access_token\": str(payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(payload.get(\"refresh_token\", refresh_token) or refresh_token).strip(),\n \"token_type\": str(payload.get(\"token_type\", tokens.get(\"token_type\", \"Bearer\")) or \"Bearer\").strip() or \"Bearer\",\n \"resource_url\": str(payload.get(\"resource_url\", tokens.get(\"resource_url\", \"portal.qwen.ai\")) or \"portal.qwen.ai\").strip(),\n \"expiry_date\": int(time.time() * 1000) + max(1, expires_in_seconds) * 1000,\n }\n _save_qwen_cli_tokens(refreshed)\n return refreshed\n\n\ndef _mark_qwen_oauth_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to qwen-oauth in auth.json.\n\n Qwen OAuth tokens live in the Qwen CLI credential file managed by\n _save_qwen_cli_tokens / resolve_qwen_runtime_credentials. This function\n only writes a minimal provider-state entry (base_url for display) and\n sets active_provider so that get_active_provider() and\n _model_section_has_credentials() detect the provider for the setup wizard\n and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"base_url\"):\n state[\"base_url\"] = str(creds[\"base_url\"])\n _save_provider_state(auth_store, \"qwen-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_qwen_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n tokens = _read_qwen_cli_tokens()\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _qwen_access_token_is_expiring(tokens.get(\"expiry_date\"), refresh_skew_seconds)\n if should_refresh:\n tokens = _refresh_qwen_cli_tokens(tokens)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Qwen OAuth access token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_access_token_missing\",\n )\n\n base_url = os.getenv(\"ARCEN_QWEN_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_QWEN_BASE_URL\n return {\n \"provider\": \"qwen-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"qwen-cli\",\n \"expires_at_ms\": tokens.get(\"expiry_date\"),\n \"auth_file\": str(_qwen_cli_auth_path()),\n }\n\n\ndef get_qwen_auth_status() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n try:\n # Validate the runtime credentials, including refresh when the cached\n # CLI token is expired. Otherwise stale tokens show up as \"logged in\"\n # and `arcen model` walks users into a broken Qwen setup flow.\n creds = resolve_qwen_runtime_credentials(refresh_if_expiring=True)\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n \"expires_at_ms\": creds.get(\"expires_at_ms\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": str(exc),\n }\n\n\n# =============================================================================\n# Google Gemini OAuth (google-gemini-cli) — PKCE flow + Cloud Code Assist.\n#\n# Tokens live in ~/.arcen/auth/google_oauth.json (managed by agent.google_oauth).\n# The `base_url` here is the marker \"cloudcode-pa://google\" that run_agent.py\n# uses to construct a GeminiCloudCodeClient instead of the default OpenAI SDK.\n# Actual HTTP traffic goes to https://cloudcode-pa.googleapis.com/v1internal:*.\n# =============================================================================\n\ndef _mark_google_gemini_cli_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to google-gemini-cli in auth.json.\n\n The actual OAuth tokens live in the Google credential file managed by\n agent.google_oauth. This function only writes a minimal provider-state\n entry (email for display) and sets active_provider so that\n get_active_provider() and _model_section_has_credentials() detect the\n provider for the setup wizard and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"email\"):\n state[\"email\"] = str(creds[\"email\"])\n _save_provider_state(auth_store, \"google-gemini-cli\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_gemini_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime OAuth creds for google-gemini-cli.\"\"\"\n try:\n from agent.google_oauth import (\n GoogleOAuthError,\n _credentials_path,\n get_valid_access_token,\n load_credentials,\n )\n except ImportError as exc:\n raise AuthError(\n f\"agent.google_oauth is not importable: {exc}\",\n provider=\"google-gemini-cli\",\n code=\"google_oauth_module_missing\",\n ) from exc\n\n try:\n access_token = get_valid_access_token(force_refresh=force_refresh)\n except GoogleOAuthError as exc:\n raise AuthError(\n str(exc),\n provider=\"google-gemini-cli\",\n code=exc.code,\n ) from exc\n\n creds = load_credentials()\n base_url = DEFAULT_GEMINI_CLOUDCODE_BASE_URL\n return {\n \"provider\": \"google-gemini-cli\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"google-oauth\",\n \"expires_at_ms\": (creds.expires_ms if creds else None),\n \"auth_file\": str(_credentials_path()),\n \"email\": (creds.email if creds else \"\") or \"\",\n \"project_id\": (creds.project_id if creds else \"\") or \"\",\n }\n\n\ndef get_gemini_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return a status dict for `arcen auth list` / `arcen status`.\"\"\"\n try:\n from agent.google_oauth import _credentials_path, load_credentials\n except ImportError:\n return {\"logged_in\": False, \"error\": \"agent.google_oauth unavailable\"}\n auth_path = _credentials_path()\n creds = load_credentials()\n if creds is None or not creds.access_token:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": \"not logged in\",\n }\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": \"google-oauth\",\n \"api_key\": creds.access_token,\n \"expires_at_ms\": creds.expires_ms,\n \"email\": creds.email,\n \"project_id\": creds.project_id,\n }\n# Spotify auth — PKCE tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\n\ndef _spotify_scope_list(raw_scope: Optional[str] = None) -> List[str]:\n scope_text = (raw_scope or DEFAULT_SPOTIFY_SCOPE).strip()\n scopes = [part for part in scope_text.split() if part]\n seen: set[str] = set()\n ordered: List[str] = []\n for scope in scopes:\n if scope not in seen:\n seen.add(scope)\n ordered.append(scope)\n return ordered\n\n\ndef _spotify_scope_string(raw_scope: Optional[str] = None) -> str:\n return \" \".join(_spotify_scope_list(raw_scope))\n\n\ndef _spotify_client_id(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\"),\n get_env_value(\"SPOTIFY_CLIENT_ID\"),\n state.get(\"client_id\") if isinstance(state, dict) else None,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n raise AuthError(\n \"Spotify client_id is required. Set ARCEN_SPOTIFY_CLIENT_ID or pass --client-id.\",\n provider=\"spotify\",\n code=\"spotify_client_id_missing\",\n )\n\n\ndef _spotify_redirect_uri(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\"),\n get_env_value(\"SPOTIFY_REDIRECT_URI\"),\n state.get(\"redirect_uri\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_REDIRECT_URI\n\n\ndef _spotify_api_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_API_BASE_URL\"),\n state.get(\"api_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_API_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_API_BASE_URL\n\n\ndef _spotify_accounts_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_ACCOUNTS_BASE_URL\"),\n state.get(\"accounts_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL\n\n\ndef _spotify_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _spotify_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _oauth_pkce_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _oauth_pkce_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _spotify_build_authorize_url(\n *,\n client_id: str,\n redirect_uri: str,\n scope: str,\n state: str,\n code_challenge: str,\n accounts_base_url: str,\n) -> str:\n query = urlencode({\n \"client_id\": client_id,\n \"response_type\": \"code\",\n \"redirect_uri\": redirect_uri,\n \"scope\": scope,\n \"state\": state,\n \"code_challenge_method\": \"S256\",\n \"code_challenge\": code_challenge,\n })\n return f\"{accounts_base_url}/authorize?{query}\"\n\n\ndef _spotify_validate_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"Spotify PKCE redirect_uri must use http://localhost or http://127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host not in {\"127.0.0.1\", \"localhost\"}:\n raise AuthError(\n \"Spotify PKCE redirect_uri must point to localhost or 127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"Spotify PKCE redirect_uri must include an explicit localhost port.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _make_spotify_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n\n class _SpotifyCallbackHandler(BaseHTTPRequestHandler):\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n result[\"code\"] = params.get(\"code\", [None])[0]\n result[\"state\"] = params.get(\"state\", [None])[0]\n result[\"error\"] = params.get(\"error\", [None])[0]\n result[\"error_description\"] = params.get(\"error_description\", [None])[0]\n\n self.send_response(200)\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if result[\"error\"]:\n body = \"<html><body><h1>Spotify authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>Spotify authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _SpotifyCallbackHandler, result\n\n\ndef _spotify_wait_for_callback(\n redirect_uri: str,\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n host, port, path = _spotify_validate_redirect_uri(redirect_uri)\n handler_cls, result = _make_spotify_callback_handler(path)\n\n class _ReuseHTTPServer(HTTPServer):\n allow_reuse_address = True\n\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n except OSError as exc:\n raise AuthError(\n f\"Could not bind Spotify callback server on {host}:{port}: {exc}\",\n provider=\"spotify\",\n code=\"spotify_callback_bind_failed\",\n ) from exc\n\n thread = threading.Thread(target=server.serve_forever, kwargs={\"poll_interval\": 0.1}, daemon=True)\n thread.start()\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n raise AuthError(\n \"Spotify authorization timed out waiting for the local callback.\",\n provider=\"spotify\",\n code=\"spotify_callback_timeout\",\n )\n\n\ndef _xai_validate_loopback_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"xAI OAuth redirect_uri must use http://127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host != XAI_OAUTH_REDIRECT_HOST:\n raise AuthError(\n \"xAI OAuth redirect_uri must point to 127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"xAI OAuth redirect_uri must include an explicit localhost port.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _xai_callback_cors_origin(origin: Optional[str]) -> str:\n # CORS allowlist for the loopback callback. Only xAI's own auth origins\n # are accepted; the redirect_uri itself is bound to 127.0.0.1 and gated by\n # PKCE+state, so additional dev/3p origins are not needed here.\n allowed = {\n \"https://accounts.x.ai\",\n \"https://auth.x.ai\",\n }\n return origin if origin in allowed else \"\"\n\n\ndef _make_xai_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n result_lock = threading.Lock()\n\n class _XAICallbackHandler(BaseHTTPRequestHandler):\n def _maybe_write_cors_headers(self) -> None:\n origin = self.headers.get(\"Origin\")\n allow_origin = _xai_callback_cors_origin(origin)\n if allow_origin:\n self.send_header(\"Access-Control-Allow-Origin\", allow_origin)\n self.send_header(\"Access-Control-Allow-Methods\", \"GET, OPTIONS\")\n self.send_header(\"Access-Control-Allow-Headers\", \"Content-Type\")\n self.send_header(\"Access-Control-Allow-Private-Network\", \"true\")\n self.send_header(\"Vary\", \"Origin\")\n\n def do_OPTIONS(self) -> None: # noqa: N802\n self.send_response(204)\n self._maybe_write_cors_headers()\n self.end_headers()\n\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n incoming = {\n \"code\": params.get(\"code\", [None])[0],\n \"state\": params.get(\"state\", [None])[0],\n \"error\": params.get(\"error\", [None])[0],\n \"error_description\": params.get(\"error_description\", [None])[0],\n }\n\n # Diagnostic logging — emits at INFO so reporters of loopback bugs\n # (#27385 — \"callback received but Arcen times out\") can produce\n # actionable evidence without a code change. Logged values are\n # fingerprints / booleans only; no actual code/state strings leak\n # into the log file. Run with ``ARCEN_LOG_LEVEL=INFO`` (or check\n # ``~/.arcen/logs/agent.log`` which captures INFO+ unconditionally).\n try:\n logger.info(\n \"xAI loopback callback received: path=%s has_code=%s has_state=%s has_error=%s \"\n \"ua=%s\",\n parsed.path,\n incoming[\"code\"] is not None,\n incoming[\"state\"] is not None,\n incoming[\"error\"] is not None,\n (self.headers.get(\"User-Agent\") or \"\")[:80],\n )\n if incoming[\"error\"]:\n logger.info(\n \"xAI loopback callback carries error=%s error_description=%s\",\n incoming[\"error\"],\n (incoming[\"error_description\"] or \"\")[:200],\n )\n except Exception:\n # Logging must never break the OAuth flow.\n pass\n\n # Treat a hit on the callback path with neither `code` nor `error`\n # as a missing OAuth callback (e.g. xAI's auth backend failed to\n # redirect and the user navigated to the bare loopback URL by hand).\n # Show an explicit \"not received\" page rather than the success page —\n # otherwise the browser claims authorization succeeded while the CLI\n # is still waiting for a real callback and eventually times out.\n if incoming[\"code\"] is None and incoming[\"error\"] is None:\n self.send_response(400)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n body = (\n \"<html><body>\"\n \"<h1>xAI authorization not received.</h1>\"\n \"<p>No authorization code was present in this callback URL. \"\n \"Return to the terminal and re-run \"\n \"<code>arcen auth add xai-oauth</code> to retry.</p>\"\n \"</body></html>\"\n )\n self.wfile.write(body.encode(\"utf-8\"))\n return\n\n # ThreadingHTTPServer allows a fallback/manual callback to complete\n # while a browser connection is stuck. Once we have a terminal\n # OAuth result (code or error), keep the first one so a later\n # concurrent/invalid callback cannot overwrite state before\n # validation in _xai_oauth_loopback_login().\n with result_lock:\n if not (result[\"code\"] or result[\"error\"]):\n result.update(incoming)\n\n self.send_response(200)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if incoming[\"error\"]:\n body = \"<html><body><h1>xAI authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>xAI authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _XAICallbackHandler, result\n\n\ndef _xai_start_callback_server(\n preferred_port: int = XAI_OAUTH_REDIRECT_PORT,\n) -> tuple[HTTPServer, threading.Thread, dict[str, Any], str]:\n host = XAI_OAUTH_REDIRECT_HOST\n expected_path = XAI_OAUTH_REDIRECT_PATH\n handler_cls, result = _make_xai_callback_handler(expected_path)\n\n class _ReuseHTTPServer(ThreadingHTTPServer):\n allow_reuse_address = True\n daemon_threads = True\n\n ports_to_try = [preferred_port]\n if preferred_port != 0:\n ports_to_try.append(0)\n server = None\n last_error: Optional[OSError] = None\n for port in ports_to_try:\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n break\n except OSError as exc:\n last_error = exc\n if server is None:\n raise AuthError(\n f\"Could not bind xAI callback server on {host}:{preferred_port}: {last_error}\",\n provider=\"xai-oauth\",\n code=\"xai_callback_bind_failed\",\n ) from last_error\n\n actual_port = int(server.server_address[1])\n redirect_uri = f\"http://{host}:{actual_port}{expected_path}\"\n thread = threading.Thread(\n target=server.serve_forever,\n kwargs={\"poll_interval\": 0.1},\n daemon=True,\n )\n thread.start()\n return server, thread, result, redirect_uri\n\n\ndef _xai_wait_for_callback(\n server: HTTPServer,\n thread: threading.Thread,\n result: dict[str, Any],\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n # Diagnostic: distinguish \"no callback ever arrived\" from \"callback\n # arrived but result wasn't populated\" (#27385). The per-hit handler\n # also logs at INFO; if neither line appears, xAI's IDP never reached\n # the loopback at all (firewall, port-binding, IPv6/IPv4 mismatch).\n logger.info(\n \"xAI loopback wait timed out after %.0fs with no usable callback \"\n \"(result.code=%s result.error=%s)\",\n max(5.0, timeout_seconds),\n result[\"code\"] is not None,\n result[\"error\"] is not None,\n )\n raise AuthError(\n \"xAI authorization timed out waiting for the local callback.\",\n provider=\"xai-oauth\",\n code=\"xai_callback_timeout\",\n )\n\n\ndef _spotify_token_payload_to_state(\n token_payload: Dict[str, Any],\n *,\n client_id: str,\n redirect_uri: str,\n requested_scope: str,\n accounts_base_url: str,\n api_base_url: str,\n previous_state: Optional[Dict[str, Any]] = None,\n) -> Dict[str, Any]:\n now = datetime.now(timezone.utc)\n expires_in = _coerce_ttl_seconds(token_payload.get(\"expires_in\", 0))\n expires_at = datetime.fromtimestamp(now.timestamp() + expires_in, tz=timezone.utc)\n state = dict(previous_state or {})\n state.update({\n \"client_id\": client_id,\n \"redirect_uri\": redirect_uri,\n \"accounts_base_url\": accounts_base_url,\n \"api_base_url\": api_base_url,\n \"scope\": requested_scope,\n \"granted_scope\": str(token_payload.get(\"scope\") or requested_scope).strip(),\n \"token_type\": str(token_payload.get(\"token_type\", \"Bearer\") or \"Bearer\").strip() or \"Bearer\",\n \"access_token\": str(token_payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(\n token_payload.get(\"refresh_token\")\n or state.get(\"refresh_token\")\n or \"\"\n ).strip(),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": expires_at.isoformat(),\n \"expires_in\": expires_in,\n \"auth_type\": \"oauth_pkce\",\n })\n return state\n\n\ndef _spotify_exchange_code_for_tokens(\n *,\n client_id: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n accounts_base_url: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"client_id\": client_id,\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"code_verifier\": code_verifier,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token exchange failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token exchange failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n )\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify token response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_invalid\",\n )\n return payload\n\n\ndef _refresh_spotify_oauth_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Spotify refresh token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_refresh_token_missing\",\n relogin_required=True,\n )\n\n client_id = _spotify_client_id(state=state)\n accounts_base_url = _spotify_accounts_base_url(state)\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": client_id,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token refresh failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token refresh failed. Run `arcen auth spotify` again.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n relogin_required=True,\n )\n\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify refresh response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_refresh_invalid\",\n relogin_required=True,\n )\n\n return _spotify_token_payload_to_state(\n payload,\n client_id=client_id,\n redirect_uri=_spotify_redirect_uri(state=state),\n requested_scope=str(state.get(\"scope\") or DEFAULT_SPOTIFY_SCOPE),\n accounts_base_url=accounts_base_url,\n api_base_url=_spotify_api_base_url(state),\n previous_state=state,\n )\n\n\ndef resolve_spotify_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = SPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"spotify\")\n if not state:\n raise AuthError(\n \"Spotify is not authenticated. Run `arcen auth spotify` first.\",\n provider=\"spotify\",\n code=\"spotify_auth_missing\",\n relogin_required=True,\n )\n\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds)\n if should_refresh:\n state = _refresh_spotify_oauth_state(state)\n _store_provider_state(auth_store, \"spotify\", state, set_active=False)\n _save_auth_store(auth_store)\n\n access_token = str(state.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Spotify access token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_access_token_missing\",\n relogin_required=True,\n )\n\n return {\n \"provider\": \"spotify\",\n \"access_token\": access_token,\n \"api_key\": access_token,\n \"token_type\": str(state.get(\"token_type\", \"Bearer\") or \"Bearer\"),\n \"base_url\": _spotify_api_base_url(state),\n \"scope\": str(state.get(\"granted_scope\") or state.get(\"scope\") or \"\").strip(),\n \"client_id\": _spotify_client_id(state=state),\n \"redirect_uri\": _spotify_redirect_uri(state=state),\n \"expires_at\": state.get(\"expires_at\"),\n \"refresh_token\": str(state.get(\"refresh_token\", \"\") or \"\").strip(),\n }\n\n\ndef get_spotify_auth_status() -> Dict[str, Any]:\n state = get_provider_auth_state(\"spotify\")\n if not state:\n return {\"logged_in\": False}\n\n expires_at = state.get(\"expires_at\")\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n return {\n \"logged_in\": bool(refresh_token or not _is_expiring(expires_at, 0)),\n \"auth_type\": state.get(\"auth_type\", \"oauth_pkce\"),\n \"client_id\": state.get(\"client_id\"),\n \"redirect_uri\": state.get(\"redirect_uri\"),\n \"scope\": state.get(\"granted_scope\") or state.get(\"scope\"),\n \"expires_at\": expires_at,\n \"api_base_url\": state.get(\"api_base_url\"),\n \"has_refresh_token\": bool(refresh_token),\n }\n\n\ndef _spotify_interactive_setup(redirect_uri_hint: str) -> str:\n \"\"\"Walk the user through creating a Spotify developer app, persist the\n resulting client_id to ~/.arcen/.env, and return it.\n\n Raises SystemExit if the user aborts or submits an empty value.\n \"\"\"\n from arcen_cli.config import save_env_value\n\n print()\n print(\"=\" * 70)\n print(\"Spotify first-time setup\")\n print(\"=\" * 70)\n print()\n print(\"Spotify requires every user to register their own lightweight\")\n print(\"developer app. This takes about two minutes and only has to be\")\n print(\"done once per machine.\")\n print()\n print(f\"Full guide: {SPOTIFY_DOCS_URL}\")\n print()\n print(\"Steps:\")\n print(f\" 1. Opening {SPOTIFY_DASHBOARD_URL} in your browser...\")\n print(\" 2. Click 'Create app' and fill in:\")\n print(\" App name: anything (e.g. arcen-agent)\")\n print(\" Description: anything\")\n print(f\" Redirect URI: {redirect_uri_hint}\")\n print(\" API/SDK: Web API\")\n print(\" 3. Agree to the terms, click Save.\")\n print(\" 4. Open the app's Settings page and copy the Client ID.\")\n print(\" 5. Paste it below.\")\n print()\n\n if not _is_remote_session():\n try:\n webbrowser.open(SPOTIFY_DASHBOARD_URL)\n except Exception:\n pass\n\n try:\n raw = input(\"Spotify Client ID: \").strip()\n except (EOFError, KeyboardInterrupt):\n print()\n raise SystemExit(\"Spotify setup cancelled.\")\n\n if not raw:\n print()\n print(f\"No Client ID entered. See {SPOTIFY_DOCS_URL} for the full guide.\")\n raise SystemExit(\"Spotify setup cancelled: empty Client ID.\")\n\n # Persist so subsequent `arcen auth spotify` runs skip the wizard.\n save_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\", raw)\n # Only persist the redirect URI if it's non-default, to avoid pinning\n # users to a value the default might later change to.\n if redirect_uri_hint and redirect_uri_hint != DEFAULT_SPOTIFY_REDIRECT_URI:\n save_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\", redirect_uri_hint)\n\n print()\n print(\"Saved ARCEN_SPOTIFY_CLIENT_ID to ~/.arcen/.env\")\n print()\n return raw\n\n\ndef login_spotify_command(args) -> None:\n existing_state = get_provider_auth_state(\"spotify\") or {}\n\n # Interactive wizard: if no client_id is configured anywhere, walk the\n # user through creating the Spotify developer app instead of crashing\n # with \"ARCEN_SPOTIFY_CLIENT_ID is required\".\n explicit_client_id = getattr(args, \"client_id\", None)\n try:\n client_id = _spotify_client_id(explicit_client_id, existing_state)\n except AuthError as exc:\n if getattr(exc, \"code\", \"\") != \"spotify_client_id_missing\":\n raise\n client_id = _spotify_interactive_setup(\n redirect_uri_hint=getattr(args, \"redirect_uri\", None) or DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n\n redirect_uri = _spotify_redirect_uri(getattr(args, \"redirect_uri\", None), existing_state)\n scope = _spotify_scope_string(getattr(args, \"scope\", None) or existing_state.get(\"scope\"))\n accounts_base_url = _spotify_accounts_base_url(existing_state)\n api_base_url = _spotify_api_base_url(existing_state)\n open_browser = not getattr(args, \"no_browser\", False)\n\n code_verifier = _spotify_code_verifier()\n code_challenge = _spotify_code_challenge(code_verifier)\n state_nonce = uuid.uuid4().hex\n authorize_url = _spotify_build_authorize_url(\n client_id=client_id,\n redirect_uri=redirect_uri,\n scope=scope,\n state=state_nonce,\n code_challenge=code_challenge,\n accounts_base_url=accounts_base_url,\n )\n\n print(\"Starting Spotify PKCE login...\")\n print(f\"Client ID: {client_id}\")\n print(f\"Redirect URI: {redirect_uri}\")\n print(\"Make sure this redirect URI is allow-listed in your Spotify app settings.\")\n print()\n print(\"Open this URL to authorize Arcen:\")\n print(authorize_url)\n print()\n print(f\"Full setup guide: {SPOTIFY_DOCS_URL}\")\n print()\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=SPOTIFY_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for Spotify authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n callback = _spotify_wait_for_callback(\n redirect_uri,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 180.0),\n )\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise SystemExit(f\"Spotify authorization failed: {detail}\")\n if callback.get(\"state\") != state_nonce:\n raise SystemExit(\"Spotify authorization failed: state mismatch.\")\n\n token_payload = _spotify_exchange_code_for_tokens(\n client_id=client_id,\n code=str(callback.get(\"code\") or \"\"),\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n accounts_base_url=accounts_base_url,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 20.0),\n )\n spotify_state = _spotify_token_payload_to_state(\n token_payload,\n client_id=client_id,\n redirect_uri=redirect_uri,\n requested_scope=scope,\n accounts_base_url=accounts_base_url,\n api_base_url=api_base_url,\n )\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _store_provider_state(auth_store, \"spotify\", spotify_state, set_active=False)\n saved_to = _save_auth_store(auth_store)\n\n print(\"Spotify login successful!\")\n print(f\" Auth state: {saved_to}\")\n print(\" Provider state saved under providers.spotify\")\n print(f\" Docs: {SPOTIFY_DOCS_URL}\")\n\n# =============================================================================\n# SSH / remote session detection\n# =============================================================================\n\ndef _is_remote_session() -> bool:\n \"\"\"Detect environments where loopback OAuth can't reach the local browser.\n\n Historically only SSH was checked, but #26923 surfaced that\n **browser-only remote consoles** (GCP Cloud Shell, GitHub\n Codespaces, AWS EC2 Instance Connect, Gitpod, Replit, etc.) hit\n the exact same problem — the user has a browser on their laptop\n but the loopback listener is bound on the remote VM that the\n laptop's browser can't reach. These environments typically don't\n set ``SSH_CLIENT`` / ``SSH_TTY``, so the SSH-only check left\n them with no guidance and no fallback.\n \"\"\"\n if os.getenv(\"SSH_CLIENT\") or os.getenv(\"SSH_TTY\"):\n return True\n # Browser-only remote IDEs / cloud shells. Keep this list narrow\n # (well-known, documented env vars set by the host platform) so\n # we don't falsely trip on a developer's local shell.\n for var in (\n \"CLOUD_SHELL\", # GCP Cloud Shell\n \"CODESPACES\", # GitHub Codespaces\n \"CODESPACE_NAME\", # GitHub Codespaces (alt)\n \"GITPOD_WORKSPACE_ID\", # Gitpod\n \"REPL_ID\", # Replit\n \"STACKBLITZ\", # StackBlitz\n ):\n if os.getenv(var):\n return True\n return False\n\n\n# Console/text-mode browsers that ``webbrowser`` will happily launch INSIDE\n# the terminal. Opening one of these is worse than not opening anything —\n# it hijacks the user's TTY with an unusable text browser (the xAI OAuth\n# \"Account Management\" page rendered in w3m, reported May 2026) instead of\n# letting them copy the URL to a real browser. When the resolved browser is\n# one of these we refuse to auto-open and fall back to the print-the-URL /\n# manual-paste path, same as a remote session.\n_CONSOLE_BROWSER_NAMES: FrozenSet[str] = frozenset(\n {\n \"w3m\",\n \"lynx\",\n \"links\",\n \"links2\",\n \"elinks\",\n \"www-browser\",\n \"browsh\", # TUI browser — still hijacks the terminal\n }\n)\n\n\ndef _can_open_graphical_browser() -> bool:\n \"\"\"Return True only when a *graphical* browser is likely to open.\n\n ``webbrowser.open()`` resolves to whatever the platform offers, and on a\n headless / CLI-only Linux box with no GUI browser installed that is often\n a text-mode browser (w3m/lynx/links) which launches inside the terminal\n and takes over the user's session. This guard distinguishes \"a real\n windowed browser will pop up\" from \"a console browser will hijack the\n TTY\", so callers can fall back to printing the URL instead.\n\n Heuristics:\n * Respect ``$BROWSER`` — if it names a known console browser, refuse.\n * On Linux, require a display server (``$DISPLAY`` / ``$WAYLAND_DISPLAY``)\n unless ``$BROWSER`` points at something graphical; no display server\n almost always means no GUI browser.\n * Ask ``webbrowser.get()`` what it resolved to and refuse when the\n underlying command is a known console browser.\n * macOS and Windows always have a usable default GUI browser.\n \"\"\"\n import webbrowser as _webbrowser\n\n def _names_console_browser(value: str) -> bool:\n token = value.strip().split()[0] if value.strip() else \"\"\n base = os.path.basename(token).lower()\n return base in _CONSOLE_BROWSER_NAMES\n\n browser_env = os.environ.get(\"BROWSER\", \"\")\n if browser_env and _names_console_browser(browser_env):\n return False\n\n if sys.platform.startswith(\"linux\"):\n has_display = bool(\n os.environ.get(\"DISPLAY\") or os.environ.get(\"WAYLAND_DISPLAY\")\n )\n # An explicit graphical $BROWSER can work without $DISPLAY in odd\n # setups, but a console $BROWSER already returned False above, so the\n # only way to reach here with a $BROWSER set is a graphical one.\n if not has_display and not browser_env:\n return False\n\n try:\n controller = _webbrowser.get()\n except Exception:\n # No browser resolvable at all → definitely don't auto-open.\n return False\n\n candidate = (\n getattr(controller, \"name\", \"\")\n or getattr(controller, \"basename\", \"\")\n or \"\"\n )\n if candidate and _names_console_browser(candidate):\n return False\n\n return True\n\n\ndef _parse_pasted_callback(raw: str) -> dict:\n \"\"\"Parse a pasted callback URL / query string into the loopback shape.\n\n Accepts any of:\n\n * full URL: ``http://127.0.0.1:56121/callback?code=abc&state=xyz``\n * bare query string: ``?code=abc&state=xyz`` or ``code=abc&state=xyz``\n * bare code (no state, only used when the upstream omits state):\n ``abc-the-code-value``\n\n Returns ``{\"code\", \"state\", \"error\", \"error_description\"}`` with\n missing keys set to ``None`` so the loopback callsites can keep\n using the same validation path (state check, error check, etc.)\n they already use for the HTTP server output. Regression for\n #26923 — formalises the curl-the-callback-URL workaround the\n reporter used while waiting for upstream support.\n \"\"\"\n stripped = raw.strip()\n result: dict = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n if not stripped:\n return result\n query = \"\"\n if stripped.startswith((\"http://\", \"https://\")):\n try:\n parsed = urlparse(stripped)\n except Exception:\n return result\n query = parsed.query or \"\"\n elif stripped.startswith(\"?\"):\n query = stripped[1:]\n elif \"=\" in stripped:\n # Looks like a bare query fragment (``code=...&state=...``).\n query = stripped\n else:\n # Treat as a bare opaque code value with no state.\n result[\"code\"] = stripped\n return result\n params = parse_qs(query, keep_blank_values=False)\n for key in (\"code\", \"state\", \"error\", \"error_description\"):\n values = params.get(key)\n if values:\n result[key] = values[0]\n return result\n\n\ndef _prompt_manual_callback_paste(redirect_uri: str) -> dict:\n \"\"\"Read a callback URL from stdin as a fallback for browser-only remotes.\n\n Used when ``--manual-paste`` is set or when the loopback listener\n cannot bind. Returns the parsed callback dict (same shape as the\n HTTP handler output) so the existing state / error validation in\n the caller works unchanged. See #26923.\n \"\"\"\n print()\n print(\"─── Manual callback paste ─────────────────────────────────────\")\n print(\"After approving in your browser, your browser will try to load\")\n print(f\" {redirect_uri}\")\n print(\"which fails (the loopback listener is on this remote machine,\")\n print(\"not on your laptop) — that is expected. Copy the FULL URL\")\n print(\"from your browser's address bar of that failed page and paste\")\n print(\"it below. A bare '?code=...&state=...' fragment also works.\")\n print(\"If the consent page shows the authorization code in-page\")\n print(\"(xAI's current behavior) rather than redirecting, paste the\")\n print(\"bare code value on its own.\")\n print(\"───────────────────────────────────────────────────────────────\")\n try:\n raw = input(\"Callback URL: \")\n except (EOFError, KeyboardInterrupt):\n raw = \"\"\n return _parse_pasted_callback(raw)\n\n\ndef _ssh_user_at_host() -> str:\n \"\"\"Return best-effort 'user@hostname' for the SSH tunnel hint command.\n\n Falls back to placeholder tokens when the values cannot be determined so\n the hint is always syntactically valid even if not copy-pasteable.\n \"\"\"\n try:\n import socket as _socket\n hostname = _socket.gethostname() or \"<this-host>\"\n except OSError:\n hostname = \"<this-host>\"\n user = os.getenv(\"USER\") or os.getenv(\"LOGNAME\") or \"<user>\"\n return f\"{user}@{hostname}\"\n\n\ndef _print_loopback_ssh_hint(redirect_uri: str, *, docs_url: str | None = None) -> None:\n \"\"\"Print an SSH tunnel hint when running a loopback-redirect OAuth flow on a\n remote host. The auth server (xAI, Spotify, ...) will redirect the user's\n browser to ``127.0.0.1:<port>/callback``. If the browser is on a different\n machine than the loopback listener (the usual SSH case), the redirect can't\n reach the listener without a local port forward.\n\n The hint is best-effort: silent if we don't think we're remote, or if we\n can't parse a host/port out of the redirect URI.\n\n Pass ``docs_url`` for a provider-specific guide (e.g. the xAI Grok OAuth\n page); the generic OAuth-over-SSH guide is always shown after it.\n \"\"\"\n if not _is_remote_session():\n return\n try:\n parsed = urlparse(redirect_uri)\n except Exception:\n return\n host = parsed.hostname or \"\"\n port = parsed.port\n if host not in {\"127.0.0.1\", \"::1\", \"localhost\"} or not port:\n return\n divider = \"-\" * 60\n print()\n print(divider)\n print(\"Remote session detected — SSH tunnel required\")\n print(divider)\n print(f\"Arcen is waiting for the OAuth callback on {redirect_uri}\")\n print(\"but your browser is on a different machine. Run this command\")\n print(\"in a NEW terminal on your local machine BEFORE opening the URL:\")\n print()\n print(f\" ssh -N -L {port}:127.0.0.1:{port} {_ssh_user_at_host()}\")\n print()\n print(\"Then open the authorize URL above in your local browser.\")\n print()\n print(\"No SSH client (Cloud Shell / Codespaces / web IDE)? Re-run with\")\n print(\"`--manual-paste` to skip the loopback listener and paste the failed\")\n print(\"callback URL directly.\")\n if docs_url:\n print(f\"Provider docs: {docs_url}\")\n print(f\"SSH/jump-box guide: {OAUTH_OVER_SSH_DOCS_URL}\")\n print(divider)\n print()\n\n\n# =============================================================================\n# OpenAI Codex auth — tokens stored in ~/.arcen/auth.json (not ~/.codex/)\n#\n# Arcen maintains its own Codex OAuth session separate from the Codex CLI\n# and VS Code extension. This prevents refresh token rotation conflicts\n# where one app's refresh invalidates the other's session.\n# =============================================================================\n\ndef _read_codex_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n \"\"\"Read Codex OAuth tokens from Arcen auth store (~/.arcen/auth.json).\n \n Returns dict with 'tokens' (access_token, refresh_token) and 'last_refresh'.\n Raises AuthError if no Codex tokens are stored.\n \"\"\"\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\")\n if not state:\n raise AuthError(\n \"No Codex credentials stored. Run `arcen auth` to authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"Codex auth state is missing tokens. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n raise AuthError(\n \"Codex auth is missing access_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_access_token\",\n relogin_required=True,\n )\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n }\n\n\ndef _sync_codex_pool_entries(\n auth_store: Dict[str, Any],\n tokens: Dict[str, str],\n last_refresh: Optional[str],\n) -> None:\n \"\"\"Mirror a fresh Codex re-auth into the credential_pool OAuth entries.\n\n The runtime selects credentials from ``credential_pool.openai-codex``, not\n from ``providers.openai-codex.tokens``. A re-auth invalidates the prior\n OAuth pair server-side, but pool entries keep holding the now-consumed\n refresh token plus any stale error markers — so the next request spends a\n dead token and gets a 401 ``token_invalidated``.\n\n What gets refreshed:\n\n * ``device_code`` — the singleton-seeded entry written by the device-code\n OAuth flow when the user logged in via ``arcen setup`` / the model\n picker. Always synced with the fresh tokens.\n * ``manual:device_code`` — entries created by ``arcen auth add openai-codex``\n that use the same device-code OAuth mechanism. An interactive re-auth\n proves the user owns the ChatGPT account, so it is safe (and expected)\n to refresh these entries too. Without this, a user who once ran the\n ``arcen auth add`` workaround for #33000 would silently leave that\n manual entry stale on every subsequent re-auth, recreating the issue\n reported in #33538.\n\n What does NOT get refreshed:\n\n * ``manual:api_key`` and any other non-device-code manual sources — those\n are independent credentials (an explicit API key, a different ChatGPT\n account, etc.) and must not be overwritten by a single re-auth.\n\n Error markers (``last_status``, ``last_error_*``) are also cleared on\n every device-code-backed entry — even those whose tokens we did not\n rewrite — so that an interactive re-auth gives every relevant pool entry\n a fresh selection chance instead of leaving them marked unhealthy from a\n pre-re-auth 401.\n \"\"\"\n access_token = tokens.get(\"access_token\")\n if not access_token:\n return\n refresh_token = tokens.get(\"refresh_token\")\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return\n # Sources whose tokens should be rewritten by a fresh Codex device-code\n # OAuth re-auth. ``manual:api_key`` and unknown sources are intentionally\n # excluded — they represent independent credentials.\n REFRESHABLE_SOURCES = {\"device_code\", \"manual:device_code\"}\n for entry in entries:\n if not isinstance(entry, dict):\n continue\n source = entry.get(\"source\")\n if source not in REFRESHABLE_SOURCES:\n continue\n entry[\"access_token\"] = access_token\n if refresh_token:\n entry[\"refresh_token\"] = refresh_token\n if last_refresh:\n entry[\"last_refresh\"] = last_refresh\n entry[\"last_status\"] = None\n entry[\"last_status_at\"] = None\n entry[\"last_error_code\"] = None\n entry[\"last_error_reason\"] = None\n entry[\"last_error_message\"] = None\n entry[\"last_error_reset_at\"] = None\n\n\ndef _save_codex_tokens(tokens: Dict[str, str], last_refresh: str = None, label: str = None) -> None:\n \"\"\"Save Codex OAuth tokens to Arcen auth store (~/.arcen/auth.json).\"\"\"\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"chatgpt\"\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n _save_provider_state(auth_store, \"openai-codex\", state)\n _sync_codex_pool_entries(auth_store, tokens, last_refresh)\n _save_auth_store(auth_store)\n\n\ndef refresh_codex_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"Refresh Codex OAuth tokens without mutating Arcen auth state.\"\"\"\n del access_token # Access token is only used by callers to decide whether to refresh.\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n CODEX_OAUTH_TOKEN_URL,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": CODEX_OAUTH_CLIENT_ID,\n },\n )\n\n if response.status_code == 429:\n # Upstream rate-limit / usage-quota exhaustion on the token endpoint.\n # The stored refresh token is still valid here — re-authenticating\n # cannot lift a quota cap. Classify distinctly from auth failures so\n # callers surface a \"retry later\" notice instead of a misleading\n # \"run arcen auth\" prompt (see issue #32790).\n retry_after = _parse_retry_after_seconds(getattr(response, \"headers\", None))\n if retry_after is not None:\n message = (\n f\"Codex provider quota exhausted (429); retry after {retry_after}s. \"\n \"Credentials are still valid.\"\n )\n else:\n message = (\n \"Codex provider quota exhausted (429). Credentials are still valid; \"\n \"retry after the usage limit resets.\"\n )\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=CODEX_RATE_LIMITED_CODE,\n relogin_required=False,\n )\n\n if response.status_code != 200:\n code = \"codex_refresh_failed\"\n message = f\"Codex token refresh failed with status {response.status_code}.\"\n relogin_required = False\n try:\n err = response.json()\n if isinstance(err, dict):\n err_obj = err.get(\"error\")\n # OpenAI shape: {\"error\": {\"code\": \"...\", \"message\": \"...\", \"type\": \"...\"}}\n if isinstance(err_obj, dict):\n nested_code = err_obj.get(\"code\") or err_obj.get(\"type\")\n if isinstance(nested_code, str) and nested_code.strip():\n code = nested_code.strip()\n nested_msg = err_obj.get(\"message\")\n if isinstance(nested_msg, str) and nested_msg.strip():\n message = f\"Codex token refresh failed: {nested_msg.strip()}\"\n # OAuth spec shape: {\"error\": \"code_str\", \"error_description\": \"...\"}\n elif isinstance(err_obj, str) and err_obj.strip():\n code = err_obj.strip()\n err_desc = err.get(\"error_description\") or err.get(\"message\")\n if isinstance(err_desc, str) and err_desc.strip():\n message = f\"Codex token refresh failed: {err_desc.strip()}\"\n except Exception:\n pass\n if code in {\"invalid_grant\", \"invalid_token\", \"invalid_request\"}:\n relogin_required = True\n if code == \"refresh_token_reused\":\n message = (\n \"Codex refresh token was already consumed by another client \"\n \"(e.g. Codex CLI or VS Code extension). \"\n \"Run `codex` in your terminal to generate fresh tokens, \"\n \"then run `arcen auth` to re-authenticate.\"\n )\n relogin_required = True\n # A 401/403 from the token endpoint always means the refresh token\n # is invalid/expired — force relogin even if the body error code\n # wasn't one of the known strings above.\n if response.status_code in {401, 403} and not relogin_required:\n relogin_required = True\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=code,\n relogin_required=relogin_required,\n )\n\n try:\n refresh_payload = response.json()\n except Exception as exc:\n raise AuthError(\n \"Codex token refresh returned invalid JSON.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_invalid_json\",\n relogin_required=True,\n ) from exc\n\n refreshed_access = refresh_payload.get(\"access_token\")\n if not isinstance(refreshed_access, str) or not refreshed_access.strip():\n raise AuthError(\n \"Codex token refresh response was missing access_token.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_missing_access_token\",\n relogin_required=True,\n )\n\n updated = {\n \"access_token\": refreshed_access.strip(),\n \"refresh_token\": refresh_token.strip(),\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n next_refresh = refresh_payload.get(\"refresh_token\")\n if isinstance(next_refresh, str) and next_refresh.strip():\n updated[\"refresh_token\"] = next_refresh.strip()\n return updated\n\n\ndef _refresh_codex_auth_tokens(\n tokens: Dict[str, str],\n timeout_seconds: float,\n) -> Dict[str, str]:\n \"\"\"Refresh Codex access token using the refresh token.\n \n Saves the new tokens to Arcen auth store automatically.\n \"\"\"\n refreshed = refresh_codex_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n\n _save_codex_tokens(updated_tokens)\n return updated_tokens\n\n\ndef _import_codex_cli_tokens() -> Optional[Dict[str, str]]:\n \"\"\"Try to read tokens from ~/.codex/auth.json (Codex CLI shared file).\n \n Returns tokens dict if valid and not expired, None otherwise.\n Does NOT write to the shared file.\n \"\"\"\n codex_home = os.getenv(\"CODEX_HOME\", \"\").strip()\n if not codex_home:\n codex_home = str(Path.home() / \".codex\")\n auth_path = Path(codex_home).expanduser() / \"auth.json\"\n if not auth_path.is_file():\n return None\n try:\n payload = json.loads(auth_path.read_text())\n tokens = payload.get(\"tokens\")\n if not isinstance(tokens, dict):\n return None\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not access_token or not refresh_token:\n return None\n # Reject expired tokens — importing stale tokens from ~/.codex/\n # that can't be refreshed leaves the user stuck with \"Login successful!\"\n # but no working credentials.\n if _codex_access_token_is_expiring(access_token, 0):\n logger.debug(\n \"Codex CLI tokens at %s are expired — skipping import.\", auth_path,\n )\n return None\n return dict(tokens)\n except Exception:\n return None\n\n\ndef resolve_codex_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime credentials from Arcen's own Codex token store.\n\n Falls back to the credential pool when the singleton (``providers.openai-codex.tokens``)\n has no usable access_token but the pool (``credential_pool.openai-codex``) does. This\n closes the divergence between the chat path (singleton-only via this function) and\n the auxiliary path (pool-first via ``_read_codex_access_token``). Without this\n fallback, a user whose tokens live only in the pool — for example after a manual\n pool seed, a partial re-auth, or pool-only restoration from a backup — gets a bare\n HTTP 401 ``Missing Authentication header`` from the wire instead of a usable\n credential. See issue #32992.\n \"\"\"\n try:\n data = _read_codex_tokens()\n except AuthError:\n pool_token = _pool_codex_access_token()\n if pool_token:\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": pool_token,\n \"source\": \"credential_pool\",\n \"last_refresh\": None,\n \"auth_mode\": \"chatgpt\",\n }\n raise\n\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_CODEX_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n # Re-read under lock to avoid racing with other Arcen processes\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_codex_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n\n if should_refresh:\n tokens = _refresh_codex_auth_tokens(tokens, refresh_timeout_seconds)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"chatgpt\",\n }\n\n\ndef _pool_codex_access_token() -> str:\n \"\"\"Return the most-recent usable access_token from the openai-codex pool.\n\n Used as a fallback by ``resolve_codex_runtime_credentials`` when the\n singleton has no creds. Reads ``credential_pool.openai-codex`` entries\n directly from auth.json and picks the first non-empty access_token,\n preferring entries that are not currently in an exhaustion cooldown.\n Returns ``\"\"`` when no usable entry is found (caller handles by raising\n the original AuthError).\n \"\"\"\n try:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return \"\"\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return \"\"\n\n def _entry_usable(entry: Dict[str, Any]) -> bool:\n if not isinstance(entry, dict):\n return False\n token = entry.get(\"access_token\")\n if not isinstance(token, str) or not token.strip():\n return False\n # Skip entries currently in an exhaustion cooldown window.\n reset_at = entry.get(\"last_error_reset_at\")\n if isinstance(reset_at, (int, float)) and reset_at > time.time():\n return False\n return True\n\n for entry in entries:\n if _entry_usable(entry):\n return str(entry.get(\"access_token\", \"\")).strip()\n except Exception:\n logger.debug(\"Codex pool fallback lookup failed\", exc_info=True)\n return \"\"\n\n\n# =============================================================================\n# xAI Grok OAuth — tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\ndef _read_xai_oauth_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\")\n if not state:\n raise AuthError(\n \"No xAI OAuth credentials stored. Select xAI Grok OAuth (SuperGrok / Premium+) in `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"xAI OAuth state is missing tokens. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI OAuth state is missing access_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_access_token\",\n relogin_required=True,\n )\n if not refresh_token:\n raise AuthError(\n \"xAI OAuth state is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n \"discovery\": state.get(\"discovery\") or {},\n \"redirect_uri\": state.get(\"redirect_uri\"),\n }\n\n\ndef _save_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n discovery: Optional[Dict[str, Any]] = None,\n redirect_uri: str = \"\",\n last_refresh: Optional[str] = None,\n) -> None:\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"oauth_pkce\"\n if discovery:\n state[\"discovery\"] = discovery\n if redirect_uri:\n state[\"redirect_uri\"] = redirect_uri\n _save_provider_state(auth_store, \"xai-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef _xai_access_token_is_expiring(access_token: str, skew_seconds: int = 0) -> bool:\n if not isinstance(access_token, str) or \".\" not in access_token:\n return False\n try:\n parts = access_token.split(\".\")\n if len(parts) < 2:\n return False\n payload_b64 = parts[1]\n payload_b64 += \"=\" * (-len(payload_b64) % 4)\n payload = json.loads(base64.urlsafe_b64decode(payload_b64.encode(\"ascii\")).decode(\"utf-8\"))\n exp = payload.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n except Exception:\n return False\n\n\ndef _xai_validate_oauth_endpoint(url: str, *, field: str) -> str:\n \"\"\"Refuse any OIDC discovery endpoint that isn't HTTPS on the xAI origin.\n\n The OIDC discovery response is a long-lived, low-frequency request whose\n output is cached in ``~/.arcen/auth.json``. A single MITM during initial\n login could substitute a malicious ``token_endpoint``; that URL would\n then receive the refresh_token on every subsequent refresh — a permanent\n credential leak from a one-time MITM. Validating scheme + host pins the\n cached endpoint to the xAI auth origin (or a future ``*.x.ai`` subdomain\n if xAI migrates) so the cache poisoning loses its persistence guarantee.\n\n RFC 8414 §2 requires the issuer to be ``https://`` and SHOULD-keeps the\n token_endpoint on the same origin; we enforce both. ``x.ai`` is the\n bare apex, so we accept either exact host match or any ``.x.ai`` suffix.\n \"\"\"\n parsed = urlparse(url)\n if parsed.scheme != \"https\":\n raise AuthError(\n f\"xAI OIDC discovery returned a non-HTTPS {field}: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n host = (parsed.hostname or \"\").lower()\n if not host:\n raise AuthError(\n f\"xAI OIDC discovery {field} is missing a hostname: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n raise AuthError(\n f\"xAI OIDC discovery {field} host {host!r} is not on the xAI origin \"\n f\"(expected x.ai or a *.x.ai subdomain). Refusing to use a cached \"\n f\"endpoint that may have been substituted by a MITM during initial \"\n f\"discovery; re-authenticate with `arcen model` to re-fetch.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n return url\n\n\ndef _xai_validate_inference_base_url(value: str, *, fallback: str) -> str:\n \"\"\"Refuse a non-xAI base_url for the OAuth-authenticated inference path.\n\n The xAI Grok OAuth bearer is a high-value, long-lived credential tied to\n the user's SuperGrok subscription. ``XAI_BASE_URL`` / ``ARCEN_XAI_BASE_URL``\n let users repoint the inference endpoint (handy for staging or a local\n proxy), but the env override is also a credential-leak vector: a tampered\n ``.env`` or hostile shell init that sets\n ``XAI_BASE_URL=https://attacker.example/v1`` would ship the OAuth access\n token to a third party on every request, silently.\n\n Pin the inference origin to ``api.x.ai`` (or any ``*.x.ai`` subdomain xAI\n may add). On rejection, fall back to the default and log a warning rather\n than raise — a bad env var should not deadlock authentication, but it\n should also never leak the bearer.\n\n ``value`` is the already-stripped, trailing-slash-trimmed candidate from\n env. Empty input returns ``fallback`` unchanged.\n \"\"\"\n candidate = (value or \"\").strip().rstrip(\"/\")\n if not candidate:\n return fallback\n try:\n parsed = urlparse(candidate)\n except Exception:\n logger.warning(\n \"Ignoring malformed xAI base_url override %r; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if parsed.scheme != \"https\":\n logger.warning(\n \"Refusing non-HTTPS xAI base_url override %r (xai-oauth bearer would \"\n \"be sent in cleartext); falling back to %s.\",\n candidate, fallback,\n )\n return fallback\n host = (parsed.hostname or \"\").lower()\n if not host:\n logger.warning(\n \"Ignoring xAI base_url override %r with no hostname; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n logger.warning(\n \"Refusing xAI base_url override %r — host %r is not on the xAI origin \"\n \"(expected x.ai or a *.x.ai subdomain). The xai-oauth bearer is only \"\n \"valid against xAI's inference API; sending it elsewhere would leak \"\n \"the credential. Falling back to %s.\",\n candidate, host, fallback,\n )\n return fallback\n return candidate\n\n\ndef _xai_oauth_discovery(timeout_seconds: float = 15.0) -> Dict[str, str]:\n try:\n response = httpx.get(\n XAI_OAUTH_DISCOVERY_URL,\n headers={\"Accept\": \"application/json\"},\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n ) from exc\n if response.status_code != 200:\n raise AuthError(\n f\"xAI OIDC discovery returned status {response.status_code}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI OIDC discovery response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n authorization_endpoint = str(payload.get(\"authorization_endpoint\", \"\") or \"\").strip()\n token_endpoint = str(payload.get(\"token_endpoint\", \"\") or \"\").strip()\n if not authorization_endpoint or not token_endpoint:\n raise AuthError(\n \"xAI OIDC discovery response was missing required endpoints.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n _xai_validate_oauth_endpoint(authorization_endpoint, field=\"authorization_endpoint\")\n _xai_validate_oauth_endpoint(token_endpoint, field=\"token_endpoint\")\n return {\n \"authorization_endpoint\": authorization_endpoint,\n \"token_endpoint\": token_endpoint,\n }\n\n\ndef refresh_xai_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n token_endpoint: str = \"\",\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n del access_token\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"xAI OAuth is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n endpoint = token_endpoint.strip() or _xai_oauth_discovery(timeout_seconds)[\"token_endpoint\"]\n # Re-validate cached endpoints on the refresh hot path: an auth.json\n # written by an older Arcen (or hand-edited) may carry a non-xAI\n # token_endpoint that would receive every future refresh_token in\n # plaintext if we trusted it blindly. Cheap suffix check; fast-fail\n # with a clear error so the user can re-run `arcen model` to refetch.\n _xai_validate_oauth_endpoint(endpoint, field=\"token_endpoint\")\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n endpoint,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"refresh_token\": refresh_token,\n },\n )\n if response.status_code != 200:\n detail = response.text.strip()\n # ``403`` from xAI's token endpoint is almost always a tier /\n # entitlement gate (the OAuth grant exists but the account isn't\n # on the allowlist for API access). Re-running ``arcen model``\n # won't fix that — surface a separate error code so\n # ``format_auth_error`` doesn't append a misleading\n # re-authenticate hint, and point users at the ``XAI_API_KEY``\n # fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n \"xAI token refresh failed with HTTP 403.\"\n + (f\" Response: {detail}\" if detail else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Re-logging in won't\"\n \" change that; set ``XAI_API_KEY`` and switch to\"\n \" ``provider: xai`` (API-key path) if available, or\"\n \" upgrade your subscription at https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n \"xAI token refresh failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_refresh_failed\",\n relogin_required=(response.status_code in {400, 401}),\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token refresh returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token refresh response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_response\",\n relogin_required=True,\n )\n refreshed_access = str(payload.get(\"access_token\", \"\") or \"\").strip()\n if not refreshed_access:\n raise AuthError(\n \"xAI token refresh response was missing access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_missing_access_token\",\n relogin_required=True,\n )\n updated = {\n \"access_token\": refreshed_access,\n \"refresh_token\": str(payload.get(\"refresh_token\") or refresh_token).strip(),\n \"id_token\": str(payload.get(\"id_token\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n return updated\n\n\ndef _refresh_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n token_endpoint: str,\n redirect_uri: str = \"\",\n timeout_seconds: float,\n) -> Dict[str, Any]:\n refreshed = refresh_xai_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n token_endpoint=token_endpoint,\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n if refreshed.get(\"id_token\"):\n updated_tokens[\"id_token\"] = refreshed[\"id_token\"]\n if refreshed.get(\"expires_in\") is not None:\n updated_tokens[\"expires_in\"] = refreshed[\"expires_in\"]\n if refreshed.get(\"token_type\"):\n updated_tokens[\"token_type\"] = refreshed[\"token_type\"]\n _save_xai_oauth_tokens(\n updated_tokens,\n discovery={\"token_endpoint\": token_endpoint},\n redirect_uri=redirect_uri,\n last_refresh=refreshed[\"last_refresh\"],\n )\n return updated_tokens\n\n\ndef resolve_xai_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n data = _read_xai_oauth_tokens()\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_XAI_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_xai_oauth_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n if not token_endpoint:\n token_endpoint = _xai_oauth_discovery(refresh_timeout_seconds)[\"token_endpoint\"]\n try:\n tokens = _refresh_xai_oauth_tokens(\n tokens,\n token_endpoint=token_endpoint,\n redirect_uri=redirect_uri,\n timeout_seconds=refresh_timeout_seconds,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n except AuthError as exc:\n if _is_terminal_xai_oauth_refresh_error(exc):\n # Terminal failure (HTTP 400/401/403 — invalid_grant, token revoked).\n # Clear dead tokens from auth.json so subsequent sessions fail fast\n # without a network retry. Mirrors credential_pool.py quarantine.\n try:\n _q_store = _load_auth_store()\n _q_state = _load_provider_state(_q_store, \"xai-oauth\") or {}\n _q_tokens = dict(_q_state.get(\"tokens\") or {})\n _q_tokens.pop(\"access_token\", None)\n _q_tokens.pop(\"refresh_token\", None)\n _q_state[\"tokens\"] = _q_tokens\n _q_state[\"last_auth_error\"] = {\n \"provider\": \"xai-oauth\",\n \"code\": exc.code or \"xai_refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _store_provider_state(_q_store, \"xai-oauth\", _q_state, set_active=False)\n _save_auth_store(_q_store)\n except Exception as _save_exc:\n logger.debug(\n \"xAI OAuth: failed to persist quarantined state: %s\", _save_exc,\n )\n raise\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"provider\": \"xai-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"oauth_pkce\",\n }\n\n\n# =============================================================================\n# TLS verification helper\n# =============================================================================\n\ndef _default_verify() -> bool | ssl.SSLContext:\n \"\"\"Platform-aware default SSL verify for httpx clients.\n\n On macOS with Homebrew Python, the system OpenSSL cannot locate the\n system trust store and valid public certs fail verification. When\n certifi is importable we pin its bundle explicitly; elsewhere we\n defer to httpx's built-in default (certifi via its own dependency).\n Mirrors the weixin fix in 3a0ec1d93.\n \"\"\"\n if sys.platform == \"darwin\":\n try:\n import certifi\n return ssl.create_default_context(cafile=certifi.where())\n except ImportError:\n pass\n return True\n\n\ndef _resolve_verify(\n *,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n auth_state: Optional[Dict[str, Any]] = None,\n) -> bool | ssl.SSLContext:\n tls_state = auth_state.get(\"tls\") if isinstance(auth_state, dict) else {}\n tls_state = tls_state if isinstance(tls_state, dict) else {}\n\n effective_insecure = (\n is_truthy_value(insecure, default=False) if insecure is not None\n else is_truthy_value(tls_state.get(\"insecure\", False), default=False)\n )\n effective_ca = (\n ca_bundle\n or tls_state.get(\"ca_bundle\")\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n or os.getenv(\"REQUESTS_CA_BUNDLE\")\n )\n\n if effective_insecure:\n return False\n if effective_ca:\n ca_path = str(effective_ca)\n if not os.path.isfile(ca_path):\n logger.warning(\n \"CA bundle path does not exist: %s — falling back to default certificates\",\n ca_path,\n )\n return _default_verify()\n return ssl.create_default_context(cafile=ca_path)\n return _default_verify()\n\n\n# =============================================================================\n# OAuth Device Code Flow — generic, parameterized by provider\n# =============================================================================\n\ndef _request_device_code(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n scope: Optional[str],\n) -> Dict[str, Any]:\n \"\"\"POST to the device code endpoint. Returns device_code, user_code, etc.\"\"\"\n response = client.post(\n f\"{portal_base_url}/api/oauth/device/code\",\n data={\n \"client_id\": client_id,\n **({\"scope\": scope} if scope else {}),\n },\n )\n response.raise_for_status()\n data = response.json()\n\n required_fields = [\n \"device_code\", \"user_code\", \"verification_uri\",\n \"verification_uri_complete\", \"expires_in\", \"interval\",\n ]\n missing = [f for f in required_fields if f not in data]\n if missing:\n raise ValueError(f\"Device code response missing fields: {', '.join(missing)}\")\n return data\n\n\ndef _poll_for_token(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n device_code: str,\n expires_in: int,\n poll_interval: int,\n) -> Dict[str, Any]:\n \"\"\"Poll the token endpoint until the user approves or the code expires.\"\"\"\n deadline = time.monotonic() + max(1, expires_in)\n current_interval = max(1, min(poll_interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n\n while time.monotonic() < deadline:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n data={\n \"grant_type\": \"urn:ietf:params:oauth:grant-type:device_code\",\n \"client_id\": client_id,\n \"device_code\": device_code,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise ValueError(\"Token response did not include access_token\")\n return payload\n\n try:\n error_payload = response.json()\n except Exception:\n response.raise_for_status()\n raise RuntimeError(\"Token endpoint returned a non-JSON error response\")\n\n error_code = error_payload.get(\"error\", \"\")\n if error_code == \"authorization_pending\":\n time.sleep(current_interval)\n continue\n if error_code == \"slow_down\":\n current_interval = min(current_interval + 1, 30)\n time.sleep(current_interval)\n continue\n\n description = error_payload.get(\"error_description\") or \"Unknown authentication error\"\n raise RuntimeError(f\"{error_code}: {description}\")\n\n raise TimeoutError(\"Timed out waiting for device authorization\")\n\n\n# =============================================================================\n# Removed provider Portal — token refresh and model discovery\n# =============================================================================\n\n# -----------------------------------------------------------------------------\n# Shared Removed provider token store — lets OAuth credentials persist across profiles\n# so a new `arcen --profile <name> auth add removed_provider --type oauth` can one-tap\n# import instead of running the full device-code flow every time.\n#\n# File lives at ${ARCEN_SHARED_AUTH_DIR}/removed_provider_auth.json, defaulting to\n# ``<arcen-root>/shared/removed_provider_auth.json`` where ``<arcen-root>`` is what\n# ``get_default_arcen_root()`` returns — ``~/.arcen`` on Linux/macOS,\n# ``%LOCALAPPDATA%\\arcen`` on native Windows, or the Docker/custom root.\n# It is OUTSIDE any named profile's ARCEN_HOME so named profiles (which\n# typically live under ``<arcen-root>/profiles/<name>/``) all see the\n# same file.\n#\n# Written on successful login and on every runtime refresh so the stored\n# refresh_token stays current even if one profile refreshes and rotates it.\n# If ever the stored refresh_token does go stale server-side, import fails\n# gracefully and the user falls back to the normal device-code flow.\n# -----------------------------------------------------------------------------\n\nREMOVED_PROVIDER_SHARED_STORE_FILENAME = \"removed_provider_auth.json\"\n_removed_provider_shared_lock_holder = threading.local()\n\n\ndef _removed_provider_shared_auth_dir() -> Path:\n \"\"\"Resolve the directory that holds the shared Removed provider token store.\n\n Honors ``ARCEN_SHARED_AUTH_DIR`` so tests can redirect it to a tmp\n path without touching the real user's home. Defaults to\n ``<arcen-root>/shared/``, where ``<arcen-root>`` is what\n :func:`arcen_constants.get_default_arcen_root` returns — so\n Linux/macOS classic installs land at ``~/.arcen/shared/``, native\n Windows installs at ``%LOCALAPPDATA%\\\\arcen\\\\shared\\\\``, and\n Docker / custom ``ARCEN_HOME`` deployments at\n ``<ARCEN_HOME>/shared/``. Sits outside any named profile so all\n profiles under the same root share the store.\n \"\"\"\n override = os.getenv(\"ARCEN_SHARED_AUTH_DIR\", \"\").strip()\n if override:\n return Path(override).expanduser()\n from arcen_constants import get_default_arcen_root\n return get_default_arcen_root() / \"shared\"\n\n\ndef _removed_provider_shared_store_path() -> Path:\n path = _removed_provider_shared_auth_dir() / REMOVED_PROVIDER_SHARED_STORE_FILENAME\n # Seat belt: if pytest is running and this resolves to a path under the\n # real user's Arcen root, refuse rather than silently corrupt cross-profile\n # state. Tests must set ARCEN_SHARED_AUTH_DIR to a tmp_path (conftest\n # does not do this automatically — mirror the _auth_file_path() guard\n # so forgetting to set it fails loudly instead of writing to the real\n # shared store).\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n from arcen_constants import get_default_arcen_root\n real_home_shared = (\n get_default_arcen_root() / \"shared\" / REMOVED_PROVIDER_SHARED_STORE_FILENAME\n ).resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_shared:\n raise RuntimeError(\n f\"Refusing to touch real user shared Removed provider auth store during test run: \"\n f\"{path}. Set ARCEN_SHARED_AUTH_DIR to a tmp_path in your test fixture.\"\n )\n return path\n\n\n@contextmanager\ndef _removed_provider_shared_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-profile lock for the shared Removed provider OAuth store.\n\n Lock ordering invariant: if both this and ``_auth_store_lock`` need\n to be held, acquire ``_auth_store_lock`` FIRST. All runtime refresh\n paths follow this order. The one exception is\n ``_try_import_shared_removed_provider_state``, which holds this lock alone for\n the entire refresh cycle so concurrent imports on sibling profiles\n can't race on the single-use shared refresh token; that helper must\n NOT be called with ``_auth_store_lock`` already held.\n \"\"\"\n try:\n lock_path = _removed_provider_shared_store_path().with_suffix(\".lock\")\n except RuntimeError:\n # No ARCEN_HOME yet (pre-setup): fall through without locking.\n yield\n return\n\n with _file_lock(\n lock_path,\n _removed_provider_shared_lock_holder,\n timeout_seconds,\n \"Timed out waiting for shared Removed provider auth lock\",\n ):\n yield\n\n\ndef _merge_shared_removed_provider_oauth_state(state: Dict[str, Any]) -> bool:\n \"\"\"Copy fresher shared OAuth tokens into a profile-local Removed provider state.\"\"\"\n shared = _read_shared_removed_provider_state()\n if not shared:\n return False\n\n shared_refresh = shared.get(\"refresh_token\")\n if not isinstance(shared_refresh, str) or not shared_refresh.strip():\n return False\n\n local_refresh = state.get(\"refresh_token\")\n shared_access_exp = _parse_iso_timestamp(shared.get(\"expires_at\")) or 0.0\n local_access_exp = _parse_iso_timestamp(state.get(\"expires_at\")) or 0.0\n refresh_changed = shared_refresh.strip() != str(local_refresh or \"\").strip()\n fresher_access = shared_access_exp > local_access_exp\n if not refresh_changed and not fresher_access:\n return False\n\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"token_type\",\n \"scope\",\n \"client_id\",\n \"portal_base_url\",\n \"inference_base_url\",\n \"obtained_at\",\n \"expires_at\",\n ):\n value = shared.get(key)\n if value not in {None, \"\"}:\n state[key] = value\n return True\n\n\ndef _write_shared_removed_provider_state(state: Dict[str, Any]) -> None:\n \"\"\"Persist a minimal copy of the Removed provider OAuth state to the shared store.\n\n Best-effort: any failure is swallowed after logging. The shared store\n is a convenience layer; the per-profile auth.json remains the source\n of truth.\n\n We deliberately omit the runtime ``agent_key`` compatibility field;\n the OAuth tokens are the cross-profile source of truth.\n \"\"\"\n refresh_token = state.get(\"refresh_token\")\n access_token = state.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n # No refresh_token = nothing worth sharing across profiles\n return\n if not (isinstance(access_token, str) and access_token.strip()):\n return\n\n shared = {\n \"_schema\": 1,\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"token_type\": state.get(\"token_type\") or \"Bearer\",\n \"scope\": state.get(\"scope\") or DEFAULT_REMOVED_PROVIDER_SCOPE,\n \"client_id\": state.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID,\n \"portal_base_url\": state.get(\"portal_base_url\") or DEFAULT_REMOVED_PROVIDER_PORTAL_URL,\n \"inference_base_url\": state.get(\"inference_base_url\") or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL,\n \"obtained_at\": state.get(\"obtained_at\"),\n \"expires_at\": state.get(\"expires_at\"),\n \"updated_at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n with _removed_provider_shared_store_lock():\n path = _removed_provider_shared_store_path()\n path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(path)\n tmp = path.with_name(f\"{path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed Removed provider\n # refresh_token at process umask. See #19673, #21148.\n fd = os.open(\n str(tmp),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(shared, indent=2, sort_keys=True))\n fh.flush()\n os.fsync(fh.fileno())\n os.replace(tmp, path)\n finally:\n try:\n if tmp.exists():\n tmp.unlink()\n except OSError:\n pass\n _oauth_trace(\n \"removed_provider_shared_store_written\",\n path=str(path),\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n except Exception as exc:\n logger.debug(\"Failed to write shared Removed provider auth store: %s\", exc)\n\n\ndef _read_shared_removed_provider_state() -> Optional[Dict[str, Any]]:\n \"\"\"Return the shared Removed provider OAuth state if present and well-formed.\n\n Returns ``None`` when the file is missing, unreadable, malformed, or\n lacks required fields. Callers should treat ``None`` as \"no shared\n credentials available — fall through to device-code\".\n \"\"\"\n try:\n path = _removed_provider_shared_store_path()\n except RuntimeError:\n # Test seat belt tripped — treat as missing\n return None\n if not path.is_file():\n return None\n try:\n payload = json.loads(path.read_text())\n except (OSError, ValueError) as exc:\n logger.debug(\"Shared Removed provider auth store at %s is unreadable: %s\", path, exc)\n return None\n if not isinstance(payload, dict):\n return None\n refresh_token = payload.get(\"refresh_token\")\n access_token = payload.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n return None\n if not (isinstance(access_token, str) and access_token.strip()):\n return None\n return payload\n\n\ndef _clear_shared_removed_provider_state(reason: str) -> None:\n \"\"\"Remove the shared Removed provider OAuth store after a terminal token failure.\"\"\"\n try:\n with _removed_provider_shared_store_lock():\n path = _removed_provider_shared_store_path()\n try:\n path.unlink()\n except FileNotFoundError:\n pass\n _oauth_trace(\"removed_provider_shared_store_cleared\", reason=reason)\n except Exception as exc:\n logger.debug(\"Failed to clear shared Removed provider auth store: %s\", exc)\n\n\ndef _is_terminal_removed_provider_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Removed provider refresh token cannot succeed.\"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"removed_provider\"\n and exc.code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_xai_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same xAI OAuth refresh token cannot succeed.\n\n ``xai_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``xai_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"xai-oauth\"\n and exc.code in {\"xai_refresh_failed\", \"xai_auth_missing_refresh_token\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_codex_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Codex OAuth refresh token cannot succeed.\n\n ``codex_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``codex_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"openai-codex\"\n and exc.code in {\n \"codex_refresh_failed\",\n \"codex_auth_missing_refresh_token\",\n \"invalid_grant\",\n \"invalid_token\",\n \"refresh_token_reused\",\n }\n and bool(exc.relogin_required)\n )\n\n\ndef _quarantine_removed_provider_oauth_state(\n state: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> None:\n \"\"\"Keep routing metadata but remove dead OAuth material so it is not replayed.\"\"\"\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"expires_at\",\n \"expires_in\",\n \"obtained_at\",\n \"agent_key\",\n \"agent_key_id\",\n \"agent_key_expires_at\",\n \"agent_key_expires_in\",\n \"agent_key_reused\",\n \"agent_key_obtained_at\",\n ):\n state.pop(key, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"removed_provider\",\n \"code\": error.code,\n \"message\": str(error),\n \"reason\": reason,\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _clear_shared_removed_provider_state(reason)\n invalidate_removed_provider_auth_status_cache()\n\n\ndef _quarantine_removed_provider_pool_entries(\n auth_store: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> bool:\n \"\"\"Remove singleton-seeded Removed provider pool entries that contain dead OAuth state.\"\"\"\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return False\n entries = pool.get(\"removed_provider\")\n if not isinstance(entries, list):\n return False\n\n retained = []\n removed = False\n singleton_sources = {REMOVED_PROVIDER_DEVICE_CODE_SOURCE, f\"manual:{REMOVED_PROVIDER_DEVICE_CODE_SOURCE}\"}\n for entry in entries:\n if isinstance(entry, dict) and entry.get(\"source\") in singleton_sources:\n removed = True\n continue\n retained.append(entry)\n\n if removed:\n pool[\"removed_provider\"] = retained\n _oauth_trace(\n \"removed_provider_pool_device_code_quarantined\",\n reason=reason,\n error_code=error.code,\n )\n return removed\n\n\ndef _try_import_shared_removed_provider_state(\n *,\n timeout_seconds: float = 15.0,\n) -> Optional[Dict[str, Any]]:\n \"\"\"Attempt to rehydrate Removed provider OAuth state from the shared store.\n\n Reads the shared file (if present), runs a forced refresh using the\n stored refresh_token to produce a fresh inference JWT scoped to this\n profile, and returns the full auth_state dict ready\n for ``persist_removed_provider_credentials()``.\n\n Returns ``None`` when no shared state is available or the rehydrate\n fails for any reason (expired refresh_token, portal unreachable,\n etc.) — caller should then fall through to the normal device-code\n flow.\n \"\"\"\n try:\n with _removed_provider_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n shared = _read_shared_removed_provider_state()\n if not shared:\n return None\n\n # Build a full state dict so refresh_removed_provider_oauth_from_state has every\n # field it needs. force_refresh=True gets us a fresh access_token\n # for this profile.\n state: Dict[str, Any] = {\n \"access_token\": shared.get(\"access_token\"),\n \"refresh_token\": shared.get(\"refresh_token\"),\n \"client_id\": shared.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID,\n \"portal_base_url\": shared.get(\"portal_base_url\") or DEFAULT_REMOVED_PROVIDER_PORTAL_URL,\n \"inference_base_url\": shared.get(\"inference_base_url\") or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL,\n \"token_type\": shared.get(\"token_type\") or \"Bearer\",\n \"scope\": shared.get(\"scope\") or DEFAULT_REMOVED_PROVIDER_SCOPE,\n \"obtained_at\": shared.get(\"obtained_at\"),\n \"expires_at\": shared.get(\"expires_at\"),\n \"agent_key\": None,\n \"agent_key_expires_at\": None,\n \"tls\": {\"insecure\": False, \"ca_bundle\": None},\n }\n\n def _persist_shared_refresh(updated_state: Dict[str, Any], _reason: str) -> None:\n _write_shared_removed_provider_state(updated_state)\n\n refreshed = refresh_removed_provider_oauth_from_state(\n state,\n timeout_seconds=timeout_seconds,\n force_refresh=True,\n on_state_update=_persist_shared_refresh,\n )\n _write_shared_removed_provider_state(refreshed)\n except AuthError as exc:\n _oauth_trace(\n \"removed_provider_shared_import_failed\",\n error_type=type(exc).__name__,\n error_code=getattr(exc, \"code\", None),\n )\n if _is_terminal_removed_provider_refresh_error(exc):\n _clear_shared_removed_provider_state(\"shared_import_terminal_refresh_failure\")\n logger.debug(\"Shared Removed provider import failed: %s\", exc)\n return None\n except Exception as exc:\n _oauth_trace(\n \"removed_provider_shared_import_failed\",\n error_type=type(exc).__name__,\n )\n logger.debug(\"Shared Removed provider import failed: %s\", exc)\n return None\n\n return refreshed\n\n\ndef _refresh_access_token(\n *,\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n refresh_token: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n headers={\"x-removed_provider-refresh-token\": refresh_token},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": client_id,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise AuthError(\"Refresh response missing access_token\",\n provider=\"removed_provider\", code=\"invalid_token\", relogin_required=True)\n return payload\n\n try:\n error_payload = response.json()\n except Exception as exc:\n raise AuthError(\"Refresh token exchange failed\",\n provider=\"removed_provider\", relogin_required=True) from exc\n\n code = str(error_payload.get(\"error\", \"invalid_grant\"))\n description = str(error_payload.get(\"error_description\") or \"Refresh token exchange failed\")\n relogin = code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n\n # Detect the OAuth 2.1 \"refresh token reuse\" signal from the Removed provider portal\n # server and surface an actionable message. This fires when an external\n # process (health-check script, monitoring tool, custom self-heal hook)\n # called POST /api/oauth/token with Arcen's refresh_token without\n # persisting the rotated token back to auth.json — the server then\n # retires the original RT, Arcen's next refresh uses it, and the whole\n # session chain gets revoked as a token-theft signal (#15099).\n lowered = description.lower()\n if code == \"refresh_token_reused\" or \"reuse\" in lowered or \"reuse detected\" in lowered:\n description = (\n \"Removed provider Portal detected refresh-token reuse and revoked this session.\\n\"\n \"This usually means an external process (monitoring script, \"\n \"custom self-heal hook, or another Arcen install sharing \"\n \"~/.arcen/auth.json) called POST /api/oauth/token with Arcen's \"\n \"refresh token without persisting the rotated token back.\\n\"\n \"Removed provider refresh tokens are single-use — only Arcen may call the \"\n \"refresh endpoint. For health checks, use `arcen auth status` \"\n \"instead.\\n\"\n \"Re-authenticate with: arcen auth add removed_provider\"\n )\n relogin = True\n\n raise AuthError(description, provider=\"removed_provider\", code=code, relogin_required=relogin)\n\n\ndef fetch_removed_provider_models(\n *,\n inference_base_url: str,\n api_key: str,\n timeout_seconds: float = 15.0,\n verify: bool | str = True,\n) -> List[str]:\n \"\"\"Fetch available model IDs from the Removed provider inference API.\"\"\"\n timeout = httpx.Timeout(timeout_seconds)\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n response = client.get(\n f\"{inference_base_url.rstrip('/')}/models\",\n headers={\"Authorization\": f\"Bearer {api_key}\"},\n )\n\n if response.status_code != 200:\n description = f\"/models request failed with status {response.status_code}\"\n try:\n err = response.json()\n description = str(err.get(\"error_description\") or err.get(\"error\") or description)\n except Exception as e:\n logger.debug(\"Could not parse error response JSON: %s\", e)\n raise AuthError(description, provider=\"removed_provider\", code=\"models_fetch_failed\")\n\n payload = response.json()\n data = payload.get(\"data\")\n if not isinstance(data, list):\n return []\n\n model_ids: List[str] = []\n for item in data:\n if not isinstance(item, dict):\n continue\n model_id = item.get(\"id\")\n if isinstance(model_id, str) and model_id.strip():\n mid = model_id.strip()\n # Skip Arcen models — they're not reliable for agentic tool-calling\n if \"arcen\" in mid.lower():\n continue\n model_ids.append(mid)\n\n # Sort: prefer opus > pro > haiku/flash > sonnet (sonnet is cheap/fast,\n # users who want the best model should see opus first).\n def _model_priority(mid: str) -> tuple:\n low = mid.lower()\n if \"opus\" in low:\n return (0, mid)\n if \"pro\" in low and \"sonnet\" not in low:\n return (1, mid)\n if \"sonnet\" in low:\n return (3, mid)\n return (2, mid)\n\n model_ids.sort(key=_model_priority)\n return list(dict.fromkeys(model_ids))\n\n\ndef _agent_key_is_usable(state: Dict[str, Any], min_ttl_seconds: int) -> bool:\n key = state.get(\"agent_key\")\n if not isinstance(key, str) or not key.strip():\n return False\n return _removed_provider_invoke_jwt_is_usable(\n key,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"agent_key_expires_at\"),\n min_ttl_seconds=max(0, int(min_ttl_seconds)),\n )\n\n\ndef resolve_removed_provider_access_token(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n refresh_skew_seconds: int = ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> str:\n \"\"\"Resolve a refresh-aware Removed provider Portal access token for managed tool gateways.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"removed_provider\")\n\n if not state:\n raise AuthError(\n \"Arcen is not logged into Removed provider Portal.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"REMOVED_PROVIDER_PORTAL_BASE_URL\")\n or DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID)\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n\n with _removed_provider_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n merged_shared = _merge_shared_removed_provider_oauth_state(state)\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\n \"No access token found for Removed provider Portal login.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n\n if not _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds):\n if merged_shared:\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n return access_token\n\n if not isinstance(refresh_token, str) or not refresh_token:\n raise AuthError(\n \"Session expired and no refresh token is available.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n with httpx.Client(\n timeout=timeout,\n headers={\"Accept\": \"application/json\"},\n verify=verify,\n ) as client:\n try:\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_removed_provider_refresh_error(exc):\n _quarantine_removed_provider_oauth_state(\n state,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _quarantine_removed_provider_pool_entries(\n auth_store,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n raise\n\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl,\n tz=timezone.utc,\n ).isoformat()\n state[\"portal_base_url\"] = portal_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n _write_shared_removed_provider_state(state)\n return state[\"access_token\"]\n\n\ndef refresh_removed_provider_oauth_pure(\n access_token: str,\n refresh_token: str,\n client_id: str,\n portal_base_url: str,\n inference_base_url: str,\n *,\n token_type: str = \"Bearer\",\n scope: str = DEFAULT_REMOVED_PROVIDER_SCOPE,\n obtained_at: Optional[str] = None,\n expires_at: Optional[str] = None,\n agent_key: Optional[str] = None,\n agent_key_expires_at: Optional[str] = None,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Removed provider OAuth state without mutating auth.json directly.\n\n ``on_state_update`` is called after a successful access-token refresh.\n Callers that own persistent state can use it to save the newly rotated\n refresh token before later validation can fail.\n \"\"\"\n state: Dict[str, Any] = {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"client_id\": client_id or DEFAULT_REMOVED_PROVIDER_CLIENT_ID,\n \"portal_base_url\": (portal_base_url or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\"),\n \"inference_base_url\": (inference_base_url or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL).rstrip(\"/\"),\n \"token_type\": token_type or \"Bearer\",\n \"scope\": scope or DEFAULT_REMOVED_PROVIDER_SCOPE,\n \"obtained_at\": obtained_at,\n \"expires_at\": expires_at,\n \"agent_key\": agent_key,\n \"agent_key_expires_at\": agent_key_expires_at,\n \"tls\": {\n \"insecure\": bool(insecure),\n \"ca_bundle\": ca_bundle,\n },\n }\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n current_invoke_jwt_status = _removed_provider_invoke_jwt_status(\n state.get(\"access_token\"),\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or current_invoke_jwt_status is not None:\n refresh_token_value = state.get(\"refresh_token\")\n if not isinstance(refresh_token_value, str) or not refresh_token_value:\n if current_invoke_jwt_status is not None:\n raise AuthError(\n \"Removed provider Portal access token is not a usable inference JWT \"\n f\"({current_invoke_jwt_status}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add removed_provider\",\n provider=\"removed_provider\",\n code=current_invoke_jwt_status,\n relogin_required=True,\n )\n raise AuthError(\n \"No refresh token is available for Removed provider Portal.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=state[\"portal_base_url\"],\n client_id=state[\"client_id\"],\n refresh_token=refresh_token_value,\n )\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token_value\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_removed_provider_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n state[\"inference_base_url\"] = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n if on_state_update is not None:\n on_state_update(dict(state), \"post_refresh_access_token\")\n\n _assert_removed_provider_inference_jwt_usable(state)\n _select_removed_provider_invoke_jwt(state)\n\n return state\n\n\ndef refresh_removed_provider_oauth_from_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 15.0,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Removed provider OAuth from a state dict. Thin wrapper around refresh_removed_provider_oauth_pure.\"\"\"\n tls = state.get(\"tls\") or {}\n return refresh_removed_provider_oauth_pure(\n state.get(\"access_token\", \"\"),\n state.get(\"refresh_token\", \"\"),\n state.get(\"client_id\", \"arcen-cli\"),\n state.get(\"portal_base_url\", DEFAULT_REMOVED_PROVIDER_PORTAL_URL),\n state.get(\"inference_base_url\", DEFAULT_REMOVED_PROVIDER_INFERENCE_URL),\n token_type=state.get(\"token_type\", \"Bearer\"),\n scope=state.get(\"scope\", DEFAULT_REMOVED_PROVIDER_SCOPE),\n obtained_at=state.get(\"obtained_at\"),\n expires_at=state.get(\"expires_at\"),\n agent_key=state.get(\"agent_key\"),\n agent_key_expires_at=state.get(\"agent_key_expires_at\"),\n timeout_seconds=timeout_seconds,\n insecure=tls.get(\"insecure\"),\n ca_bundle=tls.get(\"ca_bundle\"),\n force_refresh=force_refresh,\n on_state_update=on_state_update,\n )\n\n\ndef persist_removed_provider_credentials(\n creds: Dict[str, Any],\n *,\n label: Optional[str] = None,\n):\n \"\"\"Persist Removed provider OAuth credentials as the singleton provider state\n and ensure the credential pool is in sync.\n\n Removed provider credentials are read at runtime from two independent locations:\n\n - ``providers.removed_provider``: singleton state read by\n ``resolve_removed_provider_runtime_credentials()`` during 401 recovery and by\n ``_seed_from_singletons()`` during pool load.\n - ``credential_pool.removed_provider``: used by the runtime ``pool.select()`` path.\n\n Historically ``arcen auth add removed_provider`` wrote a ``manual:device_code`` pool\n entry only, skipping ``providers.removed_provider``. When the runtime credential\n expired, the recovery path read the empty singleton state and raised\n ``AuthError`` silently (``logger.debug`` at INFO level).\n\n This helper writes ``providers.removed_provider`` then calls ``load_pool(\"removed_provider\")`` so\n ``_seed_from_singletons`` materialises the canonical ``device_code`` pool\n entry from the singleton. Re-running login upserts the same entry in\n place; the pool never accumulates duplicate device_code rows.\n\n ``label`` is an optional user-chosen display name (from\n ``arcen auth add removed_provider --label <name>``). It gets embedded in the\n singleton state so that ``_seed_from_singletons`` uses it as the pool\n entry's label on every subsequent ``load_pool(\"removed_provider\")`` instead of the\n auto-derived token fingerprint. When ``None``, the auto-derived label\n via ``label_from_token`` is used (unchanged default behaviour).\n\n Returns the upserted :class:`PooledCredential` entry (or ``None`` if\n seeding somehow produced no match — shouldn't happen).\n \"\"\"\n from agent.credential_pool import load_pool\n\n state = dict(creds)\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n\n # Mirror to the shared store so a new profile can one-tap import\n # these credentials via `arcen auth add removed_provider --type oauth`. Best-\n # effort: any I/O failure is logged and swallowed (the per-profile\n # auth.json is still the source of truth).\n _write_shared_removed_provider_state(state)\n\n pool = load_pool(\"removed_provider\")\n return next(\n (e for e in pool.entries() if e.source == REMOVED_PROVIDER_DEVICE_CODE_SOURCE),\n None,\n )\n\n\ndef _sync_removed_provider_pool_from_auth_store() -> None:\n \"\"\"Best-effort pool reseed after providers.removed_provider changes; never fail login.\"\"\"\n try:\n from agent.credential_pool import load_pool\n\n load_pool(\"removed_provider\")\n except Exception as exc:\n logger.debug(\"Failed to sync Removed provider credential pool from auth store: %s\", exc)\n\n\ndef resolve_removed_provider_runtime_credentials(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"\n Resolve Removed provider inference credentials for runtime use.\n\n Ensures access_token is a valid inference-scoped JWT, refreshing it when\n needed. Concurrent processes coordinate through the auth store file lock.\n\n Returns dict with: provider, base_url, api_key, key_id, expires_at,\n expires_in, source (\"invoke_jwt\"), and auth_path.\n \"\"\"\n sequence_id = uuid.uuid4().hex[:12]\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"removed_provider\")\n\n if not state:\n raise AuthError(\"Arcen is not logged into Removed provider Portal.\",\n provider=\"removed_provider\", relogin_required=True)\n\n persisted_state = dict(state)\n state_persisted = False\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"REMOVED_PROVIDER_PORTAL_BASE_URL\")\n or DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n ).rstrip(\"/\")\n inference_base_url = (\n _optional_base_url(state.get(\"inference_base_url\"))\n or os.getenv(\"REMOVED_PROVIDER_INFERENCE_BASE_URL\")\n or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID)\n\n def _persist_state(reason: str) -> None:\n nonlocal persisted_state, state_persisted\n # Skip writes where only derived TTL countdowns changed; this keeps\n # the mtime-keyed Removed provider auth-status cache warm during read paths.\n if (\n _removed_provider_effective_provider_state(state)\n == _removed_provider_effective_provider_state(persisted_state)\n ):\n _oauth_trace(\n \"removed_provider_state_persist_skipped\",\n sequence_id=sequence_id,\n reason=reason,\n )\n return\n try:\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n except Exception as exc:\n _oauth_trace(\n \"removed_provider_state_persist_failed\",\n sequence_id=sequence_id,\n reason=reason,\n error_type=type(exc).__name__,\n )\n raise\n _oauth_trace(\n \"removed_provider_state_persisted\",\n sequence_id=sequence_id,\n reason=reason,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n access_token_fp=_token_fingerprint(state.get(\"access_token\")),\n )\n persisted_state = dict(state)\n state_persisted = True\n # Mirror post-refresh state to the shared store so sibling\n # profiles don't hold stale refresh_tokens after rotation.\n # Best-effort — any failure is logged and swallowed inside\n # _write_shared_removed_provider_state.\n _write_shared_removed_provider_state(state)\n\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n _oauth_trace(\n \"removed_provider_runtime_credentials_start\",\n sequence_id=sequence_id,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n )\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\"No access token found for Removed provider Portal login.\",\n provider=\"removed_provider\", relogin_required=True)\n\n invoke_jwt_status = _removed_provider_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or invoke_jwt_status is not None:\n with _removed_provider_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n if _merge_shared_removed_provider_oauth_state(state):\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n invoke_jwt_status = _removed_provider_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n _persist_state(\"post_shared_merge_access_unusable\")\n\n if force_refresh or invoke_jwt_status is not None:\n if not isinstance(refresh_token, str) or not refresh_token:\n reason = invoke_jwt_status or \"force_refresh\"\n raise AuthError(\n \"Removed provider Portal access token is not a usable inference JWT \"\n f\"({reason}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add removed_provider\",\n provider=\"removed_provider\",\n code=reason,\n relogin_required=True,\n )\n\n refresh_reason = \"force_refresh\" if force_refresh else (invoke_jwt_status or \"access_unusable\")\n _oauth_trace(\n \"refresh_start\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n try:\n refreshed = _refresh_access_token(\n client=client, portal_base_url=portal_base_url,\n client_id=client_id, refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_removed_provider_refresh_error(exc):\n _quarantine_removed_provider_oauth_state(\n state,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _quarantine_removed_provider_pool_entries(\n auth_store,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _persist_state(\"terminal_runtime_access_refresh_failure\")\n raise\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n previous_refresh_token = refresh_token\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_removed_provider_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n inference_base_url = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n access_token = state[\"access_token\"]\n refresh_token = state[\"refresh_token\"]\n _oauth_trace(\n \"refresh_success\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n previous_refresh_token_fp=_token_fingerprint(previous_refresh_token),\n new_refresh_token_fp=_token_fingerprint(refresh_token),\n )\n # Persist immediately so validation failures cannot drop rotated refresh tokens.\n _persist_state(\"post_refresh_access_token\")\n\n _assert_removed_provider_inference_jwt_usable(\n state,\n access_token=access_token,\n )\n _select_removed_provider_invoke_jwt(\n state,\n access_token=access_token,\n sequence_id=sequence_id,\n )\n\n # Persist routing and TLS metadata for non-interactive refresh.\n state[\"portal_base_url\"] = portal_base_url\n state[\"inference_base_url\"] = inference_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n\n _persist_state(\"resolve_removed_provider_runtime_credentials_final\")\n\n if state_persisted:\n _sync_removed_provider_pool_from_auth_store()\n\n api_key = state.get(\"agent_key\")\n if not isinstance(api_key, str) or not api_key:\n raise AuthError(\"Failed to resolve a Removed provider inference API key\",\n provider=\"removed_provider\", code=\"server_error\")\n\n expires_at = state.get(\"agent_key_expires_at\")\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"agent_key_expires_in\"))\n )\n\n return {\n \"provider\": \"removed_provider\",\n \"base_url\": inference_base_url,\n \"api_key\": api_key,\n \"key_id\": state.get(\"agent_key_id\"),\n \"expires_at\": expires_at,\n \"expires_in\": expires_in,\n \"source\": REMOVED_PROVIDER_AUTH_PATH_INVOKE_JWT,\n \"auth_path\": REMOVED_PROVIDER_AUTH_PATH_INVOKE_JWT,\n }\n\n\n# =============================================================================\n# Status helpers\n# =============================================================================\n\ndef _empty_removed_provider_auth_status() -> Dict[str, Any]:\n return {\n \"logged_in\": False,\n \"portal_base_url\": None,\n \"inference_base_url\": None,\n \"access_expires_at\": None,\n \"agent_key_expires_at\": None,\n \"has_refresh_token\": False,\n \"inference_credential_present\": False,\n \"credential_source\": None,\n }\n\n\ndef _snapshot_removed_provider_pool_status() -> Dict[str, Any]:\n \"\"\"Best-effort status from the credential pool.\n\n This is a fallback only. The auth-store provider state is the runtime source\n of truth because it is what ``resolve_removed_provider_runtime_credentials()`` refreshes.\n \"\"\"\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"removed_provider\")\n if not pool or not pool.has_credentials():\n return _empty_removed_provider_auth_status()\n\n entries = list(pool.entries())\n if not entries:\n return _empty_removed_provider_auth_status()\n\n def _entry_sort_key(entry: Any) -> tuple[float, float, int]:\n agent_exp = _parse_iso_timestamp(getattr(entry, \"agent_key_expires_at\", None)) or 0.0\n access_exp = _parse_iso_timestamp(getattr(entry, \"expires_at\", None)) or 0.0\n priority = int(getattr(entry, \"priority\", 0) or 0)\n return (agent_exp, access_exp, -priority)\n\n entry = max(entries, key=_entry_sort_key)\n runtime_key = getattr(entry, \"runtime_api_key\", None)\n if not runtime_key:\n return _empty_removed_provider_auth_status()\n access_token = getattr(entry, \"access_token\", None)\n auth_type = str(getattr(entry, \"auth_type\", \"\") or \"\").strip().lower()\n refresh_token = getattr(entry, \"refresh_token\", None)\n is_portal_oauth = bool(access_token) and (\n auth_type.startswith(\"oauth\") or bool(refresh_token)\n )\n label = getattr(entry, \"label\", \"unknown\")\n portal_status_url = None\n if is_portal_oauth:\n portal_status_url = (\n getattr(entry, \"portal_base_url\", None)\n or DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n )\n\n return {\n \"logged_in\": is_portal_oauth,\n \"portal_base_url\": portal_status_url,\n \"inference_base_url\": getattr(entry, \"inference_base_url\", None)\n or getattr(entry, \"runtime_base_url\", None)\n or getattr(entry, \"base_url\", None),\n \"access_token\": access_token if is_portal_oauth else None,\n \"access_expires_at\": getattr(entry, \"expires_at\", None),\n \"agent_key_expires_at\": getattr(entry, \"agent_key_expires_at\", None),\n \"has_refresh_token\": bool(refresh_token),\n \"inference_credential_present\": True,\n \"credential_source\": f\"pool:{label}\",\n \"source\": f\"pool:{label}\",\n }\n except Exception:\n return _empty_removed_provider_auth_status()\n\n\n# ── Process-level memo for get_removed_provider_auth_status() ──\n# get_removed_provider_auth_status() validates state by calling resolve_removed_provider_runtime_credentials(),\n# which does a synchroremoved_provider OAuth refresh POST to . That can take\n# ~350ms even on the failure path, and read-only UI surfaces (`arcen tools`, status panels,\n# subscription-feature checks) call it many times per render — `arcen tools` → \"All Platforms\"\n# was firing the refresh ~31× during one menu paint, racking up >13s of HTTP and burning\n# single-use refresh tokens. Cache the snapshot for a few seconds, keyed on the auth.json\n# mtime so that `arcen auth login/logout/add/remove` invalidate naturally on the next call.\n_REMOVED_PROVIDER_AUTH_STATUS_CACHE_TTL = 15.0 # seconds\n_removed_provider_auth_status_cache: Optional[Tuple[float, Optional[float], Dict[str, Any]]] = None\n\n\ndef _auth_file_mtime() -> Optional[float]:\n try:\n return _auth_file_path().stat().st_mtime\n except FileNotFoundError:\n return None\n except Exception:\n return None\n\n\ndef invalidate_removed_provider_auth_status_cache() -> None:\n \"\"\"Clear the get_removed_provider_auth_status() process-level memo.\n\n Call this from any code path that mutates Removed provider auth state without going\n through resolve_removed_provider_runtime_credentials() (e.g. tests). Login/logout\n flows touch auth.json, so the mtime check below invalidates them\n automatically — explicit invalidation is the belt-and-braces option.\n \"\"\"\n global _removed_provider_auth_status_cache\n _removed_provider_auth_status_cache = None\n\n\ndef get_removed_provider_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Removed provider auth.\n\n Prefer the auth-store provider state, because that is the live source of\n truth for refresh operations. When provider state exists, validate it\n by resolving runtime credentials so revoked refresh sessions do not show up\n as a healthy login. If provider state is absent, fall back to the credential\n pool for the just-logged-in / not-yet-promoted case.\n\n The returned snapshot is memoised for ~15s keyed on the auth.json mtime,\n so menu/status surfaces that ask repeatedly don't trigger one refresh POST\n per call. Login/logout flows write to auth.json and therefore invalidate\n the cache automatically; tests can also call\n ``invalidate_removed_provider_auth_status_cache()`` explicitly.\n \"\"\"\n global _removed_provider_auth_status_cache\n now = time.monotonic()\n mtime = _auth_file_mtime()\n cached = _removed_provider_auth_status_cache\n if cached is not None:\n cached_at, cached_mtime, cached_status = cached\n if (\n cached_mtime == mtime\n and (now - cached_at) < _REMOVED_PROVIDER_AUTH_STATUS_CACHE_TTL\n ):\n return dict(cached_status)\n\n status = _compute_removed_provider_auth_status()\n _removed_provider_auth_status_cache = (now, mtime, dict(status))\n return status\n\n\ndef _compute_removed_provider_auth_status() -> Dict[str, Any]:\n \"\"\"Uncached implementation of get_removed_provider_auth_status(). See that function.\"\"\"\n state = get_provider_auth_state(\"removed_provider\")\n if state:\n base_status = {\n \"logged_in\": bool(state.get(\"access_token\")),\n \"portal_base_url\": state.get(\"portal_base_url\"),\n \"inference_base_url\": state.get(\"inference_base_url\"),\n \"access_expires_at\": state.get(\"expires_at\"),\n \"agent_key_expires_at\": state.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(state.get(\"refresh_token\")),\n \"access_token\": state.get(\"access_token\"),\n \"inference_credential_present\": bool(\n state.get(\"access_token\") or state.get(\"agent_key\")\n ),\n \"credential_source\": \"auth_store\",\n \"source\": \"auth_store\",\n }\n try:\n creds = resolve_removed_provider_runtime_credentials()\n refreshed_state = get_provider_auth_state(\"removed_provider\") or state\n base_status.update(\n {\n \"logged_in\": True,\n \"portal_base_url\": refreshed_state.get(\"portal_base_url\") or base_status.get(\"portal_base_url\"),\n \"inference_base_url\": creds.get(\"base_url\")\n or refreshed_state.get(\"inference_base_url\")\n or base_status.get(\"inference_base_url\"),\n \"access_expires_at\": refreshed_state.get(\"expires_at\") or base_status.get(\"access_expires_at\"),\n \"agent_key_expires_at\": creds.get(\"expires_at\")\n or refreshed_state.get(\"agent_key_expires_at\")\n or base_status.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(refreshed_state.get(\"refresh_token\")),\n \"inference_credential_present\": True,\n \"credential_source\": \"auth_store\",\n \"source\": f\"runtime:{creds.get('source', 'portal')}\",\n \"key_id\": creds.get(\"key_id\"),\n }\n )\n return base_status\n except AuthError as exc:\n base_status.update({\n \"logged_in\": False,\n \"error\": str(exc),\n \"relogin_required\": bool(getattr(exc, \"relogin_required\", False)),\n \"error_code\": getattr(exc, \"code\", None),\n })\n return base_status\n\n return _snapshot_removed_provider_pool_status()\n\n\ndef get_codex_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Codex auth.\n \n Checks the credential pool first (where `arcen auth` stores credentials),\n then falls back to the legacy provider state.\n \"\"\"\n # Check credential pool first — this is where `arcen auth` and\n # `arcen model` store device_code tokens.\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(\"openai-codex\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _codex_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"chatgpt\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n # Fall back to legacy provider state\n try:\n creds = resolve_codex_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_xai_oauth_auth_status() -> Dict[str, Any]:\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"xai-oauth\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _xai_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"oauth_pkce\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n try:\n creds = resolve_xai_oauth_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_api_key_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for API-key providers (z.ai, Kimi, MiniMax).\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n return {\"configured\": False}\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"configured\": bool(api_key),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"key_source\": key_source,\n \"base_url\": base_url,\n \"logged_in\": bool(api_key), # compat with OAuth status shape\n }\n\n\ndef get_external_process_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for providers that run a local subprocess.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n return {\"configured\": False}\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n resolved_command = shutil.which(command) if command else None\n return {\n \"configured\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"command\": command,\n \"args\": args,\n \"resolved_command\": resolved_command,\n \"base_url\": base_url,\n \"logged_in\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n }\n\n\ndef get_auth_status(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Generic auth status dispatcher.\"\"\"\n target = (provider_id or get_active_provider() or \"\").strip().lower()\n if not target:\n return {\"logged_in\": False}\n if target == \"spotify\":\n return get_spotify_auth_status()\n if target == \"openai-codex\":\n return get_codex_auth_status()\n if target == \"xai-oauth\":\n return get_xai_oauth_auth_status()\n if target == \"qwen-oauth\":\n return get_qwen_auth_status()\n if target == \"google-gemini-cli\":\n return get_gemini_oauth_auth_status()\n if target == \"minimax-oauth\":\n return get_minimax_oauth_auth_status()\n if target == \"copilot-acp\":\n return get_external_process_provider_status(target)\n if target == \"azure-foundry\":\n return _get_azure_foundry_auth_status()\n # API-key providers\n pconfig = PROVIDER_REGISTRY.get(target)\n if pconfig and pconfig.auth_type == \"api_key\":\n return get_api_key_provider_status(target)\n # AWS SDK providers (Bedrock) — check via boto3 credential chain\n if pconfig and pconfig.auth_type == \"aws_sdk\":\n try:\n from agent.bedrock_adapter import has_aws_credentials\n return {\"logged_in\": has_aws_credentials(), \"provider\": target}\n except ImportError:\n return {\"logged_in\": False, \"provider\": target, \"error\": \"boto3 not installed\"}\n return {\"logged_in\": False}\n\n\ndef _get_azure_foundry_auth_status() -> Dict[str, Any]:\n \"\"\"Return structural auth status for Azure Foundry.\n\n ``logged_in`` is structural, matching other non-OAuth provider status\n checks:\n\n * ``auth_mode == \"entra_id\"`` AND ``azure-identity`` is importable\n (we do NOT mint a token here; ``arcen doctor`` runs the live\n probe and reports whether the credential chain can acquire one).\n * ``auth_mode == \"api_key\"`` (default) AND ``AZURE_FOUNDRY_API_KEY``\n is set with a usable value.\n\n Never invokes the Entra credential chain — keeps CLI startup latency\n flat regardless of token-service / az login state.\n \"\"\"\n info: Dict[str, Any] = {\"provider\": \"azure-foundry\"}\n try:\n from arcen_cli.config import load_config, get_env_value\n cfg = load_config()\n except Exception:\n cfg = {}\n\n model_cfg = cfg.get(\"model\") if isinstance(cfg, dict) else None\n auth_mode = \"api_key\"\n base_url = \"\"\n if isinstance(model_cfg, dict):\n auth_mode = str(model_cfg.get(\"auth_mode\") or \"api_key\").strip().lower() or \"api_key\"\n base_url = str(model_cfg.get(\"base_url\") or \"\").strip()\n info[\"auth_mode\"] = auth_mode\n info[\"base_url\"] = base_url\n\n if auth_mode == \"entra_id\":\n try:\n from agent.azure_identity_adapter import (\n EntraIdentityConfig,\n SCOPE_AI_AZURE_DEFAULT,\n has_azure_identity_installed,\n )\n installed = has_azure_identity_installed()\n entra_cfg = {}\n if isinstance(model_cfg, dict) and isinstance(model_cfg.get(\"entra\"), dict):\n entra_cfg = model_cfg[\"entra\"]\n identity_config = EntraIdentityConfig.from_dict(\n entra_cfg,\n default_scope=SCOPE_AI_AZURE_DEFAULT,\n )\n info[\"azure_identity_installed\"] = installed\n info[\"scope\"] = identity_config.scope\n info[\"credential_probe\"] = \"not_run\"\n info[\"credential_verified\"] = False\n info[\"logged_in\"] = bool(installed)\n if not installed:\n info[\"hint\"] = (\n \"azure-identity not installed. Install with: \"\n \"pip install azure-identity (or rely on Arcen' \"\n \"lazy-install at first use).\"\n )\n else:\n info[\"hint\"] = (\n \"azure-identity is installed; live credential validation \"\n \"is skipped here. Run `arcen doctor` to verify token acquisition.\"\n )\n return info\n except Exception as exc:\n info[\"logged_in\"] = False\n info[\"error\"] = f\"azure-identity check failed: {exc}\"\n return info\n\n # api_key mode (default)\n try:\n api_key = get_env_value(\"AZURE_FOUNDRY_API_KEY\") or os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n except Exception:\n api_key = os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n info[\"logged_in\"] = has_usable_secret(api_key)\n return info\n\n\ndef resolve_api_key_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve API key and base URL for an API-key provider.\n\n Returns dict with: provider, api_key, base_url, source.\n \"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an API-key provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n # No-auth LM Studio: substitute a placeholder so runtime / auxiliary_client\n # see the local server as configured. doctor still reports unconfigured\n # because get_api_key_provider_status uses the raw secret resolver.\n if not api_key and provider_id == \"lmstudio\":\n api_key = LMSTUDIO_NOAUTH_PLACEHOLDER\n key_source = key_source or \"default\"\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif provider_id == \"zai\":\n base_url = _resolve_zai_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url.rstrip(\"/\")\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"provider\": provider_id,\n \"api_key\": api_key,\n \"base_url\": base_url.rstrip(\"/\"),\n \"source\": key_source or \"default\",\n }\n\n\ndef resolve_external_process_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve runtime details for local subprocess-backed providers.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an external-process provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n resolved_command = shutil.which(command) if command else None\n if not resolved_command and not base_url.startswith(\"acp+tcp://\"):\n raise AuthError(\n f\"Could not find the Copilot CLI command '{command}'. \"\n \"Install GitHub Copilot CLI or set ARCEN_COPILOT_ACP_COMMAND/COPILOT_CLI_PATH.\",\n provider=provider_id,\n code=\"missing_copilot_cli\",\n )\n\n return {\n \"provider\": provider_id,\n \"api_key\": \"copilot-acp\",\n \"base_url\": base_url.rstrip(\"/\"),\n \"command\": resolved_command or command,\n \"args\": args,\n \"source\": \"process\",\n }\n\n\n# =============================================================================\n# CLI Commands — login / logout\n# =============================================================================\n\ndef _update_config_for_provider(\n provider_id: str,\n inference_base_url: str,\n default_model: Optional[str] = None,\n) -> Path:\n \"\"\"Update config.yaml and auth.json to reflect the active provider.\n\n When *default_model* is provided the function also writes it as the\n ``model.default`` value. This prevents a race condition where the\n gateway (which re-reads config per-message) picks up the new provider\n before the caller has finished model selection, resulting in a\n mismatched model/provider (e.g. ``anthropic/claude-opus-4.6`` sent to\n MiniMax's API).\n \"\"\"\n # Set active_provider in auth.json so auto-resolution picks this provider\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = provider_id\n _save_auth_store(auth_store)\n\n # Update config.yaml model section\n config_path = get_config_path()\n config_path.parent.mkdir(parents=True, exist_ok=True)\n\n config = read_raw_config()\n\n current_model = config.get(\"model\")\n if isinstance(current_model, dict):\n model_cfg = dict(current_model)\n elif isinstance(current_model, str) and current_model.strip():\n model_cfg = {\"default\": current_model.strip()}\n else:\n model_cfg = {}\n\n model_cfg[\"provider\"] = provider_id\n if inference_base_url and inference_base_url.strip():\n model_cfg[\"base_url\"] = inference_base_url.rstrip(\"/\")\n else:\n # Clear stale base_url to prevent contamination when switching providers\n model_cfg.pop(\"base_url\", None)\n\n # Clear stale api_key/api_mode left over from a previous custom provider.\n # When the user switches from e.g. a MiniMax custom endpoint\n # (api_mode=anthropic_messages, api_key=mxp-...) to a built-in provider\n # (e.g. OpenRouter), the stale api_key/api_mode would override the new\n # provider's credentials and transport choice. Built-in providers that\n # need a specific api_mode (copilot, xai) set it at request-resolution\n # time via `_copilot_runtime_api_mode` / `_detect_api_mode_for_url`, so\n # removing the persisted value here is safe.\n model_cfg.pop(\"api_key\", None)\n model_cfg.pop(\"api_mode\", None)\n\n # When switching to a non-OpenRouter provider, ensure model.default is\n # valid for the new provider. An OpenRouter-formatted name like\n # \"anthropic/claude-opus-4.6\" will fail on direct-API providers.\n if default_model:\n cur_default = model_cfg.get(\"default\", \"\")\n if not cur_default or \"/\" in cur_default:\n model_cfg[\"default\"] = default_model\n\n config[\"model\"] = model_cfg\n\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _get_config_provider() -> Optional[str]:\n \"\"\"Return model.provider from config.yaml, normalized, if present.\"\"\"\n try:\n config = read_raw_config()\n except Exception:\n return None\n if not config:\n return None\n model = config.get(\"model\")\n if not isinstance(model, dict):\n return None\n provider = model.get(\"provider\")\n if not isinstance(provider, str):\n return None\n provider = provider.strip().lower()\n return provider or None\n\n\ndef _config_provider_matches(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when config.yaml currently selects *provider_id*.\"\"\"\n if not provider_id:\n return False\n return _get_config_provider() == provider_id.strip().lower()\n\n\ndef _should_reset_config_provider_on_logout(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when logout should reset the model provider config.\"\"\"\n if not provider_id:\n return False\n normalized = provider_id.strip().lower()\n return normalized in PROVIDER_REGISTRY and _config_provider_matches(normalized)\n\n\ndef _logout_default_provider_from_config() -> Optional[str]:\n \"\"\"Fallback logout target when auth.json has no active provider.\n\n `arcen logout` historically keyed off auth.json.active_provider only.\n That left users stuck when auth state had already been cleared but\n config.yaml still selected an OAuth provider such as openai-codex for the\n agent model: there was no active auth provider to target, so logout printed\n \"No provider is currently logged in\" and never reset model.provider.\n \"\"\"\n provider = _get_config_provider()\n if provider in {\"openai-codex\", \"xai-oauth\"}:\n return provider\n return None\n\n\ndef _reset_config_provider() -> Path:\n \"\"\"Reset config.yaml provider back to auto after logout.\"\"\"\n config_path = get_config_path()\n if not config_path.exists():\n return config_path\n\n config = read_raw_config()\n if not config:\n return config_path\n\n model = config.get(\"model\")\n if isinstance(model, dict):\n model[\"provider\"] = \"auto\"\n if \"base_url\" in model:\n model[\"base_url\"] = OPENROUTER_BASE_URL\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _prompt_model_selection(\n model_ids: List[str],\n current_model: str = \"\",\n pricing: Optional[Dict[str, Dict[str, str]]] = None,\n unavailable_models: Optional[List[str]] = None,\n portal_url: str = \"\",\n unavailable_message: str = \"\",\n) -> Optional[str]:\n \"\"\"Interactive model selection. Puts current_model first with a marker. Returns chosen model ID or None.\n\n If *pricing* is provided (``{model_id: {prompt, completion}}``), a compact\n price indicator is shown next to each model in aligned columns.\n\n If *unavailable_models* is provided, those models are shown grayed out\n and unselectable, with an upgrade link to *portal_url*.\n \"\"\"\n from arcen_cli.models import _format_price_per_mtok\n\n _unavailable = unavailable_models or []\n\n # Reorder: current model first, then the rest (deduplicated)\n ordered = []\n if current_model and current_model in model_ids:\n ordered.append(current_model)\n for mid in model_ids:\n if mid not in ordered:\n ordered.append(mid)\n\n # All models for column-width computation (selectable + unavailable)\n all_models = list(ordered) + list(_unavailable)\n\n # Column-aligned labels when pricing is available\n has_pricing = bool(pricing and any(pricing.get(m) for m in all_models))\n name_col = max((len(m) for m in all_models), default=0) + 2 if has_pricing else 0\n\n # Pre-compute formatted prices and dynamic column widths\n _price_cache: dict[str, tuple[str, str, str]] = {}\n price_col = 3 # minimum width\n cache_col = 0 # only set if any model has cache pricing\n has_cache = False\n if has_pricing:\n for mid in all_models:\n p = pricing.get(mid) # type: ignore[union-attr]\n if p:\n inp = _format_price_per_mtok(p.get(\"prompt\", \"\"))\n out = _format_price_per_mtok(p.get(\"completion\", \"\"))\n cache_read = p.get(\"input_cache_read\", \"\")\n cache = _format_price_per_mtok(cache_read) if cache_read else \"\"\n if cache:\n has_cache = True\n else:\n inp, out, cache = \"\", \"\", \"\"\n _price_cache[mid] = (inp, out, cache)\n price_col = max(price_col, len(inp), len(out))\n cache_col = max(cache_col, len(cache))\n if has_cache:\n cache_col = max(cache_col, 5) # minimum: \"Cache\" header\n\n def _label(mid):\n if has_pricing:\n inp, out, cache = _price_cache.get(mid, (\"\", \"\", \"\"))\n price_part = f\" {inp:>{price_col}} {out:>{price_col}}\"\n if has_cache:\n price_part += f\" {cache:>{cache_col}}\"\n base = f\"{mid:<{name_col}}{price_part}\"\n else:\n base = mid\n if mid == current_model:\n base += \" ← currently in use\"\n return base\n\n # Default cursor on the current model (index 0 if it was reordered to top)\n default_idx = 0\n\n # Build a pricing header hint for the menu title\n menu_title = \"Select default model:\"\n if has_pricing:\n # Align the header with the model column.\n # Each choice is \" {label}\" (2 spaces) and simple_term_menu prepends\n # a 3-char cursor region (\"-> \" or \" \"), so content starts at col 5.\n pad = \" \" * 5\n header = f\"\\n{pad}{'':>{name_col}} {'In':>{price_col}} {'Out':>{price_col}}\"\n if has_cache:\n header += f\" {'Cache':>{cache_col}}\"\n menu_title += header + \" /Mtok\"\n\n # ANSI escape for dim text\n _DIM = \"\\033[2m\"\n _RESET = \"\\033[0m\"\n\n # Try arrow-key menu first, fall back to number input.\n # Uses the shared curses radiolist (ESC/arrow-key handling that works\n # across terminals, incl. those that emit raw escape sequences) instead\n # of simple_term_menu, which conflicts with /dev/tty and left ESC/arrow\n # keys unreliable in the setup model picker.\n try:\n from arcen_cli.curses_ui import curses_radiolist\n\n choices = [_label(mid) for mid in ordered]\n choices.append(\"Enter custom model name\")\n choices.append(\"Skip (keep current)\")\n\n _upgrade_url = (portal_url or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip()\n if not unavailable_footer and _unavailable:\n unavailable_footer = f\"Upgrade at {_upgrade_url} for paid models\"\n\n # The pricing column header (and any unavailable-models block) is shown\n # as a multi-line description above the list so it survives the curses\n # screen clear. menu_title already embeds the aligned price header.\n desc_lines: list[str] = []\n if has_pricing:\n # menu_title is \"Select default model:\\n<pad><header> /Mtok\"\n # Keep only the header portion for the description.\n header_part = menu_title.split(\"\\n\", 1)\n if len(header_part) > 1:\n desc_lines.extend(header_part[1].splitlines())\n if _unavailable:\n for mid in _unavailable:\n desc_lines.append(f\" {_label(mid)}\")\n desc_lines.append(f\" ── {unavailable_footer} ──\")\n description = \"\\n\".join(desc_lines) if desc_lines else None\n\n idx = curses_radiolist(\n \"Select default model:\",\n choices,\n selected=default_idx,\n cancel_returns=-1,\n description=description,\n searchable=True,\n )\n if idx < 0:\n return None\n print()\n if idx < len(ordered):\n return ordered[idx]\n elif idx == len(ordered):\n try:\n custom = input(\"Enter model name: \").strip()\n except (EOFError, KeyboardInterrupt):\n return None\n return custom if custom else None\n return None\n except (ImportError, NotImplementedError, OSError, subprocess.SubprocessError):\n pass\n\n # Fallback: numbered list\n print(menu_title)\n num_width = len(str(len(ordered) + 2))\n for i, mid in enumerate(ordered, 1):\n print(f\" {i:>{num_width}}. {_label(mid)}\")\n n = len(ordered)\n print(f\" {n + 1:>{num_width}}. Enter custom model name\")\n print(f\" {n + 2:>{num_width}}. Skip (keep current)\")\n\n if _unavailable:\n _upgrade_url = (portal_url or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip() or (\n f\"Unavailable models (requires paid tier — upgrade at {_upgrade_url})\"\n )\n print()\n print(f\" {_DIM}── {unavailable_footer} ──{_RESET}\")\n for mid in _unavailable:\n print(f\" {'':>{num_width}} {_DIM}{_label(mid)}{_RESET}\")\n print()\n\n while True:\n try:\n choice = input(f\"Choice [1-{n + 2}] (default: skip): \").strip()\n if not choice:\n return None\n idx = int(choice)\n if 1 <= idx <= n:\n return ordered[idx - 1]\n elif idx == n + 1:\n custom = input(\"Enter model name: \").strip()\n return custom if custom else None\n elif idx == n + 2:\n return None\n print(f\"Please enter 1-{n + 2}\")\n except ValueError:\n print(\"Please enter a number\")\n except (KeyboardInterrupt, EOFError):\n return None\n\n\ndef _save_model_choice(model_id: str) -> None:\n \"\"\"Save the selected model to config.yaml (single source of truth).\n\n The model is stored in config.yaml only — NOT in .env. This avoids\n conflicts in multi-agent setups where env vars would stomp each other.\n \"\"\"\n from arcen_cli.config import save_config, load_config\n\n config = load_config()\n # Always use dict format so provider/base_url can be stored alongside\n if isinstance(config.get(\"model\"), dict):\n config[\"model\"][\"default\"] = model_id\n else:\n config[\"model\"] = {\"default\": model_id}\n save_config(config)\n\n\ndef login_command(args) -> None:\n \"\"\"Deprecated: use 'arcen model' or 'arcen setup' instead.\"\"\"\n print(\"The 'arcen login' command has been removed.\")\n print(\"Use 'arcen auth' to manage credentials,\")\n print(\"'arcen model' to select a provider, or 'arcen setup' for full setup.\")\n raise SystemExit(0)\n\n\ndef _login_openai_codex(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n \"\"\"OpenAI Codex login via device code flow. Tokens stored in ~/.arcen/auth.json.\"\"\"\n\n del args, pconfig # kept for parity with other provider login helpers\n\n # Check for existing Arcen-owned credentials\n if not force_new_login:\n try:\n existing = resolve_codex_runtime_credentials()\n # Verify the resolved token is actually usable (not expired).\n # resolve_codex_runtime_credentials attempts refresh, so if we get\n # here the token should be valid — but double-check before telling\n # the user \"Login successful!\".\n _resolved_key = existing.get(\"api_key\", \"\")\n if isinstance(_resolved_key, str) and _resolved_key and not _codex_access_token_is_expiring(_resolved_key, 60):\n print(\"Existing Codex credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\"openai-codex\", existing.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n else:\n print(\"Existing Codex credentials are expired. Starting fresh login...\")\n except AuthError:\n pass\n\n # Check for existing Codex CLI tokens we can import\n if not force_new_login:\n cli_tokens = _import_codex_cli_tokens()\n if cli_tokens:\n print(\"Found existing Codex CLI credentials at ~/.codex/auth.json\")\n print(\"Arcen will create its own session to avoid conflicts with Codex CLI / VS Code.\")\n try:\n do_import = input(\"Import these credentials? (a separate login is recommended) [y/N]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"n\"\n if do_import in {\"y\", \"yes\"}:\n _save_codex_tokens(cli_tokens)\n base_url = os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_CODEX_BASE_URL\n config_path = _update_config_for_provider(\"openai-codex\", base_url)\n print()\n print(\"Credentials imported. Note: if Codex CLI refreshes its token,\")\n print(\"Arcen will keep working independently with its own session.\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n\n # Run a fresh device code flow — Arcen gets its own OAuth session\n print()\n print(\"Signing in to OpenAI Codex...\")\n print(\"(Arcen creates its own session — won't affect Codex CLI or VS Code)\")\n print()\n\n creds = _codex_device_code_login()\n\n # Save tokens to Arcen auth store\n _save_codex_tokens(creds[\"tokens\"], creds.get(\"last_refresh\"))\n config_path = _update_config_for_provider(\"openai-codex\", creds.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n\n\ndef _login_xai_oauth(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n del pconfig\n\n if not force_new_login:\n try:\n existing = resolve_xai_oauth_runtime_credentials()\n api_key = existing.get(\"api_key\", \"\")\n if isinstance(api_key, str) and api_key and not _xai_access_token_is_expiring(api_key, 60):\n print(\"Existing xAI OAuth credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\n \"xai-oauth\",\n existing.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL),\n )\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n return\n except AuthError:\n pass\n\n print()\n print(\"Signing in to xAI Grok OAuth (SuperGrok / Premium+)...\")\n print(\"(Arcen creates its own local OAuth session)\")\n print()\n\n timeout_seconds = float(getattr(args, \"timeout\", None) or 20.0)\n open_browser = not getattr(args, \"no_browser\", False)\n if _is_remote_session():\n open_browser = False\n manual_paste = bool(getattr(args, \"manual_paste\", False))\n\n creds = _xai_oauth_loopback_login(\n timeout_seconds=timeout_seconds,\n open_browser=open_browser,\n manual_paste=manual_paste,\n )\n _save_xai_oauth_tokens(\n creds[\"tokens\"],\n discovery=creds.get(\"discovery\"),\n redirect_uri=creds.get(\"redirect_uri\", \"\"),\n last_refresh=creds.get(\"last_refresh\"),\n )\n config_path = _update_config_for_provider(\"xai-oauth\", creds.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n\n\ndef _xai_oauth_build_authorize_url(\n *,\n authorization_endpoint: str,\n redirect_uri: str,\n code_challenge: str,\n state: str,\n nonce: str,\n) -> str:\n # `plan=generic` opts the consent screen into xAI's generic OAuth plan\n # tier instead of falling back to the per-account default. Without it,\n # accounts.x.ai rejects loopback OAuth from non-allowlisted clients.\n # `referrer=arcen-agent` lets xAI attribute Arcen-originated logins\n # in their OAuth server logs (we still impersonate the upstream Grok-CLI\n # client_id; this is best-effort attribution until xAI mints us our own).\n authorize_params = {\n \"response_type\": \"code\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"redirect_uri\": redirect_uri,\n \"scope\": XAI_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n \"nonce\": nonce,\n \"plan\": \"generic\",\n \"referrer\": \"arcen-agent\",\n }\n return f\"{authorization_endpoint}?{urlencode(authorize_params)}\"\n\n\ndef _xai_oauth_exchange_code_for_tokens(\n *,\n token_endpoint: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n code_challenge: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"POST the authorization code to xAI's token endpoint and return\n the parsed JSON payload.\n\n Sends ``code_verifier`` as required by RFC 7636 §4.5. Also echoes\n ``code_challenge`` + ``code_challenge_method`` in the request body\n as a defense-in-depth measure for OAuth servers (xAI's among them,\n per #26990) that re-validate the challenge at the token step\n instead of relying solely on server-side session state captured\n during the authorize step. Echoing the challenge is harmless for\n strict RFC-compliant servers — RFC 7636 doesn't forbid additional\n parameters at the token endpoint — and decisively fixes the\n ``code_challenge is required`` failure mode users hit on the\n loopback flow.\n\n Raises :class:`AuthError` on any non-2xx response or transport\n failure; the error message embeds the HTTP status code and the\n full response body so users can disambiguate cause at a glance.\n \"\"\"\n # Paranoia: if upstream call sites ever drop ``code_verifier`` we\n # want to surface a precise, local error rather than send a\n # missing-PKCE request to xAI and receive their generic \"code\n # challenge required\" message back.\n if not code_verifier:\n raise AuthError(\n \"xAI token exchange refused locally: PKCE code_verifier is empty. \"\n \"This is a bug in Arcen — please report at \"\n \"https://github.com/AdityaKumar41/arcen-agent/issues/26990.\",\n provider=\"xai-oauth\",\n code=\"xai_pkce_verifier_missing\",\n )\n\n data = {\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"code_verifier\": code_verifier,\n }\n # Defense-in-depth: include the original ``code_challenge`` and\n # ``code_challenge_method``. Some OAuth servers (including xAI's\n # auth.x.ai implementation, per the symptom reported in #26990)\n # validate these at the token endpoint instead of relying purely on\n # state captured during the authorize step — without them, xAI\n # rejects the exchange with ``code_challenge is required`` even\n # though we sent a valid ``code_verifier``.\n if code_challenge:\n data[\"code_challenge\"] = code_challenge\n data[\"code_challenge_method\"] = \"S256\"\n\n try:\n response = httpx.post(\n token_endpoint,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data=data,\n timeout=max(20.0, timeout_seconds),\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n ) from exc\n\n if response.status_code != 200:\n body = response.text.strip()\n # See ``refresh_xai_oauth_pure`` — token-exchange 403 also\n # surfaces tier/entitlement gating from xAI's backend. Avoid\n # the misleading \"re-authenticate\" hint and point at the API\n # key fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n f\"xAI token exchange failed (HTTP 403).\"\n + (f\" Response: {body}\" if body else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Set ``XAI_API_KEY``\"\n \" and switch to ``provider: xai`` (API-key path) if\"\n \" available, or upgrade your subscription at\"\n \" https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n f\"xAI token exchange failed (HTTP {response.status_code}).\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token exchange response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n return payload\n\n\ndef _xai_oauth_loopback_login(\n *,\n timeout_seconds: float = 20.0,\n open_browser: bool = True,\n manual_paste: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Run the xAI OAuth PKCE flow.\n\n When ``manual_paste=True`` the loopback HTTP listener is skipped\n entirely and the user is prompted to paste the failed callback\n URL into stdin (regression fix for #26923 — browser-only remote\n consoles like GCP Cloud Shell / GitHub Codespaces / EC2 Instance\n Connect, where the laptop's browser can't reach 127.0.0.1 on the\n remote VM). The same PKCE verifier, ``state``, and ``nonce`` are\n used for both paths so the upstream-side OAuth flow is identical.\n \"\"\"\n def _stdin_supports_manual_paste() -> bool:\n try:\n return bool(getattr(sys.stdin, \"isatty\", lambda: False)())\n except Exception:\n return False\n\n discovery = _xai_oauth_discovery(timeout_seconds)\n authorization_endpoint = discovery[\"authorization_endpoint\"]\n token_endpoint = discovery[\"token_endpoint\"]\n\n if manual_paste:\n # No HTTP listener — synthesize a redirect_uri matching what\n # the server would have bound to so the authorize URL the user\n # opens (and the redirect_uri sent in the token exchange) stay\n # byte-identical to the loopback path. xAI's token endpoint\n # cross-checks redirect_uri against the authorize request.\n redirect_uri = (\n f\"http://{XAI_OAUTH_REDIRECT_HOST}:{XAI_OAUTH_REDIRECT_PORT}\"\n f\"{XAI_OAUTH_REDIRECT_PATH}\"\n )\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n callback = _prompt_manual_callback_paste(redirect_uri)\n else:\n server, thread, callback_result, redirect_uri = _xai_start_callback_server()\n try:\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n print()\n print(f\"Waiting for callback on {redirect_uri}\")\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=XAI_OAUTH_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for xAI authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n try:\n callback = _xai_wait_for_callback(\n server,\n thread,\n callback_result,\n timeout_seconds=max(30.0, timeout_seconds * 9),\n )\n except AuthError as exc:\n if (\n getattr(exc, \"code\", \"\") != \"xai_callback_timeout\"\n or not _stdin_supports_manual_paste()\n ):\n raise\n print()\n print(\"xAI loopback callback timed out.\")\n print(\"If your browser reached a failed 127.0.0.1 callback page,\")\n print(\"paste that FULL callback URL below to continue this login.\")\n print(\"You can also re-run with `--manual-paste` to skip the\")\n print(\"loopback listener from the start.\")\n callback = _prompt_manual_callback_paste(redirect_uri)\n if callback.get(\"code\") is None and callback.get(\"error\") is None:\n raise exc\n except Exception:\n try:\n server.shutdown()\n server.server_close()\n except Exception:\n pass\n try:\n thread.join(timeout=1.0)\n except Exception:\n pass\n raise\n\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise AuthError(\n f\"xAI authorization failed: {detail}\",\n provider=\"xai-oauth\",\n code=\"xai_authorization_failed\",\n )\n callback_state = callback.get(\"state\")\n # Manual-paste bare-code path: when a user pastes only the opaque\n # authorization code (no ``code=``/``state=`` query parameters),\n # ``_parse_pasted_callback`` returns ``state=None``. xAI's consent\n # page renders the code in-page rather than redirecting through the\n # 127.0.0.1 callback, so on many remote setups (Cloud Shell, headless\n # VPS, container consoles) the bare code is the only thing the user\n # can obtain. PKCE (code_verifier) still binds the exchange to this\n # client, so the local state-equality check is redundant on the\n # bare-code path — we substitute the locally generated state to keep\n # the rest of the validation chain (and the token exchange) unchanged.\n # See #26923 (AccursedGalaxy comment, 2026-05-20).\n if callback_state is None and manual_paste:\n callback_state = state\n if callback_state != state:\n raise AuthError(\n \"xAI authorization failed: state mismatch.\",\n provider=\"xai-oauth\",\n code=\"xai_state_mismatch\",\n )\n code = str(callback.get(\"code\") or \"\").strip()\n if not code:\n raise AuthError(\n \"xAI authorization failed: missing authorization code.\",\n provider=\"xai-oauth\",\n code=\"xai_code_missing\",\n )\n\n payload = _xai_oauth_exchange_code_for_tokens(\n token_endpoint=token_endpoint,\n code=code,\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n code_challenge=code_challenge,\n timeout_seconds=timeout_seconds,\n )\n access_token = str(payload.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(payload.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI token exchange did not return an access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n if not refresh_token:\n raise AuthError(\n \"xAI token exchange did not return a refresh_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"id_token\": str(payload.get(\"id_token\", \"\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n },\n \"discovery\": discovery,\n \"redirect_uri\": redirect_uri,\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"source\": \"oauth-loopback\",\n }\n\n\ndef _codex_device_code_login() -> Dict[str, Any]:\n \"\"\"Run the OpenAI device code login flow and return credentials dict.\"\"\"\n import time as _time\n\n issuer = \"https://auth.openai.com\"\n client_id = CODEX_OAUTH_CLIENT_ID\n\n # Step 1: Request device code\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/usercode\",\n json={\"client_id\": client_id},\n headers={\"Content-Type\": \"application/json\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Failed to request device code: {exc}\",\n provider=\"openai-codex\", code=\"device_code_request_failed\",\n )\n\n if resp.status_code != 200:\n raise AuthError(\n f\"Device code request returned status {resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_request_error\",\n )\n\n device_data = resp.json()\n user_code = device_data.get(\"user_code\", \"\")\n device_auth_id = device_data.get(\"device_auth_id\", \"\")\n poll_interval = max(3, int(device_data.get(\"interval\", \"5\")))\n\n if not user_code or not device_auth_id:\n raise AuthError(\n \"Device code response missing required fields.\",\n provider=\"openai-codex\", code=\"device_code_incomplete\",\n )\n\n # Step 2: Show user the code\n print(\"To continue, follow these steps:\\n\")\n print(\" 1. Open this URL in your browser:\")\n print(f\" \\033[94m{issuer}/codex/device\\033[0m\\n\")\n print(\" 2. Enter this code:\")\n print(f\" \\033[94m{user_code}\\033[0m\\n\")\n print(\"Waiting for sign-in... (press Ctrl+C to cancel)\")\n\n # Step 3: Poll for authorization code\n max_wait = 15 * 60 # 15 minutes\n start = _time.monotonic()\n code_resp = None\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n while _time.monotonic() - start < max_wait:\n _time.sleep(poll_interval)\n poll_resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/token\",\n json={\"device_auth_id\": device_auth_id, \"user_code\": user_code},\n headers={\"Content-Type\": \"application/json\"},\n )\n\n if poll_resp.status_code == 200:\n code_resp = poll_resp.json()\n break\n elif poll_resp.status_code in {403, 404}:\n continue # User hasn't completed login yet\n else:\n raise AuthError(\n f\"Device auth polling returned status {poll_resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_poll_error\",\n )\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n\n if code_resp is None:\n raise AuthError(\n \"Login timed out after 15 minutes.\",\n provider=\"openai-codex\", code=\"device_code_timeout\",\n )\n\n # Step 4: Exchange authorization code for tokens\n authorization_code = code_resp.get(\"authorization_code\", \"\")\n code_verifier = code_resp.get(\"code_verifier\", \"\")\n redirect_uri = f\"{issuer}/deviceauth/callback\"\n\n if not authorization_code or not code_verifier:\n raise AuthError(\n \"Device auth response missing authorization_code or code_verifier.\",\n provider=\"openai-codex\", code=\"device_code_incomplete_exchange\",\n )\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n token_resp = client.post(\n CODEX_OAUTH_TOKEN_URL,\n data={\n \"grant_type\": \"authorization_code\",\n \"code\": authorization_code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": client_id,\n \"code_verifier\": code_verifier,\n },\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Token exchange failed: {exc}\",\n provider=\"openai-codex\", code=\"token_exchange_failed\",\n )\n\n if token_resp.status_code != 200:\n raise AuthError(\n f\"Token exchange returned status {token_resp.status_code}.\",\n provider=\"openai-codex\", code=\"token_exchange_error\",\n )\n\n tokens = token_resp.json()\n access_token = tokens.get(\"access_token\", \"\")\n refresh_token = tokens.get(\"refresh_token\", \"\")\n\n if not access_token:\n raise AuthError(\n \"Token exchange did not return an access_token.\",\n provider=\"openai-codex\", code=\"token_exchange_no_access_token\",\n )\n\n # Return tokens for the caller to persist (no longer writes to ~/.codex/)\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n },\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"auth_mode\": \"chatgpt\",\n \"source\": \"device-code\",\n }\n\n\n# ==================== MiniMax Portal OAuth ====================\n\ndef _minimax_pkce_pair() -> tuple:\n \"\"\"Generate (code_verifier, code_challenge_S256, state) for MiniMax OAuth.\"\"\"\n import secrets\n verifier = secrets.token_urlsafe(64)[:96]\n challenge = base64.urlsafe_b64encode(\n hashlib.sha256(verifier.encode()).digest()\n ).decode().rstrip(\"=\")\n state = secrets.token_urlsafe(16)\n return verifier, challenge, state\n\n\ndef _minimax_request_user_code(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n code_challenge: str, state: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/oauth/code\",\n data={\n \"response_type\": \"code\",\n \"client_id\": client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n \"x-request-id\": str(uuid.uuid4()),\n },\n )\n if response.status_code != 200:\n raise AuthError(\n f\"MiniMax OAuth authorization failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"authorization_failed\",\n )\n payload = response.json()\n for field in (\"user_code\", \"verification_uri\", \"expired_in\"):\n if field not in payload:\n raise AuthError(\n f\"MiniMax OAuth response missing field: {field}\",\n provider=\"minimax-oauth\", code=\"authorization_incomplete\",\n )\n if payload.get(\"state\") != state:\n raise AuthError(\n \"MiniMax OAuth state mismatch (possible CSRF).\",\n provider=\"minimax-oauth\", code=\"state_mismatch\",\n )\n return payload\n\n\ndef _minimax_expired_in_looks_like_unix_ms(expired_in: int, *, now_ms: int) -> bool:\n \"\"\"True if ``expired_in`` is plausibly a unix-ms absolute time (vs TTL seconds).\"\"\"\n return int(expired_in) > (now_ms // 2)\n\n\ndef _minimax_resolve_token_expiry_unix(expired_in: int, *, now: datetime) -> float:\n \"\"\"Return access-token expiry as unix seconds (MiniMax uses ms epoch or TTL seconds).\"\"\"\n raw = int(expired_in)\n now_ms = int(now.timestamp() * 1000)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n return raw / 1000.0\n return now.timestamp() + max(1, raw)\n\n\ndef _minimax_poll_token(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n user_code: str, code_verifier: str, expired_in: int, interval_ms: Optional[int],\n) -> Dict[str, Any]:\n # OpenClaw treats expired_in as a unix-ms timestamp (Date.now() < expireTimeMs).\n # Defensive parsing: if it's small enough to be a duration, treat as seconds.\n import time as _time\n now_ms = int(_time.time() * 1000)\n raw = int(expired_in)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n deadline = raw / 1000.0\n else:\n deadline = _time.time() + max(1, raw)\n interval = max(2.0, (interval_ms or 2000) / 1000.0)\n\n while _time.time() < deadline:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": MINIMAX_OAUTH_GRANT_TYPE,\n \"client_id\": client_id,\n \"user_code\": user_code,\n \"code_verifier\": code_verifier,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n try:\n payload = response.json() if response.text else {}\n except Exception:\n payload = {}\n\n if response.status_code != 200:\n msg = (payload.get(\"base_resp\", {}) or {}).get(\"status_msg\") or response.text\n raise AuthError(\n f\"MiniMax OAuth error: {msg or 'unknown'}\",\n provider=\"minimax-oauth\", code=\"token_exchange_failed\",\n )\n\n status = payload.get(\"status\")\n if status == \"error\":\n raise AuthError(\n \"MiniMax OAuth reported an error. Please try again later.\",\n provider=\"minimax-oauth\", code=\"authorization_denied\",\n )\n if status == \"success\":\n if not all(payload.get(k) for k in (\"access_token\", \"refresh_token\", \"expired_in\")):\n raise AuthError(\n \"MiniMax OAuth success payload missing required token fields.\",\n provider=\"minimax-oauth\", code=\"token_incomplete\",\n )\n return payload\n # \"pending\" or any other status -> keep polling\n _time.sleep(interval)\n\n raise AuthError(\n \"MiniMax OAuth timed out before authorization completed.\",\n provider=\"minimax-oauth\", code=\"timeout\",\n )\n\n\ndef _minimax_save_auth_state(auth_state: Dict[str, Any]) -> None:\n \"\"\"Persist MiniMax OAuth state to Arcen auth store (~/.arcen/auth.json).\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"minimax-oauth\", auth_state)\n _save_auth_store(auth_store)\n\n\ndef _minimax_oauth_login(\n *, region: str = \"global\", open_browser: bool = True,\n timeout_seconds: float = 15.0,\n) -> Dict[str, Any]:\n \"\"\"Run MiniMax OAuth flow, persist tokens, return auth state dict.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"minimax-oauth\"]\n if region == \"cn\":\n portal_base_url = pconfig.extra[\"cn_portal_base_url\"]\n inference_base_url = pconfig.extra[\"cn_inference_base_url\"]\n else:\n portal_base_url = pconfig.portal_base_url\n inference_base_url = pconfig.inference_base_url\n\n verifier, challenge, state = _minimax_pkce_pair()\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via MiniMax ({region}) OAuth...\")\n print(f\"Portal: {portal_base_url}\")\n\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n headers={\"Accept\": \"application/json\"},\n follow_redirects=True) as client:\n code_data = _minimax_request_user_code(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n code_challenge=challenge, state=state,\n )\n verification_url = str(code_data[\"verification_uri\"])\n user_code = str(code_data[\"user_code\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n if open_browser and _can_open_graphical_browser():\n if webbrowser.open(verification_url):\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically -- use the URL above.\")\n\n interval_raw = code_data.get(\"interval\")\n interval_ms = int(interval_raw) if interval_raw is not None else None\n print(\"Waiting for approval...\")\n\n token_data = _minimax_poll_token(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n user_code=user_code, code_verifier=verifier,\n expired_in=int(code_data[\"expired_in\"]),\n interval_ms=interval_ms,\n )\n\n now = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(token_data[\"expired_in\"]), now=now,\n )\n expires_in_s = max(0, int(expires_at_unix - now.timestamp()))\n\n auth_state = {\n \"provider\": \"minimax-oauth\",\n \"region\": region,\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": inference_base_url,\n \"client_id\": pconfig.client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data[\"refresh_token\"],\n \"resource_url\": token_data.get(\"resource_url\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n }\n\n _minimax_save_auth_state(auth_state)\n print(\"\\u2713 MiniMax OAuth login successful.\")\n if msg := token_data.get(\"notification_message\"):\n print(f\"Note from MiniMax: {msg}\")\n return auth_state\n\n\ndef _refresh_minimax_oauth_state(\n state: Dict[str, Any], *, timeout_seconds: float = 15.0,\n force: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Refresh MiniMax OAuth access token if close to expiry (or forced).\"\"\"\n if not state.get(\"refresh_token\"):\n raise AuthError(\n \"MiniMax OAuth state has no refresh_token; please re-login.\",\n provider=\"minimax-oauth\", code=\"no_refresh_token\", relogin_required=True,\n )\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n except Exception:\n expires_at = 0.0\n now = time.time()\n if not force and (expires_at - now) > MINIMAX_OAUTH_REFRESH_SKEW_SECONDS:\n return state\n\n portal_base_url = state[\"portal_base_url\"]\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n follow_redirects=True) as client:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": state[\"client_id\"],\n \"refresh_token\": state[\"refresh_token\"],\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n if response.status_code != 200:\n body = response.text.lower()\n relogin = any(m in body for m in\n (\"invalid_grant\", \"refresh_token_reused\", \"invalid_refresh_token\"))\n raise AuthError(\n f\"MiniMax OAuth refresh failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=relogin,\n )\n payload = response.json()\n if payload.get(\"status\") != \"success\":\n raise AuthError(\n \"MiniMax OAuth refresh did not return success.\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=True,\n )\n now_dt = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(payload[\"expired_in\"]), now=now_dt,\n )\n expires_in_s = max(0, int(expires_at_unix - now_dt.timestamp()))\n new_state = dict(state)\n new_state.update({\n \"access_token\": payload[\"access_token\"],\n \"refresh_token\": payload.get(\"refresh_token\", state[\"refresh_token\"]),\n \"obtained_at\": now_dt.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n })\n _minimax_save_auth_state(new_state)\n return new_state\n\n\ndef _minimax_oauth_quarantine_on_terminal_refresh(state: Dict[str, Any], exc: AuthError) -> None:\n \"\"\"Wipe dead tokens from auth.json after a terminal refresh failure.\n\n Shared by both the eager-resolve path and the lazy per-request token\n provider. Mirrors the Removed provider / xAI-OAuth / Codex-OAuth quarantine pattern\n so subsequent calls fail fast without a network retry.\n \"\"\"\n if not (exc.relogin_required and state.get(\"refresh_token\")):\n return\n for _k in (\"access_token\", \"refresh_token\", \"expires_at\", \"expires_in\", \"obtained_at\"):\n state.pop(_k, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"minimax-oauth\",\n \"code\": exc.code or \"refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n _minimax_save_auth_state(state)\n except Exception as _save_exc:\n logger.debug(\"MiniMax OAuth: failed to persist quarantined state: %s\", _save_exc)\n\n\ndef build_minimax_oauth_token_provider() -> Callable[[], str]:\n \"\"\"Return a zero-arg callable that yields a fresh MiniMax access token.\n\n The Anthropic SDK caches ``api_key`` as a static string at construction\n time, so a session that resolves credentials once at startup will keep\n sending the same bearer until MiniMax's server returns 401 — typically\n ~15 minutes in, because MiniMax issues short-lived access tokens.\n\n Returning a *callable* instead of a string lets us hook into the\n existing Entra-ID bearer infrastructure in\n :mod:`agent.anthropic_adapter`: ``build_anthropic_client`` detects a\n callable and routes through ``_build_anthropic_client_with_bearer_hook``,\n which mints a fresh ``Authorization`` header on every outbound request.\n Each invocation re-reads the persisted state from ``auth.json`` and\n calls :func:`_refresh_minimax_oauth_state` — that helper is a no-op\n when the token still has more than ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS``\n of life left, so the steady-state cost is one file read + one\n timestamp compare per request.\n\n Reading state fresh each time also means a refresh persisted by one\n process (CLI, gateway, cron) is immediately visible to every other\n process sharing the same ``auth.json``.\n \"\"\"\n def _provide() -> str:\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n token = state.get(\"access_token\")\n if not token:\n raise AuthError(\n \"MiniMax OAuth state has no access_token after refresh.\",\n provider=\"minimax-oauth\", code=\"no_access_token\", relogin_required=True,\n )\n return token\n\n return _provide\n\n\ndef resolve_minimax_oauth_runtime_credentials(\n *, min_token_ttl_seconds: int = MINIMAX_OAUTH_REFRESH_SKEW_SECONDS,\n as_token_provider: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Return {provider, api_key, base_url, source} for minimax-oauth.\n\n When ``as_token_provider`` is True, ``api_key`` is a zero-arg callable\n that mints a fresh access token per call (proactively refreshing if\n the cached token is within ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS`` of\n expiry). This is what the runtime provider path uses so that long\n sessions survive MiniMax's short access-token lifetime — see\n :func:`build_minimax_oauth_token_provider` for the rationale.\n\n The default (string ``api_key``) preserves the historical contract for\n diagnostic call sites like ``arcen status`` that just want to know\n whether a valid token exists right now.\n \"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n if as_token_provider:\n api_key: Any = build_minimax_oauth_token_provider()\n else:\n api_key = state[\"access_token\"]\n return {\n \"provider\": \"minimax-oauth\",\n \"api_key\": api_key,\n \"base_url\": state[\"inference_base_url\"].rstrip(\"/\"),\n \"source\": \"oauth\",\n }\n\n\ndef get_minimax_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return auth status dict for MiniMax OAuth provider.\"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n return {\"logged_in\": False, \"provider\": \"minimax-oauth\"}\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n token_valid = (expires_at - time.time()) > 0\n except Exception:\n token_valid = bool(state.get(\"access_token\"))\n return {\n \"logged_in\": token_valid,\n \"provider\": \"minimax-oauth\",\n \"region\": state.get(\"region\", \"global\"),\n \"expires_at\": state.get(\"expires_at\"),\n }\n\n\ndef _login_minimax_oauth(args, pconfig: ProviderConfig) -> None:\n \"\"\"CLI entry for MiniMax OAuth login.\"\"\"\n region = getattr(args, \"region\", None) or \"global\"\n open_browser = not getattr(args, \"no_browser\", False)\n timeout = getattr(args, \"timeout\", None) or 15.0\n try:\n _minimax_oauth_login(\n region=region, open_browser=open_browser, timeout_seconds=timeout,\n )\n except AuthError as exc:\n print(format_auth_error(exc))\n raise SystemExit(1)\n\n\ndef _removed_provider_device_code_login(\n *,\n portal_base_url: Optional[str] = None,\n inference_base_url: Optional[str] = None,\n client_id: Optional[str] = None,\n scope: Optional[str] = None,\n open_browser: bool = True,\n timeout_seconds: float = 15.0,\n insecure: bool = False,\n ca_bundle: Optional[str] = None,\n) -> Dict[str, Any]:\n \"\"\"Run the Removed provider device-code flow and return full OAuth state without persisting.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"removed_provider\"]\n portal_base_url = (\n portal_base_url\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"REMOVED_PROVIDER_PORTAL_BASE_URL\")\n or pconfig.portal_base_url\n ).rstrip(\"/\")\n requested_inference_url = (\n inference_base_url\n or os.getenv(\"REMOVED_PROVIDER_INFERENCE_BASE_URL\")\n or pconfig.inference_base_url\n ).rstrip(\"/\")\n client_id = client_id or pconfig.client_id\n scope = scope or pconfig.scope\n timeout = httpx.Timeout(timeout_seconds)\n verify: bool | str = False if insecure else (ca_bundle if ca_bundle else True)\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via {pconfig.name}...\")\n print(f\"Portal: {portal_base_url}\")\n if insecure:\n print(\"TLS verification: disabled (--insecure)\")\n elif ca_bundle:\n print(f\"TLS verification: custom CA bundle ({ca_bundle})\")\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n device_data = _request_device_code(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n scope=scope,\n )\n\n verification_url = str(device_data[\"verification_uri_complete\"])\n user_code = str(device_data[\"user_code\"])\n expires_in = int(device_data[\"expires_in\"])\n interval = int(device_data[\"interval\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n\n if open_browser:\n opened = webbrowser.open(verification_url)\n if opened:\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically — use the URL above.\")\n\n effective_interval = max(1, min(interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n print(f\"Waiting for approval (polling every {effective_interval}s)...\")\n\n token_data = _poll_for_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n device_code=str(device_data[\"device_code\"]),\n expires_in=expires_in,\n poll_interval=interval,\n )\n\n now = datetime.now(timezone.utc)\n token_expires_in = _coerce_ttl_seconds(token_data.get(\"expires_in\", 0))\n expires_at = now.timestamp() + token_expires_in\n resolved_inference_url = (\n _optional_base_url(token_data.get(\"inference_base_url\"))\n or requested_inference_url\n )\n if resolved_inference_url != requested_inference_url:\n print(f\"Using portal-provided inference URL: {resolved_inference_url}\")\n\n auth_state = {\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": resolved_inference_url,\n \"client_id\": client_id,\n \"scope\": token_data.get(\"scope\") or scope,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data.get(\"refresh_token\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at, tz=timezone.utc).isoformat(),\n \"expires_in\": token_expires_in,\n \"tls\": {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n },\n \"agent_key\": None,\n \"agent_key_id\": None,\n \"agent_key_expires_at\": None,\n \"agent_key_expires_in\": None,\n \"agent_key_reused\": None,\n \"agent_key_obtained_at\": None,\n }\n try:\n return refresh_removed_provider_oauth_from_state(\n auth_state,\n timeout_seconds=timeout_seconds,\n force_refresh=False,\n )\n except AuthError as exc:\n if exc.code == \"subscription_required\":\n portal_url = auth_state.get(\n \"portal_base_url\", DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n ).rstrip(\"/\")\n message = format_auth_error(exc)\n print()\n print(message)\n print(f\" Subscribe here: {portal_url}/billing\")\n print()\n print(\"After subscribing, run `arcen model` again to finish setup.\")\n raise SystemExit(1)\n raise\n\n\ndef _login_removed_provider(args, pconfig: ProviderConfig) -> None:\n \"\"\"Removed provider Portal device authorization flow.\"\"\"\n timeout_seconds = getattr(args, \"timeout\", None) or 15.0\n insecure = bool(getattr(args, \"insecure\", False))\n ca_bundle = (\n getattr(args, \"ca_bundle\", None)\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n )\n\n try:\n auth_state = None\n\n # Codex-style auto-import: before launching a fresh device-code\n # flow, check the shared store for an existing Removed provider credential\n # from any other profile. If present, offer to rehydrate it.\n shared = _read_shared_removed_provider_state()\n if shared:\n try:\n shared_path = _removed_provider_shared_store_path()\n except RuntimeError:\n shared_path = None\n print()\n if shared_path:\n print(f\"Found existing Removed provider OAuth credentials at {shared_path}\")\n else:\n print(\"Found existing shared Removed provider OAuth credentials\")\n try:\n do_import = input(\"Import these credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"y\"\n if do_import in {\"\", \"y\", \"yes\"}:\n print(\"Rehydrating Removed provider session from shared credentials...\")\n auth_state = _try_import_shared_removed_provider_state(\n timeout_seconds=timeout_seconds,\n )\n if auth_state is None:\n print(\"Could not refresh shared credentials — falling back to device-code login.\")\n\n if auth_state is None:\n auth_state = _removed_provider_device_code_login(\n portal_base_url=getattr(args, \"portal_url\", None),\n inference_base_url=getattr(args, \"inference_url\", None),\n client_id=getattr(args, \"client_id\", None) or pconfig.client_id,\n scope=getattr(args, \"scope\", None),\n open_browser=not getattr(args, \"no_browser\", False),\n timeout_seconds=timeout_seconds,\n insecure=insecure,\n ca_bundle=ca_bundle,\n )\n\n inference_base_url = auth_state[\"inference_base_url\"]\n\n # Snapshot the prior active_provider BEFORE _save_provider_state\n # overwrites it to \"removed_provider\". If the user picks \"Skip (keep current)\"\n # during model selection below, we restore this so the user's previous\n # provider (e.g. openrouter) is preserved.\n with _auth_store_lock():\n _prior_store = _load_auth_store()\n prior_active_provider = _prior_store.get(\"active_provider\")\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"removed_provider\", auth_state)\n saved_to = _save_auth_store(auth_store)\n\n # Mirror to the shared store so other profiles can one-tap import\n # these credentials. Best-effort: any I/O failure is logged and\n # swallowed inside the helper.\n _write_shared_removed_provider_state(auth_state)\n _sync_removed_provider_pool_from_auth_store()\n\n print()\n print(\"Login successful!\")\n print(f\" Auth state: {saved_to}\")\n\n # Resolve model BEFORE writing provider to config.yaml so we never\n # leave the config in a half-updated state (provider=removed_provider but model\n # still set to the previous provider's model, e.g. opus from\n # OpenRouter). The auth.json active_provider was already set above.\n selected_model = None\n try:\n runtime_key = auth_state.get(\"agent_key\") or auth_state.get(\"access_token\")\n if not isinstance(runtime_key, str) or not runtime_key:\n raise AuthError(\n \"No runtime API key available to fetch models\",\n provider=\"removed_provider\",\n code=\"invalid_token\",\n )\n\n from arcen_cli.models import (\n get_curated_removed_provider_model_ids, get_pricing_for_provider,\n check_removed_provider_free_tier, partition_removed_provider_models_by_tier,\n union_with_portal_free_recommendations,\n union_with_portal_paid_recommendations,\n )\n model_ids = get_curated_removed_provider_model_ids()\n\n print()\n unavailable_models: list = []\n unavailable_message = \"\"\n if model_ids:\n pricing = get_pricing_for_provider(\"removed_provider\")\n # Force fresh account data for model selection so recent credit\n # purchases are reflected immediately.\n free_tier = check_removed_provider_free_tier(force_fresh=True)\n _portal_for_recs = auth_state.get(\"portal_base_url\", \"\")\n if free_tier:\n try:\n from arcen_cli.removed_provider_account import (\n format_removed_provider_portal_entitlement_message,\n get_removed_provider_portal_account_info,\n )\n\n _account_info = get_removed_provider_portal_account_info(force_fresh=True)\n unavailable_message = (\n format_removed_provider_portal_entitlement_message(\n _account_info,\n capability=\"paid Removed provider models\",\n )\n or \"\"\n )\n except Exception:\n unavailable_message = \"\"\n # The Portal's freeRecommendedModels endpoint is the\n # source of truth for what's free *right now*. Augment\n # the curated list with anything new the Portal flags\n # as free so users on older Arcen builds still see\n # newly-launched free models without a CLI release.\n model_ids, pricing = union_with_portal_free_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n model_ids, unavailable_models = partition_removed_provider_models_by_tier(\n model_ids, pricing, free_tier=True,\n )\n else:\n # Paid-tier mirror: pull paidRecommendedModels so newly\n # launched paid models surface in the picker even if\n # the in-repo curated list and docs-hosted manifest\n # haven't caught up yet.\n model_ids, pricing = union_with_portal_paid_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n _portal = auth_state.get(\"portal_base_url\", \"\")\n if model_ids:\n print(f\"Showing {len(model_ids)} curated models — use \\\"Enter custom model name\\\" for others.\")\n selected_model = _prompt_model_selection(\n model_ids, pricing=pricing,\n unavailable_models=unavailable_models,\n portal_url=_portal,\n unavailable_message=unavailable_message,\n )\n elif unavailable_models:\n _url = (_portal or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n print(\"No free models currently available.\")\n print(unavailable_message or f\"Upgrade at {_url} to access paid models.\")\n else:\n print(\"No curated models available for Removed provider Portal.\")\n except Exception as exc:\n message = format_auth_error(exc) if isinstance(exc, AuthError) else str(exc)\n print()\n print(f\"Login succeeded, but could not fetch available models. Reason: {message}\")\n\n # Write provider + model atomically so config is never mismatched.\n # If no model was selected (user picked \"Skip (keep current)\",\n # model list fetch failed, or no curated models were available),\n # preserve the user's previous provider — don't silently switch\n # them to Removed provider with a mismatched model. The Removed provider OAuth tokens\n # stay saved for future use.\n if not selected_model:\n # Restore the prior active_provider that _save_provider_state\n # overwrote to \"removed_provider\". config.yaml model.provider is left\n # untouched, so the user's previous provider is fully preserved.\n with _auth_store_lock():\n auth_store = _load_auth_store()\n if prior_active_provider:\n auth_store[\"active_provider\"] = prior_active_provider\n else:\n auth_store.pop(\"active_provider\", None)\n _save_auth_store(auth_store)\n print()\n print(\"No provider change. Removed provider credentials saved for future use.\")\n print(\" Run `arcen model` again to switch to Removed provider Portal.\")\n return\n\n config_path = _update_config_for_provider(\n \"removed_provider\", inference_base_url, default_model=selected_model,\n )\n if selected_model:\n _save_model_choice(selected_model)\n print(f\"Default model set to: {selected_model}\")\n print(f\" Config updated: {config_path} (model.provider=removed_provider)\")\n\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n except Exception as exc:\n print(f\"Login failed: {exc}\")\n raise SystemExit(1)\n\n\ndef logout_command(args) -> None:\n \"\"\"Clear auth state for a provider.\"\"\"\n provider_id = getattr(args, \"provider\", None)\n\n if provider_id and not is_known_auth_provider(provider_id):\n print(f\"Unknown provider: {provider_id}\")\n raise SystemExit(1)\n\n active = get_active_provider()\n target = provider_id or active or _logout_default_provider_from_config()\n\n if not target:\n print(\"No provider is currently logged in.\")\n return\n\n should_reset_config = _should_reset_config_provider_on_logout(target)\n provider_name = get_auth_provider_display_name(target)\n\n if clear_provider_auth(target) or should_reset_config:\n if should_reset_config:\n _reset_config_provider()\n print(f\"Logged out of {provider_name}.\")\n if should_reset_config and os.getenv(\"OPENROUTER_API_KEY\"):\n print(\"Arcen will use OpenRouter for inference.\")\n elif should_reset_config:\n print(\"Run `arcen model` or configure an API key to use Arcen.\")\n else:\n print(\"Model provider configuration was unchanged.\")\n else:\n print(f\"No auth state found for {provider_name}.\")\n"}, "81b4882a0000bdf683277950d2005c3f852dadea": {"t": 1785753031.4037077, "n": 308010, "h": "5a37e8a8d2c76c58", "c": "\"\"\"\nMulti-provider authentication system for Arcen Agent.\n\nSupports OAuth device code flows (Removed provider Portal, future: OpenAI Codex) and\ntraditional API key providers (OpenRouter, custom endpoints). Auth state\nis persisted in ~/.arcen/auth.json with cross-process file locking.\n\nArchitecture:\n- ProviderConfig registry defines known OAuth providers\n- Auth store (auth.json) holds per-provider credential state\n- resolve_provider() picks the active provider via priority chain\n- resolve_*_runtime_credentials() handles token refresh and runtime keys\n- logout_command() is the CLI entry point for clearing auth\n\nRemoved provider authentication paths:\n- Invoke JWT (preferred): use a scoped access_token directly for inference.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport logging\nimport os\nimport shutil\nimport shlex\nimport ssl\nimport stat\nimport sys\nimport base64\nimport hashlib\nimport subprocess\nimport threading\nimport time\nimport uuid\nimport webbrowser\nfrom contextlib import contextmanager\nfrom dataclasses import dataclass, field\nfrom datetime import datetime, timezone\nfrom http.server import BaseHTTPRequestHandler, HTTPServer, ThreadingHTTPServer\nfrom pathlib import Path\nfrom typing import Any, Callable, Dict, FrozenSet, List, Optional, Tuple\nfrom urllib.parse import parse_qs, urlencode, urlparse\n\nimport httpx\n\nfrom arcen_cli.config import get_arcen_home, get_config_path, read_raw_config\nfrom arcen_constants import OPENROUTER_BASE_URL, secure_parent_dir\nfrom agent.credential_persistence import sanitize_borrowed_credential_payload\nfrom utils import atomic_replace, atomic_yaml_write, is_truthy_value\n\nlogger = logging.getLogger(__name__)\n\ntry:\n import fcntl\nexcept Exception:\n fcntl = None\ntry:\n import msvcrt\nexcept Exception:\n msvcrt = None\n\n# =============================================================================\n# Constants\n# =============================================================================\n\nAUTH_STORE_VERSION = 1\nAUTH_LOCK_TIMEOUT_SECONDS = 15.0\n\n# Legacy Removed provider Portal constants are kept only for backward-compatible auth-store\n# cleanup helpers. The provider is not registered or offered in Arcen Agent.\nDEFAULT_REMOVED_PROVIDER_PORTAL_URL = \"\"\nDEFAULT_REMOVED_PROVIDER_INFERENCE_URL = \"\"\nDEFAULT_REMOVED_PROVIDER_CLIENT_ID = \"\"\nREMOVED_PROVIDER_INFERENCE_INVOKE_SCOPE = \"inference:invoke\"\nDEFAULT_REMOVED_PROVIDER_SCOPE = \"\"\nREMOVED_PROVIDER_DEVICE_CODE_SOURCE = \"device_code\"\nREMOVED_PROVIDER_AUTH_PATH_INVOKE_JWT = \"invoke_jwt\"\nACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120 # refresh 2 min before expiry\nREMOVED_PROVIDER_INVOKE_JWT_MIN_TTL_SECONDS = ACCESS_TOKEN_REFRESH_SKEW_SECONDS\nDEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS = 1 # poll at most every 1s\nDEFAULT_CODEX_BASE_URL = \"https://chatgpt.com/backend-api/codex\"\nDEFAULT_XAI_OAUTH_BASE_URL = \"https://api.x.ai/v1\"\nMINIMAX_OAUTH_CLIENT_ID = \"78257093-7e40-4613-99e0-527b14b39113\"\nMINIMAX_OAUTH_SCOPE = \"group_id profile model.completion\"\nMINIMAX_OAUTH_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:user_code\"\nMINIMAX_OAUTH_GLOBAL_BASE = \"https://api.minimax.io\"\nMINIMAX_OAUTH_CN_BASE = \"https://api.minimaxi.com\"\nMINIMAX_OAUTH_GLOBAL_INFERENCE = \"https://api.minimax.io/anthropic\"\nMINIMAX_OAUTH_CN_INFERENCE = \"https://api.minimaxi.com/anthropic\"\nMINIMAX_OAUTH_REFRESH_SKEW_SECONDS = 60\nDEFAULT_QWEN_BASE_URL = \"https://portal.qwen.ai/v1\"\nDEFAULT_GITHUB_MODELS_BASE_URL = \"https://api.githubcopilot.com\"\nDEFAULT_COPILOT_ACP_BASE_URL = \"acp://copilot\"\nDEFAULT_OLLAMA_CLOUD_BASE_URL = \"https://ollama.com/v1\"\nSTEPFUN_STEP_PLAN_INTL_BASE_URL = \"https://api.stepfun.ai/step_plan/v1\"\nSTEPFUN_STEP_PLAN_CN_BASE_URL = \"https://api.stepfun.com/step_plan/v1\"\nCODEX_OAUTH_CLIENT_ID = \"app_EMoamEEZ73f0CkXaXp7hrann\"\nCODEX_OAUTH_TOKEN_URL = \"https://auth.openai.com/oauth/token\"\nCODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nXAI_OAUTH_ISSUER = \"https://auth.x.ai\"\nXAI_OAUTH_DISCOVERY_URL = f\"{XAI_OAUTH_ISSUER}/.well-known/openid-configuration\"\nXAI_OAUTH_CLIENT_ID = \"b1a00492-073a-47ea-816f-4c329264a828\"\nXAI_OAUTH_SCOPE = \"openid profile email offline_access grok-cli:access api:access\"\nXAI_OAUTH_REDIRECT_HOST = \"127.0.0.1\"\nXAI_OAUTH_REDIRECT_PORT = 56121\nXAI_OAUTH_REDIRECT_PATH = \"/callback\"\nXAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nQWEN_OAUTH_CLIENT_ID = \"f0304373b74a44d2b584a3fb70ca9e56\"\nQWEN_OAUTH_TOKEN_URL = \"https://chat.qwen.ai/api/v1/oauth2/token\"\nQWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nDEFAULT_SPOTIFY_ACCOUNTS_BASE_URL = \"https://accounts.spotify.com\"\nDEFAULT_SPOTIFY_API_BASE_URL = \"https://api.spotify.com/v1\"\nDEFAULT_SPOTIFY_REDIRECT_URI = \"http://127.0.0.1:43827/spotify/callback\"\nSPOTIFY_DOCS_URL = \"https://arcen-cli.arcenpay.com/docs/user-guide/features/spotify\"\nSPOTIFY_DASHBOARD_URL = \"https://developer.spotify.com/dashboard\"\nSPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\n\nXAI_OAUTH_DOCS_URL = \"https://arcen-cli.arcenpay.com/docs/guides/xai-grok-oauth\"\nOAUTH_OVER_SSH_DOCS_URL = \"https://arcen-cli.arcenpay.com/docs/guides/oauth-over-ssh\"\nDEFAULT_SPOTIFY_SCOPE = \" \".join((\n \"user-modify-playback-state\",\n \"user-read-playback-state\",\n \"user-read-currently-playing\",\n \"user-read-recently-played\",\n \"playlist-read-private\",\n \"playlist-read-collaborative\",\n \"playlist-modify-public\",\n \"playlist-modify-private\",\n \"user-library-read\",\n \"user-library-modify\",\n))\nSERVICE_PROVIDER_NAMES: Dict[str, str] = {\n \"spotify\": \"Spotify\",\n}\n\n# Google Gemini OAuth (google-gemini-cli provider, Cloud Code Assist backend)\nDEFAULT_GEMINI_CLOUDCODE_BASE_URL = \"cloudcode-pa://google\"\nGEMINI_OAUTH_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 60 # refresh 60s before expiry\n\n# LM Studio's default no-auth mode still requires *some* non-empty bearer for\n# the API-key code paths (auxiliary_client, runtime resolver) to treat the\n# provider as configured. This sentinel is sent only to LM Studio, never to\n# any remote service.\nLMSTUDIO_NOAUTH_PLACEHOLDER = \"dummy-lm-api-key\"\n\n\n# =============================================================================\n# Provider Registry\n# =============================================================================\n\n@dataclass\nclass ProviderConfig:\n \"\"\"Describes a known inference provider.\"\"\"\n id: str\n name: str\n auth_type: str # \"oauth_device_code\", \"oauth_external\", \"oauth_minimax\", or \"api_key\"\n portal_base_url: str = \"\"\n inference_base_url: str = \"\"\n client_id: str = \"\"\n scope: str = \"\"\n extra: Dict[str, Any] = field(default_factory=dict)\n # For API-key providers: env vars to check (in priority order)\n api_key_env_vars: tuple = ()\n # Optional env var for base URL override\n base_url_env_var: str = \"\"\n\n\nPROVIDER_REGISTRY: Dict[str, ProviderConfig] = {\n \"openai-codex\": ProviderConfig(\n id=\"openai-codex\",\n name=\"OpenAI Codex\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_CODEX_BASE_URL,\n ),\n \"openai-api\": ProviderConfig(\n id=\"openai-api\",\n name=\"OpenAI API\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.openai.com/v1\",\n api_key_env_vars=(\"OPENAI_API_KEY\",),\n base_url_env_var=\"OPENAI_BASE_URL\",\n ),\n \"xai-oauth\": ProviderConfig(\n id=\"xai-oauth\",\n name=\"xAI Grok OAuth (SuperGrok / Premium+)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_XAI_OAUTH_BASE_URL,\n ),\n \"qwen-oauth\": ProviderConfig(\n id=\"qwen-oauth\",\n name=\"Qwen OAuth\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_QWEN_BASE_URL,\n ),\n \"google-gemini-cli\": ProviderConfig(\n id=\"google-gemini-cli\",\n name=\"Google Gemini (OAuth)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_GEMINI_CLOUDCODE_BASE_URL,\n ),\n \"lmstudio\": ProviderConfig(\n id=\"lmstudio\",\n name=\"LM Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"http://127.0.0.1:1234/v1\",\n api_key_env_vars=(\"LM_API_KEY\",),\n base_url_env_var=\"LM_BASE_URL\",\n ),\n \"copilot\": ProviderConfig(\n id=\"copilot\",\n name=\"GitHub Copilot\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_GITHUB_MODELS_BASE_URL,\n api_key_env_vars=(\"COPILOT_GITHUB_TOKEN\", \"GH_TOKEN\", \"GITHUB_TOKEN\"),\n base_url_env_var=\"COPILOT_API_BASE_URL\",\n ),\n \"copilot-acp\": ProviderConfig(\n id=\"copilot-acp\",\n name=\"GitHub Copilot ACP\",\n auth_type=\"external_process\",\n inference_base_url=DEFAULT_COPILOT_ACP_BASE_URL,\n base_url_env_var=\"COPILOT_ACP_BASE_URL\",\n ),\n \"gemini\": ProviderConfig(\n id=\"gemini\",\n name=\"Google AI Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"https://generativelanguage.googleapis.com/v1beta\",\n api_key_env_vars=(\"GOOGLE_API_KEY\", \"GEMINI_API_KEY\"),\n base_url_env_var=\"GEMINI_BASE_URL\",\n ),\n \"zai\": ProviderConfig(\n id=\"zai\",\n name=\"Z.AI / GLM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.z.ai/api/paas/v4\",\n api_key_env_vars=(\"GLM_API_KEY\", \"ZAI_API_KEY\", \"Z_AI_API_KEY\"),\n base_url_env_var=\"GLM_BASE_URL\",\n ),\n \"kimi-coding\": ProviderConfig(\n id=\"kimi-coding\",\n name=\"Kimi / Moonshot\",\n auth_type=\"api_key\",\n # Legacy platform.moonshot.ai keys use this endpoint (OpenAI-compat).\n # sk-kimi- (Kimi Code) keys are auto-redirected to api.kimi.com/coding\n # by _resolve_kimi_base_url() below.\n inference_base_url=\"https://api.moonshot.ai/v1\",\n api_key_env_vars=(\"KIMI_API_KEY\", \"KIMI_CODING_API_KEY\"),\n base_url_env_var=\"KIMI_BASE_URL\",\n ),\n \"kimi-coding-cn\": ProviderConfig(\n id=\"kimi-coding-cn\",\n name=\"Kimi / Moonshot (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.moonshot.cn/v1\",\n api_key_env_vars=(\"KIMI_CN_API_KEY\",),\n ),\n \"stepfun\": ProviderConfig(\n id=\"stepfun\",\n name=\"StepFun Step Plan\",\n auth_type=\"api_key\",\n inference_base_url=STEPFUN_STEP_PLAN_INTL_BASE_URL,\n api_key_env_vars=(\"STEPFUN_API_KEY\",),\n base_url_env_var=\"STEPFUN_BASE_URL\",\n ),\n \"arcee\": ProviderConfig(\n id=\"arcee\",\n name=\"Arcee AI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.arcee.ai/api/v1\",\n api_key_env_vars=(\"ARCEEAI_API_KEY\",),\n base_url_env_var=\"ARCEE_BASE_URL\",\n ),\n \"gmi\": ProviderConfig(\n id=\"gmi\",\n name=\"GMI Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.gmi-serving.com/v1\",\n api_key_env_vars=(\"GMI_API_KEY\",),\n base_url_env_var=\"GMI_BASE_URL\",\n ),\n \"minimax\": ProviderConfig(\n id=\"minimax\",\n name=\"MiniMax\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimax.io/anthropic\",\n api_key_env_vars=(\"MINIMAX_API_KEY\",),\n base_url_env_var=\"MINIMAX_BASE_URL\",\n ),\n \"minimax-oauth\": ProviderConfig(\n id=\"minimax-oauth\",\n name=\"MiniMax (OAuth \\u00b7 minimax.io)\",\n auth_type=\"oauth_minimax\",\n portal_base_url=MINIMAX_OAUTH_GLOBAL_BASE,\n inference_base_url=MINIMAX_OAUTH_GLOBAL_INFERENCE,\n client_id=MINIMAX_OAUTH_CLIENT_ID,\n scope=MINIMAX_OAUTH_SCOPE,\n extra={\"region\": \"global\", \"cn_portal_base_url\": MINIMAX_OAUTH_CN_BASE,\n \"cn_inference_base_url\": MINIMAX_OAUTH_CN_INFERENCE},\n ),\n \"anthropic\": ProviderConfig(\n id=\"anthropic\",\n name=\"Anthropic\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.anthropic.com\",\n api_key_env_vars=(\"ANTHROPIC_API_KEY\", \"ANTHROPIC_TOKEN\", \"CLAUDE_CODE_OAUTH_TOKEN\"),\n base_url_env_var=\"ANTHROPIC_BASE_URL\",\n ),\n \"alibaba\": ProviderConfig(\n id=\"alibaba\",\n name=\"Qwen Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://dashscope-intl.aliyuncs.com/compatible-mode/v1\",\n api_key_env_vars=(\"DASHSCOPE_API_KEY\",),\n base_url_env_var=\"DASHSCOPE_BASE_URL\",\n ),\n \"alibaba-coding-plan\": ProviderConfig(\n id=\"alibaba-coding-plan\",\n name=\"Alibaba Cloud (Coding Plan)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://coding-intl.dashscope.aliyuncs.com/v1\",\n api_key_env_vars=(\"ALIBABA_CODING_PLAN_API_KEY\", \"DASHSCOPE_API_KEY\"),\n base_url_env_var=\"ALIBABA_CODING_PLAN_BASE_URL\",\n ),\n \"minimax-cn\": ProviderConfig(\n id=\"minimax-cn\",\n name=\"MiniMax (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimaxi.com/anthropic\",\n api_key_env_vars=(\"MINIMAX_CN_API_KEY\",),\n base_url_env_var=\"MINIMAX_CN_BASE_URL\",\n ),\n \"deepseek\": ProviderConfig(\n id=\"deepseek\",\n name=\"DeepSeek\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.deepseek.com/v1\",\n api_key_env_vars=(\"DEEPSEEK_API_KEY\",),\n base_url_env_var=\"DEEPSEEK_BASE_URL\",\n ),\n \"xai\": ProviderConfig(\n id=\"xai\",\n name=\"xAI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.x.ai/v1\",\n api_key_env_vars=(\"XAI_API_KEY\",),\n base_url_env_var=\"XAI_BASE_URL\",\n ),\n \"nvidia\": ProviderConfig(\n id=\"nvidia\",\n name=\"NVIDIA NIM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://integrate.api.nvidia.com/v1\",\n api_key_env_vars=(\"NVIDIA_API_KEY\",),\n base_url_env_var=\"NVIDIA_BASE_URL\",\n ),\n \"opencode-zen\": ProviderConfig(\n id=\"opencode-zen\",\n name=\"OpenCode Zen\",\n auth_type=\"api_key\",\n inference_base_url=\"https://opencode.ai/zen/v1\",\n api_key_env_vars=(\"OPENCODE_ZEN_API_KEY\",),\n base_url_env_var=\"OPENCODE_ZEN_BASE_URL\",\n ),\n \"opencode-go\": ProviderConfig(\n id=\"opencode-go\",\n name=\"OpenCode Go\",\n auth_type=\"api_key\",\n # OpenCode Go mixes API surfaces by model:\n # - GLM / Kimi use OpenAI-compatible chat completions under /v1\n # - MiniMax models use Anthropic Messages under /v1/messages\n # - Qwen 3.7 uses Anthropic Messages under /v1/messages\n # Keep the provider base at /v1 and select api_mode per-model.\n inference_base_url=\"https://opencode.ai/zen/go/v1\",\n api_key_env_vars=(\"OPENCODE_GO_API_KEY\",),\n base_url_env_var=\"OPENCODE_GO_BASE_URL\",\n ),\n \"kilocode\": ProviderConfig(\n id=\"kilocode\",\n name=\"Kilo Code\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.kilo.ai/api/gateway\",\n api_key_env_vars=(\"KILOCODE_API_KEY\",),\n base_url_env_var=\"KILOCODE_BASE_URL\",\n ),\n \"huggingface\": ProviderConfig(\n id=\"huggingface\",\n name=\"Hugging Face\",\n auth_type=\"api_key\",\n inference_base_url=\"https://router.huggingface.co/v1\",\n api_key_env_vars=(\"HF_TOKEN\",),\n base_url_env_var=\"HF_BASE_URL\",\n ),\n \"xiaomi\": ProviderConfig(\n id=\"xiaomi\",\n name=\"Xiaomi MiMo\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.xiaomimimo.com/v1\",\n api_key_env_vars=(\"XIAOMI_API_KEY\",),\n base_url_env_var=\"XIAOMI_BASE_URL\",\n ),\n \"tencent-tokenhub\": ProviderConfig(\n id=\"tencent-tokenhub\",\n name=\"Tencent TokenHub\",\n auth_type=\"api_key\",\n inference_base_url=\"https://tokenhub.tencentmaas.com/v1\",\n api_key_env_vars=(\"TOKENHUB_API_KEY\",),\n base_url_env_var=\"TOKENHUB_BASE_URL\",\n ),\n \"ollama-cloud\": ProviderConfig(\n id=\"ollama-cloud\",\n name=\"Ollama Cloud\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_OLLAMA_CLOUD_BASE_URL,\n api_key_env_vars=(\"OLLAMA_API_KEY\",),\n base_url_env_var=\"OLLAMA_BASE_URL\",\n ),\n \"bedrock\": ProviderConfig(\n id=\"bedrock\",\n name=\"AWS Bedrock\",\n auth_type=\"aws_sdk\",\n inference_base_url=\"https://bedrock-runtime.us-east-1.amazonaws.com\",\n api_key_env_vars=(),\n base_url_env_var=\"BEDROCK_BASE_URL\",\n ),\n \"azure-foundry\": ProviderConfig(\n id=\"azure-foundry\",\n name=\"Azure Foundry\",\n auth_type=\"api_key\",\n inference_base_url=\"\", # User-provided endpoint\n api_key_env_vars=(\"AZURE_FOUNDRY_API_KEY\",),\n base_url_env_var=\"AZURE_FOUNDRY_BASE_URL\",\n ),\n}\n\n# Auto-extend PROVIDER_REGISTRY with any api-key provider registered in\n# providers/ that is not already declared above. New providers only need a\n# plugins/model-providers/<name>/ plugin — no edits to this file required.\ntry:\n from providers import list_providers as _list_providers_for_registry\n for _pp in _list_providers_for_registry():\n if _pp.name in PROVIDER_REGISTRY:\n continue\n if _pp.auth_type != \"api_key\" or not _pp.env_vars:\n continue\n # Skip providers that need custom token resolution or are special-cased\n # in resolve_provider() (copilot/kimi/zai have bespoke token refresh;\n # openrouter/custom are aggregator/user-supplied and handled outside\n # the registry — adding them here breaks runtime_provider resolution\n # that relies on `openrouter not in PROVIDER_REGISTRY`).\n if _pp.name in {\"copilot\", \"kimi-coding\", \"kimi-coding-cn\", \"zai\", \"openrouter\", \"custom\"}:\n continue\n _api_key_vars = tuple(v for v in _pp.env_vars if not v.endswith(\"_BASE_URL\") and not v.endswith(\"_URL\"))\n _base_url_var = next((v for v in _pp.env_vars if v.endswith(\"_BASE_URL\") or v.endswith(\"_URL\")), None)\n PROVIDER_REGISTRY[_pp.name] = ProviderConfig(\n id=_pp.name,\n name=_pp.display_name or _pp.name,\n auth_type=\"api_key\",\n inference_base_url=_pp.base_url,\n api_key_env_vars=_api_key_vars or _pp.env_vars,\n base_url_env_var=_base_url_var or \"\",\n )\n # Also register aliases so resolve_provider() resolves them\n for _alias in _pp.aliases:\n if _alias not in PROVIDER_REGISTRY:\n PROVIDER_REGISTRY[_alias] = PROVIDER_REGISTRY[_pp.name]\nexcept Exception:\n pass\n\n\n# =============================================================================\n# Anthropic Key Helper\n# =============================================================================\n\ndef get_anthropic_key() -> str:\n \"\"\"Return the first usable Anthropic credential, or ``\"\"``.\n\n Checks both the ``.env`` file (via ``get_env_value``) and the process\n environment (``os.getenv``). The fallback order mirrors the\n ``PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars`` tuple:\n\n ANTHROPIC_API_KEY -> ANTHROPIC_TOKEN -> CLAUDE_CODE_OAUTH_TOKEN\n \"\"\"\n from arcen_cli.config import get_env_value\n\n for var in PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars:\n value = get_env_value(var) or os.getenv(var, \"\")\n if value:\n return value\n return \"\"\n\n\n# =============================================================================\n# Kimi Code Endpoint Detection\n# =============================================================================\n\n# Kimi Code (kimi.com/code) issues keys prefixed \"sk-kimi-\" that only work\n# on api.kimi.com/coding. Legacy keys from platform.moonshot.ai work on\n# api.moonshot.ai/v1 (the old default). Auto-detect when user hasn't set\n# KIMI_BASE_URL explicitly.\n#\n# Note: the base URL intentionally has NO /v1 suffix. The /coding endpoint\n# speaks the Anthropic Messages protocol, and the anthropic SDK appends\n# \"/v1/messages\" internally — so \"/coding\" + SDK suffix → \"/coding/v1/messages\"\n# (the correct target). Using \"/coding/v1\" here would produce\n# \"/coding/v1/v1/messages\" (a 404).\nKIMI_CODE_BASE_URL = \"https://api.kimi.com/coding\"\n\n\ndef _resolve_kimi_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Kimi base URL based on the API key prefix.\n\n If the user has explicitly set KIMI_BASE_URL, that always wins.\n Otherwise, sk-kimi- prefixed keys route to api.kimi.com/coding/v1.\n \"\"\"\n if env_override:\n return env_override\n # No key → nothing to infer from. Return default without inspecting.\n if not api_key:\n return default_url\n if api_key.startswith(\"sk-kimi-\"):\n return KIMI_CODE_BASE_URL\n return default_url\n\n\n\n_PLACEHOLDER_SECRET_VALUES = {\n \"*\",\n \"**\",\n \"***\",\n \"changeme\",\n \"your_api_key\",\n \"your_api_key_here\",\n \"your-api-key\",\n \"placeholder\",\n \"example\",\n \"dummy\",\n \"null\",\n \"none\",\n}\n\n\ndef has_usable_secret(value: Any, *, min_length: int = 4) -> bool:\n \"\"\"Return True when a configured secret looks usable, not empty/placeholder.\"\"\"\n if not isinstance(value, str):\n return False\n cleaned = value.strip()\n if len(cleaned) < min_length:\n return False\n if cleaned.lower() in _PLACEHOLDER_SECRET_VALUES:\n return False\n return True\n\n\ndef _resolve_api_key_provider_secret(\n provider_id: str, pconfig: ProviderConfig\n) -> tuple[str, str]:\n \"\"\"Resolve an API-key provider's token and indicate where it came from.\"\"\"\n if provider_id == \"copilot\":\n # Use the dedicated copilot auth module for proper token validation\n try:\n from arcen_cli.copilot_auth import resolve_copilot_token, get_copilot_api_token\n token, source = resolve_copilot_token()\n if token:\n return get_copilot_api_token(token), source\n except ValueError as exc:\n logger.warning(\"Copilot token validation failed: %s\", exc)\n except Exception:\n pass\n return \"\", \"\"\n\n from arcen_cli.config import get_env_value\n for env_var in pconfig.api_key_env_vars:\n # Check both os.environ and ~/.arcen/.env file\n val = (get_env_value(env_var) or \"\").strip()\n if has_usable_secret(val):\n return val, env_var\n\n # Fallback: try credential pool (e.g. zai key stored via auth.json)\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(provider_id)\n if pool and pool.has_credentials():\n entry = pool.peek()\n if entry:\n key = getattr(entry, \"access_token\", \"\") or getattr(entry, \"runtime_api_key\", \"\")\n key = str(key).strip()\n if has_usable_secret(key):\n return key, f\"credential_pool:{provider_id}\"\n except Exception:\n pass\n\n return \"\", \"\"\n\n\n# =============================================================================\n# Z.AI Endpoint Detection\n# =============================================================================\n\n# Z.AI has separate billing for general vs coding plans, and global vs China\n# endpoints. A key that works on one may return \"Insufficient balance\" on\n# another. We probe at setup time and store the working endpoint.\n# Each entry lists candidate models to try in order — newer coding plan accounts\n# may only have access to recent models (glm-5.1, glm-5v-turbo) while older\n# ones still use glm-4.7.\n\nZAI_ENDPOINTS = [\n # (id, base_url, probe_models, label)\n (\"global\", \"https://api.z.ai/api/paas/v4\", [\"glm-5\"], \"Global\"),\n (\"cn\", \"https://open.bigmodel.cn/api/paas/v4\", [\"glm-5\"], \"China\"),\n (\"coding-global\", \"https://api.z.ai/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"Global (Coding Plan)\"),\n (\"coding-cn\", \"https://open.bigmodel.cn/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"China (Coding Plan)\"),\n]\n\n\ndef detect_zai_endpoint(api_key: str, timeout: float = 8.0) -> Optional[Dict[str, str]]:\n \"\"\"Probe z.ai endpoints to find one that accepts this API key.\n\n Returns {\"id\": ..., \"base_url\": ..., \"model\": ..., \"label\": ...} for the\n first working endpoint, or None if all fail. For endpoints with multiple\n candidate models, tries each in order and returns the first that succeeds.\n \"\"\"\n for ep_id, base_url, probe_models, label in ZAI_ENDPOINTS:\n for model in probe_models:\n try:\n resp = httpx.post(\n f\"{base_url}/chat/completions\",\n headers={\n \"Authorization\": f\"Bearer {api_key}\",\n \"Content-Type\": \"application/json\",\n },\n json={\n \"model\": model,\n \"stream\": False,\n \"max_tokens\": 1,\n \"messages\": [{\"role\": \"user\", \"content\": \"ping\"}],\n },\n timeout=timeout,\n )\n if resp.status_code == 200:\n logger.debug(\"Z.AI endpoint probe: %s (%s) model=%s OK\", ep_id, base_url, model)\n return {\n \"id\": ep_id,\n \"base_url\": base_url,\n \"model\": model,\n \"label\": label,\n }\n logger.debug(\"Z.AI endpoint probe: %s model=%s returned %s\", ep_id, model, resp.status_code)\n except Exception as exc:\n logger.debug(\"Z.AI endpoint probe: %s model=%s failed: %s\", ep_id, model, exc)\n return None\n\n\ndef _resolve_zai_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Z.AI base URL by probing endpoints.\n\n If the user has explicitly set GLM_BASE_URL, that always wins.\n Otherwise, probe the candidate endpoints to find one that accepts the\n key. The detected endpoint is cached in provider state (auth.json) keyed\n on a hash of the API key so subsequent starts skip the probe.\n \"\"\"\n if env_override:\n return env_override\n\n # No API key set → don't probe (would fire N×M HTTPS requests with an\n # empty Bearer token, all returning 401). This path is hit during\n # auxiliary-client auto-detection when the user has no Z.AI credentials\n # at all — the caller discards the result immediately, so the probe is\n # pure latency for every AIAgent construction.\n if not api_key:\n return default_url\n\n # Check provider-state cache for a previously-detected endpoint.\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"zai\") or {}\n cached = state.get(\"detected_endpoint\")\n if isinstance(cached, dict) and cached.get(\"base_url\"):\n key_hash = cached.get(\"key_hash\", \"\")\n if key_hash == hashlib.sha256(api_key.encode()).hexdigest()[:16]:\n logger.debug(\"Z.AI: using cached endpoint %s\", cached[\"base_url\"])\n return cached[\"base_url\"]\n\n # Probe — may take up to ~8s per endpoint.\n detected = detect_zai_endpoint(api_key)\n if detected and detected.get(\"base_url\"):\n # Persist the detection result keyed on the API key hash.\n key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:16]\n state[\"detected_endpoint\"] = {\n \"base_url\": detected[\"base_url\"],\n \"endpoint_id\": detected.get(\"id\", \"\"),\n \"model\": detected.get(\"model\", \"\"),\n \"label\": detected.get(\"label\", \"\"),\n \"key_hash\": key_hash,\n }\n _save_provider_state(auth_store, \"zai\", state)\n logger.info(\"Z.AI: auto-detected endpoint %s (%s)\", detected[\"label\"], detected[\"base_url\"])\n return detected[\"base_url\"]\n\n logger.debug(\"Z.AI: probe failed, falling back to default %s\", default_url)\n return default_url\n\n\n# =============================================================================\n# Error Types\n# =============================================================================\n\n# Error code marking upstream rate-limit / usage-quota exhaustion (HTTP 429).\n# Such failures are transient and re-authenticating cannot resolve them, so\n# they must be kept distinct from missing/expired-credential errors.\nCODEX_RATE_LIMITED_CODE = \"codex_rate_limited\"\n\n\nclass AuthError(RuntimeError):\n \"\"\"Structured auth error with UX mapping hints.\"\"\"\n\n def __init__(\n self,\n message: str,\n *,\n provider: str = \"\",\n code: Optional[str] = None,\n relogin_required: bool = False,\n ) -> None:\n super().__init__(message)\n self.provider = provider\n self.code = code\n self.relogin_required = relogin_required\n\n\ndef is_rate_limited_auth_error(error: Exception) -> bool:\n \"\"\"True when an :class:`AuthError` represents upstream rate-limiting / quota\n exhaustion rather than missing or invalid credentials.\n\n These failures are transient — re-authenticating cannot resolve them — so\n callers should surface a \"retry later\" notice and prefer a fallback chain\n instead of prompting the operator to run ``arcen auth``.\n \"\"\"\n return (\n isinstance(error, AuthError)\n and not error.relogin_required\n and error.code == CODEX_RATE_LIMITED_CODE\n )\n\n\ndef _parse_retry_after_seconds(headers: Any) -> Optional[int]:\n \"\"\"Best-effort parse of a ``Retry-After`` header into whole seconds.\n\n Supports the delta-seconds form (e.g. ``\"120\"``). HTTP-date forms and\n missing/unparseable values return ``None`` rather than guessing.\n \"\"\"\n if headers is None:\n return None\n try:\n raw = headers.get(\"retry-after\")\n except Exception:\n return None\n if raw is None:\n return None\n try:\n seconds = int(str(raw).strip())\n except (TypeError, ValueError):\n return None\n return seconds if seconds >= 0 else None\n\n\ndef format_auth_error(error: Exception) -> str:\n \"\"\"Map auth failures to concise user-facing guidance.\"\"\"\n if not isinstance(error, AuthError):\n return str(error)\n\n # Rate-limit / quota errors are not credential problems — never append the\n # \"re-authenticate\" remediation, which would mislead the operator.\n if is_rate_limited_auth_error(error):\n return str(error)\n\n if error.relogin_required:\n return f\"{error} Run `arcen model` to re-authenticate.\"\n\n if error.code == \"subscription_required\":\n if error.provider == \"removed_provider\":\n return _format_removed_provider_entitlement_auth_error(error)\n return \"No active paid subscription found. Please purchase/activate a subscription, then retry.\"\n\n if error.code == \"insufficient_credits\":\n if error.provider == \"removed_provider\":\n return _format_removed_provider_entitlement_auth_error(error)\n return \"Subscription credits are exhausted. Top up/renew credits, then retry.\"\n\n if error.code in {\"subscription_expired\", \"no_usable_credits\", \"account_missing\"}:\n if error.provider == \"removed_provider\":\n return _format_removed_provider_entitlement_auth_error(error)\n\n if error.code == \"temporarily_unavailable\":\n return f\"{error} Please retry in a few seconds.\"\n\n return str(error)\n\n\ndef _format_removed_provider_entitlement_auth_error(error: AuthError) -> str:\n try:\n from arcen_cli.removed_provider_account import (\n format_removed_provider_portal_entitlement_message,\n get_removed_provider_portal_account_info,\n )\n\n account_info = get_removed_provider_portal_account_info(force_fresh=True)\n message = format_removed_provider_portal_entitlement_message(\n account_info,\n capability=\"Removed provider model access\",\n )\n if message:\n return message\n except Exception:\n pass\n return f\"{error} Check credits or billing in Removed provider Portal, then retry.\"\n\n\ndef _token_fingerprint(token: Any) -> Optional[str]:\n \"\"\"Return a short hash fingerprint for telemetry without leaking token bytes.\"\"\"\n if not isinstance(token, str):\n return None\n cleaned = token.strip()\n if not cleaned:\n return None\n return hashlib.sha256(cleaned.encode(\"utf-8\")).hexdigest()[:12]\n\n\ndef _oauth_trace_enabled() -> bool:\n raw = os.getenv(\"ARCEN_OAUTH_TRACE\", \"\").strip().lower()\n return raw in {\"1\", \"true\", \"yes\", \"on\"}\n\n\ndef _oauth_trace(event: str, *, sequence_id: Optional[str] = None, **fields: Any) -> None:\n if not _oauth_trace_enabled():\n return\n payload: Dict[str, Any] = {\"event\": event}\n if sequence_id:\n payload[\"sequence_id\"] = sequence_id\n payload.update(fields)\n logger.info(\"oauth_trace %s\", json.dumps(payload, sort_keys=True, ensure_ascii=False))\n\n\n# =============================================================================\n# Auth Store — persistence layer for ~/.arcen/auth.json\n# =============================================================================\n\ndef _auth_file_path() -> Path:\n path = get_arcen_home() / \"auth.json\"\n # Seat belt: if pytest is running and ARCEN_HOME resolves to the real\n # user's auth store, refuse rather than silently corrupt it. This catches\n # tests that forgot to monkeypatch ARCEN_HOME, tests invoked without the\n # hermetic conftest, or sandbox escapes via threads/subprocesses. In\n # production (no PYTEST_CURRENT_TEST) this is a single dict lookup.\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_auth = (Path.home() / \".arcen\" / \"auth.json\").resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_auth:\n raise RuntimeError(\n f\"Refusing to touch real user auth store during test run: {path}. \"\n \"Set ARCEN_HOME to a tmp_path in your test fixture, or run \"\n \"via scripts/run_tests.sh for hermetic CI-parity env.\"\n )\n return path\n\n\ndef _global_auth_file_path() -> Optional[Path]:\n \"\"\"Return the global-root auth.json when the process is in profile mode.\n\n Returns ``None`` when the profile and global root resolve to the same\n directory (classic mode, or custom ARCEN_HOME that is not a profile).\n Used by read-only fallback paths so providers authed at the root are\n visible to profile processes that haven't configured them locally.\n\n See issue #18594 follow-up (credential_pool shadowing).\n \"\"\"\n try:\n from arcen_constants import get_default_arcen_root\n global_root = get_default_arcen_root()\n except Exception:\n return None\n profile_home = get_arcen_home()\n try:\n if profile_home.resolve(strict=False) == global_root.resolve(strict=False):\n return None\n except Exception:\n if profile_home == global_root:\n return None\n # No pytest seat belt here: this is a pure read-only path, and\n # ``_load_global_auth_store()`` wraps the read in a try/except so an\n # unreadable global file can never break the profile process. The\n # write-side seat belt still lives on ``_auth_file_path()`` where it\n # belongs (that's what protects the real user's auth store from being\n # corrupted by a mis-configured test).\n return global_root / \"auth.json\"\n\n\ndef _load_global_auth_store() -> Dict[str, Any]:\n \"\"\"Load the global-root auth store (read-only fallback).\n\n Returns an empty dict when no global fallback exists (classic mode,\n or the global auth.json is absent). Never raises on missing file.\n\n Seat belt: under pytest, refuses to read the real user's\n ``~/.arcen/auth.json`` even when ARCEN_HOME is set to a profile\n path. The hermetic conftest does not redirect ``HOME``, so\n ``get_default_arcen_root()`` for a profile-shaped ARCEN_HOME can\n still resolve to the real user's home on a dev machine. That would\n leak real credentials into tests. This guard uses the unmodified\n ``HOME`` env var (what ``os.path.expanduser('~')`` would resolve to),\n not ``Path.home()``, because ``Path.home`` is sometimes monkeypatched\n by fixtures that want to relocate the global root to a tmp path.\n \"\"\"\n global_path = _global_auth_file_path()\n if global_path is None or not global_path.exists():\n return {}\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_env = os.environ.get(\"HOME\", \"\")\n if real_home_env:\n real_root = Path(real_home_env) / \".arcen\" / \"auth.json\"\n try:\n if global_path.resolve(strict=False) == real_root.resolve(strict=False):\n return {}\n except Exception:\n pass\n try:\n return _load_auth_store(global_path)\n except Exception:\n # A malformed global store must not break profile reads. The\n # profile's own auth store is still authoritative.\n return {}\n\n\ndef _auth_lock_path() -> Path:\n return _auth_file_path().with_suffix(\".lock\")\n\n\n_auth_lock_holder = threading.local()\n\n\n@contextmanager\ndef _file_lock(\n lock_path: Path,\n holder: threading.local,\n timeout_seconds: float,\n timeout_message: str,\n):\n \"\"\"Cross-process advisory flock helper.\n\n Reentrant per-thread via ``holder.depth``. Falls back to a depth-only\n guard when neither ``fcntl`` nor ``msvcrt`` is available (rare).\n Callers supply their own ``threading.local`` so independent locks\n (e.g. profile auth.json vs shared Removed provider store) don't share reentrancy\n state — that would let one lock's reentrant acquisition silently skip\n the other's kernel-level flock.\n \"\"\"\n if getattr(holder, \"depth\", 0) > 0:\n holder.depth += 1\n try:\n yield\n finally:\n holder.depth -= 1\n return\n\n lock_path.parent.mkdir(parents=True, exist_ok=True)\n\n if fcntl is None and msvcrt is None:\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n return\n\n # On Windows, msvcrt.locking needs the file to have content and the\n # file pointer at position 0. Ensure the lock file has at least 1 byte.\n if msvcrt and (not lock_path.exists() or lock_path.stat().st_size == 0):\n lock_path.write_text(\" \", encoding=\"utf-8\")\n\n with lock_path.open(\"r+\" if msvcrt else \"a+\", encoding=\"utf-8\") as lock_file:\n deadline = time.monotonic() + max(1.0, timeout_seconds)\n while True:\n try:\n if fcntl:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)\n else:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_NBLCK, 1)\n break\n except (BlockingIOError, OSError, PermissionError):\n if time.monotonic() >= deadline:\n raise TimeoutError(timeout_message)\n time.sleep(0.05)\n\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n if fcntl:\n try:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_UN)\n except (OSError, IOError):\n pass\n elif msvcrt:\n try:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_UNLCK, 1)\n except (OSError, IOError):\n pass\n\n\n@contextmanager\ndef _auth_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-process advisory lock for auth.json reads+writes. Reentrant.\n\n Lock ordering invariant: when this lock is held together with\n ``_removed_provider_shared_store_lock``, acquire ``_auth_store_lock`` FIRST\n (outer) and the shared Removed provider lock SECOND (inner). All runtime\n refresh paths follow this order; violating it risks deadlock\n against a concurrent import on the shared store.\n \"\"\"\n with _file_lock(\n _auth_lock_path(),\n _auth_lock_holder,\n timeout_seconds,\n \"Timed out waiting for auth store lock\",\n ):\n yield\n\n\ndef _load_auth_store(auth_file: Optional[Path] = None) -> Dict[str, Any]:\n auth_file = auth_file or _auth_file_path()\n if not auth_file.exists():\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n try:\n raw = json.loads(auth_file.read_text())\n except Exception as exc:\n corrupt_path = auth_file.with_suffix(\".json.corrupt\")\n try:\n import shutil\n shutil.copy2(auth_file, corrupt_path)\n except Exception:\n pass\n logger.warning(\n \"auth: failed to parse %s (%s) — starting with empty store. \"\n \"Corrupt file preserved at %s\",\n auth_file, exc, corrupt_path,\n )\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n if isinstance(raw, dict) and (\n isinstance(raw.get(\"providers\"), dict)\n or isinstance(raw.get(\"credential_pool\"), dict)\n ):\n raw.setdefault(\"providers\", {})\n return raw\n\n # Migrate from PR's \"systems\" format if present\n if isinstance(raw, dict) and isinstance(raw.get(\"systems\"), dict):\n systems = raw[\"systems\"]\n providers = {}\n if \"removed_provider_portal\" in systems:\n providers[\"removed_provider\"] = systems[\"removed_provider_portal\"]\n return {\"version\": AUTH_STORE_VERSION, \"providers\": providers,\n \"active_provider\": \"removed_provider\" if providers else None}\n\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n\ndef _save_auth_store(auth_store: Dict[str, Any]) -> Path:\n auth_file = _auth_file_path()\n auth_file.parent.mkdir(parents=True, exist_ok=True)\n # Tighten parent dir to 0o700 so siblings can't traverse to creds.\n # No-op on Windows (POSIX mode bits not enforced); ignore failures.\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_file)\n auth_store[\"version\"] = AUTH_STORE_VERSION\n auth_store[\"updated_at\"] = datetime.now(timezone.utc).isoformat()\n payload = json.dumps(auth_store, indent=2) + \"\\n\"\n tmp_path = auth_file.with_name(f\"{auth_file.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n try:\n # Create with 0o600 atomically via os.open(O_EXCL) + fdopen to close\n # the TOCTOU window where default umask (often 0o644) briefly exposed\n # OAuth tokens to other local users between open() and chmod().\n # Mirrors agent/google_oauth.py (#19673) and tools/mcp_oauth.py (#21148).\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as handle:\n handle.write(payload)\n handle.flush()\n os.fsync(handle.fileno())\n atomic_replace(tmp_path, auth_file)\n try:\n dir_fd = os.open(str(auth_file.parent), os.O_RDONLY)\n except OSError:\n dir_fd = None\n if dir_fd is not None:\n try:\n os.fsync(dir_fd)\n finally:\n os.close(dir_fd)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n # Restrict file permissions to owner only\n try:\n auth_file.chmod(stat.S_IRUSR | stat.S_IWUSR)\n except OSError:\n pass\n return auth_file\n\n\ndef _load_provider_state(auth_store: Dict[str, Any], provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return a provider's persisted state.\n\n In profile mode, falls back to the global-root ``auth.json`` when the\n profile has no entry for ``provider_id``. This mirrors the per-provider\n shadowing already used by ``read_credential_pool``: workers spawned in a\n profile can see providers (e.g. ``removed_provider``) that were only authenticated at\n global scope. Once the user runs ``arcen auth login <provider>`` inside\n the profile, the profile state fully shadows the global state on the next\n read. See issue #18594 follow-up.\n \"\"\"\n providers = auth_store.get(\"providers\")\n if isinstance(providers, dict):\n state = providers.get(provider_id)\n if isinstance(state, dict):\n return dict(state)\n\n # Read-only fallback to the global-root auth store (profile mode only;\n # returns empty dict in classic mode so this is a no-op).\n global_store = _load_global_auth_store()\n if global_store:\n global_providers = global_store.get(\"providers\")\n if isinstance(global_providers, dict):\n global_state = global_providers.get(provider_id)\n if isinstance(global_state, dict):\n return dict(global_state)\n return None\n\n\ndef _save_provider_state(auth_store: Dict[str, Any], provider_id: str, state: Dict[str, Any]) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n auth_store[\"active_provider\"] = provider_id\n\n\ndef _store_provider_state(\n auth_store: Dict[str, Any],\n provider_id: str,\n state: Dict[str, Any],\n *,\n set_active: bool = True,\n) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n if set_active:\n auth_store[\"active_provider\"] = provider_id\n\n\ndef is_known_auth_provider(provider_id: str) -> bool:\n normalized = (provider_id or \"\").strip().lower()\n return normalized in PROVIDER_REGISTRY or normalized in SERVICE_PROVIDER_NAMES\n\n\ndef get_auth_provider_display_name(provider_id: str) -> str:\n normalized = (provider_id or \"\").strip().lower()\n if normalized in PROVIDER_REGISTRY:\n return PROVIDER_REGISTRY[normalized].name\n return SERVICE_PROVIDER_NAMES.get(normalized, provider_id)\n\n\ndef read_credential_pool(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Return the persisted credential pool, or one provider slice.\n\n In profile mode, the profile's credential pool is authoritative. If a\n provider has no entries in the profile, entries from the global-root\n ``auth.json`` are used as a read-only fallback — so workers spawned in a\n profile can see providers that were only authenticated at global scope.\n\n Profile entries always win: the global fallback only applies per-provider\n when the profile has zero entries for that provider. Once the user runs\n ``arcen auth add <provider>`` inside the profile, profile entries\n fully shadow global for that provider on the next read.\n\n Writes always go to the profile (``write_credential_pool`` is unchanged).\n See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n\n global_pool: Dict[str, Any] = {}\n global_store = _load_global_auth_store()\n maybe_global_pool = global_store.get(\"credential_pool\") if global_store else None\n if isinstance(maybe_global_pool, dict):\n global_pool = maybe_global_pool\n\n if provider_id is None:\n merged = dict(pool)\n for gp_key, gp_entries in global_pool.items():\n if not isinstance(gp_entries, list) or not gp_entries:\n continue\n # Per-provider shadowing: profile wins whenever it has ANY entries.\n existing = merged.get(gp_key)\n if isinstance(existing, list) and existing:\n continue\n merged[gp_key] = list(gp_entries)\n return merged\n\n provider_entries = pool.get(provider_id)\n if isinstance(provider_entries, list) and provider_entries:\n return list(provider_entries)\n # Profile has no entries for this provider — fall back to global.\n global_entries = global_pool.get(provider_id)\n return list(global_entries) if isinstance(global_entries, list) else []\n\n\ndef write_credential_pool(provider_id: str, entries: List[Dict[str, Any]]) -> Path:\n \"\"\"Persist one provider's credential pool under auth.json.\n\n This is the final disk-boundary guard for borrowed/reference-only\n credentials. Callers may pass raw dictionaries, so sanitize here even when\n ``PooledCredential.to_dict()`` already did the same work upstream.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n pool[provider_id] = [\n sanitize_borrowed_credential_payload(entry, provider_id)\n if isinstance(entry, dict) else entry\n for entry in entries\n ]\n return _save_auth_store(auth_store)\n\n\ndef suppress_credential_source(provider_id: str, source: str) -> None:\n \"\"\"Mark a credential source as suppressed so it won't be re-seeded.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.setdefault(\"suppressed_sources\", {})\n provider_list = suppressed.setdefault(provider_id, [])\n if source not in provider_list:\n provider_list.append(source)\n _save_auth_store(auth_store)\n\n\ndef is_source_suppressed(provider_id: str, source: str) -> bool:\n \"\"\"Check if a credential source has been suppressed by the user.\"\"\"\n try:\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\", {})\n return source in suppressed.get(provider_id, [])\n except Exception:\n return False\n\n\ndef unsuppress_credential_source(provider_id: str, source: str) -> bool:\n \"\"\"Clear a suppression marker so the source will be re-seeded on the next load.\n\n Returns True if a marker was cleared, False if no marker existed.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\")\n if not isinstance(suppressed, dict):\n return False\n provider_list = suppressed.get(provider_id)\n if not isinstance(provider_list, list) or source not in provider_list:\n return False\n provider_list.remove(source)\n if not provider_list:\n suppressed.pop(provider_id, None)\n if not suppressed:\n auth_store.pop(\"suppressed_sources\", None)\n _save_auth_store(auth_store)\n return True\n\n\ndef get_provider_auth_state(provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return persisted auth state for a provider, or None.\n\n In profile mode, ``_load_provider_state`` already falls back to the\n global-root ``auth.json`` per-provider when the profile has no entry —\n so this is now a thin convenience wrapper. Profile state always wins\n when present. Writes (``_save_auth_store`` / ``persist_*_credentials``)\n are unchanged — they still target the profile only. This mirrors\n ``read_credential_pool``'s per-provider shadowing semantics so that\n ``_seed_from_singletons`` can reseed a profile's credential pool from\n global-scope provider state (e.g. a globally-authenticated Anthropic\n OAuth or Removed provider device-code session). See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n return _load_provider_state(auth_store, provider_id)\n\n\ndef get_active_provider() -> Optional[str]:\n \"\"\"Return the currently active provider ID from auth store.\"\"\"\n auth_store = _load_auth_store()\n return auth_store.get(\"active_provider\")\n\n\ndef is_provider_explicitly_configured(provider_id: str) -> bool:\n \"\"\"Return True only if the user has explicitly configured this provider.\n\n Checks:\n 1. active_provider in auth.json matches\n 2. model.provider in config.yaml matches\n 3. Provider-specific env vars are set (e.g. ANTHROPIC_API_KEY)\n\n This is used to gate auto-discovery of external credentials (e.g.\n Claude Code's ~/.claude/.credentials.json) so they are never used\n without the user's explicit choice. See PR #4210 for the same\n pattern applied to the setup wizard gate.\n \"\"\"\n normalized = (provider_id or \"\").strip().lower()\n\n # 1. Check auth.json active_provider\n try:\n auth_store = _load_auth_store()\n active = (auth_store.get(\"active_provider\") or \"\").strip().lower()\n if active and active == normalized:\n return True\n except Exception:\n pass\n\n # 2. Check config.yaml model.provider\n try:\n from arcen_cli.config import load_config\n cfg = load_config()\n model_cfg = cfg.get(\"model\")\n if isinstance(model_cfg, dict):\n cfg_provider = (model_cfg.get(\"provider\") or \"\").strip().lower()\n if cfg_provider == normalized:\n return True\n except Exception:\n pass\n\n # 3. Check provider-specific env vars\n # Exclude CLAUDE_CODE_OAUTH_TOKEN — it's set by Claude Code itself,\n # not by the user explicitly configuring anthropic in Arcen.\n _IMPLICIT_ENV_VARS = {\"CLAUDE_CODE_OAUTH_TOKEN\"}\n pconfig = PROVIDER_REGISTRY.get(normalized)\n if pconfig and pconfig.auth_type == \"api_key\":\n for env_var in pconfig.api_key_env_vars:\n if env_var in _IMPLICIT_ENV_VARS:\n continue\n if has_usable_secret(os.getenv(env_var, \"\")):\n return True\n\n return False\n\n\ndef clear_provider_auth(provider_id: Optional[str] = None) -> bool:\n \"\"\"\n Clear auth state for a provider. Used by `arcen logout`.\n If provider_id is None, clears the active provider.\n Returns True if something was cleared.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n target = provider_id or auth_store.get(\"active_provider\")\n if not target:\n return False\n\n providers = auth_store.get(\"providers\", {})\n if not isinstance(providers, dict):\n providers = {}\n auth_store[\"providers\"] = providers\n\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n\n cleared = False\n if target in providers:\n del providers[target]\n cleared = True\n if target in pool:\n del pool[target]\n cleared = True\n\n if auth_store.get(\"active_provider\") == target:\n auth_store[\"active_provider\"] = None\n cleared = True\n\n if not cleared:\n return False\n _save_auth_store(auth_store)\n return True\n\n\ndef deactivate_provider() -> None:\n \"\"\"\n Clear active_provider in auth.json without deleting credentials.\n Used when the user switches to a non-OAuth provider (OpenRouter, custom)\n so auto-resolution doesn't keep picking the OAuth provider.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = None\n _save_auth_store(auth_store)\n\n\n# =============================================================================\n# Provider Resolution — picks which provider to use\n# =============================================================================\n\n\ndef _get_config_hint_for_unknown_provider(provider_name: str) -> str:\n \"\"\"Return a helpful hint string when provider resolution fails.\n\n Checks for common config.yaml mistakes (malformed custom_providers, etc.)\n and returns a human-readable diagnostic, or empty string if nothing found.\n \"\"\"\n try:\n from arcen_cli.config import validate_config_structure\n issues = validate_config_structure()\n if not issues:\n return \"\"\n\n lines = [\"Config issue detected — run 'arcen doctor' for full diagnostics:\"]\n for ci in issues:\n prefix = \"ERROR\" if ci.severity == \"error\" else \"WARNING\"\n lines.append(f\" [{prefix}] {ci.message}\")\n # Show first line of hint\n first_hint = ci.hint.splitlines()[0] if ci.hint else \"\"\n if first_hint:\n lines.append(f\" → {first_hint}\")\n return \"\\n\".join(lines)\n except Exception:\n return \"\"\n\n\ndef resolve_provider(\n requested: Optional[str] = None,\n *,\n explicit_api_key: Optional[str] = None,\n explicit_base_url: Optional[str] = None,\n) -> str:\n \"\"\"\n Determine which inference provider to use.\n\n Priority (when requested=\"auto\" or None):\n 1. active_provider in auth.json with valid credentials\n 2. Explicit CLI api_key/base_url -> \"openrouter\"\n 3. OPENAI_API_KEY or OPENROUTER_API_KEY env vars -> \"openrouter\"\n 4. Provider-specific API keys (GLM, Kimi, MiniMax) -> that provider\n 5. Fallback: \"openrouter\"\n \"\"\"\n normalized = (requested or \"auto\").strip().lower()\n\n # Normalize provider aliases\n _PROVIDER_ALIASES = {\n \"glm\": \"zai\", \"z-ai\": \"zai\", \"z.ai\": \"zai\", \"zhipu\": \"zai\",\n \"google\": \"gemini\", \"google-gemini\": \"gemini\", \"google-ai-studio\": \"gemini\",\n \"x-ai\": \"xai\", \"x.ai\": \"xai\", \"grok\": \"xai\",\n \"xai-oauth\": \"xai-oauth\", \"x-ai-oauth\": \"xai-oauth\",\n \"grok-oauth\": \"xai-oauth\", \"xai-grok-oauth\": \"xai-oauth\",\n \"kimi\": \"kimi-coding\", \"kimi-for-coding\": \"kimi-coding\", \"moonshot\": \"kimi-coding\",\n \"kimi-cn\": \"kimi-coding-cn\", \"moonshot-cn\": \"kimi-coding-cn\",\n \"step\": \"stepfun\", \"stepfun-coding-plan\": \"stepfun\",\n \"arcee-ai\": \"arcee\", \"arceeai\": \"arcee\",\n \"gmi-cloud\": \"gmi\", \"gmicloud\": \"gmi\",\n \"minimax-china\": \"minimax-cn\", \"minimax_cn\": \"minimax-cn\",\n \"minimax-portal\": \"minimax-oauth\", \"minimax-global\": \"minimax-oauth\", \"minimax_oauth\": \"minimax-oauth\",\n \"alibaba_coding\": \"alibaba-coding-plan\", \"alibaba-coding\": \"alibaba-coding-plan\",\n \"alibaba_coding_plan\": \"alibaba-coding-plan\",\n \"claude\": \"anthropic\", \"claude-code\": \"anthropic\",\n \"github\": \"copilot\", \"github-copilot\": \"copilot\",\n \"github-models\": \"copilot\", \"github-model\": \"copilot\",\n \"github-copilot-acp\": \"copilot-acp\", \"copilot-acp-agent\": \"copilot-acp\",\n \"opencode\": \"opencode-zen\", \"zen\": \"opencode-zen\",\n \"qwen-portal\": \"qwen-oauth\", \"qwen-cli\": \"qwen-oauth\", \"qwen-oauth\": \"qwen-oauth\", \"google-gemini-cli\": \"google-gemini-cli\", \"gemini-cli\": \"google-gemini-cli\", \"gemini-oauth\": \"google-gemini-cli\",\n \"hf\": \"huggingface\", \"hugging-face\": \"huggingface\", \"huggingface-hub\": \"huggingface\",\n \"mimo\": \"xiaomi\", \"xiaomi-mimo\": \"xiaomi\",\n \"tencent\": \"tencent-tokenhub\", \"tokenhub\": \"tencent-tokenhub\",\n \"tencent-cloud\": \"tencent-tokenhub\", \"tencentmaas\": \"tencent-tokenhub\",\n \"aws\": \"bedrock\", \"aws-bedrock\": \"bedrock\", \"amazon-bedrock\": \"bedrock\", \"amazon\": \"bedrock\",\n \"go\": \"opencode-go\", \"opencode-go-sub\": \"opencode-go\",\n \"kilo\": \"kilocode\", \"kilo-code\": \"kilocode\", \"kilo-gateway\": \"kilocode\",\n \"lmstudio\": \"lmstudio\", \"lm-studio\": \"lmstudio\", \"lm_studio\": \"lmstudio\",\n # Local server aliases — route through the generic custom provider\n \"ollama\": \"custom\", \"ollama_cloud\": \"ollama-cloud\",\n \"vllm\": \"custom\", \"llamacpp\": \"custom\",\n \"llama.cpp\": \"custom\", \"llama-cpp\": \"custom\",\n }\n # Extend with aliases declared in plugins/model-providers/<name>/ that aren't already mapped.\n # This keeps providers/ as the single source for new aliases while the\n # hardcoded dict above remains authoritative for existing ones.\n try:\n from providers import list_providers as _lp\n for _pp in _lp():\n for _alias in _pp.aliases:\n if _alias not in _PROVIDER_ALIASES:\n _PROVIDER_ALIASES[_alias] = _pp.name\n except Exception:\n pass\n normalized = _PROVIDER_ALIASES.get(normalized, normalized)\n\n if normalized == \"openrouter\":\n return \"openrouter\"\n if normalized == \"custom\":\n return \"custom\"\n if normalized in PROVIDER_REGISTRY:\n return normalized\n if normalized != \"auto\":\n # Check for common config.yaml issues that cause this error\n _config_hint = _get_config_hint_for_unknown_provider(normalized)\n msg = f\"Unknown provider '{normalized}'.\"\n if _config_hint:\n msg += f\"\\n\\n{_config_hint}\"\n else:\n msg += \" Check 'arcen model' for available providers, or run 'arcen doctor' to diagnose config issues.\"\n raise AuthError(msg, code=\"invalid_provider\")\n\n # Explicit one-off CLI creds always mean openrouter/custom\n if explicit_api_key or explicit_base_url:\n return \"openrouter\"\n\n # Check auth store for an active OAuth provider\n try:\n auth_store = _load_auth_store()\n active = auth_store.get(\"active_provider\")\n if active and active in PROVIDER_REGISTRY:\n status = get_auth_status(active)\n if status.get(\"logged_in\"):\n return active\n except Exception as e:\n logger.debug(\"Could not detect active auth provider: %s\", e)\n\n if has_usable_secret(os.getenv(\"OPENAI_API_KEY\")) or has_usable_secret(os.getenv(\"OPENROUTER_API_KEY\")):\n return \"openrouter\"\n\n # Auto-detect API-key providers by checking their env vars\n for pid, pconfig in PROVIDER_REGISTRY.items():\n if pconfig.auth_type != \"api_key\":\n continue\n # GitHub tokens are commonly present for repo/tool access but should not\n # hijack inference auto-selection unless the user explicitly chooses\n # Copilot/GitHub Models as the provider. LM Studio is a local server\n # whose availability isn't implied by LM_API_KEY presence (it may be\n # offline, and the no-auth setup uses a placeholder value), so it\n # also requires explicit selection.\n if pid in {\"copilot\", \"lmstudio\"}:\n continue\n for env_var in pconfig.api_key_env_vars:\n if has_usable_secret(os.getenv(env_var, \"\")):\n return pid\n\n # AWS Bedrock — detect via boto3 credential chain (IAM roles, SSO, env vars).\n # This runs after API-key providers so explicit keys always win.\n try:\n from agent.bedrock_adapter import has_aws_credentials\n if has_aws_credentials():\n return \"bedrock\"\n except ImportError:\n pass # boto3 not installed — skip Bedrock auto-detection\n\n raise AuthError(\n \"No inference provider configured. Run 'arcen model' to choose a \"\n \"provider and model, or set an API key (OPENROUTER_API_KEY, \"\n \"OPENAI_API_KEY, etc.) in ~/.arcen/.env.\",\n code=\"no_provider_configured\",\n )\n\n\n# =============================================================================\n# Timestamp / TTL helpers\n# =============================================================================\n\ndef _parse_iso_timestamp(value: Any) -> Optional[float]:\n if not isinstance(value, str) or not value:\n return None\n text = value.strip()\n if not text:\n return None\n if text.endswith(\"Z\"):\n text = text[:-1] + \"+00:00\"\n try:\n parsed = datetime.fromisoformat(text)\n except Exception:\n return None\n if parsed.tzinfo is None:\n parsed = parsed.replace(tzinfo=timezone.utc)\n return parsed.timestamp()\n\n\ndef _is_expiring(expires_at_iso: Any, skew_seconds: int) -> bool:\n expires_epoch = _parse_iso_timestamp(expires_at_iso)\n if expires_epoch is None:\n return True\n return expires_epoch <= (time.time() + skew_seconds)\n\n\ndef _coerce_ttl_seconds(expires_in: Any) -> int:\n try:\n ttl = int(expires_in)\n except Exception:\n ttl = 0\n return max(0, ttl)\n\n\ndef _optional_base_url(value: Any) -> Optional[str]:\n if not isinstance(value, str):\n return None\n cleaned = value.strip().rstrip(\"/\")\n return cleaned if cleaned else None\n\n\n# Allowlist of hosts the Removed provider Portal proxy is willing to forward inference\n# JWTs to. Sending a bearer anywhere else would leak it.\n#\n# This is consulted only for URLs coming from the NETWORK side (Portal\n# refresh responses). User-controlled env-var overrides\n# (REMOVED_PROVIDER_INFERENCE_BASE_URL) bypass validation — that's the documented\n# dev/staging escape hatch and the env source is already trusted (the\n# user set it themselves).\n_ALLOWED_REMOVED_PROVIDER_INFERENCE_HOSTS: FrozenSet[str] = frozenset({\n \"\",\n})\n\n\ndef _validate_removed_provider_inference_url_from_network(url: Optional[str]) -> Optional[str]:\n \"\"\"Validate a Portal-returned inference URL against the host allowlist.\n\n Returns ``url`` (normalised by stripping trailing slashes) if it's a\n well-formed ``https://<allowlisted-host>/...`` URL. Returns ``None``\n if the URL is missing, malformed, non-https, or points at an\n unexpected host — letting the caller fall back to the configured\n default rather than persist or forward a poisoned value.\n\n Defense-in-depth: a compromised refresh response from the Portal API\n (MITM, malicious response injection) could otherwise redirect every\n subsequent proxy request — bearing the user's inference JWT — to an\n attacker-controlled endpoint.\n Validating scheme + host at the source closes that loop before the\n poisoned URL ever lands in ``auth.json``.\n\n The env-var override path (``REMOVED_PROVIDER_INFERENCE_BASE_URL``) bypasses\n this — env values come from the trusted OS user, not from the\n network, and the override is documented for staging/dev use.\n\n Co-authored-by: memosr <mehmet.sr35@gmail.com>\n \"\"\"\n if not isinstance(url, str):\n return None\n cleaned = url.strip()\n if not cleaned:\n return None\n try:\n parsed = urlparse(cleaned)\n except Exception:\n return None\n if parsed.scheme != \"https\":\n logger.warning(\n \"removed_provider: refusing non-https inference URL scheme %r from Portal response\",\n parsed.scheme,\n )\n return None\n if parsed.hostname not in _ALLOWED_REMOVED_PROVIDER_INFERENCE_HOSTS:\n logger.warning(\n \"removed_provider: refusing inference URL host %r from Portal response \"\n \"(not in allowlist); falling back to default\",\n parsed.hostname,\n )\n return None\n return cleaned.rstrip(\"/\")\n\n\ndef _decode_jwt_claims(token: Any) -> Dict[str, Any]:\n if not isinstance(token, str) or token.count(\".\") != 2:\n return {}\n payload = token.split(\".\")[1]\n payload += \"=\" * ((4 - len(payload) % 4) % 4)\n try:\n raw = base64.urlsafe_b64decode(payload.encode(\"utf-8\"))\n claims = json.loads(raw.decode(\"utf-8\"))\n except Exception:\n return {}\n return claims if isinstance(claims, dict) else {}\n\n\ndef _scope_values(raw_scope: Any) -> set[str]:\n # OAuth token responses normally return a space-separated string. Keep\n # collection support for JWT ``scp`` claims and older stored test fixtures.\n scopes: set[str] = set()\n if isinstance(raw_scope, str):\n for part in raw_scope.replace(\",\", \" \").split():\n cleaned = part.strip()\n if cleaned:\n scopes.add(cleaned)\n elif isinstance(raw_scope, (list, tuple, set, frozenset)):\n for item in raw_scope:\n if isinstance(item, str):\n scopes.update(_scope_values(item))\n return scopes\n\n\ndef _removed_provider_invoke_jwt_status(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = REMOVED_PROVIDER_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> Optional[str]:\n \"\"\"Return None when the token can be used for inference, else a reason.\"\"\"\n claims = _decode_jwt_claims(token)\n if not claims:\n return \"access_token_not_jwt\"\n scopes = (\n _scope_values(scope)\n | _scope_values(claims.get(\"scope\"))\n | _scope_values(claims.get(\"scp\"))\n )\n if REMOVED_PROVIDER_INFERENCE_INVOKE_SCOPE not in scopes:\n return \"missing_inference_invoke_scope\"\n exp = claims.get(\"exp\")\n skew = max(0, int(min_ttl_seconds))\n if isinstance(exp, (int, float)):\n if float(exp) <= (time.time() + skew):\n return \"invoke_jwt_expiring\"\n return None\n if _is_expiring(expires_at, skew):\n return \"invoke_jwt_expiry_unknown_or_expiring\"\n return None\n\n\ndef _removed_provider_invoke_jwt_is_usable(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = REMOVED_PROVIDER_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> bool:\n return (\n _removed_provider_invoke_jwt_status(\n token,\n scope=scope,\n expires_at=expires_at,\n min_ttl_seconds=min_ttl_seconds,\n )\n is None\n )\n\n\ndef _assert_removed_provider_inference_jwt_usable(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n) -> None:\n token = state.get(\"access_token\") if access_token is None else access_token\n reason = _removed_provider_invoke_jwt_status(\n token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if reason is None:\n return\n raise AuthError(\n \"Removed provider Portal access token is not a usable inference JWT \"\n f\"({reason}). Re-authenticate with: arcen auth add removed_provider\",\n provider=\"removed_provider\",\n code=reason,\n relogin_required=True,\n )\n\n\ndef _log_removed_provider_invoke_jwt_selected(\n *,\n access_token: Any,\n sequence_id: Optional[str] = None,\n) -> None:\n logger.info(\"Removed provider inference auth: using NAS invoke JWT\")\n _oauth_trace(\n \"removed_provider_invoke_jwt_selected\",\n sequence_id=sequence_id,\n access_token_fp=_token_fingerprint(access_token),\n )\n\n\ndef _removed_provider_jwt_expires_at(token: Any, fallback_expires_at: Any = None) -> Optional[str]:\n claims = _decode_jwt_claims(token)\n exp = claims.get(\"exp\")\n if isinstance(exp, (int, float)):\n try:\n return datetime.fromtimestamp(float(exp), tz=timezone.utc).isoformat()\n except Exception:\n pass\n return fallback_expires_at if isinstance(fallback_expires_at, str) else None\n\n\ndef _set_removed_provider_agent_key_from_invoke_jwt(\n state: Dict[str, Any],\n *,\n obtained_at: Optional[str] = None,\n) -> None:\n access_token = state.get(\"access_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n return\n now = datetime.now(timezone.utc)\n existing_obtained_at = state.get(\"agent_key_obtained_at\")\n if obtained_at:\n effective_obtained_at = obtained_at\n elif (\n state.get(\"agent_key\") == access_token\n and isinstance(existing_obtained_at, str)\n and existing_obtained_at.strip()\n ):\n effective_obtained_at = existing_obtained_at\n else:\n effective_obtained_at = now.isoformat()\n expires_at = _removed_provider_jwt_expires_at(access_token, state.get(\"expires_at\"))\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"expires_in\"))\n )\n if expires_at:\n state[\"expires_at\"] = expires_at\n state[\"expires_in\"] = expires_in\n state[\"agent_key\"] = access_token\n state[\"agent_key_id\"] = None\n state[\"agent_key_expires_at\"] = expires_at\n state[\"agent_key_expires_in\"] = expires_in\n state[\"agent_key_reused\"] = False\n state[\"agent_key_obtained_at\"] = effective_obtained_at\n\n\ndef _select_removed_provider_invoke_jwt(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n sequence_id: Optional[str] = None,\n) -> None:\n if isinstance(access_token, str) and access_token.strip():\n state[\"access_token\"] = access_token\n _set_removed_provider_agent_key_from_invoke_jwt(state)\n _log_removed_provider_invoke_jwt_selected(\n access_token=state.get(\"access_token\"),\n sequence_id=sequence_id,\n )\n\n\n_REMOVED_PROVIDER_EFFECTIVE_STATE_IGNORED_KEYS = frozenset({\n # These are derived from expires_at/JWT exp and naturally tick down between\n # reads. Persisting only these changes makes auth.json noisy and defeats\n # the mtime-keyed auth-status cache.\n \"expires_in\",\n \"agent_key_expires_in\",\n})\n\n\ndef _removed_provider_effective_provider_state(state: Dict[str, Any]) -> Dict[str, Any]:\n return {\n key: value\n for key, value in state.items()\n if key not in _REMOVED_PROVIDER_EFFECTIVE_STATE_IGNORED_KEYS\n }\n\n\ndef _codex_access_token_is_expiring(access_token: Any, skew_seconds: int) -> bool:\n claims = _decode_jwt_claims(access_token)\n exp = claims.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n\n\ndef _qwen_cli_auth_path() -> Path:\n return Path.home() / \".qwen\" / \"oauth_creds.json\"\n\n\ndef _read_qwen_cli_tokens() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n if not auth_path.exists():\n raise AuthError(\n \"Qwen CLI credentials not found. Run 'qwen auth qwen-oauth' first.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_missing\",\n )\n try:\n data = json.loads(auth_path.read_text(encoding=\"utf-8\"))\n except Exception as exc:\n raise AuthError(\n f\"Failed to read Qwen CLI credentials from {auth_path}: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_read_failed\",\n ) from exc\n if not isinstance(data, dict):\n raise AuthError(\n f\"Invalid Qwen CLI credentials in {auth_path}.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_invalid\",\n )\n return data\n\n\ndef _save_qwen_cli_tokens(tokens: Dict[str, Any]) -> Path:\n auth_path = _qwen_cli_auth_path()\n auth_path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_path)\n # Per-process random temp suffix avoids collisions between concurrent\n # writers and stale leftovers from a crashed prior write.\n tmp_path = auth_path.with_name(f\"{auth_path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed tokens\n # at process umask (typically 0o644). See #19673, #21148.\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(tokens, indent=2, sort_keys=True) + \"\\n\")\n fh.flush()\n os.fsync(fh.fileno())\n atomic_replace(tmp_path, auth_path)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n return auth_path\n\n\ndef _qwen_access_token_is_expiring(expiry_date_ms: Any, skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS) -> bool:\n try:\n expiry_ms = int(expiry_date_ms)\n except Exception:\n return True\n return (time.time() + max(0, int(skew_seconds))) * 1000 >= expiry_ms\n\n\ndef _refresh_qwen_cli_tokens(tokens: Dict[str, Any], timeout_seconds: float = 20.0) -> Dict[str, Any]:\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Qwen OAuth refresh token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_token_missing\",\n )\n\n try:\n response = httpx.post(\n QWEN_OAUTH_TOKEN_URL,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": QWEN_OAUTH_CLIENT_ID,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh failed: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n body = response.text.strip()\n raise AuthError(\n \"Qwen OAuth refresh failed. Re-run 'qwen auth qwen-oauth'.\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh returned invalid JSON: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_json\",\n ) from exc\n\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Qwen OAuth refresh response missing access_token.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_response\",\n )\n\n expires_in = payload.get(\"expires_in\")\n try:\n expires_in_seconds = int(expires_in)\n except Exception:\n expires_in_seconds = 6 * 60 * 60\n\n refreshed = {\n \"access_token\": str(payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(payload.get(\"refresh_token\", refresh_token) or refresh_token).strip(),\n \"token_type\": str(payload.get(\"token_type\", tokens.get(\"token_type\", \"Bearer\")) or \"Bearer\").strip() or \"Bearer\",\n \"resource_url\": str(payload.get(\"resource_url\", tokens.get(\"resource_url\", \"portal.qwen.ai\")) or \"portal.qwen.ai\").strip(),\n \"expiry_date\": int(time.time() * 1000) + max(1, expires_in_seconds) * 1000,\n }\n _save_qwen_cli_tokens(refreshed)\n return refreshed\n\n\ndef _mark_qwen_oauth_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to qwen-oauth in auth.json.\n\n Qwen OAuth tokens live in the Qwen CLI credential file managed by\n _save_qwen_cli_tokens / resolve_qwen_runtime_credentials. This function\n only writes a minimal provider-state entry (base_url for display) and\n sets active_provider so that get_active_provider() and\n _model_section_has_credentials() detect the provider for the setup wizard\n and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"base_url\"):\n state[\"base_url\"] = str(creds[\"base_url\"])\n _save_provider_state(auth_store, \"qwen-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_qwen_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n tokens = _read_qwen_cli_tokens()\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _qwen_access_token_is_expiring(tokens.get(\"expiry_date\"), refresh_skew_seconds)\n if should_refresh:\n tokens = _refresh_qwen_cli_tokens(tokens)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Qwen OAuth access token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_access_token_missing\",\n )\n\n base_url = os.getenv(\"ARCEN_QWEN_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_QWEN_BASE_URL\n return {\n \"provider\": \"qwen-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"qwen-cli\",\n \"expires_at_ms\": tokens.get(\"expiry_date\"),\n \"auth_file\": str(_qwen_cli_auth_path()),\n }\n\n\ndef get_qwen_auth_status() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n try:\n # Validate the runtime credentials, including refresh when the cached\n # CLI token is expired. Otherwise stale tokens show up as \"logged in\"\n # and `arcen model` walks users into a broken Qwen setup flow.\n creds = resolve_qwen_runtime_credentials(refresh_if_expiring=True)\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n \"expires_at_ms\": creds.get(\"expires_at_ms\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": str(exc),\n }\n\n\n# =============================================================================\n# Google Gemini OAuth (google-gemini-cli) — PKCE flow + Cloud Code Assist.\n#\n# Tokens live in ~/.arcen/auth/google_oauth.json (managed by agent.google_oauth).\n# The `base_url` here is the marker \"cloudcode-pa://google\" that run_agent.py\n# uses to construct a GeminiCloudCodeClient instead of the default OpenAI SDK.\n# Actual HTTP traffic goes to https://cloudcode-pa.googleapis.com/v1internal:*.\n# =============================================================================\n\ndef _mark_google_gemini_cli_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to google-gemini-cli in auth.json.\n\n The actual OAuth tokens live in the Google credential file managed by\n agent.google_oauth. This function only writes a minimal provider-state\n entry (email for display) and sets active_provider so that\n get_active_provider() and _model_section_has_credentials() detect the\n provider for the setup wizard and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"email\"):\n state[\"email\"] = str(creds[\"email\"])\n _save_provider_state(auth_store, \"google-gemini-cli\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_gemini_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime OAuth creds for google-gemini-cli.\"\"\"\n try:\n from agent.google_oauth import (\n GoogleOAuthError,\n _credentials_path,\n get_valid_access_token,\n load_credentials,\n )\n except ImportError as exc:\n raise AuthError(\n f\"agent.google_oauth is not importable: {exc}\",\n provider=\"google-gemini-cli\",\n code=\"google_oauth_module_missing\",\n ) from exc\n\n try:\n access_token = get_valid_access_token(force_refresh=force_refresh)\n except GoogleOAuthError as exc:\n raise AuthError(\n str(exc),\n provider=\"google-gemini-cli\",\n code=exc.code,\n ) from exc\n\n creds = load_credentials()\n base_url = DEFAULT_GEMINI_CLOUDCODE_BASE_URL\n return {\n \"provider\": \"google-gemini-cli\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"google-oauth\",\n \"expires_at_ms\": (creds.expires_ms if creds else None),\n \"auth_file\": str(_credentials_path()),\n \"email\": (creds.email if creds else \"\") or \"\",\n \"project_id\": (creds.project_id if creds else \"\") or \"\",\n }\n\n\ndef get_gemini_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return a status dict for `arcen auth list` / `arcen status`.\"\"\"\n try:\n from agent.google_oauth import _credentials_path, load_credentials\n except ImportError:\n return {\"logged_in\": False, \"error\": \"agent.google_oauth unavailable\"}\n auth_path = _credentials_path()\n creds = load_credentials()\n if creds is None or not creds.access_token:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": \"not logged in\",\n }\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": \"google-oauth\",\n \"api_key\": creds.access_token,\n \"expires_at_ms\": creds.expires_ms,\n \"email\": creds.email,\n \"project_id\": creds.project_id,\n }\n# Spotify auth — PKCE tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\n\ndef _spotify_scope_list(raw_scope: Optional[str] = None) -> List[str]:\n scope_text = (raw_scope or DEFAULT_SPOTIFY_SCOPE).strip()\n scopes = [part for part in scope_text.split() if part]\n seen: set[str] = set()\n ordered: List[str] = []\n for scope in scopes:\n if scope not in seen:\n seen.add(scope)\n ordered.append(scope)\n return ordered\n\n\ndef _spotify_scope_string(raw_scope: Optional[str] = None) -> str:\n return \" \".join(_spotify_scope_list(raw_scope))\n\n\ndef _spotify_client_id(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\"),\n get_env_value(\"SPOTIFY_CLIENT_ID\"),\n state.get(\"client_id\") if isinstance(state, dict) else None,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n raise AuthError(\n \"Spotify client_id is required. Set ARCEN_SPOTIFY_CLIENT_ID or pass --client-id.\",\n provider=\"spotify\",\n code=\"spotify_client_id_missing\",\n )\n\n\ndef _spotify_redirect_uri(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\"),\n get_env_value(\"SPOTIFY_REDIRECT_URI\"),\n state.get(\"redirect_uri\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_REDIRECT_URI\n\n\ndef _spotify_api_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_API_BASE_URL\"),\n state.get(\"api_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_API_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_API_BASE_URL\n\n\ndef _spotify_accounts_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_ACCOUNTS_BASE_URL\"),\n state.get(\"accounts_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL\n\n\ndef _spotify_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _spotify_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _oauth_pkce_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _oauth_pkce_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _spotify_build_authorize_url(\n *,\n client_id: str,\n redirect_uri: str,\n scope: str,\n state: str,\n code_challenge: str,\n accounts_base_url: str,\n) -> str:\n query = urlencode({\n \"client_id\": client_id,\n \"response_type\": \"code\",\n \"redirect_uri\": redirect_uri,\n \"scope\": scope,\n \"state\": state,\n \"code_challenge_method\": \"S256\",\n \"code_challenge\": code_challenge,\n })\n return f\"{accounts_base_url}/authorize?{query}\"\n\n\ndef _spotify_validate_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"Spotify PKCE redirect_uri must use http://localhost or http://127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host not in {\"127.0.0.1\", \"localhost\"}:\n raise AuthError(\n \"Spotify PKCE redirect_uri must point to localhost or 127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"Spotify PKCE redirect_uri must include an explicit localhost port.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _make_spotify_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n\n class _SpotifyCallbackHandler(BaseHTTPRequestHandler):\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n result[\"code\"] = params.get(\"code\", [None])[0]\n result[\"state\"] = params.get(\"state\", [None])[0]\n result[\"error\"] = params.get(\"error\", [None])[0]\n result[\"error_description\"] = params.get(\"error_description\", [None])[0]\n\n self.send_response(200)\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if result[\"error\"]:\n body = \"<html><body><h1>Spotify authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>Spotify authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _SpotifyCallbackHandler, result\n\n\ndef _spotify_wait_for_callback(\n redirect_uri: str,\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n host, port, path = _spotify_validate_redirect_uri(redirect_uri)\n handler_cls, result = _make_spotify_callback_handler(path)\n\n class _ReuseHTTPServer(HTTPServer):\n allow_reuse_address = True\n\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n except OSError as exc:\n raise AuthError(\n f\"Could not bind Spotify callback server on {host}:{port}: {exc}\",\n provider=\"spotify\",\n code=\"spotify_callback_bind_failed\",\n ) from exc\n\n thread = threading.Thread(target=server.serve_forever, kwargs={\"poll_interval\": 0.1}, daemon=True)\n thread.start()\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n raise AuthError(\n \"Spotify authorization timed out waiting for the local callback.\",\n provider=\"spotify\",\n code=\"spotify_callback_timeout\",\n )\n\n\ndef _xai_validate_loopback_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"xAI OAuth redirect_uri must use http://127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host != XAI_OAUTH_REDIRECT_HOST:\n raise AuthError(\n \"xAI OAuth redirect_uri must point to 127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"xAI OAuth redirect_uri must include an explicit localhost port.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _xai_callback_cors_origin(origin: Optional[str]) -> str:\n # CORS allowlist for the loopback callback. Only xAI's own auth origins\n # are accepted; the redirect_uri itself is bound to 127.0.0.1 and gated by\n # PKCE+state, so additional dev/3p origins are not needed here.\n allowed = {\n \"https://accounts.x.ai\",\n \"https://auth.x.ai\",\n }\n return origin if origin in allowed else \"\"\n\n\ndef _make_xai_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n result_lock = threading.Lock()\n\n class _XAICallbackHandler(BaseHTTPRequestHandler):\n def _maybe_write_cors_headers(self) -> None:\n origin = self.headers.get(\"Origin\")\n allow_origin = _xai_callback_cors_origin(origin)\n if allow_origin:\n self.send_header(\"Access-Control-Allow-Origin\", allow_origin)\n self.send_header(\"Access-Control-Allow-Methods\", \"GET, OPTIONS\")\n self.send_header(\"Access-Control-Allow-Headers\", \"Content-Type\")\n self.send_header(\"Access-Control-Allow-Private-Network\", \"true\")\n self.send_header(\"Vary\", \"Origin\")\n\n def do_OPTIONS(self) -> None: # noqa: N802\n self.send_response(204)\n self._maybe_write_cors_headers()\n self.end_headers()\n\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n incoming = {\n \"code\": params.get(\"code\", [None])[0],\n \"state\": params.get(\"state\", [None])[0],\n \"error\": params.get(\"error\", [None])[0],\n \"error_description\": params.get(\"error_description\", [None])[0],\n }\n\n # Diagnostic logging — emits at INFO so reporters of loopback bugs\n # (#27385 — \"callback received but Arcen times out\") can produce\n # actionable evidence without a code change. Logged values are\n # fingerprints / booleans only; no actual code/state strings leak\n # into the log file. Run with ``ARCEN_LOG_LEVEL=INFO`` (or check\n # ``~/.arcen/logs/agent.log`` which captures INFO+ unconditionally).\n try:\n logger.info(\n \"xAI loopback callback received: path=%s has_code=%s has_state=%s has_error=%s \"\n \"ua=%s\",\n parsed.path,\n incoming[\"code\"] is not None,\n incoming[\"state\"] is not None,\n incoming[\"error\"] is not None,\n (self.headers.get(\"User-Agent\") or \"\")[:80],\n )\n if incoming[\"error\"]:\n logger.info(\n \"xAI loopback callback carries error=%s error_description=%s\",\n incoming[\"error\"],\n (incoming[\"error_description\"] or \"\")[:200],\n )\n except Exception:\n # Logging must never break the OAuth flow.\n pass\n\n # Treat a hit on the callback path with neither `code` nor `error`\n # as a missing OAuth callback (e.g. xAI's auth backend failed to\n # redirect and the user navigated to the bare loopback URL by hand).\n # Show an explicit \"not received\" page rather than the success page —\n # otherwise the browser claims authorization succeeded while the CLI\n # is still waiting for a real callback and eventually times out.\n if incoming[\"code\"] is None and incoming[\"error\"] is None:\n self.send_response(400)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n body = (\n \"<html><body>\"\n \"<h1>xAI authorization not received.</h1>\"\n \"<p>No authorization code was present in this callback URL. \"\n \"Return to the terminal and re-run \"\n \"<code>arcen auth add xai-oauth</code> to retry.</p>\"\n \"</body></html>\"\n )\n self.wfile.write(body.encode(\"utf-8\"))\n return\n\n # ThreadingHTTPServer allows a fallback/manual callback to complete\n # while a browser connection is stuck. Once we have a terminal\n # OAuth result (code or error), keep the first one so a later\n # concurrent/invalid callback cannot overwrite state before\n # validation in _xai_oauth_loopback_login().\n with result_lock:\n if not (result[\"code\"] or result[\"error\"]):\n result.update(incoming)\n\n self.send_response(200)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if incoming[\"error\"]:\n body = \"<html><body><h1>xAI authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>xAI authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _XAICallbackHandler, result\n\n\ndef _xai_start_callback_server(\n preferred_port: int = XAI_OAUTH_REDIRECT_PORT,\n) -> tuple[HTTPServer, threading.Thread, dict[str, Any], str]:\n host = XAI_OAUTH_REDIRECT_HOST\n expected_path = XAI_OAUTH_REDIRECT_PATH\n handler_cls, result = _make_xai_callback_handler(expected_path)\n\n class _ReuseHTTPServer(ThreadingHTTPServer):\n allow_reuse_address = True\n daemon_threads = True\n\n ports_to_try = [preferred_port]\n if preferred_port != 0:\n ports_to_try.append(0)\n server = None\n last_error: Optional[OSError] = None\n for port in ports_to_try:\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n break\n except OSError as exc:\n last_error = exc\n if server is None:\n raise AuthError(\n f\"Could not bind xAI callback server on {host}:{preferred_port}: {last_error}\",\n provider=\"xai-oauth\",\n code=\"xai_callback_bind_failed\",\n ) from last_error\n\n actual_port = int(server.server_address[1])\n redirect_uri = f\"http://{host}:{actual_port}{expected_path}\"\n thread = threading.Thread(\n target=server.serve_forever,\n kwargs={\"poll_interval\": 0.1},\n daemon=True,\n )\n thread.start()\n return server, thread, result, redirect_uri\n\n\ndef _xai_wait_for_callback(\n server: HTTPServer,\n thread: threading.Thread,\n result: dict[str, Any],\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n # Diagnostic: distinguish \"no callback ever arrived\" from \"callback\n # arrived but result wasn't populated\" (#27385). The per-hit handler\n # also logs at INFO; if neither line appears, xAI's IDP never reached\n # the loopback at all (firewall, port-binding, IPv6/IPv4 mismatch).\n logger.info(\n \"xAI loopback wait timed out after %.0fs with no usable callback \"\n \"(result.code=%s result.error=%s)\",\n max(5.0, timeout_seconds),\n result[\"code\"] is not None,\n result[\"error\"] is not None,\n )\n raise AuthError(\n \"xAI authorization timed out waiting for the local callback.\",\n provider=\"xai-oauth\",\n code=\"xai_callback_timeout\",\n )\n\n\ndef _spotify_token_payload_to_state(\n token_payload: Dict[str, Any],\n *,\n client_id: str,\n redirect_uri: str,\n requested_scope: str,\n accounts_base_url: str,\n api_base_url: str,\n previous_state: Optional[Dict[str, Any]] = None,\n) -> Dict[str, Any]:\n now = datetime.now(timezone.utc)\n expires_in = _coerce_ttl_seconds(token_payload.get(\"expires_in\", 0))\n expires_at = datetime.fromtimestamp(now.timestamp() + expires_in, tz=timezone.utc)\n state = dict(previous_state or {})\n state.update({\n \"client_id\": client_id,\n \"redirect_uri\": redirect_uri,\n \"accounts_base_url\": accounts_base_url,\n \"api_base_url\": api_base_url,\n \"scope\": requested_scope,\n \"granted_scope\": str(token_payload.get(\"scope\") or requested_scope).strip(),\n \"token_type\": str(token_payload.get(\"token_type\", \"Bearer\") or \"Bearer\").strip() or \"Bearer\",\n \"access_token\": str(token_payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(\n token_payload.get(\"refresh_token\")\n or state.get(\"refresh_token\")\n or \"\"\n ).strip(),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": expires_at.isoformat(),\n \"expires_in\": expires_in,\n \"auth_type\": \"oauth_pkce\",\n })\n return state\n\n\ndef _spotify_exchange_code_for_tokens(\n *,\n client_id: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n accounts_base_url: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"client_id\": client_id,\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"code_verifier\": code_verifier,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token exchange failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token exchange failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n )\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify token response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_invalid\",\n )\n return payload\n\n\ndef _refresh_spotify_oauth_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Spotify refresh token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_refresh_token_missing\",\n relogin_required=True,\n )\n\n client_id = _spotify_client_id(state=state)\n accounts_base_url = _spotify_accounts_base_url(state)\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": client_id,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token refresh failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token refresh failed. Run `arcen auth spotify` again.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n relogin_required=True,\n )\n\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify refresh response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_refresh_invalid\",\n relogin_required=True,\n )\n\n return _spotify_token_payload_to_state(\n payload,\n client_id=client_id,\n redirect_uri=_spotify_redirect_uri(state=state),\n requested_scope=str(state.get(\"scope\") or DEFAULT_SPOTIFY_SCOPE),\n accounts_base_url=accounts_base_url,\n api_base_url=_spotify_api_base_url(state),\n previous_state=state,\n )\n\n\ndef resolve_spotify_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = SPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"spotify\")\n if not state:\n raise AuthError(\n \"Spotify is not authenticated. Run `arcen auth spotify` first.\",\n provider=\"spotify\",\n code=\"spotify_auth_missing\",\n relogin_required=True,\n )\n\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds)\n if should_refresh:\n state = _refresh_spotify_oauth_state(state)\n _store_provider_state(auth_store, \"spotify\", state, set_active=False)\n _save_auth_store(auth_store)\n\n access_token = str(state.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Spotify access token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_access_token_missing\",\n relogin_required=True,\n )\n\n return {\n \"provider\": \"spotify\",\n \"access_token\": access_token,\n \"api_key\": access_token,\n \"token_type\": str(state.get(\"token_type\", \"Bearer\") or \"Bearer\"),\n \"base_url\": _spotify_api_base_url(state),\n \"scope\": str(state.get(\"granted_scope\") or state.get(\"scope\") or \"\").strip(),\n \"client_id\": _spotify_client_id(state=state),\n \"redirect_uri\": _spotify_redirect_uri(state=state),\n \"expires_at\": state.get(\"expires_at\"),\n \"refresh_token\": str(state.get(\"refresh_token\", \"\") or \"\").strip(),\n }\n\n\ndef get_spotify_auth_status() -> Dict[str, Any]:\n state = get_provider_auth_state(\"spotify\")\n if not state:\n return {\"logged_in\": False}\n\n expires_at = state.get(\"expires_at\")\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n return {\n \"logged_in\": bool(refresh_token or not _is_expiring(expires_at, 0)),\n \"auth_type\": state.get(\"auth_type\", \"oauth_pkce\"),\n \"client_id\": state.get(\"client_id\"),\n \"redirect_uri\": state.get(\"redirect_uri\"),\n \"scope\": state.get(\"granted_scope\") or state.get(\"scope\"),\n \"expires_at\": expires_at,\n \"api_base_url\": state.get(\"api_base_url\"),\n \"has_refresh_token\": bool(refresh_token),\n }\n\n\ndef _spotify_interactive_setup(redirect_uri_hint: str) -> str:\n \"\"\"Walk the user through creating a Spotify developer app, persist the\n resulting client_id to ~/.arcen/.env, and return it.\n\n Raises SystemExit if the user aborts or submits an empty value.\n \"\"\"\n from arcen_cli.config import save_env_value\n\n print()\n print(\"=\" * 70)\n print(\"Spotify first-time setup\")\n print(\"=\" * 70)\n print()\n print(\"Spotify requires every user to register their own lightweight\")\n print(\"developer app. This takes about two minutes and only has to be\")\n print(\"done once per machine.\")\n print()\n print(f\"Full guide: {SPOTIFY_DOCS_URL}\")\n print()\n print(\"Steps:\")\n print(f\" 1. Opening {SPOTIFY_DASHBOARD_URL} in your browser...\")\n print(\" 2. Click 'Create app' and fill in:\")\n print(\" App name: anything (e.g. arcen-agent)\")\n print(\" Description: anything\")\n print(f\" Redirect URI: {redirect_uri_hint}\")\n print(\" API/SDK: Web API\")\n print(\" 3. Agree to the terms, click Save.\")\n print(\" 4. Open the app's Settings page and copy the Client ID.\")\n print(\" 5. Paste it below.\")\n print()\n\n if not _is_remote_session():\n try:\n webbrowser.open(SPOTIFY_DASHBOARD_URL)\n except Exception:\n pass\n\n try:\n raw = input(\"Spotify Client ID: \").strip()\n except (EOFError, KeyboardInterrupt):\n print()\n raise SystemExit(\"Spotify setup cancelled.\")\n\n if not raw:\n print()\n print(f\"No Client ID entered. See {SPOTIFY_DOCS_URL} for the full guide.\")\n raise SystemExit(\"Spotify setup cancelled: empty Client ID.\")\n\n # Persist so subsequent `arcen auth spotify` runs skip the wizard.\n save_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\", raw)\n # Only persist the redirect URI if it's non-default, to avoid pinning\n # users to a value the default might later change to.\n if redirect_uri_hint and redirect_uri_hint != DEFAULT_SPOTIFY_REDIRECT_URI:\n save_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\", redirect_uri_hint)\n\n print()\n print(\"Saved ARCEN_SPOTIFY_CLIENT_ID to ~/.arcen/.env\")\n print()\n return raw\n\n\ndef login_spotify_command(args) -> None:\n existing_state = get_provider_auth_state(\"spotify\") or {}\n\n # Interactive wizard: if no client_id is configured anywhere, walk the\n # user through creating the Spotify developer app instead of crashing\n # with \"ARCEN_SPOTIFY_CLIENT_ID is required\".\n explicit_client_id = getattr(args, \"client_id\", None)\n try:\n client_id = _spotify_client_id(explicit_client_id, existing_state)\n except AuthError as exc:\n if getattr(exc, \"code\", \"\") != \"spotify_client_id_missing\":\n raise\n client_id = _spotify_interactive_setup(\n redirect_uri_hint=getattr(args, \"redirect_uri\", None) or DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n\n redirect_uri = _spotify_redirect_uri(getattr(args, \"redirect_uri\", None), existing_state)\n scope = _spotify_scope_string(getattr(args, \"scope\", None) or existing_state.get(\"scope\"))\n accounts_base_url = _spotify_accounts_base_url(existing_state)\n api_base_url = _spotify_api_base_url(existing_state)\n open_browser = not getattr(args, \"no_browser\", False)\n\n code_verifier = _spotify_code_verifier()\n code_challenge = _spotify_code_challenge(code_verifier)\n state_nonce = uuid.uuid4().hex\n authorize_url = _spotify_build_authorize_url(\n client_id=client_id,\n redirect_uri=redirect_uri,\n scope=scope,\n state=state_nonce,\n code_challenge=code_challenge,\n accounts_base_url=accounts_base_url,\n )\n\n print(\"Starting Spotify PKCE login...\")\n print(f\"Client ID: {client_id}\")\n print(f\"Redirect URI: {redirect_uri}\")\n print(\"Make sure this redirect URI is allow-listed in your Spotify app settings.\")\n print()\n print(\"Open this URL to authorize Arcen:\")\n print(authorize_url)\n print()\n print(f\"Full setup guide: {SPOTIFY_DOCS_URL}\")\n print()\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=SPOTIFY_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for Spotify authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n callback = _spotify_wait_for_callback(\n redirect_uri,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 180.0),\n )\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise SystemExit(f\"Spotify authorization failed: {detail}\")\n if callback.get(\"state\") != state_nonce:\n raise SystemExit(\"Spotify authorization failed: state mismatch.\")\n\n token_payload = _spotify_exchange_code_for_tokens(\n client_id=client_id,\n code=str(callback.get(\"code\") or \"\"),\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n accounts_base_url=accounts_base_url,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 20.0),\n )\n spotify_state = _spotify_token_payload_to_state(\n token_payload,\n client_id=client_id,\n redirect_uri=redirect_uri,\n requested_scope=scope,\n accounts_base_url=accounts_base_url,\n api_base_url=api_base_url,\n )\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _store_provider_state(auth_store, \"spotify\", spotify_state, set_active=False)\n saved_to = _save_auth_store(auth_store)\n\n print(\"Spotify login successful!\")\n print(f\" Auth state: {saved_to}\")\n print(\" Provider state saved under providers.spotify\")\n print(f\" Docs: {SPOTIFY_DOCS_URL}\")\n\n# =============================================================================\n# SSH / remote session detection\n# =============================================================================\n\ndef _is_remote_session() -> bool:\n \"\"\"Detect environments where loopback OAuth can't reach the local browser.\n\n Historically only SSH was checked, but #26923 surfaced that\n **browser-only remote consoles** (GCP Cloud Shell, GitHub\n Codespaces, AWS EC2 Instance Connect, Gitpod, Replit, etc.) hit\n the exact same problem — the user has a browser on their laptop\n but the loopback listener is bound on the remote VM that the\n laptop's browser can't reach. These environments typically don't\n set ``SSH_CLIENT`` / ``SSH_TTY``, so the SSH-only check left\n them with no guidance and no fallback.\n \"\"\"\n if os.getenv(\"SSH_CLIENT\") or os.getenv(\"SSH_TTY\"):\n return True\n # Browser-only remote IDEs / cloud shells. Keep this list narrow\n # (well-known, documented env vars set by the host platform) so\n # we don't falsely trip on a developer's local shell.\n for var in (\n \"CLOUD_SHELL\", # GCP Cloud Shell\n \"CODESPACES\", # GitHub Codespaces\n \"CODESPACE_NAME\", # GitHub Codespaces (alt)\n \"GITPOD_WORKSPACE_ID\", # Gitpod\n \"REPL_ID\", # Replit\n \"STACKBLITZ\", # StackBlitz\n ):\n if os.getenv(var):\n return True\n return False\n\n\n# Console/text-mode browsers that ``webbrowser`` will happily launch INSIDE\n# the terminal. Opening one of these is worse than not opening anything —\n# it hijacks the user's TTY with an unusable text browser (the xAI OAuth\n# \"Account Management\" page rendered in w3m, reported May 2026) instead of\n# letting them copy the URL to a real browser. When the resolved browser is\n# one of these we refuse to auto-open and fall back to the print-the-URL /\n# manual-paste path, same as a remote session.\n_CONSOLE_BROWSER_NAMES: FrozenSet[str] = frozenset(\n {\n \"w3m\",\n \"lynx\",\n \"links\",\n \"links2\",\n \"elinks\",\n \"www-browser\",\n \"browsh\", # TUI browser — still hijacks the terminal\n }\n)\n\n\ndef _can_open_graphical_browser() -> bool:\n \"\"\"Return True only when a *graphical* browser is likely to open.\n\n ``webbrowser.open()`` resolves to whatever the platform offers, and on a\n headless / CLI-only Linux box with no GUI browser installed that is often\n a text-mode browser (w3m/lynx/links) which launches inside the terminal\n and takes over the user's session. This guard distinguishes \"a real\n windowed browser will pop up\" from \"a console browser will hijack the\n TTY\", so callers can fall back to printing the URL instead.\n\n Heuristics:\n * Respect ``$BROWSER`` — if it names a known console browser, refuse.\n * On Linux, require a display server (``$DISPLAY`` / ``$WAYLAND_DISPLAY``)\n unless ``$BROWSER`` points at something graphical; no display server\n almost always means no GUI browser.\n * Ask ``webbrowser.get()`` what it resolved to and refuse when the\n underlying command is a known console browser.\n * macOS and Windows always have a usable default GUI browser.\n \"\"\"\n import webbrowser as _webbrowser\n\n def _names_console_browser(value: str) -> bool:\n token = value.strip().split()[0] if value.strip() else \"\"\n base = os.path.basename(token).lower()\n return base in _CONSOLE_BROWSER_NAMES\n\n browser_env = os.environ.get(\"BROWSER\", \"\")\n if browser_env and _names_console_browser(browser_env):\n return False\n\n if sys.platform.startswith(\"linux\"):\n has_display = bool(\n os.environ.get(\"DISPLAY\") or os.environ.get(\"WAYLAND_DISPLAY\")\n )\n # An explicit graphical $BROWSER can work without $DISPLAY in odd\n # setups, but a console $BROWSER already returned False above, so the\n # only way to reach here with a $BROWSER set is a graphical one.\n if not has_display and not browser_env:\n return False\n\n try:\n controller = _webbrowser.get()\n except Exception:\n # No browser resolvable at all → definitely don't auto-open.\n return False\n\n candidate = (\n getattr(controller, \"name\", \"\")\n or getattr(controller, \"basename\", \"\")\n or \"\"\n )\n if candidate and _names_console_browser(candidate):\n return False\n\n return True\n\n\ndef _parse_pasted_callback(raw: str) -> dict:\n \"\"\"Parse a pasted callback URL / query string into the loopback shape.\n\n Accepts any of:\n\n * full URL: ``http://127.0.0.1:56121/callback?code=abc&state=xyz``\n * bare query string: ``?code=abc&state=xyz`` or ``code=abc&state=xyz``\n * bare code (no state, only used when the upstream omits state):\n ``abc-the-code-value``\n\n Returns ``{\"code\", \"state\", \"error\", \"error_description\"}`` with\n missing keys set to ``None`` so the loopback callsites can keep\n using the same validation path (state check, error check, etc.)\n they already use for the HTTP server output. Regression for\n #26923 — formalises the curl-the-callback-URL workaround the\n reporter used while waiting for upstream support.\n \"\"\"\n stripped = raw.strip()\n result: dict = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n if not stripped:\n return result\n query = \"\"\n if stripped.startswith((\"http://\", \"https://\")):\n try:\n parsed = urlparse(stripped)\n except Exception:\n return result\n query = parsed.query or \"\"\n elif stripped.startswith(\"?\"):\n query = stripped[1:]\n elif \"=\" in stripped:\n # Looks like a bare query fragment (``code=...&state=...``).\n query = stripped\n else:\n # Treat as a bare opaque code value with no state.\n result[\"code\"] = stripped\n return result\n params = parse_qs(query, keep_blank_values=False)\n for key in (\"code\", \"state\", \"error\", \"error_description\"):\n values = params.get(key)\n if values:\n result[key] = values[0]\n return result\n\n\ndef _prompt_manual_callback_paste(redirect_uri: str) -> dict:\n \"\"\"Read a callback URL from stdin as a fallback for browser-only remotes.\n\n Used when ``--manual-paste`` is set or when the loopback listener\n cannot bind. Returns the parsed callback dict (same shape as the\n HTTP handler output) so the existing state / error validation in\n the caller works unchanged. See #26923.\n \"\"\"\n print()\n print(\"─── Manual callback paste ─────────────────────────────────────\")\n print(\"After approving in your browser, your browser will try to load\")\n print(f\" {redirect_uri}\")\n print(\"which fails (the loopback listener is on this remote machine,\")\n print(\"not on your laptop) — that is expected. Copy the FULL URL\")\n print(\"from your browser's address bar of that failed page and paste\")\n print(\"it below. A bare '?code=...&state=...' fragment also works.\")\n print(\"If the consent page shows the authorization code in-page\")\n print(\"(xAI's current behavior) rather than redirecting, paste the\")\n print(\"bare code value on its own.\")\n print(\"───────────────────────────────────────────────────────────────\")\n try:\n raw = input(\"Callback URL: \")\n except (EOFError, KeyboardInterrupt):\n raw = \"\"\n return _parse_pasted_callback(raw)\n\n\ndef _ssh_user_at_host() -> str:\n \"\"\"Return best-effort 'user@hostname' for the SSH tunnel hint command.\n\n Falls back to placeholder tokens when the values cannot be determined so\n the hint is always syntactically valid even if not copy-pasteable.\n \"\"\"\n try:\n import socket as _socket\n hostname = _socket.gethostname() or \"<this-host>\"\n except OSError:\n hostname = \"<this-host>\"\n user = os.getenv(\"USER\") or os.getenv(\"LOGNAME\") or \"<user>\"\n return f\"{user}@{hostname}\"\n\n\ndef _print_loopback_ssh_hint(redirect_uri: str, *, docs_url: str | None = None) -> None:\n \"\"\"Print an SSH tunnel hint when running a loopback-redirect OAuth flow on a\n remote host. The auth server (xAI, Spotify, ...) will redirect the user's\n browser to ``127.0.0.1:<port>/callback``. If the browser is on a different\n machine than the loopback listener (the usual SSH case), the redirect can't\n reach the listener without a local port forward.\n\n The hint is best-effort: silent if we don't think we're remote, or if we\n can't parse a host/port out of the redirect URI.\n\n Pass ``docs_url`` for a provider-specific guide (e.g. the xAI Grok OAuth\n page); the generic OAuth-over-SSH guide is always shown after it.\n \"\"\"\n if not _is_remote_session():\n return\n try:\n parsed = urlparse(redirect_uri)\n except Exception:\n return\n host = parsed.hostname or \"\"\n port = parsed.port\n if host not in {\"127.0.0.1\", \"::1\", \"localhost\"} or not port:\n return\n divider = \"-\" * 60\n print()\n print(divider)\n print(\"Remote session detected — SSH tunnel required\")\n print(divider)\n print(f\"Arcen is waiting for the OAuth callback on {redirect_uri}\")\n print(\"but your browser is on a different machine. Run this command\")\n print(\"in a NEW terminal on your local machine BEFORE opening the URL:\")\n print()\n print(f\" ssh -N -L {port}:127.0.0.1:{port} {_ssh_user_at_host()}\")\n print()\n print(\"Then open the authorize URL above in your local browser.\")\n print()\n print(\"No SSH client (Cloud Shell / Codespaces / web IDE)? Re-run with\")\n print(\"`--manual-paste` to skip the loopback listener and paste the failed\")\n print(\"callback URL directly.\")\n if docs_url:\n print(f\"Provider docs: {docs_url}\")\n print(f\"SSH/jump-box guide: {OAUTH_OVER_SSH_DOCS_URL}\")\n print(divider)\n print()\n\n\n# =============================================================================\n# OpenAI Codex auth — tokens stored in ~/.arcen/auth.json (not ~/.codex/)\n#\n# Arcen maintains its own Codex OAuth session separate from the Codex CLI\n# and VS Code extension. This prevents refresh token rotation conflicts\n# where one app's refresh invalidates the other's session.\n# =============================================================================\n\ndef _read_codex_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n \"\"\"Read Codex OAuth tokens from Arcen auth store (~/.arcen/auth.json).\n \n Returns dict with 'tokens' (access_token, refresh_token) and 'last_refresh'.\n Raises AuthError if no Codex tokens are stored.\n \"\"\"\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\")\n if not state:\n raise AuthError(\n \"No Codex credentials stored. Run `arcen auth` to authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"Codex auth state is missing tokens. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n raise AuthError(\n \"Codex auth is missing access_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_access_token\",\n relogin_required=True,\n )\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n }\n\n\ndef _sync_codex_pool_entries(\n auth_store: Dict[str, Any],\n tokens: Dict[str, str],\n last_refresh: Optional[str],\n) -> None:\n \"\"\"Mirror a fresh Codex re-auth into the credential_pool OAuth entries.\n\n The runtime selects credentials from ``credential_pool.openai-codex``, not\n from ``providers.openai-codex.tokens``. A re-auth invalidates the prior\n OAuth pair server-side, but pool entries keep holding the now-consumed\n refresh token plus any stale error markers — so the next request spends a\n dead token and gets a 401 ``token_invalidated``.\n\n What gets refreshed:\n\n * ``device_code`` — the singleton-seeded entry written by the device-code\n OAuth flow when the user logged in via ``arcen setup`` / the model\n picker. Always synced with the fresh tokens.\n * ``manual:device_code`` — entries created by ``arcen auth add openai-codex``\n that use the same device-code OAuth mechanism. An interactive re-auth\n proves the user owns the ChatGPT account, so it is safe (and expected)\n to refresh these entries too. Without this, a user who once ran the\n ``arcen auth add`` workaround for #33000 would silently leave that\n manual entry stale on every subsequent re-auth, recreating the issue\n reported in #33538.\n\n What does NOT get refreshed:\n\n * ``manual:api_key`` and any other non-device-code manual sources — those\n are independent credentials (an explicit API key, a different ChatGPT\n account, etc.) and must not be overwritten by a single re-auth.\n\n Error markers (``last_status``, ``last_error_*``) are also cleared on\n every device-code-backed entry — even those whose tokens we did not\n rewrite — so that an interactive re-auth gives every relevant pool entry\n a fresh selection chance instead of leaving them marked unhealthy from a\n pre-re-auth 401.\n \"\"\"\n access_token = tokens.get(\"access_token\")\n if not access_token:\n return\n refresh_token = tokens.get(\"refresh_token\")\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return\n # Sources whose tokens should be rewritten by a fresh Codex device-code\n # OAuth re-auth. ``manual:api_key`` and unknown sources are intentionally\n # excluded — they represent independent credentials.\n REFRESHABLE_SOURCES = {\"device_code\", \"manual:device_code\"}\n for entry in entries:\n if not isinstance(entry, dict):\n continue\n source = entry.get(\"source\")\n if source not in REFRESHABLE_SOURCES:\n continue\n entry[\"access_token\"] = access_token\n if refresh_token:\n entry[\"refresh_token\"] = refresh_token\n if last_refresh:\n entry[\"last_refresh\"] = last_refresh\n entry[\"last_status\"] = None\n entry[\"last_status_at\"] = None\n entry[\"last_error_code\"] = None\n entry[\"last_error_reason\"] = None\n entry[\"last_error_message\"] = None\n entry[\"last_error_reset_at\"] = None\n\n\ndef _save_codex_tokens(tokens: Dict[str, str], last_refresh: str = None, label: str = None) -> None:\n \"\"\"Save Codex OAuth tokens to Arcen auth store (~/.arcen/auth.json).\"\"\"\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"chatgpt\"\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n _save_provider_state(auth_store, \"openai-codex\", state)\n _sync_codex_pool_entries(auth_store, tokens, last_refresh)\n _save_auth_store(auth_store)\n\n\ndef refresh_codex_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"Refresh Codex OAuth tokens without mutating Arcen auth state.\"\"\"\n del access_token # Access token is only used by callers to decide whether to refresh.\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n CODEX_OAUTH_TOKEN_URL,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": CODEX_OAUTH_CLIENT_ID,\n },\n )\n\n if response.status_code == 429:\n # Upstream rate-limit / usage-quota exhaustion on the token endpoint.\n # The stored refresh token is still valid here — re-authenticating\n # cannot lift a quota cap. Classify distinctly from auth failures so\n # callers surface a \"retry later\" notice instead of a misleading\n # \"run arcen auth\" prompt (see issue #32790).\n retry_after = _parse_retry_after_seconds(getattr(response, \"headers\", None))\n if retry_after is not None:\n message = (\n f\"Codex provider quota exhausted (429); retry after {retry_after}s. \"\n \"Credentials are still valid.\"\n )\n else:\n message = (\n \"Codex provider quota exhausted (429). Credentials are still valid; \"\n \"retry after the usage limit resets.\"\n )\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=CODEX_RATE_LIMITED_CODE,\n relogin_required=False,\n )\n\n if response.status_code != 200:\n code = \"codex_refresh_failed\"\n message = f\"Codex token refresh failed with status {response.status_code}.\"\n relogin_required = False\n try:\n err = response.json()\n if isinstance(err, dict):\n err_obj = err.get(\"error\")\n # OpenAI shape: {\"error\": {\"code\": \"...\", \"message\": \"...\", \"type\": \"...\"}}\n if isinstance(err_obj, dict):\n nested_code = err_obj.get(\"code\") or err_obj.get(\"type\")\n if isinstance(nested_code, str) and nested_code.strip():\n code = nested_code.strip()\n nested_msg = err_obj.get(\"message\")\n if isinstance(nested_msg, str) and nested_msg.strip():\n message = f\"Codex token refresh failed: {nested_msg.strip()}\"\n # OAuth spec shape: {\"error\": \"code_str\", \"error_description\": \"...\"}\n elif isinstance(err_obj, str) and err_obj.strip():\n code = err_obj.strip()\n err_desc = err.get(\"error_description\") or err.get(\"message\")\n if isinstance(err_desc, str) and err_desc.strip():\n message = f\"Codex token refresh failed: {err_desc.strip()}\"\n except Exception:\n pass\n if code in {\"invalid_grant\", \"invalid_token\", \"invalid_request\"}:\n relogin_required = True\n if code == \"refresh_token_reused\":\n message = (\n \"Codex refresh token was already consumed by another client \"\n \"(e.g. Codex CLI or VS Code extension). \"\n \"Run `codex` in your terminal to generate fresh tokens, \"\n \"then run `arcen auth` to re-authenticate.\"\n )\n relogin_required = True\n # A 401/403 from the token endpoint always means the refresh token\n # is invalid/expired — force relogin even if the body error code\n # wasn't one of the known strings above.\n if response.status_code in {401, 403} and not relogin_required:\n relogin_required = True\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=code,\n relogin_required=relogin_required,\n )\n\n try:\n refresh_payload = response.json()\n except Exception as exc:\n raise AuthError(\n \"Codex token refresh returned invalid JSON.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_invalid_json\",\n relogin_required=True,\n ) from exc\n\n refreshed_access = refresh_payload.get(\"access_token\")\n if not isinstance(refreshed_access, str) or not refreshed_access.strip():\n raise AuthError(\n \"Codex token refresh response was missing access_token.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_missing_access_token\",\n relogin_required=True,\n )\n\n updated = {\n \"access_token\": refreshed_access.strip(),\n \"refresh_token\": refresh_token.strip(),\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n next_refresh = refresh_payload.get(\"refresh_token\")\n if isinstance(next_refresh, str) and next_refresh.strip():\n updated[\"refresh_token\"] = next_refresh.strip()\n return updated\n\n\ndef _refresh_codex_auth_tokens(\n tokens: Dict[str, str],\n timeout_seconds: float,\n) -> Dict[str, str]:\n \"\"\"Refresh Codex access token using the refresh token.\n \n Saves the new tokens to Arcen auth store automatically.\n \"\"\"\n refreshed = refresh_codex_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n\n _save_codex_tokens(updated_tokens)\n return updated_tokens\n\n\ndef _import_codex_cli_tokens() -> Optional[Dict[str, str]]:\n \"\"\"Try to read tokens from ~/.codex/auth.json (Codex CLI shared file).\n \n Returns tokens dict if valid and not expired, None otherwise.\n Does NOT write to the shared file.\n \"\"\"\n codex_home = os.getenv(\"CODEX_HOME\", \"\").strip()\n if not codex_home:\n codex_home = str(Path.home() / \".codex\")\n auth_path = Path(codex_home).expanduser() / \"auth.json\"\n if not auth_path.is_file():\n return None\n try:\n payload = json.loads(auth_path.read_text())\n tokens = payload.get(\"tokens\")\n if not isinstance(tokens, dict):\n return None\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not access_token or not refresh_token:\n return None\n # Reject expired tokens — importing stale tokens from ~/.codex/\n # that can't be refreshed leaves the user stuck with \"Login successful!\"\n # but no working credentials.\n if _codex_access_token_is_expiring(access_token, 0):\n logger.debug(\n \"Codex CLI tokens at %s are expired — skipping import.\", auth_path,\n )\n return None\n return dict(tokens)\n except Exception:\n return None\n\n\ndef resolve_codex_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime credentials from Arcen's own Codex token store.\n\n Falls back to the credential pool when the singleton (``providers.openai-codex.tokens``)\n has no usable access_token but the pool (``credential_pool.openai-codex``) does. This\n closes the divergence between the chat path (singleton-only via this function) and\n the auxiliary path (pool-first via ``_read_codex_access_token``). Without this\n fallback, a user whose tokens live only in the pool — for example after a manual\n pool seed, a partial re-auth, or pool-only restoration from a backup — gets a bare\n HTTP 401 ``Missing Authentication header`` from the wire instead of a usable\n credential. See issue #32992.\n \"\"\"\n try:\n data = _read_codex_tokens()\n except AuthError:\n pool_token = _pool_codex_access_token()\n if pool_token:\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": pool_token,\n \"source\": \"credential_pool\",\n \"last_refresh\": None,\n \"auth_mode\": \"chatgpt\",\n }\n raise\n\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_CODEX_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n # Re-read under lock to avoid racing with other Arcen processes\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_codex_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n\n if should_refresh:\n tokens = _refresh_codex_auth_tokens(tokens, refresh_timeout_seconds)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"chatgpt\",\n }\n\n\ndef _pool_codex_access_token() -> str:\n \"\"\"Return the most-recent usable access_token from the openai-codex pool.\n\n Used as a fallback by ``resolve_codex_runtime_credentials`` when the\n singleton has no creds. Reads ``credential_pool.openai-codex`` entries\n directly from auth.json and picks the first non-empty access_token,\n preferring entries that are not currently in an exhaustion cooldown.\n Returns ``\"\"`` when no usable entry is found (caller handles by raising\n the original AuthError).\n \"\"\"\n try:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return \"\"\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return \"\"\n\n def _entry_usable(entry: Dict[str, Any]) -> bool:\n if not isinstance(entry, dict):\n return False\n token = entry.get(\"access_token\")\n if not isinstance(token, str) or not token.strip():\n return False\n # Skip entries currently in an exhaustion cooldown window.\n reset_at = entry.get(\"last_error_reset_at\")\n if isinstance(reset_at, (int, float)) and reset_at > time.time():\n return False\n return True\n\n for entry in entries:\n if _entry_usable(entry):\n return str(entry.get(\"access_token\", \"\")).strip()\n except Exception:\n logger.debug(\"Codex pool fallback lookup failed\", exc_info=True)\n return \"\"\n\n\n# =============================================================================\n# xAI Grok OAuth — tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\ndef _read_xai_oauth_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\")\n if not state:\n raise AuthError(\n \"No xAI OAuth credentials stored. Select xAI Grok OAuth (SuperGrok / Premium+) in `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"xAI OAuth state is missing tokens. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI OAuth state is missing access_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_access_token\",\n relogin_required=True,\n )\n if not refresh_token:\n raise AuthError(\n \"xAI OAuth state is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n \"discovery\": state.get(\"discovery\") or {},\n \"redirect_uri\": state.get(\"redirect_uri\"),\n }\n\n\ndef _save_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n discovery: Optional[Dict[str, Any]] = None,\n redirect_uri: str = \"\",\n last_refresh: Optional[str] = None,\n) -> None:\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"oauth_pkce\"\n if discovery:\n state[\"discovery\"] = discovery\n if redirect_uri:\n state[\"redirect_uri\"] = redirect_uri\n _save_provider_state(auth_store, \"xai-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef _xai_access_token_is_expiring(access_token: str, skew_seconds: int = 0) -> bool:\n if not isinstance(access_token, str) or \".\" not in access_token:\n return False\n try:\n parts = access_token.split(\".\")\n if len(parts) < 2:\n return False\n payload_b64 = parts[1]\n payload_b64 += \"=\" * (-len(payload_b64) % 4)\n payload = json.loads(base64.urlsafe_b64decode(payload_b64.encode(\"ascii\")).decode(\"utf-8\"))\n exp = payload.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n except Exception:\n return False\n\n\ndef _xai_validate_oauth_endpoint(url: str, *, field: str) -> str:\n \"\"\"Refuse any OIDC discovery endpoint that isn't HTTPS on the xAI origin.\n\n The OIDC discovery response is a long-lived, low-frequency request whose\n output is cached in ``~/.arcen/auth.json``. A single MITM during initial\n login could substitute a malicious ``token_endpoint``; that URL would\n then receive the refresh_token on every subsequent refresh — a permanent\n credential leak from a one-time MITM. Validating scheme + host pins the\n cached endpoint to the xAI auth origin (or a future ``*.x.ai`` subdomain\n if xAI migrates) so the cache poisoning loses its persistence guarantee.\n\n RFC 8414 §2 requires the issuer to be ``https://`` and SHOULD-keeps the\n token_endpoint on the same origin; we enforce both. ``x.ai`` is the\n bare apex, so we accept either exact host match or any ``.x.ai`` suffix.\n \"\"\"\n parsed = urlparse(url)\n if parsed.scheme != \"https\":\n raise AuthError(\n f\"xAI OIDC discovery returned a non-HTTPS {field}: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n host = (parsed.hostname or \"\").lower()\n if not host:\n raise AuthError(\n f\"xAI OIDC discovery {field} is missing a hostname: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n raise AuthError(\n f\"xAI OIDC discovery {field} host {host!r} is not on the xAI origin \"\n f\"(expected x.ai or a *.x.ai subdomain). Refusing to use a cached \"\n f\"endpoint that may have been substituted by a MITM during initial \"\n f\"discovery; re-authenticate with `arcen model` to re-fetch.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n return url\n\n\ndef _xai_validate_inference_base_url(value: str, *, fallback: str) -> str:\n \"\"\"Refuse a non-xAI base_url for the OAuth-authenticated inference path.\n\n The xAI Grok OAuth bearer is a high-value, long-lived credential tied to\n the user's SuperGrok subscription. ``XAI_BASE_URL`` / ``ARCEN_XAI_BASE_URL``\n let users repoint the inference endpoint (handy for staging or a local\n proxy), but the env override is also a credential-leak vector: a tampered\n ``.env`` or hostile shell init that sets\n ``XAI_BASE_URL=https://attacker.example/v1`` would ship the OAuth access\n token to a third party on every request, silently.\n\n Pin the inference origin to ``api.x.ai`` (or any ``*.x.ai`` subdomain xAI\n may add). On rejection, fall back to the default and log a warning rather\n than raise — a bad env var should not deadlock authentication, but it\n should also never leak the bearer.\n\n ``value`` is the already-stripped, trailing-slash-trimmed candidate from\n env. Empty input returns ``fallback`` unchanged.\n \"\"\"\n candidate = (value or \"\").strip().rstrip(\"/\")\n if not candidate:\n return fallback\n try:\n parsed = urlparse(candidate)\n except Exception:\n logger.warning(\n \"Ignoring malformed xAI base_url override %r; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if parsed.scheme != \"https\":\n logger.warning(\n \"Refusing non-HTTPS xAI base_url override %r (xai-oauth bearer would \"\n \"be sent in cleartext); falling back to %s.\",\n candidate, fallback,\n )\n return fallback\n host = (parsed.hostname or \"\").lower()\n if not host:\n logger.warning(\n \"Ignoring xAI base_url override %r with no hostname; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n logger.warning(\n \"Refusing xAI base_url override %r — host %r is not on the xAI origin \"\n \"(expected x.ai or a *.x.ai subdomain). The xai-oauth bearer is only \"\n \"valid against xAI's inference API; sending it elsewhere would leak \"\n \"the credential. Falling back to %s.\",\n candidate, host, fallback,\n )\n return fallback\n return candidate\n\n\ndef _xai_oauth_discovery(timeout_seconds: float = 15.0) -> Dict[str, str]:\n try:\n response = httpx.get(\n XAI_OAUTH_DISCOVERY_URL,\n headers={\"Accept\": \"application/json\"},\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n ) from exc\n if response.status_code != 200:\n raise AuthError(\n f\"xAI OIDC discovery returned status {response.status_code}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI OIDC discovery response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n authorization_endpoint = str(payload.get(\"authorization_endpoint\", \"\") or \"\").strip()\n token_endpoint = str(payload.get(\"token_endpoint\", \"\") or \"\").strip()\n if not authorization_endpoint or not token_endpoint:\n raise AuthError(\n \"xAI OIDC discovery response was missing required endpoints.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n _xai_validate_oauth_endpoint(authorization_endpoint, field=\"authorization_endpoint\")\n _xai_validate_oauth_endpoint(token_endpoint, field=\"token_endpoint\")\n return {\n \"authorization_endpoint\": authorization_endpoint,\n \"token_endpoint\": token_endpoint,\n }\n\n\ndef refresh_xai_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n token_endpoint: str = \"\",\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n del access_token\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"xAI OAuth is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n endpoint = token_endpoint.strip() or _xai_oauth_discovery(timeout_seconds)[\"token_endpoint\"]\n # Re-validate cached endpoints on the refresh hot path: an auth.json\n # written by an older Arcen (or hand-edited) may carry a non-xAI\n # token_endpoint that would receive every future refresh_token in\n # plaintext if we trusted it blindly. Cheap suffix check; fast-fail\n # with a clear error so the user can re-run `arcen model` to refetch.\n _xai_validate_oauth_endpoint(endpoint, field=\"token_endpoint\")\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n endpoint,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"refresh_token\": refresh_token,\n },\n )\n if response.status_code != 200:\n detail = response.text.strip()\n # ``403`` from xAI's token endpoint is almost always a tier /\n # entitlement gate (the OAuth grant exists but the account isn't\n # on the allowlist for API access). Re-running ``arcen model``\n # won't fix that — surface a separate error code so\n # ``format_auth_error`` doesn't append a misleading\n # re-authenticate hint, and point users at the ``XAI_API_KEY``\n # fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n \"xAI token refresh failed with HTTP 403.\"\n + (f\" Response: {detail}\" if detail else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Re-logging in won't\"\n \" change that; set ``XAI_API_KEY`` and switch to\"\n \" ``provider: xai`` (API-key path) if available, or\"\n \" upgrade your subscription at https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n \"xAI token refresh failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_refresh_failed\",\n relogin_required=(response.status_code in {400, 401}),\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token refresh returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token refresh response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_response\",\n relogin_required=True,\n )\n refreshed_access = str(payload.get(\"access_token\", \"\") or \"\").strip()\n if not refreshed_access:\n raise AuthError(\n \"xAI token refresh response was missing access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_missing_access_token\",\n relogin_required=True,\n )\n updated = {\n \"access_token\": refreshed_access,\n \"refresh_token\": str(payload.get(\"refresh_token\") or refresh_token).strip(),\n \"id_token\": str(payload.get(\"id_token\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n return updated\n\n\ndef _refresh_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n token_endpoint: str,\n redirect_uri: str = \"\",\n timeout_seconds: float,\n) -> Dict[str, Any]:\n refreshed = refresh_xai_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n token_endpoint=token_endpoint,\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n if refreshed.get(\"id_token\"):\n updated_tokens[\"id_token\"] = refreshed[\"id_token\"]\n if refreshed.get(\"expires_in\") is not None:\n updated_tokens[\"expires_in\"] = refreshed[\"expires_in\"]\n if refreshed.get(\"token_type\"):\n updated_tokens[\"token_type\"] = refreshed[\"token_type\"]\n _save_xai_oauth_tokens(\n updated_tokens,\n discovery={\"token_endpoint\": token_endpoint},\n redirect_uri=redirect_uri,\n last_refresh=refreshed[\"last_refresh\"],\n )\n return updated_tokens\n\n\ndef resolve_xai_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n data = _read_xai_oauth_tokens()\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_XAI_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_xai_oauth_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n if not token_endpoint:\n token_endpoint = _xai_oauth_discovery(refresh_timeout_seconds)[\"token_endpoint\"]\n try:\n tokens = _refresh_xai_oauth_tokens(\n tokens,\n token_endpoint=token_endpoint,\n redirect_uri=redirect_uri,\n timeout_seconds=refresh_timeout_seconds,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n except AuthError as exc:\n if _is_terminal_xai_oauth_refresh_error(exc):\n # Terminal failure (HTTP 400/401/403 — invalid_grant, token revoked).\n # Clear dead tokens from auth.json so subsequent sessions fail fast\n # without a network retry. Mirrors credential_pool.py quarantine.\n try:\n _q_store = _load_auth_store()\n _q_state = _load_provider_state(_q_store, \"xai-oauth\") or {}\n _q_tokens = dict(_q_state.get(\"tokens\") or {})\n _q_tokens.pop(\"access_token\", None)\n _q_tokens.pop(\"refresh_token\", None)\n _q_state[\"tokens\"] = _q_tokens\n _q_state[\"last_auth_error\"] = {\n \"provider\": \"xai-oauth\",\n \"code\": exc.code or \"xai_refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _store_provider_state(_q_store, \"xai-oauth\", _q_state, set_active=False)\n _save_auth_store(_q_store)\n except Exception as _save_exc:\n logger.debug(\n \"xAI OAuth: failed to persist quarantined state: %s\", _save_exc,\n )\n raise\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"provider\": \"xai-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"oauth_pkce\",\n }\n\n\n# =============================================================================\n# TLS verification helper\n# =============================================================================\n\ndef _default_verify() -> bool | ssl.SSLContext:\n \"\"\"Platform-aware default SSL verify for httpx clients.\n\n On macOS with Homebrew Python, the system OpenSSL cannot locate the\n system trust store and valid public certs fail verification. When\n certifi is importable we pin its bundle explicitly; elsewhere we\n defer to httpx's built-in default (certifi via its own dependency).\n Mirrors the weixin fix in 3a0ec1d93.\n \"\"\"\n if sys.platform == \"darwin\":\n try:\n import certifi\n return ssl.create_default_context(cafile=certifi.where())\n except ImportError:\n pass\n return True\n\n\ndef _resolve_verify(\n *,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n auth_state: Optional[Dict[str, Any]] = None,\n) -> bool | ssl.SSLContext:\n tls_state = auth_state.get(\"tls\") if isinstance(auth_state, dict) else {}\n tls_state = tls_state if isinstance(tls_state, dict) else {}\n\n effective_insecure = (\n is_truthy_value(insecure, default=False) if insecure is not None\n else is_truthy_value(tls_state.get(\"insecure\", False), default=False)\n )\n effective_ca = (\n ca_bundle\n or tls_state.get(\"ca_bundle\")\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n or os.getenv(\"REQUESTS_CA_BUNDLE\")\n )\n\n if effective_insecure:\n return False\n if effective_ca:\n ca_path = str(effective_ca)\n if not os.path.isfile(ca_path):\n logger.warning(\n \"CA bundle path does not exist: %s — falling back to default certificates\",\n ca_path,\n )\n return _default_verify()\n return ssl.create_default_context(cafile=ca_path)\n return _default_verify()\n\n\n# =============================================================================\n# OAuth Device Code Flow — generic, parameterized by provider\n# =============================================================================\n\ndef _request_device_code(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n scope: Optional[str],\n) -> Dict[str, Any]:\n \"\"\"POST to the device code endpoint. Returns device_code, user_code, etc.\"\"\"\n response = client.post(\n f\"{portal_base_url}/api/oauth/device/code\",\n data={\n \"client_id\": client_id,\n **({\"scope\": scope} if scope else {}),\n },\n )\n response.raise_for_status()\n data = response.json()\n\n required_fields = [\n \"device_code\", \"user_code\", \"verification_uri\",\n \"verification_uri_complete\", \"expires_in\", \"interval\",\n ]\n missing = [f for f in required_fields if f not in data]\n if missing:\n raise ValueError(f\"Device code response missing fields: {', '.join(missing)}\")\n return data\n\n\ndef _poll_for_token(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n device_code: str,\n expires_in: int,\n poll_interval: int,\n) -> Dict[str, Any]:\n \"\"\"Poll the token endpoint until the user approves or the code expires.\"\"\"\n deadline = time.monotonic() + max(1, expires_in)\n current_interval = max(1, min(poll_interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n\n while time.monotonic() < deadline:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n data={\n \"grant_type\": \"urn:ietf:params:oauth:grant-type:device_code\",\n \"client_id\": client_id,\n \"device_code\": device_code,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise ValueError(\"Token response did not include access_token\")\n return payload\n\n try:\n error_payload = response.json()\n except Exception:\n response.raise_for_status()\n raise RuntimeError(\"Token endpoint returned a non-JSON error response\")\n\n error_code = error_payload.get(\"error\", \"\")\n if error_code == \"authorization_pending\":\n time.sleep(current_interval)\n continue\n if error_code == \"slow_down\":\n current_interval = min(current_interval + 1, 30)\n time.sleep(current_interval)\n continue\n\n description = error_payload.get(\"error_description\") or \"Unknown authentication error\"\n raise RuntimeError(f\"{error_code}: {description}\")\n\n raise TimeoutError(\"Timed out waiting for device authorization\")\n\n\n# =============================================================================\n# Removed provider Portal — token refresh and model discovery\n# =============================================================================\n\n# -----------------------------------------------------------------------------\n# Shared Removed provider token store — lets OAuth credentials persist across profiles\n# so a new `arcen --profile <name> auth add removed_provider --type oauth` can one-tap\n# import instead of running the full device-code flow every time.\n#\n# File lives at ${ARCEN_SHARED_AUTH_DIR}/removed_provider_auth.json, defaulting to\n# ``<arcen-root>/shared/removed_provider_auth.json`` where ``<arcen-root>`` is what\n# ``get_default_arcen_root()`` returns — ``~/.arcen`` on Linux/macOS,\n# ``%LOCALAPPDATA%\\arcen`` on native Windows, or the Docker/custom root.\n# It is OUTSIDE any named profile's ARCEN_HOME so named profiles (which\n# typically live under ``<arcen-root>/profiles/<name>/``) all see the\n# same file.\n#\n# Written on successful login and on every runtime refresh so the stored\n# refresh_token stays current even if one profile refreshes and rotates it.\n# If ever the stored refresh_token does go stale server-side, import fails\n# gracefully and the user falls back to the normal device-code flow.\n# -----------------------------------------------------------------------------\n\nREMOVED_PROVIDER_SHARED_STORE_FILENAME = \"removed_provider_auth.json\"\n_removed_provider_shared_lock_holder = threading.local()\n\n\ndef _removed_provider_shared_auth_dir() -> Path:\n \"\"\"Resolve the directory that holds the shared Removed provider token store.\n\n Honors ``ARCEN_SHARED_AUTH_DIR`` so tests can redirect it to a tmp\n path without touching the real user's home. Defaults to\n ``<arcen-root>/shared/``, where ``<arcen-root>`` is what\n :func:`arcen_constants.get_default_arcen_root` returns — so\n Linux/macOS classic installs land at ``~/.arcen/shared/``, native\n Windows installs at ``%LOCALAPPDATA%\\\\arcen\\\\shared\\\\``, and\n Docker / custom ``ARCEN_HOME`` deployments at\n ``<ARCEN_HOME>/shared/``. Sits outside any named profile so all\n profiles under the same root share the store.\n \"\"\"\n override = os.getenv(\"ARCEN_SHARED_AUTH_DIR\", \"\").strip()\n if override:\n return Path(override).expanduser()\n from arcen_constants import get_default_arcen_root\n return get_default_arcen_root() / \"shared\"\n\n\ndef _removed_provider_shared_store_path() -> Path:\n path = _removed_provider_shared_auth_dir() / REMOVED_PROVIDER_SHARED_STORE_FILENAME\n # Seat belt: if pytest is running and this resolves to a path under the\n # real user's Arcen root, refuse rather than silently corrupt cross-profile\n # state. Tests must set ARCEN_SHARED_AUTH_DIR to a tmp_path (conftest\n # does not do this automatically — mirror the _auth_file_path() guard\n # so forgetting to set it fails loudly instead of writing to the real\n # shared store).\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n from arcen_constants import get_default_arcen_root\n real_home_shared = (\n get_default_arcen_root() / \"shared\" / REMOVED_PROVIDER_SHARED_STORE_FILENAME\n ).resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_shared:\n raise RuntimeError(\n f\"Refusing to touch real user shared Removed provider auth store during test run: \"\n f\"{path}. Set ARCEN_SHARED_AUTH_DIR to a tmp_path in your test fixture.\"\n )\n return path\n\n\n@contextmanager\ndef _removed_provider_shared_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-profile lock for the shared Removed provider OAuth store.\n\n Lock ordering invariant: if both this and ``_auth_store_lock`` need\n to be held, acquire ``_auth_store_lock`` FIRST. All runtime refresh\n paths follow this order. The one exception is\n ``_try_import_shared_removed_provider_state``, which holds this lock alone for\n the entire refresh cycle so concurrent imports on sibling profiles\n can't race on the single-use shared refresh token; that helper must\n NOT be called with ``_auth_store_lock`` already held.\n \"\"\"\n try:\n lock_path = _removed_provider_shared_store_path().with_suffix(\".lock\")\n except RuntimeError:\n # No ARCEN_HOME yet (pre-setup): fall through without locking.\n yield\n return\n\n with _file_lock(\n lock_path,\n _removed_provider_shared_lock_holder,\n timeout_seconds,\n \"Timed out waiting for shared Removed provider auth lock\",\n ):\n yield\n\n\ndef _merge_shared_removed_provider_oauth_state(state: Dict[str, Any]) -> bool:\n \"\"\"Copy fresher shared OAuth tokens into a profile-local Removed provider state.\"\"\"\n shared = _read_shared_removed_provider_state()\n if not shared:\n return False\n\n shared_refresh = shared.get(\"refresh_token\")\n if not isinstance(shared_refresh, str) or not shared_refresh.strip():\n return False\n\n local_refresh = state.get(\"refresh_token\")\n shared_access_exp = _parse_iso_timestamp(shared.get(\"expires_at\")) or 0.0\n local_access_exp = _parse_iso_timestamp(state.get(\"expires_at\")) or 0.0\n refresh_changed = shared_refresh.strip() != str(local_refresh or \"\").strip()\n fresher_access = shared_access_exp > local_access_exp\n if not refresh_changed and not fresher_access:\n return False\n\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"token_type\",\n \"scope\",\n \"client_id\",\n \"portal_base_url\",\n \"inference_base_url\",\n \"obtained_at\",\n \"expires_at\",\n ):\n value = shared.get(key)\n if value not in {None, \"\"}:\n state[key] = value\n return True\n\n\ndef _write_shared_removed_provider_state(state: Dict[str, Any]) -> None:\n \"\"\"Persist a minimal copy of the Removed provider OAuth state to the shared store.\n\n Best-effort: any failure is swallowed after logging. The shared store\n is a convenience layer; the per-profile auth.json remains the source\n of truth.\n\n We deliberately omit the runtime ``agent_key`` compatibility field;\n the OAuth tokens are the cross-profile source of truth.\n \"\"\"\n refresh_token = state.get(\"refresh_token\")\n access_token = state.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n # No refresh_token = nothing worth sharing across profiles\n return\n if not (isinstance(access_token, str) and access_token.strip()):\n return\n\n shared = {\n \"_schema\": 1,\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"token_type\": state.get(\"token_type\") or \"Bearer\",\n \"scope\": state.get(\"scope\") or DEFAULT_REMOVED_PROVIDER_SCOPE,\n \"client_id\": state.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID,\n \"portal_base_url\": state.get(\"portal_base_url\") or DEFAULT_REMOVED_PROVIDER_PORTAL_URL,\n \"inference_base_url\": state.get(\"inference_base_url\") or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL,\n \"obtained_at\": state.get(\"obtained_at\"),\n \"expires_at\": state.get(\"expires_at\"),\n \"updated_at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n with _removed_provider_shared_store_lock():\n path = _removed_provider_shared_store_path()\n path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(path)\n tmp = path.with_name(f\"{path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed Removed provider\n # refresh_token at process umask. See #19673, #21148.\n fd = os.open(\n str(tmp),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(shared, indent=2, sort_keys=True))\n fh.flush()\n os.fsync(fh.fileno())\n os.replace(tmp, path)\n finally:\n try:\n if tmp.exists():\n tmp.unlink()\n except OSError:\n pass\n _oauth_trace(\n \"removed_provider_shared_store_written\",\n path=str(path),\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n except Exception as exc:\n logger.debug(\"Failed to write shared Removed provider auth store: %s\", exc)\n\n\ndef _read_shared_removed_provider_state() -> Optional[Dict[str, Any]]:\n \"\"\"Return the shared Removed provider OAuth state if present and well-formed.\n\n Returns ``None`` when the file is missing, unreadable, malformed, or\n lacks required fields. Callers should treat ``None`` as \"no shared\n credentials available — fall through to device-code\".\n \"\"\"\n try:\n path = _removed_provider_shared_store_path()\n except RuntimeError:\n # Test seat belt tripped — treat as missing\n return None\n if not path.is_file():\n return None\n try:\n payload = json.loads(path.read_text())\n except (OSError, ValueError) as exc:\n logger.debug(\"Shared Removed provider auth store at %s is unreadable: %s\", path, exc)\n return None\n if not isinstance(payload, dict):\n return None\n refresh_token = payload.get(\"refresh_token\")\n access_token = payload.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n return None\n if not (isinstance(access_token, str) and access_token.strip()):\n return None\n return payload\n\n\ndef _clear_shared_removed_provider_state(reason: str) -> None:\n \"\"\"Remove the shared Removed provider OAuth store after a terminal token failure.\"\"\"\n try:\n with _removed_provider_shared_store_lock():\n path = _removed_provider_shared_store_path()\n try:\n path.unlink()\n except FileNotFoundError:\n pass\n _oauth_trace(\"removed_provider_shared_store_cleared\", reason=reason)\n except Exception as exc:\n logger.debug(\"Failed to clear shared Removed provider auth store: %s\", exc)\n\n\ndef _is_terminal_removed_provider_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Removed provider refresh token cannot succeed.\"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"removed_provider\"\n and exc.code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_xai_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same xAI OAuth refresh token cannot succeed.\n\n ``xai_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``xai_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"xai-oauth\"\n and exc.code in {\"xai_refresh_failed\", \"xai_auth_missing_refresh_token\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_codex_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Codex OAuth refresh token cannot succeed.\n\n ``codex_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``codex_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"openai-codex\"\n and exc.code in {\n \"codex_refresh_failed\",\n \"codex_auth_missing_refresh_token\",\n \"invalid_grant\",\n \"invalid_token\",\n \"refresh_token_reused\",\n }\n and bool(exc.relogin_required)\n )\n\n\ndef _quarantine_removed_provider_oauth_state(\n state: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> None:\n \"\"\"Keep routing metadata but remove dead OAuth material so it is not replayed.\"\"\"\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"expires_at\",\n \"expires_in\",\n \"obtained_at\",\n \"agent_key\",\n \"agent_key_id\",\n \"agent_key_expires_at\",\n \"agent_key_expires_in\",\n \"agent_key_reused\",\n \"agent_key_obtained_at\",\n ):\n state.pop(key, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"removed_provider\",\n \"code\": error.code,\n \"message\": str(error),\n \"reason\": reason,\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _clear_shared_removed_provider_state(reason)\n invalidate_removed_provider_auth_status_cache()\n\n\ndef _quarantine_removed_provider_pool_entries(\n auth_store: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> bool:\n \"\"\"Remove singleton-seeded Removed provider pool entries that contain dead OAuth state.\"\"\"\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return False\n entries = pool.get(\"removed_provider\")\n if not isinstance(entries, list):\n return False\n\n retained = []\n removed = False\n singleton_sources = {REMOVED_PROVIDER_DEVICE_CODE_SOURCE, f\"manual:{REMOVED_PROVIDER_DEVICE_CODE_SOURCE}\"}\n for entry in entries:\n if isinstance(entry, dict) and entry.get(\"source\") in singleton_sources:\n removed = True\n continue\n retained.append(entry)\n\n if removed:\n pool[\"removed_provider\"] = retained\n _oauth_trace(\n \"removed_provider_pool_device_code_quarantined\",\n reason=reason,\n error_code=error.code,\n )\n return removed\n\n\ndef _try_import_shared_removed_provider_state(\n *,\n timeout_seconds: float = 15.0,\n) -> Optional[Dict[str, Any]]:\n \"\"\"Attempt to rehydrate Removed provider OAuth state from the shared store.\n\n Reads the shared file (if present), runs a forced refresh using the\n stored refresh_token to produce a fresh inference JWT scoped to this\n profile, and returns the full auth_state dict ready\n for ``persist_removed_provider_credentials()``.\n\n Returns ``None`` when no shared state is available or the rehydrate\n fails for any reason (expired refresh_token, portal unreachable,\n etc.) — caller should then fall through to the normal device-code\n flow.\n \"\"\"\n try:\n with _removed_provider_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n shared = _read_shared_removed_provider_state()\n if not shared:\n return None\n\n # Build a full state dict so refresh_removed_provider_oauth_from_state has every\n # field it needs. force_refresh=True gets us a fresh access_token\n # for this profile.\n state: Dict[str, Any] = {\n \"access_token\": shared.get(\"access_token\"),\n \"refresh_token\": shared.get(\"refresh_token\"),\n \"client_id\": shared.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID,\n \"portal_base_url\": shared.get(\"portal_base_url\") or DEFAULT_REMOVED_PROVIDER_PORTAL_URL,\n \"inference_base_url\": shared.get(\"inference_base_url\") or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL,\n \"token_type\": shared.get(\"token_type\") or \"Bearer\",\n \"scope\": shared.get(\"scope\") or DEFAULT_REMOVED_PROVIDER_SCOPE,\n \"obtained_at\": shared.get(\"obtained_at\"),\n \"expires_at\": shared.get(\"expires_at\"),\n \"agent_key\": None,\n \"agent_key_expires_at\": None,\n \"tls\": {\"insecure\": False, \"ca_bundle\": None},\n }\n\n def _persist_shared_refresh(updated_state: Dict[str, Any], _reason: str) -> None:\n _write_shared_removed_provider_state(updated_state)\n\n refreshed = refresh_removed_provider_oauth_from_state(\n state,\n timeout_seconds=timeout_seconds,\n force_refresh=True,\n on_state_update=_persist_shared_refresh,\n )\n _write_shared_removed_provider_state(refreshed)\n except AuthError as exc:\n _oauth_trace(\n \"removed_provider_shared_import_failed\",\n error_type=type(exc).__name__,\n error_code=getattr(exc, \"code\", None),\n )\n if _is_terminal_removed_provider_refresh_error(exc):\n _clear_shared_removed_provider_state(\"shared_import_terminal_refresh_failure\")\n logger.debug(\"Shared Removed provider import failed: %s\", exc)\n return None\n except Exception as exc:\n _oauth_trace(\n \"removed_provider_shared_import_failed\",\n error_type=type(exc).__name__,\n )\n logger.debug(\"Shared Removed provider import failed: %s\", exc)\n return None\n\n return refreshed\n\n\ndef _refresh_access_token(\n *,\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n refresh_token: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n headers={\"x-removed_provider-refresh-token\": refresh_token},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": client_id,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise AuthError(\"Refresh response missing access_token\",\n provider=\"removed_provider\", code=\"invalid_token\", relogin_required=True)\n return payload\n\n try:\n error_payload = response.json()\n except Exception as exc:\n raise AuthError(\"Refresh token exchange failed\",\n provider=\"removed_provider\", relogin_required=True) from exc\n\n code = str(error_payload.get(\"error\", \"invalid_grant\"))\n description = str(error_payload.get(\"error_description\") or \"Refresh token exchange failed\")\n relogin = code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n\n # Detect the OAuth 2.1 \"refresh token reuse\" signal from the Removed provider portal\n # server and surface an actionable message. This fires when an external\n # process (health-check script, monitoring tool, custom self-heal hook)\n # called POST /api/oauth/token with Arcen's refresh_token without\n # persisting the rotated token back to auth.json — the server then\n # retires the original RT, Arcen's next refresh uses it, and the whole\n # session chain gets revoked as a token-theft signal (#15099).\n lowered = description.lower()\n if code == \"refresh_token_reused\" or \"reuse\" in lowered or \"reuse detected\" in lowered:\n description = (\n \"Removed provider Portal detected refresh-token reuse and revoked this session.\\n\"\n \"This usually means an external process (monitoring script, \"\n \"custom self-heal hook, or another Arcen install sharing \"\n \"~/.arcen/auth.json) called POST /api/oauth/token with Arcen's \"\n \"refresh token without persisting the rotated token back.\\n\"\n \"Removed provider refresh tokens are single-use — only Arcen may call the \"\n \"refresh endpoint. For health checks, use `arcen auth status` \"\n \"instead.\\n\"\n \"Re-authenticate with: arcen auth add removed_provider\"\n )\n relogin = True\n\n raise AuthError(description, provider=\"removed_provider\", code=code, relogin_required=relogin)\n\n\ndef fetch_removed_provider_models(\n *,\n inference_base_url: str,\n api_key: str,\n timeout_seconds: float = 15.0,\n verify: bool | str = True,\n) -> List[str]:\n \"\"\"Fetch available model IDs from the Removed provider inference API.\"\"\"\n timeout = httpx.Timeout(timeout_seconds)\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n response = client.get(\n f\"{inference_base_url.rstrip('/')}/models\",\n headers={\"Authorization\": f\"Bearer {api_key}\"},\n )\n\n if response.status_code != 200:\n description = f\"/models request failed with status {response.status_code}\"\n try:\n err = response.json()\n description = str(err.get(\"error_description\") or err.get(\"error\") or description)\n except Exception as e:\n logger.debug(\"Could not parse error response JSON: %s\", e)\n raise AuthError(description, provider=\"removed_provider\", code=\"models_fetch_failed\")\n\n payload = response.json()\n data = payload.get(\"data\")\n if not isinstance(data, list):\n return []\n\n model_ids: List[str] = []\n for item in data:\n if not isinstance(item, dict):\n continue\n model_id = item.get(\"id\")\n if isinstance(model_id, str) and model_id.strip():\n mid = model_id.strip()\n # Skip Arcen models — they're not reliable for agentic tool-calling\n if \"arcen\" in mid.lower():\n continue\n model_ids.append(mid)\n\n # Sort: prefer opus > pro > haiku/flash > sonnet (sonnet is cheap/fast,\n # users who want the best model should see opus first).\n def _model_priority(mid: str) -> tuple:\n low = mid.lower()\n if \"opus\" in low:\n return (0, mid)\n if \"pro\" in low and \"sonnet\" not in low:\n return (1, mid)\n if \"sonnet\" in low:\n return (3, mid)\n return (2, mid)\n\n model_ids.sort(key=_model_priority)\n return list(dict.fromkeys(model_ids))\n\n\ndef _agent_key_is_usable(state: Dict[str, Any], min_ttl_seconds: int) -> bool:\n key = state.get(\"agent_key\")\n if not isinstance(key, str) or not key.strip():\n return False\n return _removed_provider_invoke_jwt_is_usable(\n key,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"agent_key_expires_at\"),\n min_ttl_seconds=max(0, int(min_ttl_seconds)),\n )\n\n\ndef resolve_removed_provider_access_token(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n refresh_skew_seconds: int = ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> str:\n \"\"\"Resolve a refresh-aware Removed provider Portal access token for managed tool gateways.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"removed_provider\")\n\n if not state:\n raise AuthError(\n \"Arcen is not logged into Removed provider Portal.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"REMOVED_PROVIDER_PORTAL_BASE_URL\")\n or DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID)\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n\n with _removed_provider_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n merged_shared = _merge_shared_removed_provider_oauth_state(state)\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\n \"No access token found for Removed provider Portal login.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n\n if not _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds):\n if merged_shared:\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n return access_token\n\n if not isinstance(refresh_token, str) or not refresh_token:\n raise AuthError(\n \"Session expired and no refresh token is available.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n with httpx.Client(\n timeout=timeout,\n headers={\"Accept\": \"application/json\"},\n verify=verify,\n ) as client:\n try:\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_removed_provider_refresh_error(exc):\n _quarantine_removed_provider_oauth_state(\n state,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _quarantine_removed_provider_pool_entries(\n auth_store,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n raise\n\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl,\n tz=timezone.utc,\n ).isoformat()\n state[\"portal_base_url\"] = portal_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n _write_shared_removed_provider_state(state)\n return state[\"access_token\"]\n\n\ndef refresh_removed_provider_oauth_pure(\n access_token: str,\n refresh_token: str,\n client_id: str,\n portal_base_url: str,\n inference_base_url: str,\n *,\n token_type: str = \"Bearer\",\n scope: str = DEFAULT_REMOVED_PROVIDER_SCOPE,\n obtained_at: Optional[str] = None,\n expires_at: Optional[str] = None,\n agent_key: Optional[str] = None,\n agent_key_expires_at: Optional[str] = None,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Removed provider OAuth state without mutating auth.json directly.\n\n ``on_state_update`` is called after a successful access-token refresh.\n Callers that own persistent state can use it to save the newly rotated\n refresh token before later validation can fail.\n \"\"\"\n state: Dict[str, Any] = {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"client_id\": client_id or DEFAULT_REMOVED_PROVIDER_CLIENT_ID,\n \"portal_base_url\": (portal_base_url or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\"),\n \"inference_base_url\": (inference_base_url or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL).rstrip(\"/\"),\n \"token_type\": token_type or \"Bearer\",\n \"scope\": scope or DEFAULT_REMOVED_PROVIDER_SCOPE,\n \"obtained_at\": obtained_at,\n \"expires_at\": expires_at,\n \"agent_key\": agent_key,\n \"agent_key_expires_at\": agent_key_expires_at,\n \"tls\": {\n \"insecure\": bool(insecure),\n \"ca_bundle\": ca_bundle,\n },\n }\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n current_invoke_jwt_status = _removed_provider_invoke_jwt_status(\n state.get(\"access_token\"),\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or current_invoke_jwt_status is not None:\n refresh_token_value = state.get(\"refresh_token\")\n if not isinstance(refresh_token_value, str) or not refresh_token_value:\n if current_invoke_jwt_status is not None:\n raise AuthError(\n \"Removed provider Portal access token is not a usable inference JWT \"\n f\"({current_invoke_jwt_status}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add removed_provider\",\n provider=\"removed_provider\",\n code=current_invoke_jwt_status,\n relogin_required=True,\n )\n raise AuthError(\n \"No refresh token is available for Removed provider Portal.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=state[\"portal_base_url\"],\n client_id=state[\"client_id\"],\n refresh_token=refresh_token_value,\n )\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token_value\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_removed_provider_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n state[\"inference_base_url\"] = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n if on_state_update is not None:\n on_state_update(dict(state), \"post_refresh_access_token\")\n\n _assert_removed_provider_inference_jwt_usable(state)\n _select_removed_provider_invoke_jwt(state)\n\n return state\n\n\ndef refresh_removed_provider_oauth_from_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 15.0,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Removed provider OAuth from a state dict. Thin wrapper around refresh_removed_provider_oauth_pure.\"\"\"\n tls = state.get(\"tls\") or {}\n return refresh_removed_provider_oauth_pure(\n state.get(\"access_token\", \"\"),\n state.get(\"refresh_token\", \"\"),\n state.get(\"client_id\", \"arcen-cli\"),\n state.get(\"portal_base_url\", DEFAULT_REMOVED_PROVIDER_PORTAL_URL),\n state.get(\"inference_base_url\", DEFAULT_REMOVED_PROVIDER_INFERENCE_URL),\n token_type=state.get(\"token_type\", \"Bearer\"),\n scope=state.get(\"scope\", DEFAULT_REMOVED_PROVIDER_SCOPE),\n obtained_at=state.get(\"obtained_at\"),\n expires_at=state.get(\"expires_at\"),\n agent_key=state.get(\"agent_key\"),\n agent_key_expires_at=state.get(\"agent_key_expires_at\"),\n timeout_seconds=timeout_seconds,\n insecure=tls.get(\"insecure\"),\n ca_bundle=tls.get(\"ca_bundle\"),\n force_refresh=force_refresh,\n on_state_update=on_state_update,\n )\n\n\ndef persist_removed_provider_credentials(\n creds: Dict[str, Any],\n *,\n label: Optional[str] = None,\n):\n \"\"\"Persist Removed provider OAuth credentials as the singleton provider state\n and ensure the credential pool is in sync.\n\n Removed provider credentials are read at runtime from two independent locations:\n\n - ``providers.removed_provider``: singleton state read by\n ``resolve_removed_provider_runtime_credentials()`` during 401 recovery and by\n ``_seed_from_singletons()`` during pool load.\n - ``credential_pool.removed_provider``: used by the runtime ``pool.select()`` path.\n\n Historically ``arcen auth add removed_provider`` wrote a ``manual:device_code`` pool\n entry only, skipping ``providers.removed_provider``. When the runtime credential\n expired, the recovery path read the empty singleton state and raised\n ``AuthError`` silently (``logger.debug`` at INFO level).\n\n This helper writes ``providers.removed_provider`` then calls ``load_pool(\"removed_provider\")`` so\n ``_seed_from_singletons`` materialises the canonical ``device_code`` pool\n entry from the singleton. Re-running login upserts the same entry in\n place; the pool never accumulates duplicate device_code rows.\n\n ``label`` is an optional user-chosen display name (from\n ``arcen auth add removed_provider --label <name>``). It gets embedded in the\n singleton state so that ``_seed_from_singletons`` uses it as the pool\n entry's label on every subsequent ``load_pool(\"removed_provider\")`` instead of the\n auto-derived token fingerprint. When ``None``, the auto-derived label\n via ``label_from_token`` is used (unchanged default behaviour).\n\n Returns the upserted :class:`PooledCredential` entry (or ``None`` if\n seeding somehow produced no match — shouldn't happen).\n \"\"\"\n from agent.credential_pool import load_pool\n\n state = dict(creds)\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n\n # Mirror to the shared store so a new profile can one-tap import\n # these credentials via `arcen auth add removed_provider --type oauth`. Best-\n # effort: any I/O failure is logged and swallowed (the per-profile\n # auth.json is still the source of truth).\n _write_shared_removed_provider_state(state)\n\n pool = load_pool(\"removed_provider\")\n return next(\n (e for e in pool.entries() if e.source == REMOVED_PROVIDER_DEVICE_CODE_SOURCE),\n None,\n )\n\n\ndef _sync_removed_provider_pool_from_auth_store() -> None:\n \"\"\"Best-effort pool reseed after providers.removed_provider changes; never fail login.\"\"\"\n try:\n from agent.credential_pool import load_pool\n\n load_pool(\"removed_provider\")\n except Exception as exc:\n logger.debug(\"Failed to sync Removed provider credential pool from auth store: %s\", exc)\n\n\ndef resolve_removed_provider_runtime_credentials(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"\n Resolve Removed provider inference credentials for runtime use.\n\n Ensures access_token is a valid inference-scoped JWT, refreshing it when\n needed. Concurrent processes coordinate through the auth store file lock.\n\n Returns dict with: provider, base_url, api_key, key_id, expires_at,\n expires_in, source (\"invoke_jwt\"), and auth_path.\n \"\"\"\n sequence_id = uuid.uuid4().hex[:12]\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"removed_provider\")\n\n if not state:\n raise AuthError(\"Arcen is not logged into Removed provider Portal.\",\n provider=\"removed_provider\", relogin_required=True)\n\n persisted_state = dict(state)\n state_persisted = False\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"REMOVED_PROVIDER_PORTAL_BASE_URL\")\n or DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n ).rstrip(\"/\")\n inference_base_url = (\n _optional_base_url(state.get(\"inference_base_url\"))\n or os.getenv(\"REMOVED_PROVIDER_INFERENCE_BASE_URL\")\n or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID)\n\n def _persist_state(reason: str) -> None:\n nonlocal persisted_state, state_persisted\n # Skip writes where only derived TTL countdowns changed; this keeps\n # the mtime-keyed Removed provider auth-status cache warm during read paths.\n if (\n _removed_provider_effective_provider_state(state)\n == _removed_provider_effective_provider_state(persisted_state)\n ):\n _oauth_trace(\n \"removed_provider_state_persist_skipped\",\n sequence_id=sequence_id,\n reason=reason,\n )\n return\n try:\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n except Exception as exc:\n _oauth_trace(\n \"removed_provider_state_persist_failed\",\n sequence_id=sequence_id,\n reason=reason,\n error_type=type(exc).__name__,\n )\n raise\n _oauth_trace(\n \"removed_provider_state_persisted\",\n sequence_id=sequence_id,\n reason=reason,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n access_token_fp=_token_fingerprint(state.get(\"access_token\")),\n )\n persisted_state = dict(state)\n state_persisted = True\n # Mirror post-refresh state to the shared store so sibling\n # profiles don't hold stale refresh_tokens after rotation.\n # Best-effort — any failure is logged and swallowed inside\n # _write_shared_removed_provider_state.\n _write_shared_removed_provider_state(state)\n\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n _oauth_trace(\n \"removed_provider_runtime_credentials_start\",\n sequence_id=sequence_id,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n )\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\"No access token found for Removed provider Portal login.\",\n provider=\"removed_provider\", relogin_required=True)\n\n invoke_jwt_status = _removed_provider_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or invoke_jwt_status is not None:\n with _removed_provider_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n if _merge_shared_removed_provider_oauth_state(state):\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n invoke_jwt_status = _removed_provider_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n _persist_state(\"post_shared_merge_access_unusable\")\n\n if force_refresh or invoke_jwt_status is not None:\n if not isinstance(refresh_token, str) or not refresh_token:\n reason = invoke_jwt_status or \"force_refresh\"\n raise AuthError(\n \"Removed provider Portal access token is not a usable inference JWT \"\n f\"({reason}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add removed_provider\",\n provider=\"removed_provider\",\n code=reason,\n relogin_required=True,\n )\n\n refresh_reason = \"force_refresh\" if force_refresh else (invoke_jwt_status or \"access_unusable\")\n _oauth_trace(\n \"refresh_start\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n try:\n refreshed = _refresh_access_token(\n client=client, portal_base_url=portal_base_url,\n client_id=client_id, refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_removed_provider_refresh_error(exc):\n _quarantine_removed_provider_oauth_state(\n state,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _quarantine_removed_provider_pool_entries(\n auth_store,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _persist_state(\"terminal_runtime_access_refresh_failure\")\n raise\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n previous_refresh_token = refresh_token\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_removed_provider_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n inference_base_url = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n access_token = state[\"access_token\"]\n refresh_token = state[\"refresh_token\"]\n _oauth_trace(\n \"refresh_success\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n previous_refresh_token_fp=_token_fingerprint(previous_refresh_token),\n new_refresh_token_fp=_token_fingerprint(refresh_token),\n )\n # Persist immediately so validation failures cannot drop rotated refresh tokens.\n _persist_state(\"post_refresh_access_token\")\n\n _assert_removed_provider_inference_jwt_usable(\n state,\n access_token=access_token,\n )\n _select_removed_provider_invoke_jwt(\n state,\n access_token=access_token,\n sequence_id=sequence_id,\n )\n\n # Persist routing and TLS metadata for non-interactive refresh.\n state[\"portal_base_url\"] = portal_base_url\n state[\"inference_base_url\"] = inference_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n\n _persist_state(\"resolve_removed_provider_runtime_credentials_final\")\n\n if state_persisted:\n _sync_removed_provider_pool_from_auth_store()\n\n api_key = state.get(\"agent_key\")\n if not isinstance(api_key, str) or not api_key:\n raise AuthError(\"Failed to resolve a Removed provider inference API key\",\n provider=\"removed_provider\", code=\"server_error\")\n\n expires_at = state.get(\"agent_key_expires_at\")\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"agent_key_expires_in\"))\n )\n\n return {\n \"provider\": \"removed_provider\",\n \"base_url\": inference_base_url,\n \"api_key\": api_key,\n \"key_id\": state.get(\"agent_key_id\"),\n \"expires_at\": expires_at,\n \"expires_in\": expires_in,\n \"source\": REMOVED_PROVIDER_AUTH_PATH_INVOKE_JWT,\n \"auth_path\": REMOVED_PROVIDER_AUTH_PATH_INVOKE_JWT,\n }\n\n\n# =============================================================================\n# Status helpers\n# =============================================================================\n\ndef _empty_removed_provider_auth_status() -> Dict[str, Any]:\n return {\n \"logged_in\": False,\n \"portal_base_url\": None,\n \"inference_base_url\": None,\n \"access_expires_at\": None,\n \"agent_key_expires_at\": None,\n \"has_refresh_token\": False,\n \"inference_credential_present\": False,\n \"credential_source\": None,\n }\n\n\ndef _snapshot_removed_provider_pool_status() -> Dict[str, Any]:\n \"\"\"Best-effort status from the credential pool.\n\n This is a fallback only. The auth-store provider state is the runtime source\n of truth because it is what ``resolve_removed_provider_runtime_credentials()`` refreshes.\n \"\"\"\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"removed_provider\")\n if not pool or not pool.has_credentials():\n return _empty_removed_provider_auth_status()\n\n entries = list(pool.entries())\n if not entries:\n return _empty_removed_provider_auth_status()\n\n def _entry_sort_key(entry: Any) -> tuple[float, float, int]:\n agent_exp = _parse_iso_timestamp(getattr(entry, \"agent_key_expires_at\", None)) or 0.0\n access_exp = _parse_iso_timestamp(getattr(entry, \"expires_at\", None)) or 0.0\n priority = int(getattr(entry, \"priority\", 0) or 0)\n return (agent_exp, access_exp, -priority)\n\n entry = max(entries, key=_entry_sort_key)\n runtime_key = getattr(entry, \"runtime_api_key\", None)\n if not runtime_key:\n return _empty_removed_provider_auth_status()\n access_token = getattr(entry, \"access_token\", None)\n auth_type = str(getattr(entry, \"auth_type\", \"\") or \"\").strip().lower()\n refresh_token = getattr(entry, \"refresh_token\", None)\n is_portal_oauth = bool(access_token) and (\n auth_type.startswith(\"oauth\") or bool(refresh_token)\n )\n label = getattr(entry, \"label\", \"unknown\")\n portal_status_url = None\n if is_portal_oauth:\n portal_status_url = (\n getattr(entry, \"portal_base_url\", None)\n or DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n )\n\n return {\n \"logged_in\": is_portal_oauth,\n \"portal_base_url\": portal_status_url,\n \"inference_base_url\": getattr(entry, \"inference_base_url\", None)\n or getattr(entry, \"runtime_base_url\", None)\n or getattr(entry, \"base_url\", None),\n \"access_token\": access_token if is_portal_oauth else None,\n \"access_expires_at\": getattr(entry, \"expires_at\", None),\n \"agent_key_expires_at\": getattr(entry, \"agent_key_expires_at\", None),\n \"has_refresh_token\": bool(refresh_token),\n \"inference_credential_present\": True,\n \"credential_source\": f\"pool:{label}\",\n \"source\": f\"pool:{label}\",\n }\n except Exception:\n return _empty_removed_provider_auth_status()\n\n\n# ── Process-level memo for get_removed_provider_auth_status() ──\n# get_removed_provider_auth_status() validates state by calling resolve_removed_provider_runtime_credentials(),\n# which does a synchroremoved_provider OAuth refresh POST to . That can take\n# ~350ms even on the failure path, and read-only UI surfaces (`arcen tools`, status panels,\n# subscription-feature checks) call it many times per render — `arcen tools` → \"All Platforms\"\n# was firing the refresh ~31× during one menu paint, racking up >13s of HTTP and burning\n# single-use refresh tokens. Cache the snapshot for a few seconds, keyed on the auth.json\n# mtime so that `arcen auth login/logout/add/remove` invalidate naturally on the next call.\n_REMOVED_PROVIDER_AUTH_STATUS_CACHE_TTL = 15.0 # seconds\n_removed_provider_auth_status_cache: Optional[Tuple[float, Optional[float], Dict[str, Any]]] = None\n\n\ndef _auth_file_mtime() -> Optional[float]:\n try:\n return _auth_file_path().stat().st_mtime\n except FileNotFoundError:\n return None\n except Exception:\n return None\n\n\ndef invalidate_removed_provider_auth_status_cache() -> None:\n \"\"\"Clear the get_removed_provider_auth_status() process-level memo.\n\n Call this from any code path that mutates Removed provider auth state without going\n through resolve_removed_provider_runtime_credentials() (e.g. tests). Login/logout\n flows touch auth.json, so the mtime check below invalidates them\n automatically — explicit invalidation is the belt-and-braces option.\n \"\"\"\n global _removed_provider_auth_status_cache\n _removed_provider_auth_status_cache = None\n\n\ndef get_removed_provider_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Removed provider auth.\n\n Prefer the auth-store provider state, because that is the live source of\n truth for refresh operations. When provider state exists, validate it\n by resolving runtime credentials so revoked refresh sessions do not show up\n as a healthy login. If provider state is absent, fall back to the credential\n pool for the just-logged-in / not-yet-promoted case.\n\n The returned snapshot is memoised for ~15s keyed on the auth.json mtime,\n so menu/status surfaces that ask repeatedly don't trigger one refresh POST\n per call. Login/logout flows write to auth.json and therefore invalidate\n the cache automatically; tests can also call\n ``invalidate_removed_provider_auth_status_cache()`` explicitly.\n \"\"\"\n global _removed_provider_auth_status_cache\n now = time.monotonic()\n mtime = _auth_file_mtime()\n cached = _removed_provider_auth_status_cache\n if cached is not None:\n cached_at, cached_mtime, cached_status = cached\n if (\n cached_mtime == mtime\n and (now - cached_at) < _REMOVED_PROVIDER_AUTH_STATUS_CACHE_TTL\n ):\n return dict(cached_status)\n\n status = _compute_removed_provider_auth_status()\n _removed_provider_auth_status_cache = (now, mtime, dict(status))\n return status\n\n\ndef _compute_removed_provider_auth_status() -> Dict[str, Any]:\n \"\"\"Uncached implementation of get_removed_provider_auth_status(). See that function.\"\"\"\n state = get_provider_auth_state(\"removed_provider\")\n if state:\n base_status = {\n \"logged_in\": bool(state.get(\"access_token\")),\n \"portal_base_url\": state.get(\"portal_base_url\"),\n \"inference_base_url\": state.get(\"inference_base_url\"),\n \"access_expires_at\": state.get(\"expires_at\"),\n \"agent_key_expires_at\": state.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(state.get(\"refresh_token\")),\n \"access_token\": state.get(\"access_token\"),\n \"inference_credential_present\": bool(\n state.get(\"access_token\") or state.get(\"agent_key\")\n ),\n \"credential_source\": \"auth_store\",\n \"source\": \"auth_store\",\n }\n try:\n creds = resolve_removed_provider_runtime_credentials()\n refreshed_state = get_provider_auth_state(\"removed_provider\") or state\n base_status.update(\n {\n \"logged_in\": True,\n \"portal_base_url\": refreshed_state.get(\"portal_base_url\") or base_status.get(\"portal_base_url\"),\n \"inference_base_url\": creds.get(\"base_url\")\n or refreshed_state.get(\"inference_base_url\")\n or base_status.get(\"inference_base_url\"),\n \"access_expires_at\": refreshed_state.get(\"expires_at\") or base_status.get(\"access_expires_at\"),\n \"agent_key_expires_at\": creds.get(\"expires_at\")\n or refreshed_state.get(\"agent_key_expires_at\")\n or base_status.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(refreshed_state.get(\"refresh_token\")),\n \"inference_credential_present\": True,\n \"credential_source\": \"auth_store\",\n \"source\": f\"runtime:{creds.get('source', 'portal')}\",\n \"key_id\": creds.get(\"key_id\"),\n }\n )\n return base_status\n except AuthError as exc:\n base_status.update({\n \"logged_in\": False,\n \"error\": str(exc),\n \"relogin_required\": bool(getattr(exc, \"relogin_required\", False)),\n \"error_code\": getattr(exc, \"code\", None),\n })\n return base_status\n\n return _snapshot_removed_provider_pool_status()\n\n\ndef get_codex_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Codex auth.\n \n Checks the credential pool first (where `arcen auth` stores credentials),\n then falls back to the legacy provider state.\n \"\"\"\n # Check credential pool first — this is where `arcen auth` and\n # `arcen model` store device_code tokens.\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(\"openai-codex\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _codex_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"chatgpt\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n # Fall back to legacy provider state\n try:\n creds = resolve_codex_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_xai_oauth_auth_status() -> Dict[str, Any]:\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"xai-oauth\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _xai_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"oauth_pkce\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n try:\n creds = resolve_xai_oauth_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_api_key_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for API-key providers (z.ai, Kimi, MiniMax).\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n return {\"configured\": False}\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"configured\": bool(api_key),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"key_source\": key_source,\n \"base_url\": base_url,\n \"logged_in\": bool(api_key), # compat with OAuth status shape\n }\n\n\ndef get_external_process_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for providers that run a local subprocess.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n return {\"configured\": False}\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n resolved_command = shutil.which(command) if command else None\n return {\n \"configured\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"command\": command,\n \"args\": args,\n \"resolved_command\": resolved_command,\n \"base_url\": base_url,\n \"logged_in\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n }\n\n\ndef get_auth_status(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Generic auth status dispatcher.\"\"\"\n target = (provider_id or get_active_provider() or \"\").strip().lower()\n if not target:\n return {\"logged_in\": False}\n if target == \"spotify\":\n return get_spotify_auth_status()\n if target == \"openai-codex\":\n return get_codex_auth_status()\n if target == \"xai-oauth\":\n return get_xai_oauth_auth_status()\n if target == \"qwen-oauth\":\n return get_qwen_auth_status()\n if target == \"google-gemini-cli\":\n return get_gemini_oauth_auth_status()\n if target == \"minimax-oauth\":\n return get_minimax_oauth_auth_status()\n if target == \"copilot-acp\":\n return get_external_process_provider_status(target)\n if target == \"azure-foundry\":\n return _get_azure_foundry_auth_status()\n # API-key providers\n pconfig = PROVIDER_REGISTRY.get(target)\n if pconfig and pconfig.auth_type == \"api_key\":\n return get_api_key_provider_status(target)\n # AWS SDK providers (Bedrock) — check via boto3 credential chain\n if pconfig and pconfig.auth_type == \"aws_sdk\":\n try:\n from agent.bedrock_adapter import has_aws_credentials\n return {\"logged_in\": has_aws_credentials(), \"provider\": target}\n except ImportError:\n return {\"logged_in\": False, \"provider\": target, \"error\": \"boto3 not installed\"}\n return {\"logged_in\": False}\n\n\ndef _get_azure_foundry_auth_status() -> Dict[str, Any]:\n \"\"\"Return structural auth status for Azure Foundry.\n\n ``logged_in`` is structural, matching other non-OAuth provider status\n checks:\n\n * ``auth_mode == \"entra_id\"`` AND ``azure-identity`` is importable\n (we do NOT mint a token here; ``arcen doctor`` runs the live\n probe and reports whether the credential chain can acquire one).\n * ``auth_mode == \"api_key\"`` (default) AND ``AZURE_FOUNDRY_API_KEY``\n is set with a usable value.\n\n Never invokes the Entra credential chain — keeps CLI startup latency\n flat regardless of token-service / az login state.\n \"\"\"\n info: Dict[str, Any] = {\"provider\": \"azure-foundry\"}\n try:\n from arcen_cli.config import load_config, get_env_value\n cfg = load_config()\n except Exception:\n cfg = {}\n\n model_cfg = cfg.get(\"model\") if isinstance(cfg, dict) else None\n auth_mode = \"api_key\"\n base_url = \"\"\n if isinstance(model_cfg, dict):\n auth_mode = str(model_cfg.get(\"auth_mode\") or \"api_key\").strip().lower() or \"api_key\"\n base_url = str(model_cfg.get(\"base_url\") or \"\").strip()\n info[\"auth_mode\"] = auth_mode\n info[\"base_url\"] = base_url\n\n if auth_mode == \"entra_id\":\n try:\n from agent.azure_identity_adapter import (\n EntraIdentityConfig,\n SCOPE_AI_AZURE_DEFAULT,\n has_azure_identity_installed,\n )\n installed = has_azure_identity_installed()\n entra_cfg = {}\n if isinstance(model_cfg, dict) and isinstance(model_cfg.get(\"entra\"), dict):\n entra_cfg = model_cfg[\"entra\"]\n identity_config = EntraIdentityConfig.from_dict(\n entra_cfg,\n default_scope=SCOPE_AI_AZURE_DEFAULT,\n )\n info[\"azure_identity_installed\"] = installed\n info[\"scope\"] = identity_config.scope\n info[\"credential_probe\"] = \"not_run\"\n info[\"credential_verified\"] = False\n info[\"logged_in\"] = bool(installed)\n if not installed:\n info[\"hint\"] = (\n \"azure-identity not installed. Install with: \"\n \"pip install azure-identity (or rely on Arcen' \"\n \"lazy-install at first use).\"\n )\n else:\n info[\"hint\"] = (\n \"azure-identity is installed; live credential validation \"\n \"is skipped here. Run `arcen doctor` to verify token acquisition.\"\n )\n return info\n except Exception as exc:\n info[\"logged_in\"] = False\n info[\"error\"] = f\"azure-identity check failed: {exc}\"\n return info\n\n # api_key mode (default)\n try:\n api_key = get_env_value(\"AZURE_FOUNDRY_API_KEY\") or os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n except Exception:\n api_key = os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n info[\"logged_in\"] = has_usable_secret(api_key)\n return info\n\n\ndef resolve_api_key_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve API key and base URL for an API-key provider.\n\n Returns dict with: provider, api_key, base_url, source.\n \"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an API-key provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n # No-auth LM Studio: substitute a placeholder so runtime / auxiliary_client\n # see the local server as configured. doctor still reports unconfigured\n # because get_api_key_provider_status uses the raw secret resolver.\n if not api_key and provider_id == \"lmstudio\":\n api_key = LMSTUDIO_NOAUTH_PLACEHOLDER\n key_source = key_source or \"default\"\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif provider_id == \"zai\":\n base_url = _resolve_zai_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url.rstrip(\"/\")\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"provider\": provider_id,\n \"api_key\": api_key,\n \"base_url\": base_url.rstrip(\"/\"),\n \"source\": key_source or \"default\",\n }\n\n\ndef resolve_external_process_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve runtime details for local subprocess-backed providers.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an external-process provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n resolved_command = shutil.which(command) if command else None\n if not resolved_command and not base_url.startswith(\"acp+tcp://\"):\n raise AuthError(\n f\"Could not find the Copilot CLI command '{command}'. \"\n \"Install GitHub Copilot CLI or set ARCEN_COPILOT_ACP_COMMAND/COPILOT_CLI_PATH.\",\n provider=provider_id,\n code=\"missing_copilot_cli\",\n )\n\n return {\n \"provider\": provider_id,\n \"api_key\": \"copilot-acp\",\n \"base_url\": base_url.rstrip(\"/\"),\n \"command\": resolved_command or command,\n \"args\": args,\n \"source\": \"process\",\n }\n\n\n# =============================================================================\n# CLI Commands — login / logout\n# =============================================================================\n\ndef _update_config_for_provider(\n provider_id: str,\n inference_base_url: str,\n default_model: Optional[str] = None,\n) -> Path:\n \"\"\"Update config.yaml and auth.json to reflect the active provider.\n\n When *default_model* is provided the function also writes it as the\n ``model.default`` value. This prevents a race condition where the\n gateway (which re-reads config per-message) picks up the new provider\n before the caller has finished model selection, resulting in a\n mismatched model/provider (e.g. ``anthropic/claude-opus-4.6`` sent to\n MiniMax's API).\n \"\"\"\n # Set active_provider in auth.json so auto-resolution picks this provider\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = provider_id\n _save_auth_store(auth_store)\n\n # Update config.yaml model section\n config_path = get_config_path()\n config_path.parent.mkdir(parents=True, exist_ok=True)\n\n config = read_raw_config()\n\n current_model = config.get(\"model\")\n if isinstance(current_model, dict):\n model_cfg = dict(current_model)\n elif isinstance(current_model, str) and current_model.strip():\n model_cfg = {\"default\": current_model.strip()}\n else:\n model_cfg = {}\n\n model_cfg[\"provider\"] = provider_id\n if inference_base_url and inference_base_url.strip():\n model_cfg[\"base_url\"] = inference_base_url.rstrip(\"/\")\n else:\n # Clear stale base_url to prevent contamination when switching providers\n model_cfg.pop(\"base_url\", None)\n\n # Clear stale api_key/api_mode left over from a previous custom provider.\n # When the user switches from e.g. a MiniMax custom endpoint\n # (api_mode=anthropic_messages, api_key=mxp-...) to a built-in provider\n # (e.g. OpenRouter), the stale api_key/api_mode would override the new\n # provider's credentials and transport choice. Built-in providers that\n # need a specific api_mode (copilot, xai) set it at request-resolution\n # time via `_copilot_runtime_api_mode` / `_detect_api_mode_for_url`, so\n # removing the persisted value here is safe.\n model_cfg.pop(\"api_key\", None)\n model_cfg.pop(\"api_mode\", None)\n\n # When switching to a non-OpenRouter provider, ensure model.default is\n # valid for the new provider. An OpenRouter-formatted name like\n # \"anthropic/claude-opus-4.6\" will fail on direct-API providers.\n if default_model:\n cur_default = model_cfg.get(\"default\", \"\")\n if not cur_default or \"/\" in cur_default:\n model_cfg[\"default\"] = default_model\n\n config[\"model\"] = model_cfg\n\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _get_config_provider() -> Optional[str]:\n \"\"\"Return model.provider from config.yaml, normalized, if present.\"\"\"\n try:\n config = read_raw_config()\n except Exception:\n return None\n if not config:\n return None\n model = config.get(\"model\")\n if not isinstance(model, dict):\n return None\n provider = model.get(\"provider\")\n if not isinstance(provider, str):\n return None\n provider = provider.strip().lower()\n return provider or None\n\n\ndef _config_provider_matches(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when config.yaml currently selects *provider_id*.\"\"\"\n if not provider_id:\n return False\n return _get_config_provider() == provider_id.strip().lower()\n\n\ndef _should_reset_config_provider_on_logout(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when logout should reset the model provider config.\"\"\"\n if not provider_id:\n return False\n normalized = provider_id.strip().lower()\n return normalized in PROVIDER_REGISTRY and _config_provider_matches(normalized)\n\n\ndef _logout_default_provider_from_config() -> Optional[str]:\n \"\"\"Fallback logout target when auth.json has no active provider.\n\n `arcen logout` historically keyed off auth.json.active_provider only.\n That left users stuck when auth state had already been cleared but\n config.yaml still selected an OAuth provider such as openai-codex for the\n agent model: there was no active auth provider to target, so logout printed\n \"No provider is currently logged in\" and never reset model.provider.\n \"\"\"\n provider = _get_config_provider()\n if provider in {\"openai-codex\", \"xai-oauth\"}:\n return provider\n return None\n\n\ndef _reset_config_provider() -> Path:\n \"\"\"Reset config.yaml provider back to auto after logout.\"\"\"\n config_path = get_config_path()\n if not config_path.exists():\n return config_path\n\n config = read_raw_config()\n if not config:\n return config_path\n\n model = config.get(\"model\")\n if isinstance(model, dict):\n model[\"provider\"] = \"auto\"\n if \"base_url\" in model:\n model[\"base_url\"] = OPENROUTER_BASE_URL\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _prompt_model_selection(\n model_ids: List[str],\n current_model: str = \"\",\n pricing: Optional[Dict[str, Dict[str, str]]] = None,\n unavailable_models: Optional[List[str]] = None,\n portal_url: str = \"\",\n unavailable_message: str = \"\",\n) -> Optional[str]:\n \"\"\"Interactive model selection. Puts current_model first with a marker. Returns chosen model ID or None.\n\n If *pricing* is provided (``{model_id: {prompt, completion}}``), a compact\n price indicator is shown next to each model in aligned columns.\n\n If *unavailable_models* is provided, those models are shown grayed out\n and unselectable, with an upgrade link to *portal_url*.\n \"\"\"\n from arcen_cli.models import _format_price_per_mtok\n\n _unavailable = unavailable_models or []\n\n # Reorder: current model first, then the rest (deduplicated)\n ordered = []\n if current_model and current_model in model_ids:\n ordered.append(current_model)\n for mid in model_ids:\n if mid not in ordered:\n ordered.append(mid)\n\n # All models for column-width computation (selectable + unavailable)\n all_models = list(ordered) + list(_unavailable)\n\n # Column-aligned labels when pricing is available\n has_pricing = bool(pricing and any(pricing.get(m) for m in all_models))\n name_col = max((len(m) for m in all_models), default=0) + 2 if has_pricing else 0\n\n # Pre-compute formatted prices and dynamic column widths\n _price_cache: dict[str, tuple[str, str, str]] = {}\n price_col = 3 # minimum width\n cache_col = 0 # only set if any model has cache pricing\n has_cache = False\n if has_pricing:\n for mid in all_models:\n p = pricing.get(mid) # type: ignore[union-attr]\n if p:\n inp = _format_price_per_mtok(p.get(\"prompt\", \"\"))\n out = _format_price_per_mtok(p.get(\"completion\", \"\"))\n cache_read = p.get(\"input_cache_read\", \"\")\n cache = _format_price_per_mtok(cache_read) if cache_read else \"\"\n if cache:\n has_cache = True\n else:\n inp, out, cache = \"\", \"\", \"\"\n _price_cache[mid] = (inp, out, cache)\n price_col = max(price_col, len(inp), len(out))\n cache_col = max(cache_col, len(cache))\n if has_cache:\n cache_col = max(cache_col, 5) # minimum: \"Cache\" header\n\n def _label(mid):\n if has_pricing:\n inp, out, cache = _price_cache.get(mid, (\"\", \"\", \"\"))\n price_part = f\" {inp:>{price_col}} {out:>{price_col}}\"\n if has_cache:\n price_part += f\" {cache:>{cache_col}}\"\n base = f\"{mid:<{name_col}}{price_part}\"\n else:\n base = mid\n if mid == current_model:\n base += \" ← currently in use\"\n return base\n\n # Default cursor on the current model (index 0 if it was reordered to top)\n default_idx = 0\n\n # Build a pricing header hint for the menu title\n menu_title = \"Select default model:\"\n if has_pricing:\n # Align the header with the model column.\n # Each choice is \" {label}\" (2 spaces) and simple_term_menu prepends\n # a 3-char cursor region (\"-> \" or \" \"), so content starts at col 5.\n pad = \" \" * 5\n header = f\"\\n{pad}{'':>{name_col}} {'In':>{price_col}} {'Out':>{price_col}}\"\n if has_cache:\n header += f\" {'Cache':>{cache_col}}\"\n menu_title += header + \" /Mtok\"\n\n # ANSI escape for dim text\n _DIM = \"\\033[2m\"\n _RESET = \"\\033[0m\"\n\n # Try arrow-key menu first, fall back to number input.\n # Uses the shared curses radiolist (ESC/arrow-key handling that works\n # across terminals, incl. those that emit raw escape sequences) instead\n # of simple_term_menu, which conflicts with /dev/tty and left ESC/arrow\n # keys unreliable in the setup model picker.\n try:\n from arcen_cli.curses_ui import curses_radiolist\n\n choices = [_label(mid) for mid in ordered]\n choices.append(\"Enter custom model name\")\n choices.append(\"Skip (keep current)\")\n\n _upgrade_url = (portal_url or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip()\n if not unavailable_footer and _unavailable:\n unavailable_footer = f\"Upgrade at {_upgrade_url} for paid models\"\n\n # The pricing column header (and any unavailable-models block) is shown\n # as a multi-line description above the list so it survives the curses\n # screen clear. menu_title already embeds the aligned price header.\n desc_lines: list[str] = []\n if has_pricing:\n # menu_title is \"Select default model:\\n<pad><header> /Mtok\"\n # Keep only the header portion for the description.\n header_part = menu_title.split(\"\\n\", 1)\n if len(header_part) > 1:\n desc_lines.extend(header_part[1].splitlines())\n if _unavailable:\n for mid in _unavailable:\n desc_lines.append(f\" {_label(mid)}\")\n desc_lines.append(f\" ── {unavailable_footer} ──\")\n description = \"\\n\".join(desc_lines) if desc_lines else None\n\n idx = curses_radiolist(\n \"Select default model:\",\n choices,\n selected=default_idx,\n cancel_returns=-1,\n description=description,\n searchable=True,\n )\n if idx < 0:\n return None\n print()\n if idx < len(ordered):\n return ordered[idx]\n elif idx == len(ordered):\n try:\n custom = input(\"Enter model name: \").strip()\n except (EOFError, KeyboardInterrupt):\n return None\n return custom if custom else None\n return None\n except (ImportError, NotImplementedError, OSError, subprocess.SubprocessError):\n pass\n\n # Fallback: numbered list\n print(menu_title)\n num_width = len(str(len(ordered) + 2))\n for i, mid in enumerate(ordered, 1):\n print(f\" {i:>{num_width}}. {_label(mid)}\")\n n = len(ordered)\n print(f\" {n + 1:>{num_width}}. Enter custom model name\")\n print(f\" {n + 2:>{num_width}}. Skip (keep current)\")\n\n if _unavailable:\n _upgrade_url = (portal_url or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip() or (\n f\"Unavailable models (requires paid tier — upgrade at {_upgrade_url})\"\n )\n print()\n print(f\" {_DIM}── {unavailable_footer} ──{_RESET}\")\n for mid in _unavailable:\n print(f\" {'':>{num_width}} {_DIM}{_label(mid)}{_RESET}\")\n print()\n\n while True:\n try:\n choice = input(f\"Choice [1-{n + 2}] (default: skip): \").strip()\n if not choice:\n return None\n idx = int(choice)\n if 1 <= idx <= n:\n return ordered[idx - 1]\n elif idx == n + 1:\n custom = input(\"Enter model name: \").strip()\n return custom if custom else None\n elif idx == n + 2:\n return None\n print(f\"Please enter 1-{n + 2}\")\n except ValueError:\n print(\"Please enter a number\")\n except (KeyboardInterrupt, EOFError):\n return None\n\n\ndef _save_model_choice(model_id: str) -> None:\n \"\"\"Save the selected model to config.yaml (single source of truth).\n\n The model is stored in config.yaml only — NOT in .env. This avoids\n conflicts in multi-agent setups where env vars would stomp each other.\n \"\"\"\n from arcen_cli.config import save_config, load_config\n\n config = load_config()\n # Always use dict format so provider/base_url can be stored alongside\n if isinstance(config.get(\"model\"), dict):\n config[\"model\"][\"default\"] = model_id\n else:\n config[\"model\"] = {\"default\": model_id}\n save_config(config)\n\n\ndef login_command(args) -> None:\n \"\"\"Deprecated: use 'arcen model' or 'arcen setup' instead.\"\"\"\n print(\"The 'arcen login' command has been removed.\")\n print(\"Use 'arcen auth' to manage credentials,\")\n print(\"'arcen model' to select a provider, or 'arcen setup' for full setup.\")\n raise SystemExit(0)\n\n\ndef _login_openai_codex(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n \"\"\"OpenAI Codex login via device code flow. Tokens stored in ~/.arcen/auth.json.\"\"\"\n\n del args, pconfig # kept for parity with other provider login helpers\n\n # Check for existing Arcen-owned credentials\n if not force_new_login:\n try:\n existing = resolve_codex_runtime_credentials()\n # Verify the resolved token is actually usable (not expired).\n # resolve_codex_runtime_credentials attempts refresh, so if we get\n # here the token should be valid — but double-check before telling\n # the user \"Login successful!\".\n _resolved_key = existing.get(\"api_key\", \"\")\n if isinstance(_resolved_key, str) and _resolved_key and not _codex_access_token_is_expiring(_resolved_key, 60):\n print(\"Existing Codex credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\"openai-codex\", existing.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n else:\n print(\"Existing Codex credentials are expired. Starting fresh login...\")\n except AuthError:\n pass\n\n # Check for existing Codex CLI tokens we can import\n if not force_new_login:\n cli_tokens = _import_codex_cli_tokens()\n if cli_tokens:\n print(\"Found existing Codex CLI credentials at ~/.codex/auth.json\")\n print(\"Arcen will create its own session to avoid conflicts with Codex CLI / VS Code.\")\n try:\n do_import = input(\"Import these credentials? (a separate login is recommended) [y/N]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"n\"\n if do_import in {\"y\", \"yes\"}:\n _save_codex_tokens(cli_tokens)\n base_url = os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_CODEX_BASE_URL\n config_path = _update_config_for_provider(\"openai-codex\", base_url)\n print()\n print(\"Credentials imported. Note: if Codex CLI refreshes its token,\")\n print(\"Arcen will keep working independently with its own session.\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n\n # Run a fresh device code flow — Arcen gets its own OAuth session\n print()\n print(\"Signing in to OpenAI Codex...\")\n print(\"(Arcen creates its own session — won't affect Codex CLI or VS Code)\")\n print()\n\n creds = _codex_device_code_login()\n\n # Save tokens to Arcen auth store\n _save_codex_tokens(creds[\"tokens\"], creds.get(\"last_refresh\"))\n config_path = _update_config_for_provider(\"openai-codex\", creds.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n\n\ndef _login_xai_oauth(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n del pconfig\n\n if not force_new_login:\n try:\n existing = resolve_xai_oauth_runtime_credentials()\n api_key = existing.get(\"api_key\", \"\")\n if isinstance(api_key, str) and api_key and not _xai_access_token_is_expiring(api_key, 60):\n print(\"Existing xAI OAuth credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\n \"xai-oauth\",\n existing.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL),\n )\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n return\n except AuthError:\n pass\n\n print()\n print(\"Signing in to xAI Grok OAuth (SuperGrok / Premium+)...\")\n print(\"(Arcen creates its own local OAuth session)\")\n print()\n\n timeout_seconds = float(getattr(args, \"timeout\", None) or 20.0)\n open_browser = not getattr(args, \"no_browser\", False)\n if _is_remote_session():\n open_browser = False\n manual_paste = bool(getattr(args, \"manual_paste\", False))\n\n creds = _xai_oauth_loopback_login(\n timeout_seconds=timeout_seconds,\n open_browser=open_browser,\n manual_paste=manual_paste,\n )\n _save_xai_oauth_tokens(\n creds[\"tokens\"],\n discovery=creds.get(\"discovery\"),\n redirect_uri=creds.get(\"redirect_uri\", \"\"),\n last_refresh=creds.get(\"last_refresh\"),\n )\n config_path = _update_config_for_provider(\"xai-oauth\", creds.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n\n\ndef _xai_oauth_build_authorize_url(\n *,\n authorization_endpoint: str,\n redirect_uri: str,\n code_challenge: str,\n state: str,\n nonce: str,\n) -> str:\n # `plan=generic` opts the consent screen into xAI's generic OAuth plan\n # tier instead of falling back to the per-account default. Without it,\n # accounts.x.ai rejects loopback OAuth from non-allowlisted clients.\n # `referrer=arcen-agent` lets xAI attribute Arcen-originated logins\n # in their OAuth server logs (we still impersonate the upstream Grok-CLI\n # client_id; this is best-effort attribution until xAI mints us our own).\n authorize_params = {\n \"response_type\": \"code\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"redirect_uri\": redirect_uri,\n \"scope\": XAI_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n \"nonce\": nonce,\n \"plan\": \"generic\",\n \"referrer\": \"arcen-agent\",\n }\n return f\"{authorization_endpoint}?{urlencode(authorize_params)}\"\n\n\ndef _xai_oauth_exchange_code_for_tokens(\n *,\n token_endpoint: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n code_challenge: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"POST the authorization code to xAI's token endpoint and return\n the parsed JSON payload.\n\n Sends ``code_verifier`` as required by RFC 7636 §4.5. Also echoes\n ``code_challenge`` + ``code_challenge_method`` in the request body\n as a defense-in-depth measure for OAuth servers (xAI's among them,\n per #26990) that re-validate the challenge at the token step\n instead of relying solely on server-side session state captured\n during the authorize step. Echoing the challenge is harmless for\n strict RFC-compliant servers — RFC 7636 doesn't forbid additional\n parameters at the token endpoint — and decisively fixes the\n ``code_challenge is required`` failure mode users hit on the\n loopback flow.\n\n Raises :class:`AuthError` on any non-2xx response or transport\n failure; the error message embeds the HTTP status code and the\n full response body so users can disambiguate cause at a glance.\n \"\"\"\n # Paranoia: if upstream call sites ever drop ``code_verifier`` we\n # want to surface a precise, local error rather than send a\n # missing-PKCE request to xAI and receive their generic \"code\n # challenge required\" message back.\n if not code_verifier:\n raise AuthError(\n \"xAI token exchange refused locally: PKCE code_verifier is empty. \"\n \"This is a bug in Arcen — please report at \"\n \"https://github.com/AdityaKumar41/arcen-agent/issues/26990.\",\n provider=\"xai-oauth\",\n code=\"xai_pkce_verifier_missing\",\n )\n\n data = {\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"code_verifier\": code_verifier,\n }\n # Defense-in-depth: include the original ``code_challenge`` and\n # ``code_challenge_method``. Some OAuth servers (including xAI's\n # auth.x.ai implementation, per the symptom reported in #26990)\n # validate these at the token endpoint instead of relying purely on\n # state captured during the authorize step — without them, xAI\n # rejects the exchange with ``code_challenge is required`` even\n # though we sent a valid ``code_verifier``.\n if code_challenge:\n data[\"code_challenge\"] = code_challenge\n data[\"code_challenge_method\"] = \"S256\"\n\n try:\n response = httpx.post(\n token_endpoint,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data=data,\n timeout=max(20.0, timeout_seconds),\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n ) from exc\n\n if response.status_code != 200:\n body = response.text.strip()\n # See ``refresh_xai_oauth_pure`` — token-exchange 403 also\n # surfaces tier/entitlement gating from xAI's backend. Avoid\n # the misleading \"re-authenticate\" hint and point at the API\n # key fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n f\"xAI token exchange failed (HTTP 403).\"\n + (f\" Response: {body}\" if body else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Set ``XAI_API_KEY``\"\n \" and switch to ``provider: xai`` (API-key path) if\"\n \" available, or upgrade your subscription at\"\n \" https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n f\"xAI token exchange failed (HTTP {response.status_code}).\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token exchange response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n return payload\n\n\ndef _xai_oauth_loopback_login(\n *,\n timeout_seconds: float = 20.0,\n open_browser: bool = True,\n manual_paste: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Run the xAI OAuth PKCE flow.\n\n When ``manual_paste=True`` the loopback HTTP listener is skipped\n entirely and the user is prompted to paste the failed callback\n URL into stdin (regression fix for #26923 — browser-only remote\n consoles like GCP Cloud Shell / GitHub Codespaces / EC2 Instance\n Connect, where the laptop's browser can't reach 127.0.0.1 on the\n remote VM). The same PKCE verifier, ``state``, and ``nonce`` are\n used for both paths so the upstream-side OAuth flow is identical.\n \"\"\"\n def _stdin_supports_manual_paste() -> bool:\n try:\n return bool(getattr(sys.stdin, \"isatty\", lambda: False)())\n except Exception:\n return False\n\n discovery = _xai_oauth_discovery(timeout_seconds)\n authorization_endpoint = discovery[\"authorization_endpoint\"]\n token_endpoint = discovery[\"token_endpoint\"]\n\n if manual_paste:\n # No HTTP listener — synthesize a redirect_uri matching what\n # the server would have bound to so the authorize URL the user\n # opens (and the redirect_uri sent in the token exchange) stay\n # byte-identical to the loopback path. xAI's token endpoint\n # cross-checks redirect_uri against the authorize request.\n redirect_uri = (\n f\"http://{XAI_OAUTH_REDIRECT_HOST}:{XAI_OAUTH_REDIRECT_PORT}\"\n f\"{XAI_OAUTH_REDIRECT_PATH}\"\n )\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n callback = _prompt_manual_callback_paste(redirect_uri)\n else:\n server, thread, callback_result, redirect_uri = _xai_start_callback_server()\n try:\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n print()\n print(f\"Waiting for callback on {redirect_uri}\")\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=XAI_OAUTH_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for xAI authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n try:\n callback = _xai_wait_for_callback(\n server,\n thread,\n callback_result,\n timeout_seconds=max(30.0, timeout_seconds * 9),\n )\n except AuthError as exc:\n if (\n getattr(exc, \"code\", \"\") != \"xai_callback_timeout\"\n or not _stdin_supports_manual_paste()\n ):\n raise\n print()\n print(\"xAI loopback callback timed out.\")\n print(\"If your browser reached a failed 127.0.0.1 callback page,\")\n print(\"paste that FULL callback URL below to continue this login.\")\n print(\"You can also re-run with `--manual-paste` to skip the\")\n print(\"loopback listener from the start.\")\n callback = _prompt_manual_callback_paste(redirect_uri)\n if callback.get(\"code\") is None and callback.get(\"error\") is None:\n raise exc\n except Exception:\n try:\n server.shutdown()\n server.server_close()\n except Exception:\n pass\n try:\n thread.join(timeout=1.0)\n except Exception:\n pass\n raise\n\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise AuthError(\n f\"xAI authorization failed: {detail}\",\n provider=\"xai-oauth\",\n code=\"xai_authorization_failed\",\n )\n callback_state = callback.get(\"state\")\n # Manual-paste bare-code path: when a user pastes only the opaque\n # authorization code (no ``code=``/``state=`` query parameters),\n # ``_parse_pasted_callback`` returns ``state=None``. xAI's consent\n # page renders the code in-page rather than redirecting through the\n # 127.0.0.1 callback, so on many remote setups (Cloud Shell, headless\n # VPS, container consoles) the bare code is the only thing the user\n # can obtain. PKCE (code_verifier) still binds the exchange to this\n # client, so the local state-equality check is redundant on the\n # bare-code path — we substitute the locally generated state to keep\n # the rest of the validation chain (and the token exchange) unchanged.\n # See #26923 (AccursedGalaxy comment, 2026-05-20).\n if callback_state is None and manual_paste:\n callback_state = state\n if callback_state != state:\n raise AuthError(\n \"xAI authorization failed: state mismatch.\",\n provider=\"xai-oauth\",\n code=\"xai_state_mismatch\",\n )\n code = str(callback.get(\"code\") or \"\").strip()\n if not code:\n raise AuthError(\n \"xAI authorization failed: missing authorization code.\",\n provider=\"xai-oauth\",\n code=\"xai_code_missing\",\n )\n\n payload = _xai_oauth_exchange_code_for_tokens(\n token_endpoint=token_endpoint,\n code=code,\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n code_challenge=code_challenge,\n timeout_seconds=timeout_seconds,\n )\n access_token = str(payload.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(payload.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI token exchange did not return an access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n if not refresh_token:\n raise AuthError(\n \"xAI token exchange did not return a refresh_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"id_token\": str(payload.get(\"id_token\", \"\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n },\n \"discovery\": discovery,\n \"redirect_uri\": redirect_uri,\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"source\": \"oauth-loopback\",\n }\n\n\ndef _codex_device_code_login() -> Dict[str, Any]:\n \"\"\"Run the OpenAI device code login flow and return credentials dict.\"\"\"\n import time as _time\n\n issuer = \"https://auth.openai.com\"\n client_id = CODEX_OAUTH_CLIENT_ID\n\n # Step 1: Request device code\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/usercode\",\n json={\"client_id\": client_id},\n headers={\"Content-Type\": \"application/json\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Failed to request device code: {exc}\",\n provider=\"openai-codex\", code=\"device_code_request_failed\",\n )\n\n if resp.status_code != 200:\n raise AuthError(\n f\"Device code request returned status {resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_request_error\",\n )\n\n device_data = resp.json()\n user_code = device_data.get(\"user_code\", \"\")\n device_auth_id = device_data.get(\"device_auth_id\", \"\")\n poll_interval = max(3, int(device_data.get(\"interval\", \"5\")))\n\n if not user_code or not device_auth_id:\n raise AuthError(\n \"Device code response missing required fields.\",\n provider=\"openai-codex\", code=\"device_code_incomplete\",\n )\n\n # Step 2: Show user the code\n print(\"To continue, follow these steps:\\n\")\n print(\" 1. Open this URL in your browser:\")\n print(f\" \\033[94m{issuer}/codex/device\\033[0m\\n\")\n print(\" 2. Enter this code:\")\n print(f\" \\033[94m{user_code}\\033[0m\\n\")\n print(\"Waiting for sign-in... (press Ctrl+C to cancel)\")\n\n # Step 3: Poll for authorization code\n max_wait = 15 * 60 # 15 minutes\n start = _time.monotonic()\n code_resp = None\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n while _time.monotonic() - start < max_wait:\n _time.sleep(poll_interval)\n poll_resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/token\",\n json={\"device_auth_id\": device_auth_id, \"user_code\": user_code},\n headers={\"Content-Type\": \"application/json\"},\n )\n\n if poll_resp.status_code == 200:\n code_resp = poll_resp.json()\n break\n elif poll_resp.status_code in {403, 404}:\n continue # User hasn't completed login yet\n else:\n raise AuthError(\n f\"Device auth polling returned status {poll_resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_poll_error\",\n )\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n\n if code_resp is None:\n raise AuthError(\n \"Login timed out after 15 minutes.\",\n provider=\"openai-codex\", code=\"device_code_timeout\",\n )\n\n # Step 4: Exchange authorization code for tokens\n authorization_code = code_resp.get(\"authorization_code\", \"\")\n code_verifier = code_resp.get(\"code_verifier\", \"\")\n redirect_uri = f\"{issuer}/deviceauth/callback\"\n\n if not authorization_code or not code_verifier:\n raise AuthError(\n \"Device auth response missing authorization_code or code_verifier.\",\n provider=\"openai-codex\", code=\"device_code_incomplete_exchange\",\n )\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n token_resp = client.post(\n CODEX_OAUTH_TOKEN_URL,\n data={\n \"grant_type\": \"authorization_code\",\n \"code\": authorization_code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": client_id,\n \"code_verifier\": code_verifier,\n },\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Token exchange failed: {exc}\",\n provider=\"openai-codex\", code=\"token_exchange_failed\",\n )\n\n if token_resp.status_code != 200:\n raise AuthError(\n f\"Token exchange returned status {token_resp.status_code}.\",\n provider=\"openai-codex\", code=\"token_exchange_error\",\n )\n\n tokens = token_resp.json()\n access_token = tokens.get(\"access_token\", \"\")\n refresh_token = tokens.get(\"refresh_token\", \"\")\n\n if not access_token:\n raise AuthError(\n \"Token exchange did not return an access_token.\",\n provider=\"openai-codex\", code=\"token_exchange_no_access_token\",\n )\n\n # Return tokens for the caller to persist (no longer writes to ~/.codex/)\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n },\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"auth_mode\": \"chatgpt\",\n \"source\": \"device-code\",\n }\n\n\n# ==================== MiniMax Portal OAuth ====================\n\ndef _minimax_pkce_pair() -> tuple:\n \"\"\"Generate (code_verifier, code_challenge_S256, state) for MiniMax OAuth.\"\"\"\n import secrets\n verifier = secrets.token_urlsafe(64)[:96]\n challenge = base64.urlsafe_b64encode(\n hashlib.sha256(verifier.encode()).digest()\n ).decode().rstrip(\"=\")\n state = secrets.token_urlsafe(16)\n return verifier, challenge, state\n\n\ndef _minimax_request_user_code(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n code_challenge: str, state: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/oauth/code\",\n data={\n \"response_type\": \"code\",\n \"client_id\": client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n \"x-request-id\": str(uuid.uuid4()),\n },\n )\n if response.status_code != 200:\n raise AuthError(\n f\"MiniMax OAuth authorization failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"authorization_failed\",\n )\n payload = response.json()\n for field in (\"user_code\", \"verification_uri\", \"expired_in\"):\n if field not in payload:\n raise AuthError(\n f\"MiniMax OAuth response missing field: {field}\",\n provider=\"minimax-oauth\", code=\"authorization_incomplete\",\n )\n if payload.get(\"state\") != state:\n raise AuthError(\n \"MiniMax OAuth state mismatch (possible CSRF).\",\n provider=\"minimax-oauth\", code=\"state_mismatch\",\n )\n return payload\n\n\ndef _minimax_expired_in_looks_like_unix_ms(expired_in: int, *, now_ms: int) -> bool:\n \"\"\"True if ``expired_in`` is plausibly a unix-ms absolute time (vs TTL seconds).\"\"\"\n return int(expired_in) > (now_ms // 2)\n\n\ndef _minimax_resolve_token_expiry_unix(expired_in: int, *, now: datetime) -> float:\n \"\"\"Return access-token expiry as unix seconds (MiniMax uses ms epoch or TTL seconds).\"\"\"\n raw = int(expired_in)\n now_ms = int(now.timestamp() * 1000)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n return raw / 1000.0\n return now.timestamp() + max(1, raw)\n\n\ndef _minimax_poll_token(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n user_code: str, code_verifier: str, expired_in: int, interval_ms: Optional[int],\n) -> Dict[str, Any]:\n # OpenClaw treats expired_in as a unix-ms timestamp (Date.now() < expireTimeMs).\n # Defensive parsing: if it's small enough to be a duration, treat as seconds.\n import time as _time\n now_ms = int(_time.time() * 1000)\n raw = int(expired_in)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n deadline = raw / 1000.0\n else:\n deadline = _time.time() + max(1, raw)\n interval = max(2.0, (interval_ms or 2000) / 1000.0)\n\n while _time.time() < deadline:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": MINIMAX_OAUTH_GRANT_TYPE,\n \"client_id\": client_id,\n \"user_code\": user_code,\n \"code_verifier\": code_verifier,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n try:\n payload = response.json() if response.text else {}\n except Exception:\n payload = {}\n\n if response.status_code != 200:\n msg = (payload.get(\"base_resp\", {}) or {}).get(\"status_msg\") or response.text\n raise AuthError(\n f\"MiniMax OAuth error: {msg or 'unknown'}\",\n provider=\"minimax-oauth\", code=\"token_exchange_failed\",\n )\n\n status = payload.get(\"status\")\n if status == \"error\":\n raise AuthError(\n \"MiniMax OAuth reported an error. Please try again later.\",\n provider=\"minimax-oauth\", code=\"authorization_denied\",\n )\n if status == \"success\":\n if not all(payload.get(k) for k in (\"access_token\", \"refresh_token\", \"expired_in\")):\n raise AuthError(\n \"MiniMax OAuth success payload missing required token fields.\",\n provider=\"minimax-oauth\", code=\"token_incomplete\",\n )\n return payload\n # \"pending\" or any other status -> keep polling\n _time.sleep(interval)\n\n raise AuthError(\n \"MiniMax OAuth timed out before authorization completed.\",\n provider=\"minimax-oauth\", code=\"timeout\",\n )\n\n\ndef _minimax_save_auth_state(auth_state: Dict[str, Any]) -> None:\n \"\"\"Persist MiniMax OAuth state to Arcen auth store (~/.arcen/auth.json).\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"minimax-oauth\", auth_state)\n _save_auth_store(auth_store)\n\n\ndef _minimax_oauth_login(\n *, region: str = \"global\", open_browser: bool = True,\n timeout_seconds: float = 15.0,\n) -> Dict[str, Any]:\n \"\"\"Run MiniMax OAuth flow, persist tokens, return auth state dict.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"minimax-oauth\"]\n if region == \"cn\":\n portal_base_url = pconfig.extra[\"cn_portal_base_url\"]\n inference_base_url = pconfig.extra[\"cn_inference_base_url\"]\n else:\n portal_base_url = pconfig.portal_base_url\n inference_base_url = pconfig.inference_base_url\n\n verifier, challenge, state = _minimax_pkce_pair()\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via MiniMax ({region}) OAuth...\")\n print(f\"Portal: {portal_base_url}\")\n\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n headers={\"Accept\": \"application/json\"},\n follow_redirects=True) as client:\n code_data = _minimax_request_user_code(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n code_challenge=challenge, state=state,\n )\n verification_url = str(code_data[\"verification_uri\"])\n user_code = str(code_data[\"user_code\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n if open_browser and _can_open_graphical_browser():\n if webbrowser.open(verification_url):\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically -- use the URL above.\")\n\n interval_raw = code_data.get(\"interval\")\n interval_ms = int(interval_raw) if interval_raw is not None else None\n print(\"Waiting for approval...\")\n\n token_data = _minimax_poll_token(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n user_code=user_code, code_verifier=verifier,\n expired_in=int(code_data[\"expired_in\"]),\n interval_ms=interval_ms,\n )\n\n now = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(token_data[\"expired_in\"]), now=now,\n )\n expires_in_s = max(0, int(expires_at_unix - now.timestamp()))\n\n auth_state = {\n \"provider\": \"minimax-oauth\",\n \"region\": region,\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": inference_base_url,\n \"client_id\": pconfig.client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data[\"refresh_token\"],\n \"resource_url\": token_data.get(\"resource_url\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n }\n\n _minimax_save_auth_state(auth_state)\n print(\"\\u2713 MiniMax OAuth login successful.\")\n if msg := token_data.get(\"notification_message\"):\n print(f\"Note from MiniMax: {msg}\")\n return auth_state\n\n\ndef _refresh_minimax_oauth_state(\n state: Dict[str, Any], *, timeout_seconds: float = 15.0,\n force: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Refresh MiniMax OAuth access token if close to expiry (or forced).\"\"\"\n if not state.get(\"refresh_token\"):\n raise AuthError(\n \"MiniMax OAuth state has no refresh_token; please re-login.\",\n provider=\"minimax-oauth\", code=\"no_refresh_token\", relogin_required=True,\n )\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n except Exception:\n expires_at = 0.0\n now = time.time()\n if not force and (expires_at - now) > MINIMAX_OAUTH_REFRESH_SKEW_SECONDS:\n return state\n\n portal_base_url = state[\"portal_base_url\"]\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n follow_redirects=True) as client:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": state[\"client_id\"],\n \"refresh_token\": state[\"refresh_token\"],\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n if response.status_code != 200:\n body = response.text.lower()\n relogin = any(m in body for m in\n (\"invalid_grant\", \"refresh_token_reused\", \"invalid_refresh_token\"))\n raise AuthError(\n f\"MiniMax OAuth refresh failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=relogin,\n )\n payload = response.json()\n if payload.get(\"status\") != \"success\":\n raise AuthError(\n \"MiniMax OAuth refresh did not return success.\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=True,\n )\n now_dt = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(payload[\"expired_in\"]), now=now_dt,\n )\n expires_in_s = max(0, int(expires_at_unix - now_dt.timestamp()))\n new_state = dict(state)\n new_state.update({\n \"access_token\": payload[\"access_token\"],\n \"refresh_token\": payload.get(\"refresh_token\", state[\"refresh_token\"]),\n \"obtained_at\": now_dt.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n })\n _minimax_save_auth_state(new_state)\n return new_state\n\n\ndef _minimax_oauth_quarantine_on_terminal_refresh(state: Dict[str, Any], exc: AuthError) -> None:\n \"\"\"Wipe dead tokens from auth.json after a terminal refresh failure.\n\n Shared by both the eager-resolve path and the lazy per-request token\n provider. Mirrors the Removed provider / xAI-OAuth / Codex-OAuth quarantine pattern\n so subsequent calls fail fast without a network retry.\n \"\"\"\n if not (exc.relogin_required and state.get(\"refresh_token\")):\n return\n for _k in (\"access_token\", \"refresh_token\", \"expires_at\", \"expires_in\", \"obtained_at\"):\n state.pop(_k, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"minimax-oauth\",\n \"code\": exc.code or \"refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n _minimax_save_auth_state(state)\n except Exception as _save_exc:\n logger.debug(\"MiniMax OAuth: failed to persist quarantined state: %s\", _save_exc)\n\n\ndef build_minimax_oauth_token_provider() -> Callable[[], str]:\n \"\"\"Return a zero-arg callable that yields a fresh MiniMax access token.\n\n The Anthropic SDK caches ``api_key`` as a static string at construction\n time, so a session that resolves credentials once at startup will keep\n sending the same bearer until MiniMax's server returns 401 — typically\n ~15 minutes in, because MiniMax issues short-lived access tokens.\n\n Returning a *callable* instead of a string lets us hook into the\n existing Entra-ID bearer infrastructure in\n :mod:`agent.anthropic_adapter`: ``build_anthropic_client`` detects a\n callable and routes through ``_build_anthropic_client_with_bearer_hook``,\n which mints a fresh ``Authorization`` header on every outbound request.\n Each invocation re-reads the persisted state from ``auth.json`` and\n calls :func:`_refresh_minimax_oauth_state` — that helper is a no-op\n when the token still has more than ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS``\n of life left, so the steady-state cost is one file read + one\n timestamp compare per request.\n\n Reading state fresh each time also means a refresh persisted by one\n process (CLI, gateway, cron) is immediately visible to every other\n process sharing the same ``auth.json``.\n \"\"\"\n def _provide() -> str:\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n token = state.get(\"access_token\")\n if not token:\n raise AuthError(\n \"MiniMax OAuth state has no access_token after refresh.\",\n provider=\"minimax-oauth\", code=\"no_access_token\", relogin_required=True,\n )\n return token\n\n return _provide\n\n\ndef resolve_minimax_oauth_runtime_credentials(\n *, min_token_ttl_seconds: int = MINIMAX_OAUTH_REFRESH_SKEW_SECONDS,\n as_token_provider: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Return {provider, api_key, base_url, source} for minimax-oauth.\n\n When ``as_token_provider`` is True, ``api_key`` is a zero-arg callable\n that mints a fresh access token per call (proactively refreshing if\n the cached token is within ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS`` of\n expiry). This is what the runtime provider path uses so that long\n sessions survive MiniMax's short access-token lifetime — see\n :func:`build_minimax_oauth_token_provider` for the rationale.\n\n The default (string ``api_key``) preserves the historical contract for\n diagnostic call sites like ``arcen status`` that just want to know\n whether a valid token exists right now.\n \"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n if as_token_provider:\n api_key: Any = build_minimax_oauth_token_provider()\n else:\n api_key = state[\"access_token\"]\n return {\n \"provider\": \"minimax-oauth\",\n \"api_key\": api_key,\n \"base_url\": state[\"inference_base_url\"].rstrip(\"/\"),\n \"source\": \"oauth\",\n }\n\n\ndef get_minimax_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return auth status dict for MiniMax OAuth provider.\"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n return {\"logged_in\": False, \"provider\": \"minimax-oauth\"}\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n token_valid = (expires_at - time.time()) > 0\n except Exception:\n token_valid = bool(state.get(\"access_token\"))\n return {\n \"logged_in\": token_valid,\n \"provider\": \"minimax-oauth\",\n \"region\": state.get(\"region\", \"global\"),\n \"expires_at\": state.get(\"expires_at\"),\n }\n\n\ndef _login_minimax_oauth(args, pconfig: ProviderConfig) -> None:\n \"\"\"CLI entry for MiniMax OAuth login.\"\"\"\n region = getattr(args, \"region\", None) or \"global\"\n open_browser = not getattr(args, \"no_browser\", False)\n timeout = getattr(args, \"timeout\", None) or 15.0\n try:\n _minimax_oauth_login(\n region=region, open_browser=open_browser, timeout_seconds=timeout,\n )\n except AuthError as exc:\n print(format_auth_error(exc))\n raise SystemExit(1)\n\n\ndef _removed_provider_device_code_login(\n *,\n portal_base_url: Optional[str] = None,\n inference_base_url: Optional[str] = None,\n client_id: Optional[str] = None,\n scope: Optional[str] = None,\n open_browser: bool = True,\n timeout_seconds: float = 15.0,\n insecure: bool = False,\n ca_bundle: Optional[str] = None,\n) -> Dict[str, Any]:\n \"\"\"Run the Removed provider device-code flow and return full OAuth state without persisting.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"removed_provider\"]\n portal_base_url = (\n portal_base_url\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"REMOVED_PROVIDER_PORTAL_BASE_URL\")\n or pconfig.portal_base_url\n ).rstrip(\"/\")\n requested_inference_url = (\n inference_base_url\n or os.getenv(\"REMOVED_PROVIDER_INFERENCE_BASE_URL\")\n or pconfig.inference_base_url\n ).rstrip(\"/\")\n client_id = client_id or pconfig.client_id\n scope = scope or pconfig.scope\n timeout = httpx.Timeout(timeout_seconds)\n verify: bool | str = False if insecure else (ca_bundle if ca_bundle else True)\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via {pconfig.name}...\")\n print(f\"Portal: {portal_base_url}\")\n if insecure:\n print(\"TLS verification: disabled (--insecure)\")\n elif ca_bundle:\n print(f\"TLS verification: custom CA bundle ({ca_bundle})\")\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n device_data = _request_device_code(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n scope=scope,\n )\n\n verification_url = str(device_data[\"verification_uri_complete\"])\n user_code = str(device_data[\"user_code\"])\n expires_in = int(device_data[\"expires_in\"])\n interval = int(device_data[\"interval\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n\n if open_browser:\n opened = webbrowser.open(verification_url)\n if opened:\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically — use the URL above.\")\n\n effective_interval = max(1, min(interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n print(f\"Waiting for approval (polling every {effective_interval}s)...\")\n\n token_data = _poll_for_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n device_code=str(device_data[\"device_code\"]),\n expires_in=expires_in,\n poll_interval=interval,\n )\n\n now = datetime.now(timezone.utc)\n token_expires_in = _coerce_ttl_seconds(token_data.get(\"expires_in\", 0))\n expires_at = now.timestamp() + token_expires_in\n resolved_inference_url = (\n _optional_base_url(token_data.get(\"inference_base_url\"))\n or requested_inference_url\n )\n if resolved_inference_url != requested_inference_url:\n print(f\"Using portal-provided inference URL: {resolved_inference_url}\")\n\n auth_state = {\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": resolved_inference_url,\n \"client_id\": client_id,\n \"scope\": token_data.get(\"scope\") or scope,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data.get(\"refresh_token\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at, tz=timezone.utc).isoformat(),\n \"expires_in\": token_expires_in,\n \"tls\": {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n },\n \"agent_key\": None,\n \"agent_key_id\": None,\n \"agent_key_expires_at\": None,\n \"agent_key_expires_in\": None,\n \"agent_key_reused\": None,\n \"agent_key_obtained_at\": None,\n }\n try:\n return refresh_removed_provider_oauth_from_state(\n auth_state,\n timeout_seconds=timeout_seconds,\n force_refresh=False,\n )\n except AuthError as exc:\n if exc.code == \"subscription_required\":\n portal_url = auth_state.get(\n \"portal_base_url\", DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n ).rstrip(\"/\")\n message = format_auth_error(exc)\n print()\n print(message)\n print(f\" Subscribe here: {portal_url}/billing\")\n print()\n print(\"After subscribing, run `arcen model` again to finish setup.\")\n raise SystemExit(1)\n raise\n\n\ndef _login_removed_provider(args, pconfig: ProviderConfig) -> None:\n \"\"\"Removed provider Portal device authorization flow.\"\"\"\n timeout_seconds = getattr(args, \"timeout\", None) or 15.0\n insecure = bool(getattr(args, \"insecure\", False))\n ca_bundle = (\n getattr(args, \"ca_bundle\", None)\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n )\n\n try:\n auth_state = None\n\n # Codex-style auto-import: before launching a fresh device-code\n # flow, check the shared store for an existing Removed provider credential\n # from any other profile. If present, offer to rehydrate it.\n shared = _read_shared_removed_provider_state()\n if shared:\n try:\n shared_path = _removed_provider_shared_store_path()\n except RuntimeError:\n shared_path = None\n print()\n if shared_path:\n print(f\"Found existing Removed provider OAuth credentials at {shared_path}\")\n else:\n print(\"Found existing shared Removed provider OAuth credentials\")\n try:\n do_import = input(\"Import these credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"y\"\n if do_import in {\"\", \"y\", \"yes\"}:\n print(\"Rehydrating Removed provider session from shared credentials...\")\n auth_state = _try_import_shared_removed_provider_state(\n timeout_seconds=timeout_seconds,\n )\n if auth_state is None:\n print(\"Could not refresh shared credentials — falling back to device-code login.\")\n\n if auth_state is None:\n auth_state = _removed_provider_device_code_login(\n portal_base_url=getattr(args, \"portal_url\", None),\n inference_base_url=getattr(args, \"inference_url\", None),\n client_id=getattr(args, \"client_id\", None) or pconfig.client_id,\n scope=getattr(args, \"scope\", None),\n open_browser=not getattr(args, \"no_browser\", False),\n timeout_seconds=timeout_seconds,\n insecure=insecure,\n ca_bundle=ca_bundle,\n )\n\n inference_base_url = auth_state[\"inference_base_url\"]\n\n # Snapshot the prior active_provider BEFORE _save_provider_state\n # overwrites it to \"removed_provider\". If the user picks \"Skip (keep current)\"\n # during model selection below, we restore this so the user's previous\n # provider (e.g. openrouter) is preserved.\n with _auth_store_lock():\n _prior_store = _load_auth_store()\n prior_active_provider = _prior_store.get(\"active_provider\")\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"removed_provider\", auth_state)\n saved_to = _save_auth_store(auth_store)\n\n # Mirror to the shared store so other profiles can one-tap import\n # these credentials. Best-effort: any I/O failure is logged and\n # swallowed inside the helper.\n _write_shared_removed_provider_state(auth_state)\n _sync_removed_provider_pool_from_auth_store()\n\n print()\n print(\"Login successful!\")\n print(f\" Auth state: {saved_to}\")\n\n # Resolve model BEFORE writing provider to config.yaml so we never\n # leave the config in a half-updated state (provider=removed_provider but model\n # still set to the previous provider's model, e.g. opus from\n # OpenRouter). The auth.json active_provider was already set above.\n selected_model = None\n try:\n runtime_key = auth_state.get(\"agent_key\") or auth_state.get(\"access_token\")\n if not isinstance(runtime_key, str) or not runtime_key:\n raise AuthError(\n \"No runtime API key available to fetch models\",\n provider=\"removed_provider\",\n code=\"invalid_token\",\n )\n\n from arcen_cli.models import (\n get_curated_removed_provider_model_ids, get_pricing_for_provider,\n check_removed_provider_free_tier, partition_removed_provider_models_by_tier,\n union_with_portal_free_recommendations,\n union_with_portal_paid_recommendations,\n )\n model_ids = get_curated_removed_provider_model_ids()\n\n print()\n unavailable_models: list = []\n unavailable_message = \"\"\n if model_ids:\n pricing = get_pricing_for_provider(\"removed_provider\")\n # Force fresh account data for model selection so recent credit\n # purchases are reflected immediately.\n free_tier = check_removed_provider_free_tier(force_fresh=True)\n _portal_for_recs = auth_state.get(\"portal_base_url\", \"\")\n if free_tier:\n try:\n from arcen_cli.removed_provider_account import (\n format_removed_provider_portal_entitlement_message,\n get_removed_provider_portal_account_info,\n )\n\n _account_info = get_removed_provider_portal_account_info(force_fresh=True)\n unavailable_message = (\n format_removed_provider_portal_entitlement_message(\n _account_info,\n capability=\"paid Removed provider models\",\n )\n or \"\"\n )\n except Exception:\n unavailable_message = \"\"\n # The Portal's freeRecommendedModels endpoint is the\n # source of truth for what's free *right now*. Augment\n # the curated list with anything new the Portal flags\n # as free so users on older Arcen builds still see\n # newly-launched free models without a CLI release.\n model_ids, pricing = union_with_portal_free_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n model_ids, unavailable_models = partition_removed_provider_models_by_tier(\n model_ids, pricing, free_tier=True,\n )\n else:\n # Paid-tier mirror: pull paidRecommendedModels so newly\n # launched paid models surface in the picker even if\n # the in-repo curated list and docs-hosted manifest\n # haven't caught up yet.\n model_ids, pricing = union_with_portal_paid_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n _portal = auth_state.get(\"portal_base_url\", \"\")\n if model_ids:\n print(f\"Showing {len(model_ids)} curated models — use \\\"Enter custom model name\\\" for others.\")\n selected_model = _prompt_model_selection(\n model_ids, pricing=pricing,\n unavailable_models=unavailable_models,\n portal_url=_portal,\n unavailable_message=unavailable_message,\n )\n elif unavailable_models:\n _url = (_portal or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n print(\"No free models currently available.\")\n print(unavailable_message or f\"Upgrade at {_url} to access paid models.\")\n else:\n print(\"No curated models available for Removed provider Portal.\")\n except Exception as exc:\n message = format_auth_error(exc) if isinstance(exc, AuthError) else str(exc)\n print()\n print(f\"Login succeeded, but could not fetch available models. Reason: {message}\")\n\n # Write provider + model atomically so config is never mismatched.\n # If no model was selected (user picked \"Skip (keep current)\",\n # model list fetch failed, or no curated models were available),\n # preserve the user's previous provider — don't silently switch\n # them to Removed provider with a mismatched model. The Removed provider OAuth tokens\n # stay saved for future use.\n if not selected_model:\n # Restore the prior active_provider that _save_provider_state\n # overwrote to \"removed_provider\". config.yaml model.provider is left\n # untouched, so the user's previous provider is fully preserved.\n with _auth_store_lock():\n auth_store = _load_auth_store()\n if prior_active_provider:\n auth_store[\"active_provider\"] = prior_active_provider\n else:\n auth_store.pop(\"active_provider\", None)\n _save_auth_store(auth_store)\n print()\n print(\"No provider change. Removed provider credentials saved for future use.\")\n print(\" Run `arcen model` again to switch to Removed provider Portal.\")\n return\n\n config_path = _update_config_for_provider(\n \"removed_provider\", inference_base_url, default_model=selected_model,\n )\n if selected_model:\n _save_model_choice(selected_model)\n print(f\"Default model set to: {selected_model}\")\n print(f\" Config updated: {config_path} (model.provider=removed_provider)\")\n\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n except Exception as exc:\n print(f\"Login failed: {exc}\")\n raise SystemExit(1)\n\n\ndef logout_command(args) -> None:\n \"\"\"Clear auth state for a provider.\"\"\"\n provider_id = getattr(args, \"provider\", None)\n\n if provider_id and not is_known_auth_provider(provider_id):\n print(f\"Unknown provider: {provider_id}\")\n raise SystemExit(1)\n\n active = get_active_provider()\n target = provider_id or active or _logout_default_provider_from_config()\n\n if not target:\n print(\"No provider is currently logged in.\")\n return\n\n should_reset_config = _should_reset_config_provider_on_logout(target)\n provider_name = get_auth_provider_display_name(target)\n\n if clear_provider_auth(target) or should_reset_config:\n if should_reset_config:\n _reset_config_provider()\n print(f\"Logged out of {provider_name}.\")\n if should_reset_config and os.getenv(\"OPENROUTER_API_KEY\"):\n print(\"Arcen will use OpenRouter for inference.\")\n elif should_reset_config:\n print(\"Run `arcen model` or configure an API key to use Arcen.\")\n else:\n print(\"Model provider configuration was unchanged.\")\n else:\n print(f\"No auth state found for {provider_name}.\")\n"}, "d963d32e594812c695dcaa33618682d3d45cb484": {"t": 1785753033.2494786, "n": 308011, "h": "ae6461cb0450361a", "c": "\"\"\"\nMulti-provider authentication system for Arcen Agent.\n\nSupports OAuth device code flows (Removed provider Portal, future: OpenAI Codex) and\ntraditional API key providers (OpenRouter, custom endpoints). Auth state\nis persisted in ~/.arcen/auth.json with cross-process file locking.\n\nArchitecture:\n- ProviderConfig registry defines known OAuth providers\n- Auth store (auth.json) holds per-provider credential state\n- resolve_provider() picks the active provider via priority chain\n- resolve_*_runtime_credentials() handles token refresh and runtime keys\n- logout_command() is the CLI entry point for clearing auth\n\nRemoved provider authentication paths:\n- Invoke JWT (preferred): use a scoped access_token directly for inference.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport logging\nimport os\nimport shutil\nimport shlex\nimport ssl\nimport stat\nimport sys\nimport base64\nimport hashlib\nimport subprocess\nimport threading\nimport time\nimport uuid\nimport webbrowser\nfrom contextlib import contextmanager\nfrom dataclasses import dataclass, field\nfrom datetime import datetime, timezone\nfrom http.server import BaseHTTPRequestHandler, HTTPServer, ThreadingHTTPServer\nfrom pathlib import Path\nfrom typing import Any, Callable, Dict, FrozenSet, List, Optional, Tuple\nfrom urllib.parse import parse_qs, urlencode, urlparse\n\nimport httpx\n\nfrom arcen_cli.config import get_arcen_home, get_config_path, read_raw_config\nfrom arcen_constants import OPENROUTER_BASE_URL, secure_parent_dir\nfrom agent.credential_persistence import sanitize_borrowed_credential_payload\nfrom utils import atomic_replace, atomic_yaml_write, is_truthy_value\n\nlogger = logging.getLogger(__name__)\n\ntry:\n import fcntl\nexcept Exception:\n fcntl = None\ntry:\n import msvcrt\nexcept Exception:\n msvcrt = None\n\n# =============================================================================\n# Constants\n# =============================================================================\n\nAUTH_STORE_VERSION = 1\nAUTH_LOCK_TIMEOUT_SECONDS = 15.0\n\n# Legacy Removed provider Portal constants are kept only for backward-compatible auth-store\n# cleanup helpers. The provider is not registered or offered in Arcen Agent.\nDEFAULT_REMOVED_PROVIDER_PORTAL_URL = \"\"\nDEFAULT_REMOVED_PROVIDER_INFERENCE_URL = \"\"\nDEFAULT_REMOVED_PROVIDER_CLIENT_ID = \"\"\nREMOVED_PROVIDER_INFERENCE_INVOKE_SCOPE = \"inference:invoke\"\nDEFAULT_REMOVED_PROVIDER_SCOPE = \"\"\nREMOVED_PROVIDER_DEVICE_CODE_SOURCE = \"device_code\"\nREMOVED_PROVIDER_AUTH_PATH_INVOKE_JWT = \"invoke_jwt\"\nACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120 # refresh 2 min before expiry\nREMOVED_PROVIDER_INVOKE_JWT_MIN_TTL_SECONDS = ACCESS_TOKEN_REFRESH_SKEW_SECONDS\nDEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS = 1 # poll at most every 1s\nDEFAULT_CODEX_BASE_URL = \"https://chatgpt.com/backend-api/codex\"\nDEFAULT_XAI_OAUTH_BASE_URL = \"https://api.x.ai/v1\"\nMINIMAX_OAUTH_CLIENT_ID = \"78257093-7e40-4613-99e0-527b14b39113\"\nMINIMAX_OAUTH_SCOPE = \"group_id profile model.completion\"\nMINIMAX_OAUTH_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:user_code\"\nMINIMAX_OAUTH_GLOBAL_BASE = \"https://api.minimax.io\"\nMINIMAX_OAUTH_CN_BASE = \"https://api.minimaxi.com\"\nMINIMAX_OAUTH_GLOBAL_INFERENCE = \"https://api.minimax.io/anthropic\"\nMINIMAX_OAUTH_CN_INFERENCE = \"https://api.minimaxi.com/anthropic\"\nMINIMAX_OAUTH_REFRESH_SKEW_SECONDS = 60\nDEFAULT_QWEN_BASE_URL = \"https://portal.qwen.ai/v1\"\nDEFAULT_GITHUB_MODELS_BASE_URL = \"https://api.githubcopilot.com\"\nDEFAULT_COPILOT_ACP_BASE_URL = \"acp://copilot\"\nDEFAULT_OLLAMA_CLOUD_BASE_URL = \"https://ollama.com/v1\"\nSTEPFUN_STEP_PLAN_INTL_BASE_URL = \"https://api.stepfun.ai/step_plan/v1\"\nSTEPFUN_STEP_PLAN_CN_BASE_URL = \"https://api.stepfun.com/step_plan/v1\"\nCODEX_OAUTH_CLIENT_ID = \"app_EMoamEEZ73f0CkXaXp7hrann\"\nCODEX_OAUTH_TOKEN_URL = \"https://auth.openai.com/oauth/token\"\nCODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nXAI_OAUTH_ISSUER = \"https://auth.x.ai\"\nXAI_OAUTH_DISCOVERY_URL = f\"{XAI_OAUTH_ISSUER}/.well-known/openid-configuration\"\nXAI_OAUTH_CLIENT_ID = \"b1a00492-073a-47ea-816f-4c329264a828\"\nXAI_OAUTH_SCOPE = \"openid profile email offline_access grok-cli:access api:access\"\nXAI_OAUTH_REDIRECT_HOST = \"127.0.0.1\"\nXAI_OAUTH_REDIRECT_PORT = 56121\nXAI_OAUTH_REDIRECT_PATH = \"/callback\"\nXAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nQWEN_OAUTH_CLIENT_ID = \"f0304373b74a44d2b584a3fb70ca9e56\"\nQWEN_OAUTH_TOKEN_URL = \"https://chat.qwen.ai/api/v1/oauth2/token\"\nQWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nDEFAULT_SPOTIFY_ACCOUNTS_BASE_URL = \"https://accounts.spotify.com\"\nDEFAULT_SPOTIFY_API_BASE_URL = \"https://api.spotify.com/v1\"\nDEFAULT_SPOTIFY_REDIRECT_URI = \"http://127.0.0.1:43827/spotify/callback\"\nSPOTIFY_DOCS_URL = \"https://arcen-agent.arcenpay.com/docs/user-guide/features/spotify\"\nSPOTIFY_DASHBOARD_URL = \"https://developer.spotify.com/dashboard\"\nSPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\n\nXAI_OAUTH_DOCS_URL = \"https://arcen-agent.arcenpay.com/docs/guides/xai-grok-oauth\"\nOAUTH_OVER_SSH_DOCS_URL = \"https://arcen-agent.arcenpay.com/docs/guides/oauth-over-ssh\"\nDEFAULT_SPOTIFY_SCOPE = \" \".join((\n \"user-modify-playback-state\",\n \"user-read-playback-state\",\n \"user-read-currently-playing\",\n \"user-read-recently-played\",\n \"playlist-read-private\",\n \"playlist-read-collaborative\",\n \"playlist-modify-public\",\n \"playlist-modify-private\",\n \"user-library-read\",\n \"user-library-modify\",\n))\nSERVICE_PROVIDER_NAMES: Dict[str, str] = {\n \"spotify\": \"Spotify\",\n}\n\n# Google Gemini OAuth (google-gemini-cli provider, Cloud Code Assist backend)\nDEFAULT_GEMINI_CLOUDCODE_BASE_URL = \"cloudcode-pa://google\"\nGEMINI_OAUTH_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 60 # refresh 60s before expiry\n\n# LM Studio's default no-auth mode still requires *some* non-empty bearer for\n# the API-key code paths (auxiliary_client, runtime resolver) to treat the\n# provider as configured. This sentinel is sent only to LM Studio, never to\n# any remote service.\nLMSTUDIO_NOAUTH_PLACEHOLDER = \"dummy-lm-api-key\"\n\n\n# =============================================================================\n# Provider Registry\n# =============================================================================\n\n@dataclass\nclass ProviderConfig:\n \"\"\"Describes a known inference provider.\"\"\"\n id: str\n name: str\n auth_type: str # \"oauth_device_code\", \"oauth_external\", \"oauth_minimax\", or \"api_key\"\n portal_base_url: str = \"\"\n inference_base_url: str = \"\"\n client_id: str = \"\"\n scope: str = \"\"\n extra: Dict[str, Any] = field(default_factory=dict)\n # For API-key providers: env vars to check (in priority order)\n api_key_env_vars: tuple = ()\n # Optional env var for base URL override\n base_url_env_var: str = \"\"\n\n\nPROVIDER_REGISTRY: Dict[str, ProviderConfig] = {\n \"openai-codex\": ProviderConfig(\n id=\"openai-codex\",\n name=\"OpenAI Codex\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_CODEX_BASE_URL,\n ),\n \"openai-api\": ProviderConfig(\n id=\"openai-api\",\n name=\"OpenAI API\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.openai.com/v1\",\n api_key_env_vars=(\"OPENAI_API_KEY\",),\n base_url_env_var=\"OPENAI_BASE_URL\",\n ),\n \"xai-oauth\": ProviderConfig(\n id=\"xai-oauth\",\n name=\"xAI Grok OAuth (SuperGrok / Premium+)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_XAI_OAUTH_BASE_URL,\n ),\n \"qwen-oauth\": ProviderConfig(\n id=\"qwen-oauth\",\n name=\"Qwen OAuth\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_QWEN_BASE_URL,\n ),\n \"google-gemini-cli\": ProviderConfig(\n id=\"google-gemini-cli\",\n name=\"Google Gemini (OAuth)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_GEMINI_CLOUDCODE_BASE_URL,\n ),\n \"lmstudio\": ProviderConfig(\n id=\"lmstudio\",\n name=\"LM Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"http://127.0.0.1:1234/v1\",\n api_key_env_vars=(\"LM_API_KEY\",),\n base_url_env_var=\"LM_BASE_URL\",\n ),\n \"copilot\": ProviderConfig(\n id=\"copilot\",\n name=\"GitHub Copilot\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_GITHUB_MODELS_BASE_URL,\n api_key_env_vars=(\"COPILOT_GITHUB_TOKEN\", \"GH_TOKEN\", \"GITHUB_TOKEN\"),\n base_url_env_var=\"COPILOT_API_BASE_URL\",\n ),\n \"copilot-acp\": ProviderConfig(\n id=\"copilot-acp\",\n name=\"GitHub Copilot ACP\",\n auth_type=\"external_process\",\n inference_base_url=DEFAULT_COPILOT_ACP_BASE_URL,\n base_url_env_var=\"COPILOT_ACP_BASE_URL\",\n ),\n \"gemini\": ProviderConfig(\n id=\"gemini\",\n name=\"Google AI Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"https://generativelanguage.googleapis.com/v1beta\",\n api_key_env_vars=(\"GOOGLE_API_KEY\", \"GEMINI_API_KEY\"),\n base_url_env_var=\"GEMINI_BASE_URL\",\n ),\n \"zai\": ProviderConfig(\n id=\"zai\",\n name=\"Z.AI / GLM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.z.ai/api/paas/v4\",\n api_key_env_vars=(\"GLM_API_KEY\", \"ZAI_API_KEY\", \"Z_AI_API_KEY\"),\n base_url_env_var=\"GLM_BASE_URL\",\n ),\n \"kimi-coding\": ProviderConfig(\n id=\"kimi-coding\",\n name=\"Kimi / Moonshot\",\n auth_type=\"api_key\",\n # Legacy platform.moonshot.ai keys use this endpoint (OpenAI-compat).\n # sk-kimi- (Kimi Code) keys are auto-redirected to api.kimi.com/coding\n # by _resolve_kimi_base_url() below.\n inference_base_url=\"https://api.moonshot.ai/v1\",\n api_key_env_vars=(\"KIMI_API_KEY\", \"KIMI_CODING_API_KEY\"),\n base_url_env_var=\"KIMI_BASE_URL\",\n ),\n \"kimi-coding-cn\": ProviderConfig(\n id=\"kimi-coding-cn\",\n name=\"Kimi / Moonshot (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.moonshot.cn/v1\",\n api_key_env_vars=(\"KIMI_CN_API_KEY\",),\n ),\n \"stepfun\": ProviderConfig(\n id=\"stepfun\",\n name=\"StepFun Step Plan\",\n auth_type=\"api_key\",\n inference_base_url=STEPFUN_STEP_PLAN_INTL_BASE_URL,\n api_key_env_vars=(\"STEPFUN_API_KEY\",),\n base_url_env_var=\"STEPFUN_BASE_URL\",\n ),\n \"arcee\": ProviderConfig(\n id=\"arcee\",\n name=\"Arcee AI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.arcee.ai/api/v1\",\n api_key_env_vars=(\"ARCEEAI_API_KEY\",),\n base_url_env_var=\"ARCEE_BASE_URL\",\n ),\n \"gmi\": ProviderConfig(\n id=\"gmi\",\n name=\"GMI Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.gmi-serving.com/v1\",\n api_key_env_vars=(\"GMI_API_KEY\",),\n base_url_env_var=\"GMI_BASE_URL\",\n ),\n \"minimax\": ProviderConfig(\n id=\"minimax\",\n name=\"MiniMax\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimax.io/anthropic\",\n api_key_env_vars=(\"MINIMAX_API_KEY\",),\n base_url_env_var=\"MINIMAX_BASE_URL\",\n ),\n \"minimax-oauth\": ProviderConfig(\n id=\"minimax-oauth\",\n name=\"MiniMax (OAuth \\u00b7 minimax.io)\",\n auth_type=\"oauth_minimax\",\n portal_base_url=MINIMAX_OAUTH_GLOBAL_BASE,\n inference_base_url=MINIMAX_OAUTH_GLOBAL_INFERENCE,\n client_id=MINIMAX_OAUTH_CLIENT_ID,\n scope=MINIMAX_OAUTH_SCOPE,\n extra={\"region\": \"global\", \"cn_portal_base_url\": MINIMAX_OAUTH_CN_BASE,\n \"cn_inference_base_url\": MINIMAX_OAUTH_CN_INFERENCE},\n ),\n \"anthropic\": ProviderConfig(\n id=\"anthropic\",\n name=\"Anthropic\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.anthropic.com\",\n api_key_env_vars=(\"ANTHROPIC_API_KEY\", \"ANTHROPIC_TOKEN\", \"CLAUDE_CODE_OAUTH_TOKEN\"),\n base_url_env_var=\"ANTHROPIC_BASE_URL\",\n ),\n \"alibaba\": ProviderConfig(\n id=\"alibaba\",\n name=\"Qwen Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://dashscope-intl.aliyuncs.com/compatible-mode/v1\",\n api_key_env_vars=(\"DASHSCOPE_API_KEY\",),\n base_url_env_var=\"DASHSCOPE_BASE_URL\",\n ),\n \"alibaba-coding-plan\": ProviderConfig(\n id=\"alibaba-coding-plan\",\n name=\"Alibaba Cloud (Coding Plan)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://coding-intl.dashscope.aliyuncs.com/v1\",\n api_key_env_vars=(\"ALIBABA_CODING_PLAN_API_KEY\", \"DASHSCOPE_API_KEY\"),\n base_url_env_var=\"ALIBABA_CODING_PLAN_BASE_URL\",\n ),\n \"minimax-cn\": ProviderConfig(\n id=\"minimax-cn\",\n name=\"MiniMax (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimaxi.com/anthropic\",\n api_key_env_vars=(\"MINIMAX_CN_API_KEY\",),\n base_url_env_var=\"MINIMAX_CN_BASE_URL\",\n ),\n \"deepseek\": ProviderConfig(\n id=\"deepseek\",\n name=\"DeepSeek\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.deepseek.com/v1\",\n api_key_env_vars=(\"DEEPSEEK_API_KEY\",),\n base_url_env_var=\"DEEPSEEK_BASE_URL\",\n ),\n \"xai\": ProviderConfig(\n id=\"xai\",\n name=\"xAI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.x.ai/v1\",\n api_key_env_vars=(\"XAI_API_KEY\",),\n base_url_env_var=\"XAI_BASE_URL\",\n ),\n \"nvidia\": ProviderConfig(\n id=\"nvidia\",\n name=\"NVIDIA NIM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://integrate.api.nvidia.com/v1\",\n api_key_env_vars=(\"NVIDIA_API_KEY\",),\n base_url_env_var=\"NVIDIA_BASE_URL\",\n ),\n \"opencode-zen\": ProviderConfig(\n id=\"opencode-zen\",\n name=\"OpenCode Zen\",\n auth_type=\"api_key\",\n inference_base_url=\"https://opencode.ai/zen/v1\",\n api_key_env_vars=(\"OPENCODE_ZEN_API_KEY\",),\n base_url_env_var=\"OPENCODE_ZEN_BASE_URL\",\n ),\n \"opencode-go\": ProviderConfig(\n id=\"opencode-go\",\n name=\"OpenCode Go\",\n auth_type=\"api_key\",\n # OpenCode Go mixes API surfaces by model:\n # - GLM / Kimi use OpenAI-compatible chat completions under /v1\n # - MiniMax models use Anthropic Messages under /v1/messages\n # - Qwen 3.7 uses Anthropic Messages under /v1/messages\n # Keep the provider base at /v1 and select api_mode per-model.\n inference_base_url=\"https://opencode.ai/zen/go/v1\",\n api_key_env_vars=(\"OPENCODE_GO_API_KEY\",),\n base_url_env_var=\"OPENCODE_GO_BASE_URL\",\n ),\n \"kilocode\": ProviderConfig(\n id=\"kilocode\",\n name=\"Kilo Code\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.kilo.ai/api/gateway\",\n api_key_env_vars=(\"KILOCODE_API_KEY\",),\n base_url_env_var=\"KILOCODE_BASE_URL\",\n ),\n \"huggingface\": ProviderConfig(\n id=\"huggingface\",\n name=\"Hugging Face\",\n auth_type=\"api_key\",\n inference_base_url=\"https://router.huggingface.co/v1\",\n api_key_env_vars=(\"HF_TOKEN\",),\n base_url_env_var=\"HF_BASE_URL\",\n ),\n \"xiaomi\": ProviderConfig(\n id=\"xiaomi\",\n name=\"Xiaomi MiMo\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.xiaomimimo.com/v1\",\n api_key_env_vars=(\"XIAOMI_API_KEY\",),\n base_url_env_var=\"XIAOMI_BASE_URL\",\n ),\n \"tencent-tokenhub\": ProviderConfig(\n id=\"tencent-tokenhub\",\n name=\"Tencent TokenHub\",\n auth_type=\"api_key\",\n inference_base_url=\"https://tokenhub.tencentmaas.com/v1\",\n api_key_env_vars=(\"TOKENHUB_API_KEY\",),\n base_url_env_var=\"TOKENHUB_BASE_URL\",\n ),\n \"ollama-cloud\": ProviderConfig(\n id=\"ollama-cloud\",\n name=\"Ollama Cloud\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_OLLAMA_CLOUD_BASE_URL,\n api_key_env_vars=(\"OLLAMA_API_KEY\",),\n base_url_env_var=\"OLLAMA_BASE_URL\",\n ),\n \"bedrock\": ProviderConfig(\n id=\"bedrock\",\n name=\"AWS Bedrock\",\n auth_type=\"aws_sdk\",\n inference_base_url=\"https://bedrock-runtime.us-east-1.amazonaws.com\",\n api_key_env_vars=(),\n base_url_env_var=\"BEDROCK_BASE_URL\",\n ),\n \"azure-foundry\": ProviderConfig(\n id=\"azure-foundry\",\n name=\"Azure Foundry\",\n auth_type=\"api_key\",\n inference_base_url=\"\", # User-provided endpoint\n api_key_env_vars=(\"AZURE_FOUNDRY_API_KEY\",),\n base_url_env_var=\"AZURE_FOUNDRY_BASE_URL\",\n ),\n}\n\n# Auto-extend PROVIDER_REGISTRY with any api-key provider registered in\n# providers/ that is not already declared above. New providers only need a\n# plugins/model-providers/<name>/ plugin — no edits to this file required.\ntry:\n from providers import list_providers as _list_providers_for_registry\n for _pp in _list_providers_for_registry():\n if _pp.name in PROVIDER_REGISTRY:\n continue\n if _pp.auth_type != \"api_key\" or not _pp.env_vars:\n continue\n # Skip providers that need custom token resolution or are special-cased\n # in resolve_provider() (copilot/kimi/zai have bespoke token refresh;\n # openrouter/custom are aggregator/user-supplied and handled outside\n # the registry — adding them here breaks runtime_provider resolution\n # that relies on `openrouter not in PROVIDER_REGISTRY`).\n if _pp.name in {\"copilot\", \"kimi-coding\", \"kimi-coding-cn\", \"zai\", \"openrouter\", \"custom\"}:\n continue\n _api_key_vars = tuple(v for v in _pp.env_vars if not v.endswith(\"_BASE_URL\") and not v.endswith(\"_URL\"))\n _base_url_var = next((v for v in _pp.env_vars if v.endswith(\"_BASE_URL\") or v.endswith(\"_URL\")), None)\n PROVIDER_REGISTRY[_pp.name] = ProviderConfig(\n id=_pp.name,\n name=_pp.display_name or _pp.name,\n auth_type=\"api_key\",\n inference_base_url=_pp.base_url,\n api_key_env_vars=_api_key_vars or _pp.env_vars,\n base_url_env_var=_base_url_var or \"\",\n )\n # Also register aliases so resolve_provider() resolves them\n for _alias in _pp.aliases:\n if _alias not in PROVIDER_REGISTRY:\n PROVIDER_REGISTRY[_alias] = PROVIDER_REGISTRY[_pp.name]\nexcept Exception:\n pass\n\n\n# =============================================================================\n# Anthropic Key Helper\n# =============================================================================\n\ndef get_anthropic_key() -> str:\n \"\"\"Return the first usable Anthropic credential, or ``\"\"``.\n\n Checks both the ``.env`` file (via ``get_env_value``) and the process\n environment (``os.getenv``). The fallback order mirrors the\n ``PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars`` tuple:\n\n ANTHROPIC_API_KEY -> ANTHROPIC_TOKEN -> CLAUDE_CODE_OAUTH_TOKEN\n \"\"\"\n from arcen_cli.config import get_env_value\n\n for var in PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars:\n value = get_env_value(var) or os.getenv(var, \"\")\n if value:\n return value\n return \"\"\n\n\n# =============================================================================\n# Kimi Code Endpoint Detection\n# =============================================================================\n\n# Kimi Code (kimi.com/code) issues keys prefixed \"sk-kimi-\" that only work\n# on api.kimi.com/coding. Legacy keys from platform.moonshot.ai work on\n# api.moonshot.ai/v1 (the old default). Auto-detect when user hasn't set\n# KIMI_BASE_URL explicitly.\n#\n# Note: the base URL intentionally has NO /v1 suffix. The /coding endpoint\n# speaks the Anthropic Messages protocol, and the anthropic SDK appends\n# \"/v1/messages\" internally — so \"/coding\" + SDK suffix → \"/coding/v1/messages\"\n# (the correct target). Using \"/coding/v1\" here would produce\n# \"/coding/v1/v1/messages\" (a 404).\nKIMI_CODE_BASE_URL = \"https://api.kimi.com/coding\"\n\n\ndef _resolve_kimi_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Kimi base URL based on the API key prefix.\n\n If the user has explicitly set KIMI_BASE_URL, that always wins.\n Otherwise, sk-kimi- prefixed keys route to api.kimi.com/coding/v1.\n \"\"\"\n if env_override:\n return env_override\n # No key → nothing to infer from. Return default without inspecting.\n if not api_key:\n return default_url\n if api_key.startswith(\"sk-kimi-\"):\n return KIMI_CODE_BASE_URL\n return default_url\n\n\n\n_PLACEHOLDER_SECRET_VALUES = {\n \"*\",\n \"**\",\n \"***\",\n \"changeme\",\n \"your_api_key\",\n \"your_api_key_here\",\n \"your-api-key\",\n \"placeholder\",\n \"example\",\n \"dummy\",\n \"null\",\n \"none\",\n}\n\n\ndef has_usable_secret(value: Any, *, min_length: int = 4) -> bool:\n \"\"\"Return True when a configured secret looks usable, not empty/placeholder.\"\"\"\n if not isinstance(value, str):\n return False\n cleaned = value.strip()\n if len(cleaned) < min_length:\n return False\n if cleaned.lower() in _PLACEHOLDER_SECRET_VALUES:\n return False\n return True\n\n\ndef _resolve_api_key_provider_secret(\n provider_id: str, pconfig: ProviderConfig\n) -> tuple[str, str]:\n \"\"\"Resolve an API-key provider's token and indicate where it came from.\"\"\"\n if provider_id == \"copilot\":\n # Use the dedicated copilot auth module for proper token validation\n try:\n from arcen_cli.copilot_auth import resolve_copilot_token, get_copilot_api_token\n token, source = resolve_copilot_token()\n if token:\n return get_copilot_api_token(token), source\n except ValueError as exc:\n logger.warning(\"Copilot token validation failed: %s\", exc)\n except Exception:\n pass\n return \"\", \"\"\n\n from arcen_cli.config import get_env_value\n for env_var in pconfig.api_key_env_vars:\n # Check both os.environ and ~/.arcen/.env file\n val = (get_env_value(env_var) or \"\").strip()\n if has_usable_secret(val):\n return val, env_var\n\n # Fallback: try credential pool (e.g. zai key stored via auth.json)\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(provider_id)\n if pool and pool.has_credentials():\n entry = pool.peek()\n if entry:\n key = getattr(entry, \"access_token\", \"\") or getattr(entry, \"runtime_api_key\", \"\")\n key = str(key).strip()\n if has_usable_secret(key):\n return key, f\"credential_pool:{provider_id}\"\n except Exception:\n pass\n\n return \"\", \"\"\n\n\n# =============================================================================\n# Z.AI Endpoint Detection\n# =============================================================================\n\n# Z.AI has separate billing for general vs coding plans, and global vs China\n# endpoints. A key that works on one may return \"Insufficient balance\" on\n# another. We probe at setup time and store the working endpoint.\n# Each entry lists candidate models to try in order — newer coding plan accounts\n# may only have access to recent models (glm-5.1, glm-5v-turbo) while older\n# ones still use glm-4.7.\n\nZAI_ENDPOINTS = [\n # (id, base_url, probe_models, label)\n (\"global\", \"https://api.z.ai/api/paas/v4\", [\"glm-5\"], \"Global\"),\n (\"cn\", \"https://open.bigmodel.cn/api/paas/v4\", [\"glm-5\"], \"China\"),\n (\"coding-global\", \"https://api.z.ai/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"Global (Coding Plan)\"),\n (\"coding-cn\", \"https://open.bigmodel.cn/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"China (Coding Plan)\"),\n]\n\n\ndef detect_zai_endpoint(api_key: str, timeout: float = 8.0) -> Optional[Dict[str, str]]:\n \"\"\"Probe z.ai endpoints to find one that accepts this API key.\n\n Returns {\"id\": ..., \"base_url\": ..., \"model\": ..., \"label\": ...} for the\n first working endpoint, or None if all fail. For endpoints with multiple\n candidate models, tries each in order and returns the first that succeeds.\n \"\"\"\n for ep_id, base_url, probe_models, label in ZAI_ENDPOINTS:\n for model in probe_models:\n try:\n resp = httpx.post(\n f\"{base_url}/chat/completions\",\n headers={\n \"Authorization\": f\"Bearer {api_key}\",\n \"Content-Type\": \"application/json\",\n },\n json={\n \"model\": model,\n \"stream\": False,\n \"max_tokens\": 1,\n \"messages\": [{\"role\": \"user\", \"content\": \"ping\"}],\n },\n timeout=timeout,\n )\n if resp.status_code == 200:\n logger.debug(\"Z.AI endpoint probe: %s (%s) model=%s OK\", ep_id, base_url, model)\n return {\n \"id\": ep_id,\n \"base_url\": base_url,\n \"model\": model,\n \"label\": label,\n }\n logger.debug(\"Z.AI endpoint probe: %s model=%s returned %s\", ep_id, model, resp.status_code)\n except Exception as exc:\n logger.debug(\"Z.AI endpoint probe: %s model=%s failed: %s\", ep_id, model, exc)\n return None\n\n\ndef _resolve_zai_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Z.AI base URL by probing endpoints.\n\n If the user has explicitly set GLM_BASE_URL, that always wins.\n Otherwise, probe the candidate endpoints to find one that accepts the\n key. The detected endpoint is cached in provider state (auth.json) keyed\n on a hash of the API key so subsequent starts skip the probe.\n \"\"\"\n if env_override:\n return env_override\n\n # No API key set → don't probe (would fire N×M HTTPS requests with an\n # empty Bearer token, all returning 401). This path is hit during\n # auxiliary-client auto-detection when the user has no Z.AI credentials\n # at all — the caller discards the result immediately, so the probe is\n # pure latency for every AIAgent construction.\n if not api_key:\n return default_url\n\n # Check provider-state cache for a previously-detected endpoint.\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"zai\") or {}\n cached = state.get(\"detected_endpoint\")\n if isinstance(cached, dict) and cached.get(\"base_url\"):\n key_hash = cached.get(\"key_hash\", \"\")\n if key_hash == hashlib.sha256(api_key.encode()).hexdigest()[:16]:\n logger.debug(\"Z.AI: using cached endpoint %s\", cached[\"base_url\"])\n return cached[\"base_url\"]\n\n # Probe — may take up to ~8s per endpoint.\n detected = detect_zai_endpoint(api_key)\n if detected and detected.get(\"base_url\"):\n # Persist the detection result keyed on the API key hash.\n key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:16]\n state[\"detected_endpoint\"] = {\n \"base_url\": detected[\"base_url\"],\n \"endpoint_id\": detected.get(\"id\", \"\"),\n \"model\": detected.get(\"model\", \"\"),\n \"label\": detected.get(\"label\", \"\"),\n \"key_hash\": key_hash,\n }\n _save_provider_state(auth_store, \"zai\", state)\n logger.info(\"Z.AI: auto-detected endpoint %s (%s)\", detected[\"label\"], detected[\"base_url\"])\n return detected[\"base_url\"]\n\n logger.debug(\"Z.AI: probe failed, falling back to default %s\", default_url)\n return default_url\n\n\n# =============================================================================\n# Error Types\n# =============================================================================\n\n# Error code marking upstream rate-limit / usage-quota exhaustion (HTTP 429).\n# Such failures are transient and re-authenticating cannot resolve them, so\n# they must be kept distinct from missing/expired-credential errors.\nCODEX_RATE_LIMITED_CODE = \"codex_rate_limited\"\n\n\nclass AuthError(RuntimeError):\n \"\"\"Structured auth error with UX mapping hints.\"\"\"\n\n def __init__(\n self,\n message: str,\n *,\n provider: str = \"\",\n code: Optional[str] = None,\n relogin_required: bool = False,\n ) -> None:\n super().__init__(message)\n self.provider = provider\n self.code = code\n self.relogin_required = relogin_required\n\n\ndef is_rate_limited_auth_error(error: Exception) -> bool:\n \"\"\"True when an :class:`AuthError` represents upstream rate-limiting / quota\n exhaustion rather than missing or invalid credentials.\n\n These failures are transient — re-authenticating cannot resolve them — so\n callers should surface a \"retry later\" notice and prefer a fallback chain\n instead of prompting the operator to run ``arcen auth``.\n \"\"\"\n return (\n isinstance(error, AuthError)\n and not error.relogin_required\n and error.code == CODEX_RATE_LIMITED_CODE\n )\n\n\ndef _parse_retry_after_seconds(headers: Any) -> Optional[int]:\n \"\"\"Best-effort parse of a ``Retry-After`` header into whole seconds.\n\n Supports the delta-seconds form (e.g. ``\"120\"``). HTTP-date forms and\n missing/unparseable values return ``None`` rather than guessing.\n \"\"\"\n if headers is None:\n return None\n try:\n raw = headers.get(\"retry-after\")\n except Exception:\n return None\n if raw is None:\n return None\n try:\n seconds = int(str(raw).strip())\n except (TypeError, ValueError):\n return None\n return seconds if seconds >= 0 else None\n\n\ndef format_auth_error(error: Exception) -> str:\n \"\"\"Map auth failures to concise user-facing guidance.\"\"\"\n if not isinstance(error, AuthError):\n return str(error)\n\n # Rate-limit / quota errors are not credential problems — never append the\n # \"re-authenticate\" remediation, which would mislead the operator.\n if is_rate_limited_auth_error(error):\n return str(error)\n\n if error.relogin_required:\n return f\"{error} Run `arcen model` to re-authenticate.\"\n\n if error.code == \"subscription_required\":\n if error.provider == \"removed_provider\":\n return _format_removed_provider_entitlement_auth_error(error)\n return \"No active paid subscription found. Please purchase/activate a subscription, then retry.\"\n\n if error.code == \"insufficient_credits\":\n if error.provider == \"removed_provider\":\n return _format_removed_provider_entitlement_auth_error(error)\n return \"Subscription credits are exhausted. Top up/renew credits, then retry.\"\n\n if error.code in {\"subscription_expired\", \"no_usable_credits\", \"account_missing\"}:\n if error.provider == \"removed_provider\":\n return _format_removed_provider_entitlement_auth_error(error)\n\n if error.code == \"temporarily_unavailable\":\n return f\"{error} Please retry in a few seconds.\"\n\n return str(error)\n\n\ndef _format_removed_provider_entitlement_auth_error(error: AuthError) -> str:\n try:\n from arcen_cli.removed_provider_account import (\n format_removed_provider_portal_entitlement_message,\n get_removed_provider_portal_account_info,\n )\n\n account_info = get_removed_provider_portal_account_info(force_fresh=True)\n message = format_removed_provider_portal_entitlement_message(\n account_info,\n capability=\"Removed provider model access\",\n )\n if message:\n return message\n except Exception:\n pass\n return f\"{error} Check credits or billing in Removed provider Portal, then retry.\"\n\n\ndef _token_fingerprint(token: Any) -> Optional[str]:\n \"\"\"Return a short hash fingerprint for telemetry without leaking token bytes.\"\"\"\n if not isinstance(token, str):\n return None\n cleaned = token.strip()\n if not cleaned:\n return None\n return hashlib.sha256(cleaned.encode(\"utf-8\")).hexdigest()[:12]\n\n\ndef _oauth_trace_enabled() -> bool:\n raw = os.getenv(\"ARCEN_OAUTH_TRACE\", \"\").strip().lower()\n return raw in {\"1\", \"true\", \"yes\", \"on\"}\n\n\ndef _oauth_trace(event: str, *, sequence_id: Optional[str] = None, **fields: Any) -> None:\n if not _oauth_trace_enabled():\n return\n payload: Dict[str, Any] = {\"event\": event}\n if sequence_id:\n payload[\"sequence_id\"] = sequence_id\n payload.update(fields)\n logger.info(\"oauth_trace %s\", json.dumps(payload, sort_keys=True, ensure_ascii=False))\n\n\n# =============================================================================\n# Auth Store — persistence layer for ~/.arcen/auth.json\n# =============================================================================\n\ndef _auth_file_path() -> Path:\n path = get_arcen_home() / \"auth.json\"\n # Seat belt: if pytest is running and ARCEN_HOME resolves to the real\n # user's auth store, refuse rather than silently corrupt it. This catches\n # tests that forgot to monkeypatch ARCEN_HOME, tests invoked without the\n # hermetic conftest, or sandbox escapes via threads/subprocesses. In\n # production (no PYTEST_CURRENT_TEST) this is a single dict lookup.\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_auth = (Path.home() / \".arcen\" / \"auth.json\").resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_auth:\n raise RuntimeError(\n f\"Refusing to touch real user auth store during test run: {path}. \"\n \"Set ARCEN_HOME to a tmp_path in your test fixture, or run \"\n \"via scripts/run_tests.sh for hermetic CI-parity env.\"\n )\n return path\n\n\ndef _global_auth_file_path() -> Optional[Path]:\n \"\"\"Return the global-root auth.json when the process is in profile mode.\n\n Returns ``None`` when the profile and global root resolve to the same\n directory (classic mode, or custom ARCEN_HOME that is not a profile).\n Used by read-only fallback paths so providers authed at the root are\n visible to profile processes that haven't configured them locally.\n\n See issue #18594 follow-up (credential_pool shadowing).\n \"\"\"\n try:\n from arcen_constants import get_default_arcen_root\n global_root = get_default_arcen_root()\n except Exception:\n return None\n profile_home = get_arcen_home()\n try:\n if profile_home.resolve(strict=False) == global_root.resolve(strict=False):\n return None\n except Exception:\n if profile_home == global_root:\n return None\n # No pytest seat belt here: this is a pure read-only path, and\n # ``_load_global_auth_store()`` wraps the read in a try/except so an\n # unreadable global file can never break the profile process. The\n # write-side seat belt still lives on ``_auth_file_path()`` where it\n # belongs (that's what protects the real user's auth store from being\n # corrupted by a mis-configured test).\n return global_root / \"auth.json\"\n\n\ndef _load_global_auth_store() -> Dict[str, Any]:\n \"\"\"Load the global-root auth store (read-only fallback).\n\n Returns an empty dict when no global fallback exists (classic mode,\n or the global auth.json is absent). Never raises on missing file.\n\n Seat belt: under pytest, refuses to read the real user's\n ``~/.arcen/auth.json`` even when ARCEN_HOME is set to a profile\n path. The hermetic conftest does not redirect ``HOME``, so\n ``get_default_arcen_root()`` for a profile-shaped ARCEN_HOME can\n still resolve to the real user's home on a dev machine. That would\n leak real credentials into tests. This guard uses the unmodified\n ``HOME`` env var (what ``os.path.expanduser('~')`` would resolve to),\n not ``Path.home()``, because ``Path.home`` is sometimes monkeypatched\n by fixtures that want to relocate the global root to a tmp path.\n \"\"\"\n global_path = _global_auth_file_path()\n if global_path is None or not global_path.exists():\n return {}\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_env = os.environ.get(\"HOME\", \"\")\n if real_home_env:\n real_root = Path(real_home_env) / \".arcen\" / \"auth.json\"\n try:\n if global_path.resolve(strict=False) == real_root.resolve(strict=False):\n return {}\n except Exception:\n pass\n try:\n return _load_auth_store(global_path)\n except Exception:\n # A malformed global store must not break profile reads. The\n # profile's own auth store is still authoritative.\n return {}\n\n\ndef _auth_lock_path() -> Path:\n return _auth_file_path().with_suffix(\".lock\")\n\n\n_auth_lock_holder = threading.local()\n\n\n@contextmanager\ndef _file_lock(\n lock_path: Path,\n holder: threading.local,\n timeout_seconds: float,\n timeout_message: str,\n):\n \"\"\"Cross-process advisory flock helper.\n\n Reentrant per-thread via ``holder.depth``. Falls back to a depth-only\n guard when neither ``fcntl`` nor ``msvcrt`` is available (rare).\n Callers supply their own ``threading.local`` so independent locks\n (e.g. profile auth.json vs shared Removed provider store) don't share reentrancy\n state — that would let one lock's reentrant acquisition silently skip\n the other's kernel-level flock.\n \"\"\"\n if getattr(holder, \"depth\", 0) > 0:\n holder.depth += 1\n try:\n yield\n finally:\n holder.depth -= 1\n return\n\n lock_path.parent.mkdir(parents=True, exist_ok=True)\n\n if fcntl is None and msvcrt is None:\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n return\n\n # On Windows, msvcrt.locking needs the file to have content and the\n # file pointer at position 0. Ensure the lock file has at least 1 byte.\n if msvcrt and (not lock_path.exists() or lock_path.stat().st_size == 0):\n lock_path.write_text(\" \", encoding=\"utf-8\")\n\n with lock_path.open(\"r+\" if msvcrt else \"a+\", encoding=\"utf-8\") as lock_file:\n deadline = time.monotonic() + max(1.0, timeout_seconds)\n while True:\n try:\n if fcntl:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)\n else:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_NBLCK, 1)\n break\n except (BlockingIOError, OSError, PermissionError):\n if time.monotonic() >= deadline:\n raise TimeoutError(timeout_message)\n time.sleep(0.05)\n\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n if fcntl:\n try:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_UN)\n except (OSError, IOError):\n pass\n elif msvcrt:\n try:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_UNLCK, 1)\n except (OSError, IOError):\n pass\n\n\n@contextmanager\ndef _auth_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-process advisory lock for auth.json reads+writes. Reentrant.\n\n Lock ordering invariant: when this lock is held together with\n ``_removed_provider_shared_store_lock``, acquire ``_auth_store_lock`` FIRST\n (outer) and the shared Removed provider lock SECOND (inner). All runtime\n refresh paths follow this order; violating it risks deadlock\n against a concurrent import on the shared store.\n \"\"\"\n with _file_lock(\n _auth_lock_path(),\n _auth_lock_holder,\n timeout_seconds,\n \"Timed out waiting for auth store lock\",\n ):\n yield\n\n\ndef _load_auth_store(auth_file: Optional[Path] = None) -> Dict[str, Any]:\n auth_file = auth_file or _auth_file_path()\n if not auth_file.exists():\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n try:\n raw = json.loads(auth_file.read_text())\n except Exception as exc:\n corrupt_path = auth_file.with_suffix(\".json.corrupt\")\n try:\n import shutil\n shutil.copy2(auth_file, corrupt_path)\n except Exception:\n pass\n logger.warning(\n \"auth: failed to parse %s (%s) — starting with empty store. \"\n \"Corrupt file preserved at %s\",\n auth_file, exc, corrupt_path,\n )\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n if isinstance(raw, dict) and (\n isinstance(raw.get(\"providers\"), dict)\n or isinstance(raw.get(\"credential_pool\"), dict)\n ):\n raw.setdefault(\"providers\", {})\n return raw\n\n # Migrate from PR's \"systems\" format if present\n if isinstance(raw, dict) and isinstance(raw.get(\"systems\"), dict):\n systems = raw[\"systems\"]\n providers = {}\n if \"removed_provider_portal\" in systems:\n providers[\"removed_provider\"] = systems[\"removed_provider_portal\"]\n return {\"version\": AUTH_STORE_VERSION, \"providers\": providers,\n \"active_provider\": \"removed_provider\" if providers else None}\n\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n\ndef _save_auth_store(auth_store: Dict[str, Any]) -> Path:\n auth_file = _auth_file_path()\n auth_file.parent.mkdir(parents=True, exist_ok=True)\n # Tighten parent dir to 0o700 so siblings can't traverse to creds.\n # No-op on Windows (POSIX mode bits not enforced); ignore failures.\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_file)\n auth_store[\"version\"] = AUTH_STORE_VERSION\n auth_store[\"updated_at\"] = datetime.now(timezone.utc).isoformat()\n payload = json.dumps(auth_store, indent=2) + \"\\n\"\n tmp_path = auth_file.with_name(f\"{auth_file.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n try:\n # Create with 0o600 atomically via os.open(O_EXCL) + fdopen to close\n # the TOCTOU window where default umask (often 0o644) briefly exposed\n # OAuth tokens to other local users between open() and chmod().\n # Mirrors agent/google_oauth.py (#19673) and tools/mcp_oauth.py (#21148).\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as handle:\n handle.write(payload)\n handle.flush()\n os.fsync(handle.fileno())\n atomic_replace(tmp_path, auth_file)\n try:\n dir_fd = os.open(str(auth_file.parent), os.O_RDONLY)\n except OSError:\n dir_fd = None\n if dir_fd is not None:\n try:\n os.fsync(dir_fd)\n finally:\n os.close(dir_fd)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n # Restrict file permissions to owner only\n try:\n auth_file.chmod(stat.S_IRUSR | stat.S_IWUSR)\n except OSError:\n pass\n return auth_file\n\n\ndef _load_provider_state(auth_store: Dict[str, Any], provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return a provider's persisted state.\n\n In profile mode, falls back to the global-root ``auth.json`` when the\n profile has no entry for ``provider_id``. This mirrors the per-provider\n shadowing already used by ``read_credential_pool``: workers spawned in a\n profile can see providers (e.g. ``removed_provider``) that were only authenticated at\n global scope. Once the user runs ``arcen auth login <provider>`` inside\n the profile, the profile state fully shadows the global state on the next\n read. See issue #18594 follow-up.\n \"\"\"\n providers = auth_store.get(\"providers\")\n if isinstance(providers, dict):\n state = providers.get(provider_id)\n if isinstance(state, dict):\n return dict(state)\n\n # Read-only fallback to the global-root auth store (profile mode only;\n # returns empty dict in classic mode so this is a no-op).\n global_store = _load_global_auth_store()\n if global_store:\n global_providers = global_store.get(\"providers\")\n if isinstance(global_providers, dict):\n global_state = global_providers.get(provider_id)\n if isinstance(global_state, dict):\n return dict(global_state)\n return None\n\n\ndef _save_provider_state(auth_store: Dict[str, Any], provider_id: str, state: Dict[str, Any]) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n auth_store[\"active_provider\"] = provider_id\n\n\ndef _store_provider_state(\n auth_store: Dict[str, Any],\n provider_id: str,\n state: Dict[str, Any],\n *,\n set_active: bool = True,\n) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n if set_active:\n auth_store[\"active_provider\"] = provider_id\n\n\ndef is_known_auth_provider(provider_id: str) -> bool:\n normalized = (provider_id or \"\").strip().lower()\n return normalized in PROVIDER_REGISTRY or normalized in SERVICE_PROVIDER_NAMES\n\n\ndef get_auth_provider_display_name(provider_id: str) -> str:\n normalized = (provider_id or \"\").strip().lower()\n if normalized in PROVIDER_REGISTRY:\n return PROVIDER_REGISTRY[normalized].name\n return SERVICE_PROVIDER_NAMES.get(normalized, provider_id)\n\n\ndef read_credential_pool(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Return the persisted credential pool, or one provider slice.\n\n In profile mode, the profile's credential pool is authoritative. If a\n provider has no entries in the profile, entries from the global-root\n ``auth.json`` are used as a read-only fallback — so workers spawned in a\n profile can see providers that were only authenticated at global scope.\n\n Profile entries always win: the global fallback only applies per-provider\n when the profile has zero entries for that provider. Once the user runs\n ``arcen auth add <provider>`` inside the profile, profile entries\n fully shadow global for that provider on the next read.\n\n Writes always go to the profile (``write_credential_pool`` is unchanged).\n See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n\n global_pool: Dict[str, Any] = {}\n global_store = _load_global_auth_store()\n maybe_global_pool = global_store.get(\"credential_pool\") if global_store else None\n if isinstance(maybe_global_pool, dict):\n global_pool = maybe_global_pool\n\n if provider_id is None:\n merged = dict(pool)\n for gp_key, gp_entries in global_pool.items():\n if not isinstance(gp_entries, list) or not gp_entries:\n continue\n # Per-provider shadowing: profile wins whenever it has ANY entries.\n existing = merged.get(gp_key)\n if isinstance(existing, list) and existing:\n continue\n merged[gp_key] = list(gp_entries)\n return merged\n\n provider_entries = pool.get(provider_id)\n if isinstance(provider_entries, list) and provider_entries:\n return list(provider_entries)\n # Profile has no entries for this provider — fall back to global.\n global_entries = global_pool.get(provider_id)\n return list(global_entries) if isinstance(global_entries, list) else []\n\n\ndef write_credential_pool(provider_id: str, entries: List[Dict[str, Any]]) -> Path:\n \"\"\"Persist one provider's credential pool under auth.json.\n\n This is the final disk-boundary guard for borrowed/reference-only\n credentials. Callers may pass raw dictionaries, so sanitize here even when\n ``PooledCredential.to_dict()`` already did the same work upstream.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n pool[provider_id] = [\n sanitize_borrowed_credential_payload(entry, provider_id)\n if isinstance(entry, dict) else entry\n for entry in entries\n ]\n return _save_auth_store(auth_store)\n\n\ndef suppress_credential_source(provider_id: str, source: str) -> None:\n \"\"\"Mark a credential source as suppressed so it won't be re-seeded.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.setdefault(\"suppressed_sources\", {})\n provider_list = suppressed.setdefault(provider_id, [])\n if source not in provider_list:\n provider_list.append(source)\n _save_auth_store(auth_store)\n\n\ndef is_source_suppressed(provider_id: str, source: str) -> bool:\n \"\"\"Check if a credential source has been suppressed by the user.\"\"\"\n try:\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\", {})\n return source in suppressed.get(provider_id, [])\n except Exception:\n return False\n\n\ndef unsuppress_credential_source(provider_id: str, source: str) -> bool:\n \"\"\"Clear a suppression marker so the source will be re-seeded on the next load.\n\n Returns True if a marker was cleared, False if no marker existed.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\")\n if not isinstance(suppressed, dict):\n return False\n provider_list = suppressed.get(provider_id)\n if not isinstance(provider_list, list) or source not in provider_list:\n return False\n provider_list.remove(source)\n if not provider_list:\n suppressed.pop(provider_id, None)\n if not suppressed:\n auth_store.pop(\"suppressed_sources\", None)\n _save_auth_store(auth_store)\n return True\n\n\ndef get_provider_auth_state(provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return persisted auth state for a provider, or None.\n\n In profile mode, ``_load_provider_state`` already falls back to the\n global-root ``auth.json`` per-provider when the profile has no entry —\n so this is now a thin convenience wrapper. Profile state always wins\n when present. Writes (``_save_auth_store`` / ``persist_*_credentials``)\n are unchanged — they still target the profile only. This mirrors\n ``read_credential_pool``'s per-provider shadowing semantics so that\n ``_seed_from_singletons`` can reseed a profile's credential pool from\n global-scope provider state (e.g. a globally-authenticated Anthropic\n OAuth or Removed provider device-code session). See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n return _load_provider_state(auth_store, provider_id)\n\n\ndef get_active_provider() -> Optional[str]:\n \"\"\"Return the currently active provider ID from auth store.\"\"\"\n auth_store = _load_auth_store()\n return auth_store.get(\"active_provider\")\n\n\ndef is_provider_explicitly_configured(provider_id: str) -> bool:\n \"\"\"Return True only if the user has explicitly configured this provider.\n\n Checks:\n 1. active_provider in auth.json matches\n 2. model.provider in config.yaml matches\n 3. Provider-specific env vars are set (e.g. ANTHROPIC_API_KEY)\n\n This is used to gate auto-discovery of external credentials (e.g.\n Claude Code's ~/.claude/.credentials.json) so they are never used\n without the user's explicit choice. See PR #4210 for the same\n pattern applied to the setup wizard gate.\n \"\"\"\n normalized = (provider_id or \"\").strip().lower()\n\n # 1. Check auth.json active_provider\n try:\n auth_store = _load_auth_store()\n active = (auth_store.get(\"active_provider\") or \"\").strip().lower()\n if active and active == normalized:\n return True\n except Exception:\n pass\n\n # 2. Check config.yaml model.provider\n try:\n from arcen_cli.config import load_config\n cfg = load_config()\n model_cfg = cfg.get(\"model\")\n if isinstance(model_cfg, dict):\n cfg_provider = (model_cfg.get(\"provider\") or \"\").strip().lower()\n if cfg_provider == normalized:\n return True\n except Exception:\n pass\n\n # 3. Check provider-specific env vars\n # Exclude CLAUDE_CODE_OAUTH_TOKEN — it's set by Claude Code itself,\n # not by the user explicitly configuring anthropic in Arcen.\n _IMPLICIT_ENV_VARS = {\"CLAUDE_CODE_OAUTH_TOKEN\"}\n pconfig = PROVIDER_REGISTRY.get(normalized)\n if pconfig and pconfig.auth_type == \"api_key\":\n for env_var in pconfig.api_key_env_vars:\n if env_var in _IMPLICIT_ENV_VARS:\n continue\n if has_usable_secret(os.getenv(env_var, \"\")):\n return True\n\n return False\n\n\ndef clear_provider_auth(provider_id: Optional[str] = None) -> bool:\n \"\"\"\n Clear auth state for a provider. Used by `arcen logout`.\n If provider_id is None, clears the active provider.\n Returns True if something was cleared.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n target = provider_id or auth_store.get(\"active_provider\")\n if not target:\n return False\n\n providers = auth_store.get(\"providers\", {})\n if not isinstance(providers, dict):\n providers = {}\n auth_store[\"providers\"] = providers\n\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n\n cleared = False\n if target in providers:\n del providers[target]\n cleared = True\n if target in pool:\n del pool[target]\n cleared = True\n\n if auth_store.get(\"active_provider\") == target:\n auth_store[\"active_provider\"] = None\n cleared = True\n\n if not cleared:\n return False\n _save_auth_store(auth_store)\n return True\n\n\ndef deactivate_provider() -> None:\n \"\"\"\n Clear active_provider in auth.json without deleting credentials.\n Used when the user switches to a non-OAuth provider (OpenRouter, custom)\n so auto-resolution doesn't keep picking the OAuth provider.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = None\n _save_auth_store(auth_store)\n\n\n# =============================================================================\n# Provider Resolution — picks which provider to use\n# =============================================================================\n\n\ndef _get_config_hint_for_unknown_provider(provider_name: str) -> str:\n \"\"\"Return a helpful hint string when provider resolution fails.\n\n Checks for common config.yaml mistakes (malformed custom_providers, etc.)\n and returns a human-readable diagnostic, or empty string if nothing found.\n \"\"\"\n try:\n from arcen_cli.config import validate_config_structure\n issues = validate_config_structure()\n if not issues:\n return \"\"\n\n lines = [\"Config issue detected — run 'arcen doctor' for full diagnostics:\"]\n for ci in issues:\n prefix = \"ERROR\" if ci.severity == \"error\" else \"WARNING\"\n lines.append(f\" [{prefix}] {ci.message}\")\n # Show first line of hint\n first_hint = ci.hint.splitlines()[0] if ci.hint else \"\"\n if first_hint:\n lines.append(f\" → {first_hint}\")\n return \"\\n\".join(lines)\n except Exception:\n return \"\"\n\n\ndef resolve_provider(\n requested: Optional[str] = None,\n *,\n explicit_api_key: Optional[str] = None,\n explicit_base_url: Optional[str] = None,\n) -> str:\n \"\"\"\n Determine which inference provider to use.\n\n Priority (when requested=\"auto\" or None):\n 1. active_provider in auth.json with valid credentials\n 2. Explicit CLI api_key/base_url -> \"openrouter\"\n 3. OPENAI_API_KEY or OPENROUTER_API_KEY env vars -> \"openrouter\"\n 4. Provider-specific API keys (GLM, Kimi, MiniMax) -> that provider\n 5. Fallback: \"openrouter\"\n \"\"\"\n normalized = (requested or \"auto\").strip().lower()\n\n # Normalize provider aliases\n _PROVIDER_ALIASES = {\n \"glm\": \"zai\", \"z-ai\": \"zai\", \"z.ai\": \"zai\", \"zhipu\": \"zai\",\n \"google\": \"gemini\", \"google-gemini\": \"gemini\", \"google-ai-studio\": \"gemini\",\n \"x-ai\": \"xai\", \"x.ai\": \"xai\", \"grok\": \"xai\",\n \"xai-oauth\": \"xai-oauth\", \"x-ai-oauth\": \"xai-oauth\",\n \"grok-oauth\": \"xai-oauth\", \"xai-grok-oauth\": \"xai-oauth\",\n \"kimi\": \"kimi-coding\", \"kimi-for-coding\": \"kimi-coding\", \"moonshot\": \"kimi-coding\",\n \"kimi-cn\": \"kimi-coding-cn\", \"moonshot-cn\": \"kimi-coding-cn\",\n \"step\": \"stepfun\", \"stepfun-coding-plan\": \"stepfun\",\n \"arcee-ai\": \"arcee\", \"arceeai\": \"arcee\",\n \"gmi-cloud\": \"gmi\", \"gmicloud\": \"gmi\",\n \"minimax-china\": \"minimax-cn\", \"minimax_cn\": \"minimax-cn\",\n \"minimax-portal\": \"minimax-oauth\", \"minimax-global\": \"minimax-oauth\", \"minimax_oauth\": \"minimax-oauth\",\n \"alibaba_coding\": \"alibaba-coding-plan\", \"alibaba-coding\": \"alibaba-coding-plan\",\n \"alibaba_coding_plan\": \"alibaba-coding-plan\",\n \"claude\": \"anthropic\", \"claude-code\": \"anthropic\",\n \"github\": \"copilot\", \"github-copilot\": \"copilot\",\n \"github-models\": \"copilot\", \"github-model\": \"copilot\",\n \"github-copilot-acp\": \"copilot-acp\", \"copilot-acp-agent\": \"copilot-acp\",\n \"opencode\": \"opencode-zen\", \"zen\": \"opencode-zen\",\n \"qwen-portal\": \"qwen-oauth\", \"qwen-cli\": \"qwen-oauth\", \"qwen-oauth\": \"qwen-oauth\", \"google-gemini-cli\": \"google-gemini-cli\", \"gemini-cli\": \"google-gemini-cli\", \"gemini-oauth\": \"google-gemini-cli\",\n \"hf\": \"huggingface\", \"hugging-face\": \"huggingface\", \"huggingface-hub\": \"huggingface\",\n \"mimo\": \"xiaomi\", \"xiaomi-mimo\": \"xiaomi\",\n \"tencent\": \"tencent-tokenhub\", \"tokenhub\": \"tencent-tokenhub\",\n \"tencent-cloud\": \"tencent-tokenhub\", \"tencentmaas\": \"tencent-tokenhub\",\n \"aws\": \"bedrock\", \"aws-bedrock\": \"bedrock\", \"amazon-bedrock\": \"bedrock\", \"amazon\": \"bedrock\",\n \"go\": \"opencode-go\", \"opencode-go-sub\": \"opencode-go\",\n \"kilo\": \"kilocode\", \"kilo-code\": \"kilocode\", \"kilo-gateway\": \"kilocode\",\n \"lmstudio\": \"lmstudio\", \"lm-studio\": \"lmstudio\", \"lm_studio\": \"lmstudio\",\n # Local server aliases — route through the generic custom provider\n \"ollama\": \"custom\", \"ollama_cloud\": \"ollama-cloud\",\n \"vllm\": \"custom\", \"llamacpp\": \"custom\",\n \"llama.cpp\": \"custom\", \"llama-cpp\": \"custom\",\n }\n # Extend with aliases declared in plugins/model-providers/<name>/ that aren't already mapped.\n # This keeps providers/ as the single source for new aliases while the\n # hardcoded dict above remains authoritative for existing ones.\n try:\n from providers import list_providers as _lp\n for _pp in _lp():\n for _alias in _pp.aliases:\n if _alias not in _PROVIDER_ALIASES:\n _PROVIDER_ALIASES[_alias] = _pp.name\n except Exception:\n pass\n normalized = _PROVIDER_ALIASES.get(normalized, normalized)\n\n if normalized == \"openrouter\":\n return \"openrouter\"\n if normalized == \"custom\":\n return \"custom\"\n if normalized in PROVIDER_REGISTRY:\n return normalized\n if normalized != \"auto\":\n # Check for common config.yaml issues that cause this error\n _config_hint = _get_config_hint_for_unknown_provider(normalized)\n msg = f\"Unknown provider '{normalized}'.\"\n if _config_hint:\n msg += f\"\\n\\n{_config_hint}\"\n else:\n msg += \" Check 'arcen model' for available providers, or run 'arcen doctor' to diagnose config issues.\"\n raise AuthError(msg, code=\"invalid_provider\")\n\n # Explicit one-off CLI creds always mean openrouter/custom\n if explicit_api_key or explicit_base_url:\n return \"openrouter\"\n\n # Check auth store for an active OAuth provider\n try:\n auth_store = _load_auth_store()\n active = auth_store.get(\"active_provider\")\n if active and active in PROVIDER_REGISTRY:\n status = get_auth_status(active)\n if status.get(\"logged_in\"):\n return active\n except Exception as e:\n logger.debug(\"Could not detect active auth provider: %s\", e)\n\n if has_usable_secret(os.getenv(\"OPENAI_API_KEY\")) or has_usable_secret(os.getenv(\"OPENROUTER_API_KEY\")):\n return \"openrouter\"\n\n # Auto-detect API-key providers by checking their env vars\n for pid, pconfig in PROVIDER_REGISTRY.items():\n if pconfig.auth_type != \"api_key\":\n continue\n # GitHub tokens are commonly present for repo/tool access but should not\n # hijack inference auto-selection unless the user explicitly chooses\n # Copilot/GitHub Models as the provider. LM Studio is a local server\n # whose availability isn't implied by LM_API_KEY presence (it may be\n # offline, and the no-auth setup uses a placeholder value), so it\n # also requires explicit selection.\n if pid in {\"copilot\", \"lmstudio\"}:\n continue\n for env_var in pconfig.api_key_env_vars:\n if has_usable_secret(os.getenv(env_var, \"\")):\n return pid\n\n # AWS Bedrock — detect via boto3 credential chain (IAM roles, SSO, env vars).\n # This runs after API-key providers so explicit keys always win.\n try:\n from agent.bedrock_adapter import has_aws_credentials\n if has_aws_credentials():\n return \"bedrock\"\n except ImportError:\n pass # boto3 not installed — skip Bedrock auto-detection\n\n raise AuthError(\n \"No inference provider configured. Run 'arcen model' to choose a \"\n \"provider and model, or set an API key (OPENROUTER_API_KEY, \"\n \"OPENAI_API_KEY, etc.) in ~/.arcen/.env.\",\n code=\"no_provider_configured\",\n )\n\n\n# =============================================================================\n# Timestamp / TTL helpers\n# =============================================================================\n\ndef _parse_iso_timestamp(value: Any) -> Optional[float]:\n if not isinstance(value, str) or not value:\n return None\n text = value.strip()\n if not text:\n return None\n if text.endswith(\"Z\"):\n text = text[:-1] + \"+00:00\"\n try:\n parsed = datetime.fromisoformat(text)\n except Exception:\n return None\n if parsed.tzinfo is None:\n parsed = parsed.replace(tzinfo=timezone.utc)\n return parsed.timestamp()\n\n\ndef _is_expiring(expires_at_iso: Any, skew_seconds: int) -> bool:\n expires_epoch = _parse_iso_timestamp(expires_at_iso)\n if expires_epoch is None:\n return True\n return expires_epoch <= (time.time() + skew_seconds)\n\n\ndef _coerce_ttl_seconds(expires_in: Any) -> int:\n try:\n ttl = int(expires_in)\n except Exception:\n ttl = 0\n return max(0, ttl)\n\n\ndef _optional_base_url(value: Any) -> Optional[str]:\n if not isinstance(value, str):\n return None\n cleaned = value.strip().rstrip(\"/\")\n return cleaned if cleaned else None\n\n\n# Allowlist of hosts the Removed provider Portal proxy is willing to forward inference\n# JWTs to. Sending a bearer anywhere else would leak it.\n#\n# This is consulted only for URLs coming from the NETWORK side (Portal\n# refresh responses). User-controlled env-var overrides\n# (REMOVED_PROVIDER_INFERENCE_BASE_URL) bypass validation — that's the documented\n# dev/staging escape hatch and the env source is already trusted (the\n# user set it themselves).\n_ALLOWED_REMOVED_PROVIDER_INFERENCE_HOSTS: FrozenSet[str] = frozenset({\n \"\",\n})\n\n\ndef _validate_removed_provider_inference_url_from_network(url: Optional[str]) -> Optional[str]:\n \"\"\"Validate a Portal-returned inference URL against the host allowlist.\n\n Returns ``url`` (normalised by stripping trailing slashes) if it's a\n well-formed ``https://<allowlisted-host>/...`` URL. Returns ``None``\n if the URL is missing, malformed, non-https, or points at an\n unexpected host — letting the caller fall back to the configured\n default rather than persist or forward a poisoned value.\n\n Defense-in-depth: a compromised refresh response from the Portal API\n (MITM, malicious response injection) could otherwise redirect every\n subsequent proxy request — bearing the user's inference JWT — to an\n attacker-controlled endpoint.\n Validating scheme + host at the source closes that loop before the\n poisoned URL ever lands in ``auth.json``.\n\n The env-var override path (``REMOVED_PROVIDER_INFERENCE_BASE_URL``) bypasses\n this — env values come from the trusted OS user, not from the\n network, and the override is documented for staging/dev use.\n\n Co-authored-by: memosr <mehmet.sr35@gmail.com>\n \"\"\"\n if not isinstance(url, str):\n return None\n cleaned = url.strip()\n if not cleaned:\n return None\n try:\n parsed = urlparse(cleaned)\n except Exception:\n return None\n if parsed.scheme != \"https\":\n logger.warning(\n \"removed_provider: refusing non-https inference URL scheme %r from Portal response\",\n parsed.scheme,\n )\n return None\n if parsed.hostname not in _ALLOWED_REMOVED_PROVIDER_INFERENCE_HOSTS:\n logger.warning(\n \"removed_provider: refusing inference URL host %r from Portal response \"\n \"(not in allowlist); falling back to default\",\n parsed.hostname,\n )\n return None\n return cleaned.rstrip(\"/\")\n\n\ndef _decode_jwt_claims(token: Any) -> Dict[str, Any]:\n if not isinstance(token, str) or token.count(\".\") != 2:\n return {}\n payload = token.split(\".\")[1]\n payload += \"=\" * ((4 - len(payload) % 4) % 4)\n try:\n raw = base64.urlsafe_b64decode(payload.encode(\"utf-8\"))\n claims = json.loads(raw.decode(\"utf-8\"))\n except Exception:\n return {}\n return claims if isinstance(claims, dict) else {}\n\n\ndef _scope_values(raw_scope: Any) -> set[str]:\n # OAuth token responses normally return a space-separated string. Keep\n # collection support for JWT ``scp`` claims and older stored test fixtures.\n scopes: set[str] = set()\n if isinstance(raw_scope, str):\n for part in raw_scope.replace(\",\", \" \").split():\n cleaned = part.strip()\n if cleaned:\n scopes.add(cleaned)\n elif isinstance(raw_scope, (list, tuple, set, frozenset)):\n for item in raw_scope:\n if isinstance(item, str):\n scopes.update(_scope_values(item))\n return scopes\n\n\ndef _removed_provider_invoke_jwt_status(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = REMOVED_PROVIDER_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> Optional[str]:\n \"\"\"Return None when the token can be used for inference, else a reason.\"\"\"\n claims = _decode_jwt_claims(token)\n if not claims:\n return \"access_token_not_jwt\"\n scopes = (\n _scope_values(scope)\n | _scope_values(claims.get(\"scope\"))\n | _scope_values(claims.get(\"scp\"))\n )\n if REMOVED_PROVIDER_INFERENCE_INVOKE_SCOPE not in scopes:\n return \"missing_inference_invoke_scope\"\n exp = claims.get(\"exp\")\n skew = max(0, int(min_ttl_seconds))\n if isinstance(exp, (int, float)):\n if float(exp) <= (time.time() + skew):\n return \"invoke_jwt_expiring\"\n return None\n if _is_expiring(expires_at, skew):\n return \"invoke_jwt_expiry_unknown_or_expiring\"\n return None\n\n\ndef _removed_provider_invoke_jwt_is_usable(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = REMOVED_PROVIDER_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> bool:\n return (\n _removed_provider_invoke_jwt_status(\n token,\n scope=scope,\n expires_at=expires_at,\n min_ttl_seconds=min_ttl_seconds,\n )\n is None\n )\n\n\ndef _assert_removed_provider_inference_jwt_usable(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n) -> None:\n token = state.get(\"access_token\") if access_token is None else access_token\n reason = _removed_provider_invoke_jwt_status(\n token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if reason is None:\n return\n raise AuthError(\n \"Removed provider Portal access token is not a usable inference JWT \"\n f\"({reason}). Re-authenticate with: arcen auth add removed_provider\",\n provider=\"removed_provider\",\n code=reason,\n relogin_required=True,\n )\n\n\ndef _log_removed_provider_invoke_jwt_selected(\n *,\n access_token: Any,\n sequence_id: Optional[str] = None,\n) -> None:\n logger.info(\"Removed provider inference auth: using NAS invoke JWT\")\n _oauth_trace(\n \"removed_provider_invoke_jwt_selected\",\n sequence_id=sequence_id,\n access_token_fp=_token_fingerprint(access_token),\n )\n\n\ndef _removed_provider_jwt_expires_at(token: Any, fallback_expires_at: Any = None) -> Optional[str]:\n claims = _decode_jwt_claims(token)\n exp = claims.get(\"exp\")\n if isinstance(exp, (int, float)):\n try:\n return datetime.fromtimestamp(float(exp), tz=timezone.utc).isoformat()\n except Exception:\n pass\n return fallback_expires_at if isinstance(fallback_expires_at, str) else None\n\n\ndef _set_removed_provider_agent_key_from_invoke_jwt(\n state: Dict[str, Any],\n *,\n obtained_at: Optional[str] = None,\n) -> None:\n access_token = state.get(\"access_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n return\n now = datetime.now(timezone.utc)\n existing_obtained_at = state.get(\"agent_key_obtained_at\")\n if obtained_at:\n effective_obtained_at = obtained_at\n elif (\n state.get(\"agent_key\") == access_token\n and isinstance(existing_obtained_at, str)\n and existing_obtained_at.strip()\n ):\n effective_obtained_at = existing_obtained_at\n else:\n effective_obtained_at = now.isoformat()\n expires_at = _removed_provider_jwt_expires_at(access_token, state.get(\"expires_at\"))\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"expires_in\"))\n )\n if expires_at:\n state[\"expires_at\"] = expires_at\n state[\"expires_in\"] = expires_in\n state[\"agent_key\"] = access_token\n state[\"agent_key_id\"] = None\n state[\"agent_key_expires_at\"] = expires_at\n state[\"agent_key_expires_in\"] = expires_in\n state[\"agent_key_reused\"] = False\n state[\"agent_key_obtained_at\"] = effective_obtained_at\n\n\ndef _select_removed_provider_invoke_jwt(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n sequence_id: Optional[str] = None,\n) -> None:\n if isinstance(access_token, str) and access_token.strip():\n state[\"access_token\"] = access_token\n _set_removed_provider_agent_key_from_invoke_jwt(state)\n _log_removed_provider_invoke_jwt_selected(\n access_token=state.get(\"access_token\"),\n sequence_id=sequence_id,\n )\n\n\n_REMOVED_PROVIDER_EFFECTIVE_STATE_IGNORED_KEYS = frozenset({\n # These are derived from expires_at/JWT exp and naturally tick down between\n # reads. Persisting only these changes makes auth.json noisy and defeats\n # the mtime-keyed auth-status cache.\n \"expires_in\",\n \"agent_key_expires_in\",\n})\n\n\ndef _removed_provider_effective_provider_state(state: Dict[str, Any]) -> Dict[str, Any]:\n return {\n key: value\n for key, value in state.items()\n if key not in _REMOVED_PROVIDER_EFFECTIVE_STATE_IGNORED_KEYS\n }\n\n\ndef _codex_access_token_is_expiring(access_token: Any, skew_seconds: int) -> bool:\n claims = _decode_jwt_claims(access_token)\n exp = claims.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n\n\ndef _qwen_cli_auth_path() -> Path:\n return Path.home() / \".qwen\" / \"oauth_creds.json\"\n\n\ndef _read_qwen_cli_tokens() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n if not auth_path.exists():\n raise AuthError(\n \"Qwen CLI credentials not found. Run 'qwen auth qwen-oauth' first.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_missing\",\n )\n try:\n data = json.loads(auth_path.read_text(encoding=\"utf-8\"))\n except Exception as exc:\n raise AuthError(\n f\"Failed to read Qwen CLI credentials from {auth_path}: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_read_failed\",\n ) from exc\n if not isinstance(data, dict):\n raise AuthError(\n f\"Invalid Qwen CLI credentials in {auth_path}.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_invalid\",\n )\n return data\n\n\ndef _save_qwen_cli_tokens(tokens: Dict[str, Any]) -> Path:\n auth_path = _qwen_cli_auth_path()\n auth_path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_path)\n # Per-process random temp suffix avoids collisions between concurrent\n # writers and stale leftovers from a crashed prior write.\n tmp_path = auth_path.with_name(f\"{auth_path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed tokens\n # at process umask (typically 0o644). See #19673, #21148.\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(tokens, indent=2, sort_keys=True) + \"\\n\")\n fh.flush()\n os.fsync(fh.fileno())\n atomic_replace(tmp_path, auth_path)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n return auth_path\n\n\ndef _qwen_access_token_is_expiring(expiry_date_ms: Any, skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS) -> bool:\n try:\n expiry_ms = int(expiry_date_ms)\n except Exception:\n return True\n return (time.time() + max(0, int(skew_seconds))) * 1000 >= expiry_ms\n\n\ndef _refresh_qwen_cli_tokens(tokens: Dict[str, Any], timeout_seconds: float = 20.0) -> Dict[str, Any]:\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Qwen OAuth refresh token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_token_missing\",\n )\n\n try:\n response = httpx.post(\n QWEN_OAUTH_TOKEN_URL,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": QWEN_OAUTH_CLIENT_ID,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh failed: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n body = response.text.strip()\n raise AuthError(\n \"Qwen OAuth refresh failed. Re-run 'qwen auth qwen-oauth'.\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh returned invalid JSON: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_json\",\n ) from exc\n\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Qwen OAuth refresh response missing access_token.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_response\",\n )\n\n expires_in = payload.get(\"expires_in\")\n try:\n expires_in_seconds = int(expires_in)\n except Exception:\n expires_in_seconds = 6 * 60 * 60\n\n refreshed = {\n \"access_token\": str(payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(payload.get(\"refresh_token\", refresh_token) or refresh_token).strip(),\n \"token_type\": str(payload.get(\"token_type\", tokens.get(\"token_type\", \"Bearer\")) or \"Bearer\").strip() or \"Bearer\",\n \"resource_url\": str(payload.get(\"resource_url\", tokens.get(\"resource_url\", \"portal.qwen.ai\")) or \"portal.qwen.ai\").strip(),\n \"expiry_date\": int(time.time() * 1000) + max(1, expires_in_seconds) * 1000,\n }\n _save_qwen_cli_tokens(refreshed)\n return refreshed\n\n\ndef _mark_qwen_oauth_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to qwen-oauth in auth.json.\n\n Qwen OAuth tokens live in the Qwen CLI credential file managed by\n _save_qwen_cli_tokens / resolve_qwen_runtime_credentials. This function\n only writes a minimal provider-state entry (base_url for display) and\n sets active_provider so that get_active_provider() and\n _model_section_has_credentials() detect the provider for the setup wizard\n and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"base_url\"):\n state[\"base_url\"] = str(creds[\"base_url\"])\n _save_provider_state(auth_store, \"qwen-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_qwen_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n tokens = _read_qwen_cli_tokens()\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _qwen_access_token_is_expiring(tokens.get(\"expiry_date\"), refresh_skew_seconds)\n if should_refresh:\n tokens = _refresh_qwen_cli_tokens(tokens)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Qwen OAuth access token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_access_token_missing\",\n )\n\n base_url = os.getenv(\"ARCEN_QWEN_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_QWEN_BASE_URL\n return {\n \"provider\": \"qwen-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"qwen-cli\",\n \"expires_at_ms\": tokens.get(\"expiry_date\"),\n \"auth_file\": str(_qwen_cli_auth_path()),\n }\n\n\ndef get_qwen_auth_status() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n try:\n # Validate the runtime credentials, including refresh when the cached\n # CLI token is expired. Otherwise stale tokens show up as \"logged in\"\n # and `arcen model` walks users into a broken Qwen setup flow.\n creds = resolve_qwen_runtime_credentials(refresh_if_expiring=True)\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n \"expires_at_ms\": creds.get(\"expires_at_ms\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": str(exc),\n }\n\n\n# =============================================================================\n# Google Gemini OAuth (google-gemini-cli) — PKCE flow + Cloud Code Assist.\n#\n# Tokens live in ~/.arcen/auth/google_oauth.json (managed by agent.google_oauth).\n# The `base_url` here is the marker \"cloudcode-pa://google\" that run_agent.py\n# uses to construct a GeminiCloudCodeClient instead of the default OpenAI SDK.\n# Actual HTTP traffic goes to https://cloudcode-pa.googleapis.com/v1internal:*.\n# =============================================================================\n\ndef _mark_google_gemini_cli_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to google-gemini-cli in auth.json.\n\n The actual OAuth tokens live in the Google credential file managed by\n agent.google_oauth. This function only writes a minimal provider-state\n entry (email for display) and sets active_provider so that\n get_active_provider() and _model_section_has_credentials() detect the\n provider for the setup wizard and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"email\"):\n state[\"email\"] = str(creds[\"email\"])\n _save_provider_state(auth_store, \"google-gemini-cli\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_gemini_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime OAuth creds for google-gemini-cli.\"\"\"\n try:\n from agent.google_oauth import (\n GoogleOAuthError,\n _credentials_path,\n get_valid_access_token,\n load_credentials,\n )\n except ImportError as exc:\n raise AuthError(\n f\"agent.google_oauth is not importable: {exc}\",\n provider=\"google-gemini-cli\",\n code=\"google_oauth_module_missing\",\n ) from exc\n\n try:\n access_token = get_valid_access_token(force_refresh=force_refresh)\n except GoogleOAuthError as exc:\n raise AuthError(\n str(exc),\n provider=\"google-gemini-cli\",\n code=exc.code,\n ) from exc\n\n creds = load_credentials()\n base_url = DEFAULT_GEMINI_CLOUDCODE_BASE_URL\n return {\n \"provider\": \"google-gemini-cli\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"google-oauth\",\n \"expires_at_ms\": (creds.expires_ms if creds else None),\n \"auth_file\": str(_credentials_path()),\n \"email\": (creds.email if creds else \"\") or \"\",\n \"project_id\": (creds.project_id if creds else \"\") or \"\",\n }\n\n\ndef get_gemini_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return a status dict for `arcen auth list` / `arcen status`.\"\"\"\n try:\n from agent.google_oauth import _credentials_path, load_credentials\n except ImportError:\n return {\"logged_in\": False, \"error\": \"agent.google_oauth unavailable\"}\n auth_path = _credentials_path()\n creds = load_credentials()\n if creds is None or not creds.access_token:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": \"not logged in\",\n }\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": \"google-oauth\",\n \"api_key\": creds.access_token,\n \"expires_at_ms\": creds.expires_ms,\n \"email\": creds.email,\n \"project_id\": creds.project_id,\n }\n# Spotify auth — PKCE tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\n\ndef _spotify_scope_list(raw_scope: Optional[str] = None) -> List[str]:\n scope_text = (raw_scope or DEFAULT_SPOTIFY_SCOPE).strip()\n scopes = [part for part in scope_text.split() if part]\n seen: set[str] = set()\n ordered: List[str] = []\n for scope in scopes:\n if scope not in seen:\n seen.add(scope)\n ordered.append(scope)\n return ordered\n\n\ndef _spotify_scope_string(raw_scope: Optional[str] = None) -> str:\n return \" \".join(_spotify_scope_list(raw_scope))\n\n\ndef _spotify_client_id(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\"),\n get_env_value(\"SPOTIFY_CLIENT_ID\"),\n state.get(\"client_id\") if isinstance(state, dict) else None,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n raise AuthError(\n \"Spotify client_id is required. Set ARCEN_SPOTIFY_CLIENT_ID or pass --client-id.\",\n provider=\"spotify\",\n code=\"spotify_client_id_missing\",\n )\n\n\ndef _spotify_redirect_uri(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\"),\n get_env_value(\"SPOTIFY_REDIRECT_URI\"),\n state.get(\"redirect_uri\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_REDIRECT_URI\n\n\ndef _spotify_api_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_API_BASE_URL\"),\n state.get(\"api_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_API_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_API_BASE_URL\n\n\ndef _spotify_accounts_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_ACCOUNTS_BASE_URL\"),\n state.get(\"accounts_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL\n\n\ndef _spotify_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _spotify_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _oauth_pkce_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _oauth_pkce_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _spotify_build_authorize_url(\n *,\n client_id: str,\n redirect_uri: str,\n scope: str,\n state: str,\n code_challenge: str,\n accounts_base_url: str,\n) -> str:\n query = urlencode({\n \"client_id\": client_id,\n \"response_type\": \"code\",\n \"redirect_uri\": redirect_uri,\n \"scope\": scope,\n \"state\": state,\n \"code_challenge_method\": \"S256\",\n \"code_challenge\": code_challenge,\n })\n return f\"{accounts_base_url}/authorize?{query}\"\n\n\ndef _spotify_validate_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"Spotify PKCE redirect_uri must use http://localhost or http://127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host not in {\"127.0.0.1\", \"localhost\"}:\n raise AuthError(\n \"Spotify PKCE redirect_uri must point to localhost or 127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"Spotify PKCE redirect_uri must include an explicit localhost port.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _make_spotify_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n\n class _SpotifyCallbackHandler(BaseHTTPRequestHandler):\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n result[\"code\"] = params.get(\"code\", [None])[0]\n result[\"state\"] = params.get(\"state\", [None])[0]\n result[\"error\"] = params.get(\"error\", [None])[0]\n result[\"error_description\"] = params.get(\"error_description\", [None])[0]\n\n self.send_response(200)\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if result[\"error\"]:\n body = \"<html><body><h1>Spotify authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>Spotify authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _SpotifyCallbackHandler, result\n\n\ndef _spotify_wait_for_callback(\n redirect_uri: str,\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n host, port, path = _spotify_validate_redirect_uri(redirect_uri)\n handler_cls, result = _make_spotify_callback_handler(path)\n\n class _ReuseHTTPServer(HTTPServer):\n allow_reuse_address = True\n\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n except OSError as exc:\n raise AuthError(\n f\"Could not bind Spotify callback server on {host}:{port}: {exc}\",\n provider=\"spotify\",\n code=\"spotify_callback_bind_failed\",\n ) from exc\n\n thread = threading.Thread(target=server.serve_forever, kwargs={\"poll_interval\": 0.1}, daemon=True)\n thread.start()\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n raise AuthError(\n \"Spotify authorization timed out waiting for the local callback.\",\n provider=\"spotify\",\n code=\"spotify_callback_timeout\",\n )\n\n\ndef _xai_validate_loopback_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"xAI OAuth redirect_uri must use http://127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host != XAI_OAUTH_REDIRECT_HOST:\n raise AuthError(\n \"xAI OAuth redirect_uri must point to 127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"xAI OAuth redirect_uri must include an explicit localhost port.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _xai_callback_cors_origin(origin: Optional[str]) -> str:\n # CORS allowlist for the loopback callback. Only xAI's own auth origins\n # are accepted; the redirect_uri itself is bound to 127.0.0.1 and gated by\n # PKCE+state, so additional dev/3p origins are not needed here.\n allowed = {\n \"https://accounts.x.ai\",\n \"https://auth.x.ai\",\n }\n return origin if origin in allowed else \"\"\n\n\ndef _make_xai_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n result_lock = threading.Lock()\n\n class _XAICallbackHandler(BaseHTTPRequestHandler):\n def _maybe_write_cors_headers(self) -> None:\n origin = self.headers.get(\"Origin\")\n allow_origin = _xai_callback_cors_origin(origin)\n if allow_origin:\n self.send_header(\"Access-Control-Allow-Origin\", allow_origin)\n self.send_header(\"Access-Control-Allow-Methods\", \"GET, OPTIONS\")\n self.send_header(\"Access-Control-Allow-Headers\", \"Content-Type\")\n self.send_header(\"Access-Control-Allow-Private-Network\", \"true\")\n self.send_header(\"Vary\", \"Origin\")\n\n def do_OPTIONS(self) -> None: # noqa: N802\n self.send_response(204)\n self._maybe_write_cors_headers()\n self.end_headers()\n\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n incoming = {\n \"code\": params.get(\"code\", [None])[0],\n \"state\": params.get(\"state\", [None])[0],\n \"error\": params.get(\"error\", [None])[0],\n \"error_description\": params.get(\"error_description\", [None])[0],\n }\n\n # Diagnostic logging — emits at INFO so reporters of loopback bugs\n # (#27385 — \"callback received but Arcen times out\") can produce\n # actionable evidence without a code change. Logged values are\n # fingerprints / booleans only; no actual code/state strings leak\n # into the log file. Run with ``ARCEN_LOG_LEVEL=INFO`` (or check\n # ``~/.arcen/logs/agent.log`` which captures INFO+ unconditionally).\n try:\n logger.info(\n \"xAI loopback callback received: path=%s has_code=%s has_state=%s has_error=%s \"\n \"ua=%s\",\n parsed.path,\n incoming[\"code\"] is not None,\n incoming[\"state\"] is not None,\n incoming[\"error\"] is not None,\n (self.headers.get(\"User-Agent\") or \"\")[:80],\n )\n if incoming[\"error\"]:\n logger.info(\n \"xAI loopback callback carries error=%s error_description=%s\",\n incoming[\"error\"],\n (incoming[\"error_description\"] or \"\")[:200],\n )\n except Exception:\n # Logging must never break the OAuth flow.\n pass\n\n # Treat a hit on the callback path with neither `code` nor `error`\n # as a missing OAuth callback (e.g. xAI's auth backend failed to\n # redirect and the user navigated to the bare loopback URL by hand).\n # Show an explicit \"not received\" page rather than the success page —\n # otherwise the browser claims authorization succeeded while the CLI\n # is still waiting for a real callback and eventually times out.\n if incoming[\"code\"] is None and incoming[\"error\"] is None:\n self.send_response(400)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n body = (\n \"<html><body>\"\n \"<h1>xAI authorization not received.</h1>\"\n \"<p>No authorization code was present in this callback URL. \"\n \"Return to the terminal and re-run \"\n \"<code>arcen auth add xai-oauth</code> to retry.</p>\"\n \"</body></html>\"\n )\n self.wfile.write(body.encode(\"utf-8\"))\n return\n\n # ThreadingHTTPServer allows a fallback/manual callback to complete\n # while a browser connection is stuck. Once we have a terminal\n # OAuth result (code or error), keep the first one so a later\n # concurrent/invalid callback cannot overwrite state before\n # validation in _xai_oauth_loopback_login().\n with result_lock:\n if not (result[\"code\"] or result[\"error\"]):\n result.update(incoming)\n\n self.send_response(200)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if incoming[\"error\"]:\n body = \"<html><body><h1>xAI authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>xAI authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _XAICallbackHandler, result\n\n\ndef _xai_start_callback_server(\n preferred_port: int = XAI_OAUTH_REDIRECT_PORT,\n) -> tuple[HTTPServer, threading.Thread, dict[str, Any], str]:\n host = XAI_OAUTH_REDIRECT_HOST\n expected_path = XAI_OAUTH_REDIRECT_PATH\n handler_cls, result = _make_xai_callback_handler(expected_path)\n\n class _ReuseHTTPServer(ThreadingHTTPServer):\n allow_reuse_address = True\n daemon_threads = True\n\n ports_to_try = [preferred_port]\n if preferred_port != 0:\n ports_to_try.append(0)\n server = None\n last_error: Optional[OSError] = None\n for port in ports_to_try:\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n break\n except OSError as exc:\n last_error = exc\n if server is None:\n raise AuthError(\n f\"Could not bind xAI callback server on {host}:{preferred_port}: {last_error}\",\n provider=\"xai-oauth\",\n code=\"xai_callback_bind_failed\",\n ) from last_error\n\n actual_port = int(server.server_address[1])\n redirect_uri = f\"http://{host}:{actual_port}{expected_path}\"\n thread = threading.Thread(\n target=server.serve_forever,\n kwargs={\"poll_interval\": 0.1},\n daemon=True,\n )\n thread.start()\n return server, thread, result, redirect_uri\n\n\ndef _xai_wait_for_callback(\n server: HTTPServer,\n thread: threading.Thread,\n result: dict[str, Any],\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n # Diagnostic: distinguish \"no callback ever arrived\" from \"callback\n # arrived but result wasn't populated\" (#27385). The per-hit handler\n # also logs at INFO; if neither line appears, xAI's IDP never reached\n # the loopback at all (firewall, port-binding, IPv6/IPv4 mismatch).\n logger.info(\n \"xAI loopback wait timed out after %.0fs with no usable callback \"\n \"(result.code=%s result.error=%s)\",\n max(5.0, timeout_seconds),\n result[\"code\"] is not None,\n result[\"error\"] is not None,\n )\n raise AuthError(\n \"xAI authorization timed out waiting for the local callback.\",\n provider=\"xai-oauth\",\n code=\"xai_callback_timeout\",\n )\n\n\ndef _spotify_token_payload_to_state(\n token_payload: Dict[str, Any],\n *,\n client_id: str,\n redirect_uri: str,\n requested_scope: str,\n accounts_base_url: str,\n api_base_url: str,\n previous_state: Optional[Dict[str, Any]] = None,\n) -> Dict[str, Any]:\n now = datetime.now(timezone.utc)\n expires_in = _coerce_ttl_seconds(token_payload.get(\"expires_in\", 0))\n expires_at = datetime.fromtimestamp(now.timestamp() + expires_in, tz=timezone.utc)\n state = dict(previous_state or {})\n state.update({\n \"client_id\": client_id,\n \"redirect_uri\": redirect_uri,\n \"accounts_base_url\": accounts_base_url,\n \"api_base_url\": api_base_url,\n \"scope\": requested_scope,\n \"granted_scope\": str(token_payload.get(\"scope\") or requested_scope).strip(),\n \"token_type\": str(token_payload.get(\"token_type\", \"Bearer\") or \"Bearer\").strip() or \"Bearer\",\n \"access_token\": str(token_payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(\n token_payload.get(\"refresh_token\")\n or state.get(\"refresh_token\")\n or \"\"\n ).strip(),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": expires_at.isoformat(),\n \"expires_in\": expires_in,\n \"auth_type\": \"oauth_pkce\",\n })\n return state\n\n\ndef _spotify_exchange_code_for_tokens(\n *,\n client_id: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n accounts_base_url: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"client_id\": client_id,\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"code_verifier\": code_verifier,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token exchange failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token exchange failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n )\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify token response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_invalid\",\n )\n return payload\n\n\ndef _refresh_spotify_oauth_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Spotify refresh token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_refresh_token_missing\",\n relogin_required=True,\n )\n\n client_id = _spotify_client_id(state=state)\n accounts_base_url = _spotify_accounts_base_url(state)\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": client_id,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token refresh failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token refresh failed. Run `arcen auth spotify` again.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n relogin_required=True,\n )\n\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify refresh response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_refresh_invalid\",\n relogin_required=True,\n )\n\n return _spotify_token_payload_to_state(\n payload,\n client_id=client_id,\n redirect_uri=_spotify_redirect_uri(state=state),\n requested_scope=str(state.get(\"scope\") or DEFAULT_SPOTIFY_SCOPE),\n accounts_base_url=accounts_base_url,\n api_base_url=_spotify_api_base_url(state),\n previous_state=state,\n )\n\n\ndef resolve_spotify_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = SPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"spotify\")\n if not state:\n raise AuthError(\n \"Spotify is not authenticated. Run `arcen auth spotify` first.\",\n provider=\"spotify\",\n code=\"spotify_auth_missing\",\n relogin_required=True,\n )\n\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds)\n if should_refresh:\n state = _refresh_spotify_oauth_state(state)\n _store_provider_state(auth_store, \"spotify\", state, set_active=False)\n _save_auth_store(auth_store)\n\n access_token = str(state.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Spotify access token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_access_token_missing\",\n relogin_required=True,\n )\n\n return {\n \"provider\": \"spotify\",\n \"access_token\": access_token,\n \"api_key\": access_token,\n \"token_type\": str(state.get(\"token_type\", \"Bearer\") or \"Bearer\"),\n \"base_url\": _spotify_api_base_url(state),\n \"scope\": str(state.get(\"granted_scope\") or state.get(\"scope\") or \"\").strip(),\n \"client_id\": _spotify_client_id(state=state),\n \"redirect_uri\": _spotify_redirect_uri(state=state),\n \"expires_at\": state.get(\"expires_at\"),\n \"refresh_token\": str(state.get(\"refresh_token\", \"\") or \"\").strip(),\n }\n\n\ndef get_spotify_auth_status() -> Dict[str, Any]:\n state = get_provider_auth_state(\"spotify\")\n if not state:\n return {\"logged_in\": False}\n\n expires_at = state.get(\"expires_at\")\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n return {\n \"logged_in\": bool(refresh_token or not _is_expiring(expires_at, 0)),\n \"auth_type\": state.get(\"auth_type\", \"oauth_pkce\"),\n \"client_id\": state.get(\"client_id\"),\n \"redirect_uri\": state.get(\"redirect_uri\"),\n \"scope\": state.get(\"granted_scope\") or state.get(\"scope\"),\n \"expires_at\": expires_at,\n \"api_base_url\": state.get(\"api_base_url\"),\n \"has_refresh_token\": bool(refresh_token),\n }\n\n\ndef _spotify_interactive_setup(redirect_uri_hint: str) -> str:\n \"\"\"Walk the user through creating a Spotify developer app, persist the\n resulting client_id to ~/.arcen/.env, and return it.\n\n Raises SystemExit if the user aborts or submits an empty value.\n \"\"\"\n from arcen_cli.config import save_env_value\n\n print()\n print(\"=\" * 70)\n print(\"Spotify first-time setup\")\n print(\"=\" * 70)\n print()\n print(\"Spotify requires every user to register their own lightweight\")\n print(\"developer app. This takes about two minutes and only has to be\")\n print(\"done once per machine.\")\n print()\n print(f\"Full guide: {SPOTIFY_DOCS_URL}\")\n print()\n print(\"Steps:\")\n print(f\" 1. Opening {SPOTIFY_DASHBOARD_URL} in your browser...\")\n print(\" 2. Click 'Create app' and fill in:\")\n print(\" App name: anything (e.g. arcen-agent)\")\n print(\" Description: anything\")\n print(f\" Redirect URI: {redirect_uri_hint}\")\n print(\" API/SDK: Web API\")\n print(\" 3. Agree to the terms, click Save.\")\n print(\" 4. Open the app's Settings page and copy the Client ID.\")\n print(\" 5. Paste it below.\")\n print()\n\n if not _is_remote_session():\n try:\n webbrowser.open(SPOTIFY_DASHBOARD_URL)\n except Exception:\n pass\n\n try:\n raw = input(\"Spotify Client ID: \").strip()\n except (EOFError, KeyboardInterrupt):\n print()\n raise SystemExit(\"Spotify setup cancelled.\")\n\n if not raw:\n print()\n print(f\"No Client ID entered. See {SPOTIFY_DOCS_URL} for the full guide.\")\n raise SystemExit(\"Spotify setup cancelled: empty Client ID.\")\n\n # Persist so subsequent `arcen auth spotify` runs skip the wizard.\n save_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\", raw)\n # Only persist the redirect URI if it's non-default, to avoid pinning\n # users to a value the default might later change to.\n if redirect_uri_hint and redirect_uri_hint != DEFAULT_SPOTIFY_REDIRECT_URI:\n save_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\", redirect_uri_hint)\n\n print()\n print(\"Saved ARCEN_SPOTIFY_CLIENT_ID to ~/.arcen/.env\")\n print()\n return raw\n\n\ndef login_spotify_command(args) -> None:\n existing_state = get_provider_auth_state(\"spotify\") or {}\n\n # Interactive wizard: if no client_id is configured anywhere, walk the\n # user through creating the Spotify developer app instead of crashing\n # with \"ARCEN_SPOTIFY_CLIENT_ID is required\".\n explicit_client_id = getattr(args, \"client_id\", None)\n try:\n client_id = _spotify_client_id(explicit_client_id, existing_state)\n except AuthError as exc:\n if getattr(exc, \"code\", \"\") != \"spotify_client_id_missing\":\n raise\n client_id = _spotify_interactive_setup(\n redirect_uri_hint=getattr(args, \"redirect_uri\", None) or DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n\n redirect_uri = _spotify_redirect_uri(getattr(args, \"redirect_uri\", None), existing_state)\n scope = _spotify_scope_string(getattr(args, \"scope\", None) or existing_state.get(\"scope\"))\n accounts_base_url = _spotify_accounts_base_url(existing_state)\n api_base_url = _spotify_api_base_url(existing_state)\n open_browser = not getattr(args, \"no_browser\", False)\n\n code_verifier = _spotify_code_verifier()\n code_challenge = _spotify_code_challenge(code_verifier)\n state_nonce = uuid.uuid4().hex\n authorize_url = _spotify_build_authorize_url(\n client_id=client_id,\n redirect_uri=redirect_uri,\n scope=scope,\n state=state_nonce,\n code_challenge=code_challenge,\n accounts_base_url=accounts_base_url,\n )\n\n print(\"Starting Spotify PKCE login...\")\n print(f\"Client ID: {client_id}\")\n print(f\"Redirect URI: {redirect_uri}\")\n print(\"Make sure this redirect URI is allow-listed in your Spotify app settings.\")\n print()\n print(\"Open this URL to authorize Arcen:\")\n print(authorize_url)\n print()\n print(f\"Full setup guide: {SPOTIFY_DOCS_URL}\")\n print()\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=SPOTIFY_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for Spotify authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n callback = _spotify_wait_for_callback(\n redirect_uri,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 180.0),\n )\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise SystemExit(f\"Spotify authorization failed: {detail}\")\n if callback.get(\"state\") != state_nonce:\n raise SystemExit(\"Spotify authorization failed: state mismatch.\")\n\n token_payload = _spotify_exchange_code_for_tokens(\n client_id=client_id,\n code=str(callback.get(\"code\") or \"\"),\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n accounts_base_url=accounts_base_url,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 20.0),\n )\n spotify_state = _spotify_token_payload_to_state(\n token_payload,\n client_id=client_id,\n redirect_uri=redirect_uri,\n requested_scope=scope,\n accounts_base_url=accounts_base_url,\n api_base_url=api_base_url,\n )\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _store_provider_state(auth_store, \"spotify\", spotify_state, set_active=False)\n saved_to = _save_auth_store(auth_store)\n\n print(\"Spotify login successful!\")\n print(f\" Auth state: {saved_to}\")\n print(\" Provider state saved under providers.spotify\")\n print(f\" Docs: {SPOTIFY_DOCS_URL}\")\n\n# =============================================================================\n# SSH / remote session detection\n# =============================================================================\n\ndef _is_remote_session() -> bool:\n \"\"\"Detect environments where loopback OAuth can't reach the local browser.\n\n Historically only SSH was checked, but #26923 surfaced that\n **browser-only remote consoles** (GCP Cloud Shell, GitHub\n Codespaces, AWS EC2 Instance Connect, Gitpod, Replit, etc.) hit\n the exact same problem — the user has a browser on their laptop\n but the loopback listener is bound on the remote VM that the\n laptop's browser can't reach. These environments typically don't\n set ``SSH_CLIENT`` / ``SSH_TTY``, so the SSH-only check left\n them with no guidance and no fallback.\n \"\"\"\n if os.getenv(\"SSH_CLIENT\") or os.getenv(\"SSH_TTY\"):\n return True\n # Browser-only remote IDEs / cloud shells. Keep this list narrow\n # (well-known, documented env vars set by the host platform) so\n # we don't falsely trip on a developer's local shell.\n for var in (\n \"CLOUD_SHELL\", # GCP Cloud Shell\n \"CODESPACES\", # GitHub Codespaces\n \"CODESPACE_NAME\", # GitHub Codespaces (alt)\n \"GITPOD_WORKSPACE_ID\", # Gitpod\n \"REPL_ID\", # Replit\n \"STACKBLITZ\", # StackBlitz\n ):\n if os.getenv(var):\n return True\n return False\n\n\n# Console/text-mode browsers that ``webbrowser`` will happily launch INSIDE\n# the terminal. Opening one of these is worse than not opening anything —\n# it hijacks the user's TTY with an unusable text browser (the xAI OAuth\n# \"Account Management\" page rendered in w3m, reported May 2026) instead of\n# letting them copy the URL to a real browser. When the resolved browser is\n# one of these we refuse to auto-open and fall back to the print-the-URL /\n# manual-paste path, same as a remote session.\n_CONSOLE_BROWSER_NAMES: FrozenSet[str] = frozenset(\n {\n \"w3m\",\n \"lynx\",\n \"links\",\n \"links2\",\n \"elinks\",\n \"www-browser\",\n \"browsh\", # TUI browser — still hijacks the terminal\n }\n)\n\n\ndef _can_open_graphical_browser() -> bool:\n \"\"\"Return True only when a *graphical* browser is likely to open.\n\n ``webbrowser.open()`` resolves to whatever the platform offers, and on a\n headless / CLI-only Linux box with no GUI browser installed that is often\n a text-mode browser (w3m/lynx/links) which launches inside the terminal\n and takes over the user's session. This guard distinguishes \"a real\n windowed browser will pop up\" from \"a console browser will hijack the\n TTY\", so callers can fall back to printing the URL instead.\n\n Heuristics:\n * Respect ``$BROWSER`` — if it names a known console browser, refuse.\n * On Linux, require a display server (``$DISPLAY`` / ``$WAYLAND_DISPLAY``)\n unless ``$BROWSER`` points at something graphical; no display server\n almost always means no GUI browser.\n * Ask ``webbrowser.get()`` what it resolved to and refuse when the\n underlying command is a known console browser.\n * macOS and Windows always have a usable default GUI browser.\n \"\"\"\n import webbrowser as _webbrowser\n\n def _names_console_browser(value: str) -> bool:\n token = value.strip().split()[0] if value.strip() else \"\"\n base = os.path.basename(token).lower()\n return base in _CONSOLE_BROWSER_NAMES\n\n browser_env = os.environ.get(\"BROWSER\", \"\")\n if browser_env and _names_console_browser(browser_env):\n return False\n\n if sys.platform.startswith(\"linux\"):\n has_display = bool(\n os.environ.get(\"DISPLAY\") or os.environ.get(\"WAYLAND_DISPLAY\")\n )\n # An explicit graphical $BROWSER can work without $DISPLAY in odd\n # setups, but a console $BROWSER already returned False above, so the\n # only way to reach here with a $BROWSER set is a graphical one.\n if not has_display and not browser_env:\n return False\n\n try:\n controller = _webbrowser.get()\n except Exception:\n # No browser resolvable at all → definitely don't auto-open.\n return False\n\n candidate = (\n getattr(controller, \"name\", \"\")\n or getattr(controller, \"basename\", \"\")\n or \"\"\n )\n if candidate and _names_console_browser(candidate):\n return False\n\n return True\n\n\ndef _parse_pasted_callback(raw: str) -> dict:\n \"\"\"Parse a pasted callback URL / query string into the loopback shape.\n\n Accepts any of:\n\n * full URL: ``http://127.0.0.1:56121/callback?code=abc&state=xyz``\n * bare query string: ``?code=abc&state=xyz`` or ``code=abc&state=xyz``\n * bare code (no state, only used when the upstream omits state):\n ``abc-the-code-value``\n\n Returns ``{\"code\", \"state\", \"error\", \"error_description\"}`` with\n missing keys set to ``None`` so the loopback callsites can keep\n using the same validation path (state check, error check, etc.)\n they already use for the HTTP server output. Regression for\n #26923 — formalises the curl-the-callback-URL workaround the\n reporter used while waiting for upstream support.\n \"\"\"\n stripped = raw.strip()\n result: dict = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n if not stripped:\n return result\n query = \"\"\n if stripped.startswith((\"http://\", \"https://\")):\n try:\n parsed = urlparse(stripped)\n except Exception:\n return result\n query = parsed.query or \"\"\n elif stripped.startswith(\"?\"):\n query = stripped[1:]\n elif \"=\" in stripped:\n # Looks like a bare query fragment (``code=...&state=...``).\n query = stripped\n else:\n # Treat as a bare opaque code value with no state.\n result[\"code\"] = stripped\n return result\n params = parse_qs(query, keep_blank_values=False)\n for key in (\"code\", \"state\", \"error\", \"error_description\"):\n values = params.get(key)\n if values:\n result[key] = values[0]\n return result\n\n\ndef _prompt_manual_callback_paste(redirect_uri: str) -> dict:\n \"\"\"Read a callback URL from stdin as a fallback for browser-only remotes.\n\n Used when ``--manual-paste`` is set or when the loopback listener\n cannot bind. Returns the parsed callback dict (same shape as the\n HTTP handler output) so the existing state / error validation in\n the caller works unchanged. See #26923.\n \"\"\"\n print()\n print(\"─── Manual callback paste ─────────────────────────────────────\")\n print(\"After approving in your browser, your browser will try to load\")\n print(f\" {redirect_uri}\")\n print(\"which fails (the loopback listener is on this remote machine,\")\n print(\"not on your laptop) — that is expected. Copy the FULL URL\")\n print(\"from your browser's address bar of that failed page and paste\")\n print(\"it below. A bare '?code=...&state=...' fragment also works.\")\n print(\"If the consent page shows the authorization code in-page\")\n print(\"(xAI's current behavior) rather than redirecting, paste the\")\n print(\"bare code value on its own.\")\n print(\"───────────────────────────────────────────────────────────────\")\n try:\n raw = input(\"Callback URL: \")\n except (EOFError, KeyboardInterrupt):\n raw = \"\"\n return _parse_pasted_callback(raw)\n\n\ndef _ssh_user_at_host() -> str:\n \"\"\"Return best-effort 'user@hostname' for the SSH tunnel hint command.\n\n Falls back to placeholder tokens when the values cannot be determined so\n the hint is always syntactically valid even if not copy-pasteable.\n \"\"\"\n try:\n import socket as _socket\n hostname = _socket.gethostname() or \"<this-host>\"\n except OSError:\n hostname = \"<this-host>\"\n user = os.getenv(\"USER\") or os.getenv(\"LOGNAME\") or \"<user>\"\n return f\"{user}@{hostname}\"\n\n\ndef _print_loopback_ssh_hint(redirect_uri: str, *, docs_url: str | None = None) -> None:\n \"\"\"Print an SSH tunnel hint when running a loopback-redirect OAuth flow on a\n remote host. The auth server (xAI, Spotify, ...) will redirect the user's\n browser to ``127.0.0.1:<port>/callback``. If the browser is on a different\n machine than the loopback listener (the usual SSH case), the redirect can't\n reach the listener without a local port forward.\n\n The hint is best-effort: silent if we don't think we're remote, or if we\n can't parse a host/port out of the redirect URI.\n\n Pass ``docs_url`` for a provider-specific guide (e.g. the xAI Grok OAuth\n page); the generic OAuth-over-SSH guide is always shown after it.\n \"\"\"\n if not _is_remote_session():\n return\n try:\n parsed = urlparse(redirect_uri)\n except Exception:\n return\n host = parsed.hostname or \"\"\n port = parsed.port\n if host not in {\"127.0.0.1\", \"::1\", \"localhost\"} or not port:\n return\n divider = \"-\" * 60\n print()\n print(divider)\n print(\"Remote session detected — SSH tunnel required\")\n print(divider)\n print(f\"Arcen is waiting for the OAuth callback on {redirect_uri}\")\n print(\"but your browser is on a different machine. Run this command\")\n print(\"in a NEW terminal on your local machine BEFORE opening the URL:\")\n print()\n print(f\" ssh -N -L {port}:127.0.0.1:{port} {_ssh_user_at_host()}\")\n print()\n print(\"Then open the authorize URL above in your local browser.\")\n print()\n print(\"No SSH client (Cloud Shell / Codespaces / web IDE)? Re-run with\")\n print(\"`--manual-paste` to skip the loopback listener and paste the failed\")\n print(\"callback URL directly.\")\n if docs_url:\n print(f\"Provider docs: {docs_url}\")\n print(f\"SSH/jump-box guide: {OAUTH_OVER_SSH_DOCS_URL}\")\n print(divider)\n print()\n\n\n# =============================================================================\n# OpenAI Codex auth — tokens stored in ~/.arcen/auth.json (not ~/.codex/)\n#\n# Arcen maintains its own Codex OAuth session separate from the Codex CLI\n# and VS Code extension. This prevents refresh token rotation conflicts\n# where one app's refresh invalidates the other's session.\n# =============================================================================\n\ndef _read_codex_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n \"\"\"Read Codex OAuth tokens from Arcen auth store (~/.arcen/auth.json).\n \n Returns dict with 'tokens' (access_token, refresh_token) and 'last_refresh'.\n Raises AuthError if no Codex tokens are stored.\n \"\"\"\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\")\n if not state:\n raise AuthError(\n \"No Codex credentials stored. Run `arcen auth` to authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"Codex auth state is missing tokens. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n raise AuthError(\n \"Codex auth is missing access_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_access_token\",\n relogin_required=True,\n )\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n }\n\n\ndef _sync_codex_pool_entries(\n auth_store: Dict[str, Any],\n tokens: Dict[str, str],\n last_refresh: Optional[str],\n) -> None:\n \"\"\"Mirror a fresh Codex re-auth into the credential_pool OAuth entries.\n\n The runtime selects credentials from ``credential_pool.openai-codex``, not\n from ``providers.openai-codex.tokens``. A re-auth invalidates the prior\n OAuth pair server-side, but pool entries keep holding the now-consumed\n refresh token plus any stale error markers — so the next request spends a\n dead token and gets a 401 ``token_invalidated``.\n\n What gets refreshed:\n\n * ``device_code`` — the singleton-seeded entry written by the device-code\n OAuth flow when the user logged in via ``arcen setup`` / the model\n picker. Always synced with the fresh tokens.\n * ``manual:device_code`` — entries created by ``arcen auth add openai-codex``\n that use the same device-code OAuth mechanism. An interactive re-auth\n proves the user owns the ChatGPT account, so it is safe (and expected)\n to refresh these entries too. Without this, a user who once ran the\n ``arcen auth add`` workaround for #33000 would silently leave that\n manual entry stale on every subsequent re-auth, recreating the issue\n reported in #33538.\n\n What does NOT get refreshed:\n\n * ``manual:api_key`` and any other non-device-code manual sources — those\n are independent credentials (an explicit API key, a different ChatGPT\n account, etc.) and must not be overwritten by a single re-auth.\n\n Error markers (``last_status``, ``last_error_*``) are also cleared on\n every device-code-backed entry — even those whose tokens we did not\n rewrite — so that an interactive re-auth gives every relevant pool entry\n a fresh selection chance instead of leaving them marked unhealthy from a\n pre-re-auth 401.\n \"\"\"\n access_token = tokens.get(\"access_token\")\n if not access_token:\n return\n refresh_token = tokens.get(\"refresh_token\")\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return\n # Sources whose tokens should be rewritten by a fresh Codex device-code\n # OAuth re-auth. ``manual:api_key`` and unknown sources are intentionally\n # excluded — they represent independent credentials.\n REFRESHABLE_SOURCES = {\"device_code\", \"manual:device_code\"}\n for entry in entries:\n if not isinstance(entry, dict):\n continue\n source = entry.get(\"source\")\n if source not in REFRESHABLE_SOURCES:\n continue\n entry[\"access_token\"] = access_token\n if refresh_token:\n entry[\"refresh_token\"] = refresh_token\n if last_refresh:\n entry[\"last_refresh\"] = last_refresh\n entry[\"last_status\"] = None\n entry[\"last_status_at\"] = None\n entry[\"last_error_code\"] = None\n entry[\"last_error_reason\"] = None\n entry[\"last_error_message\"] = None\n entry[\"last_error_reset_at\"] = None\n\n\ndef _save_codex_tokens(tokens: Dict[str, str], last_refresh: str = None, label: str = None) -> None:\n \"\"\"Save Codex OAuth tokens to Arcen auth store (~/.arcen/auth.json).\"\"\"\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"chatgpt\"\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n _save_provider_state(auth_store, \"openai-codex\", state)\n _sync_codex_pool_entries(auth_store, tokens, last_refresh)\n _save_auth_store(auth_store)\n\n\ndef refresh_codex_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"Refresh Codex OAuth tokens without mutating Arcen auth state.\"\"\"\n del access_token # Access token is only used by callers to decide whether to refresh.\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n CODEX_OAUTH_TOKEN_URL,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": CODEX_OAUTH_CLIENT_ID,\n },\n )\n\n if response.status_code == 429:\n # Upstream rate-limit / usage-quota exhaustion on the token endpoint.\n # The stored refresh token is still valid here — re-authenticating\n # cannot lift a quota cap. Classify distinctly from auth failures so\n # callers surface a \"retry later\" notice instead of a misleading\n # \"run arcen auth\" prompt (see issue #32790).\n retry_after = _parse_retry_after_seconds(getattr(response, \"headers\", None))\n if retry_after is not None:\n message = (\n f\"Codex provider quota exhausted (429); retry after {retry_after}s. \"\n \"Credentials are still valid.\"\n )\n else:\n message = (\n \"Codex provider quota exhausted (429). Credentials are still valid; \"\n \"retry after the usage limit resets.\"\n )\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=CODEX_RATE_LIMITED_CODE,\n relogin_required=False,\n )\n\n if response.status_code != 200:\n code = \"codex_refresh_failed\"\n message = f\"Codex token refresh failed with status {response.status_code}.\"\n relogin_required = False\n try:\n err = response.json()\n if isinstance(err, dict):\n err_obj = err.get(\"error\")\n # OpenAI shape: {\"error\": {\"code\": \"...\", \"message\": \"...\", \"type\": \"...\"}}\n if isinstance(err_obj, dict):\n nested_code = err_obj.get(\"code\") or err_obj.get(\"type\")\n if isinstance(nested_code, str) and nested_code.strip():\n code = nested_code.strip()\n nested_msg = err_obj.get(\"message\")\n if isinstance(nested_msg, str) and nested_msg.strip():\n message = f\"Codex token refresh failed: {nested_msg.strip()}\"\n # OAuth spec shape: {\"error\": \"code_str\", \"error_description\": \"...\"}\n elif isinstance(err_obj, str) and err_obj.strip():\n code = err_obj.strip()\n err_desc = err.get(\"error_description\") or err.get(\"message\")\n if isinstance(err_desc, str) and err_desc.strip():\n message = f\"Codex token refresh failed: {err_desc.strip()}\"\n except Exception:\n pass\n if code in {\"invalid_grant\", \"invalid_token\", \"invalid_request\"}:\n relogin_required = True\n if code == \"refresh_token_reused\":\n message = (\n \"Codex refresh token was already consumed by another client \"\n \"(e.g. Codex CLI or VS Code extension). \"\n \"Run `codex` in your terminal to generate fresh tokens, \"\n \"then run `arcen auth` to re-authenticate.\"\n )\n relogin_required = True\n # A 401/403 from the token endpoint always means the refresh token\n # is invalid/expired — force relogin even if the body error code\n # wasn't one of the known strings above.\n if response.status_code in {401, 403} and not relogin_required:\n relogin_required = True\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=code,\n relogin_required=relogin_required,\n )\n\n try:\n refresh_payload = response.json()\n except Exception as exc:\n raise AuthError(\n \"Codex token refresh returned invalid JSON.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_invalid_json\",\n relogin_required=True,\n ) from exc\n\n refreshed_access = refresh_payload.get(\"access_token\")\n if not isinstance(refreshed_access, str) or not refreshed_access.strip():\n raise AuthError(\n \"Codex token refresh response was missing access_token.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_missing_access_token\",\n relogin_required=True,\n )\n\n updated = {\n \"access_token\": refreshed_access.strip(),\n \"refresh_token\": refresh_token.strip(),\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n next_refresh = refresh_payload.get(\"refresh_token\")\n if isinstance(next_refresh, str) and next_refresh.strip():\n updated[\"refresh_token\"] = next_refresh.strip()\n return updated\n\n\ndef _refresh_codex_auth_tokens(\n tokens: Dict[str, str],\n timeout_seconds: float,\n) -> Dict[str, str]:\n \"\"\"Refresh Codex access token using the refresh token.\n \n Saves the new tokens to Arcen auth store automatically.\n \"\"\"\n refreshed = refresh_codex_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n\n _save_codex_tokens(updated_tokens)\n return updated_tokens\n\n\ndef _import_codex_cli_tokens() -> Optional[Dict[str, str]]:\n \"\"\"Try to read tokens from ~/.codex/auth.json (Codex CLI shared file).\n \n Returns tokens dict if valid and not expired, None otherwise.\n Does NOT write to the shared file.\n \"\"\"\n codex_home = os.getenv(\"CODEX_HOME\", \"\").strip()\n if not codex_home:\n codex_home = str(Path.home() / \".codex\")\n auth_path = Path(codex_home).expanduser() / \"auth.json\"\n if not auth_path.is_file():\n return None\n try:\n payload = json.loads(auth_path.read_text())\n tokens = payload.get(\"tokens\")\n if not isinstance(tokens, dict):\n return None\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not access_token or not refresh_token:\n return None\n # Reject expired tokens — importing stale tokens from ~/.codex/\n # that can't be refreshed leaves the user stuck with \"Login successful!\"\n # but no working credentials.\n if _codex_access_token_is_expiring(access_token, 0):\n logger.debug(\n \"Codex CLI tokens at %s are expired — skipping import.\", auth_path,\n )\n return None\n return dict(tokens)\n except Exception:\n return None\n\n\ndef resolve_codex_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime credentials from Arcen's own Codex token store.\n\n Falls back to the credential pool when the singleton (``providers.openai-codex.tokens``)\n has no usable access_token but the pool (``credential_pool.openai-codex``) does. This\n closes the divergence between the chat path (singleton-only via this function) and\n the auxiliary path (pool-first via ``_read_codex_access_token``). Without this\n fallback, a user whose tokens live only in the pool — for example after a manual\n pool seed, a partial re-auth, or pool-only restoration from a backup — gets a bare\n HTTP 401 ``Missing Authentication header`` from the wire instead of a usable\n credential. See issue #32992.\n \"\"\"\n try:\n data = _read_codex_tokens()\n except AuthError:\n pool_token = _pool_codex_access_token()\n if pool_token:\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": pool_token,\n \"source\": \"credential_pool\",\n \"last_refresh\": None,\n \"auth_mode\": \"chatgpt\",\n }\n raise\n\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_CODEX_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n # Re-read under lock to avoid racing with other Arcen processes\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_codex_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n\n if should_refresh:\n tokens = _refresh_codex_auth_tokens(tokens, refresh_timeout_seconds)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"chatgpt\",\n }\n\n\ndef _pool_codex_access_token() -> str:\n \"\"\"Return the most-recent usable access_token from the openai-codex pool.\n\n Used as a fallback by ``resolve_codex_runtime_credentials`` when the\n singleton has no creds. Reads ``credential_pool.openai-codex`` entries\n directly from auth.json and picks the first non-empty access_token,\n preferring entries that are not currently in an exhaustion cooldown.\n Returns ``\"\"`` when no usable entry is found (caller handles by raising\n the original AuthError).\n \"\"\"\n try:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return \"\"\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return \"\"\n\n def _entry_usable(entry: Dict[str, Any]) -> bool:\n if not isinstance(entry, dict):\n return False\n token = entry.get(\"access_token\")\n if not isinstance(token, str) or not token.strip():\n return False\n # Skip entries currently in an exhaustion cooldown window.\n reset_at = entry.get(\"last_error_reset_at\")\n if isinstance(reset_at, (int, float)) and reset_at > time.time():\n return False\n return True\n\n for entry in entries:\n if _entry_usable(entry):\n return str(entry.get(\"access_token\", \"\")).strip()\n except Exception:\n logger.debug(\"Codex pool fallback lookup failed\", exc_info=True)\n return \"\"\n\n\n# =============================================================================\n# xAI Grok OAuth — tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\ndef _read_xai_oauth_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\")\n if not state:\n raise AuthError(\n \"No xAI OAuth credentials stored. Select xAI Grok OAuth (SuperGrok / Premium+) in `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"xAI OAuth state is missing tokens. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI OAuth state is missing access_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_access_token\",\n relogin_required=True,\n )\n if not refresh_token:\n raise AuthError(\n \"xAI OAuth state is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n \"discovery\": state.get(\"discovery\") or {},\n \"redirect_uri\": state.get(\"redirect_uri\"),\n }\n\n\ndef _save_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n discovery: Optional[Dict[str, Any]] = None,\n redirect_uri: str = \"\",\n last_refresh: Optional[str] = None,\n) -> None:\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"oauth_pkce\"\n if discovery:\n state[\"discovery\"] = discovery\n if redirect_uri:\n state[\"redirect_uri\"] = redirect_uri\n _save_provider_state(auth_store, \"xai-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef _xai_access_token_is_expiring(access_token: str, skew_seconds: int = 0) -> bool:\n if not isinstance(access_token, str) or \".\" not in access_token:\n return False\n try:\n parts = access_token.split(\".\")\n if len(parts) < 2:\n return False\n payload_b64 = parts[1]\n payload_b64 += \"=\" * (-len(payload_b64) % 4)\n payload = json.loads(base64.urlsafe_b64decode(payload_b64.encode(\"ascii\")).decode(\"utf-8\"))\n exp = payload.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n except Exception:\n return False\n\n\ndef _xai_validate_oauth_endpoint(url: str, *, field: str) -> str:\n \"\"\"Refuse any OIDC discovery endpoint that isn't HTTPS on the xAI origin.\n\n The OIDC discovery response is a long-lived, low-frequency request whose\n output is cached in ``~/.arcen/auth.json``. A single MITM during initial\n login could substitute a malicious ``token_endpoint``; that URL would\n then receive the refresh_token on every subsequent refresh — a permanent\n credential leak from a one-time MITM. Validating scheme + host pins the\n cached endpoint to the xAI auth origin (or a future ``*.x.ai`` subdomain\n if xAI migrates) so the cache poisoning loses its persistence guarantee.\n\n RFC 8414 §2 requires the issuer to be ``https://`` and SHOULD-keeps the\n token_endpoint on the same origin; we enforce both. ``x.ai`` is the\n bare apex, so we accept either exact host match or any ``.x.ai`` suffix.\n \"\"\"\n parsed = urlparse(url)\n if parsed.scheme != \"https\":\n raise AuthError(\n f\"xAI OIDC discovery returned a non-HTTPS {field}: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n host = (parsed.hostname or \"\").lower()\n if not host:\n raise AuthError(\n f\"xAI OIDC discovery {field} is missing a hostname: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n raise AuthError(\n f\"xAI OIDC discovery {field} host {host!r} is not on the xAI origin \"\n f\"(expected x.ai or a *.x.ai subdomain). Refusing to use a cached \"\n f\"endpoint that may have been substituted by a MITM during initial \"\n f\"discovery; re-authenticate with `arcen model` to re-fetch.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n return url\n\n\ndef _xai_validate_inference_base_url(value: str, *, fallback: str) -> str:\n \"\"\"Refuse a non-xAI base_url for the OAuth-authenticated inference path.\n\n The xAI Grok OAuth bearer is a high-value, long-lived credential tied to\n the user's SuperGrok subscription. ``XAI_BASE_URL`` / ``ARCEN_XAI_BASE_URL``\n let users repoint the inference endpoint (handy for staging or a local\n proxy), but the env override is also a credential-leak vector: a tampered\n ``.env`` or hostile shell init that sets\n ``XAI_BASE_URL=https://attacker.example/v1`` would ship the OAuth access\n token to a third party on every request, silently.\n\n Pin the inference origin to ``api.x.ai`` (or any ``*.x.ai`` subdomain xAI\n may add). On rejection, fall back to the default and log a warning rather\n than raise — a bad env var should not deadlock authentication, but it\n should also never leak the bearer.\n\n ``value`` is the already-stripped, trailing-slash-trimmed candidate from\n env. Empty input returns ``fallback`` unchanged.\n \"\"\"\n candidate = (value or \"\").strip().rstrip(\"/\")\n if not candidate:\n return fallback\n try:\n parsed = urlparse(candidate)\n except Exception:\n logger.warning(\n \"Ignoring malformed xAI base_url override %r; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if parsed.scheme != \"https\":\n logger.warning(\n \"Refusing non-HTTPS xAI base_url override %r (xai-oauth bearer would \"\n \"be sent in cleartext); falling back to %s.\",\n candidate, fallback,\n )\n return fallback\n host = (parsed.hostname or \"\").lower()\n if not host:\n logger.warning(\n \"Ignoring xAI base_url override %r with no hostname; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n logger.warning(\n \"Refusing xAI base_url override %r — host %r is not on the xAI origin \"\n \"(expected x.ai or a *.x.ai subdomain). The xai-oauth bearer is only \"\n \"valid against xAI's inference API; sending it elsewhere would leak \"\n \"the credential. Falling back to %s.\",\n candidate, host, fallback,\n )\n return fallback\n return candidate\n\n\ndef _xai_oauth_discovery(timeout_seconds: float = 15.0) -> Dict[str, str]:\n try:\n response = httpx.get(\n XAI_OAUTH_DISCOVERY_URL,\n headers={\"Accept\": \"application/json\"},\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n ) from exc\n if response.status_code != 200:\n raise AuthError(\n f\"xAI OIDC discovery returned status {response.status_code}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI OIDC discovery response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n authorization_endpoint = str(payload.get(\"authorization_endpoint\", \"\") or \"\").strip()\n token_endpoint = str(payload.get(\"token_endpoint\", \"\") or \"\").strip()\n if not authorization_endpoint or not token_endpoint:\n raise AuthError(\n \"xAI OIDC discovery response was missing required endpoints.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n _xai_validate_oauth_endpoint(authorization_endpoint, field=\"authorization_endpoint\")\n _xai_validate_oauth_endpoint(token_endpoint, field=\"token_endpoint\")\n return {\n \"authorization_endpoint\": authorization_endpoint,\n \"token_endpoint\": token_endpoint,\n }\n\n\ndef refresh_xai_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n token_endpoint: str = \"\",\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n del access_token\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"xAI OAuth is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n endpoint = token_endpoint.strip() or _xai_oauth_discovery(timeout_seconds)[\"token_endpoint\"]\n # Re-validate cached endpoints on the refresh hot path: an auth.json\n # written by an older Arcen (or hand-edited) may carry a non-xAI\n # token_endpoint that would receive every future refresh_token in\n # plaintext if we trusted it blindly. Cheap suffix check; fast-fail\n # with a clear error so the user can re-run `arcen model` to refetch.\n _xai_validate_oauth_endpoint(endpoint, field=\"token_endpoint\")\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n endpoint,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"refresh_token\": refresh_token,\n },\n )\n if response.status_code != 200:\n detail = response.text.strip()\n # ``403`` from xAI's token endpoint is almost always a tier /\n # entitlement gate (the OAuth grant exists but the account isn't\n # on the allowlist for API access). Re-running ``arcen model``\n # won't fix that — surface a separate error code so\n # ``format_auth_error`` doesn't append a misleading\n # re-authenticate hint, and point users at the ``XAI_API_KEY``\n # fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n \"xAI token refresh failed with HTTP 403.\"\n + (f\" Response: {detail}\" if detail else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Re-logging in won't\"\n \" change that; set ``XAI_API_KEY`` and switch to\"\n \" ``provider: xai`` (API-key path) if available, or\"\n \" upgrade your subscription at https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n \"xAI token refresh failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_refresh_failed\",\n relogin_required=(response.status_code in {400, 401}),\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token refresh returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token refresh response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_response\",\n relogin_required=True,\n )\n refreshed_access = str(payload.get(\"access_token\", \"\") or \"\").strip()\n if not refreshed_access:\n raise AuthError(\n \"xAI token refresh response was missing access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_missing_access_token\",\n relogin_required=True,\n )\n updated = {\n \"access_token\": refreshed_access,\n \"refresh_token\": str(payload.get(\"refresh_token\") or refresh_token).strip(),\n \"id_token\": str(payload.get(\"id_token\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n return updated\n\n\ndef _refresh_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n token_endpoint: str,\n redirect_uri: str = \"\",\n timeout_seconds: float,\n) -> Dict[str, Any]:\n refreshed = refresh_xai_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n token_endpoint=token_endpoint,\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n if refreshed.get(\"id_token\"):\n updated_tokens[\"id_token\"] = refreshed[\"id_token\"]\n if refreshed.get(\"expires_in\") is not None:\n updated_tokens[\"expires_in\"] = refreshed[\"expires_in\"]\n if refreshed.get(\"token_type\"):\n updated_tokens[\"token_type\"] = refreshed[\"token_type\"]\n _save_xai_oauth_tokens(\n updated_tokens,\n discovery={\"token_endpoint\": token_endpoint},\n redirect_uri=redirect_uri,\n last_refresh=refreshed[\"last_refresh\"],\n )\n return updated_tokens\n\n\ndef resolve_xai_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n data = _read_xai_oauth_tokens()\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_XAI_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_xai_oauth_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n if not token_endpoint:\n token_endpoint = _xai_oauth_discovery(refresh_timeout_seconds)[\"token_endpoint\"]\n try:\n tokens = _refresh_xai_oauth_tokens(\n tokens,\n token_endpoint=token_endpoint,\n redirect_uri=redirect_uri,\n timeout_seconds=refresh_timeout_seconds,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n except AuthError as exc:\n if _is_terminal_xai_oauth_refresh_error(exc):\n # Terminal failure (HTTP 400/401/403 — invalid_grant, token revoked).\n # Clear dead tokens from auth.json so subsequent sessions fail fast\n # without a network retry. Mirrors credential_pool.py quarantine.\n try:\n _q_store = _load_auth_store()\n _q_state = _load_provider_state(_q_store, \"xai-oauth\") or {}\n _q_tokens = dict(_q_state.get(\"tokens\") or {})\n _q_tokens.pop(\"access_token\", None)\n _q_tokens.pop(\"refresh_token\", None)\n _q_state[\"tokens\"] = _q_tokens\n _q_state[\"last_auth_error\"] = {\n \"provider\": \"xai-oauth\",\n \"code\": exc.code or \"xai_refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _store_provider_state(_q_store, \"xai-oauth\", _q_state, set_active=False)\n _save_auth_store(_q_store)\n except Exception as _save_exc:\n logger.debug(\n \"xAI OAuth: failed to persist quarantined state: %s\", _save_exc,\n )\n raise\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"provider\": \"xai-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"oauth_pkce\",\n }\n\n\n# =============================================================================\n# TLS verification helper\n# =============================================================================\n\ndef _default_verify() -> bool | ssl.SSLContext:\n \"\"\"Platform-aware default SSL verify for httpx clients.\n\n On macOS with Homebrew Python, the system OpenSSL cannot locate the\n system trust store and valid public certs fail verification. When\n certifi is importable we pin its bundle explicitly; elsewhere we\n defer to httpx's built-in default (certifi via its own dependency).\n Mirrors the weixin fix in 3a0ec1d93.\n \"\"\"\n if sys.platform == \"darwin\":\n try:\n import certifi\n return ssl.create_default_context(cafile=certifi.where())\n except ImportError:\n pass\n return True\n\n\ndef _resolve_verify(\n *,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n auth_state: Optional[Dict[str, Any]] = None,\n) -> bool | ssl.SSLContext:\n tls_state = auth_state.get(\"tls\") if isinstance(auth_state, dict) else {}\n tls_state = tls_state if isinstance(tls_state, dict) else {}\n\n effective_insecure = (\n is_truthy_value(insecure, default=False) if insecure is not None\n else is_truthy_value(tls_state.get(\"insecure\", False), default=False)\n )\n effective_ca = (\n ca_bundle\n or tls_state.get(\"ca_bundle\")\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n or os.getenv(\"REQUESTS_CA_BUNDLE\")\n )\n\n if effective_insecure:\n return False\n if effective_ca:\n ca_path = str(effective_ca)\n if not os.path.isfile(ca_path):\n logger.warning(\n \"CA bundle path does not exist: %s — falling back to default certificates\",\n ca_path,\n )\n return _default_verify()\n return ssl.create_default_context(cafile=ca_path)\n return _default_verify()\n\n\n# =============================================================================\n# OAuth Device Code Flow — generic, parameterized by provider\n# =============================================================================\n\ndef _request_device_code(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n scope: Optional[str],\n) -> Dict[str, Any]:\n \"\"\"POST to the device code endpoint. Returns device_code, user_code, etc.\"\"\"\n response = client.post(\n f\"{portal_base_url}/api/oauth/device/code\",\n data={\n \"client_id\": client_id,\n **({\"scope\": scope} if scope else {}),\n },\n )\n response.raise_for_status()\n data = response.json()\n\n required_fields = [\n \"device_code\", \"user_code\", \"verification_uri\",\n \"verification_uri_complete\", \"expires_in\", \"interval\",\n ]\n missing = [f for f in required_fields if f not in data]\n if missing:\n raise ValueError(f\"Device code response missing fields: {', '.join(missing)}\")\n return data\n\n\ndef _poll_for_token(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n device_code: str,\n expires_in: int,\n poll_interval: int,\n) -> Dict[str, Any]:\n \"\"\"Poll the token endpoint until the user approves or the code expires.\"\"\"\n deadline = time.monotonic() + max(1, expires_in)\n current_interval = max(1, min(poll_interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n\n while time.monotonic() < deadline:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n data={\n \"grant_type\": \"urn:ietf:params:oauth:grant-type:device_code\",\n \"client_id\": client_id,\n \"device_code\": device_code,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise ValueError(\"Token response did not include access_token\")\n return payload\n\n try:\n error_payload = response.json()\n except Exception:\n response.raise_for_status()\n raise RuntimeError(\"Token endpoint returned a non-JSON error response\")\n\n error_code = error_payload.get(\"error\", \"\")\n if error_code == \"authorization_pending\":\n time.sleep(current_interval)\n continue\n if error_code == \"slow_down\":\n current_interval = min(current_interval + 1, 30)\n time.sleep(current_interval)\n continue\n\n description = error_payload.get(\"error_description\") or \"Unknown authentication error\"\n raise RuntimeError(f\"{error_code}: {description}\")\n\n raise TimeoutError(\"Timed out waiting for device authorization\")\n\n\n# =============================================================================\n# Removed provider Portal — token refresh and model discovery\n# =============================================================================\n\n# -----------------------------------------------------------------------------\n# Shared Removed provider token store — lets OAuth credentials persist across profiles\n# so a new `arcen --profile <name> auth add removed_provider --type oauth` can one-tap\n# import instead of running the full device-code flow every time.\n#\n# File lives at ${ARCEN_SHARED_AUTH_DIR}/removed_provider_auth.json, defaulting to\n# ``<arcen-root>/shared/removed_provider_auth.json`` where ``<arcen-root>`` is what\n# ``get_default_arcen_root()`` returns — ``~/.arcen`` on Linux/macOS,\n# ``%LOCALAPPDATA%\\arcen`` on native Windows, or the Docker/custom root.\n# It is OUTSIDE any named profile's ARCEN_HOME so named profiles (which\n# typically live under ``<arcen-root>/profiles/<name>/``) all see the\n# same file.\n#\n# Written on successful login and on every runtime refresh so the stored\n# refresh_token stays current even if one profile refreshes and rotates it.\n# If ever the stored refresh_token does go stale server-side, import fails\n# gracefully and the user falls back to the normal device-code flow.\n# -----------------------------------------------------------------------------\n\nREMOVED_PROVIDER_SHARED_STORE_FILENAME = \"removed_provider_auth.json\"\n_removed_provider_shared_lock_holder = threading.local()\n\n\ndef _removed_provider_shared_auth_dir() -> Path:\n \"\"\"Resolve the directory that holds the shared Removed provider token store.\n\n Honors ``ARCEN_SHARED_AUTH_DIR`` so tests can redirect it to a tmp\n path without touching the real user's home. Defaults to\n ``<arcen-root>/shared/``, where ``<arcen-root>`` is what\n :func:`arcen_constants.get_default_arcen_root` returns — so\n Linux/macOS classic installs land at ``~/.arcen/shared/``, native\n Windows installs at ``%LOCALAPPDATA%\\\\arcen\\\\shared\\\\``, and\n Docker / custom ``ARCEN_HOME`` deployments at\n ``<ARCEN_HOME>/shared/``. Sits outside any named profile so all\n profiles under the same root share the store.\n \"\"\"\n override = os.getenv(\"ARCEN_SHARED_AUTH_DIR\", \"\").strip()\n if override:\n return Path(override).expanduser()\n from arcen_constants import get_default_arcen_root\n return get_default_arcen_root() / \"shared\"\n\n\ndef _removed_provider_shared_store_path() -> Path:\n path = _removed_provider_shared_auth_dir() / REMOVED_PROVIDER_SHARED_STORE_FILENAME\n # Seat belt: if pytest is running and this resolves to a path under the\n # real user's Arcen root, refuse rather than silently corrupt cross-profile\n # state. Tests must set ARCEN_SHARED_AUTH_DIR to a tmp_path (conftest\n # does not do this automatically — mirror the _auth_file_path() guard\n # so forgetting to set it fails loudly instead of writing to the real\n # shared store).\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n from arcen_constants import get_default_arcen_root\n real_home_shared = (\n get_default_arcen_root() / \"shared\" / REMOVED_PROVIDER_SHARED_STORE_FILENAME\n ).resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_shared:\n raise RuntimeError(\n f\"Refusing to touch real user shared Removed provider auth store during test run: \"\n f\"{path}. Set ARCEN_SHARED_AUTH_DIR to a tmp_path in your test fixture.\"\n )\n return path\n\n\n@contextmanager\ndef _removed_provider_shared_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-profile lock for the shared Removed provider OAuth store.\n\n Lock ordering invariant: if both this and ``_auth_store_lock`` need\n to be held, acquire ``_auth_store_lock`` FIRST. All runtime refresh\n paths follow this order. The one exception is\n ``_try_import_shared_removed_provider_state``, which holds this lock alone for\n the entire refresh cycle so concurrent imports on sibling profiles\n can't race on the single-use shared refresh token; that helper must\n NOT be called with ``_auth_store_lock`` already held.\n \"\"\"\n try:\n lock_path = _removed_provider_shared_store_path().with_suffix(\".lock\")\n except RuntimeError:\n # No ARCEN_HOME yet (pre-setup): fall through without locking.\n yield\n return\n\n with _file_lock(\n lock_path,\n _removed_provider_shared_lock_holder,\n timeout_seconds,\n \"Timed out waiting for shared Removed provider auth lock\",\n ):\n yield\n\n\ndef _merge_shared_removed_provider_oauth_state(state: Dict[str, Any]) -> bool:\n \"\"\"Copy fresher shared OAuth tokens into a profile-local Removed provider state.\"\"\"\n shared = _read_shared_removed_provider_state()\n if not shared:\n return False\n\n shared_refresh = shared.get(\"refresh_token\")\n if not isinstance(shared_refresh, str) or not shared_refresh.strip():\n return False\n\n local_refresh = state.get(\"refresh_token\")\n shared_access_exp = _parse_iso_timestamp(shared.get(\"expires_at\")) or 0.0\n local_access_exp = _parse_iso_timestamp(state.get(\"expires_at\")) or 0.0\n refresh_changed = shared_refresh.strip() != str(local_refresh or \"\").strip()\n fresher_access = shared_access_exp > local_access_exp\n if not refresh_changed and not fresher_access:\n return False\n\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"token_type\",\n \"scope\",\n \"client_id\",\n \"portal_base_url\",\n \"inference_base_url\",\n \"obtained_at\",\n \"expires_at\",\n ):\n value = shared.get(key)\n if value not in {None, \"\"}:\n state[key] = value\n return True\n\n\ndef _write_shared_removed_provider_state(state: Dict[str, Any]) -> None:\n \"\"\"Persist a minimal copy of the Removed provider OAuth state to the shared store.\n\n Best-effort: any failure is swallowed after logging. The shared store\n is a convenience layer; the per-profile auth.json remains the source\n of truth.\n\n We deliberately omit the runtime ``agent_key`` compatibility field;\n the OAuth tokens are the cross-profile source of truth.\n \"\"\"\n refresh_token = state.get(\"refresh_token\")\n access_token = state.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n # No refresh_token = nothing worth sharing across profiles\n return\n if not (isinstance(access_token, str) and access_token.strip()):\n return\n\n shared = {\n \"_schema\": 1,\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"token_type\": state.get(\"token_type\") or \"Bearer\",\n \"scope\": state.get(\"scope\") or DEFAULT_REMOVED_PROVIDER_SCOPE,\n \"client_id\": state.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID,\n \"portal_base_url\": state.get(\"portal_base_url\") or DEFAULT_REMOVED_PROVIDER_PORTAL_URL,\n \"inference_base_url\": state.get(\"inference_base_url\") or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL,\n \"obtained_at\": state.get(\"obtained_at\"),\n \"expires_at\": state.get(\"expires_at\"),\n \"updated_at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n with _removed_provider_shared_store_lock():\n path = _removed_provider_shared_store_path()\n path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(path)\n tmp = path.with_name(f\"{path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed Removed provider\n # refresh_token at process umask. See #19673, #21148.\n fd = os.open(\n str(tmp),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(shared, indent=2, sort_keys=True))\n fh.flush()\n os.fsync(fh.fileno())\n os.replace(tmp, path)\n finally:\n try:\n if tmp.exists():\n tmp.unlink()\n except OSError:\n pass\n _oauth_trace(\n \"removed_provider_shared_store_written\",\n path=str(path),\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n except Exception as exc:\n logger.debug(\"Failed to write shared Removed provider auth store: %s\", exc)\n\n\ndef _read_shared_removed_provider_state() -> Optional[Dict[str, Any]]:\n \"\"\"Return the shared Removed provider OAuth state if present and well-formed.\n\n Returns ``None`` when the file is missing, unreadable, malformed, or\n lacks required fields. Callers should treat ``None`` as \"no shared\n credentials available — fall through to device-code\".\n \"\"\"\n try:\n path = _removed_provider_shared_store_path()\n except RuntimeError:\n # Test seat belt tripped — treat as missing\n return None\n if not path.is_file():\n return None\n try:\n payload = json.loads(path.read_text())\n except (OSError, ValueError) as exc:\n logger.debug(\"Shared Removed provider auth store at %s is unreadable: %s\", path, exc)\n return None\n if not isinstance(payload, dict):\n return None\n refresh_token = payload.get(\"refresh_token\")\n access_token = payload.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n return None\n if not (isinstance(access_token, str) and access_token.strip()):\n return None\n return payload\n\n\ndef _clear_shared_removed_provider_state(reason: str) -> None:\n \"\"\"Remove the shared Removed provider OAuth store after a terminal token failure.\"\"\"\n try:\n with _removed_provider_shared_store_lock():\n path = _removed_provider_shared_store_path()\n try:\n path.unlink()\n except FileNotFoundError:\n pass\n _oauth_trace(\"removed_provider_shared_store_cleared\", reason=reason)\n except Exception as exc:\n logger.debug(\"Failed to clear shared Removed provider auth store: %s\", exc)\n\n\ndef _is_terminal_removed_provider_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Removed provider refresh token cannot succeed.\"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"removed_provider\"\n and exc.code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_xai_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same xAI OAuth refresh token cannot succeed.\n\n ``xai_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``xai_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"xai-oauth\"\n and exc.code in {\"xai_refresh_failed\", \"xai_auth_missing_refresh_token\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_codex_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Codex OAuth refresh token cannot succeed.\n\n ``codex_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``codex_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"openai-codex\"\n and exc.code in {\n \"codex_refresh_failed\",\n \"codex_auth_missing_refresh_token\",\n \"invalid_grant\",\n \"invalid_token\",\n \"refresh_token_reused\",\n }\n and bool(exc.relogin_required)\n )\n\n\ndef _quarantine_removed_provider_oauth_state(\n state: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> None:\n \"\"\"Keep routing metadata but remove dead OAuth material so it is not replayed.\"\"\"\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"expires_at\",\n \"expires_in\",\n \"obtained_at\",\n \"agent_key\",\n \"agent_key_id\",\n \"agent_key_expires_at\",\n \"agent_key_expires_in\",\n \"agent_key_reused\",\n \"agent_key_obtained_at\",\n ):\n state.pop(key, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"removed_provider\",\n \"code\": error.code,\n \"message\": str(error),\n \"reason\": reason,\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _clear_shared_removed_provider_state(reason)\n invalidate_removed_provider_auth_status_cache()\n\n\ndef _quarantine_removed_provider_pool_entries(\n auth_store: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> bool:\n \"\"\"Remove singleton-seeded Removed provider pool entries that contain dead OAuth state.\"\"\"\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return False\n entries = pool.get(\"removed_provider\")\n if not isinstance(entries, list):\n return False\n\n retained = []\n removed = False\n singleton_sources = {REMOVED_PROVIDER_DEVICE_CODE_SOURCE, f\"manual:{REMOVED_PROVIDER_DEVICE_CODE_SOURCE}\"}\n for entry in entries:\n if isinstance(entry, dict) and entry.get(\"source\") in singleton_sources:\n removed = True\n continue\n retained.append(entry)\n\n if removed:\n pool[\"removed_provider\"] = retained\n _oauth_trace(\n \"removed_provider_pool_device_code_quarantined\",\n reason=reason,\n error_code=error.code,\n )\n return removed\n\n\ndef _try_import_shared_removed_provider_state(\n *,\n timeout_seconds: float = 15.0,\n) -> Optional[Dict[str, Any]]:\n \"\"\"Attempt to rehydrate Removed provider OAuth state from the shared store.\n\n Reads the shared file (if present), runs a forced refresh using the\n stored refresh_token to produce a fresh inference JWT scoped to this\n profile, and returns the full auth_state dict ready\n for ``persist_removed_provider_credentials()``.\n\n Returns ``None`` when no shared state is available or the rehydrate\n fails for any reason (expired refresh_token, portal unreachable,\n etc.) — caller should then fall through to the normal device-code\n flow.\n \"\"\"\n try:\n with _removed_provider_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n shared = _read_shared_removed_provider_state()\n if not shared:\n return None\n\n # Build a full state dict so refresh_removed_provider_oauth_from_state has every\n # field it needs. force_refresh=True gets us a fresh access_token\n # for this profile.\n state: Dict[str, Any] = {\n \"access_token\": shared.get(\"access_token\"),\n \"refresh_token\": shared.get(\"refresh_token\"),\n \"client_id\": shared.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID,\n \"portal_base_url\": shared.get(\"portal_base_url\") or DEFAULT_REMOVED_PROVIDER_PORTAL_URL,\n \"inference_base_url\": shared.get(\"inference_base_url\") or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL,\n \"token_type\": shared.get(\"token_type\") or \"Bearer\",\n \"scope\": shared.get(\"scope\") or DEFAULT_REMOVED_PROVIDER_SCOPE,\n \"obtained_at\": shared.get(\"obtained_at\"),\n \"expires_at\": shared.get(\"expires_at\"),\n \"agent_key\": None,\n \"agent_key_expires_at\": None,\n \"tls\": {\"insecure\": False, \"ca_bundle\": None},\n }\n\n def _persist_shared_refresh(updated_state: Dict[str, Any], _reason: str) -> None:\n _write_shared_removed_provider_state(updated_state)\n\n refreshed = refresh_removed_provider_oauth_from_state(\n state,\n timeout_seconds=timeout_seconds,\n force_refresh=True,\n on_state_update=_persist_shared_refresh,\n )\n _write_shared_removed_provider_state(refreshed)\n except AuthError as exc:\n _oauth_trace(\n \"removed_provider_shared_import_failed\",\n error_type=type(exc).__name__,\n error_code=getattr(exc, \"code\", None),\n )\n if _is_terminal_removed_provider_refresh_error(exc):\n _clear_shared_removed_provider_state(\"shared_import_terminal_refresh_failure\")\n logger.debug(\"Shared Removed provider import failed: %s\", exc)\n return None\n except Exception as exc:\n _oauth_trace(\n \"removed_provider_shared_import_failed\",\n error_type=type(exc).__name__,\n )\n logger.debug(\"Shared Removed provider import failed: %s\", exc)\n return None\n\n return refreshed\n\n\ndef _refresh_access_token(\n *,\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n refresh_token: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n headers={\"x-removed_provider-refresh-token\": refresh_token},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": client_id,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise AuthError(\"Refresh response missing access_token\",\n provider=\"removed_provider\", code=\"invalid_token\", relogin_required=True)\n return payload\n\n try:\n error_payload = response.json()\n except Exception as exc:\n raise AuthError(\"Refresh token exchange failed\",\n provider=\"removed_provider\", relogin_required=True) from exc\n\n code = str(error_payload.get(\"error\", \"invalid_grant\"))\n description = str(error_payload.get(\"error_description\") or \"Refresh token exchange failed\")\n relogin = code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n\n # Detect the OAuth 2.1 \"refresh token reuse\" signal from the Removed provider portal\n # server and surface an actionable message. This fires when an external\n # process (health-check script, monitoring tool, custom self-heal hook)\n # called POST /api/oauth/token with Arcen's refresh_token without\n # persisting the rotated token back to auth.json — the server then\n # retires the original RT, Arcen's next refresh uses it, and the whole\n # session chain gets revoked as a token-theft signal (#15099).\n lowered = description.lower()\n if code == \"refresh_token_reused\" or \"reuse\" in lowered or \"reuse detected\" in lowered:\n description = (\n \"Removed provider Portal detected refresh-token reuse and revoked this session.\\n\"\n \"This usually means an external process (monitoring script, \"\n \"custom self-heal hook, or another Arcen install sharing \"\n \"~/.arcen/auth.json) called POST /api/oauth/token with Arcen's \"\n \"refresh token without persisting the rotated token back.\\n\"\n \"Removed provider refresh tokens are single-use — only Arcen may call the \"\n \"refresh endpoint. For health checks, use `arcen auth status` \"\n \"instead.\\n\"\n \"Re-authenticate with: arcen auth add removed_provider\"\n )\n relogin = True\n\n raise AuthError(description, provider=\"removed_provider\", code=code, relogin_required=relogin)\n\n\ndef fetch_removed_provider_models(\n *,\n inference_base_url: str,\n api_key: str,\n timeout_seconds: float = 15.0,\n verify: bool | str = True,\n) -> List[str]:\n \"\"\"Fetch available model IDs from the Removed provider inference API.\"\"\"\n timeout = httpx.Timeout(timeout_seconds)\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n response = client.get(\n f\"{inference_base_url.rstrip('/')}/models\",\n headers={\"Authorization\": f\"Bearer {api_key}\"},\n )\n\n if response.status_code != 200:\n description = f\"/models request failed with status {response.status_code}\"\n try:\n err = response.json()\n description = str(err.get(\"error_description\") or err.get(\"error\") or description)\n except Exception as e:\n logger.debug(\"Could not parse error response JSON: %s\", e)\n raise AuthError(description, provider=\"removed_provider\", code=\"models_fetch_failed\")\n\n payload = response.json()\n data = payload.get(\"data\")\n if not isinstance(data, list):\n return []\n\n model_ids: List[str] = []\n for item in data:\n if not isinstance(item, dict):\n continue\n model_id = item.get(\"id\")\n if isinstance(model_id, str) and model_id.strip():\n mid = model_id.strip()\n # Skip Arcen models — they're not reliable for agentic tool-calling\n if \"arcen\" in mid.lower():\n continue\n model_ids.append(mid)\n\n # Sort: prefer opus > pro > haiku/flash > sonnet (sonnet is cheap/fast,\n # users who want the best model should see opus first).\n def _model_priority(mid: str) -> tuple:\n low = mid.lower()\n if \"opus\" in low:\n return (0, mid)\n if \"pro\" in low and \"sonnet\" not in low:\n return (1, mid)\n if \"sonnet\" in low:\n return (3, mid)\n return (2, mid)\n\n model_ids.sort(key=_model_priority)\n return list(dict.fromkeys(model_ids))\n\n\ndef _agent_key_is_usable(state: Dict[str, Any], min_ttl_seconds: int) -> bool:\n key = state.get(\"agent_key\")\n if not isinstance(key, str) or not key.strip():\n return False\n return _removed_provider_invoke_jwt_is_usable(\n key,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"agent_key_expires_at\"),\n min_ttl_seconds=max(0, int(min_ttl_seconds)),\n )\n\n\ndef resolve_removed_provider_access_token(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n refresh_skew_seconds: int = ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> str:\n \"\"\"Resolve a refresh-aware Removed provider Portal access token for managed tool gateways.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"removed_provider\")\n\n if not state:\n raise AuthError(\n \"Arcen is not logged into Removed provider Portal.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"REMOVED_PROVIDER_PORTAL_BASE_URL\")\n or DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID)\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n\n with _removed_provider_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n merged_shared = _merge_shared_removed_provider_oauth_state(state)\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\n \"No access token found for Removed provider Portal login.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n\n if not _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds):\n if merged_shared:\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n return access_token\n\n if not isinstance(refresh_token, str) or not refresh_token:\n raise AuthError(\n \"Session expired and no refresh token is available.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n with httpx.Client(\n timeout=timeout,\n headers={\"Accept\": \"application/json\"},\n verify=verify,\n ) as client:\n try:\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_removed_provider_refresh_error(exc):\n _quarantine_removed_provider_oauth_state(\n state,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _quarantine_removed_provider_pool_entries(\n auth_store,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n raise\n\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl,\n tz=timezone.utc,\n ).isoformat()\n state[\"portal_base_url\"] = portal_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n _write_shared_removed_provider_state(state)\n return state[\"access_token\"]\n\n\ndef refresh_removed_provider_oauth_pure(\n access_token: str,\n refresh_token: str,\n client_id: str,\n portal_base_url: str,\n inference_base_url: str,\n *,\n token_type: str = \"Bearer\",\n scope: str = DEFAULT_REMOVED_PROVIDER_SCOPE,\n obtained_at: Optional[str] = None,\n expires_at: Optional[str] = None,\n agent_key: Optional[str] = None,\n agent_key_expires_at: Optional[str] = None,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Removed provider OAuth state without mutating auth.json directly.\n\n ``on_state_update`` is called after a successful access-token refresh.\n Callers that own persistent state can use it to save the newly rotated\n refresh token before later validation can fail.\n \"\"\"\n state: Dict[str, Any] = {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"client_id\": client_id or DEFAULT_REMOVED_PROVIDER_CLIENT_ID,\n \"portal_base_url\": (portal_base_url or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\"),\n \"inference_base_url\": (inference_base_url or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL).rstrip(\"/\"),\n \"token_type\": token_type or \"Bearer\",\n \"scope\": scope or DEFAULT_REMOVED_PROVIDER_SCOPE,\n \"obtained_at\": obtained_at,\n \"expires_at\": expires_at,\n \"agent_key\": agent_key,\n \"agent_key_expires_at\": agent_key_expires_at,\n \"tls\": {\n \"insecure\": bool(insecure),\n \"ca_bundle\": ca_bundle,\n },\n }\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n current_invoke_jwt_status = _removed_provider_invoke_jwt_status(\n state.get(\"access_token\"),\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or current_invoke_jwt_status is not None:\n refresh_token_value = state.get(\"refresh_token\")\n if not isinstance(refresh_token_value, str) or not refresh_token_value:\n if current_invoke_jwt_status is not None:\n raise AuthError(\n \"Removed provider Portal access token is not a usable inference JWT \"\n f\"({current_invoke_jwt_status}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add removed_provider\",\n provider=\"removed_provider\",\n code=current_invoke_jwt_status,\n relogin_required=True,\n )\n raise AuthError(\n \"No refresh token is available for Removed provider Portal.\",\n provider=\"removed_provider\",\n relogin_required=True,\n )\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=state[\"portal_base_url\"],\n client_id=state[\"client_id\"],\n refresh_token=refresh_token_value,\n )\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token_value\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_removed_provider_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n state[\"inference_base_url\"] = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n if on_state_update is not None:\n on_state_update(dict(state), \"post_refresh_access_token\")\n\n _assert_removed_provider_inference_jwt_usable(state)\n _select_removed_provider_invoke_jwt(state)\n\n return state\n\n\ndef refresh_removed_provider_oauth_from_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 15.0,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Removed provider OAuth from a state dict. Thin wrapper around refresh_removed_provider_oauth_pure.\"\"\"\n tls = state.get(\"tls\") or {}\n return refresh_removed_provider_oauth_pure(\n state.get(\"access_token\", \"\"),\n state.get(\"refresh_token\", \"\"),\n state.get(\"client_id\", \"arcen-cli\"),\n state.get(\"portal_base_url\", DEFAULT_REMOVED_PROVIDER_PORTAL_URL),\n state.get(\"inference_base_url\", DEFAULT_REMOVED_PROVIDER_INFERENCE_URL),\n token_type=state.get(\"token_type\", \"Bearer\"),\n scope=state.get(\"scope\", DEFAULT_REMOVED_PROVIDER_SCOPE),\n obtained_at=state.get(\"obtained_at\"),\n expires_at=state.get(\"expires_at\"),\n agent_key=state.get(\"agent_key\"),\n agent_key_expires_at=state.get(\"agent_key_expires_at\"),\n timeout_seconds=timeout_seconds,\n insecure=tls.get(\"insecure\"),\n ca_bundle=tls.get(\"ca_bundle\"),\n force_refresh=force_refresh,\n on_state_update=on_state_update,\n )\n\n\ndef persist_removed_provider_credentials(\n creds: Dict[str, Any],\n *,\n label: Optional[str] = None,\n):\n \"\"\"Persist Removed provider OAuth credentials as the singleton provider state\n and ensure the credential pool is in sync.\n\n Removed provider credentials are read at runtime from two independent locations:\n\n - ``providers.removed_provider``: singleton state read by\n ``resolve_removed_provider_runtime_credentials()`` during 401 recovery and by\n ``_seed_from_singletons()`` during pool load.\n - ``credential_pool.removed_provider``: used by the runtime ``pool.select()`` path.\n\n Historically ``arcen auth add removed_provider`` wrote a ``manual:device_code`` pool\n entry only, skipping ``providers.removed_provider``. When the runtime credential\n expired, the recovery path read the empty singleton state and raised\n ``AuthError`` silently (``logger.debug`` at INFO level).\n\n This helper writes ``providers.removed_provider`` then calls ``load_pool(\"removed_provider\")`` so\n ``_seed_from_singletons`` materialises the canonical ``device_code`` pool\n entry from the singleton. Re-running login upserts the same entry in\n place; the pool never accumulates duplicate device_code rows.\n\n ``label`` is an optional user-chosen display name (from\n ``arcen auth add removed_provider --label <name>``). It gets embedded in the\n singleton state so that ``_seed_from_singletons`` uses it as the pool\n entry's label on every subsequent ``load_pool(\"removed_provider\")`` instead of the\n auto-derived token fingerprint. When ``None``, the auto-derived label\n via ``label_from_token`` is used (unchanged default behaviour).\n\n Returns the upserted :class:`PooledCredential` entry (or ``None`` if\n seeding somehow produced no match — shouldn't happen).\n \"\"\"\n from agent.credential_pool import load_pool\n\n state = dict(creds)\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n\n # Mirror to the shared store so a new profile can one-tap import\n # these credentials via `arcen auth add removed_provider --type oauth`. Best-\n # effort: any I/O failure is logged and swallowed (the per-profile\n # auth.json is still the source of truth).\n _write_shared_removed_provider_state(state)\n\n pool = load_pool(\"removed_provider\")\n return next(\n (e for e in pool.entries() if e.source == REMOVED_PROVIDER_DEVICE_CODE_SOURCE),\n None,\n )\n\n\ndef _sync_removed_provider_pool_from_auth_store() -> None:\n \"\"\"Best-effort pool reseed after providers.removed_provider changes; never fail login.\"\"\"\n try:\n from agent.credential_pool import load_pool\n\n load_pool(\"removed_provider\")\n except Exception as exc:\n logger.debug(\"Failed to sync Removed provider credential pool from auth store: %s\", exc)\n\n\ndef resolve_removed_provider_runtime_credentials(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"\n Resolve Removed provider inference credentials for runtime use.\n\n Ensures access_token is a valid inference-scoped JWT, refreshing it when\n needed. Concurrent processes coordinate through the auth store file lock.\n\n Returns dict with: provider, base_url, api_key, key_id, expires_at,\n expires_in, source (\"invoke_jwt\"), and auth_path.\n \"\"\"\n sequence_id = uuid.uuid4().hex[:12]\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"removed_provider\")\n\n if not state:\n raise AuthError(\"Arcen is not logged into Removed provider Portal.\",\n provider=\"removed_provider\", relogin_required=True)\n\n persisted_state = dict(state)\n state_persisted = False\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"REMOVED_PROVIDER_PORTAL_BASE_URL\")\n or DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n ).rstrip(\"/\")\n inference_base_url = (\n _optional_base_url(state.get(\"inference_base_url\"))\n or os.getenv(\"REMOVED_PROVIDER_INFERENCE_BASE_URL\")\n or DEFAULT_REMOVED_PROVIDER_INFERENCE_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_REMOVED_PROVIDER_CLIENT_ID)\n\n def _persist_state(reason: str) -> None:\n nonlocal persisted_state, state_persisted\n # Skip writes where only derived TTL countdowns changed; this keeps\n # the mtime-keyed Removed provider auth-status cache warm during read paths.\n if (\n _removed_provider_effective_provider_state(state)\n == _removed_provider_effective_provider_state(persisted_state)\n ):\n _oauth_trace(\n \"removed_provider_state_persist_skipped\",\n sequence_id=sequence_id,\n reason=reason,\n )\n return\n try:\n _save_provider_state(auth_store, \"removed_provider\", state)\n _save_auth_store(auth_store)\n except Exception as exc:\n _oauth_trace(\n \"removed_provider_state_persist_failed\",\n sequence_id=sequence_id,\n reason=reason,\n error_type=type(exc).__name__,\n )\n raise\n _oauth_trace(\n \"removed_provider_state_persisted\",\n sequence_id=sequence_id,\n reason=reason,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n access_token_fp=_token_fingerprint(state.get(\"access_token\")),\n )\n persisted_state = dict(state)\n state_persisted = True\n # Mirror post-refresh state to the shared store so sibling\n # profiles don't hold stale refresh_tokens after rotation.\n # Best-effort — any failure is logged and swallowed inside\n # _write_shared_removed_provider_state.\n _write_shared_removed_provider_state(state)\n\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n _oauth_trace(\n \"removed_provider_runtime_credentials_start\",\n sequence_id=sequence_id,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n )\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\"No access token found for Removed provider Portal login.\",\n provider=\"removed_provider\", relogin_required=True)\n\n invoke_jwt_status = _removed_provider_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or invoke_jwt_status is not None:\n with _removed_provider_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n if _merge_shared_removed_provider_oauth_state(state):\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n invoke_jwt_status = _removed_provider_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n _persist_state(\"post_shared_merge_access_unusable\")\n\n if force_refresh or invoke_jwt_status is not None:\n if not isinstance(refresh_token, str) or not refresh_token:\n reason = invoke_jwt_status or \"force_refresh\"\n raise AuthError(\n \"Removed provider Portal access token is not a usable inference JWT \"\n f\"({reason}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add removed_provider\",\n provider=\"removed_provider\",\n code=reason,\n relogin_required=True,\n )\n\n refresh_reason = \"force_refresh\" if force_refresh else (invoke_jwt_status or \"access_unusable\")\n _oauth_trace(\n \"refresh_start\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n try:\n refreshed = _refresh_access_token(\n client=client, portal_base_url=portal_base_url,\n client_id=client_id, refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_removed_provider_refresh_error(exc):\n _quarantine_removed_provider_oauth_state(\n state,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _quarantine_removed_provider_pool_entries(\n auth_store,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _persist_state(\"terminal_runtime_access_refresh_failure\")\n raise\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n previous_refresh_token = refresh_token\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_removed_provider_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n inference_base_url = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n access_token = state[\"access_token\"]\n refresh_token = state[\"refresh_token\"]\n _oauth_trace(\n \"refresh_success\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n previous_refresh_token_fp=_token_fingerprint(previous_refresh_token),\n new_refresh_token_fp=_token_fingerprint(refresh_token),\n )\n # Persist immediately so validation failures cannot drop rotated refresh tokens.\n _persist_state(\"post_refresh_access_token\")\n\n _assert_removed_provider_inference_jwt_usable(\n state,\n access_token=access_token,\n )\n _select_removed_provider_invoke_jwt(\n state,\n access_token=access_token,\n sequence_id=sequence_id,\n )\n\n # Persist routing and TLS metadata for non-interactive refresh.\n state[\"portal_base_url\"] = portal_base_url\n state[\"inference_base_url\"] = inference_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n\n _persist_state(\"resolve_removed_provider_runtime_credentials_final\")\n\n if state_persisted:\n _sync_removed_provider_pool_from_auth_store()\n\n api_key = state.get(\"agent_key\")\n if not isinstance(api_key, str) or not api_key:\n raise AuthError(\"Failed to resolve a Removed provider inference API key\",\n provider=\"removed_provider\", code=\"server_error\")\n\n expires_at = state.get(\"agent_key_expires_at\")\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"agent_key_expires_in\"))\n )\n\n return {\n \"provider\": \"removed_provider\",\n \"base_url\": inference_base_url,\n \"api_key\": api_key,\n \"key_id\": state.get(\"agent_key_id\"),\n \"expires_at\": expires_at,\n \"expires_in\": expires_in,\n \"source\": REMOVED_PROVIDER_AUTH_PATH_INVOKE_JWT,\n \"auth_path\": REMOVED_PROVIDER_AUTH_PATH_INVOKE_JWT,\n }\n\n\n# =============================================================================\n# Status helpers\n# =============================================================================\n\ndef _empty_removed_provider_auth_status() -> Dict[str, Any]:\n return {\n \"logged_in\": False,\n \"portal_base_url\": None,\n \"inference_base_url\": None,\n \"access_expires_at\": None,\n \"agent_key_expires_at\": None,\n \"has_refresh_token\": False,\n \"inference_credential_present\": False,\n \"credential_source\": None,\n }\n\n\ndef _snapshot_removed_provider_pool_status() -> Dict[str, Any]:\n \"\"\"Best-effort status from the credential pool.\n\n This is a fallback only. The auth-store provider state is the runtime source\n of truth because it is what ``resolve_removed_provider_runtime_credentials()`` refreshes.\n \"\"\"\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"removed_provider\")\n if not pool or not pool.has_credentials():\n return _empty_removed_provider_auth_status()\n\n entries = list(pool.entries())\n if not entries:\n return _empty_removed_provider_auth_status()\n\n def _entry_sort_key(entry: Any) -> tuple[float, float, int]:\n agent_exp = _parse_iso_timestamp(getattr(entry, \"agent_key_expires_at\", None)) or 0.0\n access_exp = _parse_iso_timestamp(getattr(entry, \"expires_at\", None)) or 0.0\n priority = int(getattr(entry, \"priority\", 0) or 0)\n return (agent_exp, access_exp, -priority)\n\n entry = max(entries, key=_entry_sort_key)\n runtime_key = getattr(entry, \"runtime_api_key\", None)\n if not runtime_key:\n return _empty_removed_provider_auth_status()\n access_token = getattr(entry, \"access_token\", None)\n auth_type = str(getattr(entry, \"auth_type\", \"\") or \"\").strip().lower()\n refresh_token = getattr(entry, \"refresh_token\", None)\n is_portal_oauth = bool(access_token) and (\n auth_type.startswith(\"oauth\") or bool(refresh_token)\n )\n label = getattr(entry, \"label\", \"unknown\")\n portal_status_url = None\n if is_portal_oauth:\n portal_status_url = (\n getattr(entry, \"portal_base_url\", None)\n or DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n )\n\n return {\n \"logged_in\": is_portal_oauth,\n \"portal_base_url\": portal_status_url,\n \"inference_base_url\": getattr(entry, \"inference_base_url\", None)\n or getattr(entry, \"runtime_base_url\", None)\n or getattr(entry, \"base_url\", None),\n \"access_token\": access_token if is_portal_oauth else None,\n \"access_expires_at\": getattr(entry, \"expires_at\", None),\n \"agent_key_expires_at\": getattr(entry, \"agent_key_expires_at\", None),\n \"has_refresh_token\": bool(refresh_token),\n \"inference_credential_present\": True,\n \"credential_source\": f\"pool:{label}\",\n \"source\": f\"pool:{label}\",\n }\n except Exception:\n return _empty_removed_provider_auth_status()\n\n\n# ── Process-level memo for get_removed_provider_auth_status() ──\n# get_removed_provider_auth_status() validates state by calling resolve_removed_provider_runtime_credentials(),\n# which does a synchroremoved_provider OAuth refresh POST to . That can take\n# ~350ms even on the failure path, and read-only UI surfaces (`arcen tools`, status panels,\n# subscription-feature checks) call it many times per render — `arcen tools` → \"All Platforms\"\n# was firing the refresh ~31× during one menu paint, racking up >13s of HTTP and burning\n# single-use refresh tokens. Cache the snapshot for a few seconds, keyed on the auth.json\n# mtime so that `arcen auth login/logout/add/remove` invalidate naturally on the next call.\n_REMOVED_PROVIDER_AUTH_STATUS_CACHE_TTL = 15.0 # seconds\n_removed_provider_auth_status_cache: Optional[Tuple[float, Optional[float], Dict[str, Any]]] = None\n\n\ndef _auth_file_mtime() -> Optional[float]:\n try:\n return _auth_file_path().stat().st_mtime\n except FileNotFoundError:\n return None\n except Exception:\n return None\n\n\ndef invalidate_removed_provider_auth_status_cache() -> None:\n \"\"\"Clear the get_removed_provider_auth_status() process-level memo.\n\n Call this from any code path that mutates Removed provider auth state without going\n through resolve_removed_provider_runtime_credentials() (e.g. tests). Login/logout\n flows touch auth.json, so the mtime check below invalidates them\n automatically — explicit invalidation is the belt-and-braces option.\n \"\"\"\n global _removed_provider_auth_status_cache\n _removed_provider_auth_status_cache = None\n\n\ndef get_removed_provider_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Removed provider auth.\n\n Prefer the auth-store provider state, because that is the live source of\n truth for refresh operations. When provider state exists, validate it\n by resolving runtime credentials so revoked refresh sessions do not show up\n as a healthy login. If provider state is absent, fall back to the credential\n pool for the just-logged-in / not-yet-promoted case.\n\n The returned snapshot is memoised for ~15s keyed on the auth.json mtime,\n so menu/status surfaces that ask repeatedly don't trigger one refresh POST\n per call. Login/logout flows write to auth.json and therefore invalidate\n the cache automatically; tests can also call\n ``invalidate_removed_provider_auth_status_cache()`` explicitly.\n \"\"\"\n global _removed_provider_auth_status_cache\n now = time.monotonic()\n mtime = _auth_file_mtime()\n cached = _removed_provider_auth_status_cache\n if cached is not None:\n cached_at, cached_mtime, cached_status = cached\n if (\n cached_mtime == mtime\n and (now - cached_at) < _REMOVED_PROVIDER_AUTH_STATUS_CACHE_TTL\n ):\n return dict(cached_status)\n\n status = _compute_removed_provider_auth_status()\n _removed_provider_auth_status_cache = (now, mtime, dict(status))\n return status\n\n\ndef _compute_removed_provider_auth_status() -> Dict[str, Any]:\n \"\"\"Uncached implementation of get_removed_provider_auth_status(). See that function.\"\"\"\n state = get_provider_auth_state(\"removed_provider\")\n if state:\n base_status = {\n \"logged_in\": bool(state.get(\"access_token\")),\n \"portal_base_url\": state.get(\"portal_base_url\"),\n \"inference_base_url\": state.get(\"inference_base_url\"),\n \"access_expires_at\": state.get(\"expires_at\"),\n \"agent_key_expires_at\": state.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(state.get(\"refresh_token\")),\n \"access_token\": state.get(\"access_token\"),\n \"inference_credential_present\": bool(\n state.get(\"access_token\") or state.get(\"agent_key\")\n ),\n \"credential_source\": \"auth_store\",\n \"source\": \"auth_store\",\n }\n try:\n creds = resolve_removed_provider_runtime_credentials()\n refreshed_state = get_provider_auth_state(\"removed_provider\") or state\n base_status.update(\n {\n \"logged_in\": True,\n \"portal_base_url\": refreshed_state.get(\"portal_base_url\") or base_status.get(\"portal_base_url\"),\n \"inference_base_url\": creds.get(\"base_url\")\n or refreshed_state.get(\"inference_base_url\")\n or base_status.get(\"inference_base_url\"),\n \"access_expires_at\": refreshed_state.get(\"expires_at\") or base_status.get(\"access_expires_at\"),\n \"agent_key_expires_at\": creds.get(\"expires_at\")\n or refreshed_state.get(\"agent_key_expires_at\")\n or base_status.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(refreshed_state.get(\"refresh_token\")),\n \"inference_credential_present\": True,\n \"credential_source\": \"auth_store\",\n \"source\": f\"runtime:{creds.get('source', 'portal')}\",\n \"key_id\": creds.get(\"key_id\"),\n }\n )\n return base_status\n except AuthError as exc:\n base_status.update({\n \"logged_in\": False,\n \"error\": str(exc),\n \"relogin_required\": bool(getattr(exc, \"relogin_required\", False)),\n \"error_code\": getattr(exc, \"code\", None),\n })\n return base_status\n\n return _snapshot_removed_provider_pool_status()\n\n\ndef get_codex_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Codex auth.\n \n Checks the credential pool first (where `arcen auth` stores credentials),\n then falls back to the legacy provider state.\n \"\"\"\n # Check credential pool first — this is where `arcen auth` and\n # `arcen model` store device_code tokens.\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(\"openai-codex\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _codex_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"chatgpt\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n # Fall back to legacy provider state\n try:\n creds = resolve_codex_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_xai_oauth_auth_status() -> Dict[str, Any]:\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"xai-oauth\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _xai_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"oauth_pkce\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n try:\n creds = resolve_xai_oauth_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_api_key_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for API-key providers (z.ai, Kimi, MiniMax).\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n return {\"configured\": False}\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"configured\": bool(api_key),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"key_source\": key_source,\n \"base_url\": base_url,\n \"logged_in\": bool(api_key), # compat with OAuth status shape\n }\n\n\ndef get_external_process_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for providers that run a local subprocess.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n return {\"configured\": False}\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n resolved_command = shutil.which(command) if command else None\n return {\n \"configured\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"command\": command,\n \"args\": args,\n \"resolved_command\": resolved_command,\n \"base_url\": base_url,\n \"logged_in\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n }\n\n\ndef get_auth_status(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Generic auth status dispatcher.\"\"\"\n target = (provider_id or get_active_provider() or \"\").strip().lower()\n if not target:\n return {\"logged_in\": False}\n if target == \"spotify\":\n return get_spotify_auth_status()\n if target == \"openai-codex\":\n return get_codex_auth_status()\n if target == \"xai-oauth\":\n return get_xai_oauth_auth_status()\n if target == \"qwen-oauth\":\n return get_qwen_auth_status()\n if target == \"google-gemini-cli\":\n return get_gemini_oauth_auth_status()\n if target == \"minimax-oauth\":\n return get_minimax_oauth_auth_status()\n if target == \"copilot-acp\":\n return get_external_process_provider_status(target)\n if target == \"azure-foundry\":\n return _get_azure_foundry_auth_status()\n # API-key providers\n pconfig = PROVIDER_REGISTRY.get(target)\n if pconfig and pconfig.auth_type == \"api_key\":\n return get_api_key_provider_status(target)\n # AWS SDK providers (Bedrock) — check via boto3 credential chain\n if pconfig and pconfig.auth_type == \"aws_sdk\":\n try:\n from agent.bedrock_adapter import has_aws_credentials\n return {\"logged_in\": has_aws_credentials(), \"provider\": target}\n except ImportError:\n return {\"logged_in\": False, \"provider\": target, \"error\": \"boto3 not installed\"}\n return {\"logged_in\": False}\n\n\ndef _get_azure_foundry_auth_status() -> Dict[str, Any]:\n \"\"\"Return structural auth status for Azure Foundry.\n\n ``logged_in`` is structural, matching other non-OAuth provider status\n checks:\n\n * ``auth_mode == \"entra_id\"`` AND ``azure-identity`` is importable\n (we do NOT mint a token here; ``arcen doctor`` runs the live\n probe and reports whether the credential chain can acquire one).\n * ``auth_mode == \"api_key\"`` (default) AND ``AZURE_FOUNDRY_API_KEY``\n is set with a usable value.\n\n Never invokes the Entra credential chain — keeps CLI startup latency\n flat regardless of token-service / az login state.\n \"\"\"\n info: Dict[str, Any] = {\"provider\": \"azure-foundry\"}\n try:\n from arcen_cli.config import load_config, get_env_value\n cfg = load_config()\n except Exception:\n cfg = {}\n\n model_cfg = cfg.get(\"model\") if isinstance(cfg, dict) else None\n auth_mode = \"api_key\"\n base_url = \"\"\n if isinstance(model_cfg, dict):\n auth_mode = str(model_cfg.get(\"auth_mode\") or \"api_key\").strip().lower() or \"api_key\"\n base_url = str(model_cfg.get(\"base_url\") or \"\").strip()\n info[\"auth_mode\"] = auth_mode\n info[\"base_url\"] = base_url\n\n if auth_mode == \"entra_id\":\n try:\n from agent.azure_identity_adapter import (\n EntraIdentityConfig,\n SCOPE_AI_AZURE_DEFAULT,\n has_azure_identity_installed,\n )\n installed = has_azure_identity_installed()\n entra_cfg = {}\n if isinstance(model_cfg, dict) and isinstance(model_cfg.get(\"entra\"), dict):\n entra_cfg = model_cfg[\"entra\"]\n identity_config = EntraIdentityConfig.from_dict(\n entra_cfg,\n default_scope=SCOPE_AI_AZURE_DEFAULT,\n )\n info[\"azure_identity_installed\"] = installed\n info[\"scope\"] = identity_config.scope\n info[\"credential_probe\"] = \"not_run\"\n info[\"credential_verified\"] = False\n info[\"logged_in\"] = bool(installed)\n if not installed:\n info[\"hint\"] = (\n \"azure-identity not installed. Install with: \"\n \"pip install azure-identity (or rely on Arcen' \"\n \"lazy-install at first use).\"\n )\n else:\n info[\"hint\"] = (\n \"azure-identity is installed; live credential validation \"\n \"is skipped here. Run `arcen doctor` to verify token acquisition.\"\n )\n return info\n except Exception as exc:\n info[\"logged_in\"] = False\n info[\"error\"] = f\"azure-identity check failed: {exc}\"\n return info\n\n # api_key mode (default)\n try:\n api_key = get_env_value(\"AZURE_FOUNDRY_API_KEY\") or os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n except Exception:\n api_key = os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n info[\"logged_in\"] = has_usable_secret(api_key)\n return info\n\n\ndef resolve_api_key_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve API key and base URL for an API-key provider.\n\n Returns dict with: provider, api_key, base_url, source.\n \"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an API-key provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n # No-auth LM Studio: substitute a placeholder so runtime / auxiliary_client\n # see the local server as configured. doctor still reports unconfigured\n # because get_api_key_provider_status uses the raw secret resolver.\n if not api_key and provider_id == \"lmstudio\":\n api_key = LMSTUDIO_NOAUTH_PLACEHOLDER\n key_source = key_source or \"default\"\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif provider_id == \"zai\":\n base_url = _resolve_zai_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url.rstrip(\"/\")\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"provider\": provider_id,\n \"api_key\": api_key,\n \"base_url\": base_url.rstrip(\"/\"),\n \"source\": key_source or \"default\",\n }\n\n\ndef resolve_external_process_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve runtime details for local subprocess-backed providers.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an external-process provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n resolved_command = shutil.which(command) if command else None\n if not resolved_command and not base_url.startswith(\"acp+tcp://\"):\n raise AuthError(\n f\"Could not find the Copilot CLI command '{command}'. \"\n \"Install GitHub Copilot CLI or set ARCEN_COPILOT_ACP_COMMAND/COPILOT_CLI_PATH.\",\n provider=provider_id,\n code=\"missing_copilot_cli\",\n )\n\n return {\n \"provider\": provider_id,\n \"api_key\": \"copilot-acp\",\n \"base_url\": base_url.rstrip(\"/\"),\n \"command\": resolved_command or command,\n \"args\": args,\n \"source\": \"process\",\n }\n\n\n# =============================================================================\n# CLI Commands — login / logout\n# =============================================================================\n\ndef _update_config_for_provider(\n provider_id: str,\n inference_base_url: str,\n default_model: Optional[str] = None,\n) -> Path:\n \"\"\"Update config.yaml and auth.json to reflect the active provider.\n\n When *default_model* is provided the function also writes it as the\n ``model.default`` value. This prevents a race condition where the\n gateway (which re-reads config per-message) picks up the new provider\n before the caller has finished model selection, resulting in a\n mismatched model/provider (e.g. ``anthropic/claude-opus-4.6`` sent to\n MiniMax's API).\n \"\"\"\n # Set active_provider in auth.json so auto-resolution picks this provider\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = provider_id\n _save_auth_store(auth_store)\n\n # Update config.yaml model section\n config_path = get_config_path()\n config_path.parent.mkdir(parents=True, exist_ok=True)\n\n config = read_raw_config()\n\n current_model = config.get(\"model\")\n if isinstance(current_model, dict):\n model_cfg = dict(current_model)\n elif isinstance(current_model, str) and current_model.strip():\n model_cfg = {\"default\": current_model.strip()}\n else:\n model_cfg = {}\n\n model_cfg[\"provider\"] = provider_id\n if inference_base_url and inference_base_url.strip():\n model_cfg[\"base_url\"] = inference_base_url.rstrip(\"/\")\n else:\n # Clear stale base_url to prevent contamination when switching providers\n model_cfg.pop(\"base_url\", None)\n\n # Clear stale api_key/api_mode left over from a previous custom provider.\n # When the user switches from e.g. a MiniMax custom endpoint\n # (api_mode=anthropic_messages, api_key=mxp-...) to a built-in provider\n # (e.g. OpenRouter), the stale api_key/api_mode would override the new\n # provider's credentials and transport choice. Built-in providers that\n # need a specific api_mode (copilot, xai) set it at request-resolution\n # time via `_copilot_runtime_api_mode` / `_detect_api_mode_for_url`, so\n # removing the persisted value here is safe.\n model_cfg.pop(\"api_key\", None)\n model_cfg.pop(\"api_mode\", None)\n\n # When switching to a non-OpenRouter provider, ensure model.default is\n # valid for the new provider. An OpenRouter-formatted name like\n # \"anthropic/claude-opus-4.6\" will fail on direct-API providers.\n if default_model:\n cur_default = model_cfg.get(\"default\", \"\")\n if not cur_default or \"/\" in cur_default:\n model_cfg[\"default\"] = default_model\n\n config[\"model\"] = model_cfg\n\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _get_config_provider() -> Optional[str]:\n \"\"\"Return model.provider from config.yaml, normalized, if present.\"\"\"\n try:\n config = read_raw_config()\n except Exception:\n return None\n if not config:\n return None\n model = config.get(\"model\")\n if not isinstance(model, dict):\n return None\n provider = model.get(\"provider\")\n if not isinstance(provider, str):\n return None\n provider = provider.strip().lower()\n return provider or None\n\n\ndef _config_provider_matches(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when config.yaml currently selects *provider_id*.\"\"\"\n if not provider_id:\n return False\n return _get_config_provider() == provider_id.strip().lower()\n\n\ndef _should_reset_config_provider_on_logout(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when logout should reset the model provider config.\"\"\"\n if not provider_id:\n return False\n normalized = provider_id.strip().lower()\n return normalized in PROVIDER_REGISTRY and _config_provider_matches(normalized)\n\n\ndef _logout_default_provider_from_config() -> Optional[str]:\n \"\"\"Fallback logout target when auth.json has no active provider.\n\n `arcen logout` historically keyed off auth.json.active_provider only.\n That left users stuck when auth state had already been cleared but\n config.yaml still selected an OAuth provider such as openai-codex for the\n agent model: there was no active auth provider to target, so logout printed\n \"No provider is currently logged in\" and never reset model.provider.\n \"\"\"\n provider = _get_config_provider()\n if provider in {\"openai-codex\", \"xai-oauth\"}:\n return provider\n return None\n\n\ndef _reset_config_provider() -> Path:\n \"\"\"Reset config.yaml provider back to auto after logout.\"\"\"\n config_path = get_config_path()\n if not config_path.exists():\n return config_path\n\n config = read_raw_config()\n if not config:\n return config_path\n\n model = config.get(\"model\")\n if isinstance(model, dict):\n model[\"provider\"] = \"auto\"\n if \"base_url\" in model:\n model[\"base_url\"] = OPENROUTER_BASE_URL\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _prompt_model_selection(\n model_ids: List[str],\n current_model: str = \"\",\n pricing: Optional[Dict[str, Dict[str, str]]] = None,\n unavailable_models: Optional[List[str]] = None,\n portal_url: str = \"\",\n unavailable_message: str = \"\",\n) -> Optional[str]:\n \"\"\"Interactive model selection. Puts current_model first with a marker. Returns chosen model ID or None.\n\n If *pricing* is provided (``{model_id: {prompt, completion}}``), a compact\n price indicator is shown next to each model in aligned columns.\n\n If *unavailable_models* is provided, those models are shown grayed out\n and unselectable, with an upgrade link to *portal_url*.\n \"\"\"\n from arcen_cli.models import _format_price_per_mtok\n\n _unavailable = unavailable_models or []\n\n # Reorder: current model first, then the rest (deduplicated)\n ordered = []\n if current_model and current_model in model_ids:\n ordered.append(current_model)\n for mid in model_ids:\n if mid not in ordered:\n ordered.append(mid)\n\n # All models for column-width computation (selectable + unavailable)\n all_models = list(ordered) + list(_unavailable)\n\n # Column-aligned labels when pricing is available\n has_pricing = bool(pricing and any(pricing.get(m) for m in all_models))\n name_col = max((len(m) for m in all_models), default=0) + 2 if has_pricing else 0\n\n # Pre-compute formatted prices and dynamic column widths\n _price_cache: dict[str, tuple[str, str, str]] = {}\n price_col = 3 # minimum width\n cache_col = 0 # only set if any model has cache pricing\n has_cache = False\n if has_pricing:\n for mid in all_models:\n p = pricing.get(mid) # type: ignore[union-attr]\n if p:\n inp = _format_price_per_mtok(p.get(\"prompt\", \"\"))\n out = _format_price_per_mtok(p.get(\"completion\", \"\"))\n cache_read = p.get(\"input_cache_read\", \"\")\n cache = _format_price_per_mtok(cache_read) if cache_read else \"\"\n if cache:\n has_cache = True\n else:\n inp, out, cache = \"\", \"\", \"\"\n _price_cache[mid] = (inp, out, cache)\n price_col = max(price_col, len(inp), len(out))\n cache_col = max(cache_col, len(cache))\n if has_cache:\n cache_col = max(cache_col, 5) # minimum: \"Cache\" header\n\n def _label(mid):\n if has_pricing:\n inp, out, cache = _price_cache.get(mid, (\"\", \"\", \"\"))\n price_part = f\" {inp:>{price_col}} {out:>{price_col}}\"\n if has_cache:\n price_part += f\" {cache:>{cache_col}}\"\n base = f\"{mid:<{name_col}}{price_part}\"\n else:\n base = mid\n if mid == current_model:\n base += \" ← currently in use\"\n return base\n\n # Default cursor on the current model (index 0 if it was reordered to top)\n default_idx = 0\n\n # Build a pricing header hint for the menu title\n menu_title = \"Select default model:\"\n if has_pricing:\n # Align the header with the model column.\n # Each choice is \" {label}\" (2 spaces) and simple_term_menu prepends\n # a 3-char cursor region (\"-> \" or \" \"), so content starts at col 5.\n pad = \" \" * 5\n header = f\"\\n{pad}{'':>{name_col}} {'In':>{price_col}} {'Out':>{price_col}}\"\n if has_cache:\n header += f\" {'Cache':>{cache_col}}\"\n menu_title += header + \" /Mtok\"\n\n # ANSI escape for dim text\n _DIM = \"\\033[2m\"\n _RESET = \"\\033[0m\"\n\n # Try arrow-key menu first, fall back to number input.\n # Uses the shared curses radiolist (ESC/arrow-key handling that works\n # across terminals, incl. those that emit raw escape sequences) instead\n # of simple_term_menu, which conflicts with /dev/tty and left ESC/arrow\n # keys unreliable in the setup model picker.\n try:\n from arcen_cli.curses_ui import curses_radiolist\n\n choices = [_label(mid) for mid in ordered]\n choices.append(\"Enter custom model name\")\n choices.append(\"Skip (keep current)\")\n\n _upgrade_url = (portal_url or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip()\n if not unavailable_footer and _unavailable:\n unavailable_footer = f\"Upgrade at {_upgrade_url} for paid models\"\n\n # The pricing column header (and any unavailable-models block) is shown\n # as a multi-line description above the list so it survives the curses\n # screen clear. menu_title already embeds the aligned price header.\n desc_lines: list[str] = []\n if has_pricing:\n # menu_title is \"Select default model:\\n<pad><header> /Mtok\"\n # Keep only the header portion for the description.\n header_part = menu_title.split(\"\\n\", 1)\n if len(header_part) > 1:\n desc_lines.extend(header_part[1].splitlines())\n if _unavailable:\n for mid in _unavailable:\n desc_lines.append(f\" {_label(mid)}\")\n desc_lines.append(f\" ── {unavailable_footer} ──\")\n description = \"\\n\".join(desc_lines) if desc_lines else None\n\n idx = curses_radiolist(\n \"Select default model:\",\n choices,\n selected=default_idx,\n cancel_returns=-1,\n description=description,\n searchable=True,\n )\n if idx < 0:\n return None\n print()\n if idx < len(ordered):\n return ordered[idx]\n elif idx == len(ordered):\n try:\n custom = input(\"Enter model name: \").strip()\n except (EOFError, KeyboardInterrupt):\n return None\n return custom if custom else None\n return None\n except (ImportError, NotImplementedError, OSError, subprocess.SubprocessError):\n pass\n\n # Fallback: numbered list\n print(menu_title)\n num_width = len(str(len(ordered) + 2))\n for i, mid in enumerate(ordered, 1):\n print(f\" {i:>{num_width}}. {_label(mid)}\")\n n = len(ordered)\n print(f\" {n + 1:>{num_width}}. Enter custom model name\")\n print(f\" {n + 2:>{num_width}}. Skip (keep current)\")\n\n if _unavailable:\n _upgrade_url = (portal_url or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip() or (\n f\"Unavailable models (requires paid tier — upgrade at {_upgrade_url})\"\n )\n print()\n print(f\" {_DIM}── {unavailable_footer} ──{_RESET}\")\n for mid in _unavailable:\n print(f\" {'':>{num_width}} {_DIM}{_label(mid)}{_RESET}\")\n print()\n\n while True:\n try:\n choice = input(f\"Choice [1-{n + 2}] (default: skip): \").strip()\n if not choice:\n return None\n idx = int(choice)\n if 1 <= idx <= n:\n return ordered[idx - 1]\n elif idx == n + 1:\n custom = input(\"Enter model name: \").strip()\n return custom if custom else None\n elif idx == n + 2:\n return None\n print(f\"Please enter 1-{n + 2}\")\n except ValueError:\n print(\"Please enter a number\")\n except (KeyboardInterrupt, EOFError):\n return None\n\n\ndef _save_model_choice(model_id: str) -> None:\n \"\"\"Save the selected model to config.yaml (single source of truth).\n\n The model is stored in config.yaml only — NOT in .env. This avoids\n conflicts in multi-agent setups where env vars would stomp each other.\n \"\"\"\n from arcen_cli.config import save_config, load_config\n\n config = load_config()\n # Always use dict format so provider/base_url can be stored alongside\n if isinstance(config.get(\"model\"), dict):\n config[\"model\"][\"default\"] = model_id\n else:\n config[\"model\"] = {\"default\": model_id}\n save_config(config)\n\n\ndef login_command(args) -> None:\n \"\"\"Deprecated: use 'arcen model' or 'arcen setup' instead.\"\"\"\n print(\"The 'arcen login' command has been removed.\")\n print(\"Use 'arcen auth' to manage credentials,\")\n print(\"'arcen model' to select a provider, or 'arcen setup' for full setup.\")\n raise SystemExit(0)\n\n\ndef _login_openai_codex(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n \"\"\"OpenAI Codex login via device code flow. Tokens stored in ~/.arcen/auth.json.\"\"\"\n\n del args, pconfig # kept for parity with other provider login helpers\n\n # Check for existing Arcen-owned credentials\n if not force_new_login:\n try:\n existing = resolve_codex_runtime_credentials()\n # Verify the resolved token is actually usable (not expired).\n # resolve_codex_runtime_credentials attempts refresh, so if we get\n # here the token should be valid — but double-check before telling\n # the user \"Login successful!\".\n _resolved_key = existing.get(\"api_key\", \"\")\n if isinstance(_resolved_key, str) and _resolved_key and not _codex_access_token_is_expiring(_resolved_key, 60):\n print(\"Existing Codex credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\"openai-codex\", existing.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n else:\n print(\"Existing Codex credentials are expired. Starting fresh login...\")\n except AuthError:\n pass\n\n # Check for existing Codex CLI tokens we can import\n if not force_new_login:\n cli_tokens = _import_codex_cli_tokens()\n if cli_tokens:\n print(\"Found existing Codex CLI credentials at ~/.codex/auth.json\")\n print(\"Arcen will create its own session to avoid conflicts with Codex CLI / VS Code.\")\n try:\n do_import = input(\"Import these credentials? (a separate login is recommended) [y/N]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"n\"\n if do_import in {\"y\", \"yes\"}:\n _save_codex_tokens(cli_tokens)\n base_url = os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_CODEX_BASE_URL\n config_path = _update_config_for_provider(\"openai-codex\", base_url)\n print()\n print(\"Credentials imported. Note: if Codex CLI refreshes its token,\")\n print(\"Arcen will keep working independently with its own session.\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n\n # Run a fresh device code flow — Arcen gets its own OAuth session\n print()\n print(\"Signing in to OpenAI Codex...\")\n print(\"(Arcen creates its own session — won't affect Codex CLI or VS Code)\")\n print()\n\n creds = _codex_device_code_login()\n\n # Save tokens to Arcen auth store\n _save_codex_tokens(creds[\"tokens\"], creds.get(\"last_refresh\"))\n config_path = _update_config_for_provider(\"openai-codex\", creds.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n\n\ndef _login_xai_oauth(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n del pconfig\n\n if not force_new_login:\n try:\n existing = resolve_xai_oauth_runtime_credentials()\n api_key = existing.get(\"api_key\", \"\")\n if isinstance(api_key, str) and api_key and not _xai_access_token_is_expiring(api_key, 60):\n print(\"Existing xAI OAuth credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\n \"xai-oauth\",\n existing.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL),\n )\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n return\n except AuthError:\n pass\n\n print()\n print(\"Signing in to xAI Grok OAuth (SuperGrok / Premium+)...\")\n print(\"(Arcen creates its own local OAuth session)\")\n print()\n\n timeout_seconds = float(getattr(args, \"timeout\", None) or 20.0)\n open_browser = not getattr(args, \"no_browser\", False)\n if _is_remote_session():\n open_browser = False\n manual_paste = bool(getattr(args, \"manual_paste\", False))\n\n creds = _xai_oauth_loopback_login(\n timeout_seconds=timeout_seconds,\n open_browser=open_browser,\n manual_paste=manual_paste,\n )\n _save_xai_oauth_tokens(\n creds[\"tokens\"],\n discovery=creds.get(\"discovery\"),\n redirect_uri=creds.get(\"redirect_uri\", \"\"),\n last_refresh=creds.get(\"last_refresh\"),\n )\n config_path = _update_config_for_provider(\"xai-oauth\", creds.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n\n\ndef _xai_oauth_build_authorize_url(\n *,\n authorization_endpoint: str,\n redirect_uri: str,\n code_challenge: str,\n state: str,\n nonce: str,\n) -> str:\n # `plan=generic` opts the consent screen into xAI's generic OAuth plan\n # tier instead of falling back to the per-account default. Without it,\n # accounts.x.ai rejects loopback OAuth from non-allowlisted clients.\n # `referrer=arcen-agent` lets xAI attribute Arcen-originated logins\n # in their OAuth server logs (we still impersonate the upstream Grok-CLI\n # client_id; this is best-effort attribution until xAI mints us our own).\n authorize_params = {\n \"response_type\": \"code\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"redirect_uri\": redirect_uri,\n \"scope\": XAI_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n \"nonce\": nonce,\n \"plan\": \"generic\",\n \"referrer\": \"arcen-agent\",\n }\n return f\"{authorization_endpoint}?{urlencode(authorize_params)}\"\n\n\ndef _xai_oauth_exchange_code_for_tokens(\n *,\n token_endpoint: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n code_challenge: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"POST the authorization code to xAI's token endpoint and return\n the parsed JSON payload.\n\n Sends ``code_verifier`` as required by RFC 7636 §4.5. Also echoes\n ``code_challenge`` + ``code_challenge_method`` in the request body\n as a defense-in-depth measure for OAuth servers (xAI's among them,\n per #26990) that re-validate the challenge at the token step\n instead of relying solely on server-side session state captured\n during the authorize step. Echoing the challenge is harmless for\n strict RFC-compliant servers — RFC 7636 doesn't forbid additional\n parameters at the token endpoint — and decisively fixes the\n ``code_challenge is required`` failure mode users hit on the\n loopback flow.\n\n Raises :class:`AuthError` on any non-2xx response or transport\n failure; the error message embeds the HTTP status code and the\n full response body so users can disambiguate cause at a glance.\n \"\"\"\n # Paranoia: if upstream call sites ever drop ``code_verifier`` we\n # want to surface a precise, local error rather than send a\n # missing-PKCE request to xAI and receive their generic \"code\n # challenge required\" message back.\n if not code_verifier:\n raise AuthError(\n \"xAI token exchange refused locally: PKCE code_verifier is empty. \"\n \"This is a bug in Arcen — please report at \"\n \"https://github.com/arcenpay/arcen-agent/issues/26990.\",\n provider=\"xai-oauth\",\n code=\"xai_pkce_verifier_missing\",\n )\n\n data = {\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"code_verifier\": code_verifier,\n }\n # Defense-in-depth: include the original ``code_challenge`` and\n # ``code_challenge_method``. Some OAuth servers (including xAI's\n # auth.x.ai implementation, per the symptom reported in #26990)\n # validate these at the token endpoint instead of relying purely on\n # state captured during the authorize step — without them, xAI\n # rejects the exchange with ``code_challenge is required`` even\n # though we sent a valid ``code_verifier``.\n if code_challenge:\n data[\"code_challenge\"] = code_challenge\n data[\"code_challenge_method\"] = \"S256\"\n\n try:\n response = httpx.post(\n token_endpoint,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data=data,\n timeout=max(20.0, timeout_seconds),\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n ) from exc\n\n if response.status_code != 200:\n body = response.text.strip()\n # See ``refresh_xai_oauth_pure`` — token-exchange 403 also\n # surfaces tier/entitlement gating from xAI's backend. Avoid\n # the misleading \"re-authenticate\" hint and point at the API\n # key fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n f\"xAI token exchange failed (HTTP 403).\"\n + (f\" Response: {body}\" if body else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Set ``XAI_API_KEY``\"\n \" and switch to ``provider: xai`` (API-key path) if\"\n \" available, or upgrade your subscription at\"\n \" https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n f\"xAI token exchange failed (HTTP {response.status_code}).\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token exchange response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n return payload\n\n\ndef _xai_oauth_loopback_login(\n *,\n timeout_seconds: float = 20.0,\n open_browser: bool = True,\n manual_paste: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Run the xAI OAuth PKCE flow.\n\n When ``manual_paste=True`` the loopback HTTP listener is skipped\n entirely and the user is prompted to paste the failed callback\n URL into stdin (regression fix for #26923 — browser-only remote\n consoles like GCP Cloud Shell / GitHub Codespaces / EC2 Instance\n Connect, where the laptop's browser can't reach 127.0.0.1 on the\n remote VM). The same PKCE verifier, ``state``, and ``nonce`` are\n used for both paths so the upstream-side OAuth flow is identical.\n \"\"\"\n def _stdin_supports_manual_paste() -> bool:\n try:\n return bool(getattr(sys.stdin, \"isatty\", lambda: False)())\n except Exception:\n return False\n\n discovery = _xai_oauth_discovery(timeout_seconds)\n authorization_endpoint = discovery[\"authorization_endpoint\"]\n token_endpoint = discovery[\"token_endpoint\"]\n\n if manual_paste:\n # No HTTP listener — synthesize a redirect_uri matching what\n # the server would have bound to so the authorize URL the user\n # opens (and the redirect_uri sent in the token exchange) stay\n # byte-identical to the loopback path. xAI's token endpoint\n # cross-checks redirect_uri against the authorize request.\n redirect_uri = (\n f\"http://{XAI_OAUTH_REDIRECT_HOST}:{XAI_OAUTH_REDIRECT_PORT}\"\n f\"{XAI_OAUTH_REDIRECT_PATH}\"\n )\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n callback = _prompt_manual_callback_paste(redirect_uri)\n else:\n server, thread, callback_result, redirect_uri = _xai_start_callback_server()\n try:\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n print()\n print(f\"Waiting for callback on {redirect_uri}\")\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=XAI_OAUTH_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for xAI authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n try:\n callback = _xai_wait_for_callback(\n server,\n thread,\n callback_result,\n timeout_seconds=max(30.0, timeout_seconds * 9),\n )\n except AuthError as exc:\n if (\n getattr(exc, \"code\", \"\") != \"xai_callback_timeout\"\n or not _stdin_supports_manual_paste()\n ):\n raise\n print()\n print(\"xAI loopback callback timed out.\")\n print(\"If your browser reached a failed 127.0.0.1 callback page,\")\n print(\"paste that FULL callback URL below to continue this login.\")\n print(\"You can also re-run with `--manual-paste` to skip the\")\n print(\"loopback listener from the start.\")\n callback = _prompt_manual_callback_paste(redirect_uri)\n if callback.get(\"code\") is None and callback.get(\"error\") is None:\n raise exc\n except Exception:\n try:\n server.shutdown()\n server.server_close()\n except Exception:\n pass\n try:\n thread.join(timeout=1.0)\n except Exception:\n pass\n raise\n\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise AuthError(\n f\"xAI authorization failed: {detail}\",\n provider=\"xai-oauth\",\n code=\"xai_authorization_failed\",\n )\n callback_state = callback.get(\"state\")\n # Manual-paste bare-code path: when a user pastes only the opaque\n # authorization code (no ``code=``/``state=`` query parameters),\n # ``_parse_pasted_callback`` returns ``state=None``. xAI's consent\n # page renders the code in-page rather than redirecting through the\n # 127.0.0.1 callback, so on many remote setups (Cloud Shell, headless\n # VPS, container consoles) the bare code is the only thing the user\n # can obtain. PKCE (code_verifier) still binds the exchange to this\n # client, so the local state-equality check is redundant on the\n # bare-code path — we substitute the locally generated state to keep\n # the rest of the validation chain (and the token exchange) unchanged.\n # See #26923 (AccursedGalaxy comment, 2026-05-20).\n if callback_state is None and manual_paste:\n callback_state = state\n if callback_state != state:\n raise AuthError(\n \"xAI authorization failed: state mismatch.\",\n provider=\"xai-oauth\",\n code=\"xai_state_mismatch\",\n )\n code = str(callback.get(\"code\") or \"\").strip()\n if not code:\n raise AuthError(\n \"xAI authorization failed: missing authorization code.\",\n provider=\"xai-oauth\",\n code=\"xai_code_missing\",\n )\n\n payload = _xai_oauth_exchange_code_for_tokens(\n token_endpoint=token_endpoint,\n code=code,\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n code_challenge=code_challenge,\n timeout_seconds=timeout_seconds,\n )\n access_token = str(payload.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(payload.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI token exchange did not return an access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n if not refresh_token:\n raise AuthError(\n \"xAI token exchange did not return a refresh_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"id_token\": str(payload.get(\"id_token\", \"\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n },\n \"discovery\": discovery,\n \"redirect_uri\": redirect_uri,\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"source\": \"oauth-loopback\",\n }\n\n\ndef _codex_device_code_login() -> Dict[str, Any]:\n \"\"\"Run the OpenAI device code login flow and return credentials dict.\"\"\"\n import time as _time\n\n issuer = \"https://auth.openai.com\"\n client_id = CODEX_OAUTH_CLIENT_ID\n\n # Step 1: Request device code\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/usercode\",\n json={\"client_id\": client_id},\n headers={\"Content-Type\": \"application/json\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Failed to request device code: {exc}\",\n provider=\"openai-codex\", code=\"device_code_request_failed\",\n )\n\n if resp.status_code != 200:\n raise AuthError(\n f\"Device code request returned status {resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_request_error\",\n )\n\n device_data = resp.json()\n user_code = device_data.get(\"user_code\", \"\")\n device_auth_id = device_data.get(\"device_auth_id\", \"\")\n poll_interval = max(3, int(device_data.get(\"interval\", \"5\")))\n\n if not user_code or not device_auth_id:\n raise AuthError(\n \"Device code response missing required fields.\",\n provider=\"openai-codex\", code=\"device_code_incomplete\",\n )\n\n # Step 2: Show user the code\n print(\"To continue, follow these steps:\\n\")\n print(\" 1. Open this URL in your browser:\")\n print(f\" \\033[94m{issuer}/codex/device\\033[0m\\n\")\n print(\" 2. Enter this code:\")\n print(f\" \\033[94m{user_code}\\033[0m\\n\")\n print(\"Waiting for sign-in... (press Ctrl+C to cancel)\")\n\n # Step 3: Poll for authorization code\n max_wait = 15 * 60 # 15 minutes\n start = _time.monotonic()\n code_resp = None\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n while _time.monotonic() - start < max_wait:\n _time.sleep(poll_interval)\n poll_resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/token\",\n json={\"device_auth_id\": device_auth_id, \"user_code\": user_code},\n headers={\"Content-Type\": \"application/json\"},\n )\n\n if poll_resp.status_code == 200:\n code_resp = poll_resp.json()\n break\n elif poll_resp.status_code in {403, 404}:\n continue # User hasn't completed login yet\n else:\n raise AuthError(\n f\"Device auth polling returned status {poll_resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_poll_error\",\n )\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n\n if code_resp is None:\n raise AuthError(\n \"Login timed out after 15 minutes.\",\n provider=\"openai-codex\", code=\"device_code_timeout\",\n )\n\n # Step 4: Exchange authorization code for tokens\n authorization_code = code_resp.get(\"authorization_code\", \"\")\n code_verifier = code_resp.get(\"code_verifier\", \"\")\n redirect_uri = f\"{issuer}/deviceauth/callback\"\n\n if not authorization_code or not code_verifier:\n raise AuthError(\n \"Device auth response missing authorization_code or code_verifier.\",\n provider=\"openai-codex\", code=\"device_code_incomplete_exchange\",\n )\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n token_resp = client.post(\n CODEX_OAUTH_TOKEN_URL,\n data={\n \"grant_type\": \"authorization_code\",\n \"code\": authorization_code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": client_id,\n \"code_verifier\": code_verifier,\n },\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Token exchange failed: {exc}\",\n provider=\"openai-codex\", code=\"token_exchange_failed\",\n )\n\n if token_resp.status_code != 200:\n raise AuthError(\n f\"Token exchange returned status {token_resp.status_code}.\",\n provider=\"openai-codex\", code=\"token_exchange_error\",\n )\n\n tokens = token_resp.json()\n access_token = tokens.get(\"access_token\", \"\")\n refresh_token = tokens.get(\"refresh_token\", \"\")\n\n if not access_token:\n raise AuthError(\n \"Token exchange did not return an access_token.\",\n provider=\"openai-codex\", code=\"token_exchange_no_access_token\",\n )\n\n # Return tokens for the caller to persist (no longer writes to ~/.codex/)\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n },\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"auth_mode\": \"chatgpt\",\n \"source\": \"device-code\",\n }\n\n\n# ==================== MiniMax Portal OAuth ====================\n\ndef _minimax_pkce_pair() -> tuple:\n \"\"\"Generate (code_verifier, code_challenge_S256, state) for MiniMax OAuth.\"\"\"\n import secrets\n verifier = secrets.token_urlsafe(64)[:96]\n challenge = base64.urlsafe_b64encode(\n hashlib.sha256(verifier.encode()).digest()\n ).decode().rstrip(\"=\")\n state = secrets.token_urlsafe(16)\n return verifier, challenge, state\n\n\ndef _minimax_request_user_code(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n code_challenge: str, state: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/oauth/code\",\n data={\n \"response_type\": \"code\",\n \"client_id\": client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n \"x-request-id\": str(uuid.uuid4()),\n },\n )\n if response.status_code != 200:\n raise AuthError(\n f\"MiniMax OAuth authorization failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"authorization_failed\",\n )\n payload = response.json()\n for field in (\"user_code\", \"verification_uri\", \"expired_in\"):\n if field not in payload:\n raise AuthError(\n f\"MiniMax OAuth response missing field: {field}\",\n provider=\"minimax-oauth\", code=\"authorization_incomplete\",\n )\n if payload.get(\"state\") != state:\n raise AuthError(\n \"MiniMax OAuth state mismatch (possible CSRF).\",\n provider=\"minimax-oauth\", code=\"state_mismatch\",\n )\n return payload\n\n\ndef _minimax_expired_in_looks_like_unix_ms(expired_in: int, *, now_ms: int) -> bool:\n \"\"\"True if ``expired_in`` is plausibly a unix-ms absolute time (vs TTL seconds).\"\"\"\n return int(expired_in) > (now_ms // 2)\n\n\ndef _minimax_resolve_token_expiry_unix(expired_in: int, *, now: datetime) -> float:\n \"\"\"Return access-token expiry as unix seconds (MiniMax uses ms epoch or TTL seconds).\"\"\"\n raw = int(expired_in)\n now_ms = int(now.timestamp() * 1000)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n return raw / 1000.0\n return now.timestamp() + max(1, raw)\n\n\ndef _minimax_poll_token(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n user_code: str, code_verifier: str, expired_in: int, interval_ms: Optional[int],\n) -> Dict[str, Any]:\n # OpenClaw treats expired_in as a unix-ms timestamp (Date.now() < expireTimeMs).\n # Defensive parsing: if it's small enough to be a duration, treat as seconds.\n import time as _time\n now_ms = int(_time.time() * 1000)\n raw = int(expired_in)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n deadline = raw / 1000.0\n else:\n deadline = _time.time() + max(1, raw)\n interval = max(2.0, (interval_ms or 2000) / 1000.0)\n\n while _time.time() < deadline:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": MINIMAX_OAUTH_GRANT_TYPE,\n \"client_id\": client_id,\n \"user_code\": user_code,\n \"code_verifier\": code_verifier,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n try:\n payload = response.json() if response.text else {}\n except Exception:\n payload = {}\n\n if response.status_code != 200:\n msg = (payload.get(\"base_resp\", {}) or {}).get(\"status_msg\") or response.text\n raise AuthError(\n f\"MiniMax OAuth error: {msg or 'unknown'}\",\n provider=\"minimax-oauth\", code=\"token_exchange_failed\",\n )\n\n status = payload.get(\"status\")\n if status == \"error\":\n raise AuthError(\n \"MiniMax OAuth reported an error. Please try again later.\",\n provider=\"minimax-oauth\", code=\"authorization_denied\",\n )\n if status == \"success\":\n if not all(payload.get(k) for k in (\"access_token\", \"refresh_token\", \"expired_in\")):\n raise AuthError(\n \"MiniMax OAuth success payload missing required token fields.\",\n provider=\"minimax-oauth\", code=\"token_incomplete\",\n )\n return payload\n # \"pending\" or any other status -> keep polling\n _time.sleep(interval)\n\n raise AuthError(\n \"MiniMax OAuth timed out before authorization completed.\",\n provider=\"minimax-oauth\", code=\"timeout\",\n )\n\n\ndef _minimax_save_auth_state(auth_state: Dict[str, Any]) -> None:\n \"\"\"Persist MiniMax OAuth state to Arcen auth store (~/.arcen/auth.json).\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"minimax-oauth\", auth_state)\n _save_auth_store(auth_store)\n\n\ndef _minimax_oauth_login(\n *, region: str = \"global\", open_browser: bool = True,\n timeout_seconds: float = 15.0,\n) -> Dict[str, Any]:\n \"\"\"Run MiniMax OAuth flow, persist tokens, return auth state dict.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"minimax-oauth\"]\n if region == \"cn\":\n portal_base_url = pconfig.extra[\"cn_portal_base_url\"]\n inference_base_url = pconfig.extra[\"cn_inference_base_url\"]\n else:\n portal_base_url = pconfig.portal_base_url\n inference_base_url = pconfig.inference_base_url\n\n verifier, challenge, state = _minimax_pkce_pair()\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via MiniMax ({region}) OAuth...\")\n print(f\"Portal: {portal_base_url}\")\n\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n headers={\"Accept\": \"application/json\"},\n follow_redirects=True) as client:\n code_data = _minimax_request_user_code(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n code_challenge=challenge, state=state,\n )\n verification_url = str(code_data[\"verification_uri\"])\n user_code = str(code_data[\"user_code\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n if open_browser and _can_open_graphical_browser():\n if webbrowser.open(verification_url):\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically -- use the URL above.\")\n\n interval_raw = code_data.get(\"interval\")\n interval_ms = int(interval_raw) if interval_raw is not None else None\n print(\"Waiting for approval...\")\n\n token_data = _minimax_poll_token(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n user_code=user_code, code_verifier=verifier,\n expired_in=int(code_data[\"expired_in\"]),\n interval_ms=interval_ms,\n )\n\n now = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(token_data[\"expired_in\"]), now=now,\n )\n expires_in_s = max(0, int(expires_at_unix - now.timestamp()))\n\n auth_state = {\n \"provider\": \"minimax-oauth\",\n \"region\": region,\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": inference_base_url,\n \"client_id\": pconfig.client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data[\"refresh_token\"],\n \"resource_url\": token_data.get(\"resource_url\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n }\n\n _minimax_save_auth_state(auth_state)\n print(\"\\u2713 MiniMax OAuth login successful.\")\n if msg := token_data.get(\"notification_message\"):\n print(f\"Note from MiniMax: {msg}\")\n return auth_state\n\n\ndef _refresh_minimax_oauth_state(\n state: Dict[str, Any], *, timeout_seconds: float = 15.0,\n force: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Refresh MiniMax OAuth access token if close to expiry (or forced).\"\"\"\n if not state.get(\"refresh_token\"):\n raise AuthError(\n \"MiniMax OAuth state has no refresh_token; please re-login.\",\n provider=\"minimax-oauth\", code=\"no_refresh_token\", relogin_required=True,\n )\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n except Exception:\n expires_at = 0.0\n now = time.time()\n if not force and (expires_at - now) > MINIMAX_OAUTH_REFRESH_SKEW_SECONDS:\n return state\n\n portal_base_url = state[\"portal_base_url\"]\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n follow_redirects=True) as client:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": state[\"client_id\"],\n \"refresh_token\": state[\"refresh_token\"],\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n if response.status_code != 200:\n body = response.text.lower()\n relogin = any(m in body for m in\n (\"invalid_grant\", \"refresh_token_reused\", \"invalid_refresh_token\"))\n raise AuthError(\n f\"MiniMax OAuth refresh failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=relogin,\n )\n payload = response.json()\n if payload.get(\"status\") != \"success\":\n raise AuthError(\n \"MiniMax OAuth refresh did not return success.\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=True,\n )\n now_dt = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(payload[\"expired_in\"]), now=now_dt,\n )\n expires_in_s = max(0, int(expires_at_unix - now_dt.timestamp()))\n new_state = dict(state)\n new_state.update({\n \"access_token\": payload[\"access_token\"],\n \"refresh_token\": payload.get(\"refresh_token\", state[\"refresh_token\"]),\n \"obtained_at\": now_dt.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n })\n _minimax_save_auth_state(new_state)\n return new_state\n\n\ndef _minimax_oauth_quarantine_on_terminal_refresh(state: Dict[str, Any], exc: AuthError) -> None:\n \"\"\"Wipe dead tokens from auth.json after a terminal refresh failure.\n\n Shared by both the eager-resolve path and the lazy per-request token\n provider. Mirrors the Removed provider / xAI-OAuth / Codex-OAuth quarantine pattern\n so subsequent calls fail fast without a network retry.\n \"\"\"\n if not (exc.relogin_required and state.get(\"refresh_token\")):\n return\n for _k in (\"access_token\", \"refresh_token\", \"expires_at\", \"expires_in\", \"obtained_at\"):\n state.pop(_k, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"minimax-oauth\",\n \"code\": exc.code or \"refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n _minimax_save_auth_state(state)\n except Exception as _save_exc:\n logger.debug(\"MiniMax OAuth: failed to persist quarantined state: %s\", _save_exc)\n\n\ndef build_minimax_oauth_token_provider() -> Callable[[], str]:\n \"\"\"Return a zero-arg callable that yields a fresh MiniMax access token.\n\n The Anthropic SDK caches ``api_key`` as a static string at construction\n time, so a session that resolves credentials once at startup will keep\n sending the same bearer until MiniMax's server returns 401 — typically\n ~15 minutes in, because MiniMax issues short-lived access tokens.\n\n Returning a *callable* instead of a string lets us hook into the\n existing Entra-ID bearer infrastructure in\n :mod:`agent.anthropic_adapter`: ``build_anthropic_client`` detects a\n callable and routes through ``_build_anthropic_client_with_bearer_hook``,\n which mints a fresh ``Authorization`` header on every outbound request.\n Each invocation re-reads the persisted state from ``auth.json`` and\n calls :func:`_refresh_minimax_oauth_state` — that helper is a no-op\n when the token still has more than ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS``\n of life left, so the steady-state cost is one file read + one\n timestamp compare per request.\n\n Reading state fresh each time also means a refresh persisted by one\n process (CLI, gateway, cron) is immediately visible to every other\n process sharing the same ``auth.json``.\n \"\"\"\n def _provide() -> str:\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n token = state.get(\"access_token\")\n if not token:\n raise AuthError(\n \"MiniMax OAuth state has no access_token after refresh.\",\n provider=\"minimax-oauth\", code=\"no_access_token\", relogin_required=True,\n )\n return token\n\n return _provide\n\n\ndef resolve_minimax_oauth_runtime_credentials(\n *, min_token_ttl_seconds: int = MINIMAX_OAUTH_REFRESH_SKEW_SECONDS,\n as_token_provider: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Return {provider, api_key, base_url, source} for minimax-oauth.\n\n When ``as_token_provider`` is True, ``api_key`` is a zero-arg callable\n that mints a fresh access token per call (proactively refreshing if\n the cached token is within ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS`` of\n expiry). This is what the runtime provider path uses so that long\n sessions survive MiniMax's short access-token lifetime — see\n :func:`build_minimax_oauth_token_provider` for the rationale.\n\n The default (string ``api_key``) preserves the historical contract for\n diagnostic call sites like ``arcen status`` that just want to know\n whether a valid token exists right now.\n \"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n if as_token_provider:\n api_key: Any = build_minimax_oauth_token_provider()\n else:\n api_key = state[\"access_token\"]\n return {\n \"provider\": \"minimax-oauth\",\n \"api_key\": api_key,\n \"base_url\": state[\"inference_base_url\"].rstrip(\"/\"),\n \"source\": \"oauth\",\n }\n\n\ndef get_minimax_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return auth status dict for MiniMax OAuth provider.\"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n return {\"logged_in\": False, \"provider\": \"minimax-oauth\"}\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n token_valid = (expires_at - time.time()) > 0\n except Exception:\n token_valid = bool(state.get(\"access_token\"))\n return {\n \"logged_in\": token_valid,\n \"provider\": \"minimax-oauth\",\n \"region\": state.get(\"region\", \"global\"),\n \"expires_at\": state.get(\"expires_at\"),\n }\n\n\ndef _login_minimax_oauth(args, pconfig: ProviderConfig) -> None:\n \"\"\"CLI entry for MiniMax OAuth login.\"\"\"\n region = getattr(args, \"region\", None) or \"global\"\n open_browser = not getattr(args, \"no_browser\", False)\n timeout = getattr(args, \"timeout\", None) or 15.0\n try:\n _minimax_oauth_login(\n region=region, open_browser=open_browser, timeout_seconds=timeout,\n )\n except AuthError as exc:\n print(format_auth_error(exc))\n raise SystemExit(1)\n\n\ndef _removed_provider_device_code_login(\n *,\n portal_base_url: Optional[str] = None,\n inference_base_url: Optional[str] = None,\n client_id: Optional[str] = None,\n scope: Optional[str] = None,\n open_browser: bool = True,\n timeout_seconds: float = 15.0,\n insecure: bool = False,\n ca_bundle: Optional[str] = None,\n) -> Dict[str, Any]:\n \"\"\"Run the Removed provider device-code flow and return full OAuth state without persisting.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"removed_provider\"]\n portal_base_url = (\n portal_base_url\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"REMOVED_PROVIDER_PORTAL_BASE_URL\")\n or pconfig.portal_base_url\n ).rstrip(\"/\")\n requested_inference_url = (\n inference_base_url\n or os.getenv(\"REMOVED_PROVIDER_INFERENCE_BASE_URL\")\n or pconfig.inference_base_url\n ).rstrip(\"/\")\n client_id = client_id or pconfig.client_id\n scope = scope or pconfig.scope\n timeout = httpx.Timeout(timeout_seconds)\n verify: bool | str = False if insecure else (ca_bundle if ca_bundle else True)\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via {pconfig.name}...\")\n print(f\"Portal: {portal_base_url}\")\n if insecure:\n print(\"TLS verification: disabled (--insecure)\")\n elif ca_bundle:\n print(f\"TLS verification: custom CA bundle ({ca_bundle})\")\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n device_data = _request_device_code(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n scope=scope,\n )\n\n verification_url = str(device_data[\"verification_uri_complete\"])\n user_code = str(device_data[\"user_code\"])\n expires_in = int(device_data[\"expires_in\"])\n interval = int(device_data[\"interval\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n\n if open_browser:\n opened = webbrowser.open(verification_url)\n if opened:\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically — use the URL above.\")\n\n effective_interval = max(1, min(interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n print(f\"Waiting for approval (polling every {effective_interval}s)...\")\n\n token_data = _poll_for_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n device_code=str(device_data[\"device_code\"]),\n expires_in=expires_in,\n poll_interval=interval,\n )\n\n now = datetime.now(timezone.utc)\n token_expires_in = _coerce_ttl_seconds(token_data.get(\"expires_in\", 0))\n expires_at = now.timestamp() + token_expires_in\n resolved_inference_url = (\n _optional_base_url(token_data.get(\"inference_base_url\"))\n or requested_inference_url\n )\n if resolved_inference_url != requested_inference_url:\n print(f\"Using portal-provided inference URL: {resolved_inference_url}\")\n\n auth_state = {\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": resolved_inference_url,\n \"client_id\": client_id,\n \"scope\": token_data.get(\"scope\") or scope,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data.get(\"refresh_token\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at, tz=timezone.utc).isoformat(),\n \"expires_in\": token_expires_in,\n \"tls\": {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n },\n \"agent_key\": None,\n \"agent_key_id\": None,\n \"agent_key_expires_at\": None,\n \"agent_key_expires_in\": None,\n \"agent_key_reused\": None,\n \"agent_key_obtained_at\": None,\n }\n try:\n return refresh_removed_provider_oauth_from_state(\n auth_state,\n timeout_seconds=timeout_seconds,\n force_refresh=False,\n )\n except AuthError as exc:\n if exc.code == \"subscription_required\":\n portal_url = auth_state.get(\n \"portal_base_url\", DEFAULT_REMOVED_PROVIDER_PORTAL_URL\n ).rstrip(\"/\")\n message = format_auth_error(exc)\n print()\n print(message)\n print(f\" Subscribe here: {portal_url}/billing\")\n print()\n print(\"After subscribing, run `arcen model` again to finish setup.\")\n raise SystemExit(1)\n raise\n\n\ndef _login_removed_provider(args, pconfig: ProviderConfig) -> None:\n \"\"\"Removed provider Portal device authorization flow.\"\"\"\n timeout_seconds = getattr(args, \"timeout\", None) or 15.0\n insecure = bool(getattr(args, \"insecure\", False))\n ca_bundle = (\n getattr(args, \"ca_bundle\", None)\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n )\n\n try:\n auth_state = None\n\n # Codex-style auto-import: before launching a fresh device-code\n # flow, check the shared store for an existing Removed provider credential\n # from any other profile. If present, offer to rehydrate it.\n shared = _read_shared_removed_provider_state()\n if shared:\n try:\n shared_path = _removed_provider_shared_store_path()\n except RuntimeError:\n shared_path = None\n print()\n if shared_path:\n print(f\"Found existing Removed provider OAuth credentials at {shared_path}\")\n else:\n print(\"Found existing shared Removed provider OAuth credentials\")\n try:\n do_import = input(\"Import these credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"y\"\n if do_import in {\"\", \"y\", \"yes\"}:\n print(\"Rehydrating Removed provider session from shared credentials...\")\n auth_state = _try_import_shared_removed_provider_state(\n timeout_seconds=timeout_seconds,\n )\n if auth_state is None:\n print(\"Could not refresh shared credentials — falling back to device-code login.\")\n\n if auth_state is None:\n auth_state = _removed_provider_device_code_login(\n portal_base_url=getattr(args, \"portal_url\", None),\n inference_base_url=getattr(args, \"inference_url\", None),\n client_id=getattr(args, \"client_id\", None) or pconfig.client_id,\n scope=getattr(args, \"scope\", None),\n open_browser=not getattr(args, \"no_browser\", False),\n timeout_seconds=timeout_seconds,\n insecure=insecure,\n ca_bundle=ca_bundle,\n )\n\n inference_base_url = auth_state[\"inference_base_url\"]\n\n # Snapshot the prior active_provider BEFORE _save_provider_state\n # overwrites it to \"removed_provider\". If the user picks \"Skip (keep current)\"\n # during model selection below, we restore this so the user's previous\n # provider (e.g. openrouter) is preserved.\n with _auth_store_lock():\n _prior_store = _load_auth_store()\n prior_active_provider = _prior_store.get(\"active_provider\")\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"removed_provider\", auth_state)\n saved_to = _save_auth_store(auth_store)\n\n # Mirror to the shared store so other profiles can one-tap import\n # these credentials. Best-effort: any I/O failure is logged and\n # swallowed inside the helper.\n _write_shared_removed_provider_state(auth_state)\n _sync_removed_provider_pool_from_auth_store()\n\n print()\n print(\"Login successful!\")\n print(f\" Auth state: {saved_to}\")\n\n # Resolve model BEFORE writing provider to config.yaml so we never\n # leave the config in a half-updated state (provider=removed_provider but model\n # still set to the previous provider's model, e.g. opus from\n # OpenRouter). The auth.json active_provider was already set above.\n selected_model = None\n try:\n runtime_key = auth_state.get(\"agent_key\") or auth_state.get(\"access_token\")\n if not isinstance(runtime_key, str) or not runtime_key:\n raise AuthError(\n \"No runtime API key available to fetch models\",\n provider=\"removed_provider\",\n code=\"invalid_token\",\n )\n\n from arcen_cli.models import (\n get_curated_removed_provider_model_ids, get_pricing_for_provider,\n check_removed_provider_free_tier, partition_removed_provider_models_by_tier,\n union_with_portal_free_recommendations,\n union_with_portal_paid_recommendations,\n )\n model_ids = get_curated_removed_provider_model_ids()\n\n print()\n unavailable_models: list = []\n unavailable_message = \"\"\n if model_ids:\n pricing = get_pricing_for_provider(\"removed_provider\")\n # Force fresh account data for model selection so recent credit\n # purchases are reflected immediately.\n free_tier = check_removed_provider_free_tier(force_fresh=True)\n _portal_for_recs = auth_state.get(\"portal_base_url\", \"\")\n if free_tier:\n try:\n from arcen_cli.removed_provider_account import (\n format_removed_provider_portal_entitlement_message,\n get_removed_provider_portal_account_info,\n )\n\n _account_info = get_removed_provider_portal_account_info(force_fresh=True)\n unavailable_message = (\n format_removed_provider_portal_entitlement_message(\n _account_info,\n capability=\"paid Removed provider models\",\n )\n or \"\"\n )\n except Exception:\n unavailable_message = \"\"\n # The Portal's freeRecommendedModels endpoint is the\n # source of truth for what's free *right now*. Augment\n # the curated list with anything new the Portal flags\n # as free so users on older Arcen builds still see\n # newly-launched free models without a CLI release.\n model_ids, pricing = union_with_portal_free_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n model_ids, unavailable_models = partition_removed_provider_models_by_tier(\n model_ids, pricing, free_tier=True,\n )\n else:\n # Paid-tier mirror: pull paidRecommendedModels so newly\n # launched paid models surface in the picker even if\n # the in-repo curated list and docs-hosted manifest\n # haven't caught up yet.\n model_ids, pricing = union_with_portal_paid_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n _portal = auth_state.get(\"portal_base_url\", \"\")\n if model_ids:\n print(f\"Showing {len(model_ids)} curated models — use \\\"Enter custom model name\\\" for others.\")\n selected_model = _prompt_model_selection(\n model_ids, pricing=pricing,\n unavailable_models=unavailable_models,\n portal_url=_portal,\n unavailable_message=unavailable_message,\n )\n elif unavailable_models:\n _url = (_portal or DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n print(\"No free models currently available.\")\n print(unavailable_message or f\"Upgrade at {_url} to access paid models.\")\n else:\n print(\"No curated models available for Removed provider Portal.\")\n except Exception as exc:\n message = format_auth_error(exc) if isinstance(exc, AuthError) else str(exc)\n print()\n print(f\"Login succeeded, but could not fetch available models. Reason: {message}\")\n\n # Write provider + model atomically so config is never mismatched.\n # If no model was selected (user picked \"Skip (keep current)\",\n # model list fetch failed, or no curated models were available),\n # preserve the user's previous provider — don't silently switch\n # them to Removed provider with a mismatched model. The Removed provider OAuth tokens\n # stay saved for future use.\n if not selected_model:\n # Restore the prior active_provider that _save_provider_state\n # overwrote to \"removed_provider\". config.yaml model.provider is left\n # untouched, so the user's previous provider is fully preserved.\n with _auth_store_lock():\n auth_store = _load_auth_store()\n if prior_active_provider:\n auth_store[\"active_provider\"] = prior_active_provider\n else:\n auth_store.pop(\"active_provider\", None)\n _save_auth_store(auth_store)\n print()\n print(\"No provider change. Removed provider credentials saved for future use.\")\n print(\" Run `arcen model` again to switch to Removed provider Portal.\")\n return\n\n config_path = _update_config_for_provider(\n \"removed_provider\", inference_base_url, default_model=selected_model,\n )\n if selected_model:\n _save_model_choice(selected_model)\n print(f\"Default model set to: {selected_model}\")\n print(f\" Config updated: {config_path} (model.provider=removed_provider)\")\n\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n except Exception as exc:\n print(f\"Login failed: {exc}\")\n raise SystemExit(1)\n\n\ndef logout_command(args) -> None:\n \"\"\"Clear auth state for a provider.\"\"\"\n provider_id = getattr(args, \"provider\", None)\n\n if provider_id and not is_known_auth_provider(provider_id):\n print(f\"Unknown provider: {provider_id}\")\n raise SystemExit(1)\n\n active = get_active_provider()\n target = provider_id or active or _logout_default_provider_from_config()\n\n if not target:\n print(\"No provider is currently logged in.\")\n return\n\n should_reset_config = _should_reset_config_provider_on_logout(target)\n provider_name = get_auth_provider_display_name(target)\n\n if clear_provider_auth(target) or should_reset_config:\n if should_reset_config:\n _reset_config_provider()\n print(f\"Logged out of {provider_name}.\")\n if should_reset_config and os.getenv(\"OPENROUTER_API_KEY\"):\n print(\"Arcen will use OpenRouter for inference.\")\n elif should_reset_config:\n print(\"Run `arcen model` or configure an API key to use Arcen.\")\n else:\n print(\"Model provider configuration was unchanged.\")\n else:\n print(f\"No auth state found for {provider_name}.\")\n"}, "f0ed7e35cc423b1ad41232df60611c7355a41cb0": {"t": 1785753039.3005075, "n": 304280, "h": "9a3e7bce9b898324", "c": "\"\"\"\nMulti-provider authentication system for Arcen Agent.\n\nSupports OAuth device code flows (Nous Portal, future: OpenAI Codex) and\ntraditional API key providers (OpenRouter, custom endpoints). Auth state\nis persisted in ~/.arcen/auth.json with cross-process file locking.\n\nArchitecture:\n- ProviderConfig registry defines known OAuth providers\n- Auth store (auth.json) holds per-provider credential state\n- resolve_provider() picks the active provider via priority chain\n- resolve_*_runtime_credentials() handles token refresh and runtime keys\n- logout_command() is the CLI entry point for clearing auth\n\nNous authentication paths:\n- Invoke JWT (preferred): use a scoped access_token directly for inference.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport logging\nimport os\nimport shutil\nimport shlex\nimport ssl\nimport stat\nimport sys\nimport base64\nimport hashlib\nimport subprocess\nimport threading\nimport time\nimport uuid\nimport webbrowser\nfrom contextlib import contextmanager\nfrom dataclasses import dataclass, field\nfrom datetime import datetime, timezone\nfrom http.server import BaseHTTPRequestHandler, HTTPServer, ThreadingHTTPServer\nfrom pathlib import Path\nfrom typing import Any, Callable, Dict, FrozenSet, List, Optional, Tuple\nfrom urllib.parse import parse_qs, urlencode, urlparse\n\nimport httpx\n\nfrom arcen_cli.config import get_arcen_home, get_config_path, read_raw_config\nfrom arcen_constants import OPENROUTER_BASE_URL, secure_parent_dir\nfrom agent.credential_persistence import sanitize_borrowed_credential_payload\nfrom utils import atomic_replace, atomic_yaml_write, is_truthy_value\n\nlogger = logging.getLogger(__name__)\n\ntry:\n import fcntl\nexcept Exception:\n fcntl = None\ntry:\n import msvcrt\nexcept Exception:\n msvcrt = None\n\n# =============================================================================\n# Constants\n# =============================================================================\n\nAUTH_STORE_VERSION = 1\nAUTH_LOCK_TIMEOUT_SECONDS = 15.0\n\n# Nous Portal defaults\nDEFAULT_NOUS_PORTAL_URL = \"https://portal.nousresearch.com\"\nDEFAULT_NOUS_INFERENCE_URL = \"https://inference-api.nousresearch.com/v1\"\nDEFAULT_NOUS_CLIENT_ID = \"arcen-cli\"\nNOUS_INFERENCE_INVOKE_SCOPE = \"inference:invoke\"\nDEFAULT_NOUS_SCOPE = NOUS_INFERENCE_INVOKE_SCOPE\nNOUS_DEVICE_CODE_SOURCE = \"device_code\"\nNOUS_AUTH_PATH_INVOKE_JWT = \"invoke_jwt\"\nACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120 # refresh 2 min before expiry\nNOUS_INVOKE_JWT_MIN_TTL_SECONDS = ACCESS_TOKEN_REFRESH_SKEW_SECONDS\nDEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS = 1 # poll at most every 1s\nDEFAULT_CODEX_BASE_URL = \"https://chatgpt.com/backend-api/codex\"\nDEFAULT_XAI_OAUTH_BASE_URL = \"https://api.x.ai/v1\"\nMINIMAX_OAUTH_CLIENT_ID = \"78257093-7e40-4613-99e0-527b14b39113\"\nMINIMAX_OAUTH_SCOPE = \"group_id profile model.completion\"\nMINIMAX_OAUTH_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:user_code\"\nMINIMAX_OAUTH_GLOBAL_BASE = \"https://api.minimax.io\"\nMINIMAX_OAUTH_CN_BASE = \"https://api.minimaxi.com\"\nMINIMAX_OAUTH_GLOBAL_INFERENCE = \"https://api.minimax.io/anthropic\"\nMINIMAX_OAUTH_CN_INFERENCE = \"https://api.minimaxi.com/anthropic\"\nMINIMAX_OAUTH_REFRESH_SKEW_SECONDS = 60\nDEFAULT_QWEN_BASE_URL = \"https://portal.qwen.ai/v1\"\nDEFAULT_GITHUB_MODELS_BASE_URL = \"https://api.githubcopilot.com\"\nDEFAULT_COPILOT_ACP_BASE_URL = \"acp://copilot\"\nDEFAULT_OLLAMA_CLOUD_BASE_URL = \"https://ollama.com/v1\"\nSTEPFUN_STEP_PLAN_INTL_BASE_URL = \"https://api.stepfun.ai/step_plan/v1\"\nSTEPFUN_STEP_PLAN_CN_BASE_URL = \"https://api.stepfun.com/step_plan/v1\"\nCODEX_OAUTH_CLIENT_ID = \"app_EMoamEEZ73f0CkXaXp7hrann\"\nCODEX_OAUTH_TOKEN_URL = \"https://auth.openai.com/oauth/token\"\nCODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nXAI_OAUTH_ISSUER = \"https://auth.x.ai\"\nXAI_OAUTH_DISCOVERY_URL = f\"{XAI_OAUTH_ISSUER}/.well-known/openid-configuration\"\nXAI_OAUTH_CLIENT_ID = \"b1a00492-073a-47ea-816f-4c329264a828\"\nXAI_OAUTH_SCOPE = \"openid profile email offline_access grok-cli:access api:access\"\nXAI_OAUTH_REDIRECT_HOST = \"127.0.0.1\"\nXAI_OAUTH_REDIRECT_PORT = 56121\nXAI_OAUTH_REDIRECT_PATH = \"/callback\"\nXAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nQWEN_OAUTH_CLIENT_ID = \"f0304373b74a44d2b584a3fb70ca9e56\"\nQWEN_OAUTH_TOKEN_URL = \"https://chat.qwen.ai/api/v1/oauth2/token\"\nQWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nDEFAULT_SPOTIFY_ACCOUNTS_BASE_URL = \"https://accounts.spotify.com\"\nDEFAULT_SPOTIFY_API_BASE_URL = \"https://api.spotify.com/v1\"\nDEFAULT_SPOTIFY_REDIRECT_URI = \"http://127.0.0.1:43827/spotify/callback\"\nSPOTIFY_DOCS_URL = \"https://arcen-agent.arcenpay.com/docs/user-guide/features/spotify\"\nSPOTIFY_DASHBOARD_URL = \"https://developer.spotify.com/dashboard\"\nSPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\n\nXAI_OAUTH_DOCS_URL = \"https://arcen-agent.arcenpay.com/docs/guides/xai-grok-oauth\"\nOAUTH_OVER_SSH_DOCS_URL = \"https://arcen-agent.arcenpay.com/docs/guides/oauth-over-ssh\"\nDEFAULT_SPOTIFY_SCOPE = \" \".join((\n \"user-modify-playback-state\",\n \"user-read-playback-state\",\n \"user-read-currently-playing\",\n \"user-read-recently-played\",\n \"playlist-read-private\",\n \"playlist-read-collaborative\",\n \"playlist-modify-public\",\n \"playlist-modify-private\",\n \"user-library-read\",\n \"user-library-modify\",\n))\nSERVICE_PROVIDER_NAMES: Dict[str, str] = {\n \"spotify\": \"Spotify\",\n}\n\n# Google Gemini OAuth (google-gemini-cli provider, Cloud Code Assist backend)\nDEFAULT_GEMINI_CLOUDCODE_BASE_URL = \"cloudcode-pa://google\"\nGEMINI_OAUTH_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 60 # refresh 60s before expiry\n\n# LM Studio's default no-auth mode still requires *some* non-empty bearer for\n# the API-key code paths (auxiliary_client, runtime resolver) to treat the\n# provider as configured. This sentinel is sent only to LM Studio, never to\n# any remote service.\nLMSTUDIO_NOAUTH_PLACEHOLDER = \"dummy-lm-api-key\"\n\n\n# =============================================================================\n# Provider Registry\n# =============================================================================\n\n@dataclass\nclass ProviderConfig:\n \"\"\"Describes a known inference provider.\"\"\"\n id: str\n name: str\n auth_type: str # \"oauth_device_code\", \"oauth_external\", \"oauth_minimax\", or \"api_key\"\n portal_base_url: str = \"\"\n inference_base_url: str = \"\"\n client_id: str = \"\"\n scope: str = \"\"\n extra: Dict[str, Any] = field(default_factory=dict)\n # For API-key providers: env vars to check (in priority order)\n api_key_env_vars: tuple = ()\n # Optional env var for base URL override\n base_url_env_var: str = \"\"\n\n\nPROVIDER_REGISTRY: Dict[str, ProviderConfig] = {\n \"nous\": ProviderConfig(\n id=\"nous\",\n name=\"Nous Portal\",\n auth_type=\"oauth_device_code\",\n portal_base_url=DEFAULT_NOUS_PORTAL_URL,\n inference_base_url=DEFAULT_NOUS_INFERENCE_URL,\n client_id=DEFAULT_NOUS_CLIENT_ID,\n scope=DEFAULT_NOUS_SCOPE,\n ),\n \"openai-codex\": ProviderConfig(\n id=\"openai-codex\",\n name=\"OpenAI Codex\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_CODEX_BASE_URL,\n ),\n \"openai-api\": ProviderConfig(\n id=\"openai-api\",\n name=\"OpenAI API\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.openai.com/v1\",\n api_key_env_vars=(\"OPENAI_API_KEY\",),\n base_url_env_var=\"OPENAI_BASE_URL\",\n ),\n \"xai-oauth\": ProviderConfig(\n id=\"xai-oauth\",\n name=\"xAI Grok OAuth (SuperGrok / Premium+)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_XAI_OAUTH_BASE_URL,\n ),\n \"qwen-oauth\": ProviderConfig(\n id=\"qwen-oauth\",\n name=\"Qwen OAuth\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_QWEN_BASE_URL,\n ),\n \"google-gemini-cli\": ProviderConfig(\n id=\"google-gemini-cli\",\n name=\"Google Gemini (OAuth)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_GEMINI_CLOUDCODE_BASE_URL,\n ),\n \"lmstudio\": ProviderConfig(\n id=\"lmstudio\",\n name=\"LM Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"http://127.0.0.1:1234/v1\",\n api_key_env_vars=(\"LM_API_KEY\",),\n base_url_env_var=\"LM_BASE_URL\",\n ),\n \"copilot\": ProviderConfig(\n id=\"copilot\",\n name=\"GitHub Copilot\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_GITHUB_MODELS_BASE_URL,\n api_key_env_vars=(\"COPILOT_GITHUB_TOKEN\", \"GH_TOKEN\", \"GITHUB_TOKEN\"),\n base_url_env_var=\"COPILOT_API_BASE_URL\",\n ),\n \"copilot-acp\": ProviderConfig(\n id=\"copilot-acp\",\n name=\"GitHub Copilot ACP\",\n auth_type=\"external_process\",\n inference_base_url=DEFAULT_COPILOT_ACP_BASE_URL,\n base_url_env_var=\"COPILOT_ACP_BASE_URL\",\n ),\n \"gemini\": ProviderConfig(\n id=\"gemini\",\n name=\"Google AI Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"https://generativelanguage.googleapis.com/v1beta\",\n api_key_env_vars=(\"GOOGLE_API_KEY\", \"GEMINI_API_KEY\"),\n base_url_env_var=\"GEMINI_BASE_URL\",\n ),\n \"zai\": ProviderConfig(\n id=\"zai\",\n name=\"Z.AI / GLM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.z.ai/api/paas/v4\",\n api_key_env_vars=(\"GLM_API_KEY\", \"ZAI_API_KEY\", \"Z_AI_API_KEY\"),\n base_url_env_var=\"GLM_BASE_URL\",\n ),\n \"kimi-coding\": ProviderConfig(\n id=\"kimi-coding\",\n name=\"Kimi / Moonshot\",\n auth_type=\"api_key\",\n # Legacy platform.moonshot.ai keys use this endpoint (OpenAI-compat).\n # sk-kimi- (Kimi Code) keys are auto-redirected to api.kimi.com/coding\n # by _resolve_kimi_base_url() below.\n inference_base_url=\"https://api.moonshot.ai/v1\",\n api_key_env_vars=(\"KIMI_API_KEY\", \"KIMI_CODING_API_KEY\"),\n base_url_env_var=\"KIMI_BASE_URL\",\n ),\n \"kimi-coding-cn\": ProviderConfig(\n id=\"kimi-coding-cn\",\n name=\"Kimi / Moonshot (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.moonshot.cn/v1\",\n api_key_env_vars=(\"KIMI_CN_API_KEY\",),\n ),\n \"stepfun\": ProviderConfig(\n id=\"stepfun\",\n name=\"StepFun Step Plan\",\n auth_type=\"api_key\",\n inference_base_url=STEPFUN_STEP_PLAN_INTL_BASE_URL,\n api_key_env_vars=(\"STEPFUN_API_KEY\",),\n base_url_env_var=\"STEPFUN_BASE_URL\",\n ),\n \"arcee\": ProviderConfig(\n id=\"arcee\",\n name=\"Arcee AI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.arcee.ai/api/v1\",\n api_key_env_vars=(\"ARCEEAI_API_KEY\",),\n base_url_env_var=\"ARCEE_BASE_URL\",\n ),\n \"gmi\": ProviderConfig(\n id=\"gmi\",\n name=\"GMI Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.gmi-serving.com/v1\",\n api_key_env_vars=(\"GMI_API_KEY\",),\n base_url_env_var=\"GMI_BASE_URL\",\n ),\n \"minimax\": ProviderConfig(\n id=\"minimax\",\n name=\"MiniMax\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimax.io/anthropic\",\n api_key_env_vars=(\"MINIMAX_API_KEY\",),\n base_url_env_var=\"MINIMAX_BASE_URL\",\n ),\n \"minimax-oauth\": ProviderConfig(\n id=\"minimax-oauth\",\n name=\"MiniMax (OAuth \\u00b7 minimax.io)\",\n auth_type=\"oauth_minimax\",\n portal_base_url=MINIMAX_OAUTH_GLOBAL_BASE,\n inference_base_url=MINIMAX_OAUTH_GLOBAL_INFERENCE,\n client_id=MINIMAX_OAUTH_CLIENT_ID,\n scope=MINIMAX_OAUTH_SCOPE,\n extra={\"region\": \"global\", \"cn_portal_base_url\": MINIMAX_OAUTH_CN_BASE,\n \"cn_inference_base_url\": MINIMAX_OAUTH_CN_INFERENCE},\n ),\n \"anthropic\": ProviderConfig(\n id=\"anthropic\",\n name=\"Anthropic\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.anthropic.com\",\n api_key_env_vars=(\"ANTHROPIC_API_KEY\", \"ANTHROPIC_TOKEN\", \"CLAUDE_CODE_OAUTH_TOKEN\"),\n base_url_env_var=\"ANTHROPIC_BASE_URL\",\n ),\n \"alibaba\": ProviderConfig(\n id=\"alibaba\",\n name=\"Qwen Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://dashscope-intl.aliyuncs.com/compatible-mode/v1\",\n api_key_env_vars=(\"DASHSCOPE_API_KEY\",),\n base_url_env_var=\"DASHSCOPE_BASE_URL\",\n ),\n \"alibaba-coding-plan\": ProviderConfig(\n id=\"alibaba-coding-plan\",\n name=\"Alibaba Cloud (Coding Plan)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://coding-intl.dashscope.aliyuncs.com/v1\",\n api_key_env_vars=(\"ALIBABA_CODING_PLAN_API_KEY\", \"DASHSCOPE_API_KEY\"),\n base_url_env_var=\"ALIBABA_CODING_PLAN_BASE_URL\",\n ),\n \"minimax-cn\": ProviderConfig(\n id=\"minimax-cn\",\n name=\"MiniMax (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimaxi.com/anthropic\",\n api_key_env_vars=(\"MINIMAX_CN_API_KEY\",),\n base_url_env_var=\"MINIMAX_CN_BASE_URL\",\n ),\n \"deepseek\": ProviderConfig(\n id=\"deepseek\",\n name=\"DeepSeek\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.deepseek.com/v1\",\n api_key_env_vars=(\"DEEPSEEK_API_KEY\",),\n base_url_env_var=\"DEEPSEEK_BASE_URL\",\n ),\n \"xai\": ProviderConfig(\n id=\"xai\",\n name=\"xAI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.x.ai/v1\",\n api_key_env_vars=(\"XAI_API_KEY\",),\n base_url_env_var=\"XAI_BASE_URL\",\n ),\n \"nvidia\": ProviderConfig(\n id=\"nvidia\",\n name=\"NVIDIA NIM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://integrate.api.nvidia.com/v1\",\n api_key_env_vars=(\"NVIDIA_API_KEY\",),\n base_url_env_var=\"NVIDIA_BASE_URL\",\n ),\n \"opencode-zen\": ProviderConfig(\n id=\"opencode-zen\",\n name=\"OpenCode Zen\",\n auth_type=\"api_key\",\n inference_base_url=\"https://opencode.ai/zen/v1\",\n api_key_env_vars=(\"OPENCODE_ZEN_API_KEY\",),\n base_url_env_var=\"OPENCODE_ZEN_BASE_URL\",\n ),\n \"opencode-go\": ProviderConfig(\n id=\"opencode-go\",\n name=\"OpenCode Go\",\n auth_type=\"api_key\",\n # OpenCode Go mixes API surfaces by model:\n # - GLM / Kimi use OpenAI-compatible chat completions under /v1\n # - MiniMax models use Anthropic Messages under /v1/messages\n # - Qwen 3.7 uses Anthropic Messages under /v1/messages\n # Keep the provider base at /v1 and select api_mode per-model.\n inference_base_url=\"https://opencode.ai/zen/go/v1\",\n api_key_env_vars=(\"OPENCODE_GO_API_KEY\",),\n base_url_env_var=\"OPENCODE_GO_BASE_URL\",\n ),\n \"kilocode\": ProviderConfig(\n id=\"kilocode\",\n name=\"Kilo Code\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.kilo.ai/api/gateway\",\n api_key_env_vars=(\"KILOCODE_API_KEY\",),\n base_url_env_var=\"KILOCODE_BASE_URL\",\n ),\n \"huggingface\": ProviderConfig(\n id=\"huggingface\",\n name=\"Hugging Face\",\n auth_type=\"api_key\",\n inference_base_url=\"https://router.huggingface.co/v1\",\n api_key_env_vars=(\"HF_TOKEN\",),\n base_url_env_var=\"HF_BASE_URL\",\n ),\n \"xiaomi\": ProviderConfig(\n id=\"xiaomi\",\n name=\"Xiaomi MiMo\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.xiaomimimo.com/v1\",\n api_key_env_vars=(\"XIAOMI_API_KEY\",),\n base_url_env_var=\"XIAOMI_BASE_URL\",\n ),\n \"tencent-tokenhub\": ProviderConfig(\n id=\"tencent-tokenhub\",\n name=\"Tencent TokenHub\",\n auth_type=\"api_key\",\n inference_base_url=\"https://tokenhub.tencentmaas.com/v1\",\n api_key_env_vars=(\"TOKENHUB_API_KEY\",),\n base_url_env_var=\"TOKENHUB_BASE_URL\",\n ),\n \"ollama-cloud\": ProviderConfig(\n id=\"ollama-cloud\",\n name=\"Ollama Cloud\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_OLLAMA_CLOUD_BASE_URL,\n api_key_env_vars=(\"OLLAMA_API_KEY\",),\n base_url_env_var=\"OLLAMA_BASE_URL\",\n ),\n \"bedrock\": ProviderConfig(\n id=\"bedrock\",\n name=\"AWS Bedrock\",\n auth_type=\"aws_sdk\",\n inference_base_url=\"https://bedrock-runtime.us-east-1.amazonaws.com\",\n api_key_env_vars=(),\n base_url_env_var=\"BEDROCK_BASE_URL\",\n ),\n \"azure-foundry\": ProviderConfig(\n id=\"azure-foundry\",\n name=\"Azure Foundry\",\n auth_type=\"api_key\",\n inference_base_url=\"\", # User-provided endpoint\n api_key_env_vars=(\"AZURE_FOUNDRY_API_KEY\",),\n base_url_env_var=\"AZURE_FOUNDRY_BASE_URL\",\n ),\n}\n\n# Auto-extend PROVIDER_REGISTRY with any api-key provider registered in\n# providers/ that is not already declared above. New providers only need a\n# plugins/model-providers/<name>/ plugin — no edits to this file required.\ntry:\n from providers import list_providers as _list_providers_for_registry\n for _pp in _list_providers_for_registry():\n if _pp.name in PROVIDER_REGISTRY:\n continue\n if _pp.auth_type != \"api_key\" or not _pp.env_vars:\n continue\n # Skip providers that need custom token resolution or are special-cased\n # in resolve_provider() (copilot/kimi/zai have bespoke token refresh;\n # openrouter/custom are aggregator/user-supplied and handled outside\n # the registry — adding them here breaks runtime_provider resolution\n # that relies on `openrouter not in PROVIDER_REGISTRY`).\n if _pp.name in {\"copilot\", \"kimi-coding\", \"kimi-coding-cn\", \"zai\", \"openrouter\", \"custom\"}:\n continue\n _api_key_vars = tuple(v for v in _pp.env_vars if not v.endswith(\"_BASE_URL\") and not v.endswith(\"_URL\"))\n _base_url_var = next((v for v in _pp.env_vars if v.endswith(\"_BASE_URL\") or v.endswith(\"_URL\")), None)\n PROVIDER_REGISTRY[_pp.name] = ProviderConfig(\n id=_pp.name,\n name=_pp.display_name or _pp.name,\n auth_type=\"api_key\",\n inference_base_url=_pp.base_url,\n api_key_env_vars=_api_key_vars or _pp.env_vars,\n base_url_env_var=_base_url_var or \"\",\n )\n # Also register aliases so resolve_provider() resolves them\n for _alias in _pp.aliases:\n if _alias not in PROVIDER_REGISTRY:\n PROVIDER_REGISTRY[_alias] = PROVIDER_REGISTRY[_pp.name]\nexcept Exception:\n pass\n\n\n# =============================================================================\n# Anthropic Key Helper\n# =============================================================================\n\ndef get_anthropic_key() -> str:\n \"\"\"Return the first usable Anthropic credential, or ``\"\"``.\n\n Checks both the ``.env`` file (via ``get_env_value``) and the process\n environment (``os.getenv``). The fallback order mirrors the\n ``PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars`` tuple:\n\n ANTHROPIC_API_KEY -> ANTHROPIC_TOKEN -> CLAUDE_CODE_OAUTH_TOKEN\n \"\"\"\n from arcen_cli.config import get_env_value\n\n for var in PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars:\n value = get_env_value(var) or os.getenv(var, \"\")\n if value:\n return value\n return \"\"\n\n\n# =============================================================================\n# Kimi Code Endpoint Detection\n# =============================================================================\n\n# Kimi Code (kimi.com/code) issues keys prefixed \"sk-kimi-\" that only work\n# on api.kimi.com/coding. Legacy keys from platform.moonshot.ai work on\n# api.moonshot.ai/v1 (the old default). Auto-detect when user hasn't set\n# KIMI_BASE_URL explicitly.\n#\n# Note: the base URL intentionally has NO /v1 suffix. The /coding endpoint\n# speaks the Anthropic Messages protocol, and the anthropic SDK appends\n# \"/v1/messages\" internally — so \"/coding\" + SDK suffix → \"/coding/v1/messages\"\n# (the correct target). Using \"/coding/v1\" here would produce\n# \"/coding/v1/v1/messages\" (a 404).\nKIMI_CODE_BASE_URL = \"https://api.kimi.com/coding\"\n\n\ndef _resolve_kimi_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Kimi base URL based on the API key prefix.\n\n If the user has explicitly set KIMI_BASE_URL, that always wins.\n Otherwise, sk-kimi- prefixed keys route to api.kimi.com/coding/v1.\n \"\"\"\n if env_override:\n return env_override\n # No key → nothing to infer from. Return default without inspecting.\n if not api_key:\n return default_url\n if api_key.startswith(\"sk-kimi-\"):\n return KIMI_CODE_BASE_URL\n return default_url\n\n\n\n_PLACEHOLDER_SECRET_VALUES = {\n \"*\",\n \"**\",\n \"***\",\n \"changeme\",\n \"your_api_key\",\n \"your_api_key_here\",\n \"your-api-key\",\n \"placeholder\",\n \"example\",\n \"dummy\",\n \"null\",\n \"none\",\n}\n\n\ndef has_usable_secret(value: Any, *, min_length: int = 4) -> bool:\n \"\"\"Return True when a configured secret looks usable, not empty/placeholder.\"\"\"\n if not isinstance(value, str):\n return False\n cleaned = value.strip()\n if len(cleaned) < min_length:\n return False\n if cleaned.lower() in _PLACEHOLDER_SECRET_VALUES:\n return False\n return True\n\n\ndef _resolve_api_key_provider_secret(\n provider_id: str, pconfig: ProviderConfig\n) -> tuple[str, str]:\n \"\"\"Resolve an API-key provider's token and indicate where it came from.\"\"\"\n if provider_id == \"copilot\":\n # Use the dedicated copilot auth module for proper token validation\n try:\n from arcen_cli.copilot_auth import resolve_copilot_token, get_copilot_api_token\n token, source = resolve_copilot_token()\n if token:\n return get_copilot_api_token(token), source\n except ValueError as exc:\n logger.warning(\"Copilot token validation failed: %s\", exc)\n except Exception:\n pass\n return \"\", \"\"\n\n from arcen_cli.config import get_env_value\n for env_var in pconfig.api_key_env_vars:\n # Check both os.environ and ~/.arcen/.env file\n val = (get_env_value(env_var) or \"\").strip()\n if has_usable_secret(val):\n return val, env_var\n\n # Fallback: try credential pool (e.g. zai key stored via auth.json)\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(provider_id)\n if pool and pool.has_credentials():\n entry = pool.peek()\n if entry:\n key = getattr(entry, \"access_token\", \"\") or getattr(entry, \"runtime_api_key\", \"\")\n key = str(key).strip()\n if has_usable_secret(key):\n return key, f\"credential_pool:{provider_id}\"\n except Exception:\n pass\n\n return \"\", \"\"\n\n\n# =============================================================================\n# Z.AI Endpoint Detection\n# =============================================================================\n\n# Z.AI has separate billing for general vs coding plans, and global vs China\n# endpoints. A key that works on one may return \"Insufficient balance\" on\n# another. We probe at setup time and store the working endpoint.\n# Each entry lists candidate models to try in order — newer coding plan accounts\n# may only have access to recent models (glm-5.1, glm-5v-turbo) while older\n# ones still use glm-4.7.\n\nZAI_ENDPOINTS = [\n # (id, base_url, probe_models, label)\n (\"global\", \"https://api.z.ai/api/paas/v4\", [\"glm-5\"], \"Global\"),\n (\"cn\", \"https://open.bigmodel.cn/api/paas/v4\", [\"glm-5\"], \"China\"),\n (\"coding-global\", \"https://api.z.ai/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"Global (Coding Plan)\"),\n (\"coding-cn\", \"https://open.bigmodel.cn/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"China (Coding Plan)\"),\n]\n\n\ndef detect_zai_endpoint(api_key: str, timeout: float = 8.0) -> Optional[Dict[str, str]]:\n \"\"\"Probe z.ai endpoints to find one that accepts this API key.\n\n Returns {\"id\": ..., \"base_url\": ..., \"model\": ..., \"label\": ...} for the\n first working endpoint, or None if all fail. For endpoints with multiple\n candidate models, tries each in order and returns the first that succeeds.\n \"\"\"\n for ep_id, base_url, probe_models, label in ZAI_ENDPOINTS:\n for model in probe_models:\n try:\n resp = httpx.post(\n f\"{base_url}/chat/completions\",\n headers={\n \"Authorization\": f\"Bearer {api_key}\",\n \"Content-Type\": \"application/json\",\n },\n json={\n \"model\": model,\n \"stream\": False,\n \"max_tokens\": 1,\n \"messages\": [{\"role\": \"user\", \"content\": \"ping\"}],\n },\n timeout=timeout,\n )\n if resp.status_code == 200:\n logger.debug(\"Z.AI endpoint probe: %s (%s) model=%s OK\", ep_id, base_url, model)\n return {\n \"id\": ep_id,\n \"base_url\": base_url,\n \"model\": model,\n \"label\": label,\n }\n logger.debug(\"Z.AI endpoint probe: %s model=%s returned %s\", ep_id, model, resp.status_code)\n except Exception as exc:\n logger.debug(\"Z.AI endpoint probe: %s model=%s failed: %s\", ep_id, model, exc)\n return None\n\n\ndef _resolve_zai_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Z.AI base URL by probing endpoints.\n\n If the user has explicitly set GLM_BASE_URL, that always wins.\n Otherwise, probe the candidate endpoints to find one that accepts the\n key. The detected endpoint is cached in provider state (auth.json) keyed\n on a hash of the API key so subsequent starts skip the probe.\n \"\"\"\n if env_override:\n return env_override\n\n # No API key set → don't probe (would fire N×M HTTPS requests with an\n # empty Bearer token, all returning 401). This path is hit during\n # auxiliary-client auto-detection when the user has no Z.AI credentials\n # at all — the caller discards the result immediately, so the probe is\n # pure latency for every AIAgent construction.\n if not api_key:\n return default_url\n\n # Check provider-state cache for a previously-detected endpoint.\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"zai\") or {}\n cached = state.get(\"detected_endpoint\")\n if isinstance(cached, dict) and cached.get(\"base_url\"):\n key_hash = cached.get(\"key_hash\", \"\")\n if key_hash == hashlib.sha256(api_key.encode()).hexdigest()[:16]:\n logger.debug(\"Z.AI: using cached endpoint %s\", cached[\"base_url\"])\n return cached[\"base_url\"]\n\n # Probe — may take up to ~8s per endpoint.\n detected = detect_zai_endpoint(api_key)\n if detected and detected.get(\"base_url\"):\n # Persist the detection result keyed on the API key hash.\n key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:16]\n state[\"detected_endpoint\"] = {\n \"base_url\": detected[\"base_url\"],\n \"endpoint_id\": detected.get(\"id\", \"\"),\n \"model\": detected.get(\"model\", \"\"),\n \"label\": detected.get(\"label\", \"\"),\n \"key_hash\": key_hash,\n }\n _save_provider_state(auth_store, \"zai\", state)\n logger.info(\"Z.AI: auto-detected endpoint %s (%s)\", detected[\"label\"], detected[\"base_url\"])\n return detected[\"base_url\"]\n\n logger.debug(\"Z.AI: probe failed, falling back to default %s\", default_url)\n return default_url\n\n\n# =============================================================================\n# Error Types\n# =============================================================================\n\n# Error code marking upstream rate-limit / usage-quota exhaustion (HTTP 429).\n# Such failures are transient and re-authenticating cannot resolve them, so\n# they must be kept distinct from missing/expired-credential errors.\nCODEX_RATE_LIMITED_CODE = \"codex_rate_limited\"\n\n\nclass AuthError(RuntimeError):\n \"\"\"Structured auth error with UX mapping hints.\"\"\"\n\n def __init__(\n self,\n message: str,\n *,\n provider: str = \"\",\n code: Optional[str] = None,\n relogin_required: bool = False,\n ) -> None:\n super().__init__(message)\n self.provider = provider\n self.code = code\n self.relogin_required = relogin_required\n\n\ndef is_rate_limited_auth_error(error: Exception) -> bool:\n \"\"\"True when an :class:`AuthError` represents upstream rate-limiting / quota\n exhaustion rather than missing or invalid credentials.\n\n These failures are transient — re-authenticating cannot resolve them — so\n callers should surface a \"retry later\" notice and prefer a fallback chain\n instead of prompting the operator to run ``arcen auth``.\n \"\"\"\n return (\n isinstance(error, AuthError)\n and not error.relogin_required\n and error.code == CODEX_RATE_LIMITED_CODE\n )\n\n\ndef _parse_retry_after_seconds(headers: Any) -> Optional[int]:\n \"\"\"Best-effort parse of a ``Retry-After`` header into whole seconds.\n\n Supports the delta-seconds form (e.g. ``\"120\"``). HTTP-date forms and\n missing/unparseable values return ``None`` rather than guessing.\n \"\"\"\n if headers is None:\n return None\n try:\n raw = headers.get(\"retry-after\")\n except Exception:\n return None\n if raw is None:\n return None\n try:\n seconds = int(str(raw).strip())\n except (TypeError, ValueError):\n return None\n return seconds if seconds >= 0 else None\n\n\ndef format_auth_error(error: Exception) -> str:\n \"\"\"Map auth failures to concise user-facing guidance.\"\"\"\n if not isinstance(error, AuthError):\n return str(error)\n\n # Rate-limit / quota errors are not credential problems — never append the\n # \"re-authenticate\" remediation, which would mislead the operator.\n if is_rate_limited_auth_error(error):\n return str(error)\n\n if error.relogin_required:\n return f\"{error} Run `arcen model` to re-authenticate.\"\n\n if error.code == \"subscription_required\":\n if error.provider == \"nous\":\n return _format_nous_entitlement_auth_error(error)\n return \"No active paid subscription found. Please purchase/activate a subscription, then retry.\"\n\n if error.code == \"insufficient_credits\":\n if error.provider == \"nous\":\n return _format_nous_entitlement_auth_error(error)\n return \"Subscription credits are exhausted. Top up/renew credits, then retry.\"\n\n if error.code in {\"subscription_expired\", \"no_usable_credits\", \"account_missing\"}:\n if error.provider == \"nous\":\n return _format_nous_entitlement_auth_error(error)\n\n if error.code == \"temporarily_unavailable\":\n return f\"{error} Please retry in a few seconds.\"\n\n return str(error)\n\n\ndef _format_nous_entitlement_auth_error(error: AuthError) -> str:\n try:\n from arcen_cli.nous_account import (\n format_nous_portal_entitlement_message,\n get_nous_portal_account_info,\n )\n\n account_info = get_nous_portal_account_info(force_fresh=True)\n message = format_nous_portal_entitlement_message(\n account_info,\n capability=\"Nous model access\",\n )\n if message:\n return message\n except Exception:\n pass\n return f\"{error} Check credits or billing in Nous Portal, then retry.\"\n\n\ndef _token_fingerprint(token: Any) -> Optional[str]:\n \"\"\"Return a short hash fingerprint for telemetry without leaking token bytes.\"\"\"\n if not isinstance(token, str):\n return None\n cleaned = token.strip()\n if not cleaned:\n return None\n return hashlib.sha256(cleaned.encode(\"utf-8\")).hexdigest()[:12]\n\n\ndef _oauth_trace_enabled() -> bool:\n raw = os.getenv(\"ARCEN_OAUTH_TRACE\", \"\").strip().lower()\n return raw in {\"1\", \"true\", \"yes\", \"on\"}\n\n\ndef _oauth_trace(event: str, *, sequence_id: Optional[str] = None, **fields: Any) -> None:\n if not _oauth_trace_enabled():\n return\n payload: Dict[str, Any] = {\"event\": event}\n if sequence_id:\n payload[\"sequence_id\"] = sequence_id\n payload.update(fields)\n logger.info(\"oauth_trace %s\", json.dumps(payload, sort_keys=True, ensure_ascii=False))\n\n\n# =============================================================================\n# Auth Store — persistence layer for ~/.arcen/auth.json\n# =============================================================================\n\ndef _auth_file_path() -> Path:\n path = get_arcen_home() / \"auth.json\"\n # Seat belt: if pytest is running and ARCEN_HOME resolves to the real\n # user's auth store, refuse rather than silently corrupt it. This catches\n # tests that forgot to monkeypatch ARCEN_HOME, tests invoked without the\n # hermetic conftest, or sandbox escapes via threads/subprocesses. In\n # production (no PYTEST_CURRENT_TEST) this is a single dict lookup.\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_auth = (Path.home() / \".arcen\" / \"auth.json\").resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_auth:\n raise RuntimeError(\n f\"Refusing to touch real user auth store during test run: {path}. \"\n \"Set ARCEN_HOME to a tmp_path in your test fixture, or run \"\n \"via scripts/run_tests.sh for hermetic CI-parity env.\"\n )\n return path\n\n\ndef _global_auth_file_path() -> Optional[Path]:\n \"\"\"Return the global-root auth.json when the process is in profile mode.\n\n Returns ``None`` when the profile and global root resolve to the same\n directory (classic mode, or custom ARCEN_HOME that is not a profile).\n Used by read-only fallback paths so providers authed at the root are\n visible to profile processes that haven't configured them locally.\n\n See issue #18594 follow-up (credential_pool shadowing).\n \"\"\"\n try:\n from arcen_constants import get_default_arcen_root\n global_root = get_default_arcen_root()\n except Exception:\n return None\n profile_home = get_arcen_home()\n try:\n if profile_home.resolve(strict=False) == global_root.resolve(strict=False):\n return None\n except Exception:\n if profile_home == global_root:\n return None\n # No pytest seat belt here: this is a pure read-only path, and\n # ``_load_global_auth_store()`` wraps the read in a try/except so an\n # unreadable global file can never break the profile process. The\n # write-side seat belt still lives on ``_auth_file_path()`` where it\n # belongs (that's what protects the real user's auth store from being\n # corrupted by a mis-configured test).\n return global_root / \"auth.json\"\n\n\ndef _load_global_auth_store() -> Dict[str, Any]:\n \"\"\"Load the global-root auth store (read-only fallback).\n\n Returns an empty dict when no global fallback exists (classic mode,\n or the global auth.json is absent). Never raises on missing file.\n\n Seat belt: under pytest, refuses to read the real user's\n ``~/.arcen/auth.json`` even when ARCEN_HOME is set to a profile\n path. The hermetic conftest does not redirect ``HOME``, so\n ``get_default_arcen_root()`` for a profile-shaped ARCEN_HOME can\n still resolve to the real user's home on a dev machine. That would\n leak real credentials into tests. This guard uses the unmodified\n ``HOME`` env var (what ``os.path.expanduser('~')`` would resolve to),\n not ``Path.home()``, because ``Path.home`` is sometimes monkeypatched\n by fixtures that want to relocate the global root to a tmp path.\n \"\"\"\n global_path = _global_auth_file_path()\n if global_path is None or not global_path.exists():\n return {}\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_env = os.environ.get(\"HOME\", \"\")\n if real_home_env:\n real_root = Path(real_home_env) / \".arcen\" / \"auth.json\"\n try:\n if global_path.resolve(strict=False) == real_root.resolve(strict=False):\n return {}\n except Exception:\n pass\n try:\n return _load_auth_store(global_path)\n except Exception:\n # A malformed global store must not break profile reads. The\n # profile's own auth store is still authoritative.\n return {}\n\n\ndef _auth_lock_path() -> Path:\n return _auth_file_path().with_suffix(\".lock\")\n\n\n_auth_lock_holder = threading.local()\n\n\n@contextmanager\ndef _file_lock(\n lock_path: Path,\n holder: threading.local,\n timeout_seconds: float,\n timeout_message: str,\n):\n \"\"\"Cross-process advisory flock helper.\n\n Reentrant per-thread via ``holder.depth``. Falls back to a depth-only\n guard when neither ``fcntl`` nor ``msvcrt`` is available (rare).\n Callers supply their own ``threading.local`` so independent locks\n (e.g. profile auth.json vs shared Nous store) don't share reentrancy\n state — that would let one lock's reentrant acquisition silently skip\n the other's kernel-level flock.\n \"\"\"\n if getattr(holder, \"depth\", 0) > 0:\n holder.depth += 1\n try:\n yield\n finally:\n holder.depth -= 1\n return\n\n lock_path.parent.mkdir(parents=True, exist_ok=True)\n\n if fcntl is None and msvcrt is None:\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n return\n\n # On Windows, msvcrt.locking needs the file to have content and the\n # file pointer at position 0. Ensure the lock file has at least 1 byte.\n if msvcrt and (not lock_path.exists() or lock_path.stat().st_size == 0):\n lock_path.write_text(\" \", encoding=\"utf-8\")\n\n with lock_path.open(\"r+\" if msvcrt else \"a+\", encoding=\"utf-8\") as lock_file:\n deadline = time.monotonic() + max(1.0, timeout_seconds)\n while True:\n try:\n if fcntl:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)\n else:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_NBLCK, 1)\n break\n except (BlockingIOError, OSError, PermissionError):\n if time.monotonic() >= deadline:\n raise TimeoutError(timeout_message)\n time.sleep(0.05)\n\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n if fcntl:\n try:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_UN)\n except (OSError, IOError):\n pass\n elif msvcrt:\n try:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_UNLCK, 1)\n except (OSError, IOError):\n pass\n\n\n@contextmanager\ndef _auth_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-process advisory lock for auth.json reads+writes. Reentrant.\n\n Lock ordering invariant: when this lock is held together with\n ``_nous_shared_store_lock``, acquire ``_auth_store_lock`` FIRST\n (outer) and the shared Nous lock SECOND (inner). All runtime\n refresh paths follow this order; violating it risks deadlock\n against a concurrent import on the shared store.\n \"\"\"\n with _file_lock(\n _auth_lock_path(),\n _auth_lock_holder,\n timeout_seconds,\n \"Timed out waiting for auth store lock\",\n ):\n yield\n\n\ndef _load_auth_store(auth_file: Optional[Path] = None) -> Dict[str, Any]:\n auth_file = auth_file or _auth_file_path()\n if not auth_file.exists():\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n try:\n raw = json.loads(auth_file.read_text())\n except Exception as exc:\n corrupt_path = auth_file.with_suffix(\".json.corrupt\")\n try:\n import shutil\n shutil.copy2(auth_file, corrupt_path)\n except Exception:\n pass\n logger.warning(\n \"auth: failed to parse %s (%s) — starting with empty store. \"\n \"Corrupt file preserved at %s\",\n auth_file, exc, corrupt_path,\n )\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n if isinstance(raw, dict) and (\n isinstance(raw.get(\"providers\"), dict)\n or isinstance(raw.get(\"credential_pool\"), dict)\n ):\n raw.setdefault(\"providers\", {})\n return raw\n\n # Migrate from PR's \"systems\" format if present\n if isinstance(raw, dict) and isinstance(raw.get(\"systems\"), dict):\n systems = raw[\"systems\"]\n providers = {}\n if \"nous_portal\" in systems:\n providers[\"nous\"] = systems[\"nous_portal\"]\n return {\"version\": AUTH_STORE_VERSION, \"providers\": providers,\n \"active_provider\": \"nous\" if providers else None}\n\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n\ndef _save_auth_store(auth_store: Dict[str, Any]) -> Path:\n auth_file = _auth_file_path()\n auth_file.parent.mkdir(parents=True, exist_ok=True)\n # Tighten parent dir to 0o700 so siblings can't traverse to creds.\n # No-op on Windows (POSIX mode bits not enforced); ignore failures.\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_file)\n auth_store[\"version\"] = AUTH_STORE_VERSION\n auth_store[\"updated_at\"] = datetime.now(timezone.utc).isoformat()\n payload = json.dumps(auth_store, indent=2) + \"\\n\"\n tmp_path = auth_file.with_name(f\"{auth_file.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n try:\n # Create with 0o600 atomically via os.open(O_EXCL) + fdopen to close\n # the TOCTOU window where default umask (often 0o644) briefly exposed\n # OAuth tokens to other local users between open() and chmod().\n # Mirrors agent/google_oauth.py (#19673) and tools/mcp_oauth.py (#21148).\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as handle:\n handle.write(payload)\n handle.flush()\n os.fsync(handle.fileno())\n atomic_replace(tmp_path, auth_file)\n try:\n dir_fd = os.open(str(auth_file.parent), os.O_RDONLY)\n except OSError:\n dir_fd = None\n if dir_fd is not None:\n try:\n os.fsync(dir_fd)\n finally:\n os.close(dir_fd)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n # Restrict file permissions to owner only\n try:\n auth_file.chmod(stat.S_IRUSR | stat.S_IWUSR)\n except OSError:\n pass\n return auth_file\n\n\ndef _load_provider_state(auth_store: Dict[str, Any], provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return a provider's persisted state.\n\n In profile mode, falls back to the global-root ``auth.json`` when the\n profile has no entry for ``provider_id``. This mirrors the per-provider\n shadowing already used by ``read_credential_pool``: workers spawned in a\n profile can see providers (e.g. ``nous``) that were only authenticated at\n global scope. Once the user runs ``arcen auth login <provider>`` inside\n the profile, the profile state fully shadows the global state on the next\n read. See issue #18594 follow-up.\n \"\"\"\n providers = auth_store.get(\"providers\")\n if isinstance(providers, dict):\n state = providers.get(provider_id)\n if isinstance(state, dict):\n return dict(state)\n\n # Read-only fallback to the global-root auth store (profile mode only;\n # returns empty dict in classic mode so this is a no-op).\n global_store = _load_global_auth_store()\n if global_store:\n global_providers = global_store.get(\"providers\")\n if isinstance(global_providers, dict):\n global_state = global_providers.get(provider_id)\n if isinstance(global_state, dict):\n return dict(global_state)\n return None\n\n\ndef _save_provider_state(auth_store: Dict[str, Any], provider_id: str, state: Dict[str, Any]) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n auth_store[\"active_provider\"] = provider_id\n\n\ndef _store_provider_state(\n auth_store: Dict[str, Any],\n provider_id: str,\n state: Dict[str, Any],\n *,\n set_active: bool = True,\n) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n if set_active:\n auth_store[\"active_provider\"] = provider_id\n\n\ndef is_known_auth_provider(provider_id: str) -> bool:\n normalized = (provider_id or \"\").strip().lower()\n return normalized in PROVIDER_REGISTRY or normalized in SERVICE_PROVIDER_NAMES\n\n\ndef get_auth_provider_display_name(provider_id: str) -> str:\n normalized = (provider_id or \"\").strip().lower()\n if normalized in PROVIDER_REGISTRY:\n return PROVIDER_REGISTRY[normalized].name\n return SERVICE_PROVIDER_NAMES.get(normalized, provider_id)\n\n\ndef read_credential_pool(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Return the persisted credential pool, or one provider slice.\n\n In profile mode, the profile's credential pool is authoritative. If a\n provider has no entries in the profile, entries from the global-root\n ``auth.json`` are used as a read-only fallback — so workers spawned in a\n profile can see providers that were only authenticated at global scope.\n\n Profile entries always win: the global fallback only applies per-provider\n when the profile has zero entries for that provider. Once the user runs\n ``arcen auth add <provider>`` inside the profile, profile entries\n fully shadow global for that provider on the next read.\n\n Writes always go to the profile (``write_credential_pool`` is unchanged).\n See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n\n global_pool: Dict[str, Any] = {}\n global_store = _load_global_auth_store()\n maybe_global_pool = global_store.get(\"credential_pool\") if global_store else None\n if isinstance(maybe_global_pool, dict):\n global_pool = maybe_global_pool\n\n if provider_id is None:\n merged = dict(pool)\n for gp_key, gp_entries in global_pool.items():\n if not isinstance(gp_entries, list) or not gp_entries:\n continue\n # Per-provider shadowing: profile wins whenever it has ANY entries.\n existing = merged.get(gp_key)\n if isinstance(existing, list) and existing:\n continue\n merged[gp_key] = list(gp_entries)\n return merged\n\n provider_entries = pool.get(provider_id)\n if isinstance(provider_entries, list) and provider_entries:\n return list(provider_entries)\n # Profile has no entries for this provider — fall back to global.\n global_entries = global_pool.get(provider_id)\n return list(global_entries) if isinstance(global_entries, list) else []\n\n\ndef write_credential_pool(provider_id: str, entries: List[Dict[str, Any]]) -> Path:\n \"\"\"Persist one provider's credential pool under auth.json.\n\n This is the final disk-boundary guard for borrowed/reference-only\n credentials. Callers may pass raw dictionaries, so sanitize here even when\n ``PooledCredential.to_dict()`` already did the same work upstream.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n pool[provider_id] = [\n sanitize_borrowed_credential_payload(entry, provider_id)\n if isinstance(entry, dict) else entry\n for entry in entries\n ]\n return _save_auth_store(auth_store)\n\n\ndef suppress_credential_source(provider_id: str, source: str) -> None:\n \"\"\"Mark a credential source as suppressed so it won't be re-seeded.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.setdefault(\"suppressed_sources\", {})\n provider_list = suppressed.setdefault(provider_id, [])\n if source not in provider_list:\n provider_list.append(source)\n _save_auth_store(auth_store)\n\n\ndef is_source_suppressed(provider_id: str, source: str) -> bool:\n \"\"\"Check if a credential source has been suppressed by the user.\"\"\"\n try:\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\", {})\n return source in suppressed.get(provider_id, [])\n except Exception:\n return False\n\n\ndef unsuppress_credential_source(provider_id: str, source: str) -> bool:\n \"\"\"Clear a suppression marker so the source will be re-seeded on the next load.\n\n Returns True if a marker was cleared, False if no marker existed.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\")\n if not isinstance(suppressed, dict):\n return False\n provider_list = suppressed.get(provider_id)\n if not isinstance(provider_list, list) or source not in provider_list:\n return False\n provider_list.remove(source)\n if not provider_list:\n suppressed.pop(provider_id, None)\n if not suppressed:\n auth_store.pop(\"suppressed_sources\", None)\n _save_auth_store(auth_store)\n return True\n\n\ndef get_provider_auth_state(provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return persisted auth state for a provider, or None.\n\n In profile mode, ``_load_provider_state`` already falls back to the\n global-root ``auth.json`` per-provider when the profile has no entry —\n so this is now a thin convenience wrapper. Profile state always wins\n when present. Writes (``_save_auth_store`` / ``persist_*_credentials``)\n are unchanged — they still target the profile only. This mirrors\n ``read_credential_pool``'s per-provider shadowing semantics so that\n ``_seed_from_singletons`` can reseed a profile's credential pool from\n global-scope provider state (e.g. a globally-authenticated Anthropic\n OAuth or Nous device-code session). See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n return _load_provider_state(auth_store, provider_id)\n\n\ndef get_active_provider() -> Optional[str]:\n \"\"\"Return the currently active provider ID from auth store.\"\"\"\n auth_store = _load_auth_store()\n return auth_store.get(\"active_provider\")\n\n\ndef is_provider_explicitly_configured(provider_id: str) -> bool:\n \"\"\"Return True only if the user has explicitly configured this provider.\n\n Checks:\n 1. active_provider in auth.json matches\n 2. model.provider in config.yaml matches\n 3. Provider-specific env vars are set (e.g. ANTHROPIC_API_KEY)\n\n This is used to gate auto-discovery of external credentials (e.g.\n Claude Code's ~/.claude/.credentials.json) so they are never used\n without the user's explicit choice. See PR #4210 for the same\n pattern applied to the setup wizard gate.\n \"\"\"\n normalized = (provider_id or \"\").strip().lower()\n\n # 1. Check auth.json active_provider\n try:\n auth_store = _load_auth_store()\n active = (auth_store.get(\"active_provider\") or \"\").strip().lower()\n if active and active == normalized:\n return True\n except Exception:\n pass\n\n # 2. Check config.yaml model.provider\n try:\n from arcen_cli.config import load_config\n cfg = load_config()\n model_cfg = cfg.get(\"model\")\n if isinstance(model_cfg, dict):\n cfg_provider = (model_cfg.get(\"provider\") or \"\").strip().lower()\n if cfg_provider == normalized:\n return True\n except Exception:\n pass\n\n # 3. Check provider-specific env vars\n # Exclude CLAUDE_CODE_OAUTH_TOKEN — it's set by Claude Code itself,\n # not by the user explicitly configuring anthropic in Arcen.\n _IMPLICIT_ENV_VARS = {\"CLAUDE_CODE_OAUTH_TOKEN\"}\n pconfig = PROVIDER_REGISTRY.get(normalized)\n if pconfig and pconfig.auth_type == \"api_key\":\n for env_var in pconfig.api_key_env_vars:\n if env_var in _IMPLICIT_ENV_VARS:\n continue\n if has_usable_secret(os.getenv(env_var, \"\")):\n return True\n\n return False\n\n\ndef clear_provider_auth(provider_id: Optional[str] = None) -> bool:\n \"\"\"\n Clear auth state for a provider. Used by `arcen logout`.\n If provider_id is None, clears the active provider.\n Returns True if something was cleared.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n target = provider_id or auth_store.get(\"active_provider\")\n if not target:\n return False\n\n providers = auth_store.get(\"providers\", {})\n if not isinstance(providers, dict):\n providers = {}\n auth_store[\"providers\"] = providers\n\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n\n cleared = False\n if target in providers:\n del providers[target]\n cleared = True\n if target in pool:\n del pool[target]\n cleared = True\n\n if auth_store.get(\"active_provider\") == target:\n auth_store[\"active_provider\"] = None\n cleared = True\n\n if not cleared:\n return False\n _save_auth_store(auth_store)\n return True\n\n\ndef deactivate_provider() -> None:\n \"\"\"\n Clear active_provider in auth.json without deleting credentials.\n Used when the user switches to a non-OAuth provider (OpenRouter, custom)\n so auto-resolution doesn't keep picking the OAuth provider.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = None\n _save_auth_store(auth_store)\n\n\n# =============================================================================\n# Provider Resolution — picks which provider to use\n# =============================================================================\n\n\ndef _get_config_hint_for_unknown_provider(provider_name: str) -> str:\n \"\"\"Return a helpful hint string when provider resolution fails.\n\n Checks for common config.yaml mistakes (malformed custom_providers, etc.)\n and returns a human-readable diagnostic, or empty string if nothing found.\n \"\"\"\n try:\n from arcen_cli.config import validate_config_structure\n issues = validate_config_structure()\n if not issues:\n return \"\"\n\n lines = [\"Config issue detected — run 'arcen doctor' for full diagnostics:\"]\n for ci in issues:\n prefix = \"ERROR\" if ci.severity == \"error\" else \"WARNING\"\n lines.append(f\" [{prefix}] {ci.message}\")\n # Show first line of hint\n first_hint = ci.hint.splitlines()[0] if ci.hint else \"\"\n if first_hint:\n lines.append(f\" → {first_hint}\")\n return \"\\n\".join(lines)\n except Exception:\n return \"\"\n\n\ndef resolve_provider(\n requested: Optional[str] = None,\n *,\n explicit_api_key: Optional[str] = None,\n explicit_base_url: Optional[str] = None,\n) -> str:\n \"\"\"\n Determine which inference provider to use.\n\n Priority (when requested=\"auto\" or None):\n 1. active_provider in auth.json with valid credentials\n 2. Explicit CLI api_key/base_url -> \"openrouter\"\n 3. OPENAI_API_KEY or OPENROUTER_API_KEY env vars -> \"openrouter\"\n 4. Provider-specific API keys (GLM, Kimi, MiniMax) -> that provider\n 5. Fallback: \"openrouter\"\n \"\"\"\n normalized = (requested or \"auto\").strip().lower()\n\n # Normalize provider aliases\n _PROVIDER_ALIASES = {\n \"glm\": \"zai\", \"z-ai\": \"zai\", \"z.ai\": \"zai\", \"zhipu\": \"zai\",\n \"google\": \"gemini\", \"google-gemini\": \"gemini\", \"google-ai-studio\": \"gemini\",\n \"x-ai\": \"xai\", \"x.ai\": \"xai\", \"grok\": \"xai\",\n \"xai-oauth\": \"xai-oauth\", \"x-ai-oauth\": \"xai-oauth\",\n \"grok-oauth\": \"xai-oauth\", \"xai-grok-oauth\": \"xai-oauth\",\n \"kimi\": \"kimi-coding\", \"kimi-for-coding\": \"kimi-coding\", \"moonshot\": \"kimi-coding\",\n \"kimi-cn\": \"kimi-coding-cn\", \"moonshot-cn\": \"kimi-coding-cn\",\n \"step\": \"stepfun\", \"stepfun-coding-plan\": \"stepfun\",\n \"arcee-ai\": \"arcee\", \"arceeai\": \"arcee\",\n \"gmi-cloud\": \"gmi\", \"gmicloud\": \"gmi\",\n \"minimax-china\": \"minimax-cn\", \"minimax_cn\": \"minimax-cn\",\n \"minimax-portal\": \"minimax-oauth\", \"minimax-global\": \"minimax-oauth\", \"minimax_oauth\": \"minimax-oauth\",\n \"alibaba_coding\": \"alibaba-coding-plan\", \"alibaba-coding\": \"alibaba-coding-plan\",\n \"alibaba_coding_plan\": \"alibaba-coding-plan\",\n \"claude\": \"anthropic\", \"claude-code\": \"anthropic\",\n \"github\": \"copilot\", \"github-copilot\": \"copilot\",\n \"github-models\": \"copilot\", \"github-model\": \"copilot\",\n \"github-copilot-acp\": \"copilot-acp\", \"copilot-acp-agent\": \"copilot-acp\",\n \"opencode\": \"opencode-zen\", \"zen\": \"opencode-zen\",\n \"qwen-portal\": \"qwen-oauth\", \"qwen-cli\": \"qwen-oauth\", \"qwen-oauth\": \"qwen-oauth\", \"google-gemini-cli\": \"google-gemini-cli\", \"gemini-cli\": \"google-gemini-cli\", \"gemini-oauth\": \"google-gemini-cli\",\n \"hf\": \"huggingface\", \"hugging-face\": \"huggingface\", \"huggingface-hub\": \"huggingface\",\n \"mimo\": \"xiaomi\", \"xiaomi-mimo\": \"xiaomi\",\n \"tencent\": \"tencent-tokenhub\", \"tokenhub\": \"tencent-tokenhub\",\n \"tencent-cloud\": \"tencent-tokenhub\", \"tencentmaas\": \"tencent-tokenhub\",\n \"aws\": \"bedrock\", \"aws-bedrock\": \"bedrock\", \"amazon-bedrock\": \"bedrock\", \"amazon\": \"bedrock\",\n \"go\": \"opencode-go\", \"opencode-go-sub\": \"opencode-go\",\n \"kilo\": \"kilocode\", \"kilo-code\": \"kilocode\", \"kilo-gateway\": \"kilocode\",\n \"lmstudio\": \"lmstudio\", \"lm-studio\": \"lmstudio\", \"lm_studio\": \"lmstudio\",\n # Local server aliases — route through the generic custom provider\n \"ollama\": \"custom\", \"ollama_cloud\": \"ollama-cloud\",\n \"vllm\": \"custom\", \"llamacpp\": \"custom\",\n \"llama.cpp\": \"custom\", \"llama-cpp\": \"custom\",\n }\n # Extend with aliases declared in plugins/model-providers/<name>/ that aren't already mapped.\n # This keeps providers/ as the single source for new aliases while the\n # hardcoded dict above remains authoritative for existing ones.\n try:\n from providers import list_providers as _lp\n for _pp in _lp():\n for _alias in _pp.aliases:\n if _alias not in _PROVIDER_ALIASES:\n _PROVIDER_ALIASES[_alias] = _pp.name\n except Exception:\n pass\n normalized = _PROVIDER_ALIASES.get(normalized, normalized)\n\n if normalized == \"openrouter\":\n return \"openrouter\"\n if normalized == \"custom\":\n return \"custom\"\n if normalized in PROVIDER_REGISTRY:\n return normalized\n if normalized != \"auto\":\n # Check for common config.yaml issues that cause this error\n _config_hint = _get_config_hint_for_unknown_provider(normalized)\n msg = f\"Unknown provider '{normalized}'.\"\n if _config_hint:\n msg += f\"\\n\\n{_config_hint}\"\n else:\n msg += \" Check 'arcen model' for available providers, or run 'arcen doctor' to diagnose config issues.\"\n raise AuthError(msg, code=\"invalid_provider\")\n\n # Explicit one-off CLI creds always mean openrouter/custom\n if explicit_api_key or explicit_base_url:\n return \"openrouter\"\n\n # Check auth store for an active OAuth provider\n try:\n auth_store = _load_auth_store()\n active = auth_store.get(\"active_provider\")\n if active and active in PROVIDER_REGISTRY:\n status = get_auth_status(active)\n if status.get(\"logged_in\"):\n return active\n except Exception as e:\n logger.debug(\"Could not detect active auth provider: %s\", e)\n\n if has_usable_secret(os.getenv(\"OPENAI_API_KEY\")) or has_usable_secret(os.getenv(\"OPENROUTER_API_KEY\")):\n return \"openrouter\"\n\n # Auto-detect API-key providers by checking their env vars\n for pid, pconfig in PROVIDER_REGISTRY.items():\n if pconfig.auth_type != \"api_key\":\n continue\n # GitHub tokens are commonly present for repo/tool access but should not\n # hijack inference auto-selection unless the user explicitly chooses\n # Copilot/GitHub Models as the provider. LM Studio is a local server\n # whose availability isn't implied by LM_API_KEY presence (it may be\n # offline, and the no-auth setup uses a placeholder value), so it\n # also requires explicit selection.\n if pid in {\"copilot\", \"lmstudio\"}:\n continue\n for env_var in pconfig.api_key_env_vars:\n if has_usable_secret(os.getenv(env_var, \"\")):\n return pid\n\n # AWS Bedrock — detect via boto3 credential chain (IAM roles, SSO, env vars).\n # This runs after API-key providers so explicit keys always win.\n try:\n from agent.bedrock_adapter import has_aws_credentials\n if has_aws_credentials():\n return \"bedrock\"\n except ImportError:\n pass # boto3 not installed — skip Bedrock auto-detection\n\n raise AuthError(\n \"No inference provider configured. Run 'arcen model' to choose a \"\n \"provider and model, or set an API key (OPENROUTER_API_KEY, \"\n \"OPENAI_API_KEY, etc.) in ~/.arcen/.env.\",\n code=\"no_provider_configured\",\n )\n\n\n# =============================================================================\n# Timestamp / TTL helpers\n# =============================================================================\n\ndef _parse_iso_timestamp(value: Any) -> Optional[float]:\n if not isinstance(value, str) or not value:\n return None\n text = value.strip()\n if not text:\n return None\n if text.endswith(\"Z\"):\n text = text[:-1] + \"+00:00\"\n try:\n parsed = datetime.fromisoformat(text)\n except Exception:\n return None\n if parsed.tzinfo is None:\n parsed = parsed.replace(tzinfo=timezone.utc)\n return parsed.timestamp()\n\n\ndef _is_expiring(expires_at_iso: Any, skew_seconds: int) -> bool:\n expires_epoch = _parse_iso_timestamp(expires_at_iso)\n if expires_epoch is None:\n return True\n return expires_epoch <= (time.time() + skew_seconds)\n\n\ndef _coerce_ttl_seconds(expires_in: Any) -> int:\n try:\n ttl = int(expires_in)\n except Exception:\n ttl = 0\n return max(0, ttl)\n\n\ndef _optional_base_url(value: Any) -> Optional[str]:\n if not isinstance(value, str):\n return None\n cleaned = value.strip().rstrip(\"/\")\n return cleaned if cleaned else None\n\n\n# Allowlist of hosts the Nous Portal proxy is willing to forward inference\n# JWTs to. Sending a bearer anywhere else would leak it.\n#\n# This is consulted only for URLs coming from the NETWORK side (Portal\n# refresh responses). User-controlled env-var overrides\n# (NOUS_INFERENCE_BASE_URL) bypass validation — that's the documented\n# dev/staging escape hatch and the env source is already trusted (the\n# user set it themselves).\n_ALLOWED_NOUS_INFERENCE_HOSTS: FrozenSet[str] = frozenset({\n \"inference-api.nousresearch.com\",\n})\n\n\ndef _validate_nous_inference_url_from_network(url: Optional[str]) -> Optional[str]:\n \"\"\"Validate a Portal-returned inference URL against the host allowlist.\n\n Returns ``url`` (normalised by stripping trailing slashes) if it's a\n well-formed ``https://<allowlisted-host>/...`` URL. Returns ``None``\n if the URL is missing, malformed, non-https, or points at an\n unexpected host — letting the caller fall back to the configured\n default rather than persist or forward a poisoned value.\n\n Defense-in-depth: a compromised refresh response from the Portal API\n (MITM, malicious response injection) could otherwise redirect every\n subsequent proxy request — bearing the user's inference JWT — to an\n attacker-controlled endpoint.\n Validating scheme + host at the source closes that loop before the\n poisoned URL ever lands in ``auth.json``.\n\n The env-var override path (``NOUS_INFERENCE_BASE_URL``) bypasses\n this — env values come from the trusted OS user, not from the\n network, and the override is documented for staging/dev use.\n\n Co-authored-by: memosr <mehmet.sr35@gmail.com>\n \"\"\"\n if not isinstance(url, str):\n return None\n cleaned = url.strip()\n if not cleaned:\n return None\n try:\n parsed = urlparse(cleaned)\n except Exception:\n return None\n if parsed.scheme != \"https\":\n logger.warning(\n \"nous: refusing non-https inference URL scheme %r from Portal response\",\n parsed.scheme,\n )\n return None\n if parsed.hostname not in _ALLOWED_NOUS_INFERENCE_HOSTS:\n logger.warning(\n \"nous: refusing inference URL host %r from Portal response \"\n \"(not in allowlist); falling back to default\",\n parsed.hostname,\n )\n return None\n return cleaned.rstrip(\"/\")\n\n\ndef _decode_jwt_claims(token: Any) -> Dict[str, Any]:\n if not isinstance(token, str) or token.count(\".\") != 2:\n return {}\n payload = token.split(\".\")[1]\n payload += \"=\" * ((4 - len(payload) % 4) % 4)\n try:\n raw = base64.urlsafe_b64decode(payload.encode(\"utf-8\"))\n claims = json.loads(raw.decode(\"utf-8\"))\n except Exception:\n return {}\n return claims if isinstance(claims, dict) else {}\n\n\ndef _scope_values(raw_scope: Any) -> set[str]:\n # OAuth token responses normally return a space-separated string. Keep\n # collection support for JWT ``scp`` claims and older stored test fixtures.\n scopes: set[str] = set()\n if isinstance(raw_scope, str):\n for part in raw_scope.replace(\",\", \" \").split():\n cleaned = part.strip()\n if cleaned:\n scopes.add(cleaned)\n elif isinstance(raw_scope, (list, tuple, set, frozenset)):\n for item in raw_scope:\n if isinstance(item, str):\n scopes.update(_scope_values(item))\n return scopes\n\n\ndef _nous_invoke_jwt_status(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = NOUS_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> Optional[str]:\n \"\"\"Return None when the token can be used for inference, else a reason.\"\"\"\n claims = _decode_jwt_claims(token)\n if not claims:\n return \"access_token_not_jwt\"\n scopes = (\n _scope_values(scope)\n | _scope_values(claims.get(\"scope\"))\n | _scope_values(claims.get(\"scp\"))\n )\n if NOUS_INFERENCE_INVOKE_SCOPE not in scopes:\n return \"missing_inference_invoke_scope\"\n exp = claims.get(\"exp\")\n skew = max(0, int(min_ttl_seconds))\n if isinstance(exp, (int, float)):\n if float(exp) <= (time.time() + skew):\n return \"invoke_jwt_expiring\"\n return None\n if _is_expiring(expires_at, skew):\n return \"invoke_jwt_expiry_unknown_or_expiring\"\n return None\n\n\ndef _nous_invoke_jwt_is_usable(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = NOUS_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> bool:\n return (\n _nous_invoke_jwt_status(\n token,\n scope=scope,\n expires_at=expires_at,\n min_ttl_seconds=min_ttl_seconds,\n )\n is None\n )\n\n\ndef _assert_nous_inference_jwt_usable(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n) -> None:\n token = state.get(\"access_token\") if access_token is None else access_token\n reason = _nous_invoke_jwt_status(\n token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if reason is None:\n return\n raise AuthError(\n \"Nous Portal access token is not a usable inference JWT \"\n f\"({reason}). Re-authenticate with: arcen auth add nous\",\n provider=\"nous\",\n code=reason,\n relogin_required=True,\n )\n\n\ndef _log_nous_invoke_jwt_selected(\n *,\n access_token: Any,\n sequence_id: Optional[str] = None,\n) -> None:\n logger.info(\"Nous inference auth: using NAS invoke JWT\")\n _oauth_trace(\n \"nous_invoke_jwt_selected\",\n sequence_id=sequence_id,\n access_token_fp=_token_fingerprint(access_token),\n )\n\n\ndef _nous_jwt_expires_at(token: Any, fallback_expires_at: Any = None) -> Optional[str]:\n claims = _decode_jwt_claims(token)\n exp = claims.get(\"exp\")\n if isinstance(exp, (int, float)):\n try:\n return datetime.fromtimestamp(float(exp), tz=timezone.utc).isoformat()\n except Exception:\n pass\n return fallback_expires_at if isinstance(fallback_expires_at, str) else None\n\n\ndef _set_nous_agent_key_from_invoke_jwt(\n state: Dict[str, Any],\n *,\n obtained_at: Optional[str] = None,\n) -> None:\n access_token = state.get(\"access_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n return\n now = datetime.now(timezone.utc)\n existing_obtained_at = state.get(\"agent_key_obtained_at\")\n if obtained_at:\n effective_obtained_at = obtained_at\n elif (\n state.get(\"agent_key\") == access_token\n and isinstance(existing_obtained_at, str)\n and existing_obtained_at.strip()\n ):\n effective_obtained_at = existing_obtained_at\n else:\n effective_obtained_at = now.isoformat()\n expires_at = _nous_jwt_expires_at(access_token, state.get(\"expires_at\"))\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"expires_in\"))\n )\n if expires_at:\n state[\"expires_at\"] = expires_at\n state[\"expires_in\"] = expires_in\n state[\"agent_key\"] = access_token\n state[\"agent_key_id\"] = None\n state[\"agent_key_expires_at\"] = expires_at\n state[\"agent_key_expires_in\"] = expires_in\n state[\"agent_key_reused\"] = False\n state[\"agent_key_obtained_at\"] = effective_obtained_at\n\n\ndef _select_nous_invoke_jwt(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n sequence_id: Optional[str] = None,\n) -> None:\n if isinstance(access_token, str) and access_token.strip():\n state[\"access_token\"] = access_token\n _set_nous_agent_key_from_invoke_jwt(state)\n _log_nous_invoke_jwt_selected(\n access_token=state.get(\"access_token\"),\n sequence_id=sequence_id,\n )\n\n\n_NOUS_EFFECTIVE_STATE_IGNORED_KEYS = frozenset({\n # These are derived from expires_at/JWT exp and naturally tick down between\n # reads. Persisting only these changes makes auth.json noisy and defeats\n # the mtime-keyed auth-status cache.\n \"expires_in\",\n \"agent_key_expires_in\",\n})\n\n\ndef _nous_effective_provider_state(state: Dict[str, Any]) -> Dict[str, Any]:\n return {\n key: value\n for key, value in state.items()\n if key not in _NOUS_EFFECTIVE_STATE_IGNORED_KEYS\n }\n\n\ndef _codex_access_token_is_expiring(access_token: Any, skew_seconds: int) -> bool:\n claims = _decode_jwt_claims(access_token)\n exp = claims.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n\n\ndef _qwen_cli_auth_path() -> Path:\n return Path.home() / \".qwen\" / \"oauth_creds.json\"\n\n\ndef _read_qwen_cli_tokens() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n if not auth_path.exists():\n raise AuthError(\n \"Qwen CLI credentials not found. Run 'qwen auth qwen-oauth' first.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_missing\",\n )\n try:\n data = json.loads(auth_path.read_text(encoding=\"utf-8\"))\n except Exception as exc:\n raise AuthError(\n f\"Failed to read Qwen CLI credentials from {auth_path}: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_read_failed\",\n ) from exc\n if not isinstance(data, dict):\n raise AuthError(\n f\"Invalid Qwen CLI credentials in {auth_path}.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_invalid\",\n )\n return data\n\n\ndef _save_qwen_cli_tokens(tokens: Dict[str, Any]) -> Path:\n auth_path = _qwen_cli_auth_path()\n auth_path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_path)\n # Per-process random temp suffix avoids collisions between concurrent\n # writers and stale leftovers from a crashed prior write.\n tmp_path = auth_path.with_name(f\"{auth_path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed tokens\n # at process umask (typically 0o644). See #19673, #21148.\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(tokens, indent=2, sort_keys=True) + \"\\n\")\n fh.flush()\n os.fsync(fh.fileno())\n atomic_replace(tmp_path, auth_path)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n return auth_path\n\n\ndef _qwen_access_token_is_expiring(expiry_date_ms: Any, skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS) -> bool:\n try:\n expiry_ms = int(expiry_date_ms)\n except Exception:\n return True\n return (time.time() + max(0, int(skew_seconds))) * 1000 >= expiry_ms\n\n\ndef _refresh_qwen_cli_tokens(tokens: Dict[str, Any], timeout_seconds: float = 20.0) -> Dict[str, Any]:\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Qwen OAuth refresh token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_token_missing\",\n )\n\n try:\n response = httpx.post(\n QWEN_OAUTH_TOKEN_URL,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": QWEN_OAUTH_CLIENT_ID,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh failed: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n body = response.text.strip()\n raise AuthError(\n \"Qwen OAuth refresh failed. Re-run 'qwen auth qwen-oauth'.\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh returned invalid JSON: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_json\",\n ) from exc\n\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Qwen OAuth refresh response missing access_token.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_response\",\n )\n\n expires_in = payload.get(\"expires_in\")\n try:\n expires_in_seconds = int(expires_in)\n except Exception:\n expires_in_seconds = 6 * 60 * 60\n\n refreshed = {\n \"access_token\": str(payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(payload.get(\"refresh_token\", refresh_token) or refresh_token).strip(),\n \"token_type\": str(payload.get(\"token_type\", tokens.get(\"token_type\", \"Bearer\")) or \"Bearer\").strip() or \"Bearer\",\n \"resource_url\": str(payload.get(\"resource_url\", tokens.get(\"resource_url\", \"portal.qwen.ai\")) or \"portal.qwen.ai\").strip(),\n \"expiry_date\": int(time.time() * 1000) + max(1, expires_in_seconds) * 1000,\n }\n _save_qwen_cli_tokens(refreshed)\n return refreshed\n\n\ndef _mark_qwen_oauth_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to qwen-oauth in auth.json.\n\n Qwen OAuth tokens live in the Qwen CLI credential file managed by\n _save_qwen_cli_tokens / resolve_qwen_runtime_credentials. This function\n only writes a minimal provider-state entry (base_url for display) and\n sets active_provider so that get_active_provider() and\n _model_section_has_credentials() detect the provider for the setup wizard\n and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"base_url\"):\n state[\"base_url\"] = str(creds[\"base_url\"])\n _save_provider_state(auth_store, \"qwen-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_qwen_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n tokens = _read_qwen_cli_tokens()\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _qwen_access_token_is_expiring(tokens.get(\"expiry_date\"), refresh_skew_seconds)\n if should_refresh:\n tokens = _refresh_qwen_cli_tokens(tokens)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Qwen OAuth access token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_access_token_missing\",\n )\n\n base_url = os.getenv(\"ARCEN_QWEN_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_QWEN_BASE_URL\n return {\n \"provider\": \"qwen-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"qwen-cli\",\n \"expires_at_ms\": tokens.get(\"expiry_date\"),\n \"auth_file\": str(_qwen_cli_auth_path()),\n }\n\n\ndef get_qwen_auth_status() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n try:\n # Validate the runtime credentials, including refresh when the cached\n # CLI token is expired. Otherwise stale tokens show up as \"logged in\"\n # and `arcen model` walks users into a broken Qwen setup flow.\n creds = resolve_qwen_runtime_credentials(refresh_if_expiring=True)\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n \"expires_at_ms\": creds.get(\"expires_at_ms\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": str(exc),\n }\n\n\n# =============================================================================\n# Google Gemini OAuth (google-gemini-cli) — PKCE flow + Cloud Code Assist.\n#\n# Tokens live in ~/.arcen/auth/google_oauth.json (managed by agent.google_oauth).\n# The `base_url` here is the marker \"cloudcode-pa://google\" that run_agent.py\n# uses to construct a GeminiCloudCodeClient instead of the default OpenAI SDK.\n# Actual HTTP traffic goes to https://cloudcode-pa.googleapis.com/v1internal:*.\n# =============================================================================\n\ndef _mark_google_gemini_cli_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to google-gemini-cli in auth.json.\n\n The actual OAuth tokens live in the Google credential file managed by\n agent.google_oauth. This function only writes a minimal provider-state\n entry (email for display) and sets active_provider so that\n get_active_provider() and _model_section_has_credentials() detect the\n provider for the setup wizard and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"email\"):\n state[\"email\"] = str(creds[\"email\"])\n _save_provider_state(auth_store, \"google-gemini-cli\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_gemini_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime OAuth creds for google-gemini-cli.\"\"\"\n try:\n from agent.google_oauth import (\n GoogleOAuthError,\n _credentials_path,\n get_valid_access_token,\n load_credentials,\n )\n except ImportError as exc:\n raise AuthError(\n f\"agent.google_oauth is not importable: {exc}\",\n provider=\"google-gemini-cli\",\n code=\"google_oauth_module_missing\",\n ) from exc\n\n try:\n access_token = get_valid_access_token(force_refresh=force_refresh)\n except GoogleOAuthError as exc:\n raise AuthError(\n str(exc),\n provider=\"google-gemini-cli\",\n code=exc.code,\n ) from exc\n\n creds = load_credentials()\n base_url = DEFAULT_GEMINI_CLOUDCODE_BASE_URL\n return {\n \"provider\": \"google-gemini-cli\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"google-oauth\",\n \"expires_at_ms\": (creds.expires_ms if creds else None),\n \"auth_file\": str(_credentials_path()),\n \"email\": (creds.email if creds else \"\") or \"\",\n \"project_id\": (creds.project_id if creds else \"\") or \"\",\n }\n\n\ndef get_gemini_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return a status dict for `arcen auth list` / `arcen status`.\"\"\"\n try:\n from agent.google_oauth import _credentials_path, load_credentials\n except ImportError:\n return {\"logged_in\": False, \"error\": \"agent.google_oauth unavailable\"}\n auth_path = _credentials_path()\n creds = load_credentials()\n if creds is None or not creds.access_token:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": \"not logged in\",\n }\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": \"google-oauth\",\n \"api_key\": creds.access_token,\n \"expires_at_ms\": creds.expires_ms,\n \"email\": creds.email,\n \"project_id\": creds.project_id,\n }\n# Spotify auth — PKCE tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\n\ndef _spotify_scope_list(raw_scope: Optional[str] = None) -> List[str]:\n scope_text = (raw_scope or DEFAULT_SPOTIFY_SCOPE).strip()\n scopes = [part for part in scope_text.split() if part]\n seen: set[str] = set()\n ordered: List[str] = []\n for scope in scopes:\n if scope not in seen:\n seen.add(scope)\n ordered.append(scope)\n return ordered\n\n\ndef _spotify_scope_string(raw_scope: Optional[str] = None) -> str:\n return \" \".join(_spotify_scope_list(raw_scope))\n\n\ndef _spotify_client_id(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\"),\n get_env_value(\"SPOTIFY_CLIENT_ID\"),\n state.get(\"client_id\") if isinstance(state, dict) else None,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n raise AuthError(\n \"Spotify client_id is required. Set ARCEN_SPOTIFY_CLIENT_ID or pass --client-id.\",\n provider=\"spotify\",\n code=\"spotify_client_id_missing\",\n )\n\n\ndef _spotify_redirect_uri(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\"),\n get_env_value(\"SPOTIFY_REDIRECT_URI\"),\n state.get(\"redirect_uri\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_REDIRECT_URI\n\n\ndef _spotify_api_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_API_BASE_URL\"),\n state.get(\"api_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_API_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_API_BASE_URL\n\n\ndef _spotify_accounts_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_ACCOUNTS_BASE_URL\"),\n state.get(\"accounts_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL\n\n\ndef _spotify_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _spotify_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _oauth_pkce_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _oauth_pkce_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _spotify_build_authorize_url(\n *,\n client_id: str,\n redirect_uri: str,\n scope: str,\n state: str,\n code_challenge: str,\n accounts_base_url: str,\n) -> str:\n query = urlencode({\n \"client_id\": client_id,\n \"response_type\": \"code\",\n \"redirect_uri\": redirect_uri,\n \"scope\": scope,\n \"state\": state,\n \"code_challenge_method\": \"S256\",\n \"code_challenge\": code_challenge,\n })\n return f\"{accounts_base_url}/authorize?{query}\"\n\n\ndef _spotify_validate_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"Spotify PKCE redirect_uri must use http://localhost or http://127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host not in {\"127.0.0.1\", \"localhost\"}:\n raise AuthError(\n \"Spotify PKCE redirect_uri must point to localhost or 127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"Spotify PKCE redirect_uri must include an explicit localhost port.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _make_spotify_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n\n class _SpotifyCallbackHandler(BaseHTTPRequestHandler):\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n result[\"code\"] = params.get(\"code\", [None])[0]\n result[\"state\"] = params.get(\"state\", [None])[0]\n result[\"error\"] = params.get(\"error\", [None])[0]\n result[\"error_description\"] = params.get(\"error_description\", [None])[0]\n\n self.send_response(200)\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if result[\"error\"]:\n body = \"<html><body><h1>Spotify authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>Spotify authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _SpotifyCallbackHandler, result\n\n\ndef _spotify_wait_for_callback(\n redirect_uri: str,\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n host, port, path = _spotify_validate_redirect_uri(redirect_uri)\n handler_cls, result = _make_spotify_callback_handler(path)\n\n class _ReuseHTTPServer(HTTPServer):\n allow_reuse_address = True\n\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n except OSError as exc:\n raise AuthError(\n f\"Could not bind Spotify callback server on {host}:{port}: {exc}\",\n provider=\"spotify\",\n code=\"spotify_callback_bind_failed\",\n ) from exc\n\n thread = threading.Thread(target=server.serve_forever, kwargs={\"poll_interval\": 0.1}, daemon=True)\n thread.start()\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n raise AuthError(\n \"Spotify authorization timed out waiting for the local callback.\",\n provider=\"spotify\",\n code=\"spotify_callback_timeout\",\n )\n\n\ndef _xai_validate_loopback_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"xAI OAuth redirect_uri must use http://127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host != XAI_OAUTH_REDIRECT_HOST:\n raise AuthError(\n \"xAI OAuth redirect_uri must point to 127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"xAI OAuth redirect_uri must include an explicit localhost port.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _xai_callback_cors_origin(origin: Optional[str]) -> str:\n # CORS allowlist for the loopback callback. Only xAI's own auth origins\n # are accepted; the redirect_uri itself is bound to 127.0.0.1 and gated by\n # PKCE+state, so additional dev/3p origins are not needed here.\n allowed = {\n \"https://accounts.x.ai\",\n \"https://auth.x.ai\",\n }\n return origin if origin in allowed else \"\"\n\n\ndef _make_xai_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n result_lock = threading.Lock()\n\n class _XAICallbackHandler(BaseHTTPRequestHandler):\n def _maybe_write_cors_headers(self) -> None:\n origin = self.headers.get(\"Origin\")\n allow_origin = _xai_callback_cors_origin(origin)\n if allow_origin:\n self.send_header(\"Access-Control-Allow-Origin\", allow_origin)\n self.send_header(\"Access-Control-Allow-Methods\", \"GET, OPTIONS\")\n self.send_header(\"Access-Control-Allow-Headers\", \"Content-Type\")\n self.send_header(\"Access-Control-Allow-Private-Network\", \"true\")\n self.send_header(\"Vary\", \"Origin\")\n\n def do_OPTIONS(self) -> None: # noqa: N802\n self.send_response(204)\n self._maybe_write_cors_headers()\n self.end_headers()\n\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n incoming = {\n \"code\": params.get(\"code\", [None])[0],\n \"state\": params.get(\"state\", [None])[0],\n \"error\": params.get(\"error\", [None])[0],\n \"error_description\": params.get(\"error_description\", [None])[0],\n }\n\n # Diagnostic logging — emits at INFO so reporters of loopback bugs\n # (#27385 — \"callback received but Arcen times out\") can produce\n # actionable evidence without a code change. Logged values are\n # fingerprints / booleans only; no actual code/state strings leak\n # into the log file. Run with ``ARCEN_LOG_LEVEL=INFO`` (or check\n # ``~/.arcen/logs/agent.log`` which captures INFO+ unconditionally).\n try:\n logger.info(\n \"xAI loopback callback received: path=%s has_code=%s has_state=%s has_error=%s \"\n \"ua=%s\",\n parsed.path,\n incoming[\"code\"] is not None,\n incoming[\"state\"] is not None,\n incoming[\"error\"] is not None,\n (self.headers.get(\"User-Agent\") or \"\")[:80],\n )\n if incoming[\"error\"]:\n logger.info(\n \"xAI loopback callback carries error=%s error_description=%s\",\n incoming[\"error\"],\n (incoming[\"error_description\"] or \"\")[:200],\n )\n except Exception:\n # Logging must never break the OAuth flow.\n pass\n\n # Treat a hit on the callback path with neither `code` nor `error`\n # as a missing OAuth callback (e.g. xAI's auth backend failed to\n # redirect and the user navigated to the bare loopback URL by hand).\n # Show an explicit \"not received\" page rather than the success page —\n # otherwise the browser claims authorization succeeded while the CLI\n # is still waiting for a real callback and eventually times out.\n if incoming[\"code\"] is None and incoming[\"error\"] is None:\n self.send_response(400)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n body = (\n \"<html><body>\"\n \"<h1>xAI authorization not received.</h1>\"\n \"<p>No authorization code was present in this callback URL. \"\n \"Return to the terminal and re-run \"\n \"<code>arcen auth add xai-oauth</code> to retry.</p>\"\n \"</body></html>\"\n )\n self.wfile.write(body.encode(\"utf-8\"))\n return\n\n # ThreadingHTTPServer allows a fallback/manual callback to complete\n # while a browser connection is stuck. Once we have a terminal\n # OAuth result (code or error), keep the first one so a later\n # concurrent/invalid callback cannot overwrite state before\n # validation in _xai_oauth_loopback_login().\n with result_lock:\n if not (result[\"code\"] or result[\"error\"]):\n result.update(incoming)\n\n self.send_response(200)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if incoming[\"error\"]:\n body = \"<html><body><h1>xAI authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>xAI authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _XAICallbackHandler, result\n\n\ndef _xai_start_callback_server(\n preferred_port: int = XAI_OAUTH_REDIRECT_PORT,\n) -> tuple[HTTPServer, threading.Thread, dict[str, Any], str]:\n host = XAI_OAUTH_REDIRECT_HOST\n expected_path = XAI_OAUTH_REDIRECT_PATH\n handler_cls, result = _make_xai_callback_handler(expected_path)\n\n class _ReuseHTTPServer(ThreadingHTTPServer):\n allow_reuse_address = True\n daemon_threads = True\n\n ports_to_try = [preferred_port]\n if preferred_port != 0:\n ports_to_try.append(0)\n server = None\n last_error: Optional[OSError] = None\n for port in ports_to_try:\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n break\n except OSError as exc:\n last_error = exc\n if server is None:\n raise AuthError(\n f\"Could not bind xAI callback server on {host}:{preferred_port}: {last_error}\",\n provider=\"xai-oauth\",\n code=\"xai_callback_bind_failed\",\n ) from last_error\n\n actual_port = int(server.server_address[1])\n redirect_uri = f\"http://{host}:{actual_port}{expected_path}\"\n thread = threading.Thread(\n target=server.serve_forever,\n kwargs={\"poll_interval\": 0.1},\n daemon=True,\n )\n thread.start()\n return server, thread, result, redirect_uri\n\n\ndef _xai_wait_for_callback(\n server: HTTPServer,\n thread: threading.Thread,\n result: dict[str, Any],\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n # Diagnostic: distinguish \"no callback ever arrived\" from \"callback\n # arrived but result wasn't populated\" (#27385). The per-hit handler\n # also logs at INFO; if neither line appears, xAI's IDP never reached\n # the loopback at all (firewall, port-binding, IPv6/IPv4 mismatch).\n logger.info(\n \"xAI loopback wait timed out after %.0fs with no usable callback \"\n \"(result.code=%s result.error=%s)\",\n max(5.0, timeout_seconds),\n result[\"code\"] is not None,\n result[\"error\"] is not None,\n )\n raise AuthError(\n \"xAI authorization timed out waiting for the local callback.\",\n provider=\"xai-oauth\",\n code=\"xai_callback_timeout\",\n )\n\n\ndef _spotify_token_payload_to_state(\n token_payload: Dict[str, Any],\n *,\n client_id: str,\n redirect_uri: str,\n requested_scope: str,\n accounts_base_url: str,\n api_base_url: str,\n previous_state: Optional[Dict[str, Any]] = None,\n) -> Dict[str, Any]:\n now = datetime.now(timezone.utc)\n expires_in = _coerce_ttl_seconds(token_payload.get(\"expires_in\", 0))\n expires_at = datetime.fromtimestamp(now.timestamp() + expires_in, tz=timezone.utc)\n state = dict(previous_state or {})\n state.update({\n \"client_id\": client_id,\n \"redirect_uri\": redirect_uri,\n \"accounts_base_url\": accounts_base_url,\n \"api_base_url\": api_base_url,\n \"scope\": requested_scope,\n \"granted_scope\": str(token_payload.get(\"scope\") or requested_scope).strip(),\n \"token_type\": str(token_payload.get(\"token_type\", \"Bearer\") or \"Bearer\").strip() or \"Bearer\",\n \"access_token\": str(token_payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(\n token_payload.get(\"refresh_token\")\n or state.get(\"refresh_token\")\n or \"\"\n ).strip(),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": expires_at.isoformat(),\n \"expires_in\": expires_in,\n \"auth_type\": \"oauth_pkce\",\n })\n return state\n\n\ndef _spotify_exchange_code_for_tokens(\n *,\n client_id: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n accounts_base_url: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"client_id\": client_id,\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"code_verifier\": code_verifier,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token exchange failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token exchange failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n )\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify token response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_invalid\",\n )\n return payload\n\n\ndef _refresh_spotify_oauth_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Spotify refresh token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_refresh_token_missing\",\n relogin_required=True,\n )\n\n client_id = _spotify_client_id(state=state)\n accounts_base_url = _spotify_accounts_base_url(state)\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": client_id,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token refresh failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token refresh failed. Run `arcen auth spotify` again.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n relogin_required=True,\n )\n\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify refresh response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_refresh_invalid\",\n relogin_required=True,\n )\n\n return _spotify_token_payload_to_state(\n payload,\n client_id=client_id,\n redirect_uri=_spotify_redirect_uri(state=state),\n requested_scope=str(state.get(\"scope\") or DEFAULT_SPOTIFY_SCOPE),\n accounts_base_url=accounts_base_url,\n api_base_url=_spotify_api_base_url(state),\n previous_state=state,\n )\n\n\ndef resolve_spotify_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = SPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"spotify\")\n if not state:\n raise AuthError(\n \"Spotify is not authenticated. Run `arcen auth spotify` first.\",\n provider=\"spotify\",\n code=\"spotify_auth_missing\",\n relogin_required=True,\n )\n\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds)\n if should_refresh:\n state = _refresh_spotify_oauth_state(state)\n _store_provider_state(auth_store, \"spotify\", state, set_active=False)\n _save_auth_store(auth_store)\n\n access_token = str(state.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Spotify access token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_access_token_missing\",\n relogin_required=True,\n )\n\n return {\n \"provider\": \"spotify\",\n \"access_token\": access_token,\n \"api_key\": access_token,\n \"token_type\": str(state.get(\"token_type\", \"Bearer\") or \"Bearer\"),\n \"base_url\": _spotify_api_base_url(state),\n \"scope\": str(state.get(\"granted_scope\") or state.get(\"scope\") or \"\").strip(),\n \"client_id\": _spotify_client_id(state=state),\n \"redirect_uri\": _spotify_redirect_uri(state=state),\n \"expires_at\": state.get(\"expires_at\"),\n \"refresh_token\": str(state.get(\"refresh_token\", \"\") or \"\").strip(),\n }\n\n\ndef get_spotify_auth_status() -> Dict[str, Any]:\n state = get_provider_auth_state(\"spotify\")\n if not state:\n return {\"logged_in\": False}\n\n expires_at = state.get(\"expires_at\")\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n return {\n \"logged_in\": bool(refresh_token or not _is_expiring(expires_at, 0)),\n \"auth_type\": state.get(\"auth_type\", \"oauth_pkce\"),\n \"client_id\": state.get(\"client_id\"),\n \"redirect_uri\": state.get(\"redirect_uri\"),\n \"scope\": state.get(\"granted_scope\") or state.get(\"scope\"),\n \"expires_at\": expires_at,\n \"api_base_url\": state.get(\"api_base_url\"),\n \"has_refresh_token\": bool(refresh_token),\n }\n\n\ndef _spotify_interactive_setup(redirect_uri_hint: str) -> str:\n \"\"\"Walk the user through creating a Spotify developer app, persist the\n resulting client_id to ~/.arcen/.env, and return it.\n\n Raises SystemExit if the user aborts or submits an empty value.\n \"\"\"\n from arcen_cli.config import save_env_value\n\n print()\n print(\"=\" * 70)\n print(\"Spotify first-time setup\")\n print(\"=\" * 70)\n print()\n print(\"Spotify requires every user to register their own lightweight\")\n print(\"developer app. This takes about two minutes and only has to be\")\n print(\"done once per machine.\")\n print()\n print(f\"Full guide: {SPOTIFY_DOCS_URL}\")\n print()\n print(\"Steps:\")\n print(f\" 1. Opening {SPOTIFY_DASHBOARD_URL} in your browser...\")\n print(\" 2. Click 'Create app' and fill in:\")\n print(\" App name: anything (e.g. arcen-agent)\")\n print(\" Description: anything\")\n print(f\" Redirect URI: {redirect_uri_hint}\")\n print(\" API/SDK: Web API\")\n print(\" 3. Agree to the terms, click Save.\")\n print(\" 4. Open the app's Settings page and copy the Client ID.\")\n print(\" 5. Paste it below.\")\n print()\n\n if not _is_remote_session():\n try:\n webbrowser.open(SPOTIFY_DASHBOARD_URL)\n except Exception:\n pass\n\n try:\n raw = input(\"Spotify Client ID: \").strip()\n except (EOFError, KeyboardInterrupt):\n print()\n raise SystemExit(\"Spotify setup cancelled.\")\n\n if not raw:\n print()\n print(f\"No Client ID entered. See {SPOTIFY_DOCS_URL} for the full guide.\")\n raise SystemExit(\"Spotify setup cancelled: empty Client ID.\")\n\n # Persist so subsequent `arcen auth spotify` runs skip the wizard.\n save_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\", raw)\n # Only persist the redirect URI if it's non-default, to avoid pinning\n # users to a value the default might later change to.\n if redirect_uri_hint and redirect_uri_hint != DEFAULT_SPOTIFY_REDIRECT_URI:\n save_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\", redirect_uri_hint)\n\n print()\n print(\"Saved ARCEN_SPOTIFY_CLIENT_ID to ~/.arcen/.env\")\n print()\n return raw\n\n\ndef login_spotify_command(args) -> None:\n existing_state = get_provider_auth_state(\"spotify\") or {}\n\n # Interactive wizard: if no client_id is configured anywhere, walk the\n # user through creating the Spotify developer app instead of crashing\n # with \"ARCEN_SPOTIFY_CLIENT_ID is required\".\n explicit_client_id = getattr(args, \"client_id\", None)\n try:\n client_id = _spotify_client_id(explicit_client_id, existing_state)\n except AuthError as exc:\n if getattr(exc, \"code\", \"\") != \"spotify_client_id_missing\":\n raise\n client_id = _spotify_interactive_setup(\n redirect_uri_hint=getattr(args, \"redirect_uri\", None) or DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n\n redirect_uri = _spotify_redirect_uri(getattr(args, \"redirect_uri\", None), existing_state)\n scope = _spotify_scope_string(getattr(args, \"scope\", None) or existing_state.get(\"scope\"))\n accounts_base_url = _spotify_accounts_base_url(existing_state)\n api_base_url = _spotify_api_base_url(existing_state)\n open_browser = not getattr(args, \"no_browser\", False)\n\n code_verifier = _spotify_code_verifier()\n code_challenge = _spotify_code_challenge(code_verifier)\n state_nonce = uuid.uuid4().hex\n authorize_url = _spotify_build_authorize_url(\n client_id=client_id,\n redirect_uri=redirect_uri,\n scope=scope,\n state=state_nonce,\n code_challenge=code_challenge,\n accounts_base_url=accounts_base_url,\n )\n\n print(\"Starting Spotify PKCE login...\")\n print(f\"Client ID: {client_id}\")\n print(f\"Redirect URI: {redirect_uri}\")\n print(\"Make sure this redirect URI is allow-listed in your Spotify app settings.\")\n print()\n print(\"Open this URL to authorize Arcen:\")\n print(authorize_url)\n print()\n print(f\"Full setup guide: {SPOTIFY_DOCS_URL}\")\n print()\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=SPOTIFY_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for Spotify authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n callback = _spotify_wait_for_callback(\n redirect_uri,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 180.0),\n )\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise SystemExit(f\"Spotify authorization failed: {detail}\")\n if callback.get(\"state\") != state_nonce:\n raise SystemExit(\"Spotify authorization failed: state mismatch.\")\n\n token_payload = _spotify_exchange_code_for_tokens(\n client_id=client_id,\n code=str(callback.get(\"code\") or \"\"),\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n accounts_base_url=accounts_base_url,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 20.0),\n )\n spotify_state = _spotify_token_payload_to_state(\n token_payload,\n client_id=client_id,\n redirect_uri=redirect_uri,\n requested_scope=scope,\n accounts_base_url=accounts_base_url,\n api_base_url=api_base_url,\n )\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _store_provider_state(auth_store, \"spotify\", spotify_state, set_active=False)\n saved_to = _save_auth_store(auth_store)\n\n print(\"Spotify login successful!\")\n print(f\" Auth state: {saved_to}\")\n print(\" Provider state saved under providers.spotify\")\n print(f\" Docs: {SPOTIFY_DOCS_URL}\")\n\n# =============================================================================\n# SSH / remote session detection\n# =============================================================================\n\ndef _is_remote_session() -> bool:\n \"\"\"Detect environments where loopback OAuth can't reach the local browser.\n\n Historically only SSH was checked, but #26923 surfaced that\n **browser-only remote consoles** (GCP Cloud Shell, GitHub\n Codespaces, AWS EC2 Instance Connect, Gitpod, Replit, etc.) hit\n the exact same problem — the user has a browser on their laptop\n but the loopback listener is bound on the remote VM that the\n laptop's browser can't reach. These environments typically don't\n set ``SSH_CLIENT`` / ``SSH_TTY``, so the SSH-only check left\n them with no guidance and no fallback.\n \"\"\"\n if os.getenv(\"SSH_CLIENT\") or os.getenv(\"SSH_TTY\"):\n return True\n # Browser-only remote IDEs / cloud shells. Keep this list narrow\n # (well-known, documented env vars set by the host platform) so\n # we don't falsely trip on a developer's local shell.\n for var in (\n \"CLOUD_SHELL\", # GCP Cloud Shell\n \"CODESPACES\", # GitHub Codespaces\n \"CODESPACE_NAME\", # GitHub Codespaces (alt)\n \"GITPOD_WORKSPACE_ID\", # Gitpod\n \"REPL_ID\", # Replit\n \"STACKBLITZ\", # StackBlitz\n ):\n if os.getenv(var):\n return True\n return False\n\n\n# Console/text-mode browsers that ``webbrowser`` will happily launch INSIDE\n# the terminal. Opening one of these is worse than not opening anything —\n# it hijacks the user's TTY with an unusable text browser (the xAI OAuth\n# \"Account Management\" page rendered in w3m, reported May 2026) instead of\n# letting them copy the URL to a real browser. When the resolved browser is\n# one of these we refuse to auto-open and fall back to the print-the-URL /\n# manual-paste path, same as a remote session.\n_CONSOLE_BROWSER_NAMES: FrozenSet[str] = frozenset(\n {\n \"w3m\",\n \"lynx\",\n \"links\",\n \"links2\",\n \"elinks\",\n \"www-browser\",\n \"browsh\", # TUI browser — still hijacks the terminal\n }\n)\n\n\ndef _can_open_graphical_browser() -> bool:\n \"\"\"Return True only when a *graphical* browser is likely to open.\n\n ``webbrowser.open()`` resolves to whatever the platform offers, and on a\n headless / CLI-only Linux box with no GUI browser installed that is often\n a text-mode browser (w3m/lynx/links) which launches inside the terminal\n and takes over the user's session. This guard distinguishes \"a real\n windowed browser will pop up\" from \"a console browser will hijack the\n TTY\", so callers can fall back to printing the URL instead.\n\n Heuristics:\n * Respect ``$BROWSER`` — if it names a known console browser, refuse.\n * On Linux, require a display server (``$DISPLAY`` / ``$WAYLAND_DISPLAY``)\n unless ``$BROWSER`` points at something graphical; no display server\n almost always means no GUI browser.\n * Ask ``webbrowser.get()`` what it resolved to and refuse when the\n underlying command is a known console browser.\n * macOS and Windows always have a usable default GUI browser.\n \"\"\"\n import webbrowser as _webbrowser\n\n def _names_console_browser(value: str) -> bool:\n token = value.strip().split()[0] if value.strip() else \"\"\n base = os.path.basename(token).lower()\n return base in _CONSOLE_BROWSER_NAMES\n\n browser_env = os.environ.get(\"BROWSER\", \"\")\n if browser_env and _names_console_browser(browser_env):\n return False\n\n if sys.platform.startswith(\"linux\"):\n has_display = bool(\n os.environ.get(\"DISPLAY\") or os.environ.get(\"WAYLAND_DISPLAY\")\n )\n # An explicit graphical $BROWSER can work without $DISPLAY in odd\n # setups, but a console $BROWSER already returned False above, so the\n # only way to reach here with a $BROWSER set is a graphical one.\n if not has_display and not browser_env:\n return False\n\n try:\n controller = _webbrowser.get()\n except Exception:\n # No browser resolvable at all → definitely don't auto-open.\n return False\n\n candidate = (\n getattr(controller, \"name\", \"\")\n or getattr(controller, \"basename\", \"\")\n or \"\"\n )\n if candidate and _names_console_browser(candidate):\n return False\n\n return True\n\n\ndef _parse_pasted_callback(raw: str) -> dict:\n \"\"\"Parse a pasted callback URL / query string into the loopback shape.\n\n Accepts any of:\n\n * full URL: ``http://127.0.0.1:56121/callback?code=abc&state=xyz``\n * bare query string: ``?code=abc&state=xyz`` or ``code=abc&state=xyz``\n * bare code (no state, only used when the upstream omits state):\n ``abc-the-code-value``\n\n Returns ``{\"code\", \"state\", \"error\", \"error_description\"}`` with\n missing keys set to ``None`` so the loopback callsites can keep\n using the same validation path (state check, error check, etc.)\n they already use for the HTTP server output. Regression for\n #26923 — formalises the curl-the-callback-URL workaround the\n reporter used while waiting for upstream support.\n \"\"\"\n stripped = raw.strip()\n result: dict = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n if not stripped:\n return result\n query = \"\"\n if stripped.startswith((\"http://\", \"https://\")):\n try:\n parsed = urlparse(stripped)\n except Exception:\n return result\n query = parsed.query or \"\"\n elif stripped.startswith(\"?\"):\n query = stripped[1:]\n elif \"=\" in stripped:\n # Looks like a bare query fragment (``code=...&state=...``).\n query = stripped\n else:\n # Treat as a bare opaque code value with no state.\n result[\"code\"] = stripped\n return result\n params = parse_qs(query, keep_blank_values=False)\n for key in (\"code\", \"state\", \"error\", \"error_description\"):\n values = params.get(key)\n if values:\n result[key] = values[0]\n return result\n\n\ndef _prompt_manual_callback_paste(redirect_uri: str) -> dict:\n \"\"\"Read a callback URL from stdin as a fallback for browser-only remotes.\n\n Used when ``--manual-paste`` is set or when the loopback listener\n cannot bind. Returns the parsed callback dict (same shape as the\n HTTP handler output) so the existing state / error validation in\n the caller works unchanged. See #26923.\n \"\"\"\n print()\n print(\"─── Manual callback paste ─────────────────────────────────────\")\n print(\"After approving in your browser, your browser will try to load\")\n print(f\" {redirect_uri}\")\n print(\"which fails (the loopback listener is on this remote machine,\")\n print(\"not on your laptop) — that is expected. Copy the FULL URL\")\n print(\"from your browser's address bar of that failed page and paste\")\n print(\"it below. A bare '?code=...&state=...' fragment also works.\")\n print(\"If the consent page shows the authorization code in-page\")\n print(\"(xAI's current behavior) rather than redirecting, paste the\")\n print(\"bare code value on its own.\")\n print(\"───────────────────────────────────────────────────────────────\")\n try:\n raw = input(\"Callback URL: \")\n except (EOFError, KeyboardInterrupt):\n raw = \"\"\n return _parse_pasted_callback(raw)\n\n\ndef _ssh_user_at_host() -> str:\n \"\"\"Return best-effort 'user@hostname' for the SSH tunnel hint command.\n\n Falls back to placeholder tokens when the values cannot be determined so\n the hint is always syntactically valid even if not copy-pasteable.\n \"\"\"\n try:\n import socket as _socket\n hostname = _socket.gethostname() or \"<this-host>\"\n except OSError:\n hostname = \"<this-host>\"\n user = os.getenv(\"USER\") or os.getenv(\"LOGNAME\") or \"<user>\"\n return f\"{user}@{hostname}\"\n\n\ndef _print_loopback_ssh_hint(redirect_uri: str, *, docs_url: str | None = None) -> None:\n \"\"\"Print an SSH tunnel hint when running a loopback-redirect OAuth flow on a\n remote host. The auth server (xAI, Spotify, ...) will redirect the user's\n browser to ``127.0.0.1:<port>/callback``. If the browser is on a different\n machine than the loopback listener (the usual SSH case), the redirect can't\n reach the listener without a local port forward.\n\n The hint is best-effort: silent if we don't think we're remote, or if we\n can't parse a host/port out of the redirect URI.\n\n Pass ``docs_url`` for a provider-specific guide (e.g. the xAI Grok OAuth\n page); the generic OAuth-over-SSH guide is always shown after it.\n \"\"\"\n if not _is_remote_session():\n return\n try:\n parsed = urlparse(redirect_uri)\n except Exception:\n return\n host = parsed.hostname or \"\"\n port = parsed.port\n if host not in {\"127.0.0.1\", \"::1\", \"localhost\"} or not port:\n return\n divider = \"-\" * 60\n print()\n print(divider)\n print(\"Remote session detected — SSH tunnel required\")\n print(divider)\n print(f\"Arcen is waiting for the OAuth callback on {redirect_uri}\")\n print(\"but your browser is on a different machine. Run this command\")\n print(\"in a NEW terminal on your local machine BEFORE opening the URL:\")\n print()\n print(f\" ssh -N -L {port}:127.0.0.1:{port} {_ssh_user_at_host()}\")\n print()\n print(\"Then open the authorize URL above in your local browser.\")\n print()\n print(\"No SSH client (Cloud Shell / Codespaces / web IDE)? Re-run with\")\n print(\"`--manual-paste` to skip the loopback listener and paste the failed\")\n print(\"callback URL directly.\")\n if docs_url:\n print(f\"Provider docs: {docs_url}\")\n print(f\"SSH/jump-box guide: {OAUTH_OVER_SSH_DOCS_URL}\")\n print(divider)\n print()\n\n\n# =============================================================================\n# OpenAI Codex auth — tokens stored in ~/.arcen/auth.json (not ~/.codex/)\n#\n# Arcen maintains its own Codex OAuth session separate from the Codex CLI\n# and VS Code extension. This prevents refresh token rotation conflicts\n# where one app's refresh invalidates the other's session.\n# =============================================================================\n\ndef _read_codex_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n \"\"\"Read Codex OAuth tokens from Arcen auth store (~/.arcen/auth.json).\n \n Returns dict with 'tokens' (access_token, refresh_token) and 'last_refresh'.\n Raises AuthError if no Codex tokens are stored.\n \"\"\"\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\")\n if not state:\n raise AuthError(\n \"No Codex credentials stored. Run `arcen auth` to authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"Codex auth state is missing tokens. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n raise AuthError(\n \"Codex auth is missing access_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_access_token\",\n relogin_required=True,\n )\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n }\n\n\ndef _sync_codex_pool_entries(\n auth_store: Dict[str, Any],\n tokens: Dict[str, str],\n last_refresh: Optional[str],\n) -> None:\n \"\"\"Mirror a fresh Codex re-auth into the credential_pool OAuth entries.\n\n The runtime selects credentials from ``credential_pool.openai-codex``, not\n from ``providers.openai-codex.tokens``. A re-auth invalidates the prior\n OAuth pair server-side, but pool entries keep holding the now-consumed\n refresh token plus any stale error markers — so the next request spends a\n dead token and gets a 401 ``token_invalidated``.\n\n What gets refreshed:\n\n * ``device_code`` — the singleton-seeded entry written by the device-code\n OAuth flow when the user logged in via ``arcen setup`` / the model\n picker. Always synced with the fresh tokens.\n * ``manual:device_code`` — entries created by ``arcen auth add openai-codex``\n that use the same device-code OAuth mechanism. An interactive re-auth\n proves the user owns the ChatGPT account, so it is safe (and expected)\n to refresh these entries too. Without this, a user who once ran the\n ``arcen auth add`` workaround for #33000 would silently leave that\n manual entry stale on every subsequent re-auth, recreating the issue\n reported in #33538.\n\n What does NOT get refreshed:\n\n * ``manual:api_key`` and any other non-device-code manual sources — those\n are independent credentials (an explicit API key, a different ChatGPT\n account, etc.) and must not be overwritten by a single re-auth.\n\n Error markers (``last_status``, ``last_error_*``) are also cleared on\n every device-code-backed entry — even those whose tokens we did not\n rewrite — so that an interactive re-auth gives every relevant pool entry\n a fresh selection chance instead of leaving them marked unhealthy from a\n pre-re-auth 401.\n \"\"\"\n access_token = tokens.get(\"access_token\")\n if not access_token:\n return\n refresh_token = tokens.get(\"refresh_token\")\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return\n # Sources whose tokens should be rewritten by a fresh Codex device-code\n # OAuth re-auth. ``manual:api_key`` and unknown sources are intentionally\n # excluded — they represent independent credentials.\n REFRESHABLE_SOURCES = {\"device_code\", \"manual:device_code\"}\n for entry in entries:\n if not isinstance(entry, dict):\n continue\n source = entry.get(\"source\")\n if source not in REFRESHABLE_SOURCES:\n continue\n entry[\"access_token\"] = access_token\n if refresh_token:\n entry[\"refresh_token\"] = refresh_token\n if last_refresh:\n entry[\"last_refresh\"] = last_refresh\n entry[\"last_status\"] = None\n entry[\"last_status_at\"] = None\n entry[\"last_error_code\"] = None\n entry[\"last_error_reason\"] = None\n entry[\"last_error_message\"] = None\n entry[\"last_error_reset_at\"] = None\n\n\ndef _save_codex_tokens(tokens: Dict[str, str], last_refresh: str = None, label: str = None) -> None:\n \"\"\"Save Codex OAuth tokens to Arcen auth store (~/.arcen/auth.json).\"\"\"\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"chatgpt\"\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n _save_provider_state(auth_store, \"openai-codex\", state)\n _sync_codex_pool_entries(auth_store, tokens, last_refresh)\n _save_auth_store(auth_store)\n\n\ndef refresh_codex_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"Refresh Codex OAuth tokens without mutating Arcen auth state.\"\"\"\n del access_token # Access token is only used by callers to decide whether to refresh.\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n CODEX_OAUTH_TOKEN_URL,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": CODEX_OAUTH_CLIENT_ID,\n },\n )\n\n if response.status_code == 429:\n # Upstream rate-limit / usage-quota exhaustion on the token endpoint.\n # The stored refresh token is still valid here — re-authenticating\n # cannot lift a quota cap. Classify distinctly from auth failures so\n # callers surface a \"retry later\" notice instead of a misleading\n # \"run arcen auth\" prompt (see issue #32790).\n retry_after = _parse_retry_after_seconds(getattr(response, \"headers\", None))\n if retry_after is not None:\n message = (\n f\"Codex provider quota exhausted (429); retry after {retry_after}s. \"\n \"Credentials are still valid.\"\n )\n else:\n message = (\n \"Codex provider quota exhausted (429). Credentials are still valid; \"\n \"retry after the usage limit resets.\"\n )\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=CODEX_RATE_LIMITED_CODE,\n relogin_required=False,\n )\n\n if response.status_code != 200:\n code = \"codex_refresh_failed\"\n message = f\"Codex token refresh failed with status {response.status_code}.\"\n relogin_required = False\n try:\n err = response.json()\n if isinstance(err, dict):\n err_obj = err.get(\"error\")\n # OpenAI shape: {\"error\": {\"code\": \"...\", \"message\": \"...\", \"type\": \"...\"}}\n if isinstance(err_obj, dict):\n nested_code = err_obj.get(\"code\") or err_obj.get(\"type\")\n if isinstance(nested_code, str) and nested_code.strip():\n code = nested_code.strip()\n nested_msg = err_obj.get(\"message\")\n if isinstance(nested_msg, str) and nested_msg.strip():\n message = f\"Codex token refresh failed: {nested_msg.strip()}\"\n # OAuth spec shape: {\"error\": \"code_str\", \"error_description\": \"...\"}\n elif isinstance(err_obj, str) and err_obj.strip():\n code = err_obj.strip()\n err_desc = err.get(\"error_description\") or err.get(\"message\")\n if isinstance(err_desc, str) and err_desc.strip():\n message = f\"Codex token refresh failed: {err_desc.strip()}\"\n except Exception:\n pass\n if code in {\"invalid_grant\", \"invalid_token\", \"invalid_request\"}:\n relogin_required = True\n if code == \"refresh_token_reused\":\n message = (\n \"Codex refresh token was already consumed by another client \"\n \"(e.g. Codex CLI or VS Code extension). \"\n \"Run `codex` in your terminal to generate fresh tokens, \"\n \"then run `arcen auth` to re-authenticate.\"\n )\n relogin_required = True\n # A 401/403 from the token endpoint always means the refresh token\n # is invalid/expired — force relogin even if the body error code\n # wasn't one of the known strings above.\n if response.status_code in {401, 403} and not relogin_required:\n relogin_required = True\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=code,\n relogin_required=relogin_required,\n )\n\n try:\n refresh_payload = response.json()\n except Exception as exc:\n raise AuthError(\n \"Codex token refresh returned invalid JSON.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_invalid_json\",\n relogin_required=True,\n ) from exc\n\n refreshed_access = refresh_payload.get(\"access_token\")\n if not isinstance(refreshed_access, str) or not refreshed_access.strip():\n raise AuthError(\n \"Codex token refresh response was missing access_token.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_missing_access_token\",\n relogin_required=True,\n )\n\n updated = {\n \"access_token\": refreshed_access.strip(),\n \"refresh_token\": refresh_token.strip(),\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n next_refresh = refresh_payload.get(\"refresh_token\")\n if isinstance(next_refresh, str) and next_refresh.strip():\n updated[\"refresh_token\"] = next_refresh.strip()\n return updated\n\n\ndef _refresh_codex_auth_tokens(\n tokens: Dict[str, str],\n timeout_seconds: float,\n) -> Dict[str, str]:\n \"\"\"Refresh Codex access token using the refresh token.\n \n Saves the new tokens to Arcen auth store automatically.\n \"\"\"\n refreshed = refresh_codex_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n\n _save_codex_tokens(updated_tokens)\n return updated_tokens\n\n\ndef _import_codex_cli_tokens() -> Optional[Dict[str, str]]:\n \"\"\"Try to read tokens from ~/.codex/auth.json (Codex CLI shared file).\n \n Returns tokens dict if valid and not expired, None otherwise.\n Does NOT write to the shared file.\n \"\"\"\n codex_home = os.getenv(\"CODEX_HOME\", \"\").strip()\n if not codex_home:\n codex_home = str(Path.home() / \".codex\")\n auth_path = Path(codex_home).expanduser() / \"auth.json\"\n if not auth_path.is_file():\n return None\n try:\n payload = json.loads(auth_path.read_text())\n tokens = payload.get(\"tokens\")\n if not isinstance(tokens, dict):\n return None\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not access_token or not refresh_token:\n return None\n # Reject expired tokens — importing stale tokens from ~/.codex/\n # that can't be refreshed leaves the user stuck with \"Login successful!\"\n # but no working credentials.\n if _codex_access_token_is_expiring(access_token, 0):\n logger.debug(\n \"Codex CLI tokens at %s are expired — skipping import.\", auth_path,\n )\n return None\n return dict(tokens)\n except Exception:\n return None\n\n\ndef resolve_codex_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime credentials from Arcen's own Codex token store.\n\n Falls back to the credential pool when the singleton (``providers.openai-codex.tokens``)\n has no usable access_token but the pool (``credential_pool.openai-codex``) does. This\n closes the divergence between the chat path (singleton-only via this function) and\n the auxiliary path (pool-first via ``_read_codex_access_token``). Without this\n fallback, a user whose tokens live only in the pool — for example after a manual\n pool seed, a partial re-auth, or pool-only restoration from a backup — gets a bare\n HTTP 401 ``Missing Authentication header`` from the wire instead of a usable\n credential. See issue #32992.\n \"\"\"\n try:\n data = _read_codex_tokens()\n except AuthError:\n pool_token = _pool_codex_access_token()\n if pool_token:\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": pool_token,\n \"source\": \"credential_pool\",\n \"last_refresh\": None,\n \"auth_mode\": \"chatgpt\",\n }\n raise\n\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_CODEX_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n # Re-read under lock to avoid racing with other Arcen processes\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_codex_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n\n if should_refresh:\n tokens = _refresh_codex_auth_tokens(tokens, refresh_timeout_seconds)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"chatgpt\",\n }\n\n\ndef _pool_codex_access_token() -> str:\n \"\"\"Return the most-recent usable access_token from the openai-codex pool.\n\n Used as a fallback by ``resolve_codex_runtime_credentials`` when the\n singleton has no creds. Reads ``credential_pool.openai-codex`` entries\n directly from auth.json and picks the first non-empty access_token,\n preferring entries that are not currently in an exhaustion cooldown.\n Returns ``\"\"`` when no usable entry is found (caller handles by raising\n the original AuthError).\n \"\"\"\n try:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return \"\"\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return \"\"\n\n def _entry_usable(entry: Dict[str, Any]) -> bool:\n if not isinstance(entry, dict):\n return False\n token = entry.get(\"access_token\")\n if not isinstance(token, str) or not token.strip():\n return False\n # Skip entries currently in an exhaustion cooldown window.\n reset_at = entry.get(\"last_error_reset_at\")\n if isinstance(reset_at, (int, float)) and reset_at > time.time():\n return False\n return True\n\n for entry in entries:\n if _entry_usable(entry):\n return str(entry.get(\"access_token\", \"\")).strip()\n except Exception:\n logger.debug(\"Codex pool fallback lookup failed\", exc_info=True)\n return \"\"\n\n\n# =============================================================================\n# xAI Grok OAuth — tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\ndef _read_xai_oauth_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\")\n if not state:\n raise AuthError(\n \"No xAI OAuth credentials stored. Select xAI Grok OAuth (SuperGrok / Premium+) in `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"xAI OAuth state is missing tokens. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI OAuth state is missing access_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_access_token\",\n relogin_required=True,\n )\n if not refresh_token:\n raise AuthError(\n \"xAI OAuth state is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n \"discovery\": state.get(\"discovery\") or {},\n \"redirect_uri\": state.get(\"redirect_uri\"),\n }\n\n\ndef _save_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n discovery: Optional[Dict[str, Any]] = None,\n redirect_uri: str = \"\",\n last_refresh: Optional[str] = None,\n) -> None:\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"oauth_pkce\"\n if discovery:\n state[\"discovery\"] = discovery\n if redirect_uri:\n state[\"redirect_uri\"] = redirect_uri\n _save_provider_state(auth_store, \"xai-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef _xai_access_token_is_expiring(access_token: str, skew_seconds: int = 0) -> bool:\n if not isinstance(access_token, str) or \".\" not in access_token:\n return False\n try:\n parts = access_token.split(\".\")\n if len(parts) < 2:\n return False\n payload_b64 = parts[1]\n payload_b64 += \"=\" * (-len(payload_b64) % 4)\n payload = json.loads(base64.urlsafe_b64decode(payload_b64.encode(\"ascii\")).decode(\"utf-8\"))\n exp = payload.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n except Exception:\n return False\n\n\ndef _xai_validate_oauth_endpoint(url: str, *, field: str) -> str:\n \"\"\"Refuse any OIDC discovery endpoint that isn't HTTPS on the xAI origin.\n\n The OIDC discovery response is a long-lived, low-frequency request whose\n output is cached in ``~/.arcen/auth.json``. A single MITM during initial\n login could substitute a malicious ``token_endpoint``; that URL would\n then receive the refresh_token on every subsequent refresh — a permanent\n credential leak from a one-time MITM. Validating scheme + host pins the\n cached endpoint to the xAI auth origin (or a future ``*.x.ai`` subdomain\n if xAI migrates) so the cache poisoning loses its persistence guarantee.\n\n RFC 8414 §2 requires the issuer to be ``https://`` and SHOULD-keeps the\n token_endpoint on the same origin; we enforce both. ``x.ai`` is the\n bare apex, so we accept either exact host match or any ``.x.ai`` suffix.\n \"\"\"\n parsed = urlparse(url)\n if parsed.scheme != \"https\":\n raise AuthError(\n f\"xAI OIDC discovery returned a non-HTTPS {field}: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n host = (parsed.hostname or \"\").lower()\n if not host:\n raise AuthError(\n f\"xAI OIDC discovery {field} is missing a hostname: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n raise AuthError(\n f\"xAI OIDC discovery {field} host {host!r} is not on the xAI origin \"\n f\"(expected x.ai or a *.x.ai subdomain). Refusing to use a cached \"\n f\"endpoint that may have been substituted by a MITM during initial \"\n f\"discovery; re-authenticate with `arcen model` to re-fetch.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n return url\n\n\ndef _xai_validate_inference_base_url(value: str, *, fallback: str) -> str:\n \"\"\"Refuse a non-xAI base_url for the OAuth-authenticated inference path.\n\n The xAI Grok OAuth bearer is a high-value, long-lived credential tied to\n the user's SuperGrok subscription. ``XAI_BASE_URL`` / ``ARCEN_XAI_BASE_URL``\n let users repoint the inference endpoint (handy for staging or a local\n proxy), but the env override is also a credential-leak vector: a tampered\n ``.env`` or hostile shell init that sets\n ``XAI_BASE_URL=https://attacker.example/v1`` would ship the OAuth access\n token to a third party on every request, silently.\n\n Pin the inference origin to ``api.x.ai`` (or any ``*.x.ai`` subdomain xAI\n may add). On rejection, fall back to the default and log a warning rather\n than raise — a bad env var should not deadlock authentication, but it\n should also never leak the bearer.\n\n ``value`` is the already-stripped, trailing-slash-trimmed candidate from\n env. Empty input returns ``fallback`` unchanged.\n \"\"\"\n candidate = (value or \"\").strip().rstrip(\"/\")\n if not candidate:\n return fallback\n try:\n parsed = urlparse(candidate)\n except Exception:\n logger.warning(\n \"Ignoring malformed xAI base_url override %r; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if parsed.scheme != \"https\":\n logger.warning(\n \"Refusing non-HTTPS xAI base_url override %r (xai-oauth bearer would \"\n \"be sent in cleartext); falling back to %s.\",\n candidate, fallback,\n )\n return fallback\n host = (parsed.hostname or \"\").lower()\n if not host:\n logger.warning(\n \"Ignoring xAI base_url override %r with no hostname; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n logger.warning(\n \"Refusing xAI base_url override %r — host %r is not on the xAI origin \"\n \"(expected x.ai or a *.x.ai subdomain). The xai-oauth bearer is only \"\n \"valid against xAI's inference API; sending it elsewhere would leak \"\n \"the credential. Falling back to %s.\",\n candidate, host, fallback,\n )\n return fallback\n return candidate\n\n\ndef _xai_oauth_discovery(timeout_seconds: float = 15.0) -> Dict[str, str]:\n try:\n response = httpx.get(\n XAI_OAUTH_DISCOVERY_URL,\n headers={\"Accept\": \"application/json\"},\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n ) from exc\n if response.status_code != 200:\n raise AuthError(\n f\"xAI OIDC discovery returned status {response.status_code}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI OIDC discovery response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n authorization_endpoint = str(payload.get(\"authorization_endpoint\", \"\") or \"\").strip()\n token_endpoint = str(payload.get(\"token_endpoint\", \"\") or \"\").strip()\n if not authorization_endpoint or not token_endpoint:\n raise AuthError(\n \"xAI OIDC discovery response was missing required endpoints.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n _xai_validate_oauth_endpoint(authorization_endpoint, field=\"authorization_endpoint\")\n _xai_validate_oauth_endpoint(token_endpoint, field=\"token_endpoint\")\n return {\n \"authorization_endpoint\": authorization_endpoint,\n \"token_endpoint\": token_endpoint,\n }\n\n\ndef refresh_xai_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n token_endpoint: str = \"\",\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n del access_token\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"xAI OAuth is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n endpoint = token_endpoint.strip() or _xai_oauth_discovery(timeout_seconds)[\"token_endpoint\"]\n # Re-validate cached endpoints on the refresh hot path: an auth.json\n # written by an older Arcen (or hand-edited) may carry a non-xAI\n # token_endpoint that would receive every future refresh_token in\n # plaintext if we trusted it blindly. Cheap suffix check; fast-fail\n # with a clear error so the user can re-run `arcen model` to refetch.\n _xai_validate_oauth_endpoint(endpoint, field=\"token_endpoint\")\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n endpoint,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"refresh_token\": refresh_token,\n },\n )\n if response.status_code != 200:\n detail = response.text.strip()\n # ``403`` from xAI's token endpoint is almost always a tier /\n # entitlement gate (the OAuth grant exists but the account isn't\n # on the allowlist for API access). Re-running ``arcen model``\n # won't fix that — surface a separate error code so\n # ``format_auth_error`` doesn't append a misleading\n # re-authenticate hint, and point users at the ``XAI_API_KEY``\n # fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n \"xAI token refresh failed with HTTP 403.\"\n + (f\" Response: {detail}\" if detail else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Re-logging in won't\"\n \" change that; set ``XAI_API_KEY`` and switch to\"\n \" ``provider: xai`` (API-key path) if available, or\"\n \" upgrade your subscription at https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n \"xAI token refresh failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_refresh_failed\",\n relogin_required=(response.status_code in {400, 401}),\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token refresh returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token refresh response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_response\",\n relogin_required=True,\n )\n refreshed_access = str(payload.get(\"access_token\", \"\") or \"\").strip()\n if not refreshed_access:\n raise AuthError(\n \"xAI token refresh response was missing access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_missing_access_token\",\n relogin_required=True,\n )\n updated = {\n \"access_token\": refreshed_access,\n \"refresh_token\": str(payload.get(\"refresh_token\") or refresh_token).strip(),\n \"id_token\": str(payload.get(\"id_token\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n return updated\n\n\ndef _refresh_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n token_endpoint: str,\n redirect_uri: str = \"\",\n timeout_seconds: float,\n) -> Dict[str, Any]:\n refreshed = refresh_xai_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n token_endpoint=token_endpoint,\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n if refreshed.get(\"id_token\"):\n updated_tokens[\"id_token\"] = refreshed[\"id_token\"]\n if refreshed.get(\"expires_in\") is not None:\n updated_tokens[\"expires_in\"] = refreshed[\"expires_in\"]\n if refreshed.get(\"token_type\"):\n updated_tokens[\"token_type\"] = refreshed[\"token_type\"]\n _save_xai_oauth_tokens(\n updated_tokens,\n discovery={\"token_endpoint\": token_endpoint},\n redirect_uri=redirect_uri,\n last_refresh=refreshed[\"last_refresh\"],\n )\n return updated_tokens\n\n\ndef resolve_xai_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n data = _read_xai_oauth_tokens()\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_XAI_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_xai_oauth_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n if not token_endpoint:\n token_endpoint = _xai_oauth_discovery(refresh_timeout_seconds)[\"token_endpoint\"]\n try:\n tokens = _refresh_xai_oauth_tokens(\n tokens,\n token_endpoint=token_endpoint,\n redirect_uri=redirect_uri,\n timeout_seconds=refresh_timeout_seconds,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n except AuthError as exc:\n if _is_terminal_xai_oauth_refresh_error(exc):\n # Terminal failure (HTTP 400/401/403 — invalid_grant, token revoked).\n # Clear dead tokens from auth.json so subsequent sessions fail fast\n # without a network retry. Mirrors credential_pool.py quarantine.\n try:\n _q_store = _load_auth_store()\n _q_state = _load_provider_state(_q_store, \"xai-oauth\") or {}\n _q_tokens = dict(_q_state.get(\"tokens\") or {})\n _q_tokens.pop(\"access_token\", None)\n _q_tokens.pop(\"refresh_token\", None)\n _q_state[\"tokens\"] = _q_tokens\n _q_state[\"last_auth_error\"] = {\n \"provider\": \"xai-oauth\",\n \"code\": exc.code or \"xai_refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _store_provider_state(_q_store, \"xai-oauth\", _q_state, set_active=False)\n _save_auth_store(_q_store)\n except Exception as _save_exc:\n logger.debug(\n \"xAI OAuth: failed to persist quarantined state: %s\", _save_exc,\n )\n raise\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"provider\": \"xai-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"oauth_pkce\",\n }\n\n\n# =============================================================================\n# TLS verification helper\n# =============================================================================\n\ndef _default_verify() -> bool | ssl.SSLContext:\n \"\"\"Platform-aware default SSL verify for httpx clients.\n\n On macOS with Homebrew Python, the system OpenSSL cannot locate the\n system trust store and valid public certs fail verification. When\n certifi is importable we pin its bundle explicitly; elsewhere we\n defer to httpx's built-in default (certifi via its own dependency).\n Mirrors the weixin fix in 3a0ec1d93.\n \"\"\"\n if sys.platform == \"darwin\":\n try:\n import certifi\n return ssl.create_default_context(cafile=certifi.where())\n except ImportError:\n pass\n return True\n\n\ndef _resolve_verify(\n *,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n auth_state: Optional[Dict[str, Any]] = None,\n) -> bool | ssl.SSLContext:\n tls_state = auth_state.get(\"tls\") if isinstance(auth_state, dict) else {}\n tls_state = tls_state if isinstance(tls_state, dict) else {}\n\n effective_insecure = (\n is_truthy_value(insecure, default=False) if insecure is not None\n else is_truthy_value(tls_state.get(\"insecure\", False), default=False)\n )\n effective_ca = (\n ca_bundle\n or tls_state.get(\"ca_bundle\")\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n or os.getenv(\"REQUESTS_CA_BUNDLE\")\n )\n\n if effective_insecure:\n return False\n if effective_ca:\n ca_path = str(effective_ca)\n if not os.path.isfile(ca_path):\n logger.warning(\n \"CA bundle path does not exist: %s — falling back to default certificates\",\n ca_path,\n )\n return _default_verify()\n return ssl.create_default_context(cafile=ca_path)\n return _default_verify()\n\n\n# =============================================================================\n# OAuth Device Code Flow — generic, parameterized by provider\n# =============================================================================\n\ndef _request_device_code(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n scope: Optional[str],\n) -> Dict[str, Any]:\n \"\"\"POST to the device code endpoint. Returns device_code, user_code, etc.\"\"\"\n response = client.post(\n f\"{portal_base_url}/api/oauth/device/code\",\n data={\n \"client_id\": client_id,\n **({\"scope\": scope} if scope else {}),\n },\n )\n response.raise_for_status()\n data = response.json()\n\n required_fields = [\n \"device_code\", \"user_code\", \"verification_uri\",\n \"verification_uri_complete\", \"expires_in\", \"interval\",\n ]\n missing = [f for f in required_fields if f not in data]\n if missing:\n raise ValueError(f\"Device code response missing fields: {', '.join(missing)}\")\n return data\n\n\ndef _poll_for_token(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n device_code: str,\n expires_in: int,\n poll_interval: int,\n) -> Dict[str, Any]:\n \"\"\"Poll the token endpoint until the user approves or the code expires.\"\"\"\n deadline = time.monotonic() + max(1, expires_in)\n current_interval = max(1, min(poll_interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n\n while time.monotonic() < deadline:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n data={\n \"grant_type\": \"urn:ietf:params:oauth:grant-type:device_code\",\n \"client_id\": client_id,\n \"device_code\": device_code,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise ValueError(\"Token response did not include access_token\")\n return payload\n\n try:\n error_payload = response.json()\n except Exception:\n response.raise_for_status()\n raise RuntimeError(\"Token endpoint returned a non-JSON error response\")\n\n error_code = error_payload.get(\"error\", \"\")\n if error_code == \"authorization_pending\":\n time.sleep(current_interval)\n continue\n if error_code == \"slow_down\":\n current_interval = min(current_interval + 1, 30)\n time.sleep(current_interval)\n continue\n\n description = error_payload.get(\"error_description\") or \"Unknown authentication error\"\n raise RuntimeError(f\"{error_code}: {description}\")\n\n raise TimeoutError(\"Timed out waiting for device authorization\")\n\n\n# =============================================================================\n# Nous Portal — token refresh and model discovery\n# =============================================================================\n\n# -----------------------------------------------------------------------------\n# Shared Nous token store — lets OAuth credentials persist across profiles\n# so a new `arcen --profile <name> auth add nous --type oauth` can one-tap\n# import instead of running the full device-code flow every time.\n#\n# File lives at ${ARCEN_SHARED_AUTH_DIR}/nous_auth.json, defaulting to\n# ``<arcen-root>/shared/nous_auth.json`` where ``<arcen-root>`` is what\n# ``get_default_arcen_root()`` returns — ``~/.arcen`` on Linux/macOS,\n# ``%LOCALAPPDATA%\\arcen`` on native Windows, or the Docker/custom root.\n# It is OUTSIDE any named profile's ARCEN_HOME so named profiles (which\n# typically live under ``<arcen-root>/profiles/<name>/``) all see the\n# same file.\n#\n# Written on successful login and on every runtime refresh so the stored\n# refresh_token stays current even if one profile refreshes and rotates it.\n# If ever the stored refresh_token does go stale server-side, import fails\n# gracefully and the user falls back to the normal device-code flow.\n# -----------------------------------------------------------------------------\n\nNOUS_SHARED_STORE_FILENAME = \"nous_auth.json\"\n_nous_shared_lock_holder = threading.local()\n\n\ndef _nous_shared_auth_dir() -> Path:\n \"\"\"Resolve the directory that holds the shared Nous token store.\n\n Honors ``ARCEN_SHARED_AUTH_DIR`` so tests can redirect it to a tmp\n path without touching the real user's home. Defaults to\n ``<arcen-root>/shared/``, where ``<arcen-root>`` is what\n :func:`arcen_constants.get_default_arcen_root` returns — so\n Linux/macOS classic installs land at ``~/.arcen/shared/``, native\n Windows installs at ``%LOCALAPPDATA%\\\\arcen\\\\shared\\\\``, and\n Docker / custom ``ARCEN_HOME`` deployments at\n ``<ARCEN_HOME>/shared/``. Sits outside any named profile so all\n profiles under the same root share the store.\n \"\"\"\n override = os.getenv(\"ARCEN_SHARED_AUTH_DIR\", \"\").strip()\n if override:\n return Path(override).expanduser()\n from arcen_constants import get_default_arcen_root\n return get_default_arcen_root() / \"shared\"\n\n\ndef _nous_shared_store_path() -> Path:\n path = _nous_shared_auth_dir() / NOUS_SHARED_STORE_FILENAME\n # Seat belt: if pytest is running and this resolves to a path under the\n # real user's Arcen root, refuse rather than silently corrupt cross-profile\n # state. Tests must set ARCEN_SHARED_AUTH_DIR to a tmp_path (conftest\n # does not do this automatically — mirror the _auth_file_path() guard\n # so forgetting to set it fails loudly instead of writing to the real\n # shared store).\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n from arcen_constants import get_default_arcen_root\n real_home_shared = (\n get_default_arcen_root() / \"shared\" / NOUS_SHARED_STORE_FILENAME\n ).resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_shared:\n raise RuntimeError(\n f\"Refusing to touch real user shared Nous auth store during test run: \"\n f\"{path}. Set ARCEN_SHARED_AUTH_DIR to a tmp_path in your test fixture.\"\n )\n return path\n\n\n@contextmanager\ndef _nous_shared_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-profile lock for the shared Nous OAuth store.\n\n Lock ordering invariant: if both this and ``_auth_store_lock`` need\n to be held, acquire ``_auth_store_lock`` FIRST. All runtime refresh\n paths follow this order. The one exception is\n ``_try_import_shared_nous_state``, which holds this lock alone for\n the entire refresh cycle so concurrent imports on sibling profiles\n can't race on the single-use shared refresh token; that helper must\n NOT be called with ``_auth_store_lock`` already held.\n \"\"\"\n try:\n lock_path = _nous_shared_store_path().with_suffix(\".lock\")\n except RuntimeError:\n # No ARCEN_HOME yet (pre-setup): fall through without locking.\n yield\n return\n\n with _file_lock(\n lock_path,\n _nous_shared_lock_holder,\n timeout_seconds,\n \"Timed out waiting for shared Nous auth lock\",\n ):\n yield\n\n\ndef _merge_shared_nous_oauth_state(state: Dict[str, Any]) -> bool:\n \"\"\"Copy fresher shared OAuth tokens into a profile-local Nous state.\"\"\"\n shared = _read_shared_nous_state()\n if not shared:\n return False\n\n shared_refresh = shared.get(\"refresh_token\")\n if not isinstance(shared_refresh, str) or not shared_refresh.strip():\n return False\n\n local_refresh = state.get(\"refresh_token\")\n shared_access_exp = _parse_iso_timestamp(shared.get(\"expires_at\")) or 0.0\n local_access_exp = _parse_iso_timestamp(state.get(\"expires_at\")) or 0.0\n refresh_changed = shared_refresh.strip() != str(local_refresh or \"\").strip()\n fresher_access = shared_access_exp > local_access_exp\n if not refresh_changed and not fresher_access:\n return False\n\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"token_type\",\n \"scope\",\n \"client_id\",\n \"portal_base_url\",\n \"inference_base_url\",\n \"obtained_at\",\n \"expires_at\",\n ):\n value = shared.get(key)\n if value not in {None, \"\"}:\n state[key] = value\n return True\n\n\ndef _write_shared_nous_state(state: Dict[str, Any]) -> None:\n \"\"\"Persist a minimal copy of the Nous OAuth state to the shared store.\n\n Best-effort: any failure is swallowed after logging. The shared store\n is a convenience layer; the per-profile auth.json remains the source\n of truth.\n\n We deliberately omit the runtime ``agent_key`` compatibility field;\n the OAuth tokens are the cross-profile source of truth.\n \"\"\"\n refresh_token = state.get(\"refresh_token\")\n access_token = state.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n # No refresh_token = nothing worth sharing across profiles\n return\n if not (isinstance(access_token, str) and access_token.strip()):\n return\n\n shared = {\n \"_schema\": 1,\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"token_type\": state.get(\"token_type\") or \"Bearer\",\n \"scope\": state.get(\"scope\") or DEFAULT_NOUS_SCOPE,\n \"client_id\": state.get(\"client_id\") or DEFAULT_NOUS_CLIENT_ID,\n \"portal_base_url\": state.get(\"portal_base_url\") or DEFAULT_NOUS_PORTAL_URL,\n \"inference_base_url\": state.get(\"inference_base_url\") or DEFAULT_NOUS_INFERENCE_URL,\n \"obtained_at\": state.get(\"obtained_at\"),\n \"expires_at\": state.get(\"expires_at\"),\n \"updated_at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n with _nous_shared_store_lock():\n path = _nous_shared_store_path()\n path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(path)\n tmp = path.with_name(f\"{path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed Nous\n # refresh_token at process umask. See #19673, #21148.\n fd = os.open(\n str(tmp),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(shared, indent=2, sort_keys=True))\n fh.flush()\n os.fsync(fh.fileno())\n os.replace(tmp, path)\n finally:\n try:\n if tmp.exists():\n tmp.unlink()\n except OSError:\n pass\n _oauth_trace(\n \"nous_shared_store_written\",\n path=str(path),\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n except Exception as exc:\n logger.debug(\"Failed to write shared Nous auth store: %s\", exc)\n\n\ndef _read_shared_nous_state() -> Optional[Dict[str, Any]]:\n \"\"\"Return the shared Nous OAuth state if present and well-formed.\n\n Returns ``None`` when the file is missing, unreadable, malformed, or\n lacks required fields. Callers should treat ``None`` as \"no shared\n credentials available — fall through to device-code\".\n \"\"\"\n try:\n path = _nous_shared_store_path()\n except RuntimeError:\n # Test seat belt tripped — treat as missing\n return None\n if not path.is_file():\n return None\n try:\n payload = json.loads(path.read_text())\n except (OSError, ValueError) as exc:\n logger.debug(\"Shared Nous auth store at %s is unreadable: %s\", path, exc)\n return None\n if not isinstance(payload, dict):\n return None\n refresh_token = payload.get(\"refresh_token\")\n access_token = payload.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n return None\n if not (isinstance(access_token, str) and access_token.strip()):\n return None\n return payload\n\n\ndef _clear_shared_nous_state(reason: str) -> None:\n \"\"\"Remove the shared Nous OAuth store after a terminal token failure.\"\"\"\n try:\n with _nous_shared_store_lock():\n path = _nous_shared_store_path()\n try:\n path.unlink()\n except FileNotFoundError:\n pass\n _oauth_trace(\"nous_shared_store_cleared\", reason=reason)\n except Exception as exc:\n logger.debug(\"Failed to clear shared Nous auth store: %s\", exc)\n\n\ndef _is_terminal_nous_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Nous refresh token cannot succeed.\"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"nous\"\n and exc.code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_xai_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same xAI OAuth refresh token cannot succeed.\n\n ``xai_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``xai_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"xai-oauth\"\n and exc.code in {\"xai_refresh_failed\", \"xai_auth_missing_refresh_token\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_codex_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Codex OAuth refresh token cannot succeed.\n\n ``codex_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``codex_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"openai-codex\"\n and exc.code in {\n \"codex_refresh_failed\",\n \"codex_auth_missing_refresh_token\",\n \"invalid_grant\",\n \"invalid_token\",\n \"refresh_token_reused\",\n }\n and bool(exc.relogin_required)\n )\n\n\ndef _quarantine_nous_oauth_state(\n state: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> None:\n \"\"\"Keep routing metadata but remove dead OAuth material so it is not replayed.\"\"\"\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"expires_at\",\n \"expires_in\",\n \"obtained_at\",\n \"agent_key\",\n \"agent_key_id\",\n \"agent_key_expires_at\",\n \"agent_key_expires_in\",\n \"agent_key_reused\",\n \"agent_key_obtained_at\",\n ):\n state.pop(key, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"nous\",\n \"code\": error.code,\n \"message\": str(error),\n \"reason\": reason,\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _clear_shared_nous_state(reason)\n invalidate_nous_auth_status_cache()\n\n\ndef _quarantine_nous_pool_entries(\n auth_store: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> bool:\n \"\"\"Remove singleton-seeded Nous pool entries that contain dead OAuth state.\"\"\"\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return False\n entries = pool.get(\"nous\")\n if not isinstance(entries, list):\n return False\n\n retained = []\n removed = False\n singleton_sources = {NOUS_DEVICE_CODE_SOURCE, f\"manual:{NOUS_DEVICE_CODE_SOURCE}\"}\n for entry in entries:\n if isinstance(entry, dict) and entry.get(\"source\") in singleton_sources:\n removed = True\n continue\n retained.append(entry)\n\n if removed:\n pool[\"nous\"] = retained\n _oauth_trace(\n \"nous_pool_device_code_quarantined\",\n reason=reason,\n error_code=error.code,\n )\n return removed\n\n\ndef _try_import_shared_nous_state(\n *,\n timeout_seconds: float = 15.0,\n) -> Optional[Dict[str, Any]]:\n \"\"\"Attempt to rehydrate Nous OAuth state from the shared store.\n\n Reads the shared file (if present), runs a forced refresh using the\n stored refresh_token to produce a fresh inference JWT scoped to this\n profile, and returns the full auth_state dict ready\n for ``persist_nous_credentials()``.\n\n Returns ``None`` when no shared state is available or the rehydrate\n fails for any reason (expired refresh_token, portal unreachable,\n etc.) — caller should then fall through to the normal device-code\n flow.\n \"\"\"\n try:\n with _nous_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n shared = _read_shared_nous_state()\n if not shared:\n return None\n\n # Build a full state dict so refresh_nous_oauth_from_state has every\n # field it needs. force_refresh=True gets us a fresh access_token\n # for this profile.\n state: Dict[str, Any] = {\n \"access_token\": shared.get(\"access_token\"),\n \"refresh_token\": shared.get(\"refresh_token\"),\n \"client_id\": shared.get(\"client_id\") or DEFAULT_NOUS_CLIENT_ID,\n \"portal_base_url\": shared.get(\"portal_base_url\") or DEFAULT_NOUS_PORTAL_URL,\n \"inference_base_url\": shared.get(\"inference_base_url\") or DEFAULT_NOUS_INFERENCE_URL,\n \"token_type\": shared.get(\"token_type\") or \"Bearer\",\n \"scope\": shared.get(\"scope\") or DEFAULT_NOUS_SCOPE,\n \"obtained_at\": shared.get(\"obtained_at\"),\n \"expires_at\": shared.get(\"expires_at\"),\n \"agent_key\": None,\n \"agent_key_expires_at\": None,\n \"tls\": {\"insecure\": False, \"ca_bundle\": None},\n }\n\n def _persist_shared_refresh(updated_state: Dict[str, Any], _reason: str) -> None:\n _write_shared_nous_state(updated_state)\n\n refreshed = refresh_nous_oauth_from_state(\n state,\n timeout_seconds=timeout_seconds,\n force_refresh=True,\n on_state_update=_persist_shared_refresh,\n )\n _write_shared_nous_state(refreshed)\n except AuthError as exc:\n _oauth_trace(\n \"nous_shared_import_failed\",\n error_type=type(exc).__name__,\n error_code=getattr(exc, \"code\", None),\n )\n if _is_terminal_nous_refresh_error(exc):\n _clear_shared_nous_state(\"shared_import_terminal_refresh_failure\")\n logger.debug(\"Shared Nous import failed: %s\", exc)\n return None\n except Exception as exc:\n _oauth_trace(\n \"nous_shared_import_failed\",\n error_type=type(exc).__name__,\n )\n logger.debug(\"Shared Nous import failed: %s\", exc)\n return None\n\n return refreshed\n\n\ndef _refresh_access_token(\n *,\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n refresh_token: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n headers={\"x-nous-refresh-token\": refresh_token},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": client_id,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise AuthError(\"Refresh response missing access_token\",\n provider=\"nous\", code=\"invalid_token\", relogin_required=True)\n return payload\n\n try:\n error_payload = response.json()\n except Exception as exc:\n raise AuthError(\"Refresh token exchange failed\",\n provider=\"nous\", relogin_required=True) from exc\n\n code = str(error_payload.get(\"error\", \"invalid_grant\"))\n description = str(error_payload.get(\"error_description\") or \"Refresh token exchange failed\")\n relogin = code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n\n # Detect the OAuth 2.1 \"refresh token reuse\" signal from the Nous portal\n # server and surface an actionable message. This fires when an external\n # process (health-check script, monitoring tool, custom self-heal hook)\n # called POST /api/oauth/token with Arcen's refresh_token without\n # persisting the rotated token back to auth.json — the server then\n # retires the original RT, Arcen's next refresh uses it, and the whole\n # session chain gets revoked as a token-theft signal (#15099).\n lowered = description.lower()\n if code == \"refresh_token_reused\" or \"reuse\" in lowered or \"reuse detected\" in lowered:\n description = (\n \"Nous Portal detected refresh-token reuse and revoked this session.\\n\"\n \"This usually means an external process (monitoring script, \"\n \"custom self-heal hook, or another Arcen install sharing \"\n \"~/.arcen/auth.json) called POST /api/oauth/token with Arcen's \"\n \"refresh token without persisting the rotated token back.\\n\"\n \"Nous refresh tokens are single-use — only Arcen may call the \"\n \"refresh endpoint. For health checks, use `arcen auth status` \"\n \"instead.\\n\"\n \"Re-authenticate with: arcen auth add nous\"\n )\n relogin = True\n\n raise AuthError(description, provider=\"nous\", code=code, relogin_required=relogin)\n\n\ndef fetch_nous_models(\n *,\n inference_base_url: str,\n api_key: str,\n timeout_seconds: float = 15.0,\n verify: bool | str = True,\n) -> List[str]:\n \"\"\"Fetch available model IDs from the Nous inference API.\"\"\"\n timeout = httpx.Timeout(timeout_seconds)\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n response = client.get(\n f\"{inference_base_url.rstrip('/')}/models\",\n headers={\"Authorization\": f\"Bearer {api_key}\"},\n )\n\n if response.status_code != 200:\n description = f\"/models request failed with status {response.status_code}\"\n try:\n err = response.json()\n description = str(err.get(\"error_description\") or err.get(\"error\") or description)\n except Exception as e:\n logger.debug(\"Could not parse error response JSON: %s\", e)\n raise AuthError(description, provider=\"nous\", code=\"models_fetch_failed\")\n\n payload = response.json()\n data = payload.get(\"data\")\n if not isinstance(data, list):\n return []\n\n model_ids: List[str] = []\n for item in data:\n if not isinstance(item, dict):\n continue\n model_id = item.get(\"id\")\n if isinstance(model_id, str) and model_id.strip():\n mid = model_id.strip()\n # Skip Arcen models — they're not reliable for agentic tool-calling\n if \"arcen\" in mid.lower():\n continue\n model_ids.append(mid)\n\n # Sort: prefer opus > pro > haiku/flash > sonnet (sonnet is cheap/fast,\n # users who want the best model should see opus first).\n def _model_priority(mid: str) -> tuple:\n low = mid.lower()\n if \"opus\" in low:\n return (0, mid)\n if \"pro\" in low and \"sonnet\" not in low:\n return (1, mid)\n if \"sonnet\" in low:\n return (3, mid)\n return (2, mid)\n\n model_ids.sort(key=_model_priority)\n return list(dict.fromkeys(model_ids))\n\n\ndef _agent_key_is_usable(state: Dict[str, Any], min_ttl_seconds: int) -> bool:\n key = state.get(\"agent_key\")\n if not isinstance(key, str) or not key.strip():\n return False\n return _nous_invoke_jwt_is_usable(\n key,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"agent_key_expires_at\"),\n min_ttl_seconds=max(0, int(min_ttl_seconds)),\n )\n\n\ndef resolve_nous_access_token(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n refresh_skew_seconds: int = ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> str:\n \"\"\"Resolve a refresh-aware Nous Portal access token for managed tool gateways.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"nous\")\n\n if not state:\n raise AuthError(\n \"Arcen is not logged into Nous Portal.\",\n provider=\"nous\",\n relogin_required=True,\n )\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"NOUS_PORTAL_BASE_URL\")\n or DEFAULT_NOUS_PORTAL_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_NOUS_CLIENT_ID)\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n\n with _nous_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n merged_shared = _merge_shared_nous_oauth_state(state)\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\n \"No access token found for Nous Portal login.\",\n provider=\"nous\",\n relogin_required=True,\n )\n\n if not _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds):\n if merged_shared:\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n return access_token\n\n if not isinstance(refresh_token, str) or not refresh_token:\n raise AuthError(\n \"Session expired and no refresh token is available.\",\n provider=\"nous\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n with httpx.Client(\n timeout=timeout,\n headers={\"Accept\": \"application/json\"},\n verify=verify,\n ) as client:\n try:\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_nous_refresh_error(exc):\n _quarantine_nous_oauth_state(\n state,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _quarantine_nous_pool_entries(\n auth_store,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n raise\n\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl,\n tz=timezone.utc,\n ).isoformat()\n state[\"portal_base_url\"] = portal_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n _write_shared_nous_state(state)\n return state[\"access_token\"]\n\n\ndef refresh_nous_oauth_pure(\n access_token: str,\n refresh_token: str,\n client_id: str,\n portal_base_url: str,\n inference_base_url: str,\n *,\n token_type: str = \"Bearer\",\n scope: str = DEFAULT_NOUS_SCOPE,\n obtained_at: Optional[str] = None,\n expires_at: Optional[str] = None,\n agent_key: Optional[str] = None,\n agent_key_expires_at: Optional[str] = None,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Nous OAuth state without mutating auth.json directly.\n\n ``on_state_update`` is called after a successful access-token refresh.\n Callers that own persistent state can use it to save the newly rotated\n refresh token before later validation can fail.\n \"\"\"\n state: Dict[str, Any] = {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"client_id\": client_id or DEFAULT_NOUS_CLIENT_ID,\n \"portal_base_url\": (portal_base_url or DEFAULT_NOUS_PORTAL_URL).rstrip(\"/\"),\n \"inference_base_url\": (inference_base_url or DEFAULT_NOUS_INFERENCE_URL).rstrip(\"/\"),\n \"token_type\": token_type or \"Bearer\",\n \"scope\": scope or DEFAULT_NOUS_SCOPE,\n \"obtained_at\": obtained_at,\n \"expires_at\": expires_at,\n \"agent_key\": agent_key,\n \"agent_key_expires_at\": agent_key_expires_at,\n \"tls\": {\n \"insecure\": bool(insecure),\n \"ca_bundle\": ca_bundle,\n },\n }\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n current_invoke_jwt_status = _nous_invoke_jwt_status(\n state.get(\"access_token\"),\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or current_invoke_jwt_status is not None:\n refresh_token_value = state.get(\"refresh_token\")\n if not isinstance(refresh_token_value, str) or not refresh_token_value:\n if current_invoke_jwt_status is not None:\n raise AuthError(\n \"Nous Portal access token is not a usable inference JWT \"\n f\"({current_invoke_jwt_status}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add nous\",\n provider=\"nous\",\n code=current_invoke_jwt_status,\n relogin_required=True,\n )\n raise AuthError(\n \"No refresh token is available for Nous Portal.\",\n provider=\"nous\",\n relogin_required=True,\n )\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=state[\"portal_base_url\"],\n client_id=state[\"client_id\"],\n refresh_token=refresh_token_value,\n )\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token_value\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_nous_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n state[\"inference_base_url\"] = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n if on_state_update is not None:\n on_state_update(dict(state), \"post_refresh_access_token\")\n\n _assert_nous_inference_jwt_usable(state)\n _select_nous_invoke_jwt(state)\n\n return state\n\n\ndef refresh_nous_oauth_from_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 15.0,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Nous OAuth from a state dict. Thin wrapper around refresh_nous_oauth_pure.\"\"\"\n tls = state.get(\"tls\") or {}\n return refresh_nous_oauth_pure(\n state.get(\"access_token\", \"\"),\n state.get(\"refresh_token\", \"\"),\n state.get(\"client_id\", \"arcen-cli\"),\n state.get(\"portal_base_url\", DEFAULT_NOUS_PORTAL_URL),\n state.get(\"inference_base_url\", DEFAULT_NOUS_INFERENCE_URL),\n token_type=state.get(\"token_type\", \"Bearer\"),\n scope=state.get(\"scope\", DEFAULT_NOUS_SCOPE),\n obtained_at=state.get(\"obtained_at\"),\n expires_at=state.get(\"expires_at\"),\n agent_key=state.get(\"agent_key\"),\n agent_key_expires_at=state.get(\"agent_key_expires_at\"),\n timeout_seconds=timeout_seconds,\n insecure=tls.get(\"insecure\"),\n ca_bundle=tls.get(\"ca_bundle\"),\n force_refresh=force_refresh,\n on_state_update=on_state_update,\n )\n\n\ndef persist_nous_credentials(\n creds: Dict[str, Any],\n *,\n label: Optional[str] = None,\n):\n \"\"\"Persist Nous OAuth credentials as the singleton provider state\n and ensure the credential pool is in sync.\n\n Nous credentials are read at runtime from two independent locations:\n\n - ``providers.nous``: singleton state read by\n ``resolve_nous_runtime_credentials()`` during 401 recovery and by\n ``_seed_from_singletons()`` during pool load.\n - ``credential_pool.nous``: used by the runtime ``pool.select()`` path.\n\n Historically ``arcen auth add nous`` wrote a ``manual:device_code`` pool\n entry only, skipping ``providers.nous``. When the runtime credential\n expired, the recovery path read the empty singleton state and raised\n ``AuthError`` silently (``logger.debug`` at INFO level).\n\n This helper writes ``providers.nous`` then calls ``load_pool(\"nous\")`` so\n ``_seed_from_singletons`` materialises the canonical ``device_code`` pool\n entry from the singleton. Re-running login upserts the same entry in\n place; the pool never accumulates duplicate device_code rows.\n\n ``label`` is an optional user-chosen display name (from\n ``arcen auth add nous --label <name>``). It gets embedded in the\n singleton state so that ``_seed_from_singletons`` uses it as the pool\n entry's label on every subsequent ``load_pool(\"nous\")`` instead of the\n auto-derived token fingerprint. When ``None``, the auto-derived label\n via ``label_from_token`` is used (unchanged default behaviour).\n\n Returns the upserted :class:`PooledCredential` entry (or ``None`` if\n seeding somehow produced no match — shouldn't happen).\n \"\"\"\n from agent.credential_pool import load_pool\n\n state = dict(creds)\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n\n # Mirror to the shared store so a new profile can one-tap import\n # these credentials via `arcen auth add nous --type oauth`. Best-\n # effort: any I/O failure is logged and swallowed (the per-profile\n # auth.json is still the source of truth).\n _write_shared_nous_state(state)\n\n pool = load_pool(\"nous\")\n return next(\n (e for e in pool.entries() if e.source == NOUS_DEVICE_CODE_SOURCE),\n None,\n )\n\n\ndef _sync_nous_pool_from_auth_store() -> None:\n \"\"\"Best-effort pool reseed after providers.nous changes; never fail login.\"\"\"\n try:\n from agent.credential_pool import load_pool\n\n load_pool(\"nous\")\n except Exception as exc:\n logger.debug(\"Failed to sync Nous credential pool from auth store: %s\", exc)\n\n\ndef resolve_nous_runtime_credentials(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"\n Resolve Nous inference credentials for runtime use.\n\n Ensures access_token is a valid inference-scoped JWT, refreshing it when\n needed. Concurrent processes coordinate through the auth store file lock.\n\n Returns dict with: provider, base_url, api_key, key_id, expires_at,\n expires_in, source (\"invoke_jwt\"), and auth_path.\n \"\"\"\n sequence_id = uuid.uuid4().hex[:12]\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"nous\")\n\n if not state:\n raise AuthError(\"Arcen is not logged into Nous Portal.\",\n provider=\"nous\", relogin_required=True)\n\n persisted_state = dict(state)\n state_persisted = False\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"NOUS_PORTAL_BASE_URL\")\n or DEFAULT_NOUS_PORTAL_URL\n ).rstrip(\"/\")\n inference_base_url = (\n _optional_base_url(state.get(\"inference_base_url\"))\n or os.getenv(\"NOUS_INFERENCE_BASE_URL\")\n or DEFAULT_NOUS_INFERENCE_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_NOUS_CLIENT_ID)\n\n def _persist_state(reason: str) -> None:\n nonlocal persisted_state, state_persisted\n # Skip writes where only derived TTL countdowns changed; this keeps\n # the mtime-keyed Nous auth-status cache warm during read paths.\n if (\n _nous_effective_provider_state(state)\n == _nous_effective_provider_state(persisted_state)\n ):\n _oauth_trace(\n \"nous_state_persist_skipped\",\n sequence_id=sequence_id,\n reason=reason,\n )\n return\n try:\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n except Exception as exc:\n _oauth_trace(\n \"nous_state_persist_failed\",\n sequence_id=sequence_id,\n reason=reason,\n error_type=type(exc).__name__,\n )\n raise\n _oauth_trace(\n \"nous_state_persisted\",\n sequence_id=sequence_id,\n reason=reason,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n access_token_fp=_token_fingerprint(state.get(\"access_token\")),\n )\n persisted_state = dict(state)\n state_persisted = True\n # Mirror post-refresh state to the shared store so sibling\n # profiles don't hold stale refresh_tokens after rotation.\n # Best-effort — any failure is logged and swallowed inside\n # _write_shared_nous_state.\n _write_shared_nous_state(state)\n\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n _oauth_trace(\n \"nous_runtime_credentials_start\",\n sequence_id=sequence_id,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n )\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\"No access token found for Nous Portal login.\",\n provider=\"nous\", relogin_required=True)\n\n invoke_jwt_status = _nous_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or invoke_jwt_status is not None:\n with _nous_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n if _merge_shared_nous_oauth_state(state):\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n invoke_jwt_status = _nous_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n _persist_state(\"post_shared_merge_access_unusable\")\n\n if force_refresh or invoke_jwt_status is not None:\n if not isinstance(refresh_token, str) or not refresh_token:\n reason = invoke_jwt_status or \"force_refresh\"\n raise AuthError(\n \"Nous Portal access token is not a usable inference JWT \"\n f\"({reason}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add nous\",\n provider=\"nous\",\n code=reason,\n relogin_required=True,\n )\n\n refresh_reason = \"force_refresh\" if force_refresh else (invoke_jwt_status or \"access_unusable\")\n _oauth_trace(\n \"refresh_start\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n try:\n refreshed = _refresh_access_token(\n client=client, portal_base_url=portal_base_url,\n client_id=client_id, refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_nous_refresh_error(exc):\n _quarantine_nous_oauth_state(\n state,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _quarantine_nous_pool_entries(\n auth_store,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _persist_state(\"terminal_runtime_access_refresh_failure\")\n raise\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n previous_refresh_token = refresh_token\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_nous_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n inference_base_url = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n access_token = state[\"access_token\"]\n refresh_token = state[\"refresh_token\"]\n _oauth_trace(\n \"refresh_success\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n previous_refresh_token_fp=_token_fingerprint(previous_refresh_token),\n new_refresh_token_fp=_token_fingerprint(refresh_token),\n )\n # Persist immediately so validation failures cannot drop rotated refresh tokens.\n _persist_state(\"post_refresh_access_token\")\n\n _assert_nous_inference_jwt_usable(\n state,\n access_token=access_token,\n )\n _select_nous_invoke_jwt(\n state,\n access_token=access_token,\n sequence_id=sequence_id,\n )\n\n # Persist routing and TLS metadata for non-interactive refresh.\n state[\"portal_base_url\"] = portal_base_url\n state[\"inference_base_url\"] = inference_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n\n _persist_state(\"resolve_nous_runtime_credentials_final\")\n\n if state_persisted:\n _sync_nous_pool_from_auth_store()\n\n api_key = state.get(\"agent_key\")\n if not isinstance(api_key, str) or not api_key:\n raise AuthError(\"Failed to resolve a Nous inference API key\",\n provider=\"nous\", code=\"server_error\")\n\n expires_at = state.get(\"agent_key_expires_at\")\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"agent_key_expires_in\"))\n )\n\n return {\n \"provider\": \"nous\",\n \"base_url\": inference_base_url,\n \"api_key\": api_key,\n \"key_id\": state.get(\"agent_key_id\"),\n \"expires_at\": expires_at,\n \"expires_in\": expires_in,\n \"source\": NOUS_AUTH_PATH_INVOKE_JWT,\n \"auth_path\": NOUS_AUTH_PATH_INVOKE_JWT,\n }\n\n\n# =============================================================================\n# Status helpers\n# =============================================================================\n\ndef _empty_nous_auth_status() -> Dict[str, Any]:\n return {\n \"logged_in\": False,\n \"portal_base_url\": None,\n \"inference_base_url\": None,\n \"access_expires_at\": None,\n \"agent_key_expires_at\": None,\n \"has_refresh_token\": False,\n \"inference_credential_present\": False,\n \"credential_source\": None,\n }\n\n\ndef _snapshot_nous_pool_status() -> Dict[str, Any]:\n \"\"\"Best-effort status from the credential pool.\n\n This is a fallback only. The auth-store provider state is the runtime source\n of truth because it is what ``resolve_nous_runtime_credentials()`` refreshes.\n \"\"\"\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"nous\")\n if not pool or not pool.has_credentials():\n return _empty_nous_auth_status()\n\n entries = list(pool.entries())\n if not entries:\n return _empty_nous_auth_status()\n\n def _entry_sort_key(entry: Any) -> tuple[float, float, int]:\n agent_exp = _parse_iso_timestamp(getattr(entry, \"agent_key_expires_at\", None)) or 0.0\n access_exp = _parse_iso_timestamp(getattr(entry, \"expires_at\", None)) or 0.0\n priority = int(getattr(entry, \"priority\", 0) or 0)\n return (agent_exp, access_exp, -priority)\n\n entry = max(entries, key=_entry_sort_key)\n runtime_key = getattr(entry, \"runtime_api_key\", None)\n if not runtime_key:\n return _empty_nous_auth_status()\n access_token = getattr(entry, \"access_token\", None)\n auth_type = str(getattr(entry, \"auth_type\", \"\") or \"\").strip().lower()\n refresh_token = getattr(entry, \"refresh_token\", None)\n is_portal_oauth = bool(access_token) and (\n auth_type.startswith(\"oauth\") or bool(refresh_token)\n )\n label = getattr(entry, \"label\", \"unknown\")\n portal_status_url = None\n if is_portal_oauth:\n portal_status_url = (\n getattr(entry, \"portal_base_url\", None)\n or DEFAULT_NOUS_PORTAL_URL\n )\n\n return {\n \"logged_in\": is_portal_oauth,\n \"portal_base_url\": portal_status_url,\n \"inference_base_url\": getattr(entry, \"inference_base_url\", None)\n or getattr(entry, \"runtime_base_url\", None)\n or getattr(entry, \"base_url\", None),\n \"access_token\": access_token if is_portal_oauth else None,\n \"access_expires_at\": getattr(entry, \"expires_at\", None),\n \"agent_key_expires_at\": getattr(entry, \"agent_key_expires_at\", None),\n \"has_refresh_token\": bool(refresh_token),\n \"inference_credential_present\": True,\n \"credential_source\": f\"pool:{label}\",\n \"source\": f\"pool:{label}\",\n }\n except Exception:\n return _empty_nous_auth_status()\n\n\n# ── Process-level memo for get_nous_auth_status() ──\n# get_nous_auth_status() validates state by calling resolve_nous_runtime_credentials(),\n# which does a synchronous OAuth refresh POST to portal.nousresearch.com. That can take\n# ~350ms even on the failure path, and read-only UI surfaces (`arcen tools`, status panels,\n# subscription-feature checks) call it many times per render — `arcen tools` → \"All Platforms\"\n# was firing the refresh ~31× during one menu paint, racking up >13s of HTTP and burning\n# single-use refresh tokens. Cache the snapshot for a few seconds, keyed on the auth.json\n# mtime so that `arcen auth login/logout/add/remove` invalidate naturally on the next call.\n_NOUS_AUTH_STATUS_CACHE_TTL = 15.0 # seconds\n_nous_auth_status_cache: Optional[Tuple[float, Optional[float], Dict[str, Any]]] = None\n\n\ndef _auth_file_mtime() -> Optional[float]:\n try:\n return _auth_file_path().stat().st_mtime\n except FileNotFoundError:\n return None\n except Exception:\n return None\n\n\ndef invalidate_nous_auth_status_cache() -> None:\n \"\"\"Clear the get_nous_auth_status() process-level memo.\n\n Call this from any code path that mutates Nous auth state without going\n through resolve_nous_runtime_credentials() (e.g. tests). Login/logout\n flows touch auth.json, so the mtime check below invalidates them\n automatically — explicit invalidation is the belt-and-braces option.\n \"\"\"\n global _nous_auth_status_cache\n _nous_auth_status_cache = None\n\n\ndef get_nous_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Nous auth.\n\n Prefer the auth-store provider state, because that is the live source of\n truth for refresh operations. When provider state exists, validate it\n by resolving runtime credentials so revoked refresh sessions do not show up\n as a healthy login. If provider state is absent, fall back to the credential\n pool for the just-logged-in / not-yet-promoted case.\n\n The returned snapshot is memoised for ~15s keyed on the auth.json mtime,\n so menu/status surfaces that ask repeatedly don't trigger one refresh POST\n per call. Login/logout flows write to auth.json and therefore invalidate\n the cache automatically; tests can also call\n ``invalidate_nous_auth_status_cache()`` explicitly.\n \"\"\"\n global _nous_auth_status_cache\n now = time.monotonic()\n mtime = _auth_file_mtime()\n cached = _nous_auth_status_cache\n if cached is not None:\n cached_at, cached_mtime, cached_status = cached\n if (\n cached_mtime == mtime\n and (now - cached_at) < _NOUS_AUTH_STATUS_CACHE_TTL\n ):\n return dict(cached_status)\n\n status = _compute_nous_auth_status()\n _nous_auth_status_cache = (now, mtime, dict(status))\n return status\n\n\ndef _compute_nous_auth_status() -> Dict[str, Any]:\n \"\"\"Uncached implementation of get_nous_auth_status(). See that function.\"\"\"\n state = get_provider_auth_state(\"nous\")\n if state:\n base_status = {\n \"logged_in\": bool(state.get(\"access_token\")),\n \"portal_base_url\": state.get(\"portal_base_url\"),\n \"inference_base_url\": state.get(\"inference_base_url\"),\n \"access_expires_at\": state.get(\"expires_at\"),\n \"agent_key_expires_at\": state.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(state.get(\"refresh_token\")),\n \"access_token\": state.get(\"access_token\"),\n \"inference_credential_present\": bool(\n state.get(\"access_token\") or state.get(\"agent_key\")\n ),\n \"credential_source\": \"auth_store\",\n \"source\": \"auth_store\",\n }\n try:\n creds = resolve_nous_runtime_credentials()\n refreshed_state = get_provider_auth_state(\"nous\") or state\n base_status.update(\n {\n \"logged_in\": True,\n \"portal_base_url\": refreshed_state.get(\"portal_base_url\") or base_status.get(\"portal_base_url\"),\n \"inference_base_url\": creds.get(\"base_url\")\n or refreshed_state.get(\"inference_base_url\")\n or base_status.get(\"inference_base_url\"),\n \"access_expires_at\": refreshed_state.get(\"expires_at\") or base_status.get(\"access_expires_at\"),\n \"agent_key_expires_at\": creds.get(\"expires_at\")\n or refreshed_state.get(\"agent_key_expires_at\")\n or base_status.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(refreshed_state.get(\"refresh_token\")),\n \"inference_credential_present\": True,\n \"credential_source\": \"auth_store\",\n \"source\": f\"runtime:{creds.get('source', 'portal')}\",\n \"key_id\": creds.get(\"key_id\"),\n }\n )\n return base_status\n except AuthError as exc:\n base_status.update({\n \"logged_in\": False,\n \"error\": str(exc),\n \"relogin_required\": bool(getattr(exc, \"relogin_required\", False)),\n \"error_code\": getattr(exc, \"code\", None),\n })\n return base_status\n\n return _snapshot_nous_pool_status()\n\n\ndef get_codex_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Codex auth.\n \n Checks the credential pool first (where `arcen auth` stores credentials),\n then falls back to the legacy provider state.\n \"\"\"\n # Check credential pool first — this is where `arcen auth` and\n # `arcen model` store device_code tokens.\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(\"openai-codex\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _codex_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"chatgpt\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n # Fall back to legacy provider state\n try:\n creds = resolve_codex_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_xai_oauth_auth_status() -> Dict[str, Any]:\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"xai-oauth\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _xai_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"oauth_pkce\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n try:\n creds = resolve_xai_oauth_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_api_key_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for API-key providers (z.ai, Kimi, MiniMax).\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n return {\"configured\": False}\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"configured\": bool(api_key),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"key_source\": key_source,\n \"base_url\": base_url,\n \"logged_in\": bool(api_key), # compat with OAuth status shape\n }\n\n\ndef get_external_process_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for providers that run a local subprocess.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n return {\"configured\": False}\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n resolved_command = shutil.which(command) if command else None\n return {\n \"configured\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"command\": command,\n \"args\": args,\n \"resolved_command\": resolved_command,\n \"base_url\": base_url,\n \"logged_in\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n }\n\n\ndef get_auth_status(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Generic auth status dispatcher.\"\"\"\n target = (provider_id or get_active_provider() or \"\").strip().lower()\n if not target:\n return {\"logged_in\": False}\n if target == \"spotify\":\n return get_spotify_auth_status()\n if target == \"nous\":\n return get_nous_auth_status()\n if target == \"openai-codex\":\n return get_codex_auth_status()\n if target == \"xai-oauth\":\n return get_xai_oauth_auth_status()\n if target == \"qwen-oauth\":\n return get_qwen_auth_status()\n if target == \"google-gemini-cli\":\n return get_gemini_oauth_auth_status()\n if target == \"minimax-oauth\":\n return get_minimax_oauth_auth_status()\n if target == \"copilot-acp\":\n return get_external_process_provider_status(target)\n if target == \"azure-foundry\":\n return _get_azure_foundry_auth_status()\n # API-key providers\n pconfig = PROVIDER_REGISTRY.get(target)\n if pconfig and pconfig.auth_type == \"api_key\":\n return get_api_key_provider_status(target)\n # AWS SDK providers (Bedrock) — check via boto3 credential chain\n if pconfig and pconfig.auth_type == \"aws_sdk\":\n try:\n from agent.bedrock_adapter import has_aws_credentials\n return {\"logged_in\": has_aws_credentials(), \"provider\": target}\n except ImportError:\n return {\"logged_in\": False, \"provider\": target, \"error\": \"boto3 not installed\"}\n return {\"logged_in\": False}\n\n\ndef _get_azure_foundry_auth_status() -> Dict[str, Any]:\n \"\"\"Return structural auth status for Azure Foundry.\n\n ``logged_in`` is structural, matching other non-OAuth provider status\n checks:\n\n * ``auth_mode == \"entra_id\"`` AND ``azure-identity`` is importable\n (we do NOT mint a token here; ``arcen doctor`` runs the live\n probe and reports whether the credential chain can acquire one).\n * ``auth_mode == \"api_key\"`` (default) AND ``AZURE_FOUNDRY_API_KEY``\n is set with a usable value.\n\n Never invokes the Entra credential chain — keeps CLI startup latency\n flat regardless of token-service / az login state.\n \"\"\"\n info: Dict[str, Any] = {\"provider\": \"azure-foundry\"}\n try:\n from arcen_cli.config import load_config, get_env_value\n cfg = load_config()\n except Exception:\n cfg = {}\n\n model_cfg = cfg.get(\"model\") if isinstance(cfg, dict) else None\n auth_mode = \"api_key\"\n base_url = \"\"\n if isinstance(model_cfg, dict):\n auth_mode = str(model_cfg.get(\"auth_mode\") or \"api_key\").strip().lower() or \"api_key\"\n base_url = str(model_cfg.get(\"base_url\") or \"\").strip()\n info[\"auth_mode\"] = auth_mode\n info[\"base_url\"] = base_url\n\n if auth_mode == \"entra_id\":\n try:\n from agent.azure_identity_adapter import (\n EntraIdentityConfig,\n SCOPE_AI_AZURE_DEFAULT,\n has_azure_identity_installed,\n )\n installed = has_azure_identity_installed()\n entra_cfg = {}\n if isinstance(model_cfg, dict) and isinstance(model_cfg.get(\"entra\"), dict):\n entra_cfg = model_cfg[\"entra\"]\n identity_config = EntraIdentityConfig.from_dict(\n entra_cfg,\n default_scope=SCOPE_AI_AZURE_DEFAULT,\n )\n info[\"azure_identity_installed\"] = installed\n info[\"scope\"] = identity_config.scope\n info[\"credential_probe\"] = \"not_run\"\n info[\"credential_verified\"] = False\n info[\"logged_in\"] = bool(installed)\n if not installed:\n info[\"hint\"] = (\n \"azure-identity not installed. Install with: \"\n \"pip install azure-identity (or rely on Arcen' \"\n \"lazy-install at first use).\"\n )\n else:\n info[\"hint\"] = (\n \"azure-identity is installed; live credential validation \"\n \"is skipped here. Run `arcen doctor` to verify token acquisition.\"\n )\n return info\n except Exception as exc:\n info[\"logged_in\"] = False\n info[\"error\"] = f\"azure-identity check failed: {exc}\"\n return info\n\n # api_key mode (default)\n try:\n api_key = get_env_value(\"AZURE_FOUNDRY_API_KEY\") or os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n except Exception:\n api_key = os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n info[\"logged_in\"] = has_usable_secret(api_key)\n return info\n\n\ndef resolve_api_key_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve API key and base URL for an API-key provider.\n\n Returns dict with: provider, api_key, base_url, source.\n \"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an API-key provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n # No-auth LM Studio: substitute a placeholder so runtime / auxiliary_client\n # see the local server as configured. doctor still reports unconfigured\n # because get_api_key_provider_status uses the raw secret resolver.\n if not api_key and provider_id == \"lmstudio\":\n api_key = LMSTUDIO_NOAUTH_PLACEHOLDER\n key_source = key_source or \"default\"\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif provider_id == \"zai\":\n base_url = _resolve_zai_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url.rstrip(\"/\")\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"provider\": provider_id,\n \"api_key\": api_key,\n \"base_url\": base_url.rstrip(\"/\"),\n \"source\": key_source or \"default\",\n }\n\n\ndef resolve_external_process_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve runtime details for local subprocess-backed providers.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an external-process provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n resolved_command = shutil.which(command) if command else None\n if not resolved_command and not base_url.startswith(\"acp+tcp://\"):\n raise AuthError(\n f\"Could not find the Copilot CLI command '{command}'. \"\n \"Install GitHub Copilot CLI or set ARCEN_COPILOT_ACP_COMMAND/COPILOT_CLI_PATH.\",\n provider=provider_id,\n code=\"missing_copilot_cli\",\n )\n\n return {\n \"provider\": provider_id,\n \"api_key\": \"copilot-acp\",\n \"base_url\": base_url.rstrip(\"/\"),\n \"command\": resolved_command or command,\n \"args\": args,\n \"source\": \"process\",\n }\n\n\n# =============================================================================\n# CLI Commands — login / logout\n# =============================================================================\n\ndef _update_config_for_provider(\n provider_id: str,\n inference_base_url: str,\n default_model: Optional[str] = None,\n) -> Path:\n \"\"\"Update config.yaml and auth.json to reflect the active provider.\n\n When *default_model* is provided the function also writes it as the\n ``model.default`` value. This prevents a race condition where the\n gateway (which re-reads config per-message) picks up the new provider\n before the caller has finished model selection, resulting in a\n mismatched model/provider (e.g. ``anthropic/claude-opus-4.6`` sent to\n MiniMax's API).\n \"\"\"\n # Set active_provider in auth.json so auto-resolution picks this provider\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = provider_id\n _save_auth_store(auth_store)\n\n # Update config.yaml model section\n config_path = get_config_path()\n config_path.parent.mkdir(parents=True, exist_ok=True)\n\n config = read_raw_config()\n\n current_model = config.get(\"model\")\n if isinstance(current_model, dict):\n model_cfg = dict(current_model)\n elif isinstance(current_model, str) and current_model.strip():\n model_cfg = {\"default\": current_model.strip()}\n else:\n model_cfg = {}\n\n model_cfg[\"provider\"] = provider_id\n if inference_base_url and inference_base_url.strip():\n model_cfg[\"base_url\"] = inference_base_url.rstrip(\"/\")\n else:\n # Clear stale base_url to prevent contamination when switching providers\n model_cfg.pop(\"base_url\", None)\n\n # Clear stale api_key/api_mode left over from a previous custom provider.\n # When the user switches from e.g. a MiniMax custom endpoint\n # (api_mode=anthropic_messages, api_key=mxp-...) to a built-in provider\n # (e.g. OpenRouter), the stale api_key/api_mode would override the new\n # provider's credentials and transport choice. Built-in providers that\n # need a specific api_mode (copilot, xai) set it at request-resolution\n # time via `_copilot_runtime_api_mode` / `_detect_api_mode_for_url`, so\n # removing the persisted value here is safe.\n model_cfg.pop(\"api_key\", None)\n model_cfg.pop(\"api_mode\", None)\n\n # When switching to a non-OpenRouter provider, ensure model.default is\n # valid for the new provider. An OpenRouter-formatted name like\n # \"anthropic/claude-opus-4.6\" will fail on direct-API providers.\n if default_model:\n cur_default = model_cfg.get(\"default\", \"\")\n if not cur_default or \"/\" in cur_default:\n model_cfg[\"default\"] = default_model\n\n config[\"model\"] = model_cfg\n\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _get_config_provider() -> Optional[str]:\n \"\"\"Return model.provider from config.yaml, normalized, if present.\"\"\"\n try:\n config = read_raw_config()\n except Exception:\n return None\n if not config:\n return None\n model = config.get(\"model\")\n if not isinstance(model, dict):\n return None\n provider = model.get(\"provider\")\n if not isinstance(provider, str):\n return None\n provider = provider.strip().lower()\n return provider or None\n\n\ndef _config_provider_matches(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when config.yaml currently selects *provider_id*.\"\"\"\n if not provider_id:\n return False\n return _get_config_provider() == provider_id.strip().lower()\n\n\ndef _should_reset_config_provider_on_logout(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when logout should reset the model provider config.\"\"\"\n if not provider_id:\n return False\n normalized = provider_id.strip().lower()\n return normalized in PROVIDER_REGISTRY and _config_provider_matches(normalized)\n\n\ndef _logout_default_provider_from_config() -> Optional[str]:\n \"\"\"Fallback logout target when auth.json has no active provider.\n\n `arcen logout` historically keyed off auth.json.active_provider only.\n That left users stuck when auth state had already been cleared but\n config.yaml still selected an OAuth provider such as openai-codex for the\n agent model: there was no active auth provider to target, so logout printed\n \"No provider is currently logged in\" and never reset model.provider.\n \"\"\"\n provider = _get_config_provider()\n if provider in {\"nous\", \"openai-codex\", \"xai-oauth\"}:\n return provider\n return None\n\n\ndef _reset_config_provider() -> Path:\n \"\"\"Reset config.yaml provider back to auto after logout.\"\"\"\n config_path = get_config_path()\n if not config_path.exists():\n return config_path\n\n config = read_raw_config()\n if not config:\n return config_path\n\n model = config.get(\"model\")\n if isinstance(model, dict):\n model[\"provider\"] = \"auto\"\n if \"base_url\" in model:\n model[\"base_url\"] = OPENROUTER_BASE_URL\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _prompt_model_selection(\n model_ids: List[str],\n current_model: str = \"\",\n pricing: Optional[Dict[str, Dict[str, str]]] = None,\n unavailable_models: Optional[List[str]] = None,\n portal_url: str = \"\",\n unavailable_message: str = \"\",\n) -> Optional[str]:\n \"\"\"Interactive model selection. Puts current_model first with a marker. Returns chosen model ID or None.\n\n If *pricing* is provided (``{model_id: {prompt, completion}}``), a compact\n price indicator is shown next to each model in aligned columns.\n\n If *unavailable_models* is provided, those models are shown grayed out\n and unselectable, with an upgrade link to *portal_url*.\n \"\"\"\n from arcen_cli.models import _format_price_per_mtok\n\n _unavailable = unavailable_models or []\n\n # Reorder: current model first, then the rest (deduplicated)\n ordered = []\n if current_model and current_model in model_ids:\n ordered.append(current_model)\n for mid in model_ids:\n if mid not in ordered:\n ordered.append(mid)\n\n # All models for column-width computation (selectable + unavailable)\n all_models = list(ordered) + list(_unavailable)\n\n # Column-aligned labels when pricing is available\n has_pricing = bool(pricing and any(pricing.get(m) for m in all_models))\n name_col = max((len(m) for m in all_models), default=0) + 2 if has_pricing else 0\n\n # Pre-compute formatted prices and dynamic column widths\n _price_cache: dict[str, tuple[str, str, str]] = {}\n price_col = 3 # minimum width\n cache_col = 0 # only set if any model has cache pricing\n has_cache = False\n if has_pricing:\n for mid in all_models:\n p = pricing.get(mid) # type: ignore[union-attr]\n if p:\n inp = _format_price_per_mtok(p.get(\"prompt\", \"\"))\n out = _format_price_per_mtok(p.get(\"completion\", \"\"))\n cache_read = p.get(\"input_cache_read\", \"\")\n cache = _format_price_per_mtok(cache_read) if cache_read else \"\"\n if cache:\n has_cache = True\n else:\n inp, out, cache = \"\", \"\", \"\"\n _price_cache[mid] = (inp, out, cache)\n price_col = max(price_col, len(inp), len(out))\n cache_col = max(cache_col, len(cache))\n if has_cache:\n cache_col = max(cache_col, 5) # minimum: \"Cache\" header\n\n def _label(mid):\n if has_pricing:\n inp, out, cache = _price_cache.get(mid, (\"\", \"\", \"\"))\n price_part = f\" {inp:>{price_col}} {out:>{price_col}}\"\n if has_cache:\n price_part += f\" {cache:>{cache_col}}\"\n base = f\"{mid:<{name_col}}{price_part}\"\n else:\n base = mid\n if mid == current_model:\n base += \" ← currently in use\"\n return base\n\n # Default cursor on the current model (index 0 if it was reordered to top)\n default_idx = 0\n\n # Build a pricing header hint for the menu title\n menu_title = \"Select default model:\"\n if has_pricing:\n # Align the header with the model column.\n # Each choice is \" {label}\" (2 spaces) and simple_term_menu prepends\n # a 3-char cursor region (\"-> \" or \" \"), so content starts at col 5.\n pad = \" \" * 5\n header = f\"\\n{pad}{'':>{name_col}} {'In':>{price_col}} {'Out':>{price_col}}\"\n if has_cache:\n header += f\" {'Cache':>{cache_col}}\"\n menu_title += header + \" /Mtok\"\n\n # ANSI escape for dim text\n _DIM = \"\\033[2m\"\n _RESET = \"\\033[0m\"\n\n # Try arrow-key menu first, fall back to number input.\n # Uses the shared curses radiolist (ESC/arrow-key handling that works\n # across terminals, incl. those that emit raw escape sequences) instead\n # of simple_term_menu, which conflicts with /dev/tty and left ESC/arrow\n # keys unreliable in the setup model picker.\n try:\n from arcen_cli.curses_ui import curses_radiolist\n\n choices = [_label(mid) for mid in ordered]\n choices.append(\"Enter custom model name\")\n choices.append(\"Skip (keep current)\")\n\n _upgrade_url = (portal_url or DEFAULT_NOUS_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip()\n if not unavailable_footer and _unavailable:\n unavailable_footer = f\"Upgrade at {_upgrade_url} for paid models\"\n\n # The pricing column header (and any unavailable-models block) is shown\n # as a multi-line description above the list so it survives the curses\n # screen clear. menu_title already embeds the aligned price header.\n desc_lines: list[str] = []\n if has_pricing:\n # menu_title is \"Select default model:\\n<pad><header> /Mtok\"\n # Keep only the header portion for the description.\n header_part = menu_title.split(\"\\n\", 1)\n if len(header_part) > 1:\n desc_lines.extend(header_part[1].splitlines())\n if _unavailable:\n for mid in _unavailable:\n desc_lines.append(f\" {_label(mid)}\")\n desc_lines.append(f\" ── {unavailable_footer} ──\")\n description = \"\\n\".join(desc_lines) if desc_lines else None\n\n idx = curses_radiolist(\n \"Select default model:\",\n choices,\n selected=default_idx,\n cancel_returns=-1,\n description=description,\n searchable=True,\n )\n if idx < 0:\n return None\n print()\n if idx < len(ordered):\n return ordered[idx]\n elif idx == len(ordered):\n try:\n custom = input(\"Enter model name: \").strip()\n except (EOFError, KeyboardInterrupt):\n return None\n return custom if custom else None\n return None\n except (ImportError, NotImplementedError, OSError, subprocess.SubprocessError):\n pass\n\n # Fallback: numbered list\n print(menu_title)\n num_width = len(str(len(ordered) + 2))\n for i, mid in enumerate(ordered, 1):\n print(f\" {i:>{num_width}}. {_label(mid)}\")\n n = len(ordered)\n print(f\" {n + 1:>{num_width}}. Enter custom model name\")\n print(f\" {n + 2:>{num_width}}. Skip (keep current)\")\n\n if _unavailable:\n _upgrade_url = (portal_url or DEFAULT_NOUS_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip() or (\n f\"Unavailable models (requires paid tier — upgrade at {_upgrade_url})\"\n )\n print()\n print(f\" {_DIM}── {unavailable_footer} ──{_RESET}\")\n for mid in _unavailable:\n print(f\" {'':>{num_width}} {_DIM}{_label(mid)}{_RESET}\")\n print()\n\n while True:\n try:\n choice = input(f\"Choice [1-{n + 2}] (default: skip): \").strip()\n if not choice:\n return None\n idx = int(choice)\n if 1 <= idx <= n:\n return ordered[idx - 1]\n elif idx == n + 1:\n custom = input(\"Enter model name: \").strip()\n return custom if custom else None\n elif idx == n + 2:\n return None\n print(f\"Please enter 1-{n + 2}\")\n except ValueError:\n print(\"Please enter a number\")\n except (KeyboardInterrupt, EOFError):\n return None\n\n\ndef _save_model_choice(model_id: str) -> None:\n \"\"\"Save the selected model to config.yaml (single source of truth).\n\n The model is stored in config.yaml only — NOT in .env. This avoids\n conflicts in multi-agent setups where env vars would stomp each other.\n \"\"\"\n from arcen_cli.config import save_config, load_config\n\n config = load_config()\n # Always use dict format so provider/base_url can be stored alongside\n if isinstance(config.get(\"model\"), dict):\n config[\"model\"][\"default\"] = model_id\n else:\n config[\"model\"] = {\"default\": model_id}\n save_config(config)\n\n\ndef login_command(args) -> None:\n \"\"\"Deprecated: use 'arcen model' or 'arcen setup' instead.\"\"\"\n print(\"The 'arcen login' command has been removed.\")\n print(\"Use 'arcen auth' to manage credentials,\")\n print(\"'arcen model' to select a provider, or 'arcen setup' for full setup.\")\n raise SystemExit(0)\n\n\ndef _login_openai_codex(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n \"\"\"OpenAI Codex login via device code flow. Tokens stored in ~/.arcen/auth.json.\"\"\"\n\n del args, pconfig # kept for parity with other provider login helpers\n\n # Check for existing Arcen-owned credentials\n if not force_new_login:\n try:\n existing = resolve_codex_runtime_credentials()\n # Verify the resolved token is actually usable (not expired).\n # resolve_codex_runtime_credentials attempts refresh, so if we get\n # here the token should be valid — but double-check before telling\n # the user \"Login successful!\".\n _resolved_key = existing.get(\"api_key\", \"\")\n if isinstance(_resolved_key, str) and _resolved_key and not _codex_access_token_is_expiring(_resolved_key, 60):\n print(\"Existing Codex credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\"openai-codex\", existing.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n else:\n print(\"Existing Codex credentials are expired. Starting fresh login...\")\n except AuthError:\n pass\n\n # Check for existing Codex CLI tokens we can import\n if not force_new_login:\n cli_tokens = _import_codex_cli_tokens()\n if cli_tokens:\n print(\"Found existing Codex CLI credentials at ~/.codex/auth.json\")\n print(\"Arcen will create its own session to avoid conflicts with Codex CLI / VS Code.\")\n try:\n do_import = input(\"Import these credentials? (a separate login is recommended) [y/N]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"n\"\n if do_import in {\"y\", \"yes\"}:\n _save_codex_tokens(cli_tokens)\n base_url = os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_CODEX_BASE_URL\n config_path = _update_config_for_provider(\"openai-codex\", base_url)\n print()\n print(\"Credentials imported. Note: if Codex CLI refreshes its token,\")\n print(\"Arcen will keep working independently with its own session.\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n\n # Run a fresh device code flow — Arcen gets its own OAuth session\n print()\n print(\"Signing in to OpenAI Codex...\")\n print(\"(Arcen creates its own session — won't affect Codex CLI or VS Code)\")\n print()\n\n creds = _codex_device_code_login()\n\n # Save tokens to Arcen auth store\n _save_codex_tokens(creds[\"tokens\"], creds.get(\"last_refresh\"))\n config_path = _update_config_for_provider(\"openai-codex\", creds.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n\n\ndef _login_xai_oauth(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n del pconfig\n\n if not force_new_login:\n try:\n existing = resolve_xai_oauth_runtime_credentials()\n api_key = existing.get(\"api_key\", \"\")\n if isinstance(api_key, str) and api_key and not _xai_access_token_is_expiring(api_key, 60):\n print(\"Existing xAI OAuth credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\n \"xai-oauth\",\n existing.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL),\n )\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n return\n except AuthError:\n pass\n\n print()\n print(\"Signing in to xAI Grok OAuth (SuperGrok / Premium+)...\")\n print(\"(Arcen creates its own local OAuth session)\")\n print()\n\n timeout_seconds = float(getattr(args, \"timeout\", None) or 20.0)\n open_browser = not getattr(args, \"no_browser\", False)\n if _is_remote_session():\n open_browser = False\n manual_paste = bool(getattr(args, \"manual_paste\", False))\n\n creds = _xai_oauth_loopback_login(\n timeout_seconds=timeout_seconds,\n open_browser=open_browser,\n manual_paste=manual_paste,\n )\n _save_xai_oauth_tokens(\n creds[\"tokens\"],\n discovery=creds.get(\"discovery\"),\n redirect_uri=creds.get(\"redirect_uri\", \"\"),\n last_refresh=creds.get(\"last_refresh\"),\n )\n config_path = _update_config_for_provider(\"xai-oauth\", creds.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n\n\ndef _xai_oauth_build_authorize_url(\n *,\n authorization_endpoint: str,\n redirect_uri: str,\n code_challenge: str,\n state: str,\n nonce: str,\n) -> str:\n # `plan=generic` opts the consent screen into xAI's generic OAuth plan\n # tier instead of falling back to the per-account default. Without it,\n # accounts.x.ai rejects loopback OAuth from non-allowlisted clients.\n # `referrer=arcen-agent` lets xAI attribute Arcen-originated logins\n # in their OAuth server logs (we still impersonate the upstream Grok-CLI\n # client_id; this is best-effort attribution until xAI mints us our own).\n authorize_params = {\n \"response_type\": \"code\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"redirect_uri\": redirect_uri,\n \"scope\": XAI_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n \"nonce\": nonce,\n \"plan\": \"generic\",\n \"referrer\": \"arcen-agent\",\n }\n return f\"{authorization_endpoint}?{urlencode(authorize_params)}\"\n\n\ndef _xai_oauth_exchange_code_for_tokens(\n *,\n token_endpoint: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n code_challenge: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"POST the authorization code to xAI's token endpoint and return\n the parsed JSON payload.\n\n Sends ``code_verifier`` as required by RFC 7636 §4.5. Also echoes\n ``code_challenge`` + ``code_challenge_method`` in the request body\n as a defense-in-depth measure for OAuth servers (xAI's among them,\n per #26990) that re-validate the challenge at the token step\n instead of relying solely on server-side session state captured\n during the authorize step. Echoing the challenge is harmless for\n strict RFC-compliant servers — RFC 7636 doesn't forbid additional\n parameters at the token endpoint — and decisively fixes the\n ``code_challenge is required`` failure mode users hit on the\n loopback flow.\n\n Raises :class:`AuthError` on any non-2xx response or transport\n failure; the error message embeds the HTTP status code and the\n full response body so users can disambiguate cause at a glance.\n \"\"\"\n # Paranoia: if upstream call sites ever drop ``code_verifier`` we\n # want to surface a precise, local error rather than send a\n # missing-PKCE request to xAI and receive their generic \"code\n # challenge required\" message back.\n if not code_verifier:\n raise AuthError(\n \"xAI token exchange refused locally: PKCE code_verifier is empty. \"\n \"This is a bug in Arcen — please report at \"\n \"https://github.com/arcenpay/arcen-agent/issues/26990.\",\n provider=\"xai-oauth\",\n code=\"xai_pkce_verifier_missing\",\n )\n\n data = {\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"code_verifier\": code_verifier,\n }\n # Defense-in-depth: include the original ``code_challenge`` and\n # ``code_challenge_method``. Some OAuth servers (including xAI's\n # auth.x.ai implementation, per the symptom reported in #26990)\n # validate these at the token endpoint instead of relying purely on\n # state captured during the authorize step — without them, xAI\n # rejects the exchange with ``code_challenge is required`` even\n # though we sent a valid ``code_verifier``.\n if code_challenge:\n data[\"code_challenge\"] = code_challenge\n data[\"code_challenge_method\"] = \"S256\"\n\n try:\n response = httpx.post(\n token_endpoint,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data=data,\n timeout=max(20.0, timeout_seconds),\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n ) from exc\n\n if response.status_code != 200:\n body = response.text.strip()\n # See ``refresh_xai_oauth_pure`` — token-exchange 403 also\n # surfaces tier/entitlement gating from xAI's backend. Avoid\n # the misleading \"re-authenticate\" hint and point at the API\n # key fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n f\"xAI token exchange failed (HTTP 403).\"\n + (f\" Response: {body}\" if body else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Set ``XAI_API_KEY``\"\n \" and switch to ``provider: xai`` (API-key path) if\"\n \" available, or upgrade your subscription at\"\n \" https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n f\"xAI token exchange failed (HTTP {response.status_code}).\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token exchange response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n return payload\n\n\ndef _xai_oauth_loopback_login(\n *,\n timeout_seconds: float = 20.0,\n open_browser: bool = True,\n manual_paste: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Run the xAI OAuth PKCE flow.\n\n When ``manual_paste=True`` the loopback HTTP listener is skipped\n entirely and the user is prompted to paste the failed callback\n URL into stdin (regression fix for #26923 — browser-only remote\n consoles like GCP Cloud Shell / GitHub Codespaces / EC2 Instance\n Connect, where the laptop's browser can't reach 127.0.0.1 on the\n remote VM). The same PKCE verifier, ``state``, and ``nonce`` are\n used for both paths so the upstream-side OAuth flow is identical.\n \"\"\"\n def _stdin_supports_manual_paste() -> bool:\n try:\n return bool(getattr(sys.stdin, \"isatty\", lambda: False)())\n except Exception:\n return False\n\n discovery = _xai_oauth_discovery(timeout_seconds)\n authorization_endpoint = discovery[\"authorization_endpoint\"]\n token_endpoint = discovery[\"token_endpoint\"]\n\n if manual_paste:\n # No HTTP listener — synthesize a redirect_uri matching what\n # the server would have bound to so the authorize URL the user\n # opens (and the redirect_uri sent in the token exchange) stay\n # byte-identical to the loopback path. xAI's token endpoint\n # cross-checks redirect_uri against the authorize request.\n redirect_uri = (\n f\"http://{XAI_OAUTH_REDIRECT_HOST}:{XAI_OAUTH_REDIRECT_PORT}\"\n f\"{XAI_OAUTH_REDIRECT_PATH}\"\n )\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n callback = _prompt_manual_callback_paste(redirect_uri)\n else:\n server, thread, callback_result, redirect_uri = _xai_start_callback_server()\n try:\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n print()\n print(f\"Waiting for callback on {redirect_uri}\")\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=XAI_OAUTH_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for xAI authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n try:\n callback = _xai_wait_for_callback(\n server,\n thread,\n callback_result,\n timeout_seconds=max(30.0, timeout_seconds * 9),\n )\n except AuthError as exc:\n if (\n getattr(exc, \"code\", \"\") != \"xai_callback_timeout\"\n or not _stdin_supports_manual_paste()\n ):\n raise\n print()\n print(\"xAI loopback callback timed out.\")\n print(\"If your browser reached a failed 127.0.0.1 callback page,\")\n print(\"paste that FULL callback URL below to continue this login.\")\n print(\"You can also re-run with `--manual-paste` to skip the\")\n print(\"loopback listener from the start.\")\n callback = _prompt_manual_callback_paste(redirect_uri)\n if callback.get(\"code\") is None and callback.get(\"error\") is None:\n raise exc\n except Exception:\n try:\n server.shutdown()\n server.server_close()\n except Exception:\n pass\n try:\n thread.join(timeout=1.0)\n except Exception:\n pass\n raise\n\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise AuthError(\n f\"xAI authorization failed: {detail}\",\n provider=\"xai-oauth\",\n code=\"xai_authorization_failed\",\n )\n callback_state = callback.get(\"state\")\n # Manual-paste bare-code path: when a user pastes only the opaque\n # authorization code (no ``code=``/``state=`` query parameters),\n # ``_parse_pasted_callback`` returns ``state=None``. xAI's consent\n # page renders the code in-page rather than redirecting through the\n # 127.0.0.1 callback, so on many remote setups (Cloud Shell, headless\n # VPS, container consoles) the bare code is the only thing the user\n # can obtain. PKCE (code_verifier) still binds the exchange to this\n # client, so the local state-equality check is redundant on the\n # bare-code path — we substitute the locally generated state to keep\n # the rest of the validation chain (and the token exchange) unchanged.\n # See #26923 (AccursedGalaxy comment, 2026-05-20).\n if callback_state is None and manual_paste:\n callback_state = state\n if callback_state != state:\n raise AuthError(\n \"xAI authorization failed: state mismatch.\",\n provider=\"xai-oauth\",\n code=\"xai_state_mismatch\",\n )\n code = str(callback.get(\"code\") or \"\").strip()\n if not code:\n raise AuthError(\n \"xAI authorization failed: missing authorization code.\",\n provider=\"xai-oauth\",\n code=\"xai_code_missing\",\n )\n\n payload = _xai_oauth_exchange_code_for_tokens(\n token_endpoint=token_endpoint,\n code=code,\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n code_challenge=code_challenge,\n timeout_seconds=timeout_seconds,\n )\n access_token = str(payload.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(payload.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI token exchange did not return an access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n if not refresh_token:\n raise AuthError(\n \"xAI token exchange did not return a refresh_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"id_token\": str(payload.get(\"id_token\", \"\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n },\n \"discovery\": discovery,\n \"redirect_uri\": redirect_uri,\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"source\": \"oauth-loopback\",\n }\n\n\ndef _codex_device_code_login() -> Dict[str, Any]:\n \"\"\"Run the OpenAI device code login flow and return credentials dict.\"\"\"\n import time as _time\n\n issuer = \"https://auth.openai.com\"\n client_id = CODEX_OAUTH_CLIENT_ID\n\n # Step 1: Request device code\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/usercode\",\n json={\"client_id\": client_id},\n headers={\"Content-Type\": \"application/json\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Failed to request device code: {exc}\",\n provider=\"openai-codex\", code=\"device_code_request_failed\",\n )\n\n if resp.status_code != 200:\n raise AuthError(\n f\"Device code request returned status {resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_request_error\",\n )\n\n device_data = resp.json()\n user_code = device_data.get(\"user_code\", \"\")\n device_auth_id = device_data.get(\"device_auth_id\", \"\")\n poll_interval = max(3, int(device_data.get(\"interval\", \"5\")))\n\n if not user_code or not device_auth_id:\n raise AuthError(\n \"Device code response missing required fields.\",\n provider=\"openai-codex\", code=\"device_code_incomplete\",\n )\n\n # Step 2: Show user the code\n print(\"To continue, follow these steps:\\n\")\n print(\" 1. Open this URL in your browser:\")\n print(f\" \\033[94m{issuer}/codex/device\\033[0m\\n\")\n print(\" 2. Enter this code:\")\n print(f\" \\033[94m{user_code}\\033[0m\\n\")\n print(\"Waiting for sign-in... (press Ctrl+C to cancel)\")\n\n # Step 3: Poll for authorization code\n max_wait = 15 * 60 # 15 minutes\n start = _time.monotonic()\n code_resp = None\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n while _time.monotonic() - start < max_wait:\n _time.sleep(poll_interval)\n poll_resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/token\",\n json={\"device_auth_id\": device_auth_id, \"user_code\": user_code},\n headers={\"Content-Type\": \"application/json\"},\n )\n\n if poll_resp.status_code == 200:\n code_resp = poll_resp.json()\n break\n elif poll_resp.status_code in {403, 404}:\n continue # User hasn't completed login yet\n else:\n raise AuthError(\n f\"Device auth polling returned status {poll_resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_poll_error\",\n )\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n\n if code_resp is None:\n raise AuthError(\n \"Login timed out after 15 minutes.\",\n provider=\"openai-codex\", code=\"device_code_timeout\",\n )\n\n # Step 4: Exchange authorization code for tokens\n authorization_code = code_resp.get(\"authorization_code\", \"\")\n code_verifier = code_resp.get(\"code_verifier\", \"\")\n redirect_uri = f\"{issuer}/deviceauth/callback\"\n\n if not authorization_code or not code_verifier:\n raise AuthError(\n \"Device auth response missing authorization_code or code_verifier.\",\n provider=\"openai-codex\", code=\"device_code_incomplete_exchange\",\n )\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n token_resp = client.post(\n CODEX_OAUTH_TOKEN_URL,\n data={\n \"grant_type\": \"authorization_code\",\n \"code\": authorization_code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": client_id,\n \"code_verifier\": code_verifier,\n },\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Token exchange failed: {exc}\",\n provider=\"openai-codex\", code=\"token_exchange_failed\",\n )\n\n if token_resp.status_code != 200:\n raise AuthError(\n f\"Token exchange returned status {token_resp.status_code}.\",\n provider=\"openai-codex\", code=\"token_exchange_error\",\n )\n\n tokens = token_resp.json()\n access_token = tokens.get(\"access_token\", \"\")\n refresh_token = tokens.get(\"refresh_token\", \"\")\n\n if not access_token:\n raise AuthError(\n \"Token exchange did not return an access_token.\",\n provider=\"openai-codex\", code=\"token_exchange_no_access_token\",\n )\n\n # Return tokens for the caller to persist (no longer writes to ~/.codex/)\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n },\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"auth_mode\": \"chatgpt\",\n \"source\": \"device-code\",\n }\n\n\n# ==================== MiniMax Portal OAuth ====================\n\ndef _minimax_pkce_pair() -> tuple:\n \"\"\"Generate (code_verifier, code_challenge_S256, state) for MiniMax OAuth.\"\"\"\n import secrets\n verifier = secrets.token_urlsafe(64)[:96]\n challenge = base64.urlsafe_b64encode(\n hashlib.sha256(verifier.encode()).digest()\n ).decode().rstrip(\"=\")\n state = secrets.token_urlsafe(16)\n return verifier, challenge, state\n\n\ndef _minimax_request_user_code(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n code_challenge: str, state: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/oauth/code\",\n data={\n \"response_type\": \"code\",\n \"client_id\": client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n \"x-request-id\": str(uuid.uuid4()),\n },\n )\n if response.status_code != 200:\n raise AuthError(\n f\"MiniMax OAuth authorization failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"authorization_failed\",\n )\n payload = response.json()\n for field in (\"user_code\", \"verification_uri\", \"expired_in\"):\n if field not in payload:\n raise AuthError(\n f\"MiniMax OAuth response missing field: {field}\",\n provider=\"minimax-oauth\", code=\"authorization_incomplete\",\n )\n if payload.get(\"state\") != state:\n raise AuthError(\n \"MiniMax OAuth state mismatch (possible CSRF).\",\n provider=\"minimax-oauth\", code=\"state_mismatch\",\n )\n return payload\n\n\ndef _minimax_expired_in_looks_like_unix_ms(expired_in: int, *, now_ms: int) -> bool:\n \"\"\"True if ``expired_in`` is plausibly a unix-ms absolute time (vs TTL seconds).\"\"\"\n return int(expired_in) > (now_ms // 2)\n\n\ndef _minimax_resolve_token_expiry_unix(expired_in: int, *, now: datetime) -> float:\n \"\"\"Return access-token expiry as unix seconds (MiniMax uses ms epoch or TTL seconds).\"\"\"\n raw = int(expired_in)\n now_ms = int(now.timestamp() * 1000)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n return raw / 1000.0\n return now.timestamp() + max(1, raw)\n\n\ndef _minimax_poll_token(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n user_code: str, code_verifier: str, expired_in: int, interval_ms: Optional[int],\n) -> Dict[str, Any]:\n # OpenClaw treats expired_in as a unix-ms timestamp (Date.now() < expireTimeMs).\n # Defensive parsing: if it's small enough to be a duration, treat as seconds.\n import time as _time\n now_ms = int(_time.time() * 1000)\n raw = int(expired_in)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n deadline = raw / 1000.0\n else:\n deadline = _time.time() + max(1, raw)\n interval = max(2.0, (interval_ms or 2000) / 1000.0)\n\n while _time.time() < deadline:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": MINIMAX_OAUTH_GRANT_TYPE,\n \"client_id\": client_id,\n \"user_code\": user_code,\n \"code_verifier\": code_verifier,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n try:\n payload = response.json() if response.text else {}\n except Exception:\n payload = {}\n\n if response.status_code != 200:\n msg = (payload.get(\"base_resp\", {}) or {}).get(\"status_msg\") or response.text\n raise AuthError(\n f\"MiniMax OAuth error: {msg or 'unknown'}\",\n provider=\"minimax-oauth\", code=\"token_exchange_failed\",\n )\n\n status = payload.get(\"status\")\n if status == \"error\":\n raise AuthError(\n \"MiniMax OAuth reported an error. Please try again later.\",\n provider=\"minimax-oauth\", code=\"authorization_denied\",\n )\n if status == \"success\":\n if not all(payload.get(k) for k in (\"access_token\", \"refresh_token\", \"expired_in\")):\n raise AuthError(\n \"MiniMax OAuth success payload missing required token fields.\",\n provider=\"minimax-oauth\", code=\"token_incomplete\",\n )\n return payload\n # \"pending\" or any other status -> keep polling\n _time.sleep(interval)\n\n raise AuthError(\n \"MiniMax OAuth timed out before authorization completed.\",\n provider=\"minimax-oauth\", code=\"timeout\",\n )\n\n\ndef _minimax_save_auth_state(auth_state: Dict[str, Any]) -> None:\n \"\"\"Persist MiniMax OAuth state to Arcen auth store (~/.arcen/auth.json).\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"minimax-oauth\", auth_state)\n _save_auth_store(auth_store)\n\n\ndef _minimax_oauth_login(\n *, region: str = \"global\", open_browser: bool = True,\n timeout_seconds: float = 15.0,\n) -> Dict[str, Any]:\n \"\"\"Run MiniMax OAuth flow, persist tokens, return auth state dict.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"minimax-oauth\"]\n if region == \"cn\":\n portal_base_url = pconfig.extra[\"cn_portal_base_url\"]\n inference_base_url = pconfig.extra[\"cn_inference_base_url\"]\n else:\n portal_base_url = pconfig.portal_base_url\n inference_base_url = pconfig.inference_base_url\n\n verifier, challenge, state = _minimax_pkce_pair()\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via MiniMax ({region}) OAuth...\")\n print(f\"Portal: {portal_base_url}\")\n\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n headers={\"Accept\": \"application/json\"},\n follow_redirects=True) as client:\n code_data = _minimax_request_user_code(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n code_challenge=challenge, state=state,\n )\n verification_url = str(code_data[\"verification_uri\"])\n user_code = str(code_data[\"user_code\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n if open_browser and _can_open_graphical_browser():\n if webbrowser.open(verification_url):\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically -- use the URL above.\")\n\n interval_raw = code_data.get(\"interval\")\n interval_ms = int(interval_raw) if interval_raw is not None else None\n print(\"Waiting for approval...\")\n\n token_data = _minimax_poll_token(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n user_code=user_code, code_verifier=verifier,\n expired_in=int(code_data[\"expired_in\"]),\n interval_ms=interval_ms,\n )\n\n now = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(token_data[\"expired_in\"]), now=now,\n )\n expires_in_s = max(0, int(expires_at_unix - now.timestamp()))\n\n auth_state = {\n \"provider\": \"minimax-oauth\",\n \"region\": region,\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": inference_base_url,\n \"client_id\": pconfig.client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data[\"refresh_token\"],\n \"resource_url\": token_data.get(\"resource_url\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n }\n\n _minimax_save_auth_state(auth_state)\n print(\"\\u2713 MiniMax OAuth login successful.\")\n if msg := token_data.get(\"notification_message\"):\n print(f\"Note from MiniMax: {msg}\")\n return auth_state\n\n\ndef _refresh_minimax_oauth_state(\n state: Dict[str, Any], *, timeout_seconds: float = 15.0,\n force: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Refresh MiniMax OAuth access token if close to expiry (or forced).\"\"\"\n if not state.get(\"refresh_token\"):\n raise AuthError(\n \"MiniMax OAuth state has no refresh_token; please re-login.\",\n provider=\"minimax-oauth\", code=\"no_refresh_token\", relogin_required=True,\n )\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n except Exception:\n expires_at = 0.0\n now = time.time()\n if not force and (expires_at - now) > MINIMAX_OAUTH_REFRESH_SKEW_SECONDS:\n return state\n\n portal_base_url = state[\"portal_base_url\"]\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n follow_redirects=True) as client:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": state[\"client_id\"],\n \"refresh_token\": state[\"refresh_token\"],\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n if response.status_code != 200:\n body = response.text.lower()\n relogin = any(m in body for m in\n (\"invalid_grant\", \"refresh_token_reused\", \"invalid_refresh_token\"))\n raise AuthError(\n f\"MiniMax OAuth refresh failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=relogin,\n )\n payload = response.json()\n if payload.get(\"status\") != \"success\":\n raise AuthError(\n \"MiniMax OAuth refresh did not return success.\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=True,\n )\n now_dt = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(payload[\"expired_in\"]), now=now_dt,\n )\n expires_in_s = max(0, int(expires_at_unix - now_dt.timestamp()))\n new_state = dict(state)\n new_state.update({\n \"access_token\": payload[\"access_token\"],\n \"refresh_token\": payload.get(\"refresh_token\", state[\"refresh_token\"]),\n \"obtained_at\": now_dt.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n })\n _minimax_save_auth_state(new_state)\n return new_state\n\n\ndef _minimax_oauth_quarantine_on_terminal_refresh(state: Dict[str, Any], exc: AuthError) -> None:\n \"\"\"Wipe dead tokens from auth.json after a terminal refresh failure.\n\n Shared by both the eager-resolve path and the lazy per-request token\n provider. Mirrors the Nous / xAI-OAuth / Codex-OAuth quarantine pattern\n so subsequent calls fail fast without a network retry.\n \"\"\"\n if not (exc.relogin_required and state.get(\"refresh_token\")):\n return\n for _k in (\"access_token\", \"refresh_token\", \"expires_at\", \"expires_in\", \"obtained_at\"):\n state.pop(_k, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"minimax-oauth\",\n \"code\": exc.code or \"refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n _minimax_save_auth_state(state)\n except Exception as _save_exc:\n logger.debug(\"MiniMax OAuth: failed to persist quarantined state: %s\", _save_exc)\n\n\ndef build_minimax_oauth_token_provider() -> Callable[[], str]:\n \"\"\"Return a zero-arg callable that yields a fresh MiniMax access token.\n\n The Anthropic SDK caches ``api_key`` as a static string at construction\n time, so a session that resolves credentials once at startup will keep\n sending the same bearer until MiniMax's server returns 401 — typically\n ~15 minutes in, because MiniMax issues short-lived access tokens.\n\n Returning a *callable* instead of a string lets us hook into the\n existing Entra-ID bearer infrastructure in\n :mod:`agent.anthropic_adapter`: ``build_anthropic_client`` detects a\n callable and routes through ``_build_anthropic_client_with_bearer_hook``,\n which mints a fresh ``Authorization`` header on every outbound request.\n Each invocation re-reads the persisted state from ``auth.json`` and\n calls :func:`_refresh_minimax_oauth_state` — that helper is a no-op\n when the token still has more than ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS``\n of life left, so the steady-state cost is one file read + one\n timestamp compare per request.\n\n Reading state fresh each time also means a refresh persisted by one\n process (CLI, gateway, cron) is immediately visible to every other\n process sharing the same ``auth.json``.\n \"\"\"\n def _provide() -> str:\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n token = state.get(\"access_token\")\n if not token:\n raise AuthError(\n \"MiniMax OAuth state has no access_token after refresh.\",\n provider=\"minimax-oauth\", code=\"no_access_token\", relogin_required=True,\n )\n return token\n\n return _provide\n\n\ndef resolve_minimax_oauth_runtime_credentials(\n *, min_token_ttl_seconds: int = MINIMAX_OAUTH_REFRESH_SKEW_SECONDS,\n as_token_provider: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Return {provider, api_key, base_url, source} for minimax-oauth.\n\n When ``as_token_provider`` is True, ``api_key`` is a zero-arg callable\n that mints a fresh access token per call (proactively refreshing if\n the cached token is within ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS`` of\n expiry). This is what the runtime provider path uses so that long\n sessions survive MiniMax's short access-token lifetime — see\n :func:`build_minimax_oauth_token_provider` for the rationale.\n\n The default (string ``api_key``) preserves the historical contract for\n diagnostic call sites like ``arcen status`` that just want to know\n whether a valid token exists right now.\n \"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n if as_token_provider:\n api_key: Any = build_minimax_oauth_token_provider()\n else:\n api_key = state[\"access_token\"]\n return {\n \"provider\": \"minimax-oauth\",\n \"api_key\": api_key,\n \"base_url\": state[\"inference_base_url\"].rstrip(\"/\"),\n \"source\": \"oauth\",\n }\n\n\ndef get_minimax_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return auth status dict for MiniMax OAuth provider.\"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n return {\"logged_in\": False, \"provider\": \"minimax-oauth\"}\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n token_valid = (expires_at - time.time()) > 0\n except Exception:\n token_valid = bool(state.get(\"access_token\"))\n return {\n \"logged_in\": token_valid,\n \"provider\": \"minimax-oauth\",\n \"region\": state.get(\"region\", \"global\"),\n \"expires_at\": state.get(\"expires_at\"),\n }\n\n\ndef _login_minimax_oauth(args, pconfig: ProviderConfig) -> None:\n \"\"\"CLI entry for MiniMax OAuth login.\"\"\"\n region = getattr(args, \"region\", None) or \"global\"\n open_browser = not getattr(args, \"no_browser\", False)\n timeout = getattr(args, \"timeout\", None) or 15.0\n try:\n _minimax_oauth_login(\n region=region, open_browser=open_browser, timeout_seconds=timeout,\n )\n except AuthError as exc:\n print(format_auth_error(exc))\n raise SystemExit(1)\n\n\ndef _nous_device_code_login(\n *,\n portal_base_url: Optional[str] = None,\n inference_base_url: Optional[str] = None,\n client_id: Optional[str] = None,\n scope: Optional[str] = None,\n open_browser: bool = True,\n timeout_seconds: float = 15.0,\n insecure: bool = False,\n ca_bundle: Optional[str] = None,\n) -> Dict[str, Any]:\n \"\"\"Run the Nous device-code flow and return full OAuth state without persisting.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"nous\"]\n portal_base_url = (\n portal_base_url\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"NOUS_PORTAL_BASE_URL\")\n or pconfig.portal_base_url\n ).rstrip(\"/\")\n requested_inference_url = (\n inference_base_url\n or os.getenv(\"NOUS_INFERENCE_BASE_URL\")\n or pconfig.inference_base_url\n ).rstrip(\"/\")\n client_id = client_id or pconfig.client_id\n scope = scope or pconfig.scope\n timeout = httpx.Timeout(timeout_seconds)\n verify: bool | str = False if insecure else (ca_bundle if ca_bundle else True)\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via {pconfig.name}...\")\n print(f\"Portal: {portal_base_url}\")\n if insecure:\n print(\"TLS verification: disabled (--insecure)\")\n elif ca_bundle:\n print(f\"TLS verification: custom CA bundle ({ca_bundle})\")\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n device_data = _request_device_code(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n scope=scope,\n )\n\n verification_url = str(device_data[\"verification_uri_complete\"])\n user_code = str(device_data[\"user_code\"])\n expires_in = int(device_data[\"expires_in\"])\n interval = int(device_data[\"interval\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n\n if open_browser:\n opened = webbrowser.open(verification_url)\n if opened:\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically — use the URL above.\")\n\n effective_interval = max(1, min(interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n print(f\"Waiting for approval (polling every {effective_interval}s)...\")\n\n token_data = _poll_for_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n device_code=str(device_data[\"device_code\"]),\n expires_in=expires_in,\n poll_interval=interval,\n )\n\n now = datetime.now(timezone.utc)\n token_expires_in = _coerce_ttl_seconds(token_data.get(\"expires_in\", 0))\n expires_at = now.timestamp() + token_expires_in\n resolved_inference_url = (\n _optional_base_url(token_data.get(\"inference_base_url\"))\n or requested_inference_url\n )\n if resolved_inference_url != requested_inference_url:\n print(f\"Using portal-provided inference URL: {resolved_inference_url}\")\n\n auth_state = {\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": resolved_inference_url,\n \"client_id\": client_id,\n \"scope\": token_data.get(\"scope\") or scope,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data.get(\"refresh_token\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at, tz=timezone.utc).isoformat(),\n \"expires_in\": token_expires_in,\n \"tls\": {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n },\n \"agent_key\": None,\n \"agent_key_id\": None,\n \"agent_key_expires_at\": None,\n \"agent_key_expires_in\": None,\n \"agent_key_reused\": None,\n \"agent_key_obtained_at\": None,\n }\n try:\n return refresh_nous_oauth_from_state(\n auth_state,\n timeout_seconds=timeout_seconds,\n force_refresh=False,\n )\n except AuthError as exc:\n if exc.code == \"subscription_required\":\n portal_url = auth_state.get(\n \"portal_base_url\", DEFAULT_NOUS_PORTAL_URL\n ).rstrip(\"/\")\n message = format_auth_error(exc)\n print()\n print(message)\n print(f\" Subscribe here: {portal_url}/billing\")\n print()\n print(\"After subscribing, run `arcen model` again to finish setup.\")\n raise SystemExit(1)\n raise\n\n\ndef _login_nous(args, pconfig: ProviderConfig) -> None:\n \"\"\"Nous Portal device authorization flow.\"\"\"\n timeout_seconds = getattr(args, \"timeout\", None) or 15.0\n insecure = bool(getattr(args, \"insecure\", False))\n ca_bundle = (\n getattr(args, \"ca_bundle\", None)\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n )\n\n try:\n auth_state = None\n\n # Codex-style auto-import: before launching a fresh device-code\n # flow, check the shared store for an existing Nous credential\n # from any other profile. If present, offer to rehydrate it.\n shared = _read_shared_nous_state()\n if shared:\n try:\n shared_path = _nous_shared_store_path()\n except RuntimeError:\n shared_path = None\n print()\n if shared_path:\n print(f\"Found existing Nous OAuth credentials at {shared_path}\")\n else:\n print(\"Found existing shared Nous OAuth credentials\")\n try:\n do_import = input(\"Import these credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"y\"\n if do_import in {\"\", \"y\", \"yes\"}:\n print(\"Rehydrating Nous session from shared credentials...\")\n auth_state = _try_import_shared_nous_state(\n timeout_seconds=timeout_seconds,\n )\n if auth_state is None:\n print(\"Could not refresh shared credentials — falling back to device-code login.\")\n\n if auth_state is None:\n auth_state = _nous_device_code_login(\n portal_base_url=getattr(args, \"portal_url\", None),\n inference_base_url=getattr(args, \"inference_url\", None),\n client_id=getattr(args, \"client_id\", None) or pconfig.client_id,\n scope=getattr(args, \"scope\", None),\n open_browser=not getattr(args, \"no_browser\", False),\n timeout_seconds=timeout_seconds,\n insecure=insecure,\n ca_bundle=ca_bundle,\n )\n\n inference_base_url = auth_state[\"inference_base_url\"]\n\n # Snapshot the prior active_provider BEFORE _save_provider_state\n # overwrites it to \"nous\". If the user picks \"Skip (keep current)\"\n # during model selection below, we restore this so the user's previous\n # provider (e.g. openrouter) is preserved.\n with _auth_store_lock():\n _prior_store = _load_auth_store()\n prior_active_provider = _prior_store.get(\"active_provider\")\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"nous\", auth_state)\n saved_to = _save_auth_store(auth_store)\n\n # Mirror to the shared store so other profiles can one-tap import\n # these credentials. Best-effort: any I/O failure is logged and\n # swallowed inside the helper.\n _write_shared_nous_state(auth_state)\n _sync_nous_pool_from_auth_store()\n\n print()\n print(\"Login successful!\")\n print(f\" Auth state: {saved_to}\")\n\n # Resolve model BEFORE writing provider to config.yaml so we never\n # leave the config in a half-updated state (provider=nous but model\n # still set to the previous provider's model, e.g. opus from\n # OpenRouter). The auth.json active_provider was already set above.\n selected_model = None\n try:\n runtime_key = auth_state.get(\"agent_key\") or auth_state.get(\"access_token\")\n if not isinstance(runtime_key, str) or not runtime_key:\n raise AuthError(\n \"No runtime API key available to fetch models\",\n provider=\"nous\",\n code=\"invalid_token\",\n )\n\n from arcen_cli.models import (\n get_curated_nous_model_ids, get_pricing_for_provider,\n check_nous_free_tier, partition_nous_models_by_tier,\n union_with_portal_free_recommendations,\n union_with_portal_paid_recommendations,\n )\n model_ids = get_curated_nous_model_ids()\n\n print()\n unavailable_models: list = []\n unavailable_message = \"\"\n if model_ids:\n pricing = get_pricing_for_provider(\"nous\")\n # Force fresh account data for model selection so recent credit\n # purchases are reflected immediately.\n free_tier = check_nous_free_tier(force_fresh=True)\n _portal_for_recs = auth_state.get(\"portal_base_url\", \"\")\n if free_tier:\n try:\n from arcen_cli.nous_account import (\n format_nous_portal_entitlement_message,\n get_nous_portal_account_info,\n )\n\n _account_info = get_nous_portal_account_info(force_fresh=True)\n unavailable_message = (\n format_nous_portal_entitlement_message(\n _account_info,\n capability=\"paid Nous models\",\n )\n or \"\"\n )\n except Exception:\n unavailable_message = \"\"\n # The Portal's freeRecommendedModels endpoint is the\n # source of truth for what's free *right now*. Augment\n # the curated list with anything new the Portal flags\n # as free so users on older Arcen builds still see\n # newly-launched free models without a CLI release.\n model_ids, pricing = union_with_portal_free_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n model_ids, unavailable_models = partition_nous_models_by_tier(\n model_ids, pricing, free_tier=True,\n )\n else:\n # Paid-tier mirror: pull paidRecommendedModels so newly\n # launched paid models surface in the picker even if\n # the in-repo curated list and docs-hosted manifest\n # haven't caught up yet.\n model_ids, pricing = union_with_portal_paid_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n _portal = auth_state.get(\"portal_base_url\", \"\")\n if model_ids:\n print(f\"Showing {len(model_ids)} curated models — use \\\"Enter custom model name\\\" for others.\")\n selected_model = _prompt_model_selection(\n model_ids, pricing=pricing,\n unavailable_models=unavailable_models,\n portal_url=_portal,\n unavailable_message=unavailable_message,\n )\n elif unavailable_models:\n _url = (_portal or DEFAULT_NOUS_PORTAL_URL).rstrip(\"/\")\n print(\"No free models currently available.\")\n print(unavailable_message or f\"Upgrade at {_url} to access paid models.\")\n else:\n print(\"No curated models available for Nous Portal.\")\n except Exception as exc:\n message = format_auth_error(exc) if isinstance(exc, AuthError) else str(exc)\n print()\n print(f\"Login succeeded, but could not fetch available models. Reason: {message}\")\n\n # Write provider + model atomically so config is never mismatched.\n # If no model was selected (user picked \"Skip (keep current)\",\n # model list fetch failed, or no curated models were available),\n # preserve the user's previous provider — don't silently switch\n # them to Nous with a mismatched model. The Nous OAuth tokens\n # stay saved for future use.\n if not selected_model:\n # Restore the prior active_provider that _save_provider_state\n # overwrote to \"nous\". config.yaml model.provider is left\n # untouched, so the user's previous provider is fully preserved.\n with _auth_store_lock():\n auth_store = _load_auth_store()\n if prior_active_provider:\n auth_store[\"active_provider\"] = prior_active_provider\n else:\n auth_store.pop(\"active_provider\", None)\n _save_auth_store(auth_store)\n print()\n print(\"No provider change. Nous credentials saved for future use.\")\n print(\" Run `arcen model` again to switch to Nous Portal.\")\n return\n\n config_path = _update_config_for_provider(\n \"nous\", inference_base_url, default_model=selected_model,\n )\n if selected_model:\n _save_model_choice(selected_model)\n print(f\"Default model set to: {selected_model}\")\n print(f\" Config updated: {config_path} (model.provider=nous)\")\n\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n except Exception as exc:\n print(f\"Login failed: {exc}\")\n raise SystemExit(1)\n\n\ndef logout_command(args) -> None:\n \"\"\"Clear auth state for a provider.\"\"\"\n provider_id = getattr(args, \"provider\", None)\n\n if provider_id and not is_known_auth_provider(provider_id):\n print(f\"Unknown provider: {provider_id}\")\n raise SystemExit(1)\n\n active = get_active_provider()\n target = provider_id or active or _logout_default_provider_from_config()\n\n if not target:\n print(\"No provider is currently logged in.\")\n return\n\n should_reset_config = _should_reset_config_provider_on_logout(target)\n provider_name = get_auth_provider_display_name(target)\n\n if clear_provider_auth(target) or should_reset_config:\n if should_reset_config:\n _reset_config_provider()\n print(f\"Logged out of {provider_name}.\")\n if should_reset_config and os.getenv(\"OPENROUTER_API_KEY\"):\n print(\"Arcen will use OpenRouter for inference.\")\n elif should_reset_config:\n print(\"Run `arcen model` or configure an API key to use Arcen.\")\n else:\n print(\"Model provider configuration was unchanged.\")\n else:\n print(f\"No auth state found for {provider_name}.\")\n"}, "79ea1ec728b48ff4f0c2b5ea8bb48ae76e382e1c": {"t": 1785753042.0155747, "n": 304296, "h": "f8629b005e275c4c", "c": "\"\"\"\nMulti-provider authentication system for Arcen Agent.\n\nSupports OAuth device code flows (Nous Portal, future: OpenAI Codex) and\ntraditional API key providers (OpenRouter, custom endpoints). Auth state\nis persisted in ~/.arcen/auth.json with cross-process file locking.\n\nArchitecture:\n- ProviderConfig registry defines known OAuth providers\n- Auth store (auth.json) holds per-provider credential state\n- resolve_provider() picks the active provider via priority chain\n- resolve_*_runtime_credentials() handles token refresh and runtime keys\n- logout_command() is the CLI entry point for clearing auth\n\nNous authentication paths:\n- Invoke JWT (preferred): use a scoped access_token directly for inference.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport logging\nimport os\nimport shutil\nimport shlex\nimport ssl\nimport stat\nimport sys\nimport base64\nimport hashlib\nimport subprocess\nimport threading\nimport time\nimport uuid\nimport webbrowser\nfrom contextlib import contextmanager\nfrom dataclasses import dataclass, field\nfrom datetime import datetime, timezone\nfrom http.server import BaseHTTPRequestHandler, HTTPServer, ThreadingHTTPServer\nfrom pathlib import Path\nfrom typing import Any, Callable, Dict, FrozenSet, List, Optional, Tuple\nfrom urllib.parse import parse_qs, urlencode, urlparse\n\nimport httpx\n\nfrom arcen_cli.config import get_arcen_home, get_config_path, read_raw_config\nfrom arcen_constants import OPENROUTER_BASE_URL, secure_parent_dir\nfrom agent.credential_persistence import sanitize_borrowed_credential_payload\nfrom utils import atomic_replace, atomic_yaml_write, is_truthy_value\n\nlogger = logging.getLogger(__name__)\n\ntry:\n import fcntl\nexcept Exception:\n fcntl = None\ntry:\n import msvcrt\nexcept Exception:\n msvcrt = None\n\n# =============================================================================\n# Constants\n# =============================================================================\n\nAUTH_STORE_VERSION = 1\nAUTH_LOCK_TIMEOUT_SECONDS = 15.0\n\n# Nous Portal defaults\nDEFAULT_NOUS_PORTAL_URL = \"https://portal.nousresearch.com\"\nDEFAULT_NOUS_INFERENCE_URL = \"https://inference-api.nousresearch.com/v1\"\nDEFAULT_NOUS_CLIENT_ID = \"arcen-cli\"\nNOUS_INFERENCE_INVOKE_SCOPE = \"inference:invoke\"\nDEFAULT_NOUS_SCOPE = NOUS_INFERENCE_INVOKE_SCOPE\nNOUS_DEVICE_CODE_SOURCE = \"device_code\"\nNOUS_AUTH_PATH_INVOKE_JWT = \"invoke_jwt\"\nACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120 # refresh 2 min before expiry\nNOUS_INVOKE_JWT_MIN_TTL_SECONDS = ACCESS_TOKEN_REFRESH_SKEW_SECONDS\nDEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS = 1 # poll at most every 1s\nDEFAULT_CODEX_BASE_URL = \"https://chatgpt.com/backend-api/codex\"\nDEFAULT_XAI_OAUTH_BASE_URL = \"https://api.x.ai/v1\"\nMINIMAX_OAUTH_CLIENT_ID = \"78257093-7e40-4613-99e0-527b14b39113\"\nMINIMAX_OAUTH_SCOPE = \"group_id profile model.completion\"\nMINIMAX_OAUTH_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:user_code\"\nMINIMAX_OAUTH_GLOBAL_BASE = \"https://api.minimax.io\"\nMINIMAX_OAUTH_CN_BASE = \"https://api.minimaxi.com\"\nMINIMAX_OAUTH_GLOBAL_INFERENCE = \"https://api.minimax.io/anthropic\"\nMINIMAX_OAUTH_CN_INFERENCE = \"https://api.minimaxi.com/anthropic\"\nMINIMAX_OAUTH_REFRESH_SKEW_SECONDS = 60\nDEFAULT_QWEN_BASE_URL = \"https://portal.qwen.ai/v1\"\nDEFAULT_GITHUB_MODELS_BASE_URL = \"https://api.githubcopilot.com\"\nDEFAULT_COPILOT_ACP_BASE_URL = \"acp://copilot\"\nDEFAULT_OLLAMA_CLOUD_BASE_URL = \"https://ollama.com/v1\"\nSTEPFUN_STEP_PLAN_INTL_BASE_URL = \"https://api.stepfun.ai/step_plan/v1\"\nSTEPFUN_STEP_PLAN_CN_BASE_URL = \"https://api.stepfun.com/step_plan/v1\"\nCODEX_OAUTH_CLIENT_ID = \"app_EMoamEEZ73f0CkXaXp7hrann\"\nCODEX_OAUTH_TOKEN_URL = \"https://auth.openai.com/oauth/token\"\nCODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nXAI_OAUTH_ISSUER = \"https://auth.x.ai\"\nXAI_OAUTH_DISCOVERY_URL = f\"{XAI_OAUTH_ISSUER}/.well-known/openid-configuration\"\nXAI_OAUTH_CLIENT_ID = \"b1a00492-073a-47ea-816f-4c329264a828\"\nXAI_OAUTH_SCOPE = \"openid profile email offline_access grok-cli:access api:access\"\nXAI_OAUTH_REDIRECT_HOST = \"127.0.0.1\"\nXAI_OAUTH_REDIRECT_PORT = 56121\nXAI_OAUTH_REDIRECT_PATH = \"/callback\"\nXAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nQWEN_OAUTH_CLIENT_ID = \"f0304373b74a44d2b584a3fb70ca9e56\"\nQWEN_OAUTH_TOKEN_URL = \"https://chat.qwen.ai/api/v1/oauth2/token\"\nQWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\nDEFAULT_SPOTIFY_ACCOUNTS_BASE_URL = \"https://accounts.spotify.com\"\nDEFAULT_SPOTIFY_API_BASE_URL = \"https://api.spotify.com/v1\"\nDEFAULT_SPOTIFY_REDIRECT_URI = \"http://127.0.0.1:43827/spotify/callback\"\nSPOTIFY_DOCS_URL = \"https://arcen-agent.nousresearch.com/docs/user-guide/features/spotify\"\nSPOTIFY_DASHBOARD_URL = \"https://developer.spotify.com/dashboard\"\nSPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 120\n\nXAI_OAUTH_DOCS_URL = \"https://arcen-agent.nousresearch.com/docs/guides/xai-grok-oauth\"\nOAUTH_OVER_SSH_DOCS_URL = \"https://arcen-agent.nousresearch.com/docs/guides/oauth-over-ssh\"\nDEFAULT_SPOTIFY_SCOPE = \" \".join((\n \"user-modify-playback-state\",\n \"user-read-playback-state\",\n \"user-read-currently-playing\",\n \"user-read-recently-played\",\n \"playlist-read-private\",\n \"playlist-read-collaborative\",\n \"playlist-modify-public\",\n \"playlist-modify-private\",\n \"user-library-read\",\n \"user-library-modify\",\n))\nSERVICE_PROVIDER_NAMES: Dict[str, str] = {\n \"spotify\": \"Spotify\",\n}\n\n# Google Gemini OAuth (google-gemini-cli provider, Cloud Code Assist backend)\nDEFAULT_GEMINI_CLOUDCODE_BASE_URL = \"cloudcode-pa://google\"\nGEMINI_OAUTH_ACCESS_TOKEN_REFRESH_SKEW_SECONDS = 60 # refresh 60s before expiry\n\n# LM Studio's default no-auth mode still requires *some* non-empty bearer for\n# the API-key code paths (auxiliary_client, runtime resolver) to treat the\n# provider as configured. This sentinel is sent only to LM Studio, never to\n# any remote service.\nLMSTUDIO_NOAUTH_PLACEHOLDER = \"dummy-lm-api-key\"\n\n\n# =============================================================================\n# Provider Registry\n# =============================================================================\n\n@dataclass\nclass ProviderConfig:\n \"\"\"Describes a known inference provider.\"\"\"\n id: str\n name: str\n auth_type: str # \"oauth_device_code\", \"oauth_external\", \"oauth_minimax\", or \"api_key\"\n portal_base_url: str = \"\"\n inference_base_url: str = \"\"\n client_id: str = \"\"\n scope: str = \"\"\n extra: Dict[str, Any] = field(default_factory=dict)\n # For API-key providers: env vars to check (in priority order)\n api_key_env_vars: tuple = ()\n # Optional env var for base URL override\n base_url_env_var: str = \"\"\n\n\nPROVIDER_REGISTRY: Dict[str, ProviderConfig] = {\n \"nous\": ProviderConfig(\n id=\"nous\",\n name=\"Nous Portal\",\n auth_type=\"oauth_device_code\",\n portal_base_url=DEFAULT_NOUS_PORTAL_URL,\n inference_base_url=DEFAULT_NOUS_INFERENCE_URL,\n client_id=DEFAULT_NOUS_CLIENT_ID,\n scope=DEFAULT_NOUS_SCOPE,\n ),\n \"openai-codex\": ProviderConfig(\n id=\"openai-codex\",\n name=\"OpenAI Codex\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_CODEX_BASE_URL,\n ),\n \"openai-api\": ProviderConfig(\n id=\"openai-api\",\n name=\"OpenAI API\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.openai.com/v1\",\n api_key_env_vars=(\"OPENAI_API_KEY\",),\n base_url_env_var=\"OPENAI_BASE_URL\",\n ),\n \"xai-oauth\": ProviderConfig(\n id=\"xai-oauth\",\n name=\"xAI Grok OAuth (SuperGrok / Premium+)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_XAI_OAUTH_BASE_URL,\n ),\n \"qwen-oauth\": ProviderConfig(\n id=\"qwen-oauth\",\n name=\"Qwen OAuth\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_QWEN_BASE_URL,\n ),\n \"google-gemini-cli\": ProviderConfig(\n id=\"google-gemini-cli\",\n name=\"Google Gemini (OAuth)\",\n auth_type=\"oauth_external\",\n inference_base_url=DEFAULT_GEMINI_CLOUDCODE_BASE_URL,\n ),\n \"lmstudio\": ProviderConfig(\n id=\"lmstudio\",\n name=\"LM Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"http://127.0.0.1:1234/v1\",\n api_key_env_vars=(\"LM_API_KEY\",),\n base_url_env_var=\"LM_BASE_URL\",\n ),\n \"copilot\": ProviderConfig(\n id=\"copilot\",\n name=\"GitHub Copilot\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_GITHUB_MODELS_BASE_URL,\n api_key_env_vars=(\"COPILOT_GITHUB_TOKEN\", \"GH_TOKEN\", \"GITHUB_TOKEN\"),\n base_url_env_var=\"COPILOT_API_BASE_URL\",\n ),\n \"copilot-acp\": ProviderConfig(\n id=\"copilot-acp\",\n name=\"GitHub Copilot ACP\",\n auth_type=\"external_process\",\n inference_base_url=DEFAULT_COPILOT_ACP_BASE_URL,\n base_url_env_var=\"COPILOT_ACP_BASE_URL\",\n ),\n \"gemini\": ProviderConfig(\n id=\"gemini\",\n name=\"Google AI Studio\",\n auth_type=\"api_key\",\n inference_base_url=\"https://generativelanguage.googleapis.com/v1beta\",\n api_key_env_vars=(\"GOOGLE_API_KEY\", \"GEMINI_API_KEY\"),\n base_url_env_var=\"GEMINI_BASE_URL\",\n ),\n \"zai\": ProviderConfig(\n id=\"zai\",\n name=\"Z.AI / GLM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.z.ai/api/paas/v4\",\n api_key_env_vars=(\"GLM_API_KEY\", \"ZAI_API_KEY\", \"Z_AI_API_KEY\"),\n base_url_env_var=\"GLM_BASE_URL\",\n ),\n \"kimi-coding\": ProviderConfig(\n id=\"kimi-coding\",\n name=\"Kimi / Moonshot\",\n auth_type=\"api_key\",\n # Legacy platform.moonshot.ai keys use this endpoint (OpenAI-compat).\n # sk-kimi- (Kimi Code) keys are auto-redirected to api.kimi.com/coding\n # by _resolve_kimi_base_url() below.\n inference_base_url=\"https://api.moonshot.ai/v1\",\n api_key_env_vars=(\"KIMI_API_KEY\", \"KIMI_CODING_API_KEY\"),\n base_url_env_var=\"KIMI_BASE_URL\",\n ),\n \"kimi-coding-cn\": ProviderConfig(\n id=\"kimi-coding-cn\",\n name=\"Kimi / Moonshot (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.moonshot.cn/v1\",\n api_key_env_vars=(\"KIMI_CN_API_KEY\",),\n ),\n \"stepfun\": ProviderConfig(\n id=\"stepfun\",\n name=\"StepFun Step Plan\",\n auth_type=\"api_key\",\n inference_base_url=STEPFUN_STEP_PLAN_INTL_BASE_URL,\n api_key_env_vars=(\"STEPFUN_API_KEY\",),\n base_url_env_var=\"STEPFUN_BASE_URL\",\n ),\n \"arcee\": ProviderConfig(\n id=\"arcee\",\n name=\"Arcee AI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.arcee.ai/api/v1\",\n api_key_env_vars=(\"ARCEEAI_API_KEY\",),\n base_url_env_var=\"ARCEE_BASE_URL\",\n ),\n \"gmi\": ProviderConfig(\n id=\"gmi\",\n name=\"GMI Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.gmi-serving.com/v1\",\n api_key_env_vars=(\"GMI_API_KEY\",),\n base_url_env_var=\"GMI_BASE_URL\",\n ),\n \"minimax\": ProviderConfig(\n id=\"minimax\",\n name=\"MiniMax\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimax.io/anthropic\",\n api_key_env_vars=(\"MINIMAX_API_KEY\",),\n base_url_env_var=\"MINIMAX_BASE_URL\",\n ),\n \"minimax-oauth\": ProviderConfig(\n id=\"minimax-oauth\",\n name=\"MiniMax (OAuth \\u00b7 minimax.io)\",\n auth_type=\"oauth_minimax\",\n portal_base_url=MINIMAX_OAUTH_GLOBAL_BASE,\n inference_base_url=MINIMAX_OAUTH_GLOBAL_INFERENCE,\n client_id=MINIMAX_OAUTH_CLIENT_ID,\n scope=MINIMAX_OAUTH_SCOPE,\n extra={\"region\": \"global\", \"cn_portal_base_url\": MINIMAX_OAUTH_CN_BASE,\n \"cn_inference_base_url\": MINIMAX_OAUTH_CN_INFERENCE},\n ),\n \"anthropic\": ProviderConfig(\n id=\"anthropic\",\n name=\"Anthropic\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.anthropic.com\",\n api_key_env_vars=(\"ANTHROPIC_API_KEY\", \"ANTHROPIC_TOKEN\", \"CLAUDE_CODE_OAUTH_TOKEN\"),\n base_url_env_var=\"ANTHROPIC_BASE_URL\",\n ),\n \"alibaba\": ProviderConfig(\n id=\"alibaba\",\n name=\"Qwen Cloud\",\n auth_type=\"api_key\",\n inference_base_url=\"https://dashscope-intl.aliyuncs.com/compatible-mode/v1\",\n api_key_env_vars=(\"DASHSCOPE_API_KEY\",),\n base_url_env_var=\"DASHSCOPE_BASE_URL\",\n ),\n \"alibaba-coding-plan\": ProviderConfig(\n id=\"alibaba-coding-plan\",\n name=\"Alibaba Cloud (Coding Plan)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://coding-intl.dashscope.aliyuncs.com/v1\",\n api_key_env_vars=(\"ALIBABA_CODING_PLAN_API_KEY\", \"DASHSCOPE_API_KEY\"),\n base_url_env_var=\"ALIBABA_CODING_PLAN_BASE_URL\",\n ),\n \"minimax-cn\": ProviderConfig(\n id=\"minimax-cn\",\n name=\"MiniMax (China)\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.minimaxi.com/anthropic\",\n api_key_env_vars=(\"MINIMAX_CN_API_KEY\",),\n base_url_env_var=\"MINIMAX_CN_BASE_URL\",\n ),\n \"deepseek\": ProviderConfig(\n id=\"deepseek\",\n name=\"DeepSeek\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.deepseek.com/v1\",\n api_key_env_vars=(\"DEEPSEEK_API_KEY\",),\n base_url_env_var=\"DEEPSEEK_BASE_URL\",\n ),\n \"xai\": ProviderConfig(\n id=\"xai\",\n name=\"xAI\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.x.ai/v1\",\n api_key_env_vars=(\"XAI_API_KEY\",),\n base_url_env_var=\"XAI_BASE_URL\",\n ),\n \"nvidia\": ProviderConfig(\n id=\"nvidia\",\n name=\"NVIDIA NIM\",\n auth_type=\"api_key\",\n inference_base_url=\"https://integrate.api.nvidia.com/v1\",\n api_key_env_vars=(\"NVIDIA_API_KEY\",),\n base_url_env_var=\"NVIDIA_BASE_URL\",\n ),\n \"opencode-zen\": ProviderConfig(\n id=\"opencode-zen\",\n name=\"OpenCode Zen\",\n auth_type=\"api_key\",\n inference_base_url=\"https://opencode.ai/zen/v1\",\n api_key_env_vars=(\"OPENCODE_ZEN_API_KEY\",),\n base_url_env_var=\"OPENCODE_ZEN_BASE_URL\",\n ),\n \"opencode-go\": ProviderConfig(\n id=\"opencode-go\",\n name=\"OpenCode Go\",\n auth_type=\"api_key\",\n # OpenCode Go mixes API surfaces by model:\n # - GLM / Kimi use OpenAI-compatible chat completions under /v1\n # - MiniMax models use Anthropic Messages under /v1/messages\n # - Qwen 3.7 uses Anthropic Messages under /v1/messages\n # Keep the provider base at /v1 and select api_mode per-model.\n inference_base_url=\"https://opencode.ai/zen/go/v1\",\n api_key_env_vars=(\"OPENCODE_GO_API_KEY\",),\n base_url_env_var=\"OPENCODE_GO_BASE_URL\",\n ),\n \"kilocode\": ProviderConfig(\n id=\"kilocode\",\n name=\"Kilo Code\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.kilo.ai/api/gateway\",\n api_key_env_vars=(\"KILOCODE_API_KEY\",),\n base_url_env_var=\"KILOCODE_BASE_URL\",\n ),\n \"huggingface\": ProviderConfig(\n id=\"huggingface\",\n name=\"Hugging Face\",\n auth_type=\"api_key\",\n inference_base_url=\"https://router.huggingface.co/v1\",\n api_key_env_vars=(\"HF_TOKEN\",),\n base_url_env_var=\"HF_BASE_URL\",\n ),\n \"xiaomi\": ProviderConfig(\n id=\"xiaomi\",\n name=\"Xiaomi MiMo\",\n auth_type=\"api_key\",\n inference_base_url=\"https://api.xiaomimimo.com/v1\",\n api_key_env_vars=(\"XIAOMI_API_KEY\",),\n base_url_env_var=\"XIAOMI_BASE_URL\",\n ),\n \"tencent-tokenhub\": ProviderConfig(\n id=\"tencent-tokenhub\",\n name=\"Tencent TokenHub\",\n auth_type=\"api_key\",\n inference_base_url=\"https://tokenhub.tencentmaas.com/v1\",\n api_key_env_vars=(\"TOKENHUB_API_KEY\",),\n base_url_env_var=\"TOKENHUB_BASE_URL\",\n ),\n \"ollama-cloud\": ProviderConfig(\n id=\"ollama-cloud\",\n name=\"Ollama Cloud\",\n auth_type=\"api_key\",\n inference_base_url=DEFAULT_OLLAMA_CLOUD_BASE_URL,\n api_key_env_vars=(\"OLLAMA_API_KEY\",),\n base_url_env_var=\"OLLAMA_BASE_URL\",\n ),\n \"bedrock\": ProviderConfig(\n id=\"bedrock\",\n name=\"AWS Bedrock\",\n auth_type=\"aws_sdk\",\n inference_base_url=\"https://bedrock-runtime.us-east-1.amazonaws.com\",\n api_key_env_vars=(),\n base_url_env_var=\"BEDROCK_BASE_URL\",\n ),\n \"azure-foundry\": ProviderConfig(\n id=\"azure-foundry\",\n name=\"Azure Foundry\",\n auth_type=\"api_key\",\n inference_base_url=\"\", # User-provided endpoint\n api_key_env_vars=(\"AZURE_FOUNDRY_API_KEY\",),\n base_url_env_var=\"AZURE_FOUNDRY_BASE_URL\",\n ),\n}\n\n# Auto-extend PROVIDER_REGISTRY with any api-key provider registered in\n# providers/ that is not already declared above. New providers only need a\n# plugins/model-providers/<name>/ plugin — no edits to this file required.\ntry:\n from providers import list_providers as _list_providers_for_registry\n for _pp in _list_providers_for_registry():\n if _pp.name in PROVIDER_REGISTRY:\n continue\n if _pp.auth_type != \"api_key\" or not _pp.env_vars:\n continue\n # Skip providers that need custom token resolution or are special-cased\n # in resolve_provider() (copilot/kimi/zai have bespoke token refresh;\n # openrouter/custom are aggregator/user-supplied and handled outside\n # the registry — adding them here breaks runtime_provider resolution\n # that relies on `openrouter not in PROVIDER_REGISTRY`).\n if _pp.name in {\"copilot\", \"kimi-coding\", \"kimi-coding-cn\", \"zai\", \"openrouter\", \"custom\"}:\n continue\n _api_key_vars = tuple(v for v in _pp.env_vars if not v.endswith(\"_BASE_URL\") and not v.endswith(\"_URL\"))\n _base_url_var = next((v for v in _pp.env_vars if v.endswith(\"_BASE_URL\") or v.endswith(\"_URL\")), None)\n PROVIDER_REGISTRY[_pp.name] = ProviderConfig(\n id=_pp.name,\n name=_pp.display_name or _pp.name,\n auth_type=\"api_key\",\n inference_base_url=_pp.base_url,\n api_key_env_vars=_api_key_vars or _pp.env_vars,\n base_url_env_var=_base_url_var or \"\",\n )\n # Also register aliases so resolve_provider() resolves them\n for _alias in _pp.aliases:\n if _alias not in PROVIDER_REGISTRY:\n PROVIDER_REGISTRY[_alias] = PROVIDER_REGISTRY[_pp.name]\nexcept Exception:\n pass\n\n\n# =============================================================================\n# Anthropic Key Helper\n# =============================================================================\n\ndef get_anthropic_key() -> str:\n \"\"\"Return the first usable Anthropic credential, or ``\"\"``.\n\n Checks both the ``.env`` file (via ``get_env_value``) and the process\n environment (``os.getenv``). The fallback order mirrors the\n ``PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars`` tuple:\n\n ANTHROPIC_API_KEY -> ANTHROPIC_TOKEN -> CLAUDE_CODE_OAUTH_TOKEN\n \"\"\"\n from arcen_cli.config import get_env_value\n\n for var in PROVIDER_REGISTRY[\"anthropic\"].api_key_env_vars:\n value = get_env_value(var) or os.getenv(var, \"\")\n if value:\n return value\n return \"\"\n\n\n# =============================================================================\n# Kimi Code Endpoint Detection\n# =============================================================================\n\n# Kimi Code (kimi.com/code) issues keys prefixed \"sk-kimi-\" that only work\n# on api.kimi.com/coding. Legacy keys from platform.moonshot.ai work on\n# api.moonshot.ai/v1 (the old default). Auto-detect when user hasn't set\n# KIMI_BASE_URL explicitly.\n#\n# Note: the base URL intentionally has NO /v1 suffix. The /coding endpoint\n# speaks the Anthropic Messages protocol, and the anthropic SDK appends\n# \"/v1/messages\" internally — so \"/coding\" + SDK suffix → \"/coding/v1/messages\"\n# (the correct target). Using \"/coding/v1\" here would produce\n# \"/coding/v1/v1/messages\" (a 404).\nKIMI_CODE_BASE_URL = \"https://api.kimi.com/coding\"\n\n\ndef _resolve_kimi_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Kimi base URL based on the API key prefix.\n\n If the user has explicitly set KIMI_BASE_URL, that always wins.\n Otherwise, sk-kimi- prefixed keys route to api.kimi.com/coding/v1.\n \"\"\"\n if env_override:\n return env_override\n # No key → nothing to infer from. Return default without inspecting.\n if not api_key:\n return default_url\n if api_key.startswith(\"sk-kimi-\"):\n return KIMI_CODE_BASE_URL\n return default_url\n\n\n\n_PLACEHOLDER_SECRET_VALUES = {\n \"*\",\n \"**\",\n \"***\",\n \"changeme\",\n \"your_api_key\",\n \"your_api_key_here\",\n \"your-api-key\",\n \"placeholder\",\n \"example\",\n \"dummy\",\n \"null\",\n \"none\",\n}\n\n\ndef has_usable_secret(value: Any, *, min_length: int = 4) -> bool:\n \"\"\"Return True when a configured secret looks usable, not empty/placeholder.\"\"\"\n if not isinstance(value, str):\n return False\n cleaned = value.strip()\n if len(cleaned) < min_length:\n return False\n if cleaned.lower() in _PLACEHOLDER_SECRET_VALUES:\n return False\n return True\n\n\ndef _resolve_api_key_provider_secret(\n provider_id: str, pconfig: ProviderConfig\n) -> tuple[str, str]:\n \"\"\"Resolve an API-key provider's token and indicate where it came from.\"\"\"\n if provider_id == \"copilot\":\n # Use the dedicated copilot auth module for proper token validation\n try:\n from arcen_cli.copilot_auth import resolve_copilot_token, get_copilot_api_token\n token, source = resolve_copilot_token()\n if token:\n return get_copilot_api_token(token), source\n except ValueError as exc:\n logger.warning(\"Copilot token validation failed: %s\", exc)\n except Exception:\n pass\n return \"\", \"\"\n\n from arcen_cli.config import get_env_value\n for env_var in pconfig.api_key_env_vars:\n # Check both os.environ and ~/.arcen/.env file\n val = (get_env_value(env_var) or \"\").strip()\n if has_usable_secret(val):\n return val, env_var\n\n # Fallback: try credential pool (e.g. zai key stored via auth.json)\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(provider_id)\n if pool and pool.has_credentials():\n entry = pool.peek()\n if entry:\n key = getattr(entry, \"access_token\", \"\") or getattr(entry, \"runtime_api_key\", \"\")\n key = str(key).strip()\n if has_usable_secret(key):\n return key, f\"credential_pool:{provider_id}\"\n except Exception:\n pass\n\n return \"\", \"\"\n\n\n# =============================================================================\n# Z.AI Endpoint Detection\n# =============================================================================\n\n# Z.AI has separate billing for general vs coding plans, and global vs China\n# endpoints. A key that works on one may return \"Insufficient balance\" on\n# another. We probe at setup time and store the working endpoint.\n# Each entry lists candidate models to try in order — newer coding plan accounts\n# may only have access to recent models (glm-5.1, glm-5v-turbo) while older\n# ones still use glm-4.7.\n\nZAI_ENDPOINTS = [\n # (id, base_url, probe_models, label)\n (\"global\", \"https://api.z.ai/api/paas/v4\", [\"glm-5\"], \"Global\"),\n (\"cn\", \"https://open.bigmodel.cn/api/paas/v4\", [\"glm-5\"], \"China\"),\n (\"coding-global\", \"https://api.z.ai/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"Global (Coding Plan)\"),\n (\"coding-cn\", \"https://open.bigmodel.cn/api/coding/paas/v4\", [\"glm-5.1\", \"glm-5v-turbo\", \"glm-4.7\"], \"China (Coding Plan)\"),\n]\n\n\ndef detect_zai_endpoint(api_key: str, timeout: float = 8.0) -> Optional[Dict[str, str]]:\n \"\"\"Probe z.ai endpoints to find one that accepts this API key.\n\n Returns {\"id\": ..., \"base_url\": ..., \"model\": ..., \"label\": ...} for the\n first working endpoint, or None if all fail. For endpoints with multiple\n candidate models, tries each in order and returns the first that succeeds.\n \"\"\"\n for ep_id, base_url, probe_models, label in ZAI_ENDPOINTS:\n for model in probe_models:\n try:\n resp = httpx.post(\n f\"{base_url}/chat/completions\",\n headers={\n \"Authorization\": f\"Bearer {api_key}\",\n \"Content-Type\": \"application/json\",\n },\n json={\n \"model\": model,\n \"stream\": False,\n \"max_tokens\": 1,\n \"messages\": [{\"role\": \"user\", \"content\": \"ping\"}],\n },\n timeout=timeout,\n )\n if resp.status_code == 200:\n logger.debug(\"Z.AI endpoint probe: %s (%s) model=%s OK\", ep_id, base_url, model)\n return {\n \"id\": ep_id,\n \"base_url\": base_url,\n \"model\": model,\n \"label\": label,\n }\n logger.debug(\"Z.AI endpoint probe: %s model=%s returned %s\", ep_id, model, resp.status_code)\n except Exception as exc:\n logger.debug(\"Z.AI endpoint probe: %s model=%s failed: %s\", ep_id, model, exc)\n return None\n\n\ndef _resolve_zai_base_url(api_key: str, default_url: str, env_override: str) -> str:\n \"\"\"Return the correct Z.AI base URL by probing endpoints.\n\n If the user has explicitly set GLM_BASE_URL, that always wins.\n Otherwise, probe the candidate endpoints to find one that accepts the\n key. The detected endpoint is cached in provider state (auth.json) keyed\n on a hash of the API key so subsequent starts skip the probe.\n \"\"\"\n if env_override:\n return env_override\n\n # No API key set → don't probe (would fire N×M HTTPS requests with an\n # empty Bearer token, all returning 401). This path is hit during\n # auxiliary-client auto-detection when the user has no Z.AI credentials\n # at all — the caller discards the result immediately, so the probe is\n # pure latency for every AIAgent construction.\n if not api_key:\n return default_url\n\n # Check provider-state cache for a previously-detected endpoint.\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"zai\") or {}\n cached = state.get(\"detected_endpoint\")\n if isinstance(cached, dict) and cached.get(\"base_url\"):\n key_hash = cached.get(\"key_hash\", \"\")\n if key_hash == hashlib.sha256(api_key.encode()).hexdigest()[:16]:\n logger.debug(\"Z.AI: using cached endpoint %s\", cached[\"base_url\"])\n return cached[\"base_url\"]\n\n # Probe — may take up to ~8s per endpoint.\n detected = detect_zai_endpoint(api_key)\n if detected and detected.get(\"base_url\"):\n # Persist the detection result keyed on the API key hash.\n key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:16]\n state[\"detected_endpoint\"] = {\n \"base_url\": detected[\"base_url\"],\n \"endpoint_id\": detected.get(\"id\", \"\"),\n \"model\": detected.get(\"model\", \"\"),\n \"label\": detected.get(\"label\", \"\"),\n \"key_hash\": key_hash,\n }\n _save_provider_state(auth_store, \"zai\", state)\n logger.info(\"Z.AI: auto-detected endpoint %s (%s)\", detected[\"label\"], detected[\"base_url\"])\n return detected[\"base_url\"]\n\n logger.debug(\"Z.AI: probe failed, falling back to default %s\", default_url)\n return default_url\n\n\n# =============================================================================\n# Error Types\n# =============================================================================\n\n# Error code marking upstream rate-limit / usage-quota exhaustion (HTTP 429).\n# Such failures are transient and re-authenticating cannot resolve them, so\n# they must be kept distinct from missing/expired-credential errors.\nCODEX_RATE_LIMITED_CODE = \"codex_rate_limited\"\n\n\nclass AuthError(RuntimeError):\n \"\"\"Structured auth error with UX mapping hints.\"\"\"\n\n def __init__(\n self,\n message: str,\n *,\n provider: str = \"\",\n code: Optional[str] = None,\n relogin_required: bool = False,\n ) -> None:\n super().__init__(message)\n self.provider = provider\n self.code = code\n self.relogin_required = relogin_required\n\n\ndef is_rate_limited_auth_error(error: Exception) -> bool:\n \"\"\"True when an :class:`AuthError` represents upstream rate-limiting / quota\n exhaustion rather than missing or invalid credentials.\n\n These failures are transient — re-authenticating cannot resolve them — so\n callers should surface a \"retry later\" notice and prefer a fallback chain\n instead of prompting the operator to run ``arcen auth``.\n \"\"\"\n return (\n isinstance(error, AuthError)\n and not error.relogin_required\n and error.code == CODEX_RATE_LIMITED_CODE\n )\n\n\ndef _parse_retry_after_seconds(headers: Any) -> Optional[int]:\n \"\"\"Best-effort parse of a ``Retry-After`` header into whole seconds.\n\n Supports the delta-seconds form (e.g. ``\"120\"``). HTTP-date forms and\n missing/unparseable values return ``None`` rather than guessing.\n \"\"\"\n if headers is None:\n return None\n try:\n raw = headers.get(\"retry-after\")\n except Exception:\n return None\n if raw is None:\n return None\n try:\n seconds = int(str(raw).strip())\n except (TypeError, ValueError):\n return None\n return seconds if seconds >= 0 else None\n\n\ndef format_auth_error(error: Exception) -> str:\n \"\"\"Map auth failures to concise user-facing guidance.\"\"\"\n if not isinstance(error, AuthError):\n return str(error)\n\n # Rate-limit / quota errors are not credential problems — never append the\n # \"re-authenticate\" remediation, which would mislead the operator.\n if is_rate_limited_auth_error(error):\n return str(error)\n\n if error.relogin_required:\n return f\"{error} Run `arcen model` to re-authenticate.\"\n\n if error.code == \"subscription_required\":\n if error.provider == \"nous\":\n return _format_nous_entitlement_auth_error(error)\n return \"No active paid subscription found. Please purchase/activate a subscription, then retry.\"\n\n if error.code == \"insufficient_credits\":\n if error.provider == \"nous\":\n return _format_nous_entitlement_auth_error(error)\n return \"Subscription credits are exhausted. Top up/renew credits, then retry.\"\n\n if error.code in {\"subscription_expired\", \"no_usable_credits\", \"account_missing\"}:\n if error.provider == \"nous\":\n return _format_nous_entitlement_auth_error(error)\n\n if error.code == \"temporarily_unavailable\":\n return f\"{error} Please retry in a few seconds.\"\n\n return str(error)\n\n\ndef _format_nous_entitlement_auth_error(error: AuthError) -> str:\n try:\n from arcen_cli.nous_account import (\n format_nous_portal_entitlement_message,\n get_nous_portal_account_info,\n )\n\n account_info = get_nous_portal_account_info(force_fresh=True)\n message = format_nous_portal_entitlement_message(\n account_info,\n capability=\"Nous model access\",\n )\n if message:\n return message\n except Exception:\n pass\n return f\"{error} Check credits or billing in Nous Portal, then retry.\"\n\n\ndef _token_fingerprint(token: Any) -> Optional[str]:\n \"\"\"Return a short hash fingerprint for telemetry without leaking token bytes.\"\"\"\n if not isinstance(token, str):\n return None\n cleaned = token.strip()\n if not cleaned:\n return None\n return hashlib.sha256(cleaned.encode(\"utf-8\")).hexdigest()[:12]\n\n\ndef _oauth_trace_enabled() -> bool:\n raw = os.getenv(\"ARCEN_OAUTH_TRACE\", \"\").strip().lower()\n return raw in {\"1\", \"true\", \"yes\", \"on\"}\n\n\ndef _oauth_trace(event: str, *, sequence_id: Optional[str] = None, **fields: Any) -> None:\n if not _oauth_trace_enabled():\n return\n payload: Dict[str, Any] = {\"event\": event}\n if sequence_id:\n payload[\"sequence_id\"] = sequence_id\n payload.update(fields)\n logger.info(\"oauth_trace %s\", json.dumps(payload, sort_keys=True, ensure_ascii=False))\n\n\n# =============================================================================\n# Auth Store — persistence layer for ~/.arcen/auth.json\n# =============================================================================\n\ndef _auth_file_path() -> Path:\n path = get_arcen_home() / \"auth.json\"\n # Seat belt: if pytest is running and ARCEN_HOME resolves to the real\n # user's auth store, refuse rather than silently corrupt it. This catches\n # tests that forgot to monkeypatch ARCEN_HOME, tests invoked without the\n # hermetic conftest, or sandbox escapes via threads/subprocesses. In\n # production (no PYTEST_CURRENT_TEST) this is a single dict lookup.\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_auth = (Path.home() / \".arcen\" / \"auth.json\").resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_auth:\n raise RuntimeError(\n f\"Refusing to touch real user auth store during test run: {path}. \"\n \"Set ARCEN_HOME to a tmp_path in your test fixture, or run \"\n \"via scripts/run_tests.sh for hermetic CI-parity env.\"\n )\n return path\n\n\ndef _global_auth_file_path() -> Optional[Path]:\n \"\"\"Return the global-root auth.json when the process is in profile mode.\n\n Returns ``None`` when the profile and global root resolve to the same\n directory (classic mode, or custom ARCEN_HOME that is not a profile).\n Used by read-only fallback paths so providers authed at the root are\n visible to profile processes that haven't configured them locally.\n\n See issue #18594 follow-up (credential_pool shadowing).\n \"\"\"\n try:\n from arcen_constants import get_default_arcen_root\n global_root = get_default_arcen_root()\n except Exception:\n return None\n profile_home = get_arcen_home()\n try:\n if profile_home.resolve(strict=False) == global_root.resolve(strict=False):\n return None\n except Exception:\n if profile_home == global_root:\n return None\n # No pytest seat belt here: this is a pure read-only path, and\n # ``_load_global_auth_store()`` wraps the read in a try/except so an\n # unreadable global file can never break the profile process. The\n # write-side seat belt still lives on ``_auth_file_path()`` where it\n # belongs (that's what protects the real user's auth store from being\n # corrupted by a mis-configured test).\n return global_root / \"auth.json\"\n\n\ndef _load_global_auth_store() -> Dict[str, Any]:\n \"\"\"Load the global-root auth store (read-only fallback).\n\n Returns an empty dict when no global fallback exists (classic mode,\n or the global auth.json is absent). Never raises on missing file.\n\n Seat belt: under pytest, refuses to read the real user's\n ``~/.arcen/auth.json`` even when ARCEN_HOME is set to a profile\n path. The hermetic conftest does not redirect ``HOME``, so\n ``get_default_arcen_root()`` for a profile-shaped ARCEN_HOME can\n still resolve to the real user's home on a dev machine. That would\n leak real credentials into tests. This guard uses the unmodified\n ``HOME`` env var (what ``os.path.expanduser('~')`` would resolve to),\n not ``Path.home()``, because ``Path.home`` is sometimes monkeypatched\n by fixtures that want to relocate the global root to a tmp path.\n \"\"\"\n global_path = _global_auth_file_path()\n if global_path is None or not global_path.exists():\n return {}\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n real_home_env = os.environ.get(\"HOME\", \"\")\n if real_home_env:\n real_root = Path(real_home_env) / \".arcen\" / \"auth.json\"\n try:\n if global_path.resolve(strict=False) == real_root.resolve(strict=False):\n return {}\n except Exception:\n pass\n try:\n return _load_auth_store(global_path)\n except Exception:\n # A malformed global store must not break profile reads. The\n # profile's own auth store is still authoritative.\n return {}\n\n\ndef _auth_lock_path() -> Path:\n return _auth_file_path().with_suffix(\".lock\")\n\n\n_auth_lock_holder = threading.local()\n\n\n@contextmanager\ndef _file_lock(\n lock_path: Path,\n holder: threading.local,\n timeout_seconds: float,\n timeout_message: str,\n):\n \"\"\"Cross-process advisory flock helper.\n\n Reentrant per-thread via ``holder.depth``. Falls back to a depth-only\n guard when neither ``fcntl`` nor ``msvcrt`` is available (rare).\n Callers supply their own ``threading.local`` so independent locks\n (e.g. profile auth.json vs shared Nous store) don't share reentrancy\n state — that would let one lock's reentrant acquisition silently skip\n the other's kernel-level flock.\n \"\"\"\n if getattr(holder, \"depth\", 0) > 0:\n holder.depth += 1\n try:\n yield\n finally:\n holder.depth -= 1\n return\n\n lock_path.parent.mkdir(parents=True, exist_ok=True)\n\n if fcntl is None and msvcrt is None:\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n return\n\n # On Windows, msvcrt.locking needs the file to have content and the\n # file pointer at position 0. Ensure the lock file has at least 1 byte.\n if msvcrt and (not lock_path.exists() or lock_path.stat().st_size == 0):\n lock_path.write_text(\" \", encoding=\"utf-8\")\n\n with lock_path.open(\"r+\" if msvcrt else \"a+\", encoding=\"utf-8\") as lock_file:\n deadline = time.monotonic() + max(1.0, timeout_seconds)\n while True:\n try:\n if fcntl:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)\n else:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_NBLCK, 1)\n break\n except (BlockingIOError, OSError, PermissionError):\n if time.monotonic() >= deadline:\n raise TimeoutError(timeout_message)\n time.sleep(0.05)\n\n holder.depth = 1\n try:\n yield\n finally:\n holder.depth = 0\n if fcntl:\n try:\n fcntl.flock(lock_file.fileno(), fcntl.LOCK_UN)\n except (OSError, IOError):\n pass\n elif msvcrt:\n try:\n lock_file.seek(0)\n msvcrt.locking(lock_file.fileno(), msvcrt.LK_UNLCK, 1)\n except (OSError, IOError):\n pass\n\n\n@contextmanager\ndef _auth_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-process advisory lock for auth.json reads+writes. Reentrant.\n\n Lock ordering invariant: when this lock is held together with\n ``_nous_shared_store_lock``, acquire ``_auth_store_lock`` FIRST\n (outer) and the shared Nous lock SECOND (inner). All runtime\n refresh paths follow this order; violating it risks deadlock\n against a concurrent import on the shared store.\n \"\"\"\n with _file_lock(\n _auth_lock_path(),\n _auth_lock_holder,\n timeout_seconds,\n \"Timed out waiting for auth store lock\",\n ):\n yield\n\n\ndef _load_auth_store(auth_file: Optional[Path] = None) -> Dict[str, Any]:\n auth_file = auth_file or _auth_file_path()\n if not auth_file.exists():\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n try:\n raw = json.loads(auth_file.read_text())\n except Exception as exc:\n corrupt_path = auth_file.with_suffix(\".json.corrupt\")\n try:\n import shutil\n shutil.copy2(auth_file, corrupt_path)\n except Exception:\n pass\n logger.warning(\n \"auth: failed to parse %s (%s) — starting with empty store. \"\n \"Corrupt file preserved at %s\",\n auth_file, exc, corrupt_path,\n )\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n if isinstance(raw, dict) and (\n isinstance(raw.get(\"providers\"), dict)\n or isinstance(raw.get(\"credential_pool\"), dict)\n ):\n raw.setdefault(\"providers\", {})\n return raw\n\n # Migrate from PR's \"systems\" format if present\n if isinstance(raw, dict) and isinstance(raw.get(\"systems\"), dict):\n systems = raw[\"systems\"]\n providers = {}\n if \"nous_portal\" in systems:\n providers[\"nous\"] = systems[\"nous_portal\"]\n return {\"version\": AUTH_STORE_VERSION, \"providers\": providers,\n \"active_provider\": \"nous\" if providers else None}\n\n return {\"version\": AUTH_STORE_VERSION, \"providers\": {}}\n\n\ndef _save_auth_store(auth_store: Dict[str, Any]) -> Path:\n auth_file = _auth_file_path()\n auth_file.parent.mkdir(parents=True, exist_ok=True)\n # Tighten parent dir to 0o700 so siblings can't traverse to creds.\n # No-op on Windows (POSIX mode bits not enforced); ignore failures.\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_file)\n auth_store[\"version\"] = AUTH_STORE_VERSION\n auth_store[\"updated_at\"] = datetime.now(timezone.utc).isoformat()\n payload = json.dumps(auth_store, indent=2) + \"\\n\"\n tmp_path = auth_file.with_name(f\"{auth_file.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n try:\n # Create with 0o600 atomically via os.open(O_EXCL) + fdopen to close\n # the TOCTOU window where default umask (often 0o644) briefly exposed\n # OAuth tokens to other local users between open() and chmod().\n # Mirrors agent/google_oauth.py (#19673) and tools/mcp_oauth.py (#21148).\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as handle:\n handle.write(payload)\n handle.flush()\n os.fsync(handle.fileno())\n atomic_replace(tmp_path, auth_file)\n try:\n dir_fd = os.open(str(auth_file.parent), os.O_RDONLY)\n except OSError:\n dir_fd = None\n if dir_fd is not None:\n try:\n os.fsync(dir_fd)\n finally:\n os.close(dir_fd)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n # Restrict file permissions to owner only\n try:\n auth_file.chmod(stat.S_IRUSR | stat.S_IWUSR)\n except OSError:\n pass\n return auth_file\n\n\ndef _load_provider_state(auth_store: Dict[str, Any], provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return a provider's persisted state.\n\n In profile mode, falls back to the global-root ``auth.json`` when the\n profile has no entry for ``provider_id``. This mirrors the per-provider\n shadowing already used by ``read_credential_pool``: workers spawned in a\n profile can see providers (e.g. ``nous``) that were only authenticated at\n global scope. Once the user runs ``arcen auth login <provider>`` inside\n the profile, the profile state fully shadows the global state on the next\n read. See issue #18594 follow-up.\n \"\"\"\n providers = auth_store.get(\"providers\")\n if isinstance(providers, dict):\n state = providers.get(provider_id)\n if isinstance(state, dict):\n return dict(state)\n\n # Read-only fallback to the global-root auth store (profile mode only;\n # returns empty dict in classic mode so this is a no-op).\n global_store = _load_global_auth_store()\n if global_store:\n global_providers = global_store.get(\"providers\")\n if isinstance(global_providers, dict):\n global_state = global_providers.get(provider_id)\n if isinstance(global_state, dict):\n return dict(global_state)\n return None\n\n\ndef _save_provider_state(auth_store: Dict[str, Any], provider_id: str, state: Dict[str, Any]) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n auth_store[\"active_provider\"] = provider_id\n\n\ndef _store_provider_state(\n auth_store: Dict[str, Any],\n provider_id: str,\n state: Dict[str, Any],\n *,\n set_active: bool = True,\n) -> None:\n providers = auth_store.setdefault(\"providers\", {})\n if not isinstance(providers, dict):\n auth_store[\"providers\"] = {}\n providers = auth_store[\"providers\"]\n providers[provider_id] = state\n if set_active:\n auth_store[\"active_provider\"] = provider_id\n\n\ndef is_known_auth_provider(provider_id: str) -> bool:\n normalized = (provider_id or \"\").strip().lower()\n return normalized in PROVIDER_REGISTRY or normalized in SERVICE_PROVIDER_NAMES\n\n\ndef get_auth_provider_display_name(provider_id: str) -> str:\n normalized = (provider_id or \"\").strip().lower()\n if normalized in PROVIDER_REGISTRY:\n return PROVIDER_REGISTRY[normalized].name\n return SERVICE_PROVIDER_NAMES.get(normalized, provider_id)\n\n\ndef read_credential_pool(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Return the persisted credential pool, or one provider slice.\n\n In profile mode, the profile's credential pool is authoritative. If a\n provider has no entries in the profile, entries from the global-root\n ``auth.json`` are used as a read-only fallback — so workers spawned in a\n profile can see providers that were only authenticated at global scope.\n\n Profile entries always win: the global fallback only applies per-provider\n when the profile has zero entries for that provider. Once the user runs\n ``arcen auth add <provider>`` inside the profile, profile entries\n fully shadow global for that provider on the next read.\n\n Writes always go to the profile (``write_credential_pool`` is unchanged).\n See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n\n global_pool: Dict[str, Any] = {}\n global_store = _load_global_auth_store()\n maybe_global_pool = global_store.get(\"credential_pool\") if global_store else None\n if isinstance(maybe_global_pool, dict):\n global_pool = maybe_global_pool\n\n if provider_id is None:\n merged = dict(pool)\n for gp_key, gp_entries in global_pool.items():\n if not isinstance(gp_entries, list) or not gp_entries:\n continue\n # Per-provider shadowing: profile wins whenever it has ANY entries.\n existing = merged.get(gp_key)\n if isinstance(existing, list) and existing:\n continue\n merged[gp_key] = list(gp_entries)\n return merged\n\n provider_entries = pool.get(provider_id)\n if isinstance(provider_entries, list) and provider_entries:\n return list(provider_entries)\n # Profile has no entries for this provider — fall back to global.\n global_entries = global_pool.get(provider_id)\n return list(global_entries) if isinstance(global_entries, list) else []\n\n\ndef write_credential_pool(provider_id: str, entries: List[Dict[str, Any]]) -> Path:\n \"\"\"Persist one provider's credential pool under auth.json.\n\n This is the final disk-boundary guard for borrowed/reference-only\n credentials. Callers may pass raw dictionaries, so sanitize here even when\n ``PooledCredential.to_dict()`` already did the same work upstream.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n pool[provider_id] = [\n sanitize_borrowed_credential_payload(entry, provider_id)\n if isinstance(entry, dict) else entry\n for entry in entries\n ]\n return _save_auth_store(auth_store)\n\n\ndef suppress_credential_source(provider_id: str, source: str) -> None:\n \"\"\"Mark a credential source as suppressed so it won't be re-seeded.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.setdefault(\"suppressed_sources\", {})\n provider_list = suppressed.setdefault(provider_id, [])\n if source not in provider_list:\n provider_list.append(source)\n _save_auth_store(auth_store)\n\n\ndef is_source_suppressed(provider_id: str, source: str) -> bool:\n \"\"\"Check if a credential source has been suppressed by the user.\"\"\"\n try:\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\", {})\n return source in suppressed.get(provider_id, [])\n except Exception:\n return False\n\n\ndef unsuppress_credential_source(provider_id: str, source: str) -> bool:\n \"\"\"Clear a suppression marker so the source will be re-seeded on the next load.\n\n Returns True if a marker was cleared, False if no marker existed.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n suppressed = auth_store.get(\"suppressed_sources\")\n if not isinstance(suppressed, dict):\n return False\n provider_list = suppressed.get(provider_id)\n if not isinstance(provider_list, list) or source not in provider_list:\n return False\n provider_list.remove(source)\n if not provider_list:\n suppressed.pop(provider_id, None)\n if not suppressed:\n auth_store.pop(\"suppressed_sources\", None)\n _save_auth_store(auth_store)\n return True\n\n\ndef get_provider_auth_state(provider_id: str) -> Optional[Dict[str, Any]]:\n \"\"\"Return persisted auth state for a provider, or None.\n\n In profile mode, ``_load_provider_state`` already falls back to the\n global-root ``auth.json`` per-provider when the profile has no entry —\n so this is now a thin convenience wrapper. Profile state always wins\n when present. Writes (``_save_auth_store`` / ``persist_*_credentials``)\n are unchanged — they still target the profile only. This mirrors\n ``read_credential_pool``'s per-provider shadowing semantics so that\n ``_seed_from_singletons`` can reseed a profile's credential pool from\n global-scope provider state (e.g. a globally-authenticated Anthropic\n OAuth or Nous device-code session). See issue #18594 follow-up.\n \"\"\"\n auth_store = _load_auth_store()\n return _load_provider_state(auth_store, provider_id)\n\n\ndef get_active_provider() -> Optional[str]:\n \"\"\"Return the currently active provider ID from auth store.\"\"\"\n auth_store = _load_auth_store()\n return auth_store.get(\"active_provider\")\n\n\ndef is_provider_explicitly_configured(provider_id: str) -> bool:\n \"\"\"Return True only if the user has explicitly configured this provider.\n\n Checks:\n 1. active_provider in auth.json matches\n 2. model.provider in config.yaml matches\n 3. Provider-specific env vars are set (e.g. ANTHROPIC_API_KEY)\n\n This is used to gate auto-discovery of external credentials (e.g.\n Claude Code's ~/.claude/.credentials.json) so they are never used\n without the user's explicit choice. See PR #4210 for the same\n pattern applied to the setup wizard gate.\n \"\"\"\n normalized = (provider_id or \"\").strip().lower()\n\n # 1. Check auth.json active_provider\n try:\n auth_store = _load_auth_store()\n active = (auth_store.get(\"active_provider\") or \"\").strip().lower()\n if active and active == normalized:\n return True\n except Exception:\n pass\n\n # 2. Check config.yaml model.provider\n try:\n from arcen_cli.config import load_config\n cfg = load_config()\n model_cfg = cfg.get(\"model\")\n if isinstance(model_cfg, dict):\n cfg_provider = (model_cfg.get(\"provider\") or \"\").strip().lower()\n if cfg_provider == normalized:\n return True\n except Exception:\n pass\n\n # 3. Check provider-specific env vars\n # Exclude CLAUDE_CODE_OAUTH_TOKEN — it's set by Claude Code itself,\n # not by the user explicitly configuring anthropic in Arcen.\n _IMPLICIT_ENV_VARS = {\"CLAUDE_CODE_OAUTH_TOKEN\"}\n pconfig = PROVIDER_REGISTRY.get(normalized)\n if pconfig and pconfig.auth_type == \"api_key\":\n for env_var in pconfig.api_key_env_vars:\n if env_var in _IMPLICIT_ENV_VARS:\n continue\n if has_usable_secret(os.getenv(env_var, \"\")):\n return True\n\n return False\n\n\ndef clear_provider_auth(provider_id: Optional[str] = None) -> bool:\n \"\"\"\n Clear auth state for a provider. Used by `arcen logout`.\n If provider_id is None, clears the active provider.\n Returns True if something was cleared.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n target = provider_id or auth_store.get(\"active_provider\")\n if not target:\n return False\n\n providers = auth_store.get(\"providers\", {})\n if not isinstance(providers, dict):\n providers = {}\n auth_store[\"providers\"] = providers\n\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n pool = {}\n auth_store[\"credential_pool\"] = pool\n\n cleared = False\n if target in providers:\n del providers[target]\n cleared = True\n if target in pool:\n del pool[target]\n cleared = True\n\n if auth_store.get(\"active_provider\") == target:\n auth_store[\"active_provider\"] = None\n cleared = True\n\n if not cleared:\n return False\n _save_auth_store(auth_store)\n return True\n\n\ndef deactivate_provider() -> None:\n \"\"\"\n Clear active_provider in auth.json without deleting credentials.\n Used when the user switches to a non-OAuth provider (OpenRouter, custom)\n so auto-resolution doesn't keep picking the OAuth provider.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = None\n _save_auth_store(auth_store)\n\n\n# =============================================================================\n# Provider Resolution — picks which provider to use\n# =============================================================================\n\n\ndef _get_config_hint_for_unknown_provider(provider_name: str) -> str:\n \"\"\"Return a helpful hint string when provider resolution fails.\n\n Checks for common config.yaml mistakes (malformed custom_providers, etc.)\n and returns a human-readable diagnostic, or empty string if nothing found.\n \"\"\"\n try:\n from arcen_cli.config import validate_config_structure\n issues = validate_config_structure()\n if not issues:\n return \"\"\n\n lines = [\"Config issue detected — run 'arcen doctor' for full diagnostics:\"]\n for ci in issues:\n prefix = \"ERROR\" if ci.severity == \"error\" else \"WARNING\"\n lines.append(f\" [{prefix}] {ci.message}\")\n # Show first line of hint\n first_hint = ci.hint.splitlines()[0] if ci.hint else \"\"\n if first_hint:\n lines.append(f\" → {first_hint}\")\n return \"\\n\".join(lines)\n except Exception:\n return \"\"\n\n\ndef resolve_provider(\n requested: Optional[str] = None,\n *,\n explicit_api_key: Optional[str] = None,\n explicit_base_url: Optional[str] = None,\n) -> str:\n \"\"\"\n Determine which inference provider to use.\n\n Priority (when requested=\"auto\" or None):\n 1. active_provider in auth.json with valid credentials\n 2. Explicit CLI api_key/base_url -> \"openrouter\"\n 3. OPENAI_API_KEY or OPENROUTER_API_KEY env vars -> \"openrouter\"\n 4. Provider-specific API keys (GLM, Kimi, MiniMax) -> that provider\n 5. Fallback: \"openrouter\"\n \"\"\"\n normalized = (requested or \"auto\").strip().lower()\n\n # Normalize provider aliases\n _PROVIDER_ALIASES = {\n \"glm\": \"zai\", \"z-ai\": \"zai\", \"z.ai\": \"zai\", \"zhipu\": \"zai\",\n \"google\": \"gemini\", \"google-gemini\": \"gemini\", \"google-ai-studio\": \"gemini\",\n \"x-ai\": \"xai\", \"x.ai\": \"xai\", \"grok\": \"xai\",\n \"xai-oauth\": \"xai-oauth\", \"x-ai-oauth\": \"xai-oauth\",\n \"grok-oauth\": \"xai-oauth\", \"xai-grok-oauth\": \"xai-oauth\",\n \"kimi\": \"kimi-coding\", \"kimi-for-coding\": \"kimi-coding\", \"moonshot\": \"kimi-coding\",\n \"kimi-cn\": \"kimi-coding-cn\", \"moonshot-cn\": \"kimi-coding-cn\",\n \"step\": \"stepfun\", \"stepfun-coding-plan\": \"stepfun\",\n \"arcee-ai\": \"arcee\", \"arceeai\": \"arcee\",\n \"gmi-cloud\": \"gmi\", \"gmicloud\": \"gmi\",\n \"minimax-china\": \"minimax-cn\", \"minimax_cn\": \"minimax-cn\",\n \"minimax-portal\": \"minimax-oauth\", \"minimax-global\": \"minimax-oauth\", \"minimax_oauth\": \"minimax-oauth\",\n \"alibaba_coding\": \"alibaba-coding-plan\", \"alibaba-coding\": \"alibaba-coding-plan\",\n \"alibaba_coding_plan\": \"alibaba-coding-plan\",\n \"claude\": \"anthropic\", \"claude-code\": \"anthropic\",\n \"github\": \"copilot\", \"github-copilot\": \"copilot\",\n \"github-models\": \"copilot\", \"github-model\": \"copilot\",\n \"github-copilot-acp\": \"copilot-acp\", \"copilot-acp-agent\": \"copilot-acp\",\n \"opencode\": \"opencode-zen\", \"zen\": \"opencode-zen\",\n \"qwen-portal\": \"qwen-oauth\", \"qwen-cli\": \"qwen-oauth\", \"qwen-oauth\": \"qwen-oauth\", \"google-gemini-cli\": \"google-gemini-cli\", \"gemini-cli\": \"google-gemini-cli\", \"gemini-oauth\": \"google-gemini-cli\",\n \"hf\": \"huggingface\", \"hugging-face\": \"huggingface\", \"huggingface-hub\": \"huggingface\",\n \"mimo\": \"xiaomi\", \"xiaomi-mimo\": \"xiaomi\",\n \"tencent\": \"tencent-tokenhub\", \"tokenhub\": \"tencent-tokenhub\",\n \"tencent-cloud\": \"tencent-tokenhub\", \"tencentmaas\": \"tencent-tokenhub\",\n \"aws\": \"bedrock\", \"aws-bedrock\": \"bedrock\", \"amazon-bedrock\": \"bedrock\", \"amazon\": \"bedrock\",\n \"go\": \"opencode-go\", \"opencode-go-sub\": \"opencode-go\",\n \"kilo\": \"kilocode\", \"kilo-code\": \"kilocode\", \"kilo-gateway\": \"kilocode\",\n \"lmstudio\": \"lmstudio\", \"lm-studio\": \"lmstudio\", \"lm_studio\": \"lmstudio\",\n # Local server aliases — route through the generic custom provider\n \"ollama\": \"custom\", \"ollama_cloud\": \"ollama-cloud\",\n \"vllm\": \"custom\", \"llamacpp\": \"custom\",\n \"llama.cpp\": \"custom\", \"llama-cpp\": \"custom\",\n }\n # Extend with aliases declared in plugins/model-providers/<name>/ that aren't already mapped.\n # This keeps providers/ as the single source for new aliases while the\n # hardcoded dict above remains authoritative for existing ones.\n try:\n from providers import list_providers as _lp\n for _pp in _lp():\n for _alias in _pp.aliases:\n if _alias not in _PROVIDER_ALIASES:\n _PROVIDER_ALIASES[_alias] = _pp.name\n except Exception:\n pass\n normalized = _PROVIDER_ALIASES.get(normalized, normalized)\n\n if normalized == \"openrouter\":\n return \"openrouter\"\n if normalized == \"custom\":\n return \"custom\"\n if normalized in PROVIDER_REGISTRY:\n return normalized\n if normalized != \"auto\":\n # Check for common config.yaml issues that cause this error\n _config_hint = _get_config_hint_for_unknown_provider(normalized)\n msg = f\"Unknown provider '{normalized}'.\"\n if _config_hint:\n msg += f\"\\n\\n{_config_hint}\"\n else:\n msg += \" Check 'arcen model' for available providers, or run 'arcen doctor' to diagnose config issues.\"\n raise AuthError(msg, code=\"invalid_provider\")\n\n # Explicit one-off CLI creds always mean openrouter/custom\n if explicit_api_key or explicit_base_url:\n return \"openrouter\"\n\n # Check auth store for an active OAuth provider\n try:\n auth_store = _load_auth_store()\n active = auth_store.get(\"active_provider\")\n if active and active in PROVIDER_REGISTRY:\n status = get_auth_status(active)\n if status.get(\"logged_in\"):\n return active\n except Exception as e:\n logger.debug(\"Could not detect active auth provider: %s\", e)\n\n if has_usable_secret(os.getenv(\"OPENAI_API_KEY\")) or has_usable_secret(os.getenv(\"OPENROUTER_API_KEY\")):\n return \"openrouter\"\n\n # Auto-detect API-key providers by checking their env vars\n for pid, pconfig in PROVIDER_REGISTRY.items():\n if pconfig.auth_type != \"api_key\":\n continue\n # GitHub tokens are commonly present for repo/tool access but should not\n # hijack inference auto-selection unless the user explicitly chooses\n # Copilot/GitHub Models as the provider. LM Studio is a local server\n # whose availability isn't implied by LM_API_KEY presence (it may be\n # offline, and the no-auth setup uses a placeholder value), so it\n # also requires explicit selection.\n if pid in {\"copilot\", \"lmstudio\"}:\n continue\n for env_var in pconfig.api_key_env_vars:\n if has_usable_secret(os.getenv(env_var, \"\")):\n return pid\n\n # AWS Bedrock — detect via boto3 credential chain (IAM roles, SSO, env vars).\n # This runs after API-key providers so explicit keys always win.\n try:\n from agent.bedrock_adapter import has_aws_credentials\n if has_aws_credentials():\n return \"bedrock\"\n except ImportError:\n pass # boto3 not installed — skip Bedrock auto-detection\n\n raise AuthError(\n \"No inference provider configured. Run 'arcen model' to choose a \"\n \"provider and model, or set an API key (OPENROUTER_API_KEY, \"\n \"OPENAI_API_KEY, etc.) in ~/.arcen/.env.\",\n code=\"no_provider_configured\",\n )\n\n\n# =============================================================================\n# Timestamp / TTL helpers\n# =============================================================================\n\ndef _parse_iso_timestamp(value: Any) -> Optional[float]:\n if not isinstance(value, str) or not value:\n return None\n text = value.strip()\n if not text:\n return None\n if text.endswith(\"Z\"):\n text = text[:-1] + \"+00:00\"\n try:\n parsed = datetime.fromisoformat(text)\n except Exception:\n return None\n if parsed.tzinfo is None:\n parsed = parsed.replace(tzinfo=timezone.utc)\n return parsed.timestamp()\n\n\ndef _is_expiring(expires_at_iso: Any, skew_seconds: int) -> bool:\n expires_epoch = _parse_iso_timestamp(expires_at_iso)\n if expires_epoch is None:\n return True\n return expires_epoch <= (time.time() + skew_seconds)\n\n\ndef _coerce_ttl_seconds(expires_in: Any) -> int:\n try:\n ttl = int(expires_in)\n except Exception:\n ttl = 0\n return max(0, ttl)\n\n\ndef _optional_base_url(value: Any) -> Optional[str]:\n if not isinstance(value, str):\n return None\n cleaned = value.strip().rstrip(\"/\")\n return cleaned if cleaned else None\n\n\n# Allowlist of hosts the Nous Portal proxy is willing to forward inference\n# JWTs to. Sending a bearer anywhere else would leak it.\n#\n# This is consulted only for URLs coming from the NETWORK side (Portal\n# refresh responses). User-controlled env-var overrides\n# (NOUS_INFERENCE_BASE_URL) bypass validation — that's the documented\n# dev/staging escape hatch and the env source is already trusted (the\n# user set it themselves).\n_ALLOWED_NOUS_INFERENCE_HOSTS: FrozenSet[str] = frozenset({\n \"inference-api.nousresearch.com\",\n})\n\n\ndef _validate_nous_inference_url_from_network(url: Optional[str]) -> Optional[str]:\n \"\"\"Validate a Portal-returned inference URL against the host allowlist.\n\n Returns ``url`` (normalised by stripping trailing slashes) if it's a\n well-formed ``https://<allowlisted-host>/...`` URL. Returns ``None``\n if the URL is missing, malformed, non-https, or points at an\n unexpected host — letting the caller fall back to the configured\n default rather than persist or forward a poisoned value.\n\n Defense-in-depth: a compromised refresh response from the Portal API\n (MITM, malicious response injection) could otherwise redirect every\n subsequent proxy request — bearing the user's inference JWT — to an\n attacker-controlled endpoint.\n Validating scheme + host at the source closes that loop before the\n poisoned URL ever lands in ``auth.json``.\n\n The env-var override path (``NOUS_INFERENCE_BASE_URL``) bypasses\n this — env values come from the trusted OS user, not from the\n network, and the override is documented for staging/dev use.\n\n Co-authored-by: memosr <mehmet.sr35@gmail.com>\n \"\"\"\n if not isinstance(url, str):\n return None\n cleaned = url.strip()\n if not cleaned:\n return None\n try:\n parsed = urlparse(cleaned)\n except Exception:\n return None\n if parsed.scheme != \"https\":\n logger.warning(\n \"nous: refusing non-https inference URL scheme %r from Portal response\",\n parsed.scheme,\n )\n return None\n if parsed.hostname not in _ALLOWED_NOUS_INFERENCE_HOSTS:\n logger.warning(\n \"nous: refusing inference URL host %r from Portal response \"\n \"(not in allowlist); falling back to default\",\n parsed.hostname,\n )\n return None\n return cleaned.rstrip(\"/\")\n\n\ndef _decode_jwt_claims(token: Any) -> Dict[str, Any]:\n if not isinstance(token, str) or token.count(\".\") != 2:\n return {}\n payload = token.split(\".\")[1]\n payload += \"=\" * ((4 - len(payload) % 4) % 4)\n try:\n raw = base64.urlsafe_b64decode(payload.encode(\"utf-8\"))\n claims = json.loads(raw.decode(\"utf-8\"))\n except Exception:\n return {}\n return claims if isinstance(claims, dict) else {}\n\n\ndef _scope_values(raw_scope: Any) -> set[str]:\n # OAuth token responses normally return a space-separated string. Keep\n # collection support for JWT ``scp`` claims and older stored test fixtures.\n scopes: set[str] = set()\n if isinstance(raw_scope, str):\n for part in raw_scope.replace(\",\", \" \").split():\n cleaned = part.strip()\n if cleaned:\n scopes.add(cleaned)\n elif isinstance(raw_scope, (list, tuple, set, frozenset)):\n for item in raw_scope:\n if isinstance(item, str):\n scopes.update(_scope_values(item))\n return scopes\n\n\ndef _nous_invoke_jwt_status(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = NOUS_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> Optional[str]:\n \"\"\"Return None when the token can be used for inference, else a reason.\"\"\"\n claims = _decode_jwt_claims(token)\n if not claims:\n return \"access_token_not_jwt\"\n scopes = (\n _scope_values(scope)\n | _scope_values(claims.get(\"scope\"))\n | _scope_values(claims.get(\"scp\"))\n )\n if NOUS_INFERENCE_INVOKE_SCOPE not in scopes:\n return \"missing_inference_invoke_scope\"\n exp = claims.get(\"exp\")\n skew = max(0, int(min_ttl_seconds))\n if isinstance(exp, (int, float)):\n if float(exp) <= (time.time() + skew):\n return \"invoke_jwt_expiring\"\n return None\n if _is_expiring(expires_at, skew):\n return \"invoke_jwt_expiry_unknown_or_expiring\"\n return None\n\n\ndef _nous_invoke_jwt_is_usable(\n token: Any,\n *,\n scope: Any = None,\n expires_at: Any = None,\n min_ttl_seconds: int = NOUS_INVOKE_JWT_MIN_TTL_SECONDS,\n) -> bool:\n return (\n _nous_invoke_jwt_status(\n token,\n scope=scope,\n expires_at=expires_at,\n min_ttl_seconds=min_ttl_seconds,\n )\n is None\n )\n\n\ndef _assert_nous_inference_jwt_usable(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n) -> None:\n token = state.get(\"access_token\") if access_token is None else access_token\n reason = _nous_invoke_jwt_status(\n token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if reason is None:\n return\n raise AuthError(\n \"Nous Portal access token is not a usable inference JWT \"\n f\"({reason}). Re-authenticate with: arcen auth add nous\",\n provider=\"nous\",\n code=reason,\n relogin_required=True,\n )\n\n\ndef _log_nous_invoke_jwt_selected(\n *,\n access_token: Any,\n sequence_id: Optional[str] = None,\n) -> None:\n logger.info(\"Nous inference auth: using NAS invoke JWT\")\n _oauth_trace(\n \"nous_invoke_jwt_selected\",\n sequence_id=sequence_id,\n access_token_fp=_token_fingerprint(access_token),\n )\n\n\ndef _nous_jwt_expires_at(token: Any, fallback_expires_at: Any = None) -> Optional[str]:\n claims = _decode_jwt_claims(token)\n exp = claims.get(\"exp\")\n if isinstance(exp, (int, float)):\n try:\n return datetime.fromtimestamp(float(exp), tz=timezone.utc).isoformat()\n except Exception:\n pass\n return fallback_expires_at if isinstance(fallback_expires_at, str) else None\n\n\ndef _set_nous_agent_key_from_invoke_jwt(\n state: Dict[str, Any],\n *,\n obtained_at: Optional[str] = None,\n) -> None:\n access_token = state.get(\"access_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n return\n now = datetime.now(timezone.utc)\n existing_obtained_at = state.get(\"agent_key_obtained_at\")\n if obtained_at:\n effective_obtained_at = obtained_at\n elif (\n state.get(\"agent_key\") == access_token\n and isinstance(existing_obtained_at, str)\n and existing_obtained_at.strip()\n ):\n effective_obtained_at = existing_obtained_at\n else:\n effective_obtained_at = now.isoformat()\n expires_at = _nous_jwt_expires_at(access_token, state.get(\"expires_at\"))\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"expires_in\"))\n )\n if expires_at:\n state[\"expires_at\"] = expires_at\n state[\"expires_in\"] = expires_in\n state[\"agent_key\"] = access_token\n state[\"agent_key_id\"] = None\n state[\"agent_key_expires_at\"] = expires_at\n state[\"agent_key_expires_in\"] = expires_in\n state[\"agent_key_reused\"] = False\n state[\"agent_key_obtained_at\"] = effective_obtained_at\n\n\ndef _select_nous_invoke_jwt(\n state: Dict[str, Any],\n *,\n access_token: Any = None,\n sequence_id: Optional[str] = None,\n) -> None:\n if isinstance(access_token, str) and access_token.strip():\n state[\"access_token\"] = access_token\n _set_nous_agent_key_from_invoke_jwt(state)\n _log_nous_invoke_jwt_selected(\n access_token=state.get(\"access_token\"),\n sequence_id=sequence_id,\n )\n\n\n_NOUS_EFFECTIVE_STATE_IGNORED_KEYS = frozenset({\n # These are derived from expires_at/JWT exp and naturally tick down between\n # reads. Persisting only these changes makes auth.json noisy and defeats\n # the mtime-keyed auth-status cache.\n \"expires_in\",\n \"agent_key_expires_in\",\n})\n\n\ndef _nous_effective_provider_state(state: Dict[str, Any]) -> Dict[str, Any]:\n return {\n key: value\n for key, value in state.items()\n if key not in _NOUS_EFFECTIVE_STATE_IGNORED_KEYS\n }\n\n\ndef _codex_access_token_is_expiring(access_token: Any, skew_seconds: int) -> bool:\n claims = _decode_jwt_claims(access_token)\n exp = claims.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n\n\ndef _qwen_cli_auth_path() -> Path:\n return Path.home() / \".qwen\" / \"oauth_creds.json\"\n\n\ndef _read_qwen_cli_tokens() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n if not auth_path.exists():\n raise AuthError(\n \"Qwen CLI credentials not found. Run 'qwen auth qwen-oauth' first.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_missing\",\n )\n try:\n data = json.loads(auth_path.read_text(encoding=\"utf-8\"))\n except Exception as exc:\n raise AuthError(\n f\"Failed to read Qwen CLI credentials from {auth_path}: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_read_failed\",\n ) from exc\n if not isinstance(data, dict):\n raise AuthError(\n f\"Invalid Qwen CLI credentials in {auth_path}.\",\n provider=\"qwen-oauth\",\n code=\"qwen_auth_invalid\",\n )\n return data\n\n\ndef _save_qwen_cli_tokens(tokens: Dict[str, Any]) -> Path:\n auth_path = _qwen_cli_auth_path()\n auth_path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(auth_path)\n # Per-process random temp suffix avoids collisions between concurrent\n # writers and stale leftovers from a crashed prior write.\n tmp_path = auth_path.with_name(f\"{auth_path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed tokens\n # at process umask (typically 0o644). See #19673, #21148.\n fd = os.open(\n str(tmp_path),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(tokens, indent=2, sort_keys=True) + \"\\n\")\n fh.flush()\n os.fsync(fh.fileno())\n atomic_replace(tmp_path, auth_path)\n finally:\n try:\n if tmp_path.exists():\n tmp_path.unlink()\n except OSError:\n pass\n return auth_path\n\n\ndef _qwen_access_token_is_expiring(expiry_date_ms: Any, skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS) -> bool:\n try:\n expiry_ms = int(expiry_date_ms)\n except Exception:\n return True\n return (time.time() + max(0, int(skew_seconds))) * 1000 >= expiry_ms\n\n\ndef _refresh_qwen_cli_tokens(tokens: Dict[str, Any], timeout_seconds: float = 20.0) -> Dict[str, Any]:\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Qwen OAuth refresh token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_token_missing\",\n )\n\n try:\n response = httpx.post(\n QWEN_OAUTH_TOKEN_URL,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": QWEN_OAUTH_CLIENT_ID,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh failed: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n body = response.text.strip()\n raise AuthError(\n \"Qwen OAuth refresh failed. Re-run 'qwen auth qwen-oauth'.\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"Qwen OAuth refresh returned invalid JSON: {exc}\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_json\",\n ) from exc\n\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Qwen OAuth refresh response missing access_token.\",\n provider=\"qwen-oauth\",\n code=\"qwen_refresh_invalid_response\",\n )\n\n expires_in = payload.get(\"expires_in\")\n try:\n expires_in_seconds = int(expires_in)\n except Exception:\n expires_in_seconds = 6 * 60 * 60\n\n refreshed = {\n \"access_token\": str(payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(payload.get(\"refresh_token\", refresh_token) or refresh_token).strip(),\n \"token_type\": str(payload.get(\"token_type\", tokens.get(\"token_type\", \"Bearer\")) or \"Bearer\").strip() or \"Bearer\",\n \"resource_url\": str(payload.get(\"resource_url\", tokens.get(\"resource_url\", \"portal.qwen.ai\")) or \"portal.qwen.ai\").strip(),\n \"expiry_date\": int(time.time() * 1000) + max(1, expires_in_seconds) * 1000,\n }\n _save_qwen_cli_tokens(refreshed)\n return refreshed\n\n\ndef _mark_qwen_oauth_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to qwen-oauth in auth.json.\n\n Qwen OAuth tokens live in the Qwen CLI credential file managed by\n _save_qwen_cli_tokens / resolve_qwen_runtime_credentials. This function\n only writes a minimal provider-state entry (base_url for display) and\n sets active_provider so that get_active_provider() and\n _model_section_has_credentials() detect the provider for the setup wizard\n and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"base_url\"):\n state[\"base_url\"] = str(creds[\"base_url\"])\n _save_provider_state(auth_store, \"qwen-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_qwen_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = QWEN_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n tokens = _read_qwen_cli_tokens()\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _qwen_access_token_is_expiring(tokens.get(\"expiry_date\"), refresh_skew_seconds)\n if should_refresh:\n tokens = _refresh_qwen_cli_tokens(tokens)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Qwen OAuth access token missing. Re-run 'qwen auth qwen-oauth'.\",\n provider=\"qwen-oauth\",\n code=\"qwen_access_token_missing\",\n )\n\n base_url = os.getenv(\"ARCEN_QWEN_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_QWEN_BASE_URL\n return {\n \"provider\": \"qwen-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"qwen-cli\",\n \"expires_at_ms\": tokens.get(\"expiry_date\"),\n \"auth_file\": str(_qwen_cli_auth_path()),\n }\n\n\ndef get_qwen_auth_status() -> Dict[str, Any]:\n auth_path = _qwen_cli_auth_path()\n try:\n # Validate the runtime credentials, including refresh when the cached\n # CLI token is expired. Otherwise stale tokens show up as \"logged in\"\n # and `arcen model` walks users into a broken Qwen setup flow.\n creds = resolve_qwen_runtime_credentials(refresh_if_expiring=True)\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n \"expires_at_ms\": creds.get(\"expires_at_ms\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": str(exc),\n }\n\n\n# =============================================================================\n# Google Gemini OAuth (google-gemini-cli) — PKCE flow + Cloud Code Assist.\n#\n# Tokens live in ~/.arcen/auth/google_oauth.json (managed by agent.google_oauth).\n# The `base_url` here is the marker \"cloudcode-pa://google\" that run_agent.py\n# uses to construct a GeminiCloudCodeClient instead of the default OpenAI SDK.\n# Actual HTTP traffic goes to https://cloudcode-pa.googleapis.com/v1internal:*.\n# =============================================================================\n\ndef _mark_google_gemini_cli_active(creds: Dict[str, Any]) -> None:\n \"\"\"Set active_provider to google-gemini-cli in auth.json.\n\n The actual OAuth tokens live in the Google credential file managed by\n agent.google_oauth. This function only writes a minimal provider-state\n entry (email for display) and sets active_provider so that\n get_active_provider() and _model_section_has_credentials() detect the\n provider for the setup wizard and status commands.\n \"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state: Dict[str, Any] = {}\n if creds.get(\"email\"):\n state[\"email\"] = str(creds[\"email\"])\n _save_provider_state(auth_store, \"google-gemini-cli\", state)\n _save_auth_store(auth_store)\n\n\ndef resolve_gemini_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime OAuth creds for google-gemini-cli.\"\"\"\n try:\n from agent.google_oauth import (\n GoogleOAuthError,\n _credentials_path,\n get_valid_access_token,\n load_credentials,\n )\n except ImportError as exc:\n raise AuthError(\n f\"agent.google_oauth is not importable: {exc}\",\n provider=\"google-gemini-cli\",\n code=\"google_oauth_module_missing\",\n ) from exc\n\n try:\n access_token = get_valid_access_token(force_refresh=force_refresh)\n except GoogleOAuthError as exc:\n raise AuthError(\n str(exc),\n provider=\"google-gemini-cli\",\n code=exc.code,\n ) from exc\n\n creds = load_credentials()\n base_url = DEFAULT_GEMINI_CLOUDCODE_BASE_URL\n return {\n \"provider\": \"google-gemini-cli\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"google-oauth\",\n \"expires_at_ms\": (creds.expires_ms if creds else None),\n \"auth_file\": str(_credentials_path()),\n \"email\": (creds.email if creds else \"\") or \"\",\n \"project_id\": (creds.project_id if creds else \"\") or \"\",\n }\n\n\ndef get_gemini_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return a status dict for `arcen auth list` / `arcen status`.\"\"\"\n try:\n from agent.google_oauth import _credentials_path, load_credentials\n except ImportError:\n return {\"logged_in\": False, \"error\": \"agent.google_oauth unavailable\"}\n auth_path = _credentials_path()\n creds = load_credentials()\n if creds is None or not creds.access_token:\n return {\n \"logged_in\": False,\n \"auth_file\": str(auth_path),\n \"error\": \"not logged in\",\n }\n return {\n \"logged_in\": True,\n \"auth_file\": str(auth_path),\n \"source\": \"google-oauth\",\n \"api_key\": creds.access_token,\n \"expires_at_ms\": creds.expires_ms,\n \"email\": creds.email,\n \"project_id\": creds.project_id,\n }\n# Spotify auth — PKCE tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\n\ndef _spotify_scope_list(raw_scope: Optional[str] = None) -> List[str]:\n scope_text = (raw_scope or DEFAULT_SPOTIFY_SCOPE).strip()\n scopes = [part for part in scope_text.split() if part]\n seen: set[str] = set()\n ordered: List[str] = []\n for scope in scopes:\n if scope not in seen:\n seen.add(scope)\n ordered.append(scope)\n return ordered\n\n\ndef _spotify_scope_string(raw_scope: Optional[str] = None) -> str:\n return \" \".join(_spotify_scope_list(raw_scope))\n\n\ndef _spotify_client_id(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\"),\n get_env_value(\"SPOTIFY_CLIENT_ID\"),\n state.get(\"client_id\") if isinstance(state, dict) else None,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n raise AuthError(\n \"Spotify client_id is required. Set ARCEN_SPOTIFY_CLIENT_ID or pass --client-id.\",\n provider=\"spotify\",\n code=\"spotify_client_id_missing\",\n )\n\n\ndef _spotify_redirect_uri(\n explicit: Optional[str] = None,\n state: Optional[Dict[str, Any]] = None,\n) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n explicit,\n get_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\"),\n get_env_value(\"SPOTIFY_REDIRECT_URI\"),\n state.get(\"redirect_uri\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip()\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_REDIRECT_URI\n\n\ndef _spotify_api_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_API_BASE_URL\"),\n state.get(\"api_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_API_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_API_BASE_URL\n\n\ndef _spotify_accounts_base_url(state: Optional[Dict[str, Any]] = None) -> str:\n from arcen_cli.config import get_env_value\n\n candidates = (\n get_env_value(\"ARCEN_SPOTIFY_ACCOUNTS_BASE_URL\"),\n state.get(\"accounts_base_url\") if isinstance(state, dict) else None,\n DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL,\n )\n for candidate in candidates:\n cleaned = str(candidate or \"\").strip().rstrip(\"/\")\n if cleaned:\n return cleaned\n return DEFAULT_SPOTIFY_ACCOUNTS_BASE_URL\n\n\ndef _spotify_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _spotify_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _oauth_pkce_code_verifier(length: int = 64) -> str:\n raw = base64.urlsafe_b64encode(os.urandom(length)).decode(\"ascii\")\n return raw.rstrip(\"=\")[:128]\n\n\ndef _oauth_pkce_code_challenge(code_verifier: str) -> str:\n digest = hashlib.sha256(code_verifier.encode(\"utf-8\")).digest()\n return base64.urlsafe_b64encode(digest).decode(\"ascii\").rstrip(\"=\")\n\n\ndef _spotify_build_authorize_url(\n *,\n client_id: str,\n redirect_uri: str,\n scope: str,\n state: str,\n code_challenge: str,\n accounts_base_url: str,\n) -> str:\n query = urlencode({\n \"client_id\": client_id,\n \"response_type\": \"code\",\n \"redirect_uri\": redirect_uri,\n \"scope\": scope,\n \"state\": state,\n \"code_challenge_method\": \"S256\",\n \"code_challenge\": code_challenge,\n })\n return f\"{accounts_base_url}/authorize?{query}\"\n\n\ndef _spotify_validate_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"Spotify PKCE redirect_uri must use http://localhost or http://127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host not in {\"127.0.0.1\", \"localhost\"}:\n raise AuthError(\n \"Spotify PKCE redirect_uri must point to localhost or 127.0.0.1.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"Spotify PKCE redirect_uri must include an explicit localhost port.\",\n provider=\"spotify\",\n code=\"spotify_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _make_spotify_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n\n class _SpotifyCallbackHandler(BaseHTTPRequestHandler):\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n result[\"code\"] = params.get(\"code\", [None])[0]\n result[\"state\"] = params.get(\"state\", [None])[0]\n result[\"error\"] = params.get(\"error\", [None])[0]\n result[\"error_description\"] = params.get(\"error_description\", [None])[0]\n\n self.send_response(200)\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if result[\"error\"]:\n body = \"<html><body><h1>Spotify authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>Spotify authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _SpotifyCallbackHandler, result\n\n\ndef _spotify_wait_for_callback(\n redirect_uri: str,\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n host, port, path = _spotify_validate_redirect_uri(redirect_uri)\n handler_cls, result = _make_spotify_callback_handler(path)\n\n class _ReuseHTTPServer(HTTPServer):\n allow_reuse_address = True\n\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n except OSError as exc:\n raise AuthError(\n f\"Could not bind Spotify callback server on {host}:{port}: {exc}\",\n provider=\"spotify\",\n code=\"spotify_callback_bind_failed\",\n ) from exc\n\n thread = threading.Thread(target=server.serve_forever, kwargs={\"poll_interval\": 0.1}, daemon=True)\n thread.start()\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n raise AuthError(\n \"Spotify authorization timed out waiting for the local callback.\",\n provider=\"spotify\",\n code=\"spotify_callback_timeout\",\n )\n\n\ndef _xai_validate_loopback_redirect_uri(redirect_uri: str) -> tuple[str, int, str]:\n parsed = urlparse(redirect_uri)\n if parsed.scheme != \"http\":\n raise AuthError(\n \"xAI OAuth redirect_uri must use http://127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n host = parsed.hostname or \"\"\n if host != XAI_OAUTH_REDIRECT_HOST:\n raise AuthError(\n \"xAI OAuth redirect_uri must point to 127.0.0.1.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n if not parsed.port:\n raise AuthError(\n \"xAI OAuth redirect_uri must include an explicit localhost port.\",\n provider=\"xai-oauth\",\n code=\"xai_redirect_invalid\",\n )\n return host, parsed.port, parsed.path or \"/\"\n\n\ndef _xai_callback_cors_origin(origin: Optional[str]) -> str:\n # CORS allowlist for the loopback callback. Only xAI's own auth origins\n # are accepted; the redirect_uri itself is bound to 127.0.0.1 and gated by\n # PKCE+state, so additional dev/3p origins are not needed here.\n allowed = {\n \"https://accounts.x.ai\",\n \"https://auth.x.ai\",\n }\n return origin if origin in allowed else \"\"\n\n\ndef _make_xai_callback_handler(expected_path: str) -> tuple[type[BaseHTTPRequestHandler], dict[str, Any]]:\n result: dict[str, Any] = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n result_lock = threading.Lock()\n\n class _XAICallbackHandler(BaseHTTPRequestHandler):\n def _maybe_write_cors_headers(self) -> None:\n origin = self.headers.get(\"Origin\")\n allow_origin = _xai_callback_cors_origin(origin)\n if allow_origin:\n self.send_header(\"Access-Control-Allow-Origin\", allow_origin)\n self.send_header(\"Access-Control-Allow-Methods\", \"GET, OPTIONS\")\n self.send_header(\"Access-Control-Allow-Headers\", \"Content-Type\")\n self.send_header(\"Access-Control-Allow-Private-Network\", \"true\")\n self.send_header(\"Vary\", \"Origin\")\n\n def do_OPTIONS(self) -> None: # noqa: N802\n self.send_response(204)\n self._maybe_write_cors_headers()\n self.end_headers()\n\n def do_GET(self) -> None: # noqa: N802\n parsed = urlparse(self.path)\n if parsed.path != expected_path:\n self.send_response(404)\n self.end_headers()\n self.wfile.write(b\"Not found.\")\n return\n\n params = parse_qs(parsed.query)\n incoming = {\n \"code\": params.get(\"code\", [None])[0],\n \"state\": params.get(\"state\", [None])[0],\n \"error\": params.get(\"error\", [None])[0],\n \"error_description\": params.get(\"error_description\", [None])[0],\n }\n\n # Diagnostic logging — emits at INFO so reporters of loopback bugs\n # (#27385 — \"callback received but Arcen times out\") can produce\n # actionable evidence without a code change. Logged values are\n # fingerprints / booleans only; no actual code/state strings leak\n # into the log file. Run with ``ARCEN_LOG_LEVEL=INFO`` (or check\n # ``~/.arcen/logs/agent.log`` which captures INFO+ unconditionally).\n try:\n logger.info(\n \"xAI loopback callback received: path=%s has_code=%s has_state=%s has_error=%s \"\n \"ua=%s\",\n parsed.path,\n incoming[\"code\"] is not None,\n incoming[\"state\"] is not None,\n incoming[\"error\"] is not None,\n (self.headers.get(\"User-Agent\") or \"\")[:80],\n )\n if incoming[\"error\"]:\n logger.info(\n \"xAI loopback callback carries error=%s error_description=%s\",\n incoming[\"error\"],\n (incoming[\"error_description\"] or \"\")[:200],\n )\n except Exception:\n # Logging must never break the OAuth flow.\n pass\n\n # Treat a hit on the callback path with neither `code` nor `error`\n # as a missing OAuth callback (e.g. xAI's auth backend failed to\n # redirect and the user navigated to the bare loopback URL by hand).\n # Show an explicit \"not received\" page rather than the success page —\n # otherwise the browser claims authorization succeeded while the CLI\n # is still waiting for a real callback and eventually times out.\n if incoming[\"code\"] is None and incoming[\"error\"] is None:\n self.send_response(400)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n body = (\n \"<html><body>\"\n \"<h1>xAI authorization not received.</h1>\"\n \"<p>No authorization code was present in this callback URL. \"\n \"Return to the terminal and re-run \"\n \"<code>arcen auth add xai-oauth</code> to retry.</p>\"\n \"</body></html>\"\n )\n self.wfile.write(body.encode(\"utf-8\"))\n return\n\n # ThreadingHTTPServer allows a fallback/manual callback to complete\n # while a browser connection is stuck. Once we have a terminal\n # OAuth result (code or error), keep the first one so a later\n # concurrent/invalid callback cannot overwrite state before\n # validation in _xai_oauth_loopback_login().\n with result_lock:\n if not (result[\"code\"] or result[\"error\"]):\n result.update(incoming)\n\n self.send_response(200)\n self._maybe_write_cors_headers()\n self.send_header(\"Content-Type\", \"text/html; charset=utf-8\")\n self.end_headers()\n if incoming[\"error\"]:\n body = \"<html><body><h1>xAI authorization failed.</h1>You can close this tab.</body></html>\"\n else:\n body = \"<html><body><h1>xAI authorization received.</h1>You can close this tab.</body></html>\"\n self.wfile.write(body.encode(\"utf-8\"))\n\n def log_message(self, format: str, *args: Any) -> None: # noqa: A003\n return\n\n return _XAICallbackHandler, result\n\n\ndef _xai_start_callback_server(\n preferred_port: int = XAI_OAUTH_REDIRECT_PORT,\n) -> tuple[HTTPServer, threading.Thread, dict[str, Any], str]:\n host = XAI_OAUTH_REDIRECT_HOST\n expected_path = XAI_OAUTH_REDIRECT_PATH\n handler_cls, result = _make_xai_callback_handler(expected_path)\n\n class _ReuseHTTPServer(ThreadingHTTPServer):\n allow_reuse_address = True\n daemon_threads = True\n\n ports_to_try = [preferred_port]\n if preferred_port != 0:\n ports_to_try.append(0)\n server = None\n last_error: Optional[OSError] = None\n for port in ports_to_try:\n try:\n server = _ReuseHTTPServer((host, port), handler_cls)\n break\n except OSError as exc:\n last_error = exc\n if server is None:\n raise AuthError(\n f\"Could not bind xAI callback server on {host}:{preferred_port}: {last_error}\",\n provider=\"xai-oauth\",\n code=\"xai_callback_bind_failed\",\n ) from last_error\n\n actual_port = int(server.server_address[1])\n redirect_uri = f\"http://{host}:{actual_port}{expected_path}\"\n thread = threading.Thread(\n target=server.serve_forever,\n kwargs={\"poll_interval\": 0.1},\n daemon=True,\n )\n thread.start()\n return server, thread, result, redirect_uri\n\n\ndef _xai_wait_for_callback(\n server: HTTPServer,\n thread: threading.Thread,\n result: dict[str, Any],\n *,\n timeout_seconds: float = 180.0,\n) -> dict[str, Any]:\n deadline = time.monotonic() + max(5.0, timeout_seconds)\n try:\n while time.monotonic() < deadline:\n if result[\"code\"] or result[\"error\"]:\n return result\n time.sleep(0.1)\n finally:\n server.shutdown()\n server.server_close()\n thread.join(timeout=1.0)\n # Diagnostic: distinguish \"no callback ever arrived\" from \"callback\n # arrived but result wasn't populated\" (#27385). The per-hit handler\n # also logs at INFO; if neither line appears, xAI's IDP never reached\n # the loopback at all (firewall, port-binding, IPv6/IPv4 mismatch).\n logger.info(\n \"xAI loopback wait timed out after %.0fs with no usable callback \"\n \"(result.code=%s result.error=%s)\",\n max(5.0, timeout_seconds),\n result[\"code\"] is not None,\n result[\"error\"] is not None,\n )\n raise AuthError(\n \"xAI authorization timed out waiting for the local callback.\",\n provider=\"xai-oauth\",\n code=\"xai_callback_timeout\",\n )\n\n\ndef _spotify_token_payload_to_state(\n token_payload: Dict[str, Any],\n *,\n client_id: str,\n redirect_uri: str,\n requested_scope: str,\n accounts_base_url: str,\n api_base_url: str,\n previous_state: Optional[Dict[str, Any]] = None,\n) -> Dict[str, Any]:\n now = datetime.now(timezone.utc)\n expires_in = _coerce_ttl_seconds(token_payload.get(\"expires_in\", 0))\n expires_at = datetime.fromtimestamp(now.timestamp() + expires_in, tz=timezone.utc)\n state = dict(previous_state or {})\n state.update({\n \"client_id\": client_id,\n \"redirect_uri\": redirect_uri,\n \"accounts_base_url\": accounts_base_url,\n \"api_base_url\": api_base_url,\n \"scope\": requested_scope,\n \"granted_scope\": str(token_payload.get(\"scope\") or requested_scope).strip(),\n \"token_type\": str(token_payload.get(\"token_type\", \"Bearer\") or \"Bearer\").strip() or \"Bearer\",\n \"access_token\": str(token_payload.get(\"access_token\", \"\") or \"\").strip(),\n \"refresh_token\": str(\n token_payload.get(\"refresh_token\")\n or state.get(\"refresh_token\")\n or \"\"\n ).strip(),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": expires_at.isoformat(),\n \"expires_in\": expires_in,\n \"auth_type\": \"oauth_pkce\",\n })\n return state\n\n\ndef _spotify_exchange_code_for_tokens(\n *,\n client_id: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n accounts_base_url: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"client_id\": client_id,\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"code_verifier\": code_verifier,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token exchange failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token exchange failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_token_exchange_failed\",\n )\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify token response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_token_exchange_invalid\",\n )\n return payload\n\n\ndef _refresh_spotify_oauth_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n if not refresh_token:\n raise AuthError(\n \"Spotify refresh token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_refresh_token_missing\",\n relogin_required=True,\n )\n\n client_id = _spotify_client_id(state=state)\n accounts_base_url = _spotify_accounts_base_url(state)\n try:\n response = httpx.post(\n f\"{accounts_base_url}/api/token\",\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": client_id,\n },\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"Spotify token refresh failed: {exc}\",\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n ) from exc\n\n if response.status_code >= 400:\n detail = response.text.strip()\n raise AuthError(\n \"Spotify token refresh failed. Run `arcen auth spotify` again.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"spotify\",\n code=\"spotify_refresh_failed\",\n relogin_required=True,\n )\n\n payload = response.json()\n if not isinstance(payload, dict) or not str(payload.get(\"access_token\", \"\") or \"\").strip():\n raise AuthError(\n \"Spotify refresh response did not include an access_token.\",\n provider=\"spotify\",\n code=\"spotify_refresh_invalid\",\n relogin_required=True,\n )\n\n return _spotify_token_payload_to_state(\n payload,\n client_id=client_id,\n redirect_uri=_spotify_redirect_uri(state=state),\n requested_scope=str(state.get(\"scope\") or DEFAULT_SPOTIFY_SCOPE),\n accounts_base_url=accounts_base_url,\n api_base_url=_spotify_api_base_url(state),\n previous_state=state,\n )\n\n\ndef resolve_spotify_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = SPOTIFY_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"spotify\")\n if not state:\n raise AuthError(\n \"Spotify is not authenticated. Run `arcen auth spotify` first.\",\n provider=\"spotify\",\n code=\"spotify_auth_missing\",\n relogin_required=True,\n )\n\n should_refresh = bool(force_refresh)\n if not should_refresh and refresh_if_expiring:\n should_refresh = _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds)\n if should_refresh:\n state = _refresh_spotify_oauth_state(state)\n _store_provider_state(auth_store, \"spotify\", state, set_active=False)\n _save_auth_store(auth_store)\n\n access_token = str(state.get(\"access_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"Spotify access token missing. Run `arcen auth spotify` again.\",\n provider=\"spotify\",\n code=\"spotify_access_token_missing\",\n relogin_required=True,\n )\n\n return {\n \"provider\": \"spotify\",\n \"access_token\": access_token,\n \"api_key\": access_token,\n \"token_type\": str(state.get(\"token_type\", \"Bearer\") or \"Bearer\"),\n \"base_url\": _spotify_api_base_url(state),\n \"scope\": str(state.get(\"granted_scope\") or state.get(\"scope\") or \"\").strip(),\n \"client_id\": _spotify_client_id(state=state),\n \"redirect_uri\": _spotify_redirect_uri(state=state),\n \"expires_at\": state.get(\"expires_at\"),\n \"refresh_token\": str(state.get(\"refresh_token\", \"\") or \"\").strip(),\n }\n\n\ndef get_spotify_auth_status() -> Dict[str, Any]:\n state = get_provider_auth_state(\"spotify\")\n if not state:\n return {\"logged_in\": False}\n\n expires_at = state.get(\"expires_at\")\n refresh_token = str(state.get(\"refresh_token\", \"\") or \"\").strip()\n return {\n \"logged_in\": bool(refresh_token or not _is_expiring(expires_at, 0)),\n \"auth_type\": state.get(\"auth_type\", \"oauth_pkce\"),\n \"client_id\": state.get(\"client_id\"),\n \"redirect_uri\": state.get(\"redirect_uri\"),\n \"scope\": state.get(\"granted_scope\") or state.get(\"scope\"),\n \"expires_at\": expires_at,\n \"api_base_url\": state.get(\"api_base_url\"),\n \"has_refresh_token\": bool(refresh_token),\n }\n\n\ndef _spotify_interactive_setup(redirect_uri_hint: str) -> str:\n \"\"\"Walk the user through creating a Spotify developer app, persist the\n resulting client_id to ~/.arcen/.env, and return it.\n\n Raises SystemExit if the user aborts or submits an empty value.\n \"\"\"\n from arcen_cli.config import save_env_value\n\n print()\n print(\"=\" * 70)\n print(\"Spotify first-time setup\")\n print(\"=\" * 70)\n print()\n print(\"Spotify requires every user to register their own lightweight\")\n print(\"developer app. This takes about two minutes and only has to be\")\n print(\"done once per machine.\")\n print()\n print(f\"Full guide: {SPOTIFY_DOCS_URL}\")\n print()\n print(\"Steps:\")\n print(f\" 1. Opening {SPOTIFY_DASHBOARD_URL} in your browser...\")\n print(\" 2. Click 'Create app' and fill in:\")\n print(\" App name: anything (e.g. arcen-agent)\")\n print(\" Description: anything\")\n print(f\" Redirect URI: {redirect_uri_hint}\")\n print(\" API/SDK: Web API\")\n print(\" 3. Agree to the terms, click Save.\")\n print(\" 4. Open the app's Settings page and copy the Client ID.\")\n print(\" 5. Paste it below.\")\n print()\n\n if not _is_remote_session():\n try:\n webbrowser.open(SPOTIFY_DASHBOARD_URL)\n except Exception:\n pass\n\n try:\n raw = input(\"Spotify Client ID: \").strip()\n except (EOFError, KeyboardInterrupt):\n print()\n raise SystemExit(\"Spotify setup cancelled.\")\n\n if not raw:\n print()\n print(f\"No Client ID entered. See {SPOTIFY_DOCS_URL} for the full guide.\")\n raise SystemExit(\"Spotify setup cancelled: empty Client ID.\")\n\n # Persist so subsequent `arcen auth spotify` runs skip the wizard.\n save_env_value(\"ARCEN_SPOTIFY_CLIENT_ID\", raw)\n # Only persist the redirect URI if it's non-default, to avoid pinning\n # users to a value the default might later change to.\n if redirect_uri_hint and redirect_uri_hint != DEFAULT_SPOTIFY_REDIRECT_URI:\n save_env_value(\"ARCEN_SPOTIFY_REDIRECT_URI\", redirect_uri_hint)\n\n print()\n print(\"Saved ARCEN_SPOTIFY_CLIENT_ID to ~/.arcen/.env\")\n print()\n return raw\n\n\ndef login_spotify_command(args) -> None:\n existing_state = get_provider_auth_state(\"spotify\") or {}\n\n # Interactive wizard: if no client_id is configured anywhere, walk the\n # user through creating the Spotify developer app instead of crashing\n # with \"ARCEN_SPOTIFY_CLIENT_ID is required\".\n explicit_client_id = getattr(args, \"client_id\", None)\n try:\n client_id = _spotify_client_id(explicit_client_id, existing_state)\n except AuthError as exc:\n if getattr(exc, \"code\", \"\") != \"spotify_client_id_missing\":\n raise\n client_id = _spotify_interactive_setup(\n redirect_uri_hint=getattr(args, \"redirect_uri\", None) or DEFAULT_SPOTIFY_REDIRECT_URI,\n )\n\n redirect_uri = _spotify_redirect_uri(getattr(args, \"redirect_uri\", None), existing_state)\n scope = _spotify_scope_string(getattr(args, \"scope\", None) or existing_state.get(\"scope\"))\n accounts_base_url = _spotify_accounts_base_url(existing_state)\n api_base_url = _spotify_api_base_url(existing_state)\n open_browser = not getattr(args, \"no_browser\", False)\n\n code_verifier = _spotify_code_verifier()\n code_challenge = _spotify_code_challenge(code_verifier)\n state_nonce = uuid.uuid4().hex\n authorize_url = _spotify_build_authorize_url(\n client_id=client_id,\n redirect_uri=redirect_uri,\n scope=scope,\n state=state_nonce,\n code_challenge=code_challenge,\n accounts_base_url=accounts_base_url,\n )\n\n print(\"Starting Spotify PKCE login...\")\n print(f\"Client ID: {client_id}\")\n print(f\"Redirect URI: {redirect_uri}\")\n print(\"Make sure this redirect URI is allow-listed in your Spotify app settings.\")\n print()\n print(\"Open this URL to authorize Arcen:\")\n print(authorize_url)\n print()\n print(f\"Full setup guide: {SPOTIFY_DOCS_URL}\")\n print()\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=SPOTIFY_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for Spotify authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n callback = _spotify_wait_for_callback(\n redirect_uri,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 180.0),\n )\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise SystemExit(f\"Spotify authorization failed: {detail}\")\n if callback.get(\"state\") != state_nonce:\n raise SystemExit(\"Spotify authorization failed: state mismatch.\")\n\n token_payload = _spotify_exchange_code_for_tokens(\n client_id=client_id,\n code=str(callback.get(\"code\") or \"\"),\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n accounts_base_url=accounts_base_url,\n timeout_seconds=float(getattr(args, \"timeout\", None) or 20.0),\n )\n spotify_state = _spotify_token_payload_to_state(\n token_payload,\n client_id=client_id,\n redirect_uri=redirect_uri,\n requested_scope=scope,\n accounts_base_url=accounts_base_url,\n api_base_url=api_base_url,\n )\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _store_provider_state(auth_store, \"spotify\", spotify_state, set_active=False)\n saved_to = _save_auth_store(auth_store)\n\n print(\"Spotify login successful!\")\n print(f\" Auth state: {saved_to}\")\n print(\" Provider state saved under providers.spotify\")\n print(f\" Docs: {SPOTIFY_DOCS_URL}\")\n\n# =============================================================================\n# SSH / remote session detection\n# =============================================================================\n\ndef _is_remote_session() -> bool:\n \"\"\"Detect environments where loopback OAuth can't reach the local browser.\n\n Historically only SSH was checked, but #26923 surfaced that\n **browser-only remote consoles** (GCP Cloud Shell, GitHub\n Codespaces, AWS EC2 Instance Connect, Gitpod, Replit, etc.) hit\n the exact same problem — the user has a browser on their laptop\n but the loopback listener is bound on the remote VM that the\n laptop's browser can't reach. These environments typically don't\n set ``SSH_CLIENT`` / ``SSH_TTY``, so the SSH-only check left\n them with no guidance and no fallback.\n \"\"\"\n if os.getenv(\"SSH_CLIENT\") or os.getenv(\"SSH_TTY\"):\n return True\n # Browser-only remote IDEs / cloud shells. Keep this list narrow\n # (well-known, documented env vars set by the host platform) so\n # we don't falsely trip on a developer's local shell.\n for var in (\n \"CLOUD_SHELL\", # GCP Cloud Shell\n \"CODESPACES\", # GitHub Codespaces\n \"CODESPACE_NAME\", # GitHub Codespaces (alt)\n \"GITPOD_WORKSPACE_ID\", # Gitpod\n \"REPL_ID\", # Replit\n \"STACKBLITZ\", # StackBlitz\n ):\n if os.getenv(var):\n return True\n return False\n\n\n# Console/text-mode browsers that ``webbrowser`` will happily launch INSIDE\n# the terminal. Opening one of these is worse than not opening anything —\n# it hijacks the user's TTY with an unusable text browser (the xAI OAuth\n# \"Account Management\" page rendered in w3m, reported May 2026) instead of\n# letting them copy the URL to a real browser. When the resolved browser is\n# one of these we refuse to auto-open and fall back to the print-the-URL /\n# manual-paste path, same as a remote session.\n_CONSOLE_BROWSER_NAMES: FrozenSet[str] = frozenset(\n {\n \"w3m\",\n \"lynx\",\n \"links\",\n \"links2\",\n \"elinks\",\n \"www-browser\",\n \"browsh\", # TUI browser — still hijacks the terminal\n }\n)\n\n\ndef _can_open_graphical_browser() -> bool:\n \"\"\"Return True only when a *graphical* browser is likely to open.\n\n ``webbrowser.open()`` resolves to whatever the platform offers, and on a\n headless / CLI-only Linux box with no GUI browser installed that is often\n a text-mode browser (w3m/lynx/links) which launches inside the terminal\n and takes over the user's session. This guard distinguishes \"a real\n windowed browser will pop up\" from \"a console browser will hijack the\n TTY\", so callers can fall back to printing the URL instead.\n\n Heuristics:\n * Respect ``$BROWSER`` — if it names a known console browser, refuse.\n * On Linux, require a display server (``$DISPLAY`` / ``$WAYLAND_DISPLAY``)\n unless ``$BROWSER`` points at something graphical; no display server\n almost always means no GUI browser.\n * Ask ``webbrowser.get()`` what it resolved to and refuse when the\n underlying command is a known console browser.\n * macOS and Windows always have a usable default GUI browser.\n \"\"\"\n import webbrowser as _webbrowser\n\n def _names_console_browser(value: str) -> bool:\n token = value.strip().split()[0] if value.strip() else \"\"\n base = os.path.basename(token).lower()\n return base in _CONSOLE_BROWSER_NAMES\n\n browser_env = os.environ.get(\"BROWSER\", \"\")\n if browser_env and _names_console_browser(browser_env):\n return False\n\n if sys.platform.startswith(\"linux\"):\n has_display = bool(\n os.environ.get(\"DISPLAY\") or os.environ.get(\"WAYLAND_DISPLAY\")\n )\n # An explicit graphical $BROWSER can work without $DISPLAY in odd\n # setups, but a console $BROWSER already returned False above, so the\n # only way to reach here with a $BROWSER set is a graphical one.\n if not has_display and not browser_env:\n return False\n\n try:\n controller = _webbrowser.get()\n except Exception:\n # No browser resolvable at all → definitely don't auto-open.\n return False\n\n candidate = (\n getattr(controller, \"name\", \"\")\n or getattr(controller, \"basename\", \"\")\n or \"\"\n )\n if candidate and _names_console_browser(candidate):\n return False\n\n return True\n\n\ndef _parse_pasted_callback(raw: str) -> dict:\n \"\"\"Parse a pasted callback URL / query string into the loopback shape.\n\n Accepts any of:\n\n * full URL: ``http://127.0.0.1:56121/callback?code=abc&state=xyz``\n * bare query string: ``?code=abc&state=xyz`` or ``code=abc&state=xyz``\n * bare code (no state, only used when the upstream omits state):\n ``abc-the-code-value``\n\n Returns ``{\"code\", \"state\", \"error\", \"error_description\"}`` with\n missing keys set to ``None`` so the loopback callsites can keep\n using the same validation path (state check, error check, etc.)\n they already use for the HTTP server output. Regression for\n #26923 — formalises the curl-the-callback-URL workaround the\n reporter used while waiting for upstream support.\n \"\"\"\n stripped = raw.strip()\n result: dict = {\n \"code\": None,\n \"state\": None,\n \"error\": None,\n \"error_description\": None,\n }\n if not stripped:\n return result\n query = \"\"\n if stripped.startswith((\"http://\", \"https://\")):\n try:\n parsed = urlparse(stripped)\n except Exception:\n return result\n query = parsed.query or \"\"\n elif stripped.startswith(\"?\"):\n query = stripped[1:]\n elif \"=\" in stripped:\n # Looks like a bare query fragment (``code=...&state=...``).\n query = stripped\n else:\n # Treat as a bare opaque code value with no state.\n result[\"code\"] = stripped\n return result\n params = parse_qs(query, keep_blank_values=False)\n for key in (\"code\", \"state\", \"error\", \"error_description\"):\n values = params.get(key)\n if values:\n result[key] = values[0]\n return result\n\n\ndef _prompt_manual_callback_paste(redirect_uri: str) -> dict:\n \"\"\"Read a callback URL from stdin as a fallback for browser-only remotes.\n\n Used when ``--manual-paste`` is set or when the loopback listener\n cannot bind. Returns the parsed callback dict (same shape as the\n HTTP handler output) so the existing state / error validation in\n the caller works unchanged. See #26923.\n \"\"\"\n print()\n print(\"─── Manual callback paste ─────────────────────────────────────\")\n print(\"After approving in your browser, your browser will try to load\")\n print(f\" {redirect_uri}\")\n print(\"which fails (the loopback listener is on this remote machine,\")\n print(\"not on your laptop) — that is expected. Copy the FULL URL\")\n print(\"from your browser's address bar of that failed page and paste\")\n print(\"it below. A bare '?code=...&state=...' fragment also works.\")\n print(\"If the consent page shows the authorization code in-page\")\n print(\"(xAI's current behavior) rather than redirecting, paste the\")\n print(\"bare code value on its own.\")\n print(\"───────────────────────────────────────────────────────────────\")\n try:\n raw = input(\"Callback URL: \")\n except (EOFError, KeyboardInterrupt):\n raw = \"\"\n return _parse_pasted_callback(raw)\n\n\ndef _ssh_user_at_host() -> str:\n \"\"\"Return best-effort 'user@hostname' for the SSH tunnel hint command.\n\n Falls back to placeholder tokens when the values cannot be determined so\n the hint is always syntactically valid even if not copy-pasteable.\n \"\"\"\n try:\n import socket as _socket\n hostname = _socket.gethostname() or \"<this-host>\"\n except OSError:\n hostname = \"<this-host>\"\n user = os.getenv(\"USER\") or os.getenv(\"LOGNAME\") or \"<user>\"\n return f\"{user}@{hostname}\"\n\n\ndef _print_loopback_ssh_hint(redirect_uri: str, *, docs_url: str | None = None) -> None:\n \"\"\"Print an SSH tunnel hint when running a loopback-redirect OAuth flow on a\n remote host. The auth server (xAI, Spotify, ...) will redirect the user's\n browser to ``127.0.0.1:<port>/callback``. If the browser is on a different\n machine than the loopback listener (the usual SSH case), the redirect can't\n reach the listener without a local port forward.\n\n The hint is best-effort: silent if we don't think we're remote, or if we\n can't parse a host/port out of the redirect URI.\n\n Pass ``docs_url`` for a provider-specific guide (e.g. the xAI Grok OAuth\n page); the generic OAuth-over-SSH guide is always shown after it.\n \"\"\"\n if not _is_remote_session():\n return\n try:\n parsed = urlparse(redirect_uri)\n except Exception:\n return\n host = parsed.hostname or \"\"\n port = parsed.port\n if host not in {\"127.0.0.1\", \"::1\", \"localhost\"} or not port:\n return\n divider = \"-\" * 60\n print()\n print(divider)\n print(\"Remote session detected — SSH tunnel required\")\n print(divider)\n print(f\"Arcen is waiting for the OAuth callback on {redirect_uri}\")\n print(\"but your browser is on a different machine. Run this command\")\n print(\"in a NEW terminal on your local machine BEFORE opening the URL:\")\n print()\n print(f\" ssh -N -L {port}:127.0.0.1:{port} {_ssh_user_at_host()}\")\n print()\n print(\"Then open the authorize URL above in your local browser.\")\n print()\n print(\"No SSH client (Cloud Shell / Codespaces / web IDE)? Re-run with\")\n print(\"`--manual-paste` to skip the loopback listener and paste the failed\")\n print(\"callback URL directly.\")\n if docs_url:\n print(f\"Provider docs: {docs_url}\")\n print(f\"SSH/jump-box guide: {OAUTH_OVER_SSH_DOCS_URL}\")\n print(divider)\n print()\n\n\n# =============================================================================\n# OpenAI Codex auth — tokens stored in ~/.arcen/auth.json (not ~/.codex/)\n#\n# Arcen maintains its own Codex OAuth session separate from the Codex CLI\n# and VS Code extension. This prevents refresh token rotation conflicts\n# where one app's refresh invalidates the other's session.\n# =============================================================================\n\ndef _read_codex_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n \"\"\"Read Codex OAuth tokens from Arcen auth store (~/.arcen/auth.json).\n \n Returns dict with 'tokens' (access_token, refresh_token) and 'last_refresh'.\n Raises AuthError if no Codex tokens are stored.\n \"\"\"\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\")\n if not state:\n raise AuthError(\n \"No Codex credentials stored. Run `arcen auth` to authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"Codex auth state is missing tokens. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token.strip():\n raise AuthError(\n \"Codex auth is missing access_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_access_token\",\n relogin_required=True,\n )\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n }\n\n\ndef _sync_codex_pool_entries(\n auth_store: Dict[str, Any],\n tokens: Dict[str, str],\n last_refresh: Optional[str],\n) -> None:\n \"\"\"Mirror a fresh Codex re-auth into the credential_pool OAuth entries.\n\n The runtime selects credentials from ``credential_pool.openai-codex``, not\n from ``providers.openai-codex.tokens``. A re-auth invalidates the prior\n OAuth pair server-side, but pool entries keep holding the now-consumed\n refresh token plus any stale error markers — so the next request spends a\n dead token and gets a 401 ``token_invalidated``.\n\n What gets refreshed:\n\n * ``device_code`` — the singleton-seeded entry written by the device-code\n OAuth flow when the user logged in via ``arcen setup`` / the model\n picker. Always synced with the fresh tokens.\n * ``manual:device_code`` — entries created by ``arcen auth add openai-codex``\n that use the same device-code OAuth mechanism. An interactive re-auth\n proves the user owns the ChatGPT account, so it is safe (and expected)\n to refresh these entries too. Without this, a user who once ran the\n ``arcen auth add`` workaround for #33000 would silently leave that\n manual entry stale on every subsequent re-auth, recreating the issue\n reported in #33538.\n\n What does NOT get refreshed:\n\n * ``manual:api_key`` and any other non-device-code manual sources — those\n are independent credentials (an explicit API key, a different ChatGPT\n account, etc.) and must not be overwritten by a single re-auth.\n\n Error markers (``last_status``, ``last_error_*``) are also cleared on\n every device-code-backed entry — even those whose tokens we did not\n rewrite — so that an interactive re-auth gives every relevant pool entry\n a fresh selection chance instead of leaving them marked unhealthy from a\n pre-re-auth 401.\n \"\"\"\n access_token = tokens.get(\"access_token\")\n if not access_token:\n return\n refresh_token = tokens.get(\"refresh_token\")\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return\n # Sources whose tokens should be rewritten by a fresh Codex device-code\n # OAuth re-auth. ``manual:api_key`` and unknown sources are intentionally\n # excluded — they represent independent credentials.\n REFRESHABLE_SOURCES = {\"device_code\", \"manual:device_code\"}\n for entry in entries:\n if not isinstance(entry, dict):\n continue\n source = entry.get(\"source\")\n if source not in REFRESHABLE_SOURCES:\n continue\n entry[\"access_token\"] = access_token\n if refresh_token:\n entry[\"refresh_token\"] = refresh_token\n if last_refresh:\n entry[\"last_refresh\"] = last_refresh\n entry[\"last_status\"] = None\n entry[\"last_status_at\"] = None\n entry[\"last_error_code\"] = None\n entry[\"last_error_reason\"] = None\n entry[\"last_error_message\"] = None\n entry[\"last_error_reset_at\"] = None\n\n\ndef _save_codex_tokens(tokens: Dict[str, str], last_refresh: str = None, label: str = None) -> None:\n \"\"\"Save Codex OAuth tokens to Arcen auth store (~/.arcen/auth.json).\"\"\"\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"openai-codex\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"chatgpt\"\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n _save_provider_state(auth_store, \"openai-codex\", state)\n _sync_codex_pool_entries(auth_store, tokens, last_refresh)\n _save_auth_store(auth_store)\n\n\ndef refresh_codex_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"Refresh Codex OAuth tokens without mutating Arcen auth state.\"\"\"\n del access_token # Access token is only used by callers to decide whether to refresh.\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"Codex auth is missing refresh_token. Run `arcen auth` to re-authenticate.\",\n provider=\"openai-codex\",\n code=\"codex_auth_missing_refresh_token\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n CODEX_OAUTH_TOKEN_URL,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"refresh_token\": refresh_token,\n \"client_id\": CODEX_OAUTH_CLIENT_ID,\n },\n )\n\n if response.status_code == 429:\n # Upstream rate-limit / usage-quota exhaustion on the token endpoint.\n # The stored refresh token is still valid here — re-authenticating\n # cannot lift a quota cap. Classify distinctly from auth failures so\n # callers surface a \"retry later\" notice instead of a misleading\n # \"run arcen auth\" prompt (see issue #32790).\n retry_after = _parse_retry_after_seconds(getattr(response, \"headers\", None))\n if retry_after is not None:\n message = (\n f\"Codex provider quota exhausted (429); retry after {retry_after}s. \"\n \"Credentials are still valid.\"\n )\n else:\n message = (\n \"Codex provider quota exhausted (429). Credentials are still valid; \"\n \"retry after the usage limit resets.\"\n )\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=CODEX_RATE_LIMITED_CODE,\n relogin_required=False,\n )\n\n if response.status_code != 200:\n code = \"codex_refresh_failed\"\n message = f\"Codex token refresh failed with status {response.status_code}.\"\n relogin_required = False\n try:\n err = response.json()\n if isinstance(err, dict):\n err_obj = err.get(\"error\")\n # OpenAI shape: {\"error\": {\"code\": \"...\", \"message\": \"...\", \"type\": \"...\"}}\n if isinstance(err_obj, dict):\n nested_code = err_obj.get(\"code\") or err_obj.get(\"type\")\n if isinstance(nested_code, str) and nested_code.strip():\n code = nested_code.strip()\n nested_msg = err_obj.get(\"message\")\n if isinstance(nested_msg, str) and nested_msg.strip():\n message = f\"Codex token refresh failed: {nested_msg.strip()}\"\n # OAuth spec shape: {\"error\": \"code_str\", \"error_description\": \"...\"}\n elif isinstance(err_obj, str) and err_obj.strip():\n code = err_obj.strip()\n err_desc = err.get(\"error_description\") or err.get(\"message\")\n if isinstance(err_desc, str) and err_desc.strip():\n message = f\"Codex token refresh failed: {err_desc.strip()}\"\n except Exception:\n pass\n if code in {\"invalid_grant\", \"invalid_token\", \"invalid_request\"}:\n relogin_required = True\n if code == \"refresh_token_reused\":\n message = (\n \"Codex refresh token was already consumed by another client \"\n \"(e.g. Codex CLI or VS Code extension). \"\n \"Run `codex` in your terminal to generate fresh tokens, \"\n \"then run `arcen auth` to re-authenticate.\"\n )\n relogin_required = True\n # A 401/403 from the token endpoint always means the refresh token\n # is invalid/expired — force relogin even if the body error code\n # wasn't one of the known strings above.\n if response.status_code in {401, 403} and not relogin_required:\n relogin_required = True\n raise AuthError(\n message,\n provider=\"openai-codex\",\n code=code,\n relogin_required=relogin_required,\n )\n\n try:\n refresh_payload = response.json()\n except Exception as exc:\n raise AuthError(\n \"Codex token refresh returned invalid JSON.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_invalid_json\",\n relogin_required=True,\n ) from exc\n\n refreshed_access = refresh_payload.get(\"access_token\")\n if not isinstance(refreshed_access, str) or not refreshed_access.strip():\n raise AuthError(\n \"Codex token refresh response was missing access_token.\",\n provider=\"openai-codex\",\n code=\"codex_refresh_missing_access_token\",\n relogin_required=True,\n )\n\n updated = {\n \"access_token\": refreshed_access.strip(),\n \"refresh_token\": refresh_token.strip(),\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n next_refresh = refresh_payload.get(\"refresh_token\")\n if isinstance(next_refresh, str) and next_refresh.strip():\n updated[\"refresh_token\"] = next_refresh.strip()\n return updated\n\n\ndef _refresh_codex_auth_tokens(\n tokens: Dict[str, str],\n timeout_seconds: float,\n) -> Dict[str, str]:\n \"\"\"Refresh Codex access token using the refresh token.\n \n Saves the new tokens to Arcen auth store automatically.\n \"\"\"\n refreshed = refresh_codex_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n\n _save_codex_tokens(updated_tokens)\n return updated_tokens\n\n\ndef _import_codex_cli_tokens() -> Optional[Dict[str, str]]:\n \"\"\"Try to read tokens from ~/.codex/auth.json (Codex CLI shared file).\n \n Returns tokens dict if valid and not expired, None otherwise.\n Does NOT write to the shared file.\n \"\"\"\n codex_home = os.getenv(\"CODEX_HOME\", \"\").strip()\n if not codex_home:\n codex_home = str(Path.home() / \".codex\")\n auth_path = Path(codex_home).expanduser() / \"auth.json\"\n if not auth_path.is_file():\n return None\n try:\n payload = json.loads(auth_path.read_text())\n tokens = payload.get(\"tokens\")\n if not isinstance(tokens, dict):\n return None\n access_token = tokens.get(\"access_token\")\n refresh_token = tokens.get(\"refresh_token\")\n if not access_token or not refresh_token:\n return None\n # Reject expired tokens — importing stale tokens from ~/.codex/\n # that can't be refreshed leaves the user stuck with \"Login successful!\"\n # but no working credentials.\n if _codex_access_token_is_expiring(access_token, 0):\n logger.debug(\n \"Codex CLI tokens at %s are expired — skipping import.\", auth_path,\n )\n return None\n return dict(tokens)\n except Exception:\n return None\n\n\ndef resolve_codex_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n \"\"\"Resolve runtime credentials from Arcen's own Codex token store.\n\n Falls back to the credential pool when the singleton (``providers.openai-codex.tokens``)\n has no usable access_token but the pool (``credential_pool.openai-codex``) does. This\n closes the divergence between the chat path (singleton-only via this function) and\n the auxiliary path (pool-first via ``_read_codex_access_token``). Without this\n fallback, a user whose tokens live only in the pool — for example after a manual\n pool seed, a partial re-auth, or pool-only restoration from a backup — gets a bare\n HTTP 401 ``Missing Authentication header`` from the wire instead of a usable\n credential. See issue #32992.\n \"\"\"\n try:\n data = _read_codex_tokens()\n except AuthError:\n pool_token = _pool_codex_access_token()\n if pool_token:\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": pool_token,\n \"source\": \"credential_pool\",\n \"last_refresh\": None,\n \"auth_mode\": \"chatgpt\",\n }\n raise\n\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_CODEX_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n # Re-read under lock to avoid racing with other Arcen processes\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_codex_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _codex_access_token_is_expiring(access_token, refresh_skew_seconds)\n\n if should_refresh:\n tokens = _refresh_codex_auth_tokens(tokens, refresh_timeout_seconds)\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"provider\": \"openai-codex\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"chatgpt\",\n }\n\n\ndef _pool_codex_access_token() -> str:\n \"\"\"Return the most-recent usable access_token from the openai-codex pool.\n\n Used as a fallback by ``resolve_codex_runtime_credentials`` when the\n singleton has no creds. Reads ``credential_pool.openai-codex`` entries\n directly from auth.json and picks the first non-empty access_token,\n preferring entries that are not currently in an exhaustion cooldown.\n Returns ``\"\"`` when no usable entry is found (caller handles by raising\n the original AuthError).\n \"\"\"\n try:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return \"\"\n entries = pool.get(\"openai-codex\")\n if not isinstance(entries, list):\n return \"\"\n\n def _entry_usable(entry: Dict[str, Any]) -> bool:\n if not isinstance(entry, dict):\n return False\n token = entry.get(\"access_token\")\n if not isinstance(token, str) or not token.strip():\n return False\n # Skip entries currently in an exhaustion cooldown window.\n reset_at = entry.get(\"last_error_reset_at\")\n if isinstance(reset_at, (int, float)) and reset_at > time.time():\n return False\n return True\n\n for entry in entries:\n if _entry_usable(entry):\n return str(entry.get(\"access_token\", \"\")).strip()\n except Exception:\n logger.debug(\"Codex pool fallback lookup failed\", exc_info=True)\n return \"\"\n\n\n# =============================================================================\n# xAI Grok OAuth — tokens stored in ~/.arcen/auth.json\n# =============================================================================\n\ndef _read_xai_oauth_tokens(*, _lock: bool = True) -> Dict[str, Any]:\n if _lock:\n with _auth_store_lock():\n auth_store = _load_auth_store()\n else:\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\")\n if not state:\n raise AuthError(\n \"No xAI OAuth credentials stored. Select xAI Grok OAuth (SuperGrok / Premium+) in `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing\",\n relogin_required=True,\n )\n tokens = state.get(\"tokens\")\n if not isinstance(tokens, dict):\n raise AuthError(\n \"xAI OAuth state is missing tokens. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_invalid_shape\",\n relogin_required=True,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(tokens.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI OAuth state is missing access_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_access_token\",\n relogin_required=True,\n )\n if not refresh_token:\n raise AuthError(\n \"xAI OAuth state is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n return {\n \"tokens\": tokens,\n \"last_refresh\": state.get(\"last_refresh\"),\n \"discovery\": state.get(\"discovery\") or {},\n \"redirect_uri\": state.get(\"redirect_uri\"),\n }\n\n\ndef _save_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n discovery: Optional[Dict[str, Any]] = None,\n redirect_uri: str = \"\",\n last_refresh: Optional[str] = None,\n) -> None:\n if last_refresh is None:\n last_refresh = datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\")\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"xai-oauth\") or {}\n state[\"tokens\"] = tokens\n state[\"last_refresh\"] = last_refresh\n state[\"auth_mode\"] = \"oauth_pkce\"\n if discovery:\n state[\"discovery\"] = discovery\n if redirect_uri:\n state[\"redirect_uri\"] = redirect_uri\n _save_provider_state(auth_store, \"xai-oauth\", state)\n _save_auth_store(auth_store)\n\n\ndef _xai_access_token_is_expiring(access_token: str, skew_seconds: int = 0) -> bool:\n if not isinstance(access_token, str) or \".\" not in access_token:\n return False\n try:\n parts = access_token.split(\".\")\n if len(parts) < 2:\n return False\n payload_b64 = parts[1]\n payload_b64 += \"=\" * (-len(payload_b64) % 4)\n payload = json.loads(base64.urlsafe_b64decode(payload_b64.encode(\"ascii\")).decode(\"utf-8\"))\n exp = payload.get(\"exp\")\n if not isinstance(exp, (int, float)):\n return False\n return float(exp) <= (time.time() + max(0, int(skew_seconds)))\n except Exception:\n return False\n\n\ndef _xai_validate_oauth_endpoint(url: str, *, field: str) -> str:\n \"\"\"Refuse any OIDC discovery endpoint that isn't HTTPS on the xAI origin.\n\n The OIDC discovery response is a long-lived, low-frequency request whose\n output is cached in ``~/.arcen/auth.json``. A single MITM during initial\n login could substitute a malicious ``token_endpoint``; that URL would\n then receive the refresh_token on every subsequent refresh — a permanent\n credential leak from a one-time MITM. Validating scheme + host pins the\n cached endpoint to the xAI auth origin (or a future ``*.x.ai`` subdomain\n if xAI migrates) so the cache poisoning loses its persistence guarantee.\n\n RFC 8414 §2 requires the issuer to be ``https://`` and SHOULD-keeps the\n token_endpoint on the same origin; we enforce both. ``x.ai`` is the\n bare apex, so we accept either exact host match or any ``.x.ai`` suffix.\n \"\"\"\n parsed = urlparse(url)\n if parsed.scheme != \"https\":\n raise AuthError(\n f\"xAI OIDC discovery returned a non-HTTPS {field}: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n host = (parsed.hostname or \"\").lower()\n if not host:\n raise AuthError(\n f\"xAI OIDC discovery {field} is missing a hostname: {url!r}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n raise AuthError(\n f\"xAI OIDC discovery {field} host {host!r} is not on the xAI origin \"\n f\"(expected x.ai or a *.x.ai subdomain). Refusing to use a cached \"\n f\"endpoint that may have been substituted by a MITM during initial \"\n f\"discovery; re-authenticate with `arcen model` to re-fetch.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid\",\n )\n return url\n\n\ndef _xai_validate_inference_base_url(value: str, *, fallback: str) -> str:\n \"\"\"Refuse a non-xAI base_url for the OAuth-authenticated inference path.\n\n The xAI Grok OAuth bearer is a high-value, long-lived credential tied to\n the user's SuperGrok subscription. ``XAI_BASE_URL`` / ``ARCEN_XAI_BASE_URL``\n let users repoint the inference endpoint (handy for staging or a local\n proxy), but the env override is also a credential-leak vector: a tampered\n ``.env`` or hostile shell init that sets\n ``XAI_BASE_URL=https://attacker.example/v1`` would ship the OAuth access\n token to a third party on every request, silently.\n\n Pin the inference origin to ``api.x.ai`` (or any ``*.x.ai`` subdomain xAI\n may add). On rejection, fall back to the default and log a warning rather\n than raise — a bad env var should not deadlock authentication, but it\n should also never leak the bearer.\n\n ``value`` is the already-stripped, trailing-slash-trimmed candidate from\n env. Empty input returns ``fallback`` unchanged.\n \"\"\"\n candidate = (value or \"\").strip().rstrip(\"/\")\n if not candidate:\n return fallback\n try:\n parsed = urlparse(candidate)\n except Exception:\n logger.warning(\n \"Ignoring malformed xAI base_url override %r; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if parsed.scheme != \"https\":\n logger.warning(\n \"Refusing non-HTTPS xAI base_url override %r (xai-oauth bearer would \"\n \"be sent in cleartext); falling back to %s.\",\n candidate, fallback,\n )\n return fallback\n host = (parsed.hostname or \"\").lower()\n if not host:\n logger.warning(\n \"Ignoring xAI base_url override %r with no hostname; using %s instead.\",\n candidate, fallback,\n )\n return fallback\n if host != \"x.ai\" and not host.endswith(\".x.ai\"):\n logger.warning(\n \"Refusing xAI base_url override %r — host %r is not on the xAI origin \"\n \"(expected x.ai or a *.x.ai subdomain). The xai-oauth bearer is only \"\n \"valid against xAI's inference API; sending it elsewhere would leak \"\n \"the credential. Falling back to %s.\",\n candidate, host, fallback,\n )\n return fallback\n return candidate\n\n\ndef _xai_oauth_discovery(timeout_seconds: float = 15.0) -> Dict[str, str]:\n try:\n response = httpx.get(\n XAI_OAUTH_DISCOVERY_URL,\n headers={\"Accept\": \"application/json\"},\n timeout=timeout_seconds,\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n ) from exc\n if response.status_code != 200:\n raise AuthError(\n f\"xAI OIDC discovery returned status {response.status_code}.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_failed\",\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI OIDC discovery returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI OIDC discovery response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n authorization_endpoint = str(payload.get(\"authorization_endpoint\", \"\") or \"\").strip()\n token_endpoint = str(payload.get(\"token_endpoint\", \"\") or \"\").strip()\n if not authorization_endpoint or not token_endpoint:\n raise AuthError(\n \"xAI OIDC discovery response was missing required endpoints.\",\n provider=\"xai-oauth\",\n code=\"xai_discovery_incomplete\",\n )\n _xai_validate_oauth_endpoint(authorization_endpoint, field=\"authorization_endpoint\")\n _xai_validate_oauth_endpoint(token_endpoint, field=\"token_endpoint\")\n return {\n \"authorization_endpoint\": authorization_endpoint,\n \"token_endpoint\": token_endpoint,\n }\n\n\ndef refresh_xai_oauth_pure(\n access_token: str,\n refresh_token: str,\n *,\n token_endpoint: str = \"\",\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n del access_token\n if not isinstance(refresh_token, str) or not refresh_token.strip():\n raise AuthError(\n \"xAI OAuth is missing refresh_token. Re-authenticate with `arcen model`.\",\n provider=\"xai-oauth\",\n code=\"xai_auth_missing_refresh_token\",\n relogin_required=True,\n )\n endpoint = token_endpoint.strip() or _xai_oauth_discovery(timeout_seconds)[\"token_endpoint\"]\n # Re-validate cached endpoints on the refresh hot path: an auth.json\n # written by an older Arcen (or hand-edited) may carry a non-xAI\n # token_endpoint that would receive every future refresh_token in\n # plaintext if we trusted it blindly. Cheap suffix check; fast-fail\n # with a clear error so the user can re-run `arcen model` to refetch.\n _xai_validate_oauth_endpoint(endpoint, field=\"token_endpoint\")\n timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}) as client:\n response = client.post(\n endpoint,\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"refresh_token\": refresh_token,\n },\n )\n if response.status_code != 200:\n detail = response.text.strip()\n # ``403`` from xAI's token endpoint is almost always a tier /\n # entitlement gate (the OAuth grant exists but the account isn't\n # on the allowlist for API access). Re-running ``arcen model``\n # won't fix that — surface a separate error code so\n # ``format_auth_error`` doesn't append a misleading\n # re-authenticate hint, and point users at the ``XAI_API_KEY``\n # fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n \"xAI token refresh failed with HTTP 403.\"\n + (f\" Response: {detail}\" if detail else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Re-logging in won't\"\n \" change that; set ``XAI_API_KEY`` and switch to\"\n \" ``provider: xai`` (API-key path) if available, or\"\n \" upgrade your subscription at https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n \"xAI token refresh failed.\"\n + (f\" Response: {detail}\" if detail else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_refresh_failed\",\n relogin_required=(response.status_code in {400, 401}),\n )\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token refresh returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_json\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token refresh response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_invalid_response\",\n relogin_required=True,\n )\n refreshed_access = str(payload.get(\"access_token\", \"\") or \"\").strip()\n if not refreshed_access:\n raise AuthError(\n \"xAI token refresh response was missing access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_refresh_missing_access_token\",\n relogin_required=True,\n )\n updated = {\n \"access_token\": refreshed_access,\n \"refresh_token\": str(payload.get(\"refresh_token\") or refresh_token).strip(),\n \"id_token\": str(payload.get(\"id_token\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n }\n return updated\n\n\ndef _refresh_xai_oauth_tokens(\n tokens: Dict[str, Any],\n *,\n token_endpoint: str,\n redirect_uri: str = \"\",\n timeout_seconds: float,\n) -> Dict[str, Any]:\n refreshed = refresh_xai_oauth_pure(\n str(tokens.get(\"access_token\", \"\") or \"\"),\n str(tokens.get(\"refresh_token\", \"\") or \"\"),\n token_endpoint=token_endpoint,\n timeout_seconds=timeout_seconds,\n )\n updated_tokens = dict(tokens)\n updated_tokens[\"access_token\"] = refreshed[\"access_token\"]\n updated_tokens[\"refresh_token\"] = refreshed[\"refresh_token\"]\n if refreshed.get(\"id_token\"):\n updated_tokens[\"id_token\"] = refreshed[\"id_token\"]\n if refreshed.get(\"expires_in\") is not None:\n updated_tokens[\"expires_in\"] = refreshed[\"expires_in\"]\n if refreshed.get(\"token_type\"):\n updated_tokens[\"token_type\"] = refreshed[\"token_type\"]\n _save_xai_oauth_tokens(\n updated_tokens,\n discovery={\"token_endpoint\": token_endpoint},\n redirect_uri=redirect_uri,\n last_refresh=refreshed[\"last_refresh\"],\n )\n return updated_tokens\n\n\ndef resolve_xai_oauth_runtime_credentials(\n *,\n force_refresh: bool = False,\n refresh_if_expiring: bool = True,\n refresh_skew_seconds: int = XAI_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> Dict[str, Any]:\n data = _read_xai_oauth_tokens()\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n refresh_timeout_seconds = float(os.getenv(\"ARCEN_XAI_REFRESH_TIMEOUT_SECONDS\", \"20\"))\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n with _auth_store_lock(timeout_seconds=max(float(AUTH_LOCK_TIMEOUT_SECONDS), refresh_timeout_seconds + 5.0)):\n data = _read_xai_oauth_tokens(_lock=False)\n tokens = dict(data[\"tokens\"])\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n discovery = dict(data.get(\"discovery\") or {})\n token_endpoint = str(discovery.get(\"token_endpoint\", \"\") or \"\").strip()\n redirect_uri = str(data.get(\"redirect_uri\", \"\") or \"\").strip()\n should_refresh = bool(force_refresh)\n if (not should_refresh) and refresh_if_expiring:\n should_refresh = _xai_access_token_is_expiring(access_token, refresh_skew_seconds)\n if should_refresh:\n if not token_endpoint:\n token_endpoint = _xai_oauth_discovery(refresh_timeout_seconds)[\"token_endpoint\"]\n try:\n tokens = _refresh_xai_oauth_tokens(\n tokens,\n token_endpoint=token_endpoint,\n redirect_uri=redirect_uri,\n timeout_seconds=refresh_timeout_seconds,\n )\n access_token = str(tokens.get(\"access_token\", \"\") or \"\").strip()\n except AuthError as exc:\n if _is_terminal_xai_oauth_refresh_error(exc):\n # Terminal failure (HTTP 400/401/403 — invalid_grant, token revoked).\n # Clear dead tokens from auth.json so subsequent sessions fail fast\n # without a network retry. Mirrors credential_pool.py quarantine.\n try:\n _q_store = _load_auth_store()\n _q_state = _load_provider_state(_q_store, \"xai-oauth\") or {}\n _q_tokens = dict(_q_state.get(\"tokens\") or {})\n _q_tokens.pop(\"access_token\", None)\n _q_tokens.pop(\"refresh_token\", None)\n _q_state[\"tokens\"] = _q_tokens\n _q_state[\"last_auth_error\"] = {\n \"provider\": \"xai-oauth\",\n \"code\": exc.code or \"xai_refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _store_provider_state(_q_store, \"xai-oauth\", _q_state, set_active=False)\n _save_auth_store(_q_store)\n except Exception as _save_exc:\n logger.debug(\n \"xAI OAuth: failed to persist quarantined state: %s\", _save_exc,\n )\n raise\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"provider\": \"xai-oauth\",\n \"base_url\": base_url,\n \"api_key\": access_token,\n \"source\": \"arcen-auth-store\",\n \"last_refresh\": data.get(\"last_refresh\"),\n \"auth_mode\": \"oauth_pkce\",\n }\n\n\n# =============================================================================\n# TLS verification helper\n# =============================================================================\n\ndef _default_verify() -> bool | ssl.SSLContext:\n \"\"\"Platform-aware default SSL verify for httpx clients.\n\n On macOS with Homebrew Python, the system OpenSSL cannot locate the\n system trust store and valid public certs fail verification. When\n certifi is importable we pin its bundle explicitly; elsewhere we\n defer to httpx's built-in default (certifi via its own dependency).\n Mirrors the weixin fix in 3a0ec1d93.\n \"\"\"\n if sys.platform == \"darwin\":\n try:\n import certifi\n return ssl.create_default_context(cafile=certifi.where())\n except ImportError:\n pass\n return True\n\n\ndef _resolve_verify(\n *,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n auth_state: Optional[Dict[str, Any]] = None,\n) -> bool | ssl.SSLContext:\n tls_state = auth_state.get(\"tls\") if isinstance(auth_state, dict) else {}\n tls_state = tls_state if isinstance(tls_state, dict) else {}\n\n effective_insecure = (\n is_truthy_value(insecure, default=False) if insecure is not None\n else is_truthy_value(tls_state.get(\"insecure\", False), default=False)\n )\n effective_ca = (\n ca_bundle\n or tls_state.get(\"ca_bundle\")\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n or os.getenv(\"REQUESTS_CA_BUNDLE\")\n )\n\n if effective_insecure:\n return False\n if effective_ca:\n ca_path = str(effective_ca)\n if not os.path.isfile(ca_path):\n logger.warning(\n \"CA bundle path does not exist: %s — falling back to default certificates\",\n ca_path,\n )\n return _default_verify()\n return ssl.create_default_context(cafile=ca_path)\n return _default_verify()\n\n\n# =============================================================================\n# OAuth Device Code Flow — generic, parameterized by provider\n# =============================================================================\n\ndef _request_device_code(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n scope: Optional[str],\n) -> Dict[str, Any]:\n \"\"\"POST to the device code endpoint. Returns device_code, user_code, etc.\"\"\"\n response = client.post(\n f\"{portal_base_url}/api/oauth/device/code\",\n data={\n \"client_id\": client_id,\n **({\"scope\": scope} if scope else {}),\n },\n )\n response.raise_for_status()\n data = response.json()\n\n required_fields = [\n \"device_code\", \"user_code\", \"verification_uri\",\n \"verification_uri_complete\", \"expires_in\", \"interval\",\n ]\n missing = [f for f in required_fields if f not in data]\n if missing:\n raise ValueError(f\"Device code response missing fields: {', '.join(missing)}\")\n return data\n\n\ndef _poll_for_token(\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n device_code: str,\n expires_in: int,\n poll_interval: int,\n) -> Dict[str, Any]:\n \"\"\"Poll the token endpoint until the user approves or the code expires.\"\"\"\n deadline = time.monotonic() + max(1, expires_in)\n current_interval = max(1, min(poll_interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n\n while time.monotonic() < deadline:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n data={\n \"grant_type\": \"urn:ietf:params:oauth:grant-type:device_code\",\n \"client_id\": client_id,\n \"device_code\": device_code,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise ValueError(\"Token response did not include access_token\")\n return payload\n\n try:\n error_payload = response.json()\n except Exception:\n response.raise_for_status()\n raise RuntimeError(\"Token endpoint returned a non-JSON error response\")\n\n error_code = error_payload.get(\"error\", \"\")\n if error_code == \"authorization_pending\":\n time.sleep(current_interval)\n continue\n if error_code == \"slow_down\":\n current_interval = min(current_interval + 1, 30)\n time.sleep(current_interval)\n continue\n\n description = error_payload.get(\"error_description\") or \"Unknown authentication error\"\n raise RuntimeError(f\"{error_code}: {description}\")\n\n raise TimeoutError(\"Timed out waiting for device authorization\")\n\n\n# =============================================================================\n# Nous Portal — token refresh and model discovery\n# =============================================================================\n\n# -----------------------------------------------------------------------------\n# Shared Nous token store — lets OAuth credentials persist across profiles\n# so a new `arcen --profile <name> auth add nous --type oauth` can one-tap\n# import instead of running the full device-code flow every time.\n#\n# File lives at ${ARCEN_SHARED_AUTH_DIR}/nous_auth.json, defaulting to\n# ``<arcen-root>/shared/nous_auth.json`` where ``<arcen-root>`` is what\n# ``get_default_arcen_root()`` returns — ``~/.arcen`` on Linux/macOS,\n# ``%LOCALAPPDATA%\\arcen`` on native Windows, or the Docker/custom root.\n# It is OUTSIDE any named profile's ARCEN_HOME so named profiles (which\n# typically live under ``<arcen-root>/profiles/<name>/``) all see the\n# same file.\n#\n# Written on successful login and on every runtime refresh so the stored\n# refresh_token stays current even if one profile refreshes and rotates it.\n# If ever the stored refresh_token does go stale server-side, import fails\n# gracefully and the user falls back to the normal device-code flow.\n# -----------------------------------------------------------------------------\n\nNOUS_SHARED_STORE_FILENAME = \"nous_auth.json\"\n_nous_shared_lock_holder = threading.local()\n\n\ndef _nous_shared_auth_dir() -> Path:\n \"\"\"Resolve the directory that holds the shared Nous token store.\n\n Honors ``ARCEN_SHARED_AUTH_DIR`` so tests can redirect it to a tmp\n path without touching the real user's home. Defaults to\n ``<arcen-root>/shared/``, where ``<arcen-root>`` is what\n :func:`arcen_constants.get_default_arcen_root` returns — so\n Linux/macOS classic installs land at ``~/.arcen/shared/``, native\n Windows installs at ``%LOCALAPPDATA%\\\\arcen\\\\shared\\\\``, and\n Docker / custom ``ARCEN_HOME`` deployments at\n ``<ARCEN_HOME>/shared/``. Sits outside any named profile so all\n profiles under the same root share the store.\n \"\"\"\n override = os.getenv(\"ARCEN_SHARED_AUTH_DIR\", \"\").strip()\n if override:\n return Path(override).expanduser()\n from arcen_constants import get_default_arcen_root\n return get_default_arcen_root() / \"shared\"\n\n\ndef _nous_shared_store_path() -> Path:\n path = _nous_shared_auth_dir() / NOUS_SHARED_STORE_FILENAME\n # Seat belt: if pytest is running and this resolves to a path under the\n # real user's Arcen root, refuse rather than silently corrupt cross-profile\n # state. Tests must set ARCEN_SHARED_AUTH_DIR to a tmp_path (conftest\n # does not do this automatically — mirror the _auth_file_path() guard\n # so forgetting to set it fails loudly instead of writing to the real\n # shared store).\n if os.environ.get(\"PYTEST_CURRENT_TEST\"):\n from arcen_constants import get_default_arcen_root\n real_home_shared = (\n get_default_arcen_root() / \"shared\" / NOUS_SHARED_STORE_FILENAME\n ).resolve(strict=False)\n try:\n resolved = path.resolve(strict=False)\n except Exception:\n resolved = path\n if resolved == real_home_shared:\n raise RuntimeError(\n f\"Refusing to touch real user shared Nous auth store during test run: \"\n f\"{path}. Set ARCEN_SHARED_AUTH_DIR to a tmp_path in your test fixture.\"\n )\n return path\n\n\n@contextmanager\ndef _nous_shared_store_lock(timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):\n \"\"\"Cross-profile lock for the shared Nous OAuth store.\n\n Lock ordering invariant: if both this and ``_auth_store_lock`` need\n to be held, acquire ``_auth_store_lock`` FIRST. All runtime refresh\n paths follow this order. The one exception is\n ``_try_import_shared_nous_state``, which holds this lock alone for\n the entire refresh cycle so concurrent imports on sibling profiles\n can't race on the single-use shared refresh token; that helper must\n NOT be called with ``_auth_store_lock`` already held.\n \"\"\"\n try:\n lock_path = _nous_shared_store_path().with_suffix(\".lock\")\n except RuntimeError:\n # No ARCEN_HOME yet (pre-setup): fall through without locking.\n yield\n return\n\n with _file_lock(\n lock_path,\n _nous_shared_lock_holder,\n timeout_seconds,\n \"Timed out waiting for shared Nous auth lock\",\n ):\n yield\n\n\ndef _merge_shared_nous_oauth_state(state: Dict[str, Any]) -> bool:\n \"\"\"Copy fresher shared OAuth tokens into a profile-local Nous state.\"\"\"\n shared = _read_shared_nous_state()\n if not shared:\n return False\n\n shared_refresh = shared.get(\"refresh_token\")\n if not isinstance(shared_refresh, str) or not shared_refresh.strip():\n return False\n\n local_refresh = state.get(\"refresh_token\")\n shared_access_exp = _parse_iso_timestamp(shared.get(\"expires_at\")) or 0.0\n local_access_exp = _parse_iso_timestamp(state.get(\"expires_at\")) or 0.0\n refresh_changed = shared_refresh.strip() != str(local_refresh or \"\").strip()\n fresher_access = shared_access_exp > local_access_exp\n if not refresh_changed and not fresher_access:\n return False\n\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"token_type\",\n \"scope\",\n \"client_id\",\n \"portal_base_url\",\n \"inference_base_url\",\n \"obtained_at\",\n \"expires_at\",\n ):\n value = shared.get(key)\n if value not in {None, \"\"}:\n state[key] = value\n return True\n\n\ndef _write_shared_nous_state(state: Dict[str, Any]) -> None:\n \"\"\"Persist a minimal copy of the Nous OAuth state to the shared store.\n\n Best-effort: any failure is swallowed after logging. The shared store\n is a convenience layer; the per-profile auth.json remains the source\n of truth.\n\n We deliberately omit the runtime ``agent_key`` compatibility field;\n the OAuth tokens are the cross-profile source of truth.\n \"\"\"\n refresh_token = state.get(\"refresh_token\")\n access_token = state.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n # No refresh_token = nothing worth sharing across profiles\n return\n if not (isinstance(access_token, str) and access_token.strip()):\n return\n\n shared = {\n \"_schema\": 1,\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"token_type\": state.get(\"token_type\") or \"Bearer\",\n \"scope\": state.get(\"scope\") or DEFAULT_NOUS_SCOPE,\n \"client_id\": state.get(\"client_id\") or DEFAULT_NOUS_CLIENT_ID,\n \"portal_base_url\": state.get(\"portal_base_url\") or DEFAULT_NOUS_PORTAL_URL,\n \"inference_base_url\": state.get(\"inference_base_url\") or DEFAULT_NOUS_INFERENCE_URL,\n \"obtained_at\": state.get(\"obtained_at\"),\n \"expires_at\": state.get(\"expires_at\"),\n \"updated_at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n with _nous_shared_store_lock():\n path = _nous_shared_store_path()\n path.parent.mkdir(parents=True, exist_ok=True)\n # secure_parent_dir refuses to chmod / or top-level dirs (#25821).\n secure_parent_dir(path)\n tmp = path.with_name(f\"{path.name}.tmp.{os.getpid()}.{uuid.uuid4().hex}\")\n # Create with 0o600 atomically via os.open(O_EXCL) — closes the TOCTOU\n # window where write_text() + post-write chmod briefly exposed Nous\n # refresh_token at process umask. See #19673, #21148.\n fd = os.open(\n str(tmp),\n os.O_WRONLY | os.O_CREAT | os.O_EXCL,\n stat.S_IRUSR | stat.S_IWUSR,\n )\n try:\n with os.fdopen(fd, \"w\", encoding=\"utf-8\") as fh:\n fh.write(json.dumps(shared, indent=2, sort_keys=True))\n fh.flush()\n os.fsync(fh.fileno())\n os.replace(tmp, path)\n finally:\n try:\n if tmp.exists():\n tmp.unlink()\n except OSError:\n pass\n _oauth_trace(\n \"nous_shared_store_written\",\n path=str(path),\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n except Exception as exc:\n logger.debug(\"Failed to write shared Nous auth store: %s\", exc)\n\n\ndef _read_shared_nous_state() -> Optional[Dict[str, Any]]:\n \"\"\"Return the shared Nous OAuth state if present and well-formed.\n\n Returns ``None`` when the file is missing, unreadable, malformed, or\n lacks required fields. Callers should treat ``None`` as \"no shared\n credentials available — fall through to device-code\".\n \"\"\"\n try:\n path = _nous_shared_store_path()\n except RuntimeError:\n # Test seat belt tripped — treat as missing\n return None\n if not path.is_file():\n return None\n try:\n payload = json.loads(path.read_text())\n except (OSError, ValueError) as exc:\n logger.debug(\"Shared Nous auth store at %s is unreadable: %s\", path, exc)\n return None\n if not isinstance(payload, dict):\n return None\n refresh_token = payload.get(\"refresh_token\")\n access_token = payload.get(\"access_token\")\n if not (isinstance(refresh_token, str) and refresh_token.strip()):\n return None\n if not (isinstance(access_token, str) and access_token.strip()):\n return None\n return payload\n\n\ndef _clear_shared_nous_state(reason: str) -> None:\n \"\"\"Remove the shared Nous OAuth store after a terminal token failure.\"\"\"\n try:\n with _nous_shared_store_lock():\n path = _nous_shared_store_path()\n try:\n path.unlink()\n except FileNotFoundError:\n pass\n _oauth_trace(\"nous_shared_store_cleared\", reason=reason)\n except Exception as exc:\n logger.debug(\"Failed to clear shared Nous auth store: %s\", exc)\n\n\ndef _is_terminal_nous_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Nous refresh token cannot succeed.\"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"nous\"\n and exc.code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_xai_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same xAI OAuth refresh token cannot succeed.\n\n ``xai_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``xai_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"xai-oauth\"\n and exc.code in {\"xai_refresh_failed\", \"xai_auth_missing_refresh_token\"}\n and bool(exc.relogin_required)\n )\n\n\ndef _is_terminal_codex_oauth_refresh_error(exc: Exception) -> bool:\n \"\"\"True when retrying the same Codex OAuth refresh token cannot succeed.\n\n ``codex_refresh_failed`` covers HTTP 400/401/403 from the token endpoint\n (invalid_grant, token revoked, refresh_token_reused).\n ``codex_auth_missing_refresh_token`` means the pool entry has no refresh\n token at all — retrying will never work.\n Both carry ``relogin_required=True``; transient failures (429, 5xx) do not.\n \"\"\"\n return (\n isinstance(exc, AuthError)\n and exc.provider == \"openai-codex\"\n and exc.code in {\n \"codex_refresh_failed\",\n \"codex_auth_missing_refresh_token\",\n \"invalid_grant\",\n \"invalid_token\",\n \"refresh_token_reused\",\n }\n and bool(exc.relogin_required)\n )\n\n\ndef _quarantine_nous_oauth_state(\n state: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> None:\n \"\"\"Keep routing metadata but remove dead OAuth material so it is not replayed.\"\"\"\n for key in (\n \"access_token\",\n \"refresh_token\",\n \"expires_at\",\n \"expires_in\",\n \"obtained_at\",\n \"agent_key\",\n \"agent_key_id\",\n \"agent_key_expires_at\",\n \"agent_key_expires_in\",\n \"agent_key_reused\",\n \"agent_key_obtained_at\",\n ):\n state.pop(key, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"nous\",\n \"code\": error.code,\n \"message\": str(error),\n \"reason\": reason,\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n _clear_shared_nous_state(reason)\n invalidate_nous_auth_status_cache()\n\n\ndef _quarantine_nous_pool_entries(\n auth_store: Dict[str, Any],\n error: AuthError,\n *,\n reason: str,\n) -> bool:\n \"\"\"Remove singleton-seeded Nous pool entries that contain dead OAuth state.\"\"\"\n pool = auth_store.get(\"credential_pool\")\n if not isinstance(pool, dict):\n return False\n entries = pool.get(\"nous\")\n if not isinstance(entries, list):\n return False\n\n retained = []\n removed = False\n singleton_sources = {NOUS_DEVICE_CODE_SOURCE, f\"manual:{NOUS_DEVICE_CODE_SOURCE}\"}\n for entry in entries:\n if isinstance(entry, dict) and entry.get(\"source\") in singleton_sources:\n removed = True\n continue\n retained.append(entry)\n\n if removed:\n pool[\"nous\"] = retained\n _oauth_trace(\n \"nous_pool_device_code_quarantined\",\n reason=reason,\n error_code=error.code,\n )\n return removed\n\n\ndef _try_import_shared_nous_state(\n *,\n timeout_seconds: float = 15.0,\n) -> Optional[Dict[str, Any]]:\n \"\"\"Attempt to rehydrate Nous OAuth state from the shared store.\n\n Reads the shared file (if present), runs a forced refresh using the\n stored refresh_token to produce a fresh inference JWT scoped to this\n profile, and returns the full auth_state dict ready\n for ``persist_nous_credentials()``.\n\n Returns ``None`` when no shared state is available or the rehydrate\n fails for any reason (expired refresh_token, portal unreachable,\n etc.) — caller should then fall through to the normal device-code\n flow.\n \"\"\"\n try:\n with _nous_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n shared = _read_shared_nous_state()\n if not shared:\n return None\n\n # Build a full state dict so refresh_nous_oauth_from_state has every\n # field it needs. force_refresh=True gets us a fresh access_token\n # for this profile.\n state: Dict[str, Any] = {\n \"access_token\": shared.get(\"access_token\"),\n \"refresh_token\": shared.get(\"refresh_token\"),\n \"client_id\": shared.get(\"client_id\") or DEFAULT_NOUS_CLIENT_ID,\n \"portal_base_url\": shared.get(\"portal_base_url\") or DEFAULT_NOUS_PORTAL_URL,\n \"inference_base_url\": shared.get(\"inference_base_url\") or DEFAULT_NOUS_INFERENCE_URL,\n \"token_type\": shared.get(\"token_type\") or \"Bearer\",\n \"scope\": shared.get(\"scope\") or DEFAULT_NOUS_SCOPE,\n \"obtained_at\": shared.get(\"obtained_at\"),\n \"expires_at\": shared.get(\"expires_at\"),\n \"agent_key\": None,\n \"agent_key_expires_at\": None,\n \"tls\": {\"insecure\": False, \"ca_bundle\": None},\n }\n\n def _persist_shared_refresh(updated_state: Dict[str, Any], _reason: str) -> None:\n _write_shared_nous_state(updated_state)\n\n refreshed = refresh_nous_oauth_from_state(\n state,\n timeout_seconds=timeout_seconds,\n force_refresh=True,\n on_state_update=_persist_shared_refresh,\n )\n _write_shared_nous_state(refreshed)\n except AuthError as exc:\n _oauth_trace(\n \"nous_shared_import_failed\",\n error_type=type(exc).__name__,\n error_code=getattr(exc, \"code\", None),\n )\n if _is_terminal_nous_refresh_error(exc):\n _clear_shared_nous_state(\"shared_import_terminal_refresh_failure\")\n logger.debug(\"Shared Nous import failed: %s\", exc)\n return None\n except Exception as exc:\n _oauth_trace(\n \"nous_shared_import_failed\",\n error_type=type(exc).__name__,\n )\n logger.debug(\"Shared Nous import failed: %s\", exc)\n return None\n\n return refreshed\n\n\ndef _refresh_access_token(\n *,\n client: httpx.Client,\n portal_base_url: str,\n client_id: str,\n refresh_token: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/api/oauth/token\",\n headers={\"x-nous-refresh-token\": refresh_token},\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": client_id,\n },\n )\n\n if response.status_code == 200:\n payload = response.json()\n if \"access_token\" not in payload:\n raise AuthError(\"Refresh response missing access_token\",\n provider=\"nous\", code=\"invalid_token\", relogin_required=True)\n return payload\n\n try:\n error_payload = response.json()\n except Exception as exc:\n raise AuthError(\"Refresh token exchange failed\",\n provider=\"nous\", relogin_required=True) from exc\n\n code = str(error_payload.get(\"error\", \"invalid_grant\"))\n description = str(error_payload.get(\"error_description\") or \"Refresh token exchange failed\")\n relogin = code in {\"invalid_grant\", \"invalid_token\", \"refresh_token_reused\"}\n\n # Detect the OAuth 2.1 \"refresh token reuse\" signal from the Nous portal\n # server and surface an actionable message. This fires when an external\n # process (health-check script, monitoring tool, custom self-heal hook)\n # called POST /api/oauth/token with Arcen's refresh_token without\n # persisting the rotated token back to auth.json — the server then\n # retires the original RT, Arcen's next refresh uses it, and the whole\n # session chain gets revoked as a token-theft signal (#15099).\n lowered = description.lower()\n if code == \"refresh_token_reused\" or \"reuse\" in lowered or \"reuse detected\" in lowered:\n description = (\n \"Nous Portal detected refresh-token reuse and revoked this session.\\n\"\n \"This usually means an external process (monitoring script, \"\n \"custom self-heal hook, or another Arcen install sharing \"\n \"~/.arcen/auth.json) called POST /api/oauth/token with Arcen's \"\n \"refresh token without persisting the rotated token back.\\n\"\n \"Nous refresh tokens are single-use — only Arcen may call the \"\n \"refresh endpoint. For health checks, use `arcen auth status` \"\n \"instead.\\n\"\n \"Re-authenticate with: arcen auth add nous\"\n )\n relogin = True\n\n raise AuthError(description, provider=\"nous\", code=code, relogin_required=relogin)\n\n\ndef fetch_nous_models(\n *,\n inference_base_url: str,\n api_key: str,\n timeout_seconds: float = 15.0,\n verify: bool | str = True,\n) -> List[str]:\n \"\"\"Fetch available model IDs from the Nous inference API.\"\"\"\n timeout = httpx.Timeout(timeout_seconds)\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n response = client.get(\n f\"{inference_base_url.rstrip('/')}/models\",\n headers={\"Authorization\": f\"Bearer {api_key}\"},\n )\n\n if response.status_code != 200:\n description = f\"/models request failed with status {response.status_code}\"\n try:\n err = response.json()\n description = str(err.get(\"error_description\") or err.get(\"error\") or description)\n except Exception as e:\n logger.debug(\"Could not parse error response JSON: %s\", e)\n raise AuthError(description, provider=\"nous\", code=\"models_fetch_failed\")\n\n payload = response.json()\n data = payload.get(\"data\")\n if not isinstance(data, list):\n return []\n\n model_ids: List[str] = []\n for item in data:\n if not isinstance(item, dict):\n continue\n model_id = item.get(\"id\")\n if isinstance(model_id, str) and model_id.strip():\n mid = model_id.strip()\n # Skip Arcen models — they're not reliable for agentic tool-calling\n if \"arcen\" in mid.lower():\n continue\n model_ids.append(mid)\n\n # Sort: prefer opus > pro > haiku/flash > sonnet (sonnet is cheap/fast,\n # users who want the best model should see opus first).\n def _model_priority(mid: str) -> tuple:\n low = mid.lower()\n if \"opus\" in low:\n return (0, mid)\n if \"pro\" in low and \"sonnet\" not in low:\n return (1, mid)\n if \"sonnet\" in low:\n return (3, mid)\n return (2, mid)\n\n model_ids.sort(key=_model_priority)\n return list(dict.fromkeys(model_ids))\n\n\ndef _agent_key_is_usable(state: Dict[str, Any], min_ttl_seconds: int) -> bool:\n key = state.get(\"agent_key\")\n if not isinstance(key, str) or not key.strip():\n return False\n return _nous_invoke_jwt_is_usable(\n key,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"agent_key_expires_at\"),\n min_ttl_seconds=max(0, int(min_ttl_seconds)),\n )\n\n\ndef resolve_nous_access_token(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n refresh_skew_seconds: int = ACCESS_TOKEN_REFRESH_SKEW_SECONDS,\n) -> str:\n \"\"\"Resolve a refresh-aware Nous Portal access token for managed tool gateways.\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"nous\")\n\n if not state:\n raise AuthError(\n \"Arcen is not logged into Nous Portal.\",\n provider=\"nous\",\n relogin_required=True,\n )\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"NOUS_PORTAL_BASE_URL\")\n or DEFAULT_NOUS_PORTAL_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_NOUS_CLIENT_ID)\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n\n with _nous_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n merged_shared = _merge_shared_nous_oauth_state(state)\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\n \"No access token found for Nous Portal login.\",\n provider=\"nous\",\n relogin_required=True,\n )\n\n if not _is_expiring(state.get(\"expires_at\"), refresh_skew_seconds):\n if merged_shared:\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n return access_token\n\n if not isinstance(refresh_token, str) or not refresh_token:\n raise AuthError(\n \"Session expired and no refresh token is available.\",\n provider=\"nous\",\n relogin_required=True,\n )\n\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n with httpx.Client(\n timeout=timeout,\n headers={\"Accept\": \"application/json\"},\n verify=verify,\n ) as client:\n try:\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_nous_refresh_error(exc):\n _quarantine_nous_oauth_state(\n state,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _quarantine_nous_pool_entries(\n auth_store,\n exc,\n reason=\"managed_access_token_refresh_failure\",\n )\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n raise\n\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl,\n tz=timezone.utc,\n ).isoformat()\n state[\"portal_base_url\"] = portal_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n _write_shared_nous_state(state)\n return state[\"access_token\"]\n\n\ndef refresh_nous_oauth_pure(\n access_token: str,\n refresh_token: str,\n client_id: str,\n portal_base_url: str,\n inference_base_url: str,\n *,\n token_type: str = \"Bearer\",\n scope: str = DEFAULT_NOUS_SCOPE,\n obtained_at: Optional[str] = None,\n expires_at: Optional[str] = None,\n agent_key: Optional[str] = None,\n agent_key_expires_at: Optional[str] = None,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Nous OAuth state without mutating auth.json directly.\n\n ``on_state_update`` is called after a successful access-token refresh.\n Callers that own persistent state can use it to save the newly rotated\n refresh token before later validation can fail.\n \"\"\"\n state: Dict[str, Any] = {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"client_id\": client_id or DEFAULT_NOUS_CLIENT_ID,\n \"portal_base_url\": (portal_base_url or DEFAULT_NOUS_PORTAL_URL).rstrip(\"/\"),\n \"inference_base_url\": (inference_base_url or DEFAULT_NOUS_INFERENCE_URL).rstrip(\"/\"),\n \"token_type\": token_type or \"Bearer\",\n \"scope\": scope or DEFAULT_NOUS_SCOPE,\n \"obtained_at\": obtained_at,\n \"expires_at\": expires_at,\n \"agent_key\": agent_key,\n \"agent_key_expires_at\": agent_key_expires_at,\n \"tls\": {\n \"insecure\": bool(insecure),\n \"ca_bundle\": ca_bundle,\n },\n }\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n current_invoke_jwt_status = _nous_invoke_jwt_status(\n state.get(\"access_token\"),\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or current_invoke_jwt_status is not None:\n refresh_token_value = state.get(\"refresh_token\")\n if not isinstance(refresh_token_value, str) or not refresh_token_value:\n if current_invoke_jwt_status is not None:\n raise AuthError(\n \"Nous Portal access token is not a usable inference JWT \"\n f\"({current_invoke_jwt_status}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add nous\",\n provider=\"nous\",\n code=current_invoke_jwt_status,\n relogin_required=True,\n )\n raise AuthError(\n \"No refresh token is available for Nous Portal.\",\n provider=\"nous\",\n relogin_required=True,\n )\n refreshed = _refresh_access_token(\n client=client,\n portal_base_url=state[\"portal_base_url\"],\n client_id=state[\"client_id\"],\n refresh_token=refresh_token_value,\n )\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token_value\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_nous_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n state[\"inference_base_url\"] = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n if on_state_update is not None:\n on_state_update(dict(state), \"post_refresh_access_token\")\n\n _assert_nous_inference_jwt_usable(state)\n _select_nous_invoke_jwt(state)\n\n return state\n\n\ndef refresh_nous_oauth_from_state(\n state: Dict[str, Any],\n *,\n timeout_seconds: float = 15.0,\n force_refresh: bool = False,\n on_state_update: Optional[Callable[[Dict[str, Any], str], None]] = None,\n) -> Dict[str, Any]:\n \"\"\"Refresh Nous OAuth from a state dict. Thin wrapper around refresh_nous_oauth_pure.\"\"\"\n tls = state.get(\"tls\") or {}\n return refresh_nous_oauth_pure(\n state.get(\"access_token\", \"\"),\n state.get(\"refresh_token\", \"\"),\n state.get(\"client_id\", \"arcen-cli\"),\n state.get(\"portal_base_url\", DEFAULT_NOUS_PORTAL_URL),\n state.get(\"inference_base_url\", DEFAULT_NOUS_INFERENCE_URL),\n token_type=state.get(\"token_type\", \"Bearer\"),\n scope=state.get(\"scope\", DEFAULT_NOUS_SCOPE),\n obtained_at=state.get(\"obtained_at\"),\n expires_at=state.get(\"expires_at\"),\n agent_key=state.get(\"agent_key\"),\n agent_key_expires_at=state.get(\"agent_key_expires_at\"),\n timeout_seconds=timeout_seconds,\n insecure=tls.get(\"insecure\"),\n ca_bundle=tls.get(\"ca_bundle\"),\n force_refresh=force_refresh,\n on_state_update=on_state_update,\n )\n\n\ndef persist_nous_credentials(\n creds: Dict[str, Any],\n *,\n label: Optional[str] = None,\n):\n \"\"\"Persist Nous OAuth credentials as the singleton provider state\n and ensure the credential pool is in sync.\n\n Nous credentials are read at runtime from two independent locations:\n\n - ``providers.nous``: singleton state read by\n ``resolve_nous_runtime_credentials()`` during 401 recovery and by\n ``_seed_from_singletons()`` during pool load.\n - ``credential_pool.nous``: used by the runtime ``pool.select()`` path.\n\n Historically ``arcen auth add nous`` wrote a ``manual:device_code`` pool\n entry only, skipping ``providers.nous``. When the runtime credential\n expired, the recovery path read the empty singleton state and raised\n ``AuthError`` silently (``logger.debug`` at INFO level).\n\n This helper writes ``providers.nous`` then calls ``load_pool(\"nous\")`` so\n ``_seed_from_singletons`` materialises the canonical ``device_code`` pool\n entry from the singleton. Re-running login upserts the same entry in\n place; the pool never accumulates duplicate device_code rows.\n\n ``label`` is an optional user-chosen display name (from\n ``arcen auth add nous --label <name>``). It gets embedded in the\n singleton state so that ``_seed_from_singletons`` uses it as the pool\n entry's label on every subsequent ``load_pool(\"nous\")`` instead of the\n auto-derived token fingerprint. When ``None``, the auto-derived label\n via ``label_from_token`` is used (unchanged default behaviour).\n\n Returns the upserted :class:`PooledCredential` entry (or ``None`` if\n seeding somehow produced no match — shouldn't happen).\n \"\"\"\n from agent.credential_pool import load_pool\n\n state = dict(creds)\n if label and str(label).strip():\n state[\"label\"] = str(label).strip()\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n\n # Mirror to the shared store so a new profile can one-tap import\n # these credentials via `arcen auth add nous --type oauth`. Best-\n # effort: any I/O failure is logged and swallowed (the per-profile\n # auth.json is still the source of truth).\n _write_shared_nous_state(state)\n\n pool = load_pool(\"nous\")\n return next(\n (e for e in pool.entries() if e.source == NOUS_DEVICE_CODE_SOURCE),\n None,\n )\n\n\ndef _sync_nous_pool_from_auth_store() -> None:\n \"\"\"Best-effort pool reseed after providers.nous changes; never fail login.\"\"\"\n try:\n from agent.credential_pool import load_pool\n\n load_pool(\"nous\")\n except Exception as exc:\n logger.debug(\"Failed to sync Nous credential pool from auth store: %s\", exc)\n\n\ndef resolve_nous_runtime_credentials(\n *,\n timeout_seconds: float = 15.0,\n insecure: Optional[bool] = None,\n ca_bundle: Optional[str] = None,\n force_refresh: bool = False,\n) -> Dict[str, Any]:\n \"\"\"\n Resolve Nous inference credentials for runtime use.\n\n Ensures access_token is a valid inference-scoped JWT, refreshing it when\n needed. Concurrent processes coordinate through the auth store file lock.\n\n Returns dict with: provider, base_url, api_key, key_id, expires_at,\n expires_in, source (\"invoke_jwt\"), and auth_path.\n \"\"\"\n sequence_id = uuid.uuid4().hex[:12]\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n state = _load_provider_state(auth_store, \"nous\")\n\n if not state:\n raise AuthError(\"Arcen is not logged into Nous Portal.\",\n provider=\"nous\", relogin_required=True)\n\n persisted_state = dict(state)\n state_persisted = False\n\n portal_base_url = (\n _optional_base_url(state.get(\"portal_base_url\"))\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"NOUS_PORTAL_BASE_URL\")\n or DEFAULT_NOUS_PORTAL_URL\n ).rstrip(\"/\")\n inference_base_url = (\n _optional_base_url(state.get(\"inference_base_url\"))\n or os.getenv(\"NOUS_INFERENCE_BASE_URL\")\n or DEFAULT_NOUS_INFERENCE_URL\n ).rstrip(\"/\")\n client_id = str(state.get(\"client_id\") or DEFAULT_NOUS_CLIENT_ID)\n\n def _persist_state(reason: str) -> None:\n nonlocal persisted_state, state_persisted\n # Skip writes where only derived TTL countdowns changed; this keeps\n # the mtime-keyed Nous auth-status cache warm during read paths.\n if (\n _nous_effective_provider_state(state)\n == _nous_effective_provider_state(persisted_state)\n ):\n _oauth_trace(\n \"nous_state_persist_skipped\",\n sequence_id=sequence_id,\n reason=reason,\n )\n return\n try:\n _save_provider_state(auth_store, \"nous\", state)\n _save_auth_store(auth_store)\n except Exception as exc:\n _oauth_trace(\n \"nous_state_persist_failed\",\n sequence_id=sequence_id,\n reason=reason,\n error_type=type(exc).__name__,\n )\n raise\n _oauth_trace(\n \"nous_state_persisted\",\n sequence_id=sequence_id,\n reason=reason,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n access_token_fp=_token_fingerprint(state.get(\"access_token\")),\n )\n persisted_state = dict(state)\n state_persisted = True\n # Mirror post-refresh state to the shared store so sibling\n # profiles don't hold stale refresh_tokens after rotation.\n # Best-effort — any failure is logged and swallowed inside\n # _write_shared_nous_state.\n _write_shared_nous_state(state)\n\n verify = _resolve_verify(insecure=insecure, ca_bundle=ca_bundle, auth_state=state)\n timeout = httpx.Timeout(timeout_seconds if timeout_seconds else 15.0)\n _oauth_trace(\n \"nous_runtime_credentials_start\",\n sequence_id=sequence_id,\n refresh_token_fp=_token_fingerprint(state.get(\"refresh_token\")),\n )\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n\n if not isinstance(access_token, str) or not access_token:\n raise AuthError(\"No access token found for Nous Portal login.\",\n provider=\"nous\", relogin_required=True)\n\n invoke_jwt_status = _nous_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n if force_refresh or invoke_jwt_status is not None:\n with _nous_shared_store_lock(timeout_seconds=max(timeout_seconds + 5.0, AUTH_LOCK_TIMEOUT_SECONDS)):\n if _merge_shared_nous_oauth_state(state):\n access_token = state.get(\"access_token\")\n refresh_token = state.get(\"refresh_token\")\n invoke_jwt_status = _nous_invoke_jwt_status(\n access_token,\n scope=state.get(\"scope\"),\n expires_at=state.get(\"expires_at\"),\n )\n _persist_state(\"post_shared_merge_access_unusable\")\n\n if force_refresh or invoke_jwt_status is not None:\n if not isinstance(refresh_token, str) or not refresh_token:\n reason = invoke_jwt_status or \"force_refresh\"\n raise AuthError(\n \"Nous Portal access token is not a usable inference JWT \"\n f\"({reason}) and no refresh token is available. \"\n \"Re-authenticate with: arcen auth add nous\",\n provider=\"nous\",\n code=reason,\n relogin_required=True,\n )\n\n refresh_reason = \"force_refresh\" if force_refresh else (invoke_jwt_status or \"access_unusable\")\n _oauth_trace(\n \"refresh_start\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n refresh_token_fp=_token_fingerprint(refresh_token),\n )\n try:\n refreshed = _refresh_access_token(\n client=client, portal_base_url=portal_base_url,\n client_id=client_id, refresh_token=refresh_token,\n )\n except AuthError as exc:\n if _is_terminal_nous_refresh_error(exc):\n _quarantine_nous_oauth_state(\n state,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _quarantine_nous_pool_entries(\n auth_store,\n exc,\n reason=\"runtime_access_refresh_failure\",\n )\n _persist_state(\"terminal_runtime_access_refresh_failure\")\n raise\n now = datetime.now(timezone.utc)\n access_ttl = _coerce_ttl_seconds(refreshed.get(\"expires_in\"))\n previous_refresh_token = refresh_token\n state[\"access_token\"] = refreshed[\"access_token\"]\n state[\"refresh_token\"] = refreshed.get(\"refresh_token\") or refresh_token\n state[\"token_type\"] = refreshed.get(\"token_type\") or state.get(\"token_type\") or \"Bearer\"\n state[\"scope\"] = refreshed.get(\"scope\") or state.get(\"scope\")\n refreshed_url = _validate_nous_inference_url_from_network(refreshed.get(\"inference_base_url\"))\n if refreshed_url:\n inference_base_url = refreshed_url\n state[\"obtained_at\"] = now.isoformat()\n state[\"expires_in\"] = access_ttl\n state[\"expires_at\"] = datetime.fromtimestamp(\n now.timestamp() + access_ttl, tz=timezone.utc\n ).isoformat()\n access_token = state[\"access_token\"]\n refresh_token = state[\"refresh_token\"]\n _oauth_trace(\n \"refresh_success\",\n sequence_id=sequence_id,\n reason=refresh_reason,\n previous_refresh_token_fp=_token_fingerprint(previous_refresh_token),\n new_refresh_token_fp=_token_fingerprint(refresh_token),\n )\n # Persist immediately so validation failures cannot drop rotated refresh tokens.\n _persist_state(\"post_refresh_access_token\")\n\n _assert_nous_inference_jwt_usable(\n state,\n access_token=access_token,\n )\n _select_nous_invoke_jwt(\n state,\n access_token=access_token,\n sequence_id=sequence_id,\n )\n\n # Persist routing and TLS metadata for non-interactive refresh.\n state[\"portal_base_url\"] = portal_base_url\n state[\"inference_base_url\"] = inference_base_url\n state[\"client_id\"] = client_id\n state[\"tls\"] = {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n }\n\n _persist_state(\"resolve_nous_runtime_credentials_final\")\n\n if state_persisted:\n _sync_nous_pool_from_auth_store()\n\n api_key = state.get(\"agent_key\")\n if not isinstance(api_key, str) or not api_key:\n raise AuthError(\"Failed to resolve a Nous inference API key\",\n provider=\"nous\", code=\"server_error\")\n\n expires_at = state.get(\"agent_key_expires_at\")\n expires_epoch = _parse_iso_timestamp(expires_at)\n expires_in = (\n max(0, int(expires_epoch - time.time()))\n if expires_epoch is not None\n else _coerce_ttl_seconds(state.get(\"agent_key_expires_in\"))\n )\n\n return {\n \"provider\": \"nous\",\n \"base_url\": inference_base_url,\n \"api_key\": api_key,\n \"key_id\": state.get(\"agent_key_id\"),\n \"expires_at\": expires_at,\n \"expires_in\": expires_in,\n \"source\": NOUS_AUTH_PATH_INVOKE_JWT,\n \"auth_path\": NOUS_AUTH_PATH_INVOKE_JWT,\n }\n\n\n# =============================================================================\n# Status helpers\n# =============================================================================\n\ndef _empty_nous_auth_status() -> Dict[str, Any]:\n return {\n \"logged_in\": False,\n \"portal_base_url\": None,\n \"inference_base_url\": None,\n \"access_expires_at\": None,\n \"agent_key_expires_at\": None,\n \"has_refresh_token\": False,\n \"inference_credential_present\": False,\n \"credential_source\": None,\n }\n\n\ndef _snapshot_nous_pool_status() -> Dict[str, Any]:\n \"\"\"Best-effort status from the credential pool.\n\n This is a fallback only. The auth-store provider state is the runtime source\n of truth because it is what ``resolve_nous_runtime_credentials()`` refreshes.\n \"\"\"\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"nous\")\n if not pool or not pool.has_credentials():\n return _empty_nous_auth_status()\n\n entries = list(pool.entries())\n if not entries:\n return _empty_nous_auth_status()\n\n def _entry_sort_key(entry: Any) -> tuple[float, float, int]:\n agent_exp = _parse_iso_timestamp(getattr(entry, \"agent_key_expires_at\", None)) or 0.0\n access_exp = _parse_iso_timestamp(getattr(entry, \"expires_at\", None)) or 0.0\n priority = int(getattr(entry, \"priority\", 0) or 0)\n return (agent_exp, access_exp, -priority)\n\n entry = max(entries, key=_entry_sort_key)\n runtime_key = getattr(entry, \"runtime_api_key\", None)\n if not runtime_key:\n return _empty_nous_auth_status()\n access_token = getattr(entry, \"access_token\", None)\n auth_type = str(getattr(entry, \"auth_type\", \"\") or \"\").strip().lower()\n refresh_token = getattr(entry, \"refresh_token\", None)\n is_portal_oauth = bool(access_token) and (\n auth_type.startswith(\"oauth\") or bool(refresh_token)\n )\n label = getattr(entry, \"label\", \"unknown\")\n portal_status_url = None\n if is_portal_oauth:\n portal_status_url = (\n getattr(entry, \"portal_base_url\", None)\n or DEFAULT_NOUS_PORTAL_URL\n )\n\n return {\n \"logged_in\": is_portal_oauth,\n \"portal_base_url\": portal_status_url,\n \"inference_base_url\": getattr(entry, \"inference_base_url\", None)\n or getattr(entry, \"runtime_base_url\", None)\n or getattr(entry, \"base_url\", None),\n \"access_token\": access_token if is_portal_oauth else None,\n \"access_expires_at\": getattr(entry, \"expires_at\", None),\n \"agent_key_expires_at\": getattr(entry, \"agent_key_expires_at\", None),\n \"has_refresh_token\": bool(refresh_token),\n \"inference_credential_present\": True,\n \"credential_source\": f\"pool:{label}\",\n \"source\": f\"pool:{label}\",\n }\n except Exception:\n return _empty_nous_auth_status()\n\n\n# ── Process-level memo for get_nous_auth_status() ──\n# get_nous_auth_status() validates state by calling resolve_nous_runtime_credentials(),\n# which does a synchronous OAuth refresh POST to portal.nousresearch.com. That can take\n# ~350ms even on the failure path, and read-only UI surfaces (`arcen tools`, status panels,\n# subscription-feature checks) call it many times per render — `arcen tools` → \"All Platforms\"\n# was firing the refresh ~31× during one menu paint, racking up >13s of HTTP and burning\n# single-use refresh tokens. Cache the snapshot for a few seconds, keyed on the auth.json\n# mtime so that `arcen auth login/logout/add/remove` invalidate naturally on the next call.\n_NOUS_AUTH_STATUS_CACHE_TTL = 15.0 # seconds\n_nous_auth_status_cache: Optional[Tuple[float, Optional[float], Dict[str, Any]]] = None\n\n\ndef _auth_file_mtime() -> Optional[float]:\n try:\n return _auth_file_path().stat().st_mtime\n except FileNotFoundError:\n return None\n except Exception:\n return None\n\n\ndef invalidate_nous_auth_status_cache() -> None:\n \"\"\"Clear the get_nous_auth_status() process-level memo.\n\n Call this from any code path that mutates Nous auth state without going\n through resolve_nous_runtime_credentials() (e.g. tests). Login/logout\n flows touch auth.json, so the mtime check below invalidates them\n automatically — explicit invalidation is the belt-and-braces option.\n \"\"\"\n global _nous_auth_status_cache\n _nous_auth_status_cache = None\n\n\ndef get_nous_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Nous auth.\n\n Prefer the auth-store provider state, because that is the live source of\n truth for refresh operations. When provider state exists, validate it\n by resolving runtime credentials so revoked refresh sessions do not show up\n as a healthy login. If provider state is absent, fall back to the credential\n pool for the just-logged-in / not-yet-promoted case.\n\n The returned snapshot is memoised for ~15s keyed on the auth.json mtime,\n so menu/status surfaces that ask repeatedly don't trigger one refresh POST\n per call. Login/logout flows write to auth.json and therefore invalidate\n the cache automatically; tests can also call\n ``invalidate_nous_auth_status_cache()`` explicitly.\n \"\"\"\n global _nous_auth_status_cache\n now = time.monotonic()\n mtime = _auth_file_mtime()\n cached = _nous_auth_status_cache\n if cached is not None:\n cached_at, cached_mtime, cached_status = cached\n if (\n cached_mtime == mtime\n and (now - cached_at) < _NOUS_AUTH_STATUS_CACHE_TTL\n ):\n return dict(cached_status)\n\n status = _compute_nous_auth_status()\n _nous_auth_status_cache = (now, mtime, dict(status))\n return status\n\n\ndef _compute_nous_auth_status() -> Dict[str, Any]:\n \"\"\"Uncached implementation of get_nous_auth_status(). See that function.\"\"\"\n state = get_provider_auth_state(\"nous\")\n if state:\n base_status = {\n \"logged_in\": bool(state.get(\"access_token\")),\n \"portal_base_url\": state.get(\"portal_base_url\"),\n \"inference_base_url\": state.get(\"inference_base_url\"),\n \"access_expires_at\": state.get(\"expires_at\"),\n \"agent_key_expires_at\": state.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(state.get(\"refresh_token\")),\n \"access_token\": state.get(\"access_token\"),\n \"inference_credential_present\": bool(\n state.get(\"access_token\") or state.get(\"agent_key\")\n ),\n \"credential_source\": \"auth_store\",\n \"source\": \"auth_store\",\n }\n try:\n creds = resolve_nous_runtime_credentials()\n refreshed_state = get_provider_auth_state(\"nous\") or state\n base_status.update(\n {\n \"logged_in\": True,\n \"portal_base_url\": refreshed_state.get(\"portal_base_url\") or base_status.get(\"portal_base_url\"),\n \"inference_base_url\": creds.get(\"base_url\")\n or refreshed_state.get(\"inference_base_url\")\n or base_status.get(\"inference_base_url\"),\n \"access_expires_at\": refreshed_state.get(\"expires_at\") or base_status.get(\"access_expires_at\"),\n \"agent_key_expires_at\": creds.get(\"expires_at\")\n or refreshed_state.get(\"agent_key_expires_at\")\n or base_status.get(\"agent_key_expires_at\"),\n \"has_refresh_token\": bool(refreshed_state.get(\"refresh_token\")),\n \"inference_credential_present\": True,\n \"credential_source\": \"auth_store\",\n \"source\": f\"runtime:{creds.get('source', 'portal')}\",\n \"key_id\": creds.get(\"key_id\"),\n }\n )\n return base_status\n except AuthError as exc:\n base_status.update({\n \"logged_in\": False,\n \"error\": str(exc),\n \"relogin_required\": bool(getattr(exc, \"relogin_required\", False)),\n \"error_code\": getattr(exc, \"code\", None),\n })\n return base_status\n\n return _snapshot_nous_pool_status()\n\n\ndef get_codex_auth_status() -> Dict[str, Any]:\n \"\"\"Status snapshot for Codex auth.\n \n Checks the credential pool first (where `arcen auth` stores credentials),\n then falls back to the legacy provider state.\n \"\"\"\n # Check credential pool first — this is where `arcen auth` and\n # `arcen model` store device_code tokens.\n try:\n from agent.credential_pool import load_pool\n pool = load_pool(\"openai-codex\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _codex_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"chatgpt\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n # Fall back to legacy provider state\n try:\n creds = resolve_codex_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_xai_oauth_auth_status() -> Dict[str, Any]:\n try:\n from agent.credential_pool import load_pool\n\n pool = load_pool(\"xai-oauth\")\n if pool and pool.has_credentials():\n entry = pool.select()\n if entry is not None:\n api_key = (\n getattr(entry, \"runtime_api_key\", None)\n or getattr(entry, \"access_token\", \"\")\n )\n if api_key and not _xai_access_token_is_expiring(api_key, 0):\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": getattr(entry, \"last_refresh\", None),\n \"auth_mode\": \"oauth_pkce\",\n \"source\": f\"pool:{getattr(entry, 'label', 'unknown')}\",\n \"api_key\": api_key,\n }\n except Exception:\n pass\n\n try:\n creds = resolve_xai_oauth_runtime_credentials()\n return {\n \"logged_in\": True,\n \"auth_store\": str(_auth_file_path()),\n \"last_refresh\": creds.get(\"last_refresh\"),\n \"auth_mode\": creds.get(\"auth_mode\"),\n \"source\": creds.get(\"source\"),\n \"api_key\": creds.get(\"api_key\"),\n }\n except AuthError as exc:\n return {\n \"logged_in\": False,\n \"auth_store\": str(_auth_file_path()),\n \"error\": str(exc),\n }\n\n\ndef get_api_key_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for API-key providers (z.ai, Kimi, MiniMax).\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n return {\"configured\": False}\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"configured\": bool(api_key),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"key_source\": key_source,\n \"base_url\": base_url,\n \"logged_in\": bool(api_key), # compat with OAuth status shape\n }\n\n\ndef get_external_process_provider_status(provider_id: str) -> Dict[str, Any]:\n \"\"\"Status snapshot for providers that run a local subprocess.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n return {\"configured\": False}\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n resolved_command = shutil.which(command) if command else None\n return {\n \"configured\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n \"provider\": provider_id,\n \"name\": pconfig.name,\n \"command\": command,\n \"args\": args,\n \"resolved_command\": resolved_command,\n \"base_url\": base_url,\n \"logged_in\": bool(resolved_command or base_url.startswith(\"acp+tcp://\")),\n }\n\n\ndef get_auth_status(provider_id: Optional[str] = None) -> Dict[str, Any]:\n \"\"\"Generic auth status dispatcher.\"\"\"\n target = (provider_id or get_active_provider() or \"\").strip().lower()\n if not target:\n return {\"logged_in\": False}\n if target == \"spotify\":\n return get_spotify_auth_status()\n if target == \"nous\":\n return get_nous_auth_status()\n if target == \"openai-codex\":\n return get_codex_auth_status()\n if target == \"xai-oauth\":\n return get_xai_oauth_auth_status()\n if target == \"qwen-oauth\":\n return get_qwen_auth_status()\n if target == \"google-gemini-cli\":\n return get_gemini_oauth_auth_status()\n if target == \"minimax-oauth\":\n return get_minimax_oauth_auth_status()\n if target == \"copilot-acp\":\n return get_external_process_provider_status(target)\n if target == \"azure-foundry\":\n return _get_azure_foundry_auth_status()\n # API-key providers\n pconfig = PROVIDER_REGISTRY.get(target)\n if pconfig and pconfig.auth_type == \"api_key\":\n return get_api_key_provider_status(target)\n # AWS SDK providers (Bedrock) — check via boto3 credential chain\n if pconfig and pconfig.auth_type == \"aws_sdk\":\n try:\n from agent.bedrock_adapter import has_aws_credentials\n return {\"logged_in\": has_aws_credentials(), \"provider\": target}\n except ImportError:\n return {\"logged_in\": False, \"provider\": target, \"error\": \"boto3 not installed\"}\n return {\"logged_in\": False}\n\n\ndef _get_azure_foundry_auth_status() -> Dict[str, Any]:\n \"\"\"Return structural auth status for Azure Foundry.\n\n ``logged_in`` is structural, matching other non-OAuth provider status\n checks:\n\n * ``auth_mode == \"entra_id\"`` AND ``azure-identity`` is importable\n (we do NOT mint a token here; ``arcen doctor`` runs the live\n probe and reports whether the credential chain can acquire one).\n * ``auth_mode == \"api_key\"`` (default) AND ``AZURE_FOUNDRY_API_KEY``\n is set with a usable value.\n\n Never invokes the Entra credential chain — keeps CLI startup latency\n flat regardless of token-service / az login state.\n \"\"\"\n info: Dict[str, Any] = {\"provider\": \"azure-foundry\"}\n try:\n from arcen_cli.config import load_config, get_env_value\n cfg = load_config()\n except Exception:\n cfg = {}\n\n model_cfg = cfg.get(\"model\") if isinstance(cfg, dict) else None\n auth_mode = \"api_key\"\n base_url = \"\"\n if isinstance(model_cfg, dict):\n auth_mode = str(model_cfg.get(\"auth_mode\") or \"api_key\").strip().lower() or \"api_key\"\n base_url = str(model_cfg.get(\"base_url\") or \"\").strip()\n info[\"auth_mode\"] = auth_mode\n info[\"base_url\"] = base_url\n\n if auth_mode == \"entra_id\":\n try:\n from agent.azure_identity_adapter import (\n EntraIdentityConfig,\n SCOPE_AI_AZURE_DEFAULT,\n has_azure_identity_installed,\n )\n installed = has_azure_identity_installed()\n entra_cfg = {}\n if isinstance(model_cfg, dict) and isinstance(model_cfg.get(\"entra\"), dict):\n entra_cfg = model_cfg[\"entra\"]\n identity_config = EntraIdentityConfig.from_dict(\n entra_cfg,\n default_scope=SCOPE_AI_AZURE_DEFAULT,\n )\n info[\"azure_identity_installed\"] = installed\n info[\"scope\"] = identity_config.scope\n info[\"credential_probe\"] = \"not_run\"\n info[\"credential_verified\"] = False\n info[\"logged_in\"] = bool(installed)\n if not installed:\n info[\"hint\"] = (\n \"azure-identity not installed. Install with: \"\n \"pip install azure-identity (or rely on Arcen' \"\n \"lazy-install at first use).\"\n )\n else:\n info[\"hint\"] = (\n \"azure-identity is installed; live credential validation \"\n \"is skipped here. Run `arcen doctor` to verify token acquisition.\"\n )\n return info\n except Exception as exc:\n info[\"logged_in\"] = False\n info[\"error\"] = f\"azure-identity check failed: {exc}\"\n return info\n\n # api_key mode (default)\n try:\n api_key = get_env_value(\"AZURE_FOUNDRY_API_KEY\") or os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n except Exception:\n api_key = os.getenv(\"AZURE_FOUNDRY_API_KEY\", \"\")\n info[\"logged_in\"] = has_usable_secret(api_key)\n return info\n\n\ndef resolve_api_key_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve API key and base URL for an API-key provider.\n\n Returns dict with: provider, api_key, base_url, source.\n \"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"api_key\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an API-key provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n api_key = \"\"\n key_source = \"\"\n api_key, key_source = _resolve_api_key_provider_secret(provider_id, pconfig)\n\n # No-auth LM Studio: substitute a placeholder so runtime / auxiliary_client\n # see the local server as configured. doctor still reports unconfigured\n # because get_api_key_provider_status uses the raw secret resolver.\n if not api_key and provider_id == \"lmstudio\":\n api_key = LMSTUDIO_NOAUTH_PLACEHOLDER\n key_source = key_source or \"default\"\n\n env_url = \"\"\n if pconfig.base_url_env_var:\n env_url = os.getenv(pconfig.base_url_env_var, \"\").strip()\n\n if provider_id in {\"kimi-coding\", \"kimi-coding-cn\"}:\n base_url = _resolve_kimi_base_url(api_key, pconfig.inference_base_url, env_url)\n elif provider_id == \"zai\":\n base_url = _resolve_zai_base_url(api_key, pconfig.inference_base_url, env_url)\n elif env_url:\n base_url = env_url.rstrip(\"/\")\n else:\n base_url = pconfig.inference_base_url\n\n return {\n \"provider\": provider_id,\n \"api_key\": api_key,\n \"base_url\": base_url.rstrip(\"/\"),\n \"source\": key_source or \"default\",\n }\n\n\ndef resolve_external_process_provider_credentials(provider_id: str) -> Dict[str, Any]:\n \"\"\"Resolve runtime details for local subprocess-backed providers.\"\"\"\n pconfig = PROVIDER_REGISTRY.get(provider_id)\n if not pconfig or pconfig.auth_type != \"external_process\":\n raise AuthError(\n f\"Provider '{provider_id}' is not an external-process provider.\",\n provider=provider_id,\n code=\"invalid_provider\",\n )\n\n base_url = os.getenv(pconfig.base_url_env_var, \"\").strip() if pconfig.base_url_env_var else \"\"\n if not base_url:\n base_url = pconfig.inference_base_url\n\n command = (\n os.getenv(\"ARCEN_COPILOT_ACP_COMMAND\", \"\").strip()\n or os.getenv(\"COPILOT_CLI_PATH\", \"\").strip()\n or \"copilot\"\n )\n raw_args = os.getenv(\"ARCEN_COPILOT_ACP_ARGS\", \"\").strip()\n args = shlex.split(raw_args) if raw_args else [\"--acp\", \"--stdio\"]\n resolved_command = shutil.which(command) if command else None\n if not resolved_command and not base_url.startswith(\"acp+tcp://\"):\n raise AuthError(\n f\"Could not find the Copilot CLI command '{command}'. \"\n \"Install GitHub Copilot CLI or set ARCEN_COPILOT_ACP_COMMAND/COPILOT_CLI_PATH.\",\n provider=provider_id,\n code=\"missing_copilot_cli\",\n )\n\n return {\n \"provider\": provider_id,\n \"api_key\": \"copilot-acp\",\n \"base_url\": base_url.rstrip(\"/\"),\n \"command\": resolved_command or command,\n \"args\": args,\n \"source\": \"process\",\n }\n\n\n# =============================================================================\n# CLI Commands — login / logout\n# =============================================================================\n\ndef _update_config_for_provider(\n provider_id: str,\n inference_base_url: str,\n default_model: Optional[str] = None,\n) -> Path:\n \"\"\"Update config.yaml and auth.json to reflect the active provider.\n\n When *default_model* is provided the function also writes it as the\n ``model.default`` value. This prevents a race condition where the\n gateway (which re-reads config per-message) picks up the new provider\n before the caller has finished model selection, resulting in a\n mismatched model/provider (e.g. ``anthropic/claude-opus-4.6`` sent to\n MiniMax's API).\n \"\"\"\n # Set active_provider in auth.json so auto-resolution picks this provider\n with _auth_store_lock():\n auth_store = _load_auth_store()\n auth_store[\"active_provider\"] = provider_id\n _save_auth_store(auth_store)\n\n # Update config.yaml model section\n config_path = get_config_path()\n config_path.parent.mkdir(parents=True, exist_ok=True)\n\n config = read_raw_config()\n\n current_model = config.get(\"model\")\n if isinstance(current_model, dict):\n model_cfg = dict(current_model)\n elif isinstance(current_model, str) and current_model.strip():\n model_cfg = {\"default\": current_model.strip()}\n else:\n model_cfg = {}\n\n model_cfg[\"provider\"] = provider_id\n if inference_base_url and inference_base_url.strip():\n model_cfg[\"base_url\"] = inference_base_url.rstrip(\"/\")\n else:\n # Clear stale base_url to prevent contamination when switching providers\n model_cfg.pop(\"base_url\", None)\n\n # Clear stale api_key/api_mode left over from a previous custom provider.\n # When the user switches from e.g. a MiniMax custom endpoint\n # (api_mode=anthropic_messages, api_key=mxp-...) to a built-in provider\n # (e.g. OpenRouter), the stale api_key/api_mode would override the new\n # provider's credentials and transport choice. Built-in providers that\n # need a specific api_mode (copilot, xai) set it at request-resolution\n # time via `_copilot_runtime_api_mode` / `_detect_api_mode_for_url`, so\n # removing the persisted value here is safe.\n model_cfg.pop(\"api_key\", None)\n model_cfg.pop(\"api_mode\", None)\n\n # When switching to a non-OpenRouter provider, ensure model.default is\n # valid for the new provider. An OpenRouter-formatted name like\n # \"anthropic/claude-opus-4.6\" will fail on direct-API providers.\n if default_model:\n cur_default = model_cfg.get(\"default\", \"\")\n if not cur_default or \"/\" in cur_default:\n model_cfg[\"default\"] = default_model\n\n config[\"model\"] = model_cfg\n\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _get_config_provider() -> Optional[str]:\n \"\"\"Return model.provider from config.yaml, normalized, if present.\"\"\"\n try:\n config = read_raw_config()\n except Exception:\n return None\n if not config:\n return None\n model = config.get(\"model\")\n if not isinstance(model, dict):\n return None\n provider = model.get(\"provider\")\n if not isinstance(provider, str):\n return None\n provider = provider.strip().lower()\n return provider or None\n\n\ndef _config_provider_matches(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when config.yaml currently selects *provider_id*.\"\"\"\n if not provider_id:\n return False\n return _get_config_provider() == provider_id.strip().lower()\n\n\ndef _should_reset_config_provider_on_logout(provider_id: Optional[str]) -> bool:\n \"\"\"Return True when logout should reset the model provider config.\"\"\"\n if not provider_id:\n return False\n normalized = provider_id.strip().lower()\n return normalized in PROVIDER_REGISTRY and _config_provider_matches(normalized)\n\n\ndef _logout_default_provider_from_config() -> Optional[str]:\n \"\"\"Fallback logout target when auth.json has no active provider.\n\n `arcen logout` historically keyed off auth.json.active_provider only.\n That left users stuck when auth state had already been cleared but\n config.yaml still selected an OAuth provider such as openai-codex for the\n agent model: there was no active auth provider to target, so logout printed\n \"No provider is currently logged in\" and never reset model.provider.\n \"\"\"\n provider = _get_config_provider()\n if provider in {\"nous\", \"openai-codex\", \"xai-oauth\"}:\n return provider\n return None\n\n\ndef _reset_config_provider() -> Path:\n \"\"\"Reset config.yaml provider back to auto after logout.\"\"\"\n config_path = get_config_path()\n if not config_path.exists():\n return config_path\n\n config = read_raw_config()\n if not config:\n return config_path\n\n model = config.get(\"model\")\n if isinstance(model, dict):\n model[\"provider\"] = \"auto\"\n if \"base_url\" in model:\n model[\"base_url\"] = OPENROUTER_BASE_URL\n atomic_yaml_write(config_path, config, sort_keys=False)\n return config_path\n\n\ndef _prompt_model_selection(\n model_ids: List[str],\n current_model: str = \"\",\n pricing: Optional[Dict[str, Dict[str, str]]] = None,\n unavailable_models: Optional[List[str]] = None,\n portal_url: str = \"\",\n unavailable_message: str = \"\",\n) -> Optional[str]:\n \"\"\"Interactive model selection. Puts current_model first with a marker. Returns chosen model ID or None.\n\n If *pricing* is provided (``{model_id: {prompt, completion}}``), a compact\n price indicator is shown next to each model in aligned columns.\n\n If *unavailable_models* is provided, those models are shown grayed out\n and unselectable, with an upgrade link to *portal_url*.\n \"\"\"\n from arcen_cli.models import _format_price_per_mtok\n\n _unavailable = unavailable_models or []\n\n # Reorder: current model first, then the rest (deduplicated)\n ordered = []\n if current_model and current_model in model_ids:\n ordered.append(current_model)\n for mid in model_ids:\n if mid not in ordered:\n ordered.append(mid)\n\n # All models for column-width computation (selectable + unavailable)\n all_models = list(ordered) + list(_unavailable)\n\n # Column-aligned labels when pricing is available\n has_pricing = bool(pricing and any(pricing.get(m) for m in all_models))\n name_col = max((len(m) for m in all_models), default=0) + 2 if has_pricing else 0\n\n # Pre-compute formatted prices and dynamic column widths\n _price_cache: dict[str, tuple[str, str, str]] = {}\n price_col = 3 # minimum width\n cache_col = 0 # only set if any model has cache pricing\n has_cache = False\n if has_pricing:\n for mid in all_models:\n p = pricing.get(mid) # type: ignore[union-attr]\n if p:\n inp = _format_price_per_mtok(p.get(\"prompt\", \"\"))\n out = _format_price_per_mtok(p.get(\"completion\", \"\"))\n cache_read = p.get(\"input_cache_read\", \"\")\n cache = _format_price_per_mtok(cache_read) if cache_read else \"\"\n if cache:\n has_cache = True\n else:\n inp, out, cache = \"\", \"\", \"\"\n _price_cache[mid] = (inp, out, cache)\n price_col = max(price_col, len(inp), len(out))\n cache_col = max(cache_col, len(cache))\n if has_cache:\n cache_col = max(cache_col, 5) # minimum: \"Cache\" header\n\n def _label(mid):\n if has_pricing:\n inp, out, cache = _price_cache.get(mid, (\"\", \"\", \"\"))\n price_part = f\" {inp:>{price_col}} {out:>{price_col}}\"\n if has_cache:\n price_part += f\" {cache:>{cache_col}}\"\n base = f\"{mid:<{name_col}}{price_part}\"\n else:\n base = mid\n if mid == current_model:\n base += \" ← currently in use\"\n return base\n\n # Default cursor on the current model (index 0 if it was reordered to top)\n default_idx = 0\n\n # Build a pricing header hint for the menu title\n menu_title = \"Select default model:\"\n if has_pricing:\n # Align the header with the model column.\n # Each choice is \" {label}\" (2 spaces) and simple_term_menu prepends\n # a 3-char cursor region (\"-> \" or \" \"), so content starts at col 5.\n pad = \" \" * 5\n header = f\"\\n{pad}{'':>{name_col}} {'In':>{price_col}} {'Out':>{price_col}}\"\n if has_cache:\n header += f\" {'Cache':>{cache_col}}\"\n menu_title += header + \" /Mtok\"\n\n # ANSI escape for dim text\n _DIM = \"\\033[2m\"\n _RESET = \"\\033[0m\"\n\n # Try arrow-key menu first, fall back to number input.\n # Uses the shared curses radiolist (ESC/arrow-key handling that works\n # across terminals, incl. those that emit raw escape sequences) instead\n # of simple_term_menu, which conflicts with /dev/tty and left ESC/arrow\n # keys unreliable in the setup model picker.\n try:\n from arcen_cli.curses_ui import curses_radiolist\n\n choices = [_label(mid) for mid in ordered]\n choices.append(\"Enter custom model name\")\n choices.append(\"Skip (keep current)\")\n\n _upgrade_url = (portal_url or DEFAULT_NOUS_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip()\n if not unavailable_footer and _unavailable:\n unavailable_footer = f\"Upgrade at {_upgrade_url} for paid models\"\n\n # The pricing column header (and any unavailable-models block) is shown\n # as a multi-line description above the list so it survives the curses\n # screen clear. menu_title already embeds the aligned price header.\n desc_lines: list[str] = []\n if has_pricing:\n # menu_title is \"Select default model:\\n<pad><header> /Mtok\"\n # Keep only the header portion for the description.\n header_part = menu_title.split(\"\\n\", 1)\n if len(header_part) > 1:\n desc_lines.extend(header_part[1].splitlines())\n if _unavailable:\n for mid in _unavailable:\n desc_lines.append(f\" {_label(mid)}\")\n desc_lines.append(f\" ── {unavailable_footer} ──\")\n description = \"\\n\".join(desc_lines) if desc_lines else None\n\n idx = curses_radiolist(\n \"Select default model:\",\n choices,\n selected=default_idx,\n cancel_returns=-1,\n description=description,\n searchable=True,\n )\n if idx < 0:\n return None\n print()\n if idx < len(ordered):\n return ordered[idx]\n elif idx == len(ordered):\n try:\n custom = input(\"Enter model name: \").strip()\n except (EOFError, KeyboardInterrupt):\n return None\n return custom if custom else None\n return None\n except (ImportError, NotImplementedError, OSError, subprocess.SubprocessError):\n pass\n\n # Fallback: numbered list\n print(menu_title)\n num_width = len(str(len(ordered) + 2))\n for i, mid in enumerate(ordered, 1):\n print(f\" {i:>{num_width}}. {_label(mid)}\")\n n = len(ordered)\n print(f\" {n + 1:>{num_width}}. Enter custom model name\")\n print(f\" {n + 2:>{num_width}}. Skip (keep current)\")\n\n if _unavailable:\n _upgrade_url = (portal_url or DEFAULT_NOUS_PORTAL_URL).rstrip(\"/\")\n unavailable_footer = unavailable_message.strip() or (\n f\"Unavailable models (requires paid tier — upgrade at {_upgrade_url})\"\n )\n print()\n print(f\" {_DIM}── {unavailable_footer} ──{_RESET}\")\n for mid in _unavailable:\n print(f\" {'':>{num_width}} {_DIM}{_label(mid)}{_RESET}\")\n print()\n\n while True:\n try:\n choice = input(f\"Choice [1-{n + 2}] (default: skip): \").strip()\n if not choice:\n return None\n idx = int(choice)\n if 1 <= idx <= n:\n return ordered[idx - 1]\n elif idx == n + 1:\n custom = input(\"Enter model name: \").strip()\n return custom if custom else None\n elif idx == n + 2:\n return None\n print(f\"Please enter 1-{n + 2}\")\n except ValueError:\n print(\"Please enter a number\")\n except (KeyboardInterrupt, EOFError):\n return None\n\n\ndef _save_model_choice(model_id: str) -> None:\n \"\"\"Save the selected model to config.yaml (single source of truth).\n\n The model is stored in config.yaml only — NOT in .env. This avoids\n conflicts in multi-agent setups where env vars would stomp each other.\n \"\"\"\n from arcen_cli.config import save_config, load_config\n\n config = load_config()\n # Always use dict format so provider/base_url can be stored alongside\n if isinstance(config.get(\"model\"), dict):\n config[\"model\"][\"default\"] = model_id\n else:\n config[\"model\"] = {\"default\": model_id}\n save_config(config)\n\n\ndef login_command(args) -> None:\n \"\"\"Deprecated: use 'arcen model' or 'arcen setup' instead.\"\"\"\n print(\"The 'arcen login' command has been removed.\")\n print(\"Use 'arcen auth' to manage credentials,\")\n print(\"'arcen model' to select a provider, or 'arcen setup' for full setup.\")\n raise SystemExit(0)\n\n\ndef _login_openai_codex(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n \"\"\"OpenAI Codex login via device code flow. Tokens stored in ~/.arcen/auth.json.\"\"\"\n\n del args, pconfig # kept for parity with other provider login helpers\n\n # Check for existing Arcen-owned credentials\n if not force_new_login:\n try:\n existing = resolve_codex_runtime_credentials()\n # Verify the resolved token is actually usable (not expired).\n # resolve_codex_runtime_credentials attempts refresh, so if we get\n # here the token should be valid — but double-check before telling\n # the user \"Login successful!\".\n _resolved_key = existing.get(\"api_key\", \"\")\n if isinstance(_resolved_key, str) and _resolved_key and not _codex_access_token_is_expiring(_resolved_key, 60):\n print(\"Existing Codex credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\"openai-codex\", existing.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n else:\n print(\"Existing Codex credentials are expired. Starting fresh login...\")\n except AuthError:\n pass\n\n # Check for existing Codex CLI tokens we can import\n if not force_new_login:\n cli_tokens = _import_codex_cli_tokens()\n if cli_tokens:\n print(\"Found existing Codex CLI credentials at ~/.codex/auth.json\")\n print(\"Arcen will create its own session to avoid conflicts with Codex CLI / VS Code.\")\n try:\n do_import = input(\"Import these credentials? (a separate login is recommended) [y/N]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"n\"\n if do_import in {\"y\", \"yes\"}:\n _save_codex_tokens(cli_tokens)\n base_url = os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\") or DEFAULT_CODEX_BASE_URL\n config_path = _update_config_for_provider(\"openai-codex\", base_url)\n print()\n print(\"Credentials imported. Note: if Codex CLI refreshes its token,\")\n print(\"Arcen will keep working independently with its own session.\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n return\n\n # Run a fresh device code flow — Arcen gets its own OAuth session\n print()\n print(\"Signing in to OpenAI Codex...\")\n print(\"(Arcen creates its own session — won't affect Codex CLI or VS Code)\")\n print()\n\n creds = _codex_device_code_login()\n\n # Save tokens to Arcen auth store\n _save_codex_tokens(creds[\"tokens\"], creds.get(\"last_refresh\"))\n config_path = _update_config_for_provider(\"openai-codex\", creds.get(\"base_url\", DEFAULT_CODEX_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=openai-codex)\")\n\n\ndef _login_xai_oauth(\n args,\n pconfig: ProviderConfig,\n *,\n force_new_login: bool = False,\n) -> None:\n del pconfig\n\n if not force_new_login:\n try:\n existing = resolve_xai_oauth_runtime_credentials()\n api_key = existing.get(\"api_key\", \"\")\n if isinstance(api_key, str) and api_key and not _xai_access_token_is_expiring(api_key, 60):\n print(\"Existing xAI OAuth credentials found in Arcen auth store.\")\n try:\n reuse = input(\"Use existing credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n reuse = \"y\"\n if reuse in {\"\", \"y\", \"yes\"}:\n config_path = _update_config_for_provider(\n \"xai-oauth\",\n existing.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL),\n )\n print()\n print(\"Login successful!\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n return\n except AuthError:\n pass\n\n print()\n print(\"Signing in to xAI Grok OAuth (SuperGrok / Premium+)...\")\n print(\"(Arcen creates its own local OAuth session)\")\n print()\n\n timeout_seconds = float(getattr(args, \"timeout\", None) or 20.0)\n open_browser = not getattr(args, \"no_browser\", False)\n if _is_remote_session():\n open_browser = False\n manual_paste = bool(getattr(args, \"manual_paste\", False))\n\n creds = _xai_oauth_loopback_login(\n timeout_seconds=timeout_seconds,\n open_browser=open_browser,\n manual_paste=manual_paste,\n )\n _save_xai_oauth_tokens(\n creds[\"tokens\"],\n discovery=creds.get(\"discovery\"),\n redirect_uri=creds.get(\"redirect_uri\", \"\"),\n last_refresh=creds.get(\"last_refresh\"),\n )\n config_path = _update_config_for_provider(\"xai-oauth\", creds.get(\"base_url\", DEFAULT_XAI_OAUTH_BASE_URL))\n print()\n print(\"Login successful!\")\n from arcen_constants import display_arcen_home as _dhh\n print(f\" Auth state: {_dhh()}/auth.json\")\n print(f\" Config updated: {config_path} (model.provider=xai-oauth)\")\n\n\ndef _xai_oauth_build_authorize_url(\n *,\n authorization_endpoint: str,\n redirect_uri: str,\n code_challenge: str,\n state: str,\n nonce: str,\n) -> str:\n # `plan=generic` opts the consent screen into xAI's generic OAuth plan\n # tier instead of falling back to the per-account default. Without it,\n # accounts.x.ai rejects loopback OAuth from non-allowlisted clients.\n # `referrer=arcen-agent` lets xAI attribute Arcen-originated logins\n # in their OAuth server logs (we still impersonate the upstream Grok-CLI\n # client_id; this is best-effort attribution until xAI mints us our own).\n authorize_params = {\n \"response_type\": \"code\",\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"redirect_uri\": redirect_uri,\n \"scope\": XAI_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n \"nonce\": nonce,\n \"plan\": \"generic\",\n \"referrer\": \"arcen-agent\",\n }\n return f\"{authorization_endpoint}?{urlencode(authorize_params)}\"\n\n\ndef _xai_oauth_exchange_code_for_tokens(\n *,\n token_endpoint: str,\n code: str,\n redirect_uri: str,\n code_verifier: str,\n code_challenge: str,\n timeout_seconds: float = 20.0,\n) -> Dict[str, Any]:\n \"\"\"POST the authorization code to xAI's token endpoint and return\n the parsed JSON payload.\n\n Sends ``code_verifier`` as required by RFC 7636 §4.5. Also echoes\n ``code_challenge`` + ``code_challenge_method`` in the request body\n as a defense-in-depth measure for OAuth servers (xAI's among them,\n per #26990) that re-validate the challenge at the token step\n instead of relying solely on server-side session state captured\n during the authorize step. Echoing the challenge is harmless for\n strict RFC-compliant servers — RFC 7636 doesn't forbid additional\n parameters at the token endpoint — and decisively fixes the\n ``code_challenge is required`` failure mode users hit on the\n loopback flow.\n\n Raises :class:`AuthError` on any non-2xx response or transport\n failure; the error message embeds the HTTP status code and the\n full response body so users can disambiguate cause at a glance.\n \"\"\"\n # Paranoia: if upstream call sites ever drop ``code_verifier`` we\n # want to surface a precise, local error rather than send a\n # missing-PKCE request to xAI and receive their generic \"code\n # challenge required\" message back.\n if not code_verifier:\n raise AuthError(\n \"xAI token exchange refused locally: PKCE code_verifier is empty. \"\n \"This is a bug in Arcen — please report at \"\n \"https://github.com/NousResearch/arcen-agent/issues/26990.\",\n provider=\"xai-oauth\",\n code=\"xai_pkce_verifier_missing\",\n )\n\n data = {\n \"grant_type\": \"authorization_code\",\n \"code\": code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": XAI_OAUTH_CLIENT_ID,\n \"code_verifier\": code_verifier,\n }\n # Defense-in-depth: include the original ``code_challenge`` and\n # ``code_challenge_method``. Some OAuth servers (including xAI's\n # auth.x.ai implementation, per the symptom reported in #26990)\n # validate these at the token endpoint instead of relying purely on\n # state captured during the authorize step — without them, xAI\n # rejects the exchange with ``code_challenge is required`` even\n # though we sent a valid ``code_verifier``.\n if code_challenge:\n data[\"code_challenge\"] = code_challenge\n data[\"code_challenge_method\"] = \"S256\"\n\n try:\n response = httpx.post(\n token_endpoint,\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n data=data,\n timeout=max(20.0, timeout_seconds),\n )\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange failed: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n ) from exc\n\n if response.status_code != 200:\n body = response.text.strip()\n # See ``refresh_xai_oauth_pure`` — token-exchange 403 also\n # surfaces tier/entitlement gating from xAI's backend. Avoid\n # the misleading \"re-authenticate\" hint and point at the API\n # key fallback. See #26847.\n if response.status_code == 403:\n raise AuthError(\n f\"xAI token exchange failed (HTTP 403).\"\n + (f\" Response: {body}\" if body else \"\")\n + \" This OAuth account is not authorized for xAI API\"\n \" access — xAI may be restricting API/OAuth use to\"\n \" specific SuperGrok tiers despite the in-app\"\n \" subscription being active. Set ``XAI_API_KEY``\"\n \" and switch to ``provider: xai`` (API-key path) if\"\n \" available, or upgrade your subscription at\"\n \" https://x.ai/grok.\",\n provider=\"xai-oauth\",\n code=\"xai_oauth_tier_denied\",\n relogin_required=False,\n )\n raise AuthError(\n f\"xAI token exchange failed (HTTP {response.status_code}).\"\n + (f\" Response: {body}\" if body else \"\"),\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_failed\",\n )\n\n try:\n payload = response.json()\n except Exception as exc:\n raise AuthError(\n f\"xAI token exchange returned invalid JSON: {exc}\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n ) from exc\n if not isinstance(payload, dict):\n raise AuthError(\n \"xAI token exchange response was not a JSON object.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n return payload\n\n\ndef _xai_oauth_loopback_login(\n *,\n timeout_seconds: float = 20.0,\n open_browser: bool = True,\n manual_paste: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Run the xAI OAuth PKCE flow.\n\n When ``manual_paste=True`` the loopback HTTP listener is skipped\n entirely and the user is prompted to paste the failed callback\n URL into stdin (regression fix for #26923 — browser-only remote\n consoles like GCP Cloud Shell / GitHub Codespaces / EC2 Instance\n Connect, where the laptop's browser can't reach 127.0.0.1 on the\n remote VM). The same PKCE verifier, ``state``, and ``nonce`` are\n used for both paths so the upstream-side OAuth flow is identical.\n \"\"\"\n def _stdin_supports_manual_paste() -> bool:\n try:\n return bool(getattr(sys.stdin, \"isatty\", lambda: False)())\n except Exception:\n return False\n\n discovery = _xai_oauth_discovery(timeout_seconds)\n authorization_endpoint = discovery[\"authorization_endpoint\"]\n token_endpoint = discovery[\"token_endpoint\"]\n\n if manual_paste:\n # No HTTP listener — synthesize a redirect_uri matching what\n # the server would have bound to so the authorize URL the user\n # opens (and the redirect_uri sent in the token exchange) stay\n # byte-identical to the loopback path. xAI's token endpoint\n # cross-checks redirect_uri against the authorize request.\n redirect_uri = (\n f\"http://{XAI_OAUTH_REDIRECT_HOST}:{XAI_OAUTH_REDIRECT_PORT}\"\n f\"{XAI_OAUTH_REDIRECT_PATH}\"\n )\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n callback = _prompt_manual_callback_paste(redirect_uri)\n else:\n server, thread, callback_result, redirect_uri = _xai_start_callback_server()\n try:\n _xai_validate_loopback_redirect_uri(redirect_uri)\n code_verifier = _oauth_pkce_code_verifier()\n code_challenge = _oauth_pkce_code_challenge(code_verifier)\n state = uuid.uuid4().hex\n nonce = uuid.uuid4().hex\n authorize_url = _xai_oauth_build_authorize_url(\n authorization_endpoint=authorization_endpoint,\n redirect_uri=redirect_uri,\n code_challenge=code_challenge,\n state=state,\n nonce=nonce,\n )\n\n print(\"Open this URL to authorize Arcen with xAI:\")\n print(authorize_url)\n print()\n print(f\"Waiting for callback on {redirect_uri}\")\n\n _print_loopback_ssh_hint(redirect_uri, docs_url=XAI_OAUTH_DOCS_URL)\n\n if open_browser and not _is_remote_session() and _can_open_graphical_browser():\n try:\n opened = webbrowser.open(authorize_url)\n except Exception:\n opened = False\n if opened:\n print(\"Browser opened for xAI authorization.\")\n else:\n print(\"Could not open the browser automatically; use the URL above.\")\n\n try:\n callback = _xai_wait_for_callback(\n server,\n thread,\n callback_result,\n timeout_seconds=max(30.0, timeout_seconds * 9),\n )\n except AuthError as exc:\n if (\n getattr(exc, \"code\", \"\") != \"xai_callback_timeout\"\n or not _stdin_supports_manual_paste()\n ):\n raise\n print()\n print(\"xAI loopback callback timed out.\")\n print(\"If your browser reached a failed 127.0.0.1 callback page,\")\n print(\"paste that FULL callback URL below to continue this login.\")\n print(\"You can also re-run with `--manual-paste` to skip the\")\n print(\"loopback listener from the start.\")\n callback = _prompt_manual_callback_paste(redirect_uri)\n if callback.get(\"code\") is None and callback.get(\"error\") is None:\n raise exc\n except Exception:\n try:\n server.shutdown()\n server.server_close()\n except Exception:\n pass\n try:\n thread.join(timeout=1.0)\n except Exception:\n pass\n raise\n\n if callback.get(\"error\"):\n detail = callback.get(\"error_description\") or callback[\"error\"]\n raise AuthError(\n f\"xAI authorization failed: {detail}\",\n provider=\"xai-oauth\",\n code=\"xai_authorization_failed\",\n )\n callback_state = callback.get(\"state\")\n # Manual-paste bare-code path: when a user pastes only the opaque\n # authorization code (no ``code=``/``state=`` query parameters),\n # ``_parse_pasted_callback`` returns ``state=None``. xAI's consent\n # page renders the code in-page rather than redirecting through the\n # 127.0.0.1 callback, so on many remote setups (Cloud Shell, headless\n # VPS, container consoles) the bare code is the only thing the user\n # can obtain. PKCE (code_verifier) still binds the exchange to this\n # client, so the local state-equality check is redundant on the\n # bare-code path — we substitute the locally generated state to keep\n # the rest of the validation chain (and the token exchange) unchanged.\n # See #26923 (AccursedGalaxy comment, 2026-05-20).\n if callback_state is None and manual_paste:\n callback_state = state\n if callback_state != state:\n raise AuthError(\n \"xAI authorization failed: state mismatch.\",\n provider=\"xai-oauth\",\n code=\"xai_state_mismatch\",\n )\n code = str(callback.get(\"code\") or \"\").strip()\n if not code:\n raise AuthError(\n \"xAI authorization failed: missing authorization code.\",\n provider=\"xai-oauth\",\n code=\"xai_code_missing\",\n )\n\n payload = _xai_oauth_exchange_code_for_tokens(\n token_endpoint=token_endpoint,\n code=code,\n redirect_uri=redirect_uri,\n code_verifier=code_verifier,\n code_challenge=code_challenge,\n timeout_seconds=timeout_seconds,\n )\n access_token = str(payload.get(\"access_token\", \"\") or \"\").strip()\n refresh_token = str(payload.get(\"refresh_token\", \"\") or \"\").strip()\n if not access_token:\n raise AuthError(\n \"xAI token exchange did not return an access_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n if not refresh_token:\n raise AuthError(\n \"xAI token exchange did not return a refresh_token.\",\n provider=\"xai-oauth\",\n code=\"xai_token_exchange_invalid\",\n )\n\n base_url = _xai_validate_inference_base_url(\n os.getenv(\"ARCEN_XAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n or os.getenv(\"XAI_BASE_URL\", \"\").strip().rstrip(\"/\"),\n fallback=DEFAULT_XAI_OAUTH_BASE_URL,\n )\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n \"id_token\": str(payload.get(\"id_token\", \"\") or \"\").strip(),\n \"expires_in\": payload.get(\"expires_in\"),\n \"token_type\": str(payload.get(\"token_type\") or \"Bearer\").strip() or \"Bearer\",\n },\n \"discovery\": discovery,\n \"redirect_uri\": redirect_uri,\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"source\": \"oauth-loopback\",\n }\n\n\ndef _codex_device_code_login() -> Dict[str, Any]:\n \"\"\"Run the OpenAI device code login flow and return credentials dict.\"\"\"\n import time as _time\n\n issuer = \"https://auth.openai.com\"\n client_id = CODEX_OAUTH_CLIENT_ID\n\n # Step 1: Request device code\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/usercode\",\n json={\"client_id\": client_id},\n headers={\"Content-Type\": \"application/json\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Failed to request device code: {exc}\",\n provider=\"openai-codex\", code=\"device_code_request_failed\",\n )\n\n if resp.status_code != 200:\n raise AuthError(\n f\"Device code request returned status {resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_request_error\",\n )\n\n device_data = resp.json()\n user_code = device_data.get(\"user_code\", \"\")\n device_auth_id = device_data.get(\"device_auth_id\", \"\")\n poll_interval = max(3, int(device_data.get(\"interval\", \"5\")))\n\n if not user_code or not device_auth_id:\n raise AuthError(\n \"Device code response missing required fields.\",\n provider=\"openai-codex\", code=\"device_code_incomplete\",\n )\n\n # Step 2: Show user the code\n print(\"To continue, follow these steps:\\n\")\n print(\" 1. Open this URL in your browser:\")\n print(f\" \\033[94m{issuer}/codex/device\\033[0m\\n\")\n print(\" 2. Enter this code:\")\n print(f\" \\033[94m{user_code}\\033[0m\\n\")\n print(\"Waiting for sign-in... (press Ctrl+C to cancel)\")\n\n # Step 3: Poll for authorization code\n max_wait = 15 * 60 # 15 minutes\n start = _time.monotonic()\n code_resp = None\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n while _time.monotonic() - start < max_wait:\n _time.sleep(poll_interval)\n poll_resp = client.post(\n f\"{issuer}/api/accounts/deviceauth/token\",\n json={\"device_auth_id\": device_auth_id, \"user_code\": user_code},\n headers={\"Content-Type\": \"application/json\"},\n )\n\n if poll_resp.status_code == 200:\n code_resp = poll_resp.json()\n break\n elif poll_resp.status_code in {403, 404}:\n continue # User hasn't completed login yet\n else:\n raise AuthError(\n f\"Device auth polling returned status {poll_resp.status_code}.\",\n provider=\"openai-codex\", code=\"device_code_poll_error\",\n )\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n\n if code_resp is None:\n raise AuthError(\n \"Login timed out after 15 minutes.\",\n provider=\"openai-codex\", code=\"device_code_timeout\",\n )\n\n # Step 4: Exchange authorization code for tokens\n authorization_code = code_resp.get(\"authorization_code\", \"\")\n code_verifier = code_resp.get(\"code_verifier\", \"\")\n redirect_uri = f\"{issuer}/deviceauth/callback\"\n\n if not authorization_code or not code_verifier:\n raise AuthError(\n \"Device auth response missing authorization_code or code_verifier.\",\n provider=\"openai-codex\", code=\"device_code_incomplete_exchange\",\n )\n\n try:\n with httpx.Client(timeout=httpx.Timeout(15.0)) as client:\n token_resp = client.post(\n CODEX_OAUTH_TOKEN_URL,\n data={\n \"grant_type\": \"authorization_code\",\n \"code\": authorization_code,\n \"redirect_uri\": redirect_uri,\n \"client_id\": client_id,\n \"code_verifier\": code_verifier,\n },\n headers={\"Content-Type\": \"application/x-www-form-urlencoded\"},\n )\n except Exception as exc:\n raise AuthError(\n f\"Token exchange failed: {exc}\",\n provider=\"openai-codex\", code=\"token_exchange_failed\",\n )\n\n if token_resp.status_code != 200:\n raise AuthError(\n f\"Token exchange returned status {token_resp.status_code}.\",\n provider=\"openai-codex\", code=\"token_exchange_error\",\n )\n\n tokens = token_resp.json()\n access_token = tokens.get(\"access_token\", \"\")\n refresh_token = tokens.get(\"refresh_token\", \"\")\n\n if not access_token:\n raise AuthError(\n \"Token exchange did not return an access_token.\",\n provider=\"openai-codex\", code=\"token_exchange_no_access_token\",\n )\n\n # Return tokens for the caller to persist (no longer writes to ~/.codex/)\n base_url = (\n os.getenv(\"ARCEN_CODEX_BASE_URL\", \"\").strip().rstrip(\"/\")\n or DEFAULT_CODEX_BASE_URL\n )\n\n return {\n \"tokens\": {\n \"access_token\": access_token,\n \"refresh_token\": refresh_token,\n },\n \"base_url\": base_url,\n \"last_refresh\": datetime.now(timezone.utc).isoformat().replace(\"+00:00\", \"Z\"),\n \"auth_mode\": \"chatgpt\",\n \"source\": \"device-code\",\n }\n\n\n# ==================== MiniMax Portal OAuth ====================\n\ndef _minimax_pkce_pair() -> tuple:\n \"\"\"Generate (code_verifier, code_challenge_S256, state) for MiniMax OAuth.\"\"\"\n import secrets\n verifier = secrets.token_urlsafe(64)[:96]\n challenge = base64.urlsafe_b64encode(\n hashlib.sha256(verifier.encode()).digest()\n ).decode().rstrip(\"=\")\n state = secrets.token_urlsafe(16)\n return verifier, challenge, state\n\n\ndef _minimax_request_user_code(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n code_challenge: str, state: str,\n) -> Dict[str, Any]:\n response = client.post(\n f\"{portal_base_url}/oauth/code\",\n data={\n \"response_type\": \"code\",\n \"client_id\": client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"code_challenge\": code_challenge,\n \"code_challenge_method\": \"S256\",\n \"state\": state,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n \"x-request-id\": str(uuid.uuid4()),\n },\n )\n if response.status_code != 200:\n raise AuthError(\n f\"MiniMax OAuth authorization failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"authorization_failed\",\n )\n payload = response.json()\n for field in (\"user_code\", \"verification_uri\", \"expired_in\"):\n if field not in payload:\n raise AuthError(\n f\"MiniMax OAuth response missing field: {field}\",\n provider=\"minimax-oauth\", code=\"authorization_incomplete\",\n )\n if payload.get(\"state\") != state:\n raise AuthError(\n \"MiniMax OAuth state mismatch (possible CSRF).\",\n provider=\"minimax-oauth\", code=\"state_mismatch\",\n )\n return payload\n\n\ndef _minimax_expired_in_looks_like_unix_ms(expired_in: int, *, now_ms: int) -> bool:\n \"\"\"True if ``expired_in`` is plausibly a unix-ms absolute time (vs TTL seconds).\"\"\"\n return int(expired_in) > (now_ms // 2)\n\n\ndef _minimax_resolve_token_expiry_unix(expired_in: int, *, now: datetime) -> float:\n \"\"\"Return access-token expiry as unix seconds (MiniMax uses ms epoch or TTL seconds).\"\"\"\n raw = int(expired_in)\n now_ms = int(now.timestamp() * 1000)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n return raw / 1000.0\n return now.timestamp() + max(1, raw)\n\n\ndef _minimax_poll_token(\n client: httpx.Client, *, portal_base_url: str, client_id: str,\n user_code: str, code_verifier: str, expired_in: int, interval_ms: Optional[int],\n) -> Dict[str, Any]:\n # OpenClaw treats expired_in as a unix-ms timestamp (Date.now() < expireTimeMs).\n # Defensive parsing: if it's small enough to be a duration, treat as seconds.\n import time as _time\n now_ms = int(_time.time() * 1000)\n raw = int(expired_in)\n if _minimax_expired_in_looks_like_unix_ms(raw, now_ms=now_ms):\n deadline = raw / 1000.0\n else:\n deadline = _time.time() + max(1, raw)\n interval = max(2.0, (interval_ms or 2000) / 1000.0)\n\n while _time.time() < deadline:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": MINIMAX_OAUTH_GRANT_TYPE,\n \"client_id\": client_id,\n \"user_code\": user_code,\n \"code_verifier\": code_verifier,\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n try:\n payload = response.json() if response.text else {}\n except Exception:\n payload = {}\n\n if response.status_code != 200:\n msg = (payload.get(\"base_resp\", {}) or {}).get(\"status_msg\") or response.text\n raise AuthError(\n f\"MiniMax OAuth error: {msg or 'unknown'}\",\n provider=\"minimax-oauth\", code=\"token_exchange_failed\",\n )\n\n status = payload.get(\"status\")\n if status == \"error\":\n raise AuthError(\n \"MiniMax OAuth reported an error. Please try again later.\",\n provider=\"minimax-oauth\", code=\"authorization_denied\",\n )\n if status == \"success\":\n if not all(payload.get(k) for k in (\"access_token\", \"refresh_token\", \"expired_in\")):\n raise AuthError(\n \"MiniMax OAuth success payload missing required token fields.\",\n provider=\"minimax-oauth\", code=\"token_incomplete\",\n )\n return payload\n # \"pending\" or any other status -> keep polling\n _time.sleep(interval)\n\n raise AuthError(\n \"MiniMax OAuth timed out before authorization completed.\",\n provider=\"minimax-oauth\", code=\"timeout\",\n )\n\n\ndef _minimax_save_auth_state(auth_state: Dict[str, Any]) -> None:\n \"\"\"Persist MiniMax OAuth state to Arcen auth store (~/.arcen/auth.json).\"\"\"\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"minimax-oauth\", auth_state)\n _save_auth_store(auth_store)\n\n\ndef _minimax_oauth_login(\n *, region: str = \"global\", open_browser: bool = True,\n timeout_seconds: float = 15.0,\n) -> Dict[str, Any]:\n \"\"\"Run MiniMax OAuth flow, persist tokens, return auth state dict.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"minimax-oauth\"]\n if region == \"cn\":\n portal_base_url = pconfig.extra[\"cn_portal_base_url\"]\n inference_base_url = pconfig.extra[\"cn_inference_base_url\"]\n else:\n portal_base_url = pconfig.portal_base_url\n inference_base_url = pconfig.inference_base_url\n\n verifier, challenge, state = _minimax_pkce_pair()\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via MiniMax ({region}) OAuth...\")\n print(f\"Portal: {portal_base_url}\")\n\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n headers={\"Accept\": \"application/json\"},\n follow_redirects=True) as client:\n code_data = _minimax_request_user_code(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n code_challenge=challenge, state=state,\n )\n verification_url = str(code_data[\"verification_uri\"])\n user_code = str(code_data[\"user_code\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n if open_browser and _can_open_graphical_browser():\n if webbrowser.open(verification_url):\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically -- use the URL above.\")\n\n interval_raw = code_data.get(\"interval\")\n interval_ms = int(interval_raw) if interval_raw is not None else None\n print(\"Waiting for approval...\")\n\n token_data = _minimax_poll_token(\n client, portal_base_url=portal_base_url,\n client_id=pconfig.client_id,\n user_code=user_code, code_verifier=verifier,\n expired_in=int(code_data[\"expired_in\"]),\n interval_ms=interval_ms,\n )\n\n now = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(token_data[\"expired_in\"]), now=now,\n )\n expires_in_s = max(0, int(expires_at_unix - now.timestamp()))\n\n auth_state = {\n \"provider\": \"minimax-oauth\",\n \"region\": region,\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": inference_base_url,\n \"client_id\": pconfig.client_id,\n \"scope\": MINIMAX_OAUTH_SCOPE,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data[\"refresh_token\"],\n \"resource_url\": token_data.get(\"resource_url\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n }\n\n _minimax_save_auth_state(auth_state)\n print(\"\\u2713 MiniMax OAuth login successful.\")\n if msg := token_data.get(\"notification_message\"):\n print(f\"Note from MiniMax: {msg}\")\n return auth_state\n\n\ndef _refresh_minimax_oauth_state(\n state: Dict[str, Any], *, timeout_seconds: float = 15.0,\n force: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Refresh MiniMax OAuth access token if close to expiry (or forced).\"\"\"\n if not state.get(\"refresh_token\"):\n raise AuthError(\n \"MiniMax OAuth state has no refresh_token; please re-login.\",\n provider=\"minimax-oauth\", code=\"no_refresh_token\", relogin_required=True,\n )\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n except Exception:\n expires_at = 0.0\n now = time.time()\n if not force and (expires_at - now) > MINIMAX_OAUTH_REFRESH_SKEW_SECONDS:\n return state\n\n portal_base_url = state[\"portal_base_url\"]\n with httpx.Client(timeout=httpx.Timeout(timeout_seconds),\n follow_redirects=True) as client:\n response = client.post(\n f\"{portal_base_url}/oauth/token\",\n data={\n \"grant_type\": \"refresh_token\",\n \"client_id\": state[\"client_id\"],\n \"refresh_token\": state[\"refresh_token\"],\n },\n headers={\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n \"Accept\": \"application/json\",\n },\n )\n if response.status_code != 200:\n body = response.text.lower()\n relogin = any(m in body for m in\n (\"invalid_grant\", \"refresh_token_reused\", \"invalid_refresh_token\"))\n raise AuthError(\n f\"MiniMax OAuth refresh failed: {response.text or response.reason_phrase}\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=relogin,\n )\n payload = response.json()\n if payload.get(\"status\") != \"success\":\n raise AuthError(\n \"MiniMax OAuth refresh did not return success.\",\n provider=\"minimax-oauth\", code=\"refresh_failed\",\n relogin_required=True,\n )\n now_dt = datetime.now(timezone.utc)\n expires_at_unix = _minimax_resolve_token_expiry_unix(\n int(payload[\"expired_in\"]), now=now_dt,\n )\n expires_in_s = max(0, int(expires_at_unix - now_dt.timestamp()))\n new_state = dict(state)\n new_state.update({\n \"access_token\": payload[\"access_token\"],\n \"refresh_token\": payload.get(\"refresh_token\", state[\"refresh_token\"]),\n \"obtained_at\": now_dt.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at_unix, tz=timezone.utc).isoformat(),\n \"expires_in\": expires_in_s,\n })\n _minimax_save_auth_state(new_state)\n return new_state\n\n\ndef _minimax_oauth_quarantine_on_terminal_refresh(state: Dict[str, Any], exc: AuthError) -> None:\n \"\"\"Wipe dead tokens from auth.json after a terminal refresh failure.\n\n Shared by both the eager-resolve path and the lazy per-request token\n provider. Mirrors the Nous / xAI-OAuth / Codex-OAuth quarantine pattern\n so subsequent calls fail fast without a network retry.\n \"\"\"\n if not (exc.relogin_required and state.get(\"refresh_token\")):\n return\n for _k in (\"access_token\", \"refresh_token\", \"expires_at\", \"expires_in\", \"obtained_at\"):\n state.pop(_k, None)\n state[\"last_auth_error\"] = {\n \"provider\": \"minimax-oauth\",\n \"code\": exc.code or \"refresh_failed\",\n \"message\": str(exc),\n \"reason\": \"runtime_refresh_failure\",\n \"relogin_required\": True,\n \"at\": datetime.now(timezone.utc).isoformat(),\n }\n try:\n _minimax_save_auth_state(state)\n except Exception as _save_exc:\n logger.debug(\"MiniMax OAuth: failed to persist quarantined state: %s\", _save_exc)\n\n\ndef build_minimax_oauth_token_provider() -> Callable[[], str]:\n \"\"\"Return a zero-arg callable that yields a fresh MiniMax access token.\n\n The Anthropic SDK caches ``api_key`` as a static string at construction\n time, so a session that resolves credentials once at startup will keep\n sending the same bearer until MiniMax's server returns 401 — typically\n ~15 minutes in, because MiniMax issues short-lived access tokens.\n\n Returning a *callable* instead of a string lets us hook into the\n existing Entra-ID bearer infrastructure in\n :mod:`agent.anthropic_adapter`: ``build_anthropic_client`` detects a\n callable and routes through ``_build_anthropic_client_with_bearer_hook``,\n which mints a fresh ``Authorization`` header on every outbound request.\n Each invocation re-reads the persisted state from ``auth.json`` and\n calls :func:`_refresh_minimax_oauth_state` — that helper is a no-op\n when the token still has more than ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS``\n of life left, so the steady-state cost is one file read + one\n timestamp compare per request.\n\n Reading state fresh each time also means a refresh persisted by one\n process (CLI, gateway, cron) is immediately visible to every other\n process sharing the same ``auth.json``.\n \"\"\"\n def _provide() -> str:\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n token = state.get(\"access_token\")\n if not token:\n raise AuthError(\n \"MiniMax OAuth state has no access_token after refresh.\",\n provider=\"minimax-oauth\", code=\"no_access_token\", relogin_required=True,\n )\n return token\n\n return _provide\n\n\ndef resolve_minimax_oauth_runtime_credentials(\n *, min_token_ttl_seconds: int = MINIMAX_OAUTH_REFRESH_SKEW_SECONDS,\n as_token_provider: bool = False,\n) -> Dict[str, Any]:\n \"\"\"Return {provider, api_key, base_url, source} for minimax-oauth.\n\n When ``as_token_provider`` is True, ``api_key`` is a zero-arg callable\n that mints a fresh access token per call (proactively refreshing if\n the cached token is within ``MINIMAX_OAUTH_REFRESH_SKEW_SECONDS`` of\n expiry). This is what the runtime provider path uses so that long\n sessions survive MiniMax's short access-token lifetime — see\n :func:`build_minimax_oauth_token_provider` for the rationale.\n\n The default (string ``api_key``) preserves the historical contract for\n diagnostic call sites like ``arcen status`` that just want to know\n whether a valid token exists right now.\n \"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n raise AuthError(\n \"Not logged into MiniMax OAuth. Run `arcen model` and select \"\n \"MiniMax (OAuth).\",\n provider=\"minimax-oauth\", code=\"not_logged_in\", relogin_required=True,\n )\n try:\n state = _refresh_minimax_oauth_state(state)\n except AuthError as exc:\n _minimax_oauth_quarantine_on_terminal_refresh(state, exc)\n raise\n if as_token_provider:\n api_key: Any = build_minimax_oauth_token_provider()\n else:\n api_key = state[\"access_token\"]\n return {\n \"provider\": \"minimax-oauth\",\n \"api_key\": api_key,\n \"base_url\": state[\"inference_base_url\"].rstrip(\"/\"),\n \"source\": \"oauth\",\n }\n\n\ndef get_minimax_oauth_auth_status() -> Dict[str, Any]:\n \"\"\"Return auth status dict for MiniMax OAuth provider.\"\"\"\n state = get_provider_auth_state(\"minimax-oauth\")\n if not state or not state.get(\"access_token\"):\n return {\"logged_in\": False, \"provider\": \"minimax-oauth\"}\n try:\n expires_at = datetime.fromisoformat(state.get(\"expires_at\", \"\")).timestamp()\n token_valid = (expires_at - time.time()) > 0\n except Exception:\n token_valid = bool(state.get(\"access_token\"))\n return {\n \"logged_in\": token_valid,\n \"provider\": \"minimax-oauth\",\n \"region\": state.get(\"region\", \"global\"),\n \"expires_at\": state.get(\"expires_at\"),\n }\n\n\ndef _login_minimax_oauth(args, pconfig: ProviderConfig) -> None:\n \"\"\"CLI entry for MiniMax OAuth login.\"\"\"\n region = getattr(args, \"region\", None) or \"global\"\n open_browser = not getattr(args, \"no_browser\", False)\n timeout = getattr(args, \"timeout\", None) or 15.0\n try:\n _minimax_oauth_login(\n region=region, open_browser=open_browser, timeout_seconds=timeout,\n )\n except AuthError as exc:\n print(format_auth_error(exc))\n raise SystemExit(1)\n\n\ndef _nous_device_code_login(\n *,\n portal_base_url: Optional[str] = None,\n inference_base_url: Optional[str] = None,\n client_id: Optional[str] = None,\n scope: Optional[str] = None,\n open_browser: bool = True,\n timeout_seconds: float = 15.0,\n insecure: bool = False,\n ca_bundle: Optional[str] = None,\n) -> Dict[str, Any]:\n \"\"\"Run the Nous device-code flow and return full OAuth state without persisting.\"\"\"\n pconfig = PROVIDER_REGISTRY[\"nous\"]\n portal_base_url = (\n portal_base_url\n or os.getenv(\"ARCEN_PORTAL_BASE_URL\")\n or os.getenv(\"NOUS_PORTAL_BASE_URL\")\n or pconfig.portal_base_url\n ).rstrip(\"/\")\n requested_inference_url = (\n inference_base_url\n or os.getenv(\"NOUS_INFERENCE_BASE_URL\")\n or pconfig.inference_base_url\n ).rstrip(\"/\")\n client_id = client_id or pconfig.client_id\n scope = scope or pconfig.scope\n timeout = httpx.Timeout(timeout_seconds)\n verify: bool | str = False if insecure else (ca_bundle if ca_bundle else True)\n\n if _is_remote_session():\n open_browser = False\n\n print(f\"Starting Arcen login via {pconfig.name}...\")\n print(f\"Portal: {portal_base_url}\")\n if insecure:\n print(\"TLS verification: disabled (--insecure)\")\n elif ca_bundle:\n print(f\"TLS verification: custom CA bundle ({ca_bundle})\")\n\n with httpx.Client(timeout=timeout, headers={\"Accept\": \"application/json\"}, verify=verify) as client:\n device_data = _request_device_code(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n scope=scope,\n )\n\n verification_url = str(device_data[\"verification_uri_complete\"])\n user_code = str(device_data[\"user_code\"])\n expires_in = int(device_data[\"expires_in\"])\n interval = int(device_data[\"interval\"])\n\n print()\n print(\"To continue:\")\n print(f\" 1. Open: {verification_url}\")\n print(f\" 2. If prompted, enter code: {user_code}\")\n\n if open_browser:\n opened = webbrowser.open(verification_url)\n if opened:\n print(\" (Opened browser for verification)\")\n else:\n print(\" Could not open browser automatically — use the URL above.\")\n\n effective_interval = max(1, min(interval, DEVICE_AUTH_POLL_INTERVAL_CAP_SECONDS))\n print(f\"Waiting for approval (polling every {effective_interval}s)...\")\n\n token_data = _poll_for_token(\n client=client,\n portal_base_url=portal_base_url,\n client_id=client_id,\n device_code=str(device_data[\"device_code\"]),\n expires_in=expires_in,\n poll_interval=interval,\n )\n\n now = datetime.now(timezone.utc)\n token_expires_in = _coerce_ttl_seconds(token_data.get(\"expires_in\", 0))\n expires_at = now.timestamp() + token_expires_in\n resolved_inference_url = (\n _optional_base_url(token_data.get(\"inference_base_url\"))\n or requested_inference_url\n )\n if resolved_inference_url != requested_inference_url:\n print(f\"Using portal-provided inference URL: {resolved_inference_url}\")\n\n auth_state = {\n \"portal_base_url\": portal_base_url,\n \"inference_base_url\": resolved_inference_url,\n \"client_id\": client_id,\n \"scope\": token_data.get(\"scope\") or scope,\n \"token_type\": token_data.get(\"token_type\", \"Bearer\"),\n \"access_token\": token_data[\"access_token\"],\n \"refresh_token\": token_data.get(\"refresh_token\"),\n \"obtained_at\": now.isoformat(),\n \"expires_at\": datetime.fromtimestamp(expires_at, tz=timezone.utc).isoformat(),\n \"expires_in\": token_expires_in,\n \"tls\": {\n \"insecure\": verify is False,\n \"ca_bundle\": verify if isinstance(verify, str) else None,\n },\n \"agent_key\": None,\n \"agent_key_id\": None,\n \"agent_key_expires_at\": None,\n \"agent_key_expires_in\": None,\n \"agent_key_reused\": None,\n \"agent_key_obtained_at\": None,\n }\n try:\n return refresh_nous_oauth_from_state(\n auth_state,\n timeout_seconds=timeout_seconds,\n force_refresh=False,\n )\n except AuthError as exc:\n if exc.code == \"subscription_required\":\n portal_url = auth_state.get(\n \"portal_base_url\", DEFAULT_NOUS_PORTAL_URL\n ).rstrip(\"/\")\n message = format_auth_error(exc)\n print()\n print(message)\n print(f\" Subscribe here: {portal_url}/billing\")\n print()\n print(\"After subscribing, run `arcen model` again to finish setup.\")\n raise SystemExit(1)\n raise\n\n\ndef _login_nous(args, pconfig: ProviderConfig) -> None:\n \"\"\"Nous Portal device authorization flow.\"\"\"\n timeout_seconds = getattr(args, \"timeout\", None) or 15.0\n insecure = bool(getattr(args, \"insecure\", False))\n ca_bundle = (\n getattr(args, \"ca_bundle\", None)\n or os.getenv(\"ARCEN_CA_BUNDLE\")\n or os.getenv(\"SSL_CERT_FILE\")\n )\n\n try:\n auth_state = None\n\n # Codex-style auto-import: before launching a fresh device-code\n # flow, check the shared store for an existing Nous credential\n # from any other profile. If present, offer to rehydrate it.\n shared = _read_shared_nous_state()\n if shared:\n try:\n shared_path = _nous_shared_store_path()\n except RuntimeError:\n shared_path = None\n print()\n if shared_path:\n print(f\"Found existing Nous OAuth credentials at {shared_path}\")\n else:\n print(\"Found existing shared Nous OAuth credentials\")\n try:\n do_import = input(\"Import these credentials? [Y/n]: \").strip().lower()\n except (EOFError, KeyboardInterrupt):\n do_import = \"y\"\n if do_import in {\"\", \"y\", \"yes\"}:\n print(\"Rehydrating Nous session from shared credentials...\")\n auth_state = _try_import_shared_nous_state(\n timeout_seconds=timeout_seconds,\n )\n if auth_state is None:\n print(\"Could not refresh shared credentials — falling back to device-code login.\")\n\n if auth_state is None:\n auth_state = _nous_device_code_login(\n portal_base_url=getattr(args, \"portal_url\", None),\n inference_base_url=getattr(args, \"inference_url\", None),\n client_id=getattr(args, \"client_id\", None) or pconfig.client_id,\n scope=getattr(args, \"scope\", None),\n open_browser=not getattr(args, \"no_browser\", False),\n timeout_seconds=timeout_seconds,\n insecure=insecure,\n ca_bundle=ca_bundle,\n )\n\n inference_base_url = auth_state[\"inference_base_url\"]\n\n # Snapshot the prior active_provider BEFORE _save_provider_state\n # overwrites it to \"nous\". If the user picks \"Skip (keep current)\"\n # during model selection below, we restore this so the user's previous\n # provider (e.g. openrouter) is preserved.\n with _auth_store_lock():\n _prior_store = _load_auth_store()\n prior_active_provider = _prior_store.get(\"active_provider\")\n\n with _auth_store_lock():\n auth_store = _load_auth_store()\n _save_provider_state(auth_store, \"nous\", auth_state)\n saved_to = _save_auth_store(auth_store)\n\n # Mirror to the shared store so other profiles can one-tap import\n # these credentials. Best-effort: any I/O failure is logged and\n # swallowed inside the helper.\n _write_shared_nous_state(auth_state)\n _sync_nous_pool_from_auth_store()\n\n print()\n print(\"Login successful!\")\n print(f\" Auth state: {saved_to}\")\n\n # Resolve model BEFORE writing provider to config.yaml so we never\n # leave the config in a half-updated state (provider=nous but model\n # still set to the previous provider's model, e.g. opus from\n # OpenRouter). The auth.json active_provider was already set above.\n selected_model = None\n try:\n runtime_key = auth_state.get(\"agent_key\") or auth_state.get(\"access_token\")\n if not isinstance(runtime_key, str) or not runtime_key:\n raise AuthError(\n \"No runtime API key available to fetch models\",\n provider=\"nous\",\n code=\"invalid_token\",\n )\n\n from arcen_cli.models import (\n get_curated_nous_model_ids, get_pricing_for_provider,\n check_nous_free_tier, partition_nous_models_by_tier,\n union_with_portal_free_recommendations,\n union_with_portal_paid_recommendations,\n )\n model_ids = get_curated_nous_model_ids()\n\n print()\n unavailable_models: list = []\n unavailable_message = \"\"\n if model_ids:\n pricing = get_pricing_for_provider(\"nous\")\n # Force fresh account data for model selection so recent credit\n # purchases are reflected immediately.\n free_tier = check_nous_free_tier(force_fresh=True)\n _portal_for_recs = auth_state.get(\"portal_base_url\", \"\")\n if free_tier:\n try:\n from arcen_cli.nous_account import (\n format_nous_portal_entitlement_message,\n get_nous_portal_account_info,\n )\n\n _account_info = get_nous_portal_account_info(force_fresh=True)\n unavailable_message = (\n format_nous_portal_entitlement_message(\n _account_info,\n capability=\"paid Nous models\",\n )\n or \"\"\n )\n except Exception:\n unavailable_message = \"\"\n # The Portal's freeRecommendedModels endpoint is the\n # source of truth for what's free *right now*. Augment\n # the curated list with anything new the Portal flags\n # as free so users on older Arcen builds still see\n # newly-launched free models without a CLI release.\n model_ids, pricing = union_with_portal_free_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n model_ids, unavailable_models = partition_nous_models_by_tier(\n model_ids, pricing, free_tier=True,\n )\n else:\n # Paid-tier mirror: pull paidRecommendedModels so newly\n # launched paid models surface in the picker even if\n # the in-repo curated list and docs-hosted manifest\n # haven't caught up yet.\n model_ids, pricing = union_with_portal_paid_recommendations(\n model_ids, pricing, _portal_for_recs,\n )\n _portal = auth_state.get(\"portal_base_url\", \"\")\n if model_ids:\n print(f\"Showing {len(model_ids)} curated models — use \\\"Enter custom model name\\\" for others.\")\n selected_model = _prompt_model_selection(\n model_ids, pricing=pricing,\n unavailable_models=unavailable_models,\n portal_url=_portal,\n unavailable_message=unavailable_message,\n )\n elif unavailable_models:\n _url = (_portal or DEFAULT_NOUS_PORTAL_URL).rstrip(\"/\")\n print(\"No free models currently available.\")\n print(unavailable_message or f\"Upgrade at {_url} to access paid models.\")\n else:\n print(\"No curated models available for Nous Portal.\")\n except Exception as exc:\n message = format_auth_error(exc) if isinstance(exc, AuthError) else str(exc)\n print()\n print(f\"Login succeeded, but could not fetch available models. Reason: {message}\")\n\n # Write provider + model atomically so config is never mismatched.\n # If no model was selected (user picked \"Skip (keep current)\",\n # model list fetch failed, or no curated models were available),\n # preserve the user's previous provider — don't silently switch\n # them to Nous with a mismatched model. The Nous OAuth tokens\n # stay saved for future use.\n if not selected_model:\n # Restore the prior active_provider that _save_provider_state\n # overwrote to \"nous\". config.yaml model.provider is left\n # untouched, so the user's previous provider is fully preserved.\n with _auth_store_lock():\n auth_store = _load_auth_store()\n if prior_active_provider:\n auth_store[\"active_provider\"] = prior_active_provider\n else:\n auth_store.pop(\"active_provider\", None)\n _save_auth_store(auth_store)\n print()\n print(\"No provider change. Nous credentials saved for future use.\")\n print(\" Run `arcen model` again to switch to Nous Portal.\")\n return\n\n config_path = _update_config_for_provider(\n \"nous\", inference_base_url, default_model=selected_model,\n )\n if selected_model:\n _save_model_choice(selected_model)\n print(f\"Default model set to: {selected_model}\")\n print(f\" Config updated: {config_path} (model.provider=nous)\")\n\n except KeyboardInterrupt:\n print(\"\\nLogin cancelled.\")\n raise SystemExit(130)\n except Exception as exc:\n print(f\"Login failed: {exc}\")\n raise SystemExit(1)\n\n\ndef logout_command(args) -> None:\n \"\"\"Clear auth state for a provider.\"\"\"\n provider_id = getattr(args, \"provider\", None)\n\n if provider_id and not is_known_auth_provider(provider_id):\n print(f\"Unknown provider: {provider_id}\")\n raise SystemExit(1)\n\n active = get_active_provider()\n target = provider_id or active or _logout_default_provider_from_config()\n\n if not target:\n print(\"No provider is currently logged in.\")\n return\n\n should_reset_config = _should_reset_config_provider_on_logout(target)\n provider_name = get_auth_provider_display_name(target)\n\n if clear_provider_auth(target) or should_reset_config:\n if should_reset_config:\n _reset_config_provider()\n print(f\"Logged out of {provider_name}.\")\n if should_reset_config and os.getenv(\"OPENROUTER_API_KEY\"):\n print(\"Arcen will use OpenRouter for inference.\")\n elif should_reset_config:\n print(\"Run `arcen model` or configure an API key to use Arcen.\")\n else:\n print(\"Model provider configuration was unchanged.\")\n else:\n print(f\"No auth state found for {provider_name}.\")\n"}}, "arcen_cli/models.py": {"41d6a8164c24506a38253f69334701ad2e137204": {"t": 1785746562.6897833, "n": 148869, "h": "e43dc50fa0289253", "c": "\"\"\"\nCanonical model catalogs and lightweight validation helpers.\n\nAdd, remove, or reorder entries here — both `arcen setup` and\n`arcen` provider-selection will pick up the change automatically.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport os\nimport urllib.request\nimport urllib.error\nimport time\nfrom difflib import get_close_matches\nfrom pathlib import Path\nfrom typing import Any, NamedTuple, Optional\n\nfrom arcen_cli import __version__ as _ARCEN_VERSION\n\n# Identify ourselves so endpoints fronted by Cloudflare's Browser Integrity\n# Check (error 1010) don't reject the default ``Python-urllib/*`` signature.\n_ARCEN_USER_AGENT = f\"arcen-cli/{_ARCEN_VERSION}\"\n\nCOPILOT_BASE_URL = \"https://api.githubcopilot.com\"\nCOPILOT_MODELS_URL = f\"{COPILOT_BASE_URL}/models\"\nCOPILOT_EDITOR_VERSION = \"vscode/1.104.1\"\nCOPILOT_REASONING_EFFORTS_GPT5 = [\"minimal\", \"low\", \"medium\", \"high\"]\nCOPILOT_REASONING_EFFORTS_O_SERIES = [\"low\", \"medium\", \"high\"]\n\n\n# Fallback OpenRouter snapshot used when the live catalog is unavailable.\n# (model_id, display description shown in menus)\nOPENROUTER_MODELS: list[tuple[str, str]] = [\n # Anthropic\n (\"anthropic/claude-opus-4.8\", \"\"),\n (\"anthropic/claude-opus-4.8-fast\", \"2x price, higher output speed\"),\n (\"anthropic/claude-sonnet-4.6\", \"\"),\n (\"anthropic/claude-haiku-4.5\", \"\"),\n # OpenAI\n (\"openai/gpt-5.5\", \"\"),\n (\"openai/gpt-5.5-pro\", \"\"),\n (\"openai/gpt-5.4-mini\", \"\"),\n # Google\n (\"google/gemini-3-pro-preview\", \"\"),\n (\"google/gemini-3.1-pro-preview\", \"\"),\n (\"google/gemini-3.5-flash\", \"\"),\n # xAI\n (\"x-ai/grok-4.3\", \"\"),\n # DeepSeek\n (\"deepseek/deepseek-v4-pro\", \"\"),\n (\"deepseek/deepseek-v4-flash\", \"\"),\n # Qwen\n (\"qwen/qwen3.7-max\", \"\"),\n (\"qwen/qwen3.7-plus\", \"\"),\n (\"qwen/qwen3.6-35b-a3b\", \"\"),\n # MoonshotAI\n (\"moonshotai/kimi-k2.6\", \"recommended\"),\n # MiniMax\n (\"minimax/minimax-m3\", \"\"),\n # Z-AI\n (\"z-ai/glm-5.1\", \"\"),\n # Xiaomi\n (\"xiaomi/mimo-v2.5-pro\", \"\"),\n # Tencent\n (\"tencent/hy3-preview\", \"\"),\n # StepFun\n (\"stepfun/step-3.7-flash\", \"\"),\n # NVIDIA\n (\"nvidia/nemotron-3-super-120b-a12b\", \"\"),\n # OpenRouter routers\n (\"openrouter/pareto-code\", \"auto-routes to cheapest coder meeting openrouter.min_coding_score\"),\n # Free tier\n (\"openrouter/elephant-alpha\", \"free\"),\n (\"openrouter/owl-alpha\", \"free\"),\n (\"tencent/hy3-preview:free\", \"free\"),\n (\"nvidia/nemotron-3-super-120b-a12b:free\", \"free\"),\n (\"inclusionai/ring-2.6-1t:free\", \"free\"),\n]\n\n_openrouter_catalog_cache: list[tuple[str, str]] | None = None\n\n\n\n\ndef _codex_curated_models() -> list[str]:\n \"\"\"Derive the openai-codex curated list from codex_models.py.\n\n Single source of truth: DEFAULT_CODEX_MODELS + forward-compat synthesis.\n This keeps the gateway /model picker in sync with the CLI `arcen model`\n flow without maintaining a separate static list.\n \"\"\"\n from arcen_cli.codex_models import DEFAULT_CODEX_MODELS, _add_forward_compat_models\n return _add_forward_compat_models(list(DEFAULT_CODEX_MODELS))\n\n\n# Static fallback for xAI when the models.dev disk cache is empty (fresh\n# install, offline first run, etc.). Mirrors the xAI-direct model IDs from\n# $ARCEN_HOME/models_dev_cache.json as of 2026-04-28. Whenever xAI renames\n# or retires a model, the disk cache picks it up on the next refresh and the\n# fallback here only matters until that refresh lands.\n#\n# Models retired by xAI on May 15, 2026 are excluded — see\n# https://docs.x.ai/developers/migration/may-15-retirement\n# (grok-4, grok-4-0709, grok-4-fast{,-reasoning,-non-reasoning},\n# grok-4-1-fast{,-reasoning,-non-reasoning}, grok-code-fast-1 → grok-4.3).\n_XAI_STATIC_FALLBACK: list[str] = [\n \"grok-4.3\",\n \"grok-4.20-0309-reasoning\",\n \"grok-4.20-0309-non-reasoning\",\n \"grok-4.20-multi-agent-0309\",\n]\n\n\n_XAI_TOP_MODEL = \"grok-4.3\"\n\n\ndef _xai_promote_top(ids: list[str]) -> list[str]:\n \"\"\"Pin the headline xAI model to the top of the curated list.\"\"\"\n if _XAI_TOP_MODEL in ids:\n return [_XAI_TOP_MODEL] + [m for m in ids if m != _XAI_TOP_MODEL]\n return ids\n\n\ndef _xai_curated_models() -> list[str]:\n \"\"\"Derive the xAI-direct curated list from models.dev disk cache.\n\n Reads $ARCEN_HOME/models_dev_cache.json directly (no network) so this\n runs at import time without blocking. Falls back to ``_XAI_STATIC_FALLBACK``\n when the cache is empty or unreadable. Arcen refreshes the cache from\n https://models.dev/api.json on normal use, so this list self-heals as\n xAI renames models.\n\n Mirrors ``_codex_curated_models()``'s role for openai-codex.\n \"\"\"\n try:\n from agent.models_dev import _load_disk_cache\n data = _load_disk_cache()\n xai = data.get(\"xai\") if isinstance(data, dict) else None\n models = xai.get(\"models\") if isinstance(xai, dict) else None\n if isinstance(models, dict) and models:\n ids = [mid for mid in models.keys() if isinstance(mid, str)]\n if ids:\n return _xai_promote_top(sorted(ids))\n except Exception:\n # Any failure (missing file, malformed JSON, import error)\n # falls through to the static list.\n pass\n return list(_XAI_STATIC_FALLBACK)\n\n\n_PROVIDER_MODELS: dict[str, list[str]] = {\n # Native OpenAI Chat Completions (api.openai.com). Used by /model counts and\n # provider_model_ids fallback when /v1/models is unavailable.\n \"openai\": [\n \"gpt-5.4\",\n \"gpt-5.4-mini\",\n \"gpt-5-mini\",\n \"gpt-5.3-codex\",\n \"gpt-5.2-codex\",\n \"gpt-4.1\",\n \"gpt-4o\",\n \"gpt-4o-mini\",\n ],\n \"openai-api\": [\n \"gpt-5.5\",\n \"gpt-5.5-pro\",\n \"gpt-5.4\",\n \"gpt-5.4-mini\",\n \"gpt-5.4-nano\",\n \"gpt-5-mini\",\n \"gpt-5.3-codex\",\n \"gpt-4.1\",\n \"gpt-4o\",\n \"gpt-4o-mini\",\n ],\n \"openai-codex\": _codex_curated_models(),\n \"xai-oauth\": _xai_curated_models(),\n \"copilot-acp\": [\n \"copilot-acp\",\n ],\n \"copilot\": [\n \"gpt-5.4\",\n \"gpt-5.4-mini\",\n \"gpt-5-mini\",\n \"gpt-5.3-codex\",\n \"gpt-5.2-codex\",\n \"gpt-4.1\",\n \"gpt-4o\",\n \"gpt-4o-mini\",\n \"claude-sonnet-4.6\",\n \"claude-sonnet-4\",\n \"claude-sonnet-4.5\",\n \"claude-haiku-4.5\",\n \"gemini-3.1-pro-preview\",\n \"gemini-3-pro-preview\",\n \"gemini-3-flash-preview\",\n \"gemini-2.5-pro\",\n ],\n \"gemini\": [\n \"gemini-3.1-pro-preview\",\n \"gemini-3-pro-preview\",\n \"gemini-3.5-flash\",\n \"gemini-3.1-flash-lite-preview\",\n ],\n \"google-gemini-cli\": [\n \"gemini-3.1-pro-preview\",\n \"gemini-3-pro-preview\",\n # Code Assist serves two flash slugs with different access gates\n # (gemini-cli models.ts): gemini-3-flash-preview is the preview flash\n # that subscription/free-tier OAuth users actually reach, while\n # gemini-3.5-flash is GA-channel-gated. Offer both so non-GA users\n # aren't stuck with a slug cloudcode-pa 404s for them.\n \"gemini-3-flash-preview\",\n \"gemini-3.5-flash\",\n ],\n \"zai\": [\n \"glm-5.1\",\n \"glm-5\",\n \"glm-5v-turbo\",\n \"glm-5-turbo\",\n \"glm-4.7\",\n \"glm-4.5\",\n \"glm-4.5-flash\",\n ],\n \"xai\": _xai_curated_models(),\n \"nvidia\": [\n # NVIDIA flagship reasoning models\n \"nvidia/nemotron-3-super-120b-a12b\",\n \"nvidia/nemotron-3-nano-30b-a3b\",\n \"nvidia/llama-3.3-nemotron-super-49b-v1.5\",\n # Third-party agentic models hosted on build.nvidia.com\n # (map to OpenRouter defaults — users get familiar picks on NIM)\n \"qwen/qwen3.5-397b-a17b\",\n \"deepseek-ai/deepseek-v3.2\",\n \"moonshotai/kimi-k2.6\",\n \"minimaxai/minimax-m2.5\",\n \"z-ai/glm5\",\n \"openai/gpt-oss-120b\",\n ],\n \"kimi-coding\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"kimi-for-coding\",\n \"kimi-k2-thinking\",\n \"kimi-k2-thinking-turbo\",\n \"kimi-k2-turbo-preview\",\n \"kimi-k2-0905-preview\",\n ],\n \"kimi-coding-cn\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"kimi-k2-thinking\",\n \"kimi-k2-turbo-preview\",\n \"kimi-k2-0905-preview\",\n ],\n \"stepfun\": [\n \"step-3.5-flash\",\n \"step-3.5-flash-2603\",\n ],\n \"moonshot\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"kimi-k2-thinking\",\n \"kimi-k2-turbo-preview\",\n \"kimi-k2-0905-preview\",\n ],\n \"minimax\": [\n \"MiniMax-M3\",\n \"MiniMax-M2.7\",\n \"MiniMax-M2.5\",\n \"MiniMax-M2.1\",\n \"MiniMax-M2\",\n ],\n \"minimax-oauth\": [\n \"MiniMax-M3\",\n \"MiniMax-M2.7\",\n \"MiniMax-M2.7-highspeed\",\n ],\n \"minimax-cn\": [\n \"MiniMax-M3\",\n \"MiniMax-M2.7\",\n \"MiniMax-M2.5\",\n \"MiniMax-M2.1\",\n \"MiniMax-M2\",\n ],\n \"anthropic\": [\n \"claude-opus-4-8\",\n \"claude-opus-4-7\",\n \"claude-opus-4-6\",\n \"claude-sonnet-4-6\",\n \"claude-opus-4-5-20251101\",\n \"claude-sonnet-4-5-20250929\",\n \"claude-opus-4-20250514\",\n \"claude-sonnet-4-20250514\",\n \"claude-haiku-4-5-20251001\",\n ],\n \"deepseek\": [\n \"deepseek-v4-pro\",\n \"deepseek-v4-flash\",\n \"deepseek-chat\",\n \"deepseek-reasoner\",\n ],\n \"xiaomi\": [\n \"mimo-v2.5-pro\",\n \"mimo-v2.5\",\n \"mimo-v2-pro\",\n \"mimo-v2-omni\",\n \"mimo-v2-flash\",\n ],\n \"tencent-tokenhub\": [\n \"hy3-preview\",\n ],\n \"arcee\": [\n \"trinity-large-thinking\",\n \"trinity-large-preview\",\n \"trinity-mini\",\n ],\n \"gmi\": [\n \"zai-org/GLM-5.1-FP8\",\n \"deepseek-ai/DeepSeek-V3.2\",\n \"moonshotai/Kimi-K2.5\",\n \"google/gemini-3.1-flash-lite-preview\",\n \"anthropic/claude-sonnet-4.6\",\n \"openai/gpt-5.4\",\n ],\n \"opencode-zen\": [\n \"kimi-k2.5\",\n \"gpt-5.4-pro\",\n \"gpt-5.4\",\n \"gpt-5.3-codex\",\n \"gpt-5.2\",\n \"gpt-5.2-codex\",\n \"gpt-5.1\",\n \"gpt-5.1-codex\",\n \"gpt-5.1-codex-max\",\n \"gpt-5.1-codex-mini\",\n \"gpt-5\",\n \"gpt-5-codex\",\n \"gpt-5-nano\",\n \"claude-opus-4-6\",\n \"claude-opus-4-5\",\n \"claude-opus-4-1\",\n \"claude-sonnet-4-6\",\n \"claude-sonnet-4-5\",\n \"claude-sonnet-4\",\n \"claude-haiku-4-5\",\n \"claude-3-5-haiku\",\n \"gemini-3.1-pro\",\n \"gemini-3-pro\",\n \"gemini-3-flash\",\n \"minimax-m2.7\",\n \"minimax-m2.5\",\n \"minimax-m2.5-free\",\n \"minimax-m2.1\",\n \"glm-5\",\n \"glm-4.7\",\n \"glm-4.6\",\n \"kimi-k2-thinking\",\n \"kimi-k2\",\n \"qwen3-coder\",\n \"big-pickle\",\n ],\n \"opencode-go\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"glm-5.1\",\n \"glm-5\",\n \"mimo-v2.5-pro\",\n \"mimo-v2.5\",\n \"mimo-v2-pro\",\n \"mimo-v2-omni\",\n \"minimax-m2.7\",\n \"minimax-m2.5\",\n \"qwen3.7-max\",\n \"qwen3.6-plus\",\n \"qwen3.5-plus\",\n ],\n \"kilocode\": [\n \"anthropic/claude-opus-4.6\",\n \"anthropic/claude-sonnet-4.6\",\n \"openai/gpt-5.4\",\n \"google/gemini-3-pro-preview\",\n \"google/gemini-3-flash-preview\",\n ],\n # Alibaba DashScope Coding platform (coding-intl) — default endpoint.\n # Supports Qwen models + third-party providers (GLM, Kimi, MiniMax).\n # Users with classic DashScope keys should override DASHSCOPE_BASE_URL\n # to https://dashscope-intl.aliyuncs.com/compatible-mode/v1 (OpenAI-compat)\n # or https://dashscope-intl.aliyuncs.com/apps/anthropic (Anthropic-compat).\n \"alibaba\": [\n \"qwen3.7-max\",\n \"qwen3.6-plus\",\n \"kimi-k2.5\",\n \"qwen3.5-plus\",\n \"qwen3-coder-plus\",\n \"qwen3-coder-next\",\n # Third-party models available on coding-intl\n \"glm-5\",\n \"glm-4.7\",\n \"MiniMax-M2.5\",\n ],\n # Alibaba Coding Plan — same platform as alibaba (DashScope coding-intl),\n # separate provider ID with its own base_url_env_var.\n \"alibaba-coding-plan\": [\n \"qwen3.7-max\",\n \"qwen3.6-plus\",\n \"qwen3.5-plus\",\n \"qwen3-coder-plus\",\n \"qwen3-coder-next\",\n \"kimi-k2.5\",\n \"glm-5\",\n \"glm-4.7\",\n \"MiniMax-M2.5\",\n ],\n # Curated HF model list — only agentic models that map to OpenRouter defaults.\n \"huggingface\": [\n \"moonshotai/Kimi-K2.5\",\n \"Qwen/Qwen3.5-397B-A17B\",\n \"Qwen/Qwen3.5-35B-A3B\",\n \"deepseek-ai/DeepSeek-V3.2\",\n \"MiniMaxAI/MiniMax-M2.5\",\n \"zai-org/GLM-5\",\n \"XiaomiMiMo/MiMo-V2-Flash\",\n \"moonshotai/Kimi-K2-Thinking\",\n \"moonshotai/Kimi-K2.6\",\n ],\n # AWS Bedrock — static fallback list used when dynamic discovery is\n # unavailable (no boto3, no credentials, or API error). The agent\n # prefers live discovery via ListFoundationModels + ListInferenceProfiles.\n # Use inference profile IDs (us.*) since most models require them.\n \"bedrock\": [\n \"us.anthropic.claude-sonnet-4-6\",\n \"us.anthropic.claude-opus-4-6-v1\",\n \"us.anthropic.claude-haiku-4-5-20251001-v1:0\",\n \"us.anthropic.claude-sonnet-4-5-20250929-v1:0\",\n \"us.amazon.nova-pro-v1:0\",\n \"us.amazon.nova-lite-v1:0\",\n \"us.amazon.nova-micro-v1:0\",\n \"deepseek.v3.2\",\n \"us.meta.llama4-maverick-17b-instruct-v1:0\",\n \"us.meta.llama4-scout-17b-instruct-v1:0\",\n ],\n # Azure Foundry: user-provided endpoint and model.\n # Empty list because models depend on the endpoint configuration.\n \"azure-foundry\": [],\n \"novita\": [\n \"moonshotai/kimi-k2.5\",\n \"minimax/minimax-m2.7\",\n \"zai-org/glm-5\",\n \"deepseek/deepseek-v3-0324\",\n \"deepseek/deepseek-r1-0528\",\n \"qwen/qwen3-235b-a22b-fp8\",\n ],\n}\n\n# ---------------------------------------------------------------------------\n# Removed provider Portal free-model helper\n# ---------------------------------------------------------------------------\n# The Removed provider Portal models endpoint is the source of truth for which models\n# are currently offered (free or paid). We trust whatever it returns and\n# surface it to users as-is — no local allowlist filtering.\n\n\ndef _is_model_free(model_id: str, pricing: dict[str, dict[str, str]]) -> bool:\n \"\"\"Return True if *model_id* has zero-cost prompt AND completion pricing.\"\"\"\n p = pricing.get(model_id)\n if not p:\n return False\n try:\n return float(p.get(\"prompt\", \"1\")) == 0 and float(p.get(\"completion\", \"1\")) == 0\n except (TypeError, ValueError):\n return False\n\n\n# ---------------------------------------------------------------------------\n# Removed provider Portal account tier detection\n# ---------------------------------------------------------------------------\ndef is_removed_provider_free_tier(account_info: dict[str, Any]) -> bool:\n \"\"\"Return True if the account info indicates a free (unpaid) tier.\n\n Prefer the Portal's explicit ``paid_service_access.allowed`` entitlement\n decision. Legacy payloads fall back to ``subscription.monthly_charge == 0``.\n Returns False when both signals are missing or unparseable.\n \"\"\"\n paid_access = account_info.get(\"paid_service_access\")\n if isinstance(paid_access, dict):\n allowed = paid_access.get(\"allowed\")\n if isinstance(allowed, bool):\n return not allowed\n paid = paid_access.get(\"paid_access\")\n if isinstance(paid, bool):\n return not paid\n\n sub = account_info.get(\"subscription\")\n if not isinstance(sub, dict):\n return False\n charge = sub.get(\"monthly_charge\")\n if charge is None:\n return False\n try:\n return float(charge) == 0\n except (TypeError, ValueError):\n return False\n\n\ndef partition_removed_provider_models_by_tier(\n model_ids: list[str],\n pricing: dict[str, dict[str, str]],\n free_tier: bool,\n) -> tuple[list[str], list[str]]:\n \"\"\"Split Removed provider models into (selectable, unavailable) based on user tier.\n\n For paid-tier users: all models are selectable, none unavailable.\n\n For free-tier users: only free models are selectable; paid models\n are returned as unavailable (shown grayed out in the menu).\n \"\"\"\n if not free_tier:\n return (model_ids, [])\n\n if not pricing:\n return (model_ids, []) # can't determine, show everything\n\n selectable: list[str] = []\n unavailable: list[str] = []\n for mid in model_ids:\n if _is_model_free(mid, pricing):\n selectable.append(mid)\n else:\n unavailable.append(mid)\n return (selectable, unavailable)\n\n\ndef union_with_portal_free_recommendations(\n curated_ids: list[str],\n pricing: dict[str, dict[str, str]],\n portal_base_url: str = \"\",\n *,\n force_refresh: bool = False,\n) -> tuple[list[str], dict[str, dict[str, str]]]:\n \"\"\"Augment curated list + pricing with the Portal's ``freeRecommendedModels``.\n\n The Portal's ``/api/removed_provider/recommended-models`` endpoint advertises which\n models are free *right now* — independent of what the in-repo\n ``_PROVIDER_MODELS[\"removed_provider\"]`` list happens to contain or whether the\n docs-hosted catalog manifest has been rebuilt since the last release.\n\n For free-tier users this is the source of truth: any model the Portal\n flags as free should be selectable, even if the user is running an\n older Arcen that doesn't ship that model in its hardcoded curated\n list. This function returns an augmented ``(model_ids, pricing)``\n pair where:\n\n * Portal free recommendations missing from ``curated_ids`` are\n appended after the curated list (so the in-repo curated models\n show first and Portal-only picks follow).\n * ``pricing`` gets a synthetic ``{\"prompt\": \"0\", \"completion\": \"0\"}``\n entry for any free recommendation missing from the live pricing\n map, so :func:`partition_removed_provider_models_by_tier` keeps it.\n\n Failures (network, parse, missing field) are silent and degrade to\n returning the inputs unchanged.\n \"\"\"\n try:\n payload = fetch_removed_provider_recommended_models(\n portal_base_url, force_refresh=force_refresh\n )\n except Exception:\n return (list(curated_ids), dict(pricing))\n\n free_block = payload.get(\"freeRecommendedModels\") if isinstance(payload, dict) else None\n if not isinstance(free_block, list) or not free_block:\n return (list(curated_ids), dict(pricing))\n\n portal_free_ids: list[str] = []\n for entry in free_block:\n name = _extract_model_name(entry)\n if name:\n portal_free_ids.append(name)\n if not portal_free_ids:\n return (list(curated_ids), dict(pricing))\n\n augmented_pricing = dict(pricing)\n free_synthetic = {\"prompt\": \"0\", \"completion\": \"0\"}\n for mid in portal_free_ids:\n if mid not in augmented_pricing:\n augmented_pricing[mid] = dict(free_synthetic)\n\n augmented_ids = list(curated_ids)\n seen = set(augmented_ids)\n # Append Portal free recommendations that aren't already curated, so the\n # in-repo curated (\"HA\") models show first and Portal-only picks follow.\n new_ones = [mid for mid in portal_free_ids if mid not in seen]\n if new_ones:\n augmented_ids = augmented_ids + new_ones\n\n return (augmented_ids, augmented_pricing)\n\n\ndef union_with_portal_paid_recommendations(\n curated_ids: list[str],\n pricing: dict[str, dict[str, str]],\n portal_base_url: str = \"\",\n *,\n force_refresh: bool = False,\n) -> tuple[list[str], dict[str, dict[str, str]]]:\n \"\"\"Augment curated list with the Portal's ``paidRecommendedModels``.\n\n Mirror of :func:`union_with_portal_free_recommendations` for paid-tier\n users. The Portal's ``/api/removed_provider/recommended-models`` endpoint advertises\n which paid models are blessed *right now* — independent of what the\n in-repo ``_PROVIDER_MODELS[\"removed_provider\"]`` list happens to contain or whether\n the docs-hosted catalog manifest has been rebuilt since the last release.\n\n For paid-tier users this lets newly-launched paid models surface in the\n picker even if the user is running an older Arcen that doesn't ship\n them in its hardcoded curated list. This function returns an augmented\n ``(model_ids, pricing)`` pair where:\n\n * Portal paid recommendations missing from ``curated_ids`` are\n appended after the curated list (so the in-repo curated models\n show first and Portal-only picks follow).\n * ``pricing`` is left untouched — we deliberately do NOT synthesize\n pricing entries for paid models. Live pricing is fetched separately\n via :func:`get_pricing_for_provider`; if the live endpoint hasn't\n published pricing yet, the picker shows a blank price column rather\n than fabricating numbers. (The free helper synthesizes ``$0`` so\n :func:`partition_removed_provider_models_by_tier` keeps free models selectable;\n no equivalent gating applies on the paid side, so synthesis would\n only mislead the user.)\n\n Failures (network, parse, missing field) are silent and degrade to\n returning the inputs unchanged — never block the picker on a\n Portal-side hiccup.\n \"\"\"\n try:\n payload = fetch_removed_provider_recommended_models(\n portal_base_url, force_refresh=force_refresh\n )\n except Exception:\n return (list(curated_ids), dict(pricing))\n\n paid_block = payload.get(\"paidRecommendedModels\") if isinstance(payload, dict) else None\n if not isinstance(paid_block, list) or not paid_block:\n return (list(curated_ids), dict(pricing))\n\n portal_paid_ids: list[str] = []\n for entry in paid_block:\n name = _extract_model_name(entry)\n if name:\n portal_paid_ids.append(name)\n if not portal_paid_ids:\n return (list(curated_ids), dict(pricing))\n\n augmented_ids = list(curated_ids)\n seen = set(augmented_ids)\n # Append Portal paid recommendations that aren't already curated, so the\n # in-repo curated (\"HA\") models show first and Portal-only picks follow.\n new_ones = [mid for mid in portal_paid_ids if mid not in seen]\n if new_ones:\n augmented_ids = augmented_ids + new_ones\n\n return (augmented_ids, dict(pricing))\n\n\n# ---------------------------------------------------------------------------\n# TTL cache for free-tier detection — avoids repeated API calls within a\n# session while still picking up upgrades quickly.\n# ---------------------------------------------------------------------------\n_FREE_TIER_CACHE_TTL: int = 180 # seconds (3 minutes)\n_free_tier_cache: tuple[bool, float] | None = None # (result, timestamp)\n\n\ndef check_removed_provider_free_tier(*, force_fresh: bool = False) -> bool:\n \"\"\"Check if the current Removed provider Portal user is on a free (unpaid) tier.\n\n Results are cached for ``_FREE_TIER_CACHE_TTL`` seconds to avoid\n hitting the Portal API on every call. The cache is short-lived so\n that an account upgrade is reflected within a few minutes.\n\n Returns True only when entitlement is known to be free. Unknown/error\n states return False so this compatibility wrapper does not block users.\n \"\"\"\n global _free_tier_cache\n now = time.monotonic()\n if not force_fresh and _free_tier_cache is not None:\n cached_result, cached_at = _free_tier_cache\n if now - cached_at < _FREE_TIER_CACHE_TTL:\n return cached_result\n\n try:\n from arcen_cli.removed_provider_account import get_removed_provider_portal_account_info\n\n account_info = get_removed_provider_portal_account_info(force_fresh=force_fresh)\n result = account_info.is_free_tier\n _free_tier_cache = (result, now)\n return result\n except Exception:\n _free_tier_cache = (False, now)\n return False # default to paid on error — don't block users\n\n\n# ---------------------------------------------------------------------------\n# Removed provider Portal recommended models\n#\n# The Portal publishes a curated list of suggested models (separated into\n# paid and free tiers) plus dedicated recommendations for compaction (text\n# summarisation / auxiliary) and vision tasks. We fetch it once per process\n# with a TTL cache so callers can ask \"what's the best aux model right now?\"\n# without hitting the network on every lookup.\n#\n# Shape of the response (fields we care about):\n# {\n# \"paidRecommendedModels\": [ {modelName, ...}, ... ],\n# \"freeRecommendedModels\": [ {modelName, ...}, ... ],\n# \"paidRecommendedCompactionModel\": {modelName, ...} | null,\n# \"paidRecommendedVisionModel\": {modelName, ...} | null,\n# \"freeRecommendedCompactionModel\": {modelName, ...} | null,\n# \"freeRecommendedVisionModel\": {modelName, ...} | null,\n# }\n# ---------------------------------------------------------------------------\n\nREMOVED_PROVIDER_RECOMMENDED_MODELS_PATH = \"/api/removed_provider/recommended-models\"\n_REMOVED_PROVIDER_RECOMMENDED_CACHE_TTL: int = 600 # seconds (10 minutes)\n# (result_dict, timestamp) keyed by portal_base_url so staging vs prod don't collide.\n_removed_provider_recommended_cache: dict[str, tuple[dict[str, Any], float]] = {}\n\n\ndef fetch_removed_provider_recommended_models(\n portal_base_url: str = \"\",\n timeout: float = 5.0,\n *,\n force_refresh: bool = False,\n) -> dict[str, Any]:\n \"\"\"Fetch the Removed provider Portal's curated recommended-models payload.\n\n Hits ``<portal>/api/removed_provider/recommended-models``. The endpoint is public —\n no auth is required. Results are cached per portal URL for\n ``_REMOVED_PROVIDER_RECOMMENDED_CACHE_TTL`` seconds; pass ``force_refresh=True`` to\n bypass the cache.\n\n Returns the parsed JSON dict on success, or ``{}`` on any failure\n (network, parse, non-2xx). Callers must treat missing/null fields as\n \"no recommendation\" and fall back to their own default.\n \"\"\"\n base = (portal_base_url or \"https://\").rstrip(\"/\")\n now = time.monotonic()\n cached = _removed_provider_recommended_cache.get(base)\n if not force_refresh and cached is not None:\n payload, cached_at = cached\n if now - cached_at < _REMOVED_PROVIDER_RECOMMENDED_CACHE_TTL:\n return payload\n\n url = f\"{base}{REMOVED_PROVIDER_RECOMMENDED_MODELS_PATH}\"\n try:\n req = urllib.request.Request(\n url,\n headers={\"Accept\": \"application/json\"},\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n data = json.loads(resp.read().decode())\n if not isinstance(data, dict):\n data = {}\n except Exception:\n data = {}\n\n _removed_provider_recommended_cache[base] = (data, now)\n return data\n\n\ndef _resolve_removed_provider_portal_url() -> str:\n \"\"\"Best-effort lookup of the Portal base URL the user is authed against.\"\"\"\n try:\n from arcen_cli.auth import (\n DEFAULT_REMOVED_PROVIDER_PORTAL_URL,\n get_provider_auth_state,\n )\n state = get_provider_auth_state(\"removed_provider\") or {}\n portal = str(state.get(\"portal_base_url\") or \"\").strip()\n if portal:\n return portal.rstrip(\"/\")\n return str(DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n except Exception:\n return \"https://\"\n\n\ndef _extract_model_name(entry: Any) -> Optional[str]:\n \"\"\"Pull the ``modelName`` field from a recommended-model entry, else None.\"\"\"\n if not isinstance(entry, dict):\n return None\n model_name = entry.get(\"modelName\")\n if isinstance(model_name, str) and model_name.strip():\n return model_name.strip()\n return None\n\n\ndef get_removed_provider_recommended_aux_model(\n *,\n vision: bool = False,\n free_tier: Optional[bool] = None,\n portal_base_url: str = \"\",\n force_refresh: bool = False,\n) -> Optional[str]:\n \"\"\"Return the Portal's recommended model name for an auxiliary task.\n\n Picks the best field from the Portal's recommended-models payload:\n\n * ``vision=True`` → ``paidRecommendedVisionModel`` (paid tier) or\n ``freeRecommendedVisionModel`` (free tier)\n * ``vision=False`` → ``paidRecommendedCompactionModel`` or\n ``freeRecommendedCompactionModel``\n\n When ``free_tier`` is ``None`` (default) the user's tier is auto-detected\n via :func:`check_removed_provider_free_tier`. Pass an explicit bool to bypass the\n detection — useful for tests or when the caller already knows the tier.\n\n For paid-tier users we prefer the paid recommendation but gracefully fall\n back to the free recommendation if the Portal returned ``null`` for the\n paid field (common during the staged rollout of new paid models).\n\n Returns ``None`` when every candidate is missing, null, or the fetch\n fails — callers should fall back to their own default (currently\n ``google/gemini-3-flash-preview``).\n \"\"\"\n base = portal_base_url or _resolve_removed_provider_portal_url()\n payload = fetch_removed_provider_recommended_models(base, force_refresh=force_refresh)\n if not payload:\n return None\n\n if free_tier is None:\n try:\n free_tier = check_removed_provider_free_tier()\n except Exception:\n # On any detection error, assume paid — paid users see both fields\n # anyway so this is a safe default that maximises model quality.\n free_tier = False\n\n if vision:\n paid_key, free_key = \"paidRecommendedVisionModel\", \"freeRecommendedVisionModel\"\n else:\n paid_key, free_key = \"paidRecommendedCompactionModel\", \"freeRecommendedCompactionModel\"\n\n # Preference order:\n # free tier → free only\n # paid tier → paid, then free (if paid field is null)\n candidates = [free_key] if free_tier else [paid_key, free_key]\n for key in candidates:\n name = _extract_model_name(payload.get(key))\n if name:\n return name\n return None\n\n\n# ---------------------------------------------------------------------------\n# Canonical provider list — single source of truth for provider identity.\n# Every code path that lists, displays, or iterates providers derives from\n# this list: arcen model, /model, list_authenticated_providers.\n#\n# Fields:\n# slug — internal provider ID (used in config.yaml, --provider flag)\n# label — short display name\n# tui_desc — longer description for the `arcen model` interactive picker\n# ---------------------------------------------------------------------------\n\nclass ProviderEntry(NamedTuple):\n slug: str\n label: str\n tui_desc: str # detailed description for `arcen model` TUI\n\nCANONICAL_PROVIDERS: list[ProviderEntry] = [\n ProviderEntry(\"openrouter\", \"OpenRouter\", \"OpenRouter (Pay-per-use API aggregator)\"),\n ProviderEntry(\"novita\", \"NovitaAI\", \"NovitaAI (Cloud: Model API, Agent Sandbox, GPU Cloud)\"),\n ProviderEntry(\"lmstudio\", \"LM Studio\", \"LM Studio (Local desktop app with built-in model server)\"),\n ProviderEntry(\"anthropic\", \"Anthropic\", \"Anthropic (Claude models via API key or Claude Code)\"),\n ProviderEntry(\"openai-codex\", \"OpenAI Codex\", \"OpenAI Codex (Codex CLI via ChatGPT subscription or API key)\"),\n ProviderEntry(\"openai-api\", \"OpenAI API\", \"OpenAI API (api.openai.com, API key)\"),\n ProviderEntry(\"alibaba\", \"Qwen Cloud\", \"Qwen Cloud / DashScope (Qwen + multi-provider)\"),\n ProviderEntry(\"xai-oauth\", \"xAI Grok OAuth (SuperGrok / Premium+)\", \"xAI Grok OAuth (SuperGrok / Premium+ subscription)\"),\n ProviderEntry(\"xiaomi\", \"Xiaomi MiMo\", \"Xiaomi MiMo (MiMo-V2.5 and V2 models: pro, omni, flash)\"),\n ProviderEntry(\"tencent-tokenhub\", \"Tencent TokenHub\", \"Tencent TokenHub (Hy3 Preview via tokenhub.tencentmaas.com)\"),\n ProviderEntry(\"nvidia\", \"NVIDIA NIM\", \"NVIDIA NIM (Nemotron models via build.nvidia.com or local NIM)\"),\n ProviderEntry(\"copilot\", \"GitHub Copilot\", \"GitHub Copilot (Uses GITHUB_TOKEN or gh auth token)\"),\n ProviderEntry(\"copilot-acp\", \"GitHub Copilot ACP\", \"GitHub Copilot ACP (Spawns copilot --acp --stdio)\"),\n ProviderEntry(\"huggingface\", \"Hugging Face\", \"Hugging Face Inference Providers\"),\n ProviderEntry(\"gemini\", \"Google AI Studio\", \"Google AI Studio (Native Gemini API)\"),\n ProviderEntry(\"google-gemini-cli\", \"Google Gemini (OAuth)\", \"Google Gemini via OAuth + Code Assist (Code Assist OAuth flow)\"),\n ProviderEntry(\"deepseek\", \"DeepSeek\", \"DeepSeek (V3, R1, coder, direct API)\"),\n ProviderEntry(\"xai\", \"xAI\", \"xAI Grok (Direct API)\"),\n ProviderEntry(\"zai\", \"Z.AI / GLM\", \"Z.AI / GLM (Zhipu direct API)\"),\n ProviderEntry(\"kimi-coding\", \"Kimi / Kimi Coding Plan\", \"Kimi Coding Plan (api.kimi.com & Moonshot API)\"),\n ProviderEntry(\"kimi-coding-cn\", \"Kimi / Moonshot (China)\", \"Kimi / Moonshot China (Domestic direct API)\"),\n ProviderEntry(\"stepfun\", \"StepFun Step Plan\", \"StepFun Step Plan (Agent / coding models via Step Plan API)\"),\n ProviderEntry(\"minimax\", \"MiniMax\", \"MiniMax (Global direct API)\"),\n ProviderEntry(\"minimax-oauth\", \"MiniMax (OAuth)\", \"MiniMax via OAuth browser login (Coding Plan, minimax.io)\"),\n ProviderEntry(\"minimax-cn\", \"MiniMax (China)\", \"MiniMax China (Domestic direct API)\"),\n ProviderEntry(\"ollama-cloud\", \"Ollama Cloud\", \"Ollama Cloud (Cloud-hosted open models, ollama.com)\"),\n ProviderEntry(\"arcee\", \"Arcee AI\", \"Arcee AI (Trinity models, direct API)\"),\n ProviderEntry(\"gmi\", \"GMI Cloud\", \"GMI Cloud (Multi-model direct API)\"),\n ProviderEntry(\"kilocode\", \"Kilo Code\", \"Kilo Code (Kilo Gateway API)\"),\n ProviderEntry(\"opencode-zen\", \"OpenCode Zen\", \"OpenCode Zen (Curated models, pay-as-you-go)\"),\n ProviderEntry(\"opencode-go\", \"OpenCode Go\", \"OpenCode Go (Open models subscription)\"),\n ProviderEntry(\"bedrock\", \"AWS Bedrock\", \"AWS Bedrock (Claude, Nova, Llama, DeepSeek; IAM or API key)\"),\n ProviderEntry(\"azure-foundry\", \"Azure Foundry\", \"Azure Foundry (OpenAI-style or Anthropic-style endpoint, your Azure AI deployment)\"),\n ProviderEntry(\"qwen-oauth\", \"Qwen OAuth (Portal)\", \"Qwen OAuth (Reuses local Qwen CLI login)\"),\n]\n\n# Auto-extend CANONICAL_PROVIDERS with any provider registered in providers/\n# that is not already in the list above. Adding plugins/model-providers/<name>/\n# is sufficient to expose a new provider in the model picker, /model, and all\n# downstream consumers — no edits to this file needed.\n_canonical_slugs = {p.slug for p in CANONICAL_PROVIDERS}\ntry:\n from providers import list_providers as _list_providers_for_canonical\n for _pp in _list_providers_for_canonical():\n if _pp.name in _canonical_slugs:\n continue\n if _pp.auth_type in {\"oauth_device_code\", \"oauth_external\", \"external_process\", \"aws_sdk\", \"copilot\"}:\n continue # non-api-key flows need bespoke picker UX; skip auto-inject\n _label = _pp.display_name or _pp.name\n _desc = _pp.description or f\"{_label} (direct API)\"\n CANONICAL_PROVIDERS.append(ProviderEntry(_pp.name, _label, _desc))\n _canonical_slugs.add(_pp.name)\nexcept Exception:\n pass\n\n# Derived dicts — used throughout the codebase\n_PROVIDER_LABELS = {p.slug: p.label for p in CANONICAL_PROVIDERS}\n_PROVIDER_LABELS[\"custom\"] = \"Custom endpoint\" # special case: not a named provider\n\n\n# ---------------------------------------------------------------------------\n# Provider groups — DISPLAY ONLY\n#\n# Some vendors expose several Arcen provider slugs (one per endpoint /\n# auth method: global API, China API, OAuth coding plan, ...). Listing every\n# slug as a top-level row in the interactive `arcen model` / setup wizard /\n# Telegram `/model` pickers makes that list long and noisy.\n#\n# These groups fold related slugs under one top-level row in INTERACTIVE\n# PICKERS only. They do NOT change ``CANONICAL_PROVIDERS``, slug identity,\n# the ``--provider`` flag, ``/model <provider:model>``, or any typed path —\n# every member slug remains individually addressable. Grouping is a pure\n# display affordance; ``group_providers()`` is the single fold used by all\n# three picker surfaces so they stay consistent.\n#\n# group_id -> (display_label, group_description, [member_slug, ...])\n#\n# ``group_description`` is a short blurb shown on the collapsed top-level group\n# row in the interactive pickers (alongside the label). Member-specific detail\n# lives in each member's ``tui_desc`` and shows in the drill-down sub-picker.\n# Member order is the order shown inside the group submenu.\n# ---------------------------------------------------------------------------\nPROVIDER_GROUPS: dict[str, tuple[str, str, list[str]]] = {\n \"kimi\": (\"Kimi / Moonshot\", \"Coding Plan, Moonshot global & China endpoints\", [\"kimi-coding\", \"kimi-coding-cn\"]),\n \"minimax\": (\"MiniMax\", \"Global, OAuth Coding Plan & China endpoints\", [\"minimax\", \"minimax-oauth\", \"minimax-cn\"]),\n \"xai\": (\"xAI Grok\", \"Direct API or SuperGrok / Premium+ OAuth\", [\"xai\", \"xai-oauth\"]),\n \"google\": (\"Google Gemini\", \"AI Studio API or OAuth + Code Assist\", [\"gemini\", \"google-gemini-cli\"]),\n \"openai\": (\"OpenAI\", \"Codex CLI or direct OpenAI API\", [\"openai-codex\", \"openai-api\"]),\n \"opencode\": (\"OpenCode\", \"Zen pay-as-you-go or Go subscription\", [\"opencode-zen\", \"opencode-go\"]),\n \"copilot\": (\"GitHub Copilot\", \"GitHub token API or copilot --acp process\", [\"copilot\", \"copilot-acp\"]),\n}\n\n# Reverse index: member slug -> group_id. Built once at import.\n_SLUG_TO_GROUP: dict[str, str] = {\n slug: gid for gid, (_label, _desc, members) in PROVIDER_GROUPS.items() for slug in members\n}\n\n\ndef provider_group_for_slug(slug: str) -> str:\n \"\"\"Return the group_id a provider slug belongs to, or \"\" if ungrouped.\"\"\"\n return _SLUG_TO_GROUP.get(str(slug or \"\").strip().lower(), \"\")\n\n\ndef group_providers(slugs):\n \"\"\"Fold a flat ordered slug iterable into picker rows by provider group.\n\n DISPLAY ONLY. Used by every interactive picker (``arcen model``, the\n setup wizard, the Telegram ``/model`` keyboard) so grouping is identical\n across surfaces.\n\n Each returned row is a dict::\n\n {\"kind\": \"single\", \"slug\": <slug>} # ungrouped, or\n # 1-member group\n {\"kind\": \"group\", \"group_id\": <gid>, \"label\": <label>,\n \"description\": <desc>, \"members\": [<slug>, ...]} # 2+ members\n\n Rules:\n * A group row appears at the position of its FIRST present member, in\n the input order. Subsequent members fold into that row (and are not\n emitted again).\n * Member order inside a group follows ``PROVIDER_GROUPS`` declaration,\n restricted to the members actually present in ``slugs``.\n * A group reduced to a single present member degrades to a ``single``\n row — no pointless one-item submenu.\n * Slugs not in any group pass through as ``single`` rows, order\n preserved.\n * Duplicate slugs in the input are ignored after first sight.\n \"\"\"\n seen: set[str] = set()\n # Which present members each group has, in declaration order.\n group_members: dict[str, list[str]] = {}\n for gid, (_label, _desc, members) in PROVIDER_GROUPS.items():\n present = [m for m in members if m in set(slugs)]\n if present:\n group_members[gid] = present\n\n rows = []\n emitted_groups: set[str] = set()\n for slug in slugs:\n s = str(slug or \"\").strip().lower()\n if not s or s in seen:\n continue\n seen.add(s)\n gid = _SLUG_TO_GROUP.get(s, \"\")\n if not gid:\n rows.append({\"kind\": \"single\", \"slug\": s})\n continue\n if gid in emitted_groups:\n continue # already folded at the first member's position\n emitted_groups.add(gid)\n members = group_members.get(gid, [s])\n if len(members) <= 1:\n rows.append({\"kind\": \"single\", \"slug\": members[0]})\n else:\n label, desc, _ = PROVIDER_GROUPS[gid]\n rows.append(\n {\"kind\": \"group\", \"group_id\": gid, \"label\": label,\n \"description\": desc, \"members\": list(members)}\n )\n return rows\n\n\n_PROVIDER_ALIASES = {\n \"glm\": \"zai\",\n \"z-ai\": \"zai\",\n \"z.ai\": \"zai\",\n \"zhipu\": \"zai\",\n \"github\": \"copilot\",\n \"github-copilot\": \"copilot\",\n \"github-models\": \"copilot\",\n \"github-model\": \"copilot\",\n \"github-copilot-acp\": \"copilot-acp\",\n \"copilot-acp-agent\": \"copilot-acp\",\n \"google\": \"gemini\",\n \"google-gemini\": \"gemini\",\n \"google-ai-studio\": \"gemini\",\n \"kimi\": \"kimi-coding\",\n \"moonshot\": \"kimi-coding\",\n \"kimi-cn\": \"kimi-coding-cn\",\n \"moonshot-cn\": \"kimi-coding-cn\",\n \"step\": \"stepfun\",\n \"stepfun-coding-plan\": \"stepfun\",\n \"arcee-ai\": \"arcee\",\n \"arceeai\": \"arcee\",\n \"gmi-cloud\": \"gmi\",\n \"gmicloud\": \"gmi\",\n \"minimax-china\": \"minimax-cn\",\n \"minimax_cn\": \"minimax-cn\",\n \"minimax-portal\": \"minimax-oauth\",\n \"minimax-global\": \"minimax-oauth\",\n \"minimax_oauth\": \"minimax-oauth\",\n \"claude\": \"anthropic\",\n \"claude-code\": \"anthropic\",\n \"deep-seek\": \"deepseek\",\n \"opencode\": \"opencode-zen\",\n \"zen\": \"opencode-zen\",\n \"go\": \"opencode-go\",\n \"opencode-go-sub\": \"opencode-go\",\n \"kilo\": \"kilocode\",\n \"kilo-code\": \"kilocode\",\n \"kilo-gateway\": \"kilocode\",\n \"dashscope\": \"alibaba\",\n \"aliyun\": \"alibaba\",\n \"qwen\": \"alibaba\",\n \"alibaba-cloud\": \"alibaba\",\n \"qwen-portal\": \"qwen-oauth\",\n \"gemini-cli\": \"google-gemini-cli\",\n \"gemini-oauth\": \"google-gemini-cli\",\n \"hf\": \"huggingface\",\n \"hugging-face\": \"huggingface\",\n \"huggingface-hub\": \"huggingface\",\n \"novita-ai\": \"novita\",\n \"novitaai\": \"novita\",\n \"mimo\": \"xiaomi\",\n \"xiaomi-mimo\": \"xiaomi\",\n \"tencent\": \"tencent-tokenhub\",\n \"tokenhub\": \"tencent-tokenhub\",\n \"tencent-cloud\": \"tencent-tokenhub\",\n \"tencentmaas\": \"tencent-tokenhub\",\n \"aws\": \"bedrock\",\n \"aws-bedrock\": \"bedrock\",\n \"amazon-bedrock\": \"bedrock\",\n \"amazon\": \"bedrock\",\n \"grok\": \"xai\",\n \"grok-oauth\": \"xai-oauth\",\n \"xai-oauth\": \"xai-oauth\",\n \"x-ai-oauth\": \"xai-oauth\",\n \"xai-grok-oauth\": \"xai-oauth\",\n \"x-ai\": \"xai\",\n \"x.ai\": \"xai\",\n \"nim\": \"nvidia\",\n \"nvidia-nim\": \"nvidia\",\n \"build-nvidia\": \"nvidia\",\n \"nemotron\": \"nvidia\",\n \"lmstudio\": \"lmstudio\",\n \"lm-studio\": \"lmstudio\",\n \"lm_studio\": \"lmstudio\",\n \"ollama\": \"custom\", # bare \"ollama\" = local; use \"ollama-cloud\" for cloud\n \"ollama_cloud\": \"ollama-cloud\",\n}\n\n\n# Cost-safe overrides for the *silent* auto-default\n# (``get_default_model_for_provider``). Most providers' curated lists lead with a\n_PROVIDER_SILENT_DEFAULT_OVERRIDES: dict[str, str] = {}\n\n\ndef get_default_model_for_provider(provider: str) -> str:\n \"\"\"Return a cost-safe default model for a provider, or \"\" if unknown.\n\n Used as a NON-INTERACTIVE fallback when a provider is configured but no\n model was ever selected (e.g. ``arcen auth add openai-codex`` without\n ``arcen model``, or a profile that sets ``provider`` with no ``model``).\n\n For most providers this is the first entry in ``_PROVIDER_MODELS`` — the\n same model the ``arcen model`` picker offers first. For metered aggregators\n whose curated list is ordered most-capable-first, that entry is also the\n most EXPENSIVE one, so silently defaulting to it is a billing footgun. Such\n providers carry an explicit low-cost override in\n ``_PROVIDER_SILENT_DEFAULT_OVERRIDES``; a missing model must never\n auto-escalate to the flagship.\n \"\"\"\n models = _PROVIDER_MODELS.get(provider, [])\n override = _PROVIDER_SILENT_DEFAULT_OVERRIDES.get(provider)\n if override and override in models:\n return override\n return models[0] if models else \"\"\n\n\ndef _openrouter_model_is_free(pricing: Any) -> bool:\n \"\"\"Return True when both prompt and completion pricing are zero.\"\"\"\n if not isinstance(pricing, dict):\n return False\n try:\n return float(pricing.get(\"prompt\", \"0\")) == 0 and float(pricing.get(\"completion\", \"0\")) == 0\n except (TypeError, ValueError):\n return False\n\n\ndef _openrouter_model_supports_tools(item: Any) -> bool:\n \"\"\"Return True when the model's ``supported_parameters`` advertise tool calling.\n\n arcen-agent is tool-calling-first — every provider path assumes the model\n can invoke tools. Models that don't advertise ``tools`` in their\n ``supported_parameters`` (e.g. image-only or completion-only models) cannot\n be driven by the agent loop and would fail at the first tool call.\n\n **Permissive when the field is missing.** Some OpenRouter-compatible gateways\n (Removed provider Portal, private mirrors, older catalog snapshots) don't populate\n ``supported_parameters`` at all. Treat that as \"unknown capability → allow\"\n so the picker doesn't silently empty for those users. Only hide models\n whose ``supported_parameters`` is an explicit list that omits ``tools``.\n\n Ported from Kilo-Org/kilocode#9068.\n \"\"\"\n if not isinstance(item, dict):\n return True\n params = item.get(\"supported_parameters\")\n if not isinstance(params, list):\n # Field absent / malformed / None — be permissive.\n return True\n return \"tools\" in params\n\n\ndef fetch_openrouter_models(\n timeout: float = 8.0,\n *,\n force_refresh: bool = False,\n) -> list[tuple[str, str]]:\n \"\"\"Return the curated OpenRouter picker list, refreshed from the live catalog when possible.\"\"\"\n global _openrouter_catalog_cache\n\n if _openrouter_catalog_cache is not None and not force_refresh:\n return list(_openrouter_catalog_cache)\n\n # Prefer the remotely-hosted catalog manifest; fall back to the in-repo\n # snapshot when the manifest is unreachable. Both are curated lists that\n # drive the picker; the OpenRouter live /v1/models filter (tool support,\n # free pricing) is applied on top either way.\n try:\n from arcen_cli.model_catalog import get_curated_openrouter_models\n remote = get_curated_openrouter_models()\n except Exception:\n remote = None\n fallback = list(remote) if remote else list(OPENROUTER_MODELS)\n preferred_ids = [mid for mid, _ in fallback]\n\n try:\n req = urllib.request.Request(\n \"https://openrouter.ai/api/v1/models\",\n headers={\"Accept\": \"application/json\"},\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except Exception:\n return list(_openrouter_catalog_cache or fallback)\n\n live_items = payload.get(\"data\", [])\n if not isinstance(live_items, list):\n return list(_openrouter_catalog_cache or fallback)\n\n live_by_id: dict[str, dict[str, Any]] = {}\n for item in live_items:\n if not isinstance(item, dict):\n continue\n mid = str(item.get(\"id\") or \"\").strip()\n if not mid:\n continue\n live_by_id[mid] = item\n\n curated: list[tuple[str, str]] = []\n for preferred_id in preferred_ids:\n live_item = live_by_id.get(preferred_id)\n if live_item is None:\n continue\n # Hide models that don't advertise tool-calling support — arcen-agent\n # requires it and surfacing them leads to immediate runtime failures\n # when the user selects them. Ported from Kilo-Org/kilocode#9068.\n if not _openrouter_model_supports_tools(live_item):\n continue\n desc = \"free\" if _openrouter_model_is_free(live_item.get(\"pricing\")) else \"\"\n curated.append((preferred_id, desc))\n\n if not curated:\n return list(_openrouter_catalog_cache or fallback)\n\n first_id, _ = curated[0]\n curated[0] = (first_id, \"recommended\")\n _openrouter_catalog_cache = curated\n return list(curated)\n\n\ndef model_ids(*, force_refresh: bool = False) -> list[str]:\n \"\"\"Return just the OpenRouter model-id strings.\"\"\"\n return [mid for mid, _ in fetch_openrouter_models(force_refresh=force_refresh)]\n\n\ndef get_curated_removed_provider_model_ids() -> list[str]:\n \"\"\"Return the curated Removed provider Portal model-id list.\n\n Prefers the remotely-hosted catalog manifest (published under\n ``website/static/api/model-catalog.json``); falls back to the in-repo\n snapshot in ``_PROVIDER_MODELS[\"removed_provider\"]`` when the manifest is\n unreachable. Always returns a list (never None).\n \"\"\"\n try:\n from arcen_cli.model_catalog import get_curated_removed_provider_models\n remote = get_curated_removed_provider_models()\n except Exception:\n remote = None\n if remote:\n return list(remote)\n return list(_PROVIDER_MODELS.get(\"removed_provider\", []))\n\n\n# ---------------------------------------------------------------------------\n# Pricing helpers — fetch live pricing from OpenRouter-compatible /v1/models\n# ---------------------------------------------------------------------------\n\n# Cache: maps model_id → {\"prompt\": str, \"completion\": str} per endpoint\n_pricing_cache: dict[str, dict[str, dict[str, str]]] = {}\n\n\ndef _format_price_per_mtok(per_token_str: str) -> str:\n \"\"\"Convert a per-token price string to a human-friendly $/Mtok string.\n\n Always uses 2 decimal places so that prices align vertically when\n right-justified in a column (the decimal point stays in the same position).\n\n Examples:\n \"0.000003\" → \"$3.00\" (per million tokens)\n \"0.00003\" → \"$30.00\"\n \"0.00000015\" → \"$0.15\"\n \"0.0000001\" → \"$0.10\"\n \"0.00018\" → \"$180.00\"\n \"0\" → \"free\"\n \"\"\"\n try:\n val = float(per_token_str)\n except (TypeError, ValueError):\n return \"?\"\n if val == 0:\n return \"free\"\n per_m = val * 1_000_000\n return f\"${per_m:.2f}\"\n\n\ndef fetch_models_with_pricing(\n api_key: str | None = None,\n base_url: str = \"https://openrouter.ai/api\",\n timeout: float = 8.0,\n *,\n force_refresh: bool = False,\n) -> dict[str, dict[str, str]]:\n \"\"\"Fetch ``/v1/models`` and return ``{model_id: {prompt, completion}}`` pricing.\n\n Results are cached per *base_url* so repeated calls are free.\n Works with any OpenRouter-compatible endpoint (OpenRouter, Removed provider Portal).\n \"\"\"\n cache_key = (base_url or \"\").rstrip(\"/\")\n if not force_refresh and cache_key in _pricing_cache:\n return _pricing_cache[cache_key]\n\n url = cache_key.rstrip(\"/\") + \"/v1/models\"\n headers: dict[str, str] = {\n \"Accept\": \"application/json\",\n \"User-Agent\": _ARCEN_USER_AGENT,\n }\n if api_key:\n headers[\"Authorization\"] = f\"Bearer {api_key}\"\n\n try:\n req = urllib.request.Request(url, headers=headers)\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except Exception:\n _pricing_cache[cache_key] = {}\n return {}\n\n result: dict[str, dict[str, str]] = {}\n for item in payload.get(\"data\", []):\n mid = item.get(\"id\")\n pricing = item.get(\"pricing\")\n if mid and isinstance(pricing, dict):\n entry: dict[str, str] = {\n \"prompt\": str(pricing.get(\"prompt\", \"\")),\n \"completion\": str(pricing.get(\"completion\", \"\")),\n }\n if pricing.get(\"input_cache_read\"):\n entry[\"input_cache_read\"] = str(pricing[\"input_cache_read\"])\n if pricing.get(\"input_cache_write\"):\n entry[\"input_cache_write\"] = str(pricing[\"input_cache_write\"])\n result[mid] = entry\n\n _pricing_cache[cache_key] = result\n return result\n\n\ndef _resolve_openrouter_api_key() -> str:\n \"\"\"Best-effort OpenRouter API key for pricing fetch.\"\"\"\n return os.getenv(\"OPENROUTER_API_KEY\", \"\").strip()\n\n\n_DEFAULT_REMOVED_PROVIDER_INFERENCE_BASE = \"https://\"\n\n\ndef _resolve_removed_provider_pricing_credentials() -> tuple[str, str]:\n \"\"\"Return ``(api_key, base_url)`` for Removed provider Portal pricing.\n\n The Removed provider inference ``/v1/models`` endpoint exposes pricing without\n authentication, so the api_key is best-effort: when runtime credential\n resolution fails (expired refresh token, missing auth.json, etc.) we\n still return the default inference base URL so the picker keeps\n working with anonymous pricing data. Free-tier users in particular\n need this — pricing drives the free/paid partition, and silently\n returning empty pricing because of an auth blip makes the picker\n look broken (\"No free models currently available\").\n \"\"\"\n try:\n from arcen_cli.auth import resolve_removed_provider_runtime_credentials\n creds = resolve_removed_provider_runtime_credentials()\n if creds:\n return (creds.get(\"api_key\", \"\"), creds.get(\"base_url\", \"\"))\n except Exception:\n pass\n return (\"\", _DEFAULT_REMOVED_PROVIDER_INFERENCE_BASE)\n\n\ndef get_pricing_for_provider(provider: str, *, force_refresh: bool = False) -> dict[str, dict[str, str]]:\n \"\"\"Return live pricing for providers that support it (openrouter, removed_provider, novita).\"\"\"\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\":\n return fetch_models_with_pricing(\n api_key=_resolve_openrouter_api_key(),\n base_url=\"https://openrouter.ai/api\",\n force_refresh=force_refresh,\n )\n if normalized == \"novita\":\n return _fetch_novita_pricing(force_refresh=force_refresh)\n if normalized == \"removed_provider\":\n api_key, base_url = _resolve_removed_provider_pricing_credentials()\n if base_url:\n # Removed provider base_url typically looks like https:///v1\n # We need the part before /v1 for our fetch function\n stripped = base_url.rstrip(\"/\")\n if stripped.endswith(\"/v1\"):\n stripped = stripped[:-3]\n return fetch_models_with_pricing(\n api_key=api_key,\n base_url=stripped,\n force_refresh=force_refresh,\n )\n return {}\n\n\ndef _fetch_novita_pricing(\n timeout: float = 8.0,\n *,\n force_refresh: bool = False,\n) -> dict[str, dict[str, str]]:\n \"\"\"Fetch pricing from NovitaAI /v1/models.\n\n NovitaAI returns input/output prices per million tokens in units of\n 0.0001 USD. Convert them to the per-token strings used by the shared\n pricing formatter.\n\n Results are cached in ``_pricing_cache`` keyed on the resolved base URL —\n without this, every menu render or pricing lookup re-hits the network.\n \"\"\"\n api_key = os.getenv(\"NOVITA_API_KEY\", \"\").strip()\n if not api_key:\n return {}\n\n base_url = os.getenv(\"NOVITA_BASE_URL\", \"\").strip() or \"https://api.novita.ai/openai/v1\"\n cache_key = base_url.rstrip(\"/\")\n if not force_refresh and cache_key in _pricing_cache:\n return _pricing_cache[cache_key]\n\n url = cache_key + \"/models\"\n headers = {\n \"Authorization\": f\"Bearer {api_key}\",\n \"Accept\": \"application/json\",\n \"User-Agent\": _ARCEN_USER_AGENT,\n }\n\n try:\n req = urllib.request.Request(url, headers=headers)\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except Exception:\n _pricing_cache[cache_key] = {}\n return {}\n\n result: dict[str, dict[str, str]] = {}\n for item in payload.get(\"data\", []):\n if not isinstance(item, dict):\n continue\n mid = item.get(\"id\")\n if not mid:\n continue\n inp = item.get(\"input_token_price_per_m\")\n out = item.get(\"output_token_price_per_m\")\n if inp is None and out is None:\n continue\n result[str(mid)] = {\n \"prompt\": str(float(inp or 0) / 10_000 / 1_000_000),\n \"completion\": str(float(out or 0) / 10_000 / 1_000_000),\n }\n\n _pricing_cache[cache_key] = result\n return result\n\n\n# All provider IDs and aliases that are valid for the provider:model syntax.\n_KNOWN_PROVIDER_NAMES: set[str] = (\n set(_PROVIDER_LABELS.keys())\n | set(_PROVIDER_ALIASES.keys())\n | {\"openrouter\", \"custom\"}\n)\n\n\ndef list_available_providers() -> list[dict[str, str]]:\n \"\"\"Return info about all providers the user could use with ``provider:model``.\n\n Each dict has ``id``, ``label``, and ``aliases``.\n Checks which providers have valid credentials configured.\n\n Derives the provider list from :data:`CANONICAL_PROVIDERS` (single\n source of truth shared with ``arcen model``, ``/model``, etc.).\n \"\"\"\n # Derive display order from canonical list + custom\n provider_order = [p.slug for p in CANONICAL_PROVIDERS] + [\"custom\"]\n\n # Build reverse alias map\n aliases_for: dict[str, list[str]] = {}\n for alias, canonical in _PROVIDER_ALIASES.items():\n aliases_for.setdefault(canonical, []).append(alias)\n\n result = []\n for pid in provider_order:\n label = _PROVIDER_LABELS.get(pid, pid)\n alias_list = aliases_for.get(pid, [])\n # Check if this provider has credentials available\n has_creds = False\n try:\n from arcen_cli.auth import get_auth_status, has_usable_secret\n if pid == \"custom\":\n custom_base_url = _get_custom_base_url() or \"\"\n has_creds = bool(custom_base_url.strip())\n elif pid == \"openrouter\":\n has_creds = has_usable_secret(os.getenv(\"OPENROUTER_API_KEY\", \"\"))\n else:\n status = get_auth_status(pid)\n has_creds = bool(status.get(\"logged_in\") or status.get(\"configured\"))\n except Exception:\n pass\n result.append({\n \"id\": pid,\n \"label\": label,\n \"aliases\": alias_list,\n \"authenticated\": has_creds,\n })\n return result\n\n\ndef parse_model_input(raw: str, current_provider: str) -> tuple[str, str]:\n \"\"\"Parse ``/model`` input into ``(provider, model)``.\n\n Supports ``provider:model`` syntax to switch providers at runtime::\n\n openrouter:anthropic/claude-sonnet-4.5 → (\"openrouter\", \"anthropic/claude-sonnet-4.5\")\n removed_provider:arcen-3 → (\"removed_provider\", \"arcen-3\")\n anthropic/claude-sonnet-4.5 → (current_provider, \"anthropic/claude-sonnet-4.5\")\n gpt-5.4 → (current_provider, \"gpt-5.4\")\n\n The colon is only treated as a provider delimiter if the left side is a\n recognized provider name or alias. This avoids misinterpreting model names\n that happen to contain colons (e.g. ``anthropic/claude-3.5-sonnet:beta``).\n\n Returns ``(provider, model)`` where *provider* is either the explicit\n provider from the input or *current_provider* if none was specified.\n \"\"\"\n stripped = raw.strip()\n colon = stripped.find(\":\")\n if colon > 0:\n provider_part = stripped[:colon].strip().lower()\n model_part = stripped[colon + 1:].strip()\n if provider_part and model_part and provider_part in _KNOWN_PROVIDER_NAMES:\n # Support custom:name:model triple syntax for named custom\n # providers. ``custom:local:qwen`` → (\"custom:local\", \"qwen\").\n # Single colon ``custom:qwen`` → (\"custom\", \"qwen\") as before.\n if provider_part == \"custom\" and \":\" in model_part:\n second_colon = model_part.find(\":\")\n custom_name = model_part[:second_colon].strip()\n actual_model = model_part[second_colon + 1:].strip()\n if custom_name and actual_model:\n return (f\"custom:{custom_name}\", actual_model)\n return (normalize_provider(provider_part), model_part)\n return (current_provider, stripped)\n\n\ndef _get_custom_base_url() -> str:\n \"\"\"Get the custom endpoint base_url from config.yaml.\"\"\"\n try:\n from arcen_cli.config import load_config\n config = load_config()\n model_cfg = config.get(\"model\", {})\n if isinstance(model_cfg, dict):\n return str(model_cfg.get(\"base_url\", \"\")).strip()\n except Exception:\n pass\n return \"\"\n\n\ndef curated_models_for_provider(\n provider: Optional[str],\n *,\n force_refresh: bool = False,\n) -> list[tuple[str, str]]:\n \"\"\"Return ``(model_id, description)`` tuples for a provider's model list.\n\n Tries to fetch the live model list from the provider's API first,\n falling back to the static ``_PROVIDER_MODELS`` catalog if the API\n is unreachable.\n \"\"\"\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\":\n return fetch_openrouter_models(force_refresh=force_refresh)\n\n # Try live API first (Codex, Removed provider, etc. all support /models)\n live = provider_model_ids(normalized)\n if live:\n return [(m, \"\") for m in live]\n\n # Fallback to static catalog\n models = _PROVIDER_MODELS.get(normalized, [])\n return [(m, \"\") for m in models]\n\n\ndef _provider_keys(provider: str) -> set[str]:\n key = (provider or \"\").strip().lower()\n normalized = normalize_provider(provider)\n return {k for k in (key, normalized) if k}\n\n\ndef _model_in_provider_catalog(name_lower: str, providers: set[str]) -> bool:\n return any(\n name_lower == model.lower()\n for provider in providers\n for model in _PROVIDER_MODELS.get(provider, [])\n )\n\n\n_AGGREGATOR_PROVIDERS = frozenset(\n {\"removed_provider\", \"openrouter\", \"copilot\", \"kilocode\"}\n)\n\n\ndef _resolve_static_model_alias(\n name_lower: str,\n current_keys: set[str],\n) -> Optional[tuple[str, str]]:\n \"\"\"Resolve short aliases (e.g. sonnet/opus) using static catalogs only.\"\"\"\n try:\n from arcen_cli.model_switch import MODEL_ALIASES\n except Exception:\n return None\n\n identity = MODEL_ALIASES.get(name_lower)\n if identity is None:\n return None\n\n vendor = identity.vendor\n family = identity.family\n\n def _match(provider: str) -> Optional[str]:\n models = _PROVIDER_MODELS.get(provider, [])\n if not models:\n return None\n prefix = (\n f\"{vendor}/{family}\"\n if provider in _AGGREGATOR_PROVIDERS\n else family\n ).lower()\n for model in models:\n if model.lower().startswith(prefix):\n return model\n return None\n\n for provider in current_keys:\n if matched := _match(provider):\n return provider, matched\n\n for provider in _PROVIDER_MODELS:\n if provider in current_keys or provider in _AGGREGATOR_PROVIDERS:\n continue\n if matched := _match(provider):\n return provider, matched\n\n for provider in _AGGREGATOR_PROVIDERS:\n if provider in current_keys and (matched := _match(provider)):\n return provider, matched\n\n return None\n\n\ndef detect_static_provider_for_model(\n model_name: str,\n current_provider: str,\n) -> Optional[tuple[str, str]]:\n \"\"\"Auto-detect a provider from static catalogs only.\n\n Returns ``(provider_id, model_name)``. The model name may be remapped\n when a static alias or bare provider name resolves to a catalog default.\n Returns ``None`` when no confident match is found.\n \"\"\"\n name = (model_name or \"\").strip()\n if not name:\n return None\n\n name_lower = name.lower()\n current_keys = _provider_keys(current_provider)\n\n alias_match = _resolve_static_model_alias(name_lower, current_keys)\n if alias_match:\n return alias_match\n\n # --- Step 0: bare provider name typed as model ---\n # If someone types `/model removed_provider` or `/model anthropic`, treat it as a\n # provider switch and pick the first model from that provider's catalog.\n # Skip \"custom\" and \"openrouter\" — custom has no model catalog, and\n # openrouter requires an explicit model name to be useful.\n resolved_provider = _PROVIDER_ALIASES.get(name_lower, name_lower)\n if resolved_provider not in {\"custom\", \"openrouter\"}:\n default_models = _PROVIDER_MODELS.get(resolved_provider, [])\n if (\n resolved_provider in _PROVIDER_LABELS\n and default_models\n and resolved_provider not in current_keys\n ):\n return (resolved_provider, default_models[0])\n\n # Aggregators list other providers' models — never auto-switch TO them\n # If the model belongs to the current provider's catalog, don't suggest switching\n if _model_in_provider_catalog(name_lower, current_keys):\n return None\n\n # --- Step 1: check static provider catalogs for a direct match ---\n for pid, models in _PROVIDER_MODELS.items():\n if pid in current_keys or pid in _AGGREGATOR_PROVIDERS:\n continue\n if any(name_lower == m.lower() for m in models):\n return (pid, name)\n\n return None\n\n\ndef detect_provider_for_model(\n model_name: str,\n current_provider: str,\n) -> Optional[tuple[str, str]]:\n \"\"\"Auto-detect the best provider for a model name.\n\n Returns ``(provider_id, model_name)`` — the model name may be remapped\n (e.g. bare ``deepseek-chat`` → ``deepseek/deepseek-chat`` for OpenRouter).\n Returns ``None`` when no confident match is found.\n\n Priority:\n 0. Bare provider name → switch to that provider's default model\n 1. Direct provider static catalog match\n 2. OpenRouter catalog match\n \"\"\"\n name = (model_name or \"\").strip()\n if not name:\n return None\n\n static_match = detect_static_provider_for_model(name, current_provider)\n if static_match:\n return static_match\n if _model_in_provider_catalog(name.lower(), _provider_keys(current_provider)):\n return None\n\n # --- Step 2: check OpenRouter catalog ---\n # First try exact match (handles provider/model format)\n or_slug = _find_openrouter_slug(name)\n if or_slug:\n if current_provider != \"openrouter\":\n return (\"openrouter\", or_slug)\n # Already on openrouter, just return the resolved slug\n if or_slug != name:\n return (\"openrouter\", or_slug)\n return None # already on openrouter with matching name\n\n return None\n\n\ndef _find_openrouter_slug(model_name: str) -> Optional[str]:\n \"\"\"Find the full OpenRouter model slug for a bare or partial model name.\n\n Handles:\n - Exact match: ``anthropic/claude-opus-4.6`` → as-is\n - Bare name: ``deepseek-chat`` → ``deepseek/deepseek-chat``\n - Bare name: ``claude-opus-4.6`` → ``anthropic/claude-opus-4.6``\n \"\"\"\n name_lower = model_name.strip().lower()\n if not name_lower:\n return None\n\n # Exact match (already has provider/ prefix)\n for mid in model_ids():\n if name_lower == mid.lower():\n return mid\n\n # Try matching just the model part (after the /)\n for mid in model_ids():\n if \"/\" in mid:\n _, model_part = mid.split(\"/\", 1)\n if name_lower == model_part.lower():\n return mid\n\n return None\n\n\ndef normalize_provider(provider: Optional[str]) -> str:\n \"\"\"Normalize provider aliases to Arcen' canonical provider ids.\n\n Note: ``\"auto\"`` passes through unchanged — use\n ``arcen_cli.auth.resolve_provider()`` to resolve it to a concrete\n provider based on credentials and environment.\n \"\"\"\n normalized = (provider or \"openrouter\").strip().lower()\n return _PROVIDER_ALIASES.get(normalized, normalized)\n\n\ndef provider_label(provider: Optional[str]) -> str:\n \"\"\"Return a human-friendly label for a provider id or alias.\"\"\"\n original = (provider or \"openrouter\").strip()\n normalized = original.lower()\n if normalized == \"auto\":\n return \"Auto\"\n normalized = normalize_provider(normalized)\n return _PROVIDER_LABELS.get(normalized, original or \"OpenRouter\")\n\n\n# Models that support OpenAI Priority Processing (service_tier=\"priority\").\n# See https://openai.com/api-priority-processing/ for the canonical list.\n#\n# Pattern-based matching — any OpenAI flagship model (gpt-*, o1*, o3*, o4*)\n# is assumed to support Priority Processing. service_tier=priority is silently\n# ignored by non-OpenAI endpoints (OpenRouter/Copilot/opencode-zen proxies\n# strip the field), so false positives are harmless. Codex-series models\n# (gpt-5-codex, gpt-5.3-codex, etc.) are excluded — they don't expose the\n# service_tier parameter through the Codex Responses API.\n_OPENAI_FAST_MODE_PREFIXES: tuple[str, ...] = (\n \"gpt-\",\n \"o1\",\n \"o3\",\n \"o4\",\n)\n\n\ndef _is_openai_fast_model(model_id: Optional[str]) -> bool:\n \"\"\"Return True if the model is an OpenAI flagship eligible for Priority Processing.\"\"\"\n raw = _strip_vendor_prefix(str(model_id or \"\"))\n base = raw.split(\":\")[0]\n if not base:\n return False\n # Exclude Codex-series — they route through the Codex Responses API\n # which doesn't accept service_tier.\n if \"codex\" in base:\n return False\n return any(base.startswith(prefix) for prefix in _OPENAI_FAST_MODE_PREFIXES)\n\n\n# Models that support Anthropic Fast Mode (speed=\"fast\").\n# See https://platform.claude.com/docs/en/build-with-claude/fast-mode\n#\n# Pattern-based matching — any claude-* model is eligible. The anthropic\n# adapter gates speed=fast on native Anthropic endpoints only (see\n# _is_third_party_anthropic_endpoint in agent/anthropic_adapter.py), so\n# third-party proxies that would reject the beta header are protected.\n\n\ndef _strip_vendor_prefix(model_id: str) -> str:\n \"\"\"Strip vendor/ prefix from a model ID (e.g. 'anthropic/claude-opus-4-6' -> 'claude-opus-4-6').\"\"\"\n raw = str(model_id or \"\").strip().lower()\n if \"/\" in raw:\n raw = raw.split(\"/\", 1)[1]\n return raw\n\n\ndef model_supports_fast_mode(model_id: Optional[str]) -> bool:\n \"\"\"Return whether Arcen should expose the /fast toggle for this model.\"\"\"\n return _is_anthropic_fast_model(model_id) or _is_openai_fast_model(model_id)\n\n\ndef _is_anthropic_fast_model(model_id: Optional[str]) -> bool:\n \"\"\"Return True if the model accepts the Anthropic Fast Mode ``speed`` param.\n\n This gates the *speed=fast request parameter*, which Anthropic supports on\n Opus 4.6 only (Opus 4.7 explicitly 400s). It is deliberately NOT a general\n \"is this a fast model\" check: for Opus 4.8 the fast offering is a SEPARATE\n model id (``…-opus-4.8-fast``) selected via the model field, not the speed\n parameter — see ``agent.anthropic_adapter._supports_fast_mode`` and its\n test. Keep this in lock-step with that adapter gate so the UI never shows a\n Fast toggle that the runtime would silently drop.\n \"\"\"\n raw = _strip_vendor_prefix(str(model_id or \"\"))\n base = raw.split(\":\")[0]\n if not base.startswith(\"claude-\"):\n return False\n # Only Opus 4.6 supports the speed=fast parameter at present.\n return \"opus-4-6\" in base or \"opus-4.6\" in base\n\n\ndef resolve_fast_mode_overrides(model_id: Optional[str]) -> dict[str, Any] | None:\n \"\"\"Return request_overrides for fast/priority mode, or None if unsupported.\n\n Returns provider-appropriate overrides:\n - OpenAI models: ``{\"service_tier\": \"priority\"}`` (Priority Processing)\n - Anthropic models: ``{\"speed\": \"fast\"}`` (Anthropic Fast Mode beta)\n\n The overrides are injected into the API request kwargs by\n ``_build_api_kwargs`` in run_agent.py — each API path handles its own\n keys (service_tier for OpenAI/Codex, speed for Anthropic Messages).\n \"\"\"\n if not model_supports_fast_mode(model_id):\n return None\n if _is_anthropic_fast_model(model_id):\n return {\"speed\": \"fast\"}\n return {\"service_tier\": \"priority\"}\n\n\ndef _resolve_copilot_catalog_api_key() -> str:\n \"\"\"Best-effort GitHub token for fetching the Copilot model catalog.\n\n Resolution order:\n 1. ``resolve_api_key_provider_credentials(\"copilot\")`` — env vars\n (``COPILOT_GITHUB_TOKEN`` / ``GH_TOKEN`` / ``GITHUB_TOKEN``) plus\n the ``gh auth token`` CLI fallback.\n 2. ``read_credential_pool(\"copilot\")`` — a token (typically a\n ``gho_*`` from device-code login, or a fine-grained PAT) stored in\n ``auth.json`` under ``credential_pool.copilot[]``. The pool is\n populated by ``arcen auth add copilot`` and by ``_seed_from_env``\n when the env var is set in ``~/.arcen/.env``.\n\n Without (2), users whose only Copilot credential is in the pool see\n the ``/model`` picker fall back to a stale hardcoded list because the\n live catalog fetch silently 401s. To avoid wedging on a malformed pool\n entry, each candidate is exchanged via ``exchange_copilot_token`` —\n only entries that actually exchange successfully are returned, so a\n later valid entry is reachable when an earlier one is unsupported.\n \"\"\"\n try:\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n creds = resolve_api_key_provider_credentials(\"copilot\")\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n if api_key:\n return api_key\n except Exception:\n pass\n\n try:\n from arcen_cli.auth import read_credential_pool\n from arcen_cli.copilot_auth import (\n exchange_copilot_token,\n validate_copilot_token,\n )\n\n for entry in read_credential_pool(\"copilot\"):\n if not isinstance(entry, dict):\n continue\n raw = str(entry.get(\"access_token\") or \"\").strip()\n if not raw:\n continue\n valid, _ = validate_copilot_token(raw)\n if not valid:\n continue\n try:\n api_token, _expires_at = exchange_copilot_token(raw)\n except Exception:\n continue\n if api_token:\n return api_token\n except Exception:\n pass\n\n return \"\"\n\n\n# Providers where models.dev is treated as authoritative: curated static\n# lists are kept only as an offline fallback and to capture custom additions\n# the registry doesn't publish yet. Adding a provider here causes its\n# curated list to be merged with fresh models.dev entries (fresh first, any\n# curated-only names appended) for both the CLI and the gateway /model picker.\n#\n# DELIBERATELY EXCLUDED:\n# - \"openrouter\": curated list is already a hand-picked agentic subset of\n# OpenRouter's 400+ catalog. Blindly merging would dump everything.\n# - \"removed_provider\": curated list and Portal /models endpoint are the source of\n# truth for the subscription tier.\n# Also excluded: providers that already have dedicated live-endpoint\n# branches below (copilot, anthropic, ollama-cloud, custom,\n# stepfun, openai-codex) — those paths handle freshness themselves.\n_MODELS_DEV_PREFERRED: frozenset[str] = frozenset({\n \"opencode-go\",\n \"opencode-zen\",\n \"deepseek\",\n \"kilocode\",\n \"fireworks\",\n \"mistral\",\n \"togetherai\",\n \"cohere\",\n \"perplexity\",\n \"groq\",\n \"nvidia\",\n \"huggingface\",\n \"zai\",\n \"gemini\",\n \"google\",\n})\n\n\ndef _merge_with_models_dev(provider: str, curated: list[str]) -> list[str]:\n \"\"\"Merge curated list with fresh models.dev entries for a preferred provider.\n\n Returns models.dev entries first (in models.dev order), then any\n curated-only entries appended. Preserves case for curated fallbacks\n (e.g. ``MiniMax-M2.7``) while trusting models.dev for newer variants.\n\n If models.dev is unreachable or returns nothing, the curated list is\n returned unchanged — this is the offline/CI fallback path.\n \"\"\"\n try:\n from agent.models_dev import list_agentic_models\n mdev = list_agentic_models(provider)\n except Exception:\n mdev = []\n\n if not mdev:\n return list(curated)\n\n # Case-insensitive dedup while preserving order and curated casing.\n seen_lower: set[str] = set()\n merged: list[str] = []\n for mid in mdev:\n key = str(mid).lower()\n if key in seen_lower:\n continue\n seen_lower.add(key)\n merged.append(mid)\n for mid in curated:\n key = str(mid).lower()\n if key in seen_lower:\n continue\n seen_lower.add(key)\n merged.append(mid)\n return merged\n\n\ndef provider_model_ids(provider: Optional[str], *, force_refresh: bool = False) -> list[str]:\n \"\"\"Return the best known model catalog for a provider.\n\n Tries live API endpoints for providers that support them (Codex, Removed provider),\n falling back to static lists. For providers in ``_MODELS_DEV_PREFERRED``\n (opencode-go/zen, xiaomi, deepseek, smaller inference providers, etc.),\n models.dev entries are merged on top of curated so new models released\n on the platform appear in ``/model`` without an Arcen release.\n \"\"\"\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\":\n return model_ids(force_refresh=force_refresh)\n if normalized == \"openai-codex\":\n from arcen_cli.codex_models import get_codex_model_ids\n\n # Pass the live OAuth access token so the picker matches whatever\n # ChatGPT lists for this account right now (new models appear without\n # an Arcen release). Falls back to the hardcoded catalog if no token\n # or the endpoint is unreachable.\n access_token = None\n try:\n from arcen_cli.auth import resolve_codex_runtime_credentials\n\n creds = resolve_codex_runtime_credentials(refresh_if_expiring=True)\n access_token = creds.get(\"api_key\")\n except Exception:\n access_token = None\n return get_codex_model_ids(access_token=access_token)\n if normalized == \"xai-oauth\":\n return list(_PROVIDER_MODELS.get(\"xai-oauth\", _PROVIDER_MODELS.get(\"xai\", [])))\n if normalized in {\"copilot\", \"copilot-acp\"}:\n try:\n live = _fetch_github_models(_resolve_copilot_catalog_api_key())\n if live:\n return live\n except Exception:\n pass\n if normalized == \"copilot-acp\":\n return list(_PROVIDER_MODELS.get(\"copilot\", []))\n if normalized == \"removed_provider\":\n # Try live Removed provider Portal /models endpoint\n try:\n from arcen_cli.auth import fetch_removed_provider_models, resolve_removed_provider_runtime_credentials\n creds = resolve_removed_provider_runtime_credentials()\n if creds:\n live = fetch_removed_provider_models(api_key=creds.get(\"api_key\", \"\"), inference_base_url=creds.get(\"base_url\", \"\"))\n if live:\n return live\n except Exception:\n pass\n # Live failed (or no creds). Fall back to the docs-hosted manifest\n # — NOT the in-repo _PROVIDER_MODELS[\"removed_provider\"] snapshot — so newly\n # added Portal models still surface without an Arcen release.\n manifest_ids = get_curated_removed_provider_model_ids()\n if manifest_ids:\n return manifest_ids\n if normalized == \"stepfun\":\n try:\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n creds = resolve_api_key_provider_credentials(\"stepfun\")\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n base_url = str(creds.get(\"base_url\") or \"\").strip()\n if api_key and base_url:\n live = fetch_api_models(api_key, base_url)\n if live:\n return live\n except Exception:\n pass\n if normalized == \"anthropic\":\n live = _fetch_anthropic_models()\n if live:\n return live\n if normalized == \"ollama-cloud\":\n live = fetch_ollama_cloud_models(force_refresh=force_refresh)\n if live:\n return live\n if normalized in (\"openai\", \"openai-api\"):\n api_key = os.getenv(\"OPENAI_API_KEY\", \"\").strip()\n if api_key:\n base_raw = os.getenv(\"OPENAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n base = base_raw or \"https://api.openai.com/v1\"\n # Custom OpenAI-compatible endpoints (proxies, gateways, self-hosted)\n # may serve a small curated catalog — use the live list verbatim so\n # discovery works. But the canonical api.openai.com /v1/models dump\n # is 120+ entries of embeddings, whisper, tts, dall-e, moderation and\n # legacy chat models — none of which belong in the agent model picker.\n # For the default endpoint, intersect the live list with our curated\n # agentic catalog so ``/model`` matches what ``arcen model`` shows.\n is_default_openai = base.rstrip(\"/\") in (\n \"https://api.openai.com/v1\",\n \"https://api.openai.com\",\n )\n try:\n live = fetch_api_models(api_key, base)\n if live:\n if is_default_openai:\n live_lower = {m.lower() for m in live}\n curated = list(_PROVIDER_MODELS.get(normalized, []))\n # Keep curated order; only surface curated models the\n # account actually has access to.\n filtered = [m for m in curated if m.lower() in live_lower]\n if filtered:\n return filtered\n # Account serves none of the curated models (rare —\n # e.g. org without GPT-5 access). Fall back to curated\n # so the picker still offers sane defaults.\n return curated or live\n return live\n except Exception:\n pass\n if normalized == \"gmi\":\n try:\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n creds = resolve_api_key_provider_credentials(\"gmi\")\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n base_url = str(creds.get(\"base_url\") or \"\").strip()\n if api_key and base_url:\n live = fetch_api_models(api_key, base_url)\n if live:\n return live\n except Exception:\n pass\n if normalized == \"custom\":\n base_url = _get_custom_base_url()\n if base_url:\n # Try common API key env vars for custom endpoints\n api_key = (\n os.getenv(\"CUSTOM_API_KEY\", \"\")\n or os.getenv(\"OPENAI_API_KEY\", \"\")\n or os.getenv(\"OPENROUTER_API_KEY\", \"\")\n )\n live = fetch_api_models(api_key, base_url)\n if live:\n return live\n # Bedrock uses live discovery keyed by the resolved AWS region so that\n # EU/AP users see eu.*/ap.* model IDs instead of the static us.* list.\n # Note: early return intentionally skips _MODELS_DEV_PREFERRED merge\n # below — bedrock is not expected to appear in that table.\n if normalized == \"bedrock\":\n try:\n from agent.bedrock_adapter import bedrock_model_ids_or_none\n ids = bedrock_model_ids_or_none()\n if ids is not None:\n return ids\n except Exception:\n pass\n\n # ── Profile-based generic live fetch (all simple api-key providers) ──\n # Handles any provider registered in providers/ with auth_type=\"api_key\".\n # Replaces per-provider copy-paste blocks (stepfun, gmi, zai, etc.).\n try:\n from providers import get_provider_profile\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n _p = get_provider_profile(normalized)\n if _p and _p.auth_type == \"api_key\" and _p.base_url:\n try:\n creds = resolve_api_key_provider_credentials(normalized)\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n base_url = str(creds.get(\"base_url\") or \"\").strip()\n except Exception:\n api_key, base_url = \"\", _p.base_url\n if not base_url:\n base_url = _p.base_url\n if api_key:\n live = _p.fetch_models(api_key=api_key)\n if live:\n return live\n # Use profile's fallback_models if defined\n if _p.fallback_models:\n return list(_p.fallback_models)\n except Exception:\n pass\n\n curated_static = list(_PROVIDER_MODELS.get(normalized, []))\n if normalized in _MODELS_DEV_PREFERRED:\n return _merge_with_models_dev(normalized, curated_static)\n return curated_static\n\n\n# ---------------------------------------------------------------------------\n# Generic disk cache for provider_model_ids() — keeps /model picker fast.\n# ---------------------------------------------------------------------------\n#\n# Without this layer, every /model picker open re-fetches every authed\n# provider's /v1/models endpoint. On a well-configured user (anthropic +\n# openai + copilot + gemini + huggingface + ...) that's 2+ seconds of cold\n# HTTP roundtrips just to render the provider list.\n#\n# Cache strategy:\n# - One JSON file at $ARCEN_HOME/provider_models_cache.json\n# - Per-provider entries keyed by (provider, credential fingerprint)\n# - Credential fingerprint = sha256 of env-var values that the provider\n# normally reads. Swap your OPENAI_API_KEY and the entry invalidates.\n# - 1h TTL by default. `force_refresh=True` skips the cache entirely\n# and overwrites it on success.\n# - Only NON-EMPTY results are cached. An empty/None response from a\n# transient network error never gets pinned.\n# - Cache file is best-effort. Any read/write error degrades silently\n# to a live fetch — the picker keeps working.\n\n_PROVIDER_MODELS_CACHE_TTL = 3600 # 1h\n\n\ndef _provider_models_cache_path() -> Path:\n from arcen_constants import get_arcen_home\n return get_arcen_home() / \"provider_models_cache.json\"\n\n\ndef _credential_fingerprint(provider: str) -> str:\n \"\"\"Return a short hash representing the credentials that\n ``provider_model_ids(provider)`` would see right now.\n\n Rotating any of the relevant env vars invalidates the cached entry\n for that provider. We hash AT LEAST the api-key + base-url env vars\n declared in ``PROVIDER_REGISTRY``. For OAuth-backed providers\n (codex, copilot, anthropic-via-claude-code, removed_provider portal), the\n relevant tokens live in ``$ARCEN_HOME/auth.json`` and external\n credential files. Rather than parse every shape, we additionally\n fold the mtime of those files into the fingerprint so refreshes\n after re-auth bust the cache.\n \"\"\"\n import hashlib\n import os as _os\n\n parts: list[str] = []\n\n # Env vars from PROVIDER_REGISTRY for this slug\n try:\n from arcen_cli.auth import PROVIDER_REGISTRY\n pcfg = PROVIDER_REGISTRY.get(provider)\n if pcfg is not None:\n for ev in getattr(pcfg, \"api_key_env_vars\", ()) or ():\n parts.append(f\"{ev}={_os.environ.get(ev, '')}\")\n bev = getattr(pcfg, \"base_url_env_var\", \"\") or \"\"\n if bev:\n parts.append(f\"{bev}={_os.environ.get(bev, '')}\")\n except Exception:\n pass\n\n # OAuth / external-file mtimes that change on re-auth\n try:\n from arcen_constants import get_arcen_home\n for rel in (\"auth.json\", \"credentials.json\"):\n p = get_arcen_home() / rel\n try:\n parts.append(f\"{rel}@{p.stat().st_mtime_ns}\")\n except FileNotFoundError:\n parts.append(f\"{rel}@missing\")\n except Exception:\n pass\n except Exception:\n pass\n\n # External well-known credential file locations\n for path in (\n _os.path.expanduser(\"~/.codex/auth.json\"),\n _os.path.expanduser(\"~/.claude/.credentials.json\"),\n _os.path.expanduser(\"~/.config/github-copilot/hosts.json\"),\n _os.path.expanduser(\"~/.minimax/credentials.json\"),\n ):\n try:\n mt = _os.stat(path).st_mtime_ns\n parts.append(f\"{path}@{mt}\")\n except FileNotFoundError:\n parts.append(f\"{path}@missing\")\n except Exception:\n pass\n\n blob = \"|\".join(parts).encode(\"utf-8\", errors=\"replace\")\n # blake2b for cache-key fingerprinting only — not for credential storage.\n # We never reverse this hash; collisions are harmless (worst case: cache\n # miss → live re-fetch). Use blake2b instead of sha256 here because\n # CodeQL's `py/weak-sensitive-data-hashing` rule flags sha256 over env\n # vars whose names contain \"API_KEY\" / \"TOKEN\" even when the hash is\n # used as an identity fingerprint, not for password storage. blake2b\n # is a keyed-hash primitive and isn't flagged.\n return hashlib.blake2b(blob, digest_size=8).hexdigest()\n\n\ndef _load_provider_models_cache() -> dict:\n \"\"\"Return the full cache dict, or {} on any error.\"\"\"\n try:\n path = _provider_models_cache_path()\n if not path.exists():\n return {}\n with open(path, encoding=\"utf-8\") as f:\n data = json.load(f)\n return data if isinstance(data, dict) else {}\n except Exception:\n return {}\n\n\ndef _save_provider_models_cache(data: dict) -> None:\n \"\"\"Persist the cache dict. Best-effort — silent on any error.\"\"\"\n try:\n from utils import atomic_json_write\n path = _provider_models_cache_path()\n path.parent.mkdir(parents=True, exist_ok=True)\n atomic_json_write(path, data, indent=None)\n except Exception:\n pass\n\n\ndef cached_provider_model_ids(\n provider: Optional[str],\n *,\n force_refresh: bool = False,\n ttl_seconds: int = _PROVIDER_MODELS_CACHE_TTL,\n) -> list[str]:\n \"\"\"Disk-cached wrapper around :func:`provider_model_ids`.\n\n Hits the cache when fresh; otherwise calls the live function and\n persists a non-empty result. Always returns a list (never None).\n \"\"\"\n normalized = normalize_provider(provider) or (provider or \"\")\n if not normalized:\n return []\n\n cache = _load_provider_models_cache()\n fp = _credential_fingerprint(normalized)\n entry = cache.get(normalized)\n now = time.time()\n\n if (\n not force_refresh\n and isinstance(entry, dict)\n and entry.get(\"fp\") == fp\n and isinstance(entry.get(\"models\"), list)\n and entry[\"models\"]\n and (now - float(entry.get(\"at\", 0))) < ttl_seconds\n ):\n return list(entry[\"models\"])\n\n # Cache miss / stale / forced refresh — call the live path.\n live = provider_model_ids(normalized, force_refresh=force_refresh)\n if live:\n cache[normalized] = {\n \"fp\": fp,\n \"at\": now,\n \"models\": list(live),\n }\n _save_provider_models_cache(cache)\n return list(live)\n\n # Live fetch returned nothing. If we have a stale entry with the\n # SAME fingerprint, prefer it over an empty result — stale data\n # beats no data when the network is flaky.\n if (\n isinstance(entry, dict)\n and entry.get(\"fp\") == fp\n and isinstance(entry.get(\"models\"), list)\n and entry[\"models\"]\n ):\n return list(entry[\"models\"])\n return list(live or [])\n\n\ndef clear_provider_models_cache(provider: Optional[str] = None) -> None:\n \"\"\"Drop a single provider's cache entry, or wipe the whole cache.\n\n ``provider=None`` wipes everything; otherwise only that provider's\n entry is removed. Used by ``/model --refresh`` and\n ``arcen model --refresh``.\n \"\"\"\n try:\n if provider is None:\n path = _provider_models_cache_path()\n if path.exists():\n path.unlink()\n return\n cache = _load_provider_models_cache()\n normalized = normalize_provider(provider) or provider or \"\"\n if normalized in cache:\n del cache[normalized]\n _save_provider_models_cache(cache)\n except Exception:\n pass\n\n\ndef _fetch_anthropic_models(timeout: float = 5.0) -> Optional[list[str]]:\n \"\"\"Fetch available models from the Anthropic /v1/models endpoint.\n\n Uses resolve_anthropic_token() to find credentials (env vars or\n Claude Code auto-discovery). Returns sorted model IDs or None.\n \"\"\"\n try:\n from agent.anthropic_adapter import resolve_anthropic_token, _is_oauth_token\n except ImportError:\n return None\n\n token = resolve_anthropic_token()\n if not token:\n return None\n\n headers: dict[str, str] = {\"anthropic-version\": \"2023-06-01\"}\n is_oauth = _is_oauth_token(token)\n if is_oauth:\n headers[\"Authorization\"] = f\"Bearer {token}\"\n from agent.anthropic_adapter import _COMMON_BETAS, _OAUTH_ONLY_BETAS, _CONTEXT_1M_BETA\n headers[\"anthropic-beta\"] = \",\".join(_COMMON_BETAS + _OAUTH_ONLY_BETAS)\n else:\n headers[\"x-api-key\"] = token\n\n def _do_request(h: dict[str, str]):\n req = urllib.request.Request(\n \"https://api.anthropic.com/v1/models\",\n headers=h,\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n return json.loads(resp.read().decode())\n\n try:\n try:\n data = _do_request(headers)\n except urllib.error.HTTPError as http_err:\n # Reactive recovery for OAuth subscriptions that reject the 1M\n # context beta with 400 \"long context beta is not yet available\n # for this subscription\". Retry once without the beta; re-raise\n # anything else so the outer except logs it.\n if (\n is_oauth\n and http_err.code == 400\n ):\n try:\n body_text = http_err.read().decode(errors=\"ignore\").lower()\n except Exception:\n body_text = \"\"\n if \"long context beta\" in body_text and \"not yet available\" in body_text:\n headers[\"anthropic-beta\"] = \",\".join(\n [b for b in _COMMON_BETAS if b != _CONTEXT_1M_BETA]\n + list(_OAUTH_ONLY_BETAS)\n )\n data = _do_request(headers)\n else:\n raise\n else:\n raise\n models = [m[\"id\"] for m in data.get(\"data\", []) if m.get(\"id\")]\n # Sort: latest/largest first (opus > sonnet > haiku, higher version first)\n return sorted(models, key=lambda m: (\n \"opus\" not in m, # opus first\n \"sonnet\" not in m, # then sonnet\n \"haiku\" not in m, # then haiku\n m, # alphabetical within tier\n ))\n except Exception as e:\n import logging\n logging.getLogger(__name__).debug(\"Failed to fetch Anthropic models: %s\", e)\n return None\n\n\ndef _payload_items(payload: Any) -> list[dict[str, Any]]:\n if isinstance(payload, list):\n return [item for item in payload if isinstance(item, dict)]\n if isinstance(payload, dict):\n data = payload.get(\"data\", [])\n if isinstance(data, list):\n return [item for item in data if isinstance(item, dict)]\n return []\n\n\ndef copilot_default_headers() -> dict[str, str]:\n \"\"\"Standard headers for Copilot API requests.\n\n Includes Openai-Intent and x-initiator headers that opencode and the\n Copilot CLI send on every request.\n \"\"\"\n try:\n from arcen_cli.copilot_auth import copilot_request_headers\n return copilot_request_headers(is_agent_turn=True)\n except ImportError:\n return {\n \"Editor-Version\": COPILOT_EDITOR_VERSION,\n \"User-Agent\": \"ArcenAgent/1.0\",\n \"Openai-Intent\": \"conversation-edits\",\n \"x-initiator\": \"agent\",\n }\n\n\ndef _copilot_catalog_item_is_text_model(item: dict[str, Any]) -> bool:\n model_id = str(item.get(\"id\") or \"\").strip()\n if not model_id:\n return False\n\n if item.get(\"model_picker_enabled\") is False:\n return False\n\n capabilities = item.get(\"capabilities\")\n if isinstance(capabilities, dict):\n model_type = str(capabilities.get(\"type\") or \"\").strip().lower()\n if model_type and model_type != \"chat\":\n return False\n\n supported_endpoints = item.get(\"supported_endpoints\")\n if isinstance(supported_endpoints, list):\n normalized_endpoints = {\n str(endpoint).strip()\n for endpoint in supported_endpoints\n if str(endpoint).strip()\n }\n if normalized_endpoints and not normalized_endpoints.intersection(\n {\"/chat/completions\", \"/responses\", \"/v1/messages\"}\n ):\n return False\n\n return True\n\n\ndef fetch_github_model_catalog(\n api_key: Optional[str] = None, timeout: float = 5.0\n) -> Optional[list[dict[str, Any]]]:\n \"\"\"Fetch the live GitHub Copilot model catalog for this account.\"\"\"\n attempts: list[dict[str, str]] = []\n if api_key:\n attempts.append({\n **copilot_default_headers(),\n \"Authorization\": f\"Bearer {api_key}\",\n })\n attempts.append(copilot_default_headers())\n\n for headers in attempts:\n req = urllib.request.Request(COPILOT_MODELS_URL, headers=headers)\n try:\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n data = json.loads(resp.read().decode())\n items = _payload_items(data)\n models: list[dict[str, Any]] = []\n seen_ids: set[str] = set()\n for item in items:\n if not _copilot_catalog_item_is_text_model(item):\n continue\n model_id = str(item.get(\"id\") or \"\").strip()\n if not model_id or model_id in seen_ids:\n continue\n seen_ids.add(model_id)\n models.append(item)\n if models:\n return models\n except Exception:\n continue\n return None\n\n\n# ─── Copilot catalog context-window helpers ─────────────────────────────────\n\n# Module-level cache: {model_id: max_prompt_tokens}\n_copilot_context_cache: dict[str, int] = {}\n_copilot_context_cache_time: float = 0.0\n_COPILOT_CONTEXT_CACHE_TTL = 3600 # 1 hour\n\n\ndef get_copilot_model_context(model_id: str, api_key: Optional[str] = None) -> Optional[int]:\n \"\"\"Look up max_prompt_tokens for a Copilot model from the live /models API.\n\n Results are cached in-process for 1 hour to avoid repeated API calls.\n Returns the token limit or None if not found.\n \"\"\"\n global _copilot_context_cache, _copilot_context_cache_time\n\n # Serve from cache if fresh\n if _copilot_context_cache and (time.time() - _copilot_context_cache_time < _COPILOT_CONTEXT_CACHE_TTL):\n if model_id in _copilot_context_cache:\n return _copilot_context_cache[model_id]\n # Cache is fresh but model not in it — don't re-fetch\n return None\n\n # Fetch and populate cache\n catalog = fetch_github_model_catalog(api_key=api_key)\n if not catalog:\n return None\n\n cache: dict[str, int] = {}\n for item in catalog:\n mid = str(item.get(\"id\") or \"\").strip()\n if not mid:\n continue\n caps = item.get(\"capabilities\") or {}\n limits = caps.get(\"limits\") or {}\n max_prompt = limits.get(\"max_prompt_tokens\")\n if isinstance(max_prompt, int) and max_prompt > 0:\n cache[mid] = max_prompt\n\n _copilot_context_cache = cache\n _copilot_context_cache_time = time.time()\n\n return cache.get(model_id)\n\n\ndef _is_github_models_base_url(base_url: Optional[str]) -> bool:\n normalized = (base_url or \"\").strip().rstrip(\"/\").lower()\n return (\n normalized.startswith(COPILOT_BASE_URL)\n or normalized.startswith(\"https://models.github.ai/inference\")\n or normalized.startswith(\"https://models.inference.ai.azure.com\")\n )\n\n\ndef _lmstudio_server_root(base_url: Optional[str]) -> Optional[str]:\n \"\"\"Strip ``/v1`` suffix from an LM Studio base URL to get the native API root.\n\n Returns ``None`` when the base URL is empty/invalid.\n \"\"\"\n root = (base_url or \"\").strip().rstrip(\"/\")\n if root.endswith(\"/v1\"):\n root = root[:-3].rstrip(\"/\")\n return root or None\n\n\ndef _lmstudio_request_headers(api_key: Optional[str] = None) -> dict:\n \"\"\"Build HTTP headers for LM Studio native API requests.\"\"\"\n headers = {\"User-Agent\": _ARCEN_USER_AGENT}\n token = str(api_key or \"\").strip()\n if token:\n headers[\"Authorization\"] = f\"Bearer {token}\"\n return headers\n\n\ndef _lmstudio_fetch_raw_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n timeout: float = 5.0,\n) -> Optional[list[dict]]:\n \"\"\"Fetch the raw model list from LM Studio's ``/api/v1/models``.\n\n Returns the ``models`` list of dicts on success, ``None`` on network\n errors or malformed responses. Raises ``AuthError`` on HTTP 401/403.\n \"\"\"\n server_root = _lmstudio_server_root(base_url)\n if not server_root:\n return None\n\n headers = _lmstudio_request_headers(api_key)\n request = urllib.request.Request(server_root + \"/api/v1/models\", headers=headers)\n try:\n with urllib.request.urlopen(request, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except urllib.error.HTTPError as exc:\n if exc.code in {401, 403}:\n from arcen_cli.auth import AuthError\n raise AuthError(\n f\"LM Studio rejected the request with HTTP {exc.code}.\",\n provider=\"lmstudio\",\n code=\"auth_rejected\",\n ) from exc\n import logging\n logging.getLogger(__name__).debug(\n \"LM Studio probe at %s failed with HTTP %s\", server_root, exc.code,\n )\n return None\n except Exception as exc:\n import logging\n logging.getLogger(__name__).debug(\n \"LM Studio probe at %s failed: %s\", server_root, exc,\n )\n return None\n\n raw_models = payload.get(\"models\") if isinstance(payload, dict) else None\n if not isinstance(raw_models, list):\n import logging\n logging.getLogger(__name__).debug(\n \"LM Studio probe at %s returned malformed payload (no `models` list)\",\n server_root,\n )\n return None\n return raw_models\n\n\ndef probe_lmstudio_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n timeout: float = 5.0,\n) -> Optional[list[str]]:\n \"\"\"Probe LM Studio's model listing.\n\n Returns chat-capable model keys on success, including the valid empty-list\n case when the server is reachable but has no non-embedding models.\n Returns ``None`` on network errors, malformed responses, or empty/invalid\n base URLs.\n\n Raises ``AuthError`` on HTTP 401/403 so callers can surface token issues\n separately from reachability problems.\n \"\"\"\n raw_models = _lmstudio_fetch_raw_models(api_key=api_key, base_url=base_url, timeout=timeout)\n if raw_models is None:\n return None\n\n keys: list[str] = []\n for raw in raw_models:\n if not isinstance(raw, dict):\n continue\n if str(raw.get(\"type\") or \"\").strip().lower() == \"embedding\":\n continue\n key = str(raw.get(\"key\") or raw.get(\"id\") or \"\").strip()\n if key and key not in keys:\n keys.append(key)\n return keys\n\n\ndef fetch_lmstudio_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n timeout: float = 5.0,\n) -> list[str]:\n \"\"\"Fetch LM Studio chat-capable model keys from native ``/api/v1/models``.\n\n Returns a list of model keys (e.g. ``publisher/model-name``) with embedding\n models filtered out. Returns an empty list on network errors, malformed\n responses, or empty/invalid base URLs.\n\n Raises ``AuthError`` on HTTP 401/403 so callers can distinguish a missing\n or wrong ``LM_API_KEY`` from an unreachable server — the most common\n LM Studio support case once auth-enabled mode is turned on.\n \"\"\"\n models = probe_lmstudio_models(api_key=api_key, base_url=base_url, timeout=timeout)\n return models or []\n\n\ndef ensure_lmstudio_model_loaded(\n model: str,\n base_url: Optional[str],\n api_key: Optional[str],\n target_context_length: int,\n timeout: float = 120.0,\n) -> Optional[int]:\n \"\"\"Ensure LM Studio has ``model`` loaded with at least ``target_context_length``.\n\n No-op when an instance is already loaded with sufficient context. Otherwise\n POSTs ``/api/v1/models/load`` to (re)load with the target context, capped\n at the model's ``max_context_length``. Returns the resolved loaded context\n length, or ``None`` when the probe / load failed.\n \"\"\"\n server_root = _lmstudio_server_root(base_url)\n if not server_root:\n return None\n\n headers = _lmstudio_request_headers(api_key)\n\n try:\n raw_models = _lmstudio_fetch_raw_models(api_key=api_key, base_url=base_url, timeout=10)\n except Exception:\n raw_models = None\n if raw_models is None:\n return None\n\n target_entry = None\n for raw in raw_models:\n if not isinstance(raw, dict):\n continue\n if raw.get(\"key\") == model or raw.get(\"id\") == model:\n target_entry = raw\n break\n if target_entry is None:\n return None\n\n max_ctx = target_entry.get(\"max_context_length\")\n if isinstance(max_ctx, int) and max_ctx > 0:\n target_context_length = min(target_context_length, max_ctx)\n\n for inst in target_entry.get(\"loaded_instances\") or []:\n cfg = inst.get(\"config\") if isinstance(inst, dict) else None\n loaded_ctx = cfg.get(\"context_length\") if isinstance(cfg, dict) else None\n if isinstance(loaded_ctx, int) and loaded_ctx >= target_context_length:\n return loaded_ctx\n\n body = json.dumps({\n \"model\": model,\n \"context_length\": target_context_length,\n }).encode()\n load_headers = dict(headers)\n load_headers[\"Content-Type\"] = \"application/json\"\n try:\n with urllib.request.urlopen(\n urllib.request.Request(\n server_root + \"/api/v1/models/load\",\n data=body,\n headers=load_headers,\n method=\"POST\",\n ),\n timeout=timeout,\n ) as resp:\n resp.read()\n except Exception:\n return None\n return target_context_length\n\n\ndef lmstudio_model_reasoning_options(\n model: str,\n base_url: Optional[str],\n api_key: Optional[str] = None,\n timeout: float = 5.0,\n) -> list[str]:\n \"\"\"Return the reasoning ``allowed_options`` LM Studio publishes for ``model``.\n\n Pulls ``capabilities.reasoning.allowed_options`` from ``/api/v1/models``.\n Returns ``[]`` when the model is unknown, the endpoint is unreachable,\n or the model does not declare a reasoning capability.\n \"\"\"\n try:\n raw_models = _lmstudio_fetch_raw_models(api_key=api_key, base_url=base_url, timeout=timeout)\n except Exception:\n raw_models = None\n if not raw_models:\n return []\n\n for raw in raw_models:\n if not isinstance(raw, dict):\n continue\n if raw.get(\"key\") != model and raw.get(\"id\") != model:\n continue\n caps = raw.get(\"capabilities\")\n reasoning = caps.get(\"reasoning\") if isinstance(caps, dict) else None\n opts = reasoning.get(\"allowed_options\") if isinstance(reasoning, dict) else None\n if isinstance(opts, list):\n return [str(o).strip().lower() for o in opts if isinstance(o, str)]\n return []\n return []\n\n\ndef _fetch_github_models(api_key: Optional[str] = None, timeout: float = 5.0) -> Optional[list[str]]:\n catalog = fetch_github_model_catalog(api_key=api_key, timeout=timeout)\n if not catalog:\n return None\n return [item.get(\"id\", \"\") for item in catalog if item.get(\"id\")]\n\n\n_COPILOT_MODEL_ALIASES = {\n \"openai/gpt-5\": \"gpt-5-mini\",\n \"openai/gpt-5-chat\": \"gpt-5-mini\",\n \"openai/gpt-5-mini\": \"gpt-5-mini\",\n \"openai/gpt-5-nano\": \"gpt-5-mini\",\n \"openai/gpt-4.1\": \"gpt-4.1\",\n \"openai/gpt-4.1-mini\": \"gpt-4.1\",\n \"openai/gpt-4.1-nano\": \"gpt-4.1\",\n \"openai/gpt-4o\": \"gpt-4o\",\n \"openai/gpt-4o-mini\": \"gpt-4o-mini\",\n \"openai/o1\": \"gpt-5.2\",\n \"openai/o1-mini\": \"gpt-5-mini\",\n \"openai/o1-preview\": \"gpt-5.2\",\n \"openai/o3\": \"gpt-5.3-codex\",\n \"openai/o3-mini\": \"gpt-5-mini\",\n \"openai/o4-mini\": \"gpt-5-mini\",\n \"anthropic/claude-opus-4.6\": \"claude-opus-4.6\",\n \"anthropic/claude-sonnet-4.6\": \"claude-sonnet-4.6\",\n \"anthropic/claude-sonnet-4\": \"claude-sonnet-4\",\n \"anthropic/claude-sonnet-4.5\": \"claude-sonnet-4.5\",\n \"anthropic/claude-haiku-4.5\": \"claude-haiku-4.5\",\n # Dash-notation fallbacks: Arcen' default Claude IDs elsewhere use\n # hyphens (anthropic native format), but Copilot's API only accepts\n # dot-notation. Accept both so users who configure copilot + a\n # default hyphenated Claude model don't hit HTTP 400\n # \"model_not_supported\". See issue #6879.\n \"claude-opus-4-6\": \"claude-opus-4.6\",\n \"claude-sonnet-4-6\": \"claude-sonnet-4.6\",\n \"claude-sonnet-4-0\": \"claude-sonnet-4\",\n \"claude-sonnet-4-5\": \"claude-sonnet-4.5\",\n \"claude-haiku-4-5\": \"claude-haiku-4.5\",\n \"anthropic/claude-opus-4-6\": \"claude-opus-4.6\",\n \"anthropic/claude-sonnet-4-6\": \"claude-sonnet-4.6\",\n \"anthropic/claude-sonnet-4-0\": \"claude-sonnet-4\",\n \"anthropic/claude-sonnet-4-5\": \"claude-sonnet-4.5\",\n \"anthropic/claude-haiku-4-5\": \"claude-haiku-4.5\",\n}\n\n\ndef _copilot_catalog_ids(\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> set[str]:\n if catalog is None and api_key:\n catalog = fetch_github_model_catalog(api_key=api_key)\n if not catalog:\n return set()\n return {\n str(item.get(\"id\") or \"\").strip()\n for item in catalog\n if str(item.get(\"id\") or \"\").strip()\n }\n\n\ndef normalize_copilot_model_id(\n model_id: Optional[str],\n *,\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> str:\n raw = str(model_id or \"\").strip()\n if not raw:\n return \"\"\n\n catalog_ids = _copilot_catalog_ids(catalog=catalog, api_key=api_key)\n alias = _COPILOT_MODEL_ALIASES.get(raw)\n if alias:\n return alias\n\n candidates = [raw]\n if \"/\" in raw:\n candidates.append(raw.split(\"/\", 1)[1].strip())\n\n if raw.endswith(\"-mini\"):\n candidates.append(raw[:-5])\n if raw.endswith(\"-nano\"):\n candidates.append(raw[:-5])\n if raw.endswith(\"-chat\"):\n candidates.append(raw[:-5])\n\n seen: set[str] = set()\n for candidate in candidates:\n if not candidate or candidate in seen:\n continue\n seen.add(candidate)\n if candidate in _COPILOT_MODEL_ALIASES:\n return _COPILOT_MODEL_ALIASES[candidate]\n if candidate in catalog_ids:\n return candidate\n\n if \"/\" in raw:\n return raw.split(\"/\", 1)[1].strip()\n return raw\n\n\ndef _github_reasoning_efforts_for_model_id(model_id: str) -> list[str]:\n raw = (model_id or \"\").strip().lower()\n if raw.startswith((\"openai/o1\", \"openai/o3\", \"openai/o4\", \"o1\", \"o3\", \"o4\")):\n return list(COPILOT_REASONING_EFFORTS_O_SERIES)\n normalized = normalize_copilot_model_id(model_id).lower()\n if normalized.startswith(\"gpt-5\"):\n return list(COPILOT_REASONING_EFFORTS_GPT5)\n return []\n\n\ndef _should_use_copilot_responses_api(model_id: str) -> bool:\n \"\"\"Decide whether a Copilot model should use the Responses API.\n\n Replicates opencode's ``shouldUseCopilotResponsesApi`` logic:\n GPT-5+ models use Responses API, except ``gpt-5-mini`` which uses\n Chat Completions. All non-GPT models (Claude, Gemini, etc.) use\n Chat Completions.\n \"\"\"\n import re\n\n match = re.match(r\"^gpt-(\\d+)\", model_id)\n if not match:\n return False\n major = int(match.group(1))\n return major >= 5 and not model_id.startswith(\"gpt-5-mini\")\n\n\ndef copilot_model_api_mode(\n model_id: Optional[str],\n *,\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> str:\n \"\"\"Determine the API mode for a Copilot model.\n\n Uses the model ID pattern (matching opencode's approach) as the\n primary signal. Falls back to the catalog's ``supported_endpoints``\n only for models not covered by the pattern check.\n \"\"\"\n # Fetch the catalog once so normalize + endpoint check share it\n # (avoids two redundant network calls for non-GPT-5 models).\n if catalog is None and api_key:\n catalog = fetch_github_model_catalog(api_key=api_key)\n\n normalized = normalize_copilot_model_id(model_id, catalog=catalog, api_key=api_key)\n if not normalized:\n return \"chat_completions\"\n\n # Primary: model ID pattern (matches opencode's shouldUseCopilotResponsesApi)\n if _should_use_copilot_responses_api(normalized):\n return \"codex_responses\"\n\n # Secondary: check catalog for non-GPT-5 models (Claude via /v1/messages, etc.)\n if catalog:\n catalog_entry = next((item for item in catalog if item.get(\"id\") == normalized), None)\n if isinstance(catalog_entry, dict):\n supported_endpoints = {\n str(endpoint).strip()\n for endpoint in (catalog_entry.get(\"supported_endpoints\") or [])\n if str(endpoint).strip()\n }\n # For non-GPT-5 models, check if they only support messages API\n if \"/v1/messages\" in supported_endpoints and \"/chat/completions\" not in supported_endpoints:\n return \"anthropic_messages\"\n\n return \"chat_completions\"\n\n\n# Azure Foundry model families that require the Responses API. Azure\n# rejects /chat/completions against these deployments with\n# ``400 \"The requested operation is unsupported.\"`` — the same payload Bob\n# Dobolina hit in April 2026 on ``gpt-5.3-codex`` while ``gpt-4o-pure`` on\n# the same endpoint worked fine. Keep the patterns broad enough to cover\n# vendor-renamed deployments (e.g. ``gpt-5.3-codex``, ``gpt-5-codex``,\n# ``gpt-5.4``, ``o1-preview``) but tight enough to leave GPT-4 / 3.5 / Llama /\n# Mistral / Grok deployments on chat completions.\n_AZURE_FOUNDRY_RESPONSES_PREFIXES = (\n \"codex\", # codex-*, codex-mini\n \"gpt-5\", # gpt-5, gpt-5.x, gpt-5-codex, gpt-5.x-codex\n \"o1\", # o1, o1-preview, o1-mini\n \"o3\", # o3, o3-mini\n \"o4\", # o4, o4-mini\n)\n\n\ndef azure_foundry_model_api_mode(model_name: Optional[str]) -> Optional[str]:\n \"\"\"Infer Azure Foundry api_mode from a deployment/model name.\n\n Returns ``\"codex_responses\"`` when the model name matches a family that\n only accepts the Responses API on Azure Foundry (GPT-5.x, codex, o1/o3/o4\n reasoning models). Returns ``None`` otherwise — the caller should fall\n back to the configured/default api_mode (typically ``chat_completions``)\n so GPT-4o, GPT-4 Turbo, Llama, Mistral, etc. keep working.\n\n Intentionally does NOT return ``anthropic_messages``; Anthropic-style\n Azure endpoints are disambiguated by URL (``/anthropic`` suffix) in\n ``runtime_provider._detect_api_mode_for_url`` and by the user setting\n ``model.api_mode: anthropic_messages`` explicitly.\n \"\"\"\n raw = str(model_name or \"\").strip().lower()\n if not raw:\n return None\n # Strip any vendor/ prefix a user may have copied from OpenRouter / Copilot.\n if \"/\" in raw:\n raw = raw.rsplit(\"/\", 1)[-1]\n # gpt-5-mini speaks chat completions on Copilot but Azure Foundry deploys\n # the full gpt-5 family uniformly on Responses API — don't carve an\n # exception here.\n for prefix in _AZURE_FOUNDRY_RESPONSES_PREFIXES:\n if raw.startswith(prefix):\n return \"codex_responses\"\n return None\n\n\ndef normalize_opencode_model_id(provider_id: Optional[str], model_id: Optional[str]) -> str:\n \"\"\"Normalize OpenCode config IDs to the bare model slug used in API requests.\"\"\"\n provider = normalize_provider(provider_id)\n current = str(model_id or \"\").strip()\n if not current or provider not in {\"opencode-zen\", \"opencode-go\"}:\n return current\n\n prefix = f\"{provider}/\"\n if current.lower().startswith(prefix):\n return current[len(prefix):]\n return current\n\n\ndef opencode_model_api_mode(provider_id: Optional[str], model_id: Optional[str]) -> str:\n \"\"\"Determine the API mode for an OpenCode Zen / Go model.\n\n OpenCode routes different models behind different API surfaces:\n\n - GPT-5 / Codex models on Zen use ``/v1/responses``\n - Claude models on Zen use ``/v1/messages``\n - MiniMax models on Go use ``/v1/messages``\n - GLM / Kimi on Go use ``/v1/chat/completions``\n - Other Zen models (Gemini, GLM, Kimi, MiniMax, Qwen, etc.) use\n ``/v1/chat/completions``\n\n This follows the published OpenCode docs for Zen and Go endpoints.\n \"\"\"\n provider = normalize_provider(provider_id)\n normalized = normalize_opencode_model_id(provider_id, model_id).lower()\n if not normalized:\n return \"chat_completions\"\n\n if provider == \"opencode-go\":\n if normalized.startswith(\"minimax-\"):\n return \"anthropic_messages\"\n if normalized.startswith(\"qwen3.7-max\"):\n return \"anthropic_messages\"\n return \"chat_completions\"\n\n if provider == \"opencode-zen\":\n if normalized.startswith(\"claude-\"):\n return \"anthropic_messages\"\n if normalized.startswith(\"gpt-\"):\n return \"codex_responses\"\n return \"chat_completions\"\n\n return \"chat_completions\"\n\n\ndef github_model_reasoning_efforts(\n model_id: Optional[str],\n *,\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> list[str]:\n \"\"\"Return supported reasoning-effort levels for a Copilot-visible model.\"\"\"\n normalized = normalize_copilot_model_id(model_id, catalog=catalog, api_key=api_key)\n if not normalized:\n return []\n\n catalog_entry = None\n if catalog is not None:\n catalog_entry = next((item for item in catalog if item.get(\"id\") == normalized), None)\n elif api_key:\n fetched_catalog = fetch_github_model_catalog(api_key=api_key)\n if fetched_catalog:\n catalog_entry = next((item for item in fetched_catalog if item.get(\"id\") == normalized), None)\n\n if catalog_entry is not None:\n capabilities = catalog_entry.get(\"capabilities\")\n if isinstance(capabilities, dict):\n supports = capabilities.get(\"supports\")\n if isinstance(supports, dict):\n efforts = supports.get(\"reasoning_effort\")\n if isinstance(efforts, list):\n normalized_efforts = [\n str(effort).strip().lower()\n for effort in efforts\n if str(effort).strip()\n ]\n return list(dict.fromkeys(normalized_efforts))\n return []\n legacy_capabilities = {\n str(capability).strip().lower()\n for capability in catalog_entry.get(\"capabilities\", [])\n if str(capability).strip()\n }\n if \"reasoning\" not in legacy_capabilities:\n return []\n\n return _github_reasoning_efforts_for_model_id(str(model_id or normalized))\n\n\ndef probe_api_models(\n api_key: Optional[str],\n base_url: Optional[str],\n timeout: float = 5.0,\n api_mode: Optional[str] = None,\n) -> dict[str, Any]:\n \"\"\"Probe a ``/models`` endpoint with light URL heuristics.\n\n For ``anthropic_messages`` mode, uses ``x-api-key`` and\n ``anthropic-version`` headers (Anthropic's native auth) instead of\n ``Authorization: Bearer``. The response shape (``data[].id``) is\n identical, so the same parser works for both.\n \"\"\"\n normalized = (base_url or \"\").strip().rstrip(\"/\")\n if not normalized:\n return {\n \"models\": None,\n \"probed_url\": None,\n \"resolved_base_url\": \"\",\n \"suggested_base_url\": None,\n \"used_fallback\": False,\n }\n\n if _is_github_models_base_url(normalized):\n models = _fetch_github_models(api_key=api_key, timeout=timeout)\n return {\n \"models\": models,\n \"probed_url\": COPILOT_MODELS_URL,\n \"resolved_base_url\": COPILOT_BASE_URL,\n \"suggested_base_url\": None,\n \"used_fallback\": False,\n }\n\n if normalized.endswith(\"/v1\"):\n alternate_base = normalized[:-3].rstrip(\"/\")\n else:\n alternate_base = normalized + \"/v1\"\n\n candidates: list[tuple[str, bool]] = [(normalized, False)]\n if alternate_base and alternate_base != normalized:\n candidates.append((alternate_base, True))\n\n tried: list[str] = []\n headers: dict[str, str] = {\"User-Agent\": _ARCEN_USER_AGENT}\n if api_key and api_mode == \"anthropic_messages\":\n headers[\"x-api-key\"] = api_key\n headers[\"anthropic-version\"] = \"2023-06-01\"\n elif api_key:\n headers[\"Authorization\"] = f\"Bearer {api_key}\"\n if normalized.startswith(COPILOT_BASE_URL):\n headers.update(copilot_default_headers())\n\n for candidate_base, is_fallback in candidates:\n url = candidate_base.rstrip(\"/\") + \"/models\"\n tried.append(url)\n req = urllib.request.Request(url, headers=headers)\n try:\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n data = json.loads(resp.read().decode())\n return {\n \"models\": [m.get(\"id\", \"\") for m in data.get(\"data\", [])],\n \"probed_url\": url,\n \"resolved_base_url\": candidate_base.rstrip(\"/\"),\n \"suggested_base_url\": alternate_base if alternate_base != candidate_base else normalized,\n \"used_fallback\": is_fallback,\n }\n except Exception:\n continue\n\n return {\n \"models\": None,\n \"probed_url\": tried[0] if tried else normalized.rstrip(\"/\") + \"/models\",\n \"resolved_base_url\": normalized,\n \"suggested_base_url\": alternate_base if alternate_base != normalized else None,\n \"used_fallback\": False,\n }\n\n\ndef fetch_api_models(\n api_key: Optional[str],\n base_url: Optional[str],\n timeout: float = 5.0,\n api_mode: Optional[str] = None,\n) -> Optional[list[str]]:\n \"\"\"Fetch the list of available model IDs from the provider's ``/models`` endpoint.\n\n Returns a list of model ID strings, or ``None`` if the endpoint could not\n be reached (network error, timeout, auth failure, etc.).\n \"\"\"\n return probe_api_models(api_key, base_url, timeout=timeout, api_mode=api_mode).get(\"models\")\n\n\n# ---------------------------------------------------------------------------\n# Ollama Cloud — merged model discovery with disk cache\n# ---------------------------------------------------------------------------\n\n\n\n_OLLAMA_CLOUD_CACHE_TTL = 3600 # 1 hour\n\n\ndef _strip_ollama_cloud_suffix(model_id: str) -> str:\n \"\"\"Strip :cloud / -cloud suffixes that models.dev appends to Ollama Cloud IDs.\n\n The live API uses clean IDs (e.g. 'kimi-k2.6') while models.dev sometimes\n returns them as 'kimi-k2.6:cloud'. Normalising before the dedup merge\n prevents duplicate entries in the merged model list.\n \"\"\"\n for suffix in (\":cloud\", \"-cloud\"):\n if model_id.endswith(suffix):\n return model_id[: -len(suffix)]\n return model_id\n\n\ndef _ollama_cloud_cache_path() -> Path:\n \"\"\"Return the path for the Ollama Cloud model cache.\"\"\"\n from arcen_constants import get_arcen_home\n return get_arcen_home() / \"ollama_cloud_models_cache.json\"\n\n\ndef _load_ollama_cloud_cache(*, ignore_ttl: bool = False) -> Optional[dict]:\n \"\"\"Load cached Ollama Cloud models from disk.\n\n Args:\n ignore_ttl: If True, return data even if the TTL has expired (stale fallback).\n \"\"\"\n try:\n cache_path = _ollama_cloud_cache_path()\n if not cache_path.exists():\n return None\n with open(cache_path, encoding=\"utf-8\") as f:\n data = json.load(f)\n if not isinstance(data, dict):\n return None\n models = data.get(\"models\")\n if not (isinstance(models, list) and models):\n return None\n if not ignore_ttl:\n cached_at = data.get(\"cached_at\", 0)\n if (time.time() - cached_at) > _OLLAMA_CLOUD_CACHE_TTL:\n return None # stale\n return data\n except Exception:\n pass\n return None\n\n\ndef _save_ollama_cloud_cache(models: list[str]) -> None:\n \"\"\"Persist the merged Ollama Cloud model list to disk.\"\"\"\n try:\n from utils import atomic_json_write\n cache_path = _ollama_cloud_cache_path()\n cache_path.parent.mkdir(parents=True, exist_ok=True)\n atomic_json_write(cache_path, {\"models\": models, \"cached_at\": time.time()}, indent=None)\n except Exception:\n pass\n\n\ndef fetch_ollama_cloud_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n *,\n force_refresh: bool = False,\n) -> list[str]:\n \"\"\"Fetch Ollama Cloud models by merging live API + models.dev, with disk cache.\n\n Resolution order:\n 1. Disk cache (if fresh, < 1 hour, and not force_refresh)\n 2. Live ``/v1/models`` endpoint (primary — freshest source)\n 3. models.dev registry (secondary — fills gaps for unlisted models)\n 4. Merge: live models first, then models.dev additions (deduped)\n\n Returns a list of model IDs (never None — empty list on total failure).\n \"\"\"\n # 1. Check disk cache\n if not force_refresh:\n cached = _load_ollama_cloud_cache()\n if cached is not None:\n return cached[\"models\"]\n\n # 2. Live API probe\n if not api_key:\n api_key = os.getenv(\"OLLAMA_API_KEY\", \"\")\n if not base_url:\n base_url = os.getenv(\"OLLAMA_BASE_URL\", \"\") or \"https://ollama.com/v1\"\n\n live_models: list[str] = []\n if api_key:\n result = fetch_api_models(api_key, base_url, timeout=8.0)\n if result:\n live_models = result\n\n # 3. models.dev registry\n mdev_models: list[str] = []\n try:\n from agent.models_dev import list_agentic_models\n mdev_models = list_agentic_models(\"ollama-cloud\")\n except Exception:\n pass\n\n # 4. Merge: live first, then models.dev additions (deduped, order-preserving)\n if live_models or mdev_models:\n seen: set[str] = set()\n merged: list[str] = []\n for m in live_models:\n if m and m not in seen:\n seen.add(m)\n merged.append(m)\n for m in mdev_models:\n normalized = _strip_ollama_cloud_suffix(m)\n if normalized and normalized not in seen:\n seen.add(normalized)\n merged.append(normalized)\n if merged:\n _save_ollama_cloud_cache(merged)\n return merged\n\n # Total failure — return stale cache if available (ignore TTL)\n stale = _load_ollama_cloud_cache(ignore_ttl=True)\n if stale is not None:\n return stale[\"models\"]\n\n return []\n\n\ndef validate_requested_model(\n model_name: str,\n provider: Optional[str],\n *,\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n api_mode: Optional[str] = None,\n) -> dict[str, Any]:\n \"\"\"\n Validate a ``/model`` value for the active provider.\n\n Performs format checks first, then probes the live API to confirm\n the model actually exists.\n\n Returns a dict with:\n - accepted: whether the CLI should switch to the requested model now\n - persist: whether it is safe to save to config\n - recognized: whether it matched a known provider catalog\n - message: optional warning / guidance for the user\n \"\"\"\n requested = (model_name or \"\").strip()\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\" and base_url and \"openrouter.ai\" not in base_url:\n normalized = \"custom\"\n requested_for_lookup = requested\n if normalized == \"copilot\":\n requested_for_lookup = normalize_copilot_model_id(\n requested,\n api_key=api_key,\n ) or requested\n\n if not requested:\n return {\n \"accepted\": False,\n \"persist\": False,\n \"recognized\": False,\n \"message\": \"Model name cannot be empty.\",\n }\n\n if any(ch.isspace() for ch in requested):\n return {\n \"accepted\": False,\n \"persist\": False,\n \"recognized\": False,\n \"message\": \"Model names cannot contain spaces.\",\n }\n\n if normalized == \"lmstudio\":\n from arcen_cli.auth import AuthError\n # Use probe_lmstudio_models so we can distinguish None (unreachable\n # / malformed response) from [] (reachable, but no chat-capable models\n # are loaded). fetch_lmstudio_models collapses both to [].\n try:\n models = probe_lmstudio_models(api_key=api_key, base_url=base_url)\n except AuthError as exc:\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": (\n f\"{exc} Set `LM_API_KEY` (or update it) to match the server's bearer token.\"\n ),\n }\n if models is None:\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": f\"Could not reach LM Studio's `/api/v1/models` to validate `{requested}`.\",\n }\n if not models:\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": (\n f\"LM Studio is reachable but no chat-capable models are loaded. \"\n f\"Load `{requested}` in LM Studio (Developer tab → Load Model) and try again.\"\n ),\n }\n if requested_for_lookup in set(models):\n return {\"accepted\": True, \"persist\": True, \"recognized\": True, \"message\": None}\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": f\"Model `{requested}` was not found in LM Studio's model listing.\",\n }\n\n if normalized == \"custom\" or normalized.startswith(\"custom:\"):\n # Try probing with correct auth for the api_mode.\n if api_mode == \"anthropic_messages\":\n probe = probe_api_models(api_key, base_url, api_mode=api_mode)\n else:\n probe = probe_api_models(api_key, base_url)\n api_models = probe.get(\"models\")\n if api_models is not None:\n if requested_for_lookup in set(api_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n\n # Auto-correct if the top match is very similar (e.g. typo)\n auto = get_close_matches(requested_for_lookup, api_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n\n suggestions = get_close_matches(requested, api_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n\n message = (\n f\"Note: `{requested}` was not found in this custom endpoint's model listing \"\n f\"({probe.get('probed_url')}). It may still work if the server supports hidden or aliased models.\"\n f\"{suggestion_text}\"\n )\n if probe.get(\"used_fallback\"):\n message += (\n f\"\\n Endpoint verification succeeded after trying `{probe.get('resolved_base_url')}`. \"\n f\"Consider saving that as your base URL.\"\n )\n\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": message,\n }\n\n message = (\n f\"Note: could not reach this custom endpoint's model listing at `{probe.get('probed_url')}`. \"\n f\"Arcen will still save `{requested}`, but the endpoint should expose `/models` for verification.\"\n )\n if api_mode == \"anthropic_messages\":\n message += (\n \"\\n Many Anthropic-compatible proxies do not implement the Models API \"\n \"(GET /v1/models). The model name has been accepted without verification.\"\n )\n if probe.get(\"suggested_base_url\"):\n message += f\"\\n If this server expects `/v1`, try base URL: `{probe.get('suggested_base_url')}`\"\n\n return {\n \"accepted\": api_mode == \"anthropic_messages\",\n \"persist\": True,\n \"recognized\": False,\n \"message\": message,\n }\n\n # Providers with non-standard catalog validation — /v1/models probing is not the right path.\n if normalized in {\"openai-codex\", \"xai-oauth\"}:\n try:\n catalog_models = provider_model_ids(normalized)\n except Exception:\n catalog_models = []\n if catalog_models:\n if requested_for_lookup in set(catalog_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n # Auto-correct if the top match is very similar (e.g. typo)\n auto = get_close_matches(requested_for_lookup, catalog_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n suggestions = get_close_matches(requested_for_lookup, catalog_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n provider_label = \"OpenAI Codex\" if normalized == \"openai-codex\" else \"xAI Grok OAuth (SuperGrok / Premium+)\"\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in the {provider_label} model listing. \"\n \"It may still work if your account has access to a newer or hidden model ID.\"\n f\"{suggestion_text}\"\n ),\n }\n\n # MiniMax providers don't expose a /models endpoint — validate against\n # the static catalog instead, similar to openai-codex.\n if normalized in {\"minimax\", \"minimax-cn\"}:\n try:\n catalog_models = provider_model_ids(normalized)\n except Exception:\n catalog_models = []\n if catalog_models:\n # Case-insensitive lookup (catalog uses mixed case like MiniMax-M2.7)\n catalog_lower = {m.lower(): m for m in catalog_models}\n if requested_for_lookup.lower() in catalog_lower:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n # Auto-correct close matches (case-insensitive)\n catalog_lower_list = list(catalog_lower.keys())\n auto = get_close_matches(requested_for_lookup.lower(), catalog_lower_list, n=1, cutoff=0.9)\n if auto:\n corrected = catalog_lower[auto[0]]\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": corrected,\n \"message\": f\"Auto-corrected `{requested}` → `{corrected}`\",\n }\n suggestions = get_close_matches(requested_for_lookup.lower(), catalog_lower_list, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{catalog_lower[s]}`\" for s in suggestions)\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in the MiniMax catalog.\"\n f\"{suggestion_text}\"\n \"\\n MiniMax does not expose a /models endpoint, so Arcen cannot verify the model name.\"\n \"\\n The model may still work if it exists on the server.\"\n ),\n }\n\n # Native Anthropic provider: /v1/models requires x-api-key (or Bearer for\n # OAuth) plus anthropic-version headers. The generic OpenAI-style probe\n # below uses plain Bearer auth and 401s against Anthropic, so dispatch to\n # the native fetcher which handles both API keys and Claude-Code OAuth\n # tokens. (The api_mode==\"anthropic_messages\" branch below handles the\n # Messages-API transport case separately.)\n if normalized == \"anthropic\":\n anthropic_models = _fetch_anthropic_models()\n if anthropic_models is not None:\n if requested_for_lookup in set(anthropic_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n auto = get_close_matches(requested_for_lookup, anthropic_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n suggestions = get_close_matches(requested, anthropic_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n # Accept anyway — Anthropic sometimes gates newer/preview models\n # (e.g. snapshot IDs, early-access releases) behind accounts\n # even though they aren't listed on /v1/models.\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in Anthropic's /v1/models listing. \"\n f\"It may still work if you have early-access or snapshot IDs.\"\n f\"{suggestion_text}\"\n ),\n }\n # _fetch_anthropic_models returned None — no token resolvable or\n # network failure. Fall through to the generic warning below.\n\n # Anthropic Messages API: many proxies don't implement /v1/models.\n # Try probing with correct auth; if it fails, accept with a warning.\n if api_mode == \"anthropic_messages\":\n api_models = fetch_api_models(api_key, base_url, api_mode=api_mode)\n if api_models is not None:\n if requested_for_lookup in set(api_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n auto = get_close_matches(requested_for_lookup, api_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n # Probe failed or model not found — accept anyway (proxy likely\n # doesn't implement the Anthropic Models API).\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: could not verify `{requested}` against this endpoint's \"\n f\"model listing. Many Anthropic-compatible proxies do not \"\n f\"implement GET /v1/models. The model name has been accepted \"\n f\"without verification.\"\n ),\n }\n\n # Probe the live API to check if the model actually exists\n api_models = fetch_api_models(api_key, base_url)\n\n if api_models is not None:\n # Gemini's OpenAI-compat /v1beta/openai/models endpoint returns IDs\n # prefixed with \"models/\" (e.g. \"models/gemini-2.5-flash\") — native\n # Gemini-API convention. Our curated list and user input both use\n # the bare ID, so a direct set-membership check drops every known\n # Gemini model. Strip the prefix before comparison. See #12532.\n if normalized == \"gemini\":\n api_models = [\n m[len(\"models/\"):] if isinstance(m, str) and m.startswith(\"models/\") else m\n for m in api_models\n ]\n if requested_for_lookup in set(api_models):\n # API confirmed the model exists\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n else:\n # API responded but model is not listed. Accept anyway —\n # the user may have access to models not shown in the public\n # listing (e.g. Z.AI Pro/Max plans can use glm-5 on coding\n # endpoints even though it's not in /models). Warn but allow.\n\n # Auto-correct if the top match is very similar (e.g. typo)\n auto = get_close_matches(requested_for_lookup, api_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n\n suggestions = get_close_matches(requested, api_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n\n return {\n \"accepted\": False,\n \"persist\": False,\n \"recognized\": False,\n \"message\": (\n f\"Model `{requested}` was not found in this provider's model listing.\"\n f\"{suggestion_text}\"\n ),\n }\n\n # api_models is None — couldn't reach API. Accept and persist,\n # but warn so typos don't silently break things.\n\n # Bedrock: use our own discovery instead of HTTP /models endpoint.\n # Bedrock's bedrock-runtime URL doesn't support /models — it uses the\n # AWS SDK control plane (ListFoundationModels + ListInferenceProfiles).\n if normalized == \"bedrock\":\n try:\n from agent.bedrock_adapter import discover_bedrock_models, resolve_bedrock_region\n region = resolve_bedrock_region()\n discovered = discover_bedrock_models(region)\n discovered_ids = {m[\"id\"] for m in discovered}\n if requested in discovered_ids:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n # Not in discovered list — still accept (user may have custom\n # inference profiles or cross-account access), but warn.\n suggestions = get_close_matches(requested, list(discovered_ids), n=3, cutoff=0.4)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in Bedrock model discovery for {region}. \"\n f\"It may still work with custom inference profiles or cross-account access.\"\n f\"{suggestion_text}\"\n ),\n }\n except Exception:\n pass # Fall through to generic warning\n\n # Static-catalog fallback: when the /models probe was unreachable,\n # validate against the curated list from provider_model_ids() — same\n # pattern as the openai-codex and minimax branches above. This keeps\n # /model switches working in the gateway for providers whose /models\n # endpoint is temporarily unreachable or returns a non-JSON payload.\n # Without this block, validate_requested_model would reject every model\n # on such providers, switch_model() would return success=False, and\n # the gateway would never write to _session_model_overrides.\n provider_label = _PROVIDER_LABELS.get(normalized, normalized)\n try:\n catalog_models = provider_model_ids(normalized)\n except Exception:\n catalog_models = []\n\n if catalog_models:\n catalog_lower = {m.lower(): m for m in catalog_models}\n if requested_for_lookup.lower() in catalog_lower:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n catalog_lower_list = list(catalog_lower.keys())\n auto = get_close_matches(\n requested_for_lookup.lower(), catalog_lower_list, n=1, cutoff=0.9\n )\n if auto:\n corrected = catalog_lower[auto[0]]\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": corrected,\n \"message\": f\"Auto-corrected `{requested}` → `{corrected}`\",\n }\n suggestions = get_close_matches(\n requested_for_lookup.lower(), catalog_lower_list, n=3, cutoff=0.5\n )\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(\n f\"`{catalog_lower[s]}`\" for s in suggestions\n )\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in the {provider_label} curated catalog \"\n f\"and the /models endpoint was unreachable.{suggestion_text}\"\n f\"\\n The model may still work if it exists on the provider.\"\n ),\n }\n\n # No catalog available — accept with a warning, matching the comment's\n # stated intent (\"Accept and persist, but warn\").\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: could not reach the {provider_label} API to validate `{requested}`. \"\n f\"If the service isn't down, this model may not be valid.\"\n ),\n }\n"}, "d963d32e594812c695dcaa33618682d3d45cb484": {"t": 1785753030.2312467, "n": 148869, "h": "e43dc50fa0289253", "c": "\"\"\"\nCanonical model catalogs and lightweight validation helpers.\n\nAdd, remove, or reorder entries here — both `arcen setup` and\n`arcen` provider-selection will pick up the change automatically.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport os\nimport urllib.request\nimport urllib.error\nimport time\nfrom difflib import get_close_matches\nfrom pathlib import Path\nfrom typing import Any, NamedTuple, Optional\n\nfrom arcen_cli import __version__ as _ARCEN_VERSION\n\n# Identify ourselves so endpoints fronted by Cloudflare's Browser Integrity\n# Check (error 1010) don't reject the default ``Python-urllib/*`` signature.\n_ARCEN_USER_AGENT = f\"arcen-cli/{_ARCEN_VERSION}\"\n\nCOPILOT_BASE_URL = \"https://api.githubcopilot.com\"\nCOPILOT_MODELS_URL = f\"{COPILOT_BASE_URL}/models\"\nCOPILOT_EDITOR_VERSION = \"vscode/1.104.1\"\nCOPILOT_REASONING_EFFORTS_GPT5 = [\"minimal\", \"low\", \"medium\", \"high\"]\nCOPILOT_REASONING_EFFORTS_O_SERIES = [\"low\", \"medium\", \"high\"]\n\n\n# Fallback OpenRouter snapshot used when the live catalog is unavailable.\n# (model_id, display description shown in menus)\nOPENROUTER_MODELS: list[tuple[str, str]] = [\n # Anthropic\n (\"anthropic/claude-opus-4.8\", \"\"),\n (\"anthropic/claude-opus-4.8-fast\", \"2x price, higher output speed\"),\n (\"anthropic/claude-sonnet-4.6\", \"\"),\n (\"anthropic/claude-haiku-4.5\", \"\"),\n # OpenAI\n (\"openai/gpt-5.5\", \"\"),\n (\"openai/gpt-5.5-pro\", \"\"),\n (\"openai/gpt-5.4-mini\", \"\"),\n # Google\n (\"google/gemini-3-pro-preview\", \"\"),\n (\"google/gemini-3.1-pro-preview\", \"\"),\n (\"google/gemini-3.5-flash\", \"\"),\n # xAI\n (\"x-ai/grok-4.3\", \"\"),\n # DeepSeek\n (\"deepseek/deepseek-v4-pro\", \"\"),\n (\"deepseek/deepseek-v4-flash\", \"\"),\n # Qwen\n (\"qwen/qwen3.7-max\", \"\"),\n (\"qwen/qwen3.7-plus\", \"\"),\n (\"qwen/qwen3.6-35b-a3b\", \"\"),\n # MoonshotAI\n (\"moonshotai/kimi-k2.6\", \"recommended\"),\n # MiniMax\n (\"minimax/minimax-m3\", \"\"),\n # Z-AI\n (\"z-ai/glm-5.1\", \"\"),\n # Xiaomi\n (\"xiaomi/mimo-v2.5-pro\", \"\"),\n # Tencent\n (\"tencent/hy3-preview\", \"\"),\n # StepFun\n (\"stepfun/step-3.7-flash\", \"\"),\n # NVIDIA\n (\"nvidia/nemotron-3-super-120b-a12b\", \"\"),\n # OpenRouter routers\n (\"openrouter/pareto-code\", \"auto-routes to cheapest coder meeting openrouter.min_coding_score\"),\n # Free tier\n (\"openrouter/elephant-alpha\", \"free\"),\n (\"openrouter/owl-alpha\", \"free\"),\n (\"tencent/hy3-preview:free\", \"free\"),\n (\"nvidia/nemotron-3-super-120b-a12b:free\", \"free\"),\n (\"inclusionai/ring-2.6-1t:free\", \"free\"),\n]\n\n_openrouter_catalog_cache: list[tuple[str, str]] | None = None\n\n\n\n\ndef _codex_curated_models() -> list[str]:\n \"\"\"Derive the openai-codex curated list from codex_models.py.\n\n Single source of truth: DEFAULT_CODEX_MODELS + forward-compat synthesis.\n This keeps the gateway /model picker in sync with the CLI `arcen model`\n flow without maintaining a separate static list.\n \"\"\"\n from arcen_cli.codex_models import DEFAULT_CODEX_MODELS, _add_forward_compat_models\n return _add_forward_compat_models(list(DEFAULT_CODEX_MODELS))\n\n\n# Static fallback for xAI when the models.dev disk cache is empty (fresh\n# install, offline first run, etc.). Mirrors the xAI-direct model IDs from\n# $ARCEN_HOME/models_dev_cache.json as of 2026-04-28. Whenever xAI renames\n# or retires a model, the disk cache picks it up on the next refresh and the\n# fallback here only matters until that refresh lands.\n#\n# Models retired by xAI on May 15, 2026 are excluded — see\n# https://docs.x.ai/developers/migration/may-15-retirement\n# (grok-4, grok-4-0709, grok-4-fast{,-reasoning,-non-reasoning},\n# grok-4-1-fast{,-reasoning,-non-reasoning}, grok-code-fast-1 → grok-4.3).\n_XAI_STATIC_FALLBACK: list[str] = [\n \"grok-4.3\",\n \"grok-4.20-0309-reasoning\",\n \"grok-4.20-0309-non-reasoning\",\n \"grok-4.20-multi-agent-0309\",\n]\n\n\n_XAI_TOP_MODEL = \"grok-4.3\"\n\n\ndef _xai_promote_top(ids: list[str]) -> list[str]:\n \"\"\"Pin the headline xAI model to the top of the curated list.\"\"\"\n if _XAI_TOP_MODEL in ids:\n return [_XAI_TOP_MODEL] + [m for m in ids if m != _XAI_TOP_MODEL]\n return ids\n\n\ndef _xai_curated_models() -> list[str]:\n \"\"\"Derive the xAI-direct curated list from models.dev disk cache.\n\n Reads $ARCEN_HOME/models_dev_cache.json directly (no network) so this\n runs at import time without blocking. Falls back to ``_XAI_STATIC_FALLBACK``\n when the cache is empty or unreadable. Arcen refreshes the cache from\n https://models.dev/api.json on normal use, so this list self-heals as\n xAI renames models.\n\n Mirrors ``_codex_curated_models()``'s role for openai-codex.\n \"\"\"\n try:\n from agent.models_dev import _load_disk_cache\n data = _load_disk_cache()\n xai = data.get(\"xai\") if isinstance(data, dict) else None\n models = xai.get(\"models\") if isinstance(xai, dict) else None\n if isinstance(models, dict) and models:\n ids = [mid for mid in models.keys() if isinstance(mid, str)]\n if ids:\n return _xai_promote_top(sorted(ids))\n except Exception:\n # Any failure (missing file, malformed JSON, import error)\n # falls through to the static list.\n pass\n return list(_XAI_STATIC_FALLBACK)\n\n\n_PROVIDER_MODELS: dict[str, list[str]] = {\n # Native OpenAI Chat Completions (api.openai.com). Used by /model counts and\n # provider_model_ids fallback when /v1/models is unavailable.\n \"openai\": [\n \"gpt-5.4\",\n \"gpt-5.4-mini\",\n \"gpt-5-mini\",\n \"gpt-5.3-codex\",\n \"gpt-5.2-codex\",\n \"gpt-4.1\",\n \"gpt-4o\",\n \"gpt-4o-mini\",\n ],\n \"openai-api\": [\n \"gpt-5.5\",\n \"gpt-5.5-pro\",\n \"gpt-5.4\",\n \"gpt-5.4-mini\",\n \"gpt-5.4-nano\",\n \"gpt-5-mini\",\n \"gpt-5.3-codex\",\n \"gpt-4.1\",\n \"gpt-4o\",\n \"gpt-4o-mini\",\n ],\n \"openai-codex\": _codex_curated_models(),\n \"xai-oauth\": _xai_curated_models(),\n \"copilot-acp\": [\n \"copilot-acp\",\n ],\n \"copilot\": [\n \"gpt-5.4\",\n \"gpt-5.4-mini\",\n \"gpt-5-mini\",\n \"gpt-5.3-codex\",\n \"gpt-5.2-codex\",\n \"gpt-4.1\",\n \"gpt-4o\",\n \"gpt-4o-mini\",\n \"claude-sonnet-4.6\",\n \"claude-sonnet-4\",\n \"claude-sonnet-4.5\",\n \"claude-haiku-4.5\",\n \"gemini-3.1-pro-preview\",\n \"gemini-3-pro-preview\",\n \"gemini-3-flash-preview\",\n \"gemini-2.5-pro\",\n ],\n \"gemini\": [\n \"gemini-3.1-pro-preview\",\n \"gemini-3-pro-preview\",\n \"gemini-3.5-flash\",\n \"gemini-3.1-flash-lite-preview\",\n ],\n \"google-gemini-cli\": [\n \"gemini-3.1-pro-preview\",\n \"gemini-3-pro-preview\",\n # Code Assist serves two flash slugs with different access gates\n # (gemini-cli models.ts): gemini-3-flash-preview is the preview flash\n # that subscription/free-tier OAuth users actually reach, while\n # gemini-3.5-flash is GA-channel-gated. Offer both so non-GA users\n # aren't stuck with a slug cloudcode-pa 404s for them.\n \"gemini-3-flash-preview\",\n \"gemini-3.5-flash\",\n ],\n \"zai\": [\n \"glm-5.1\",\n \"glm-5\",\n \"glm-5v-turbo\",\n \"glm-5-turbo\",\n \"glm-4.7\",\n \"glm-4.5\",\n \"glm-4.5-flash\",\n ],\n \"xai\": _xai_curated_models(),\n \"nvidia\": [\n # NVIDIA flagship reasoning models\n \"nvidia/nemotron-3-super-120b-a12b\",\n \"nvidia/nemotron-3-nano-30b-a3b\",\n \"nvidia/llama-3.3-nemotron-super-49b-v1.5\",\n # Third-party agentic models hosted on build.nvidia.com\n # (map to OpenRouter defaults — users get familiar picks on NIM)\n \"qwen/qwen3.5-397b-a17b\",\n \"deepseek-ai/deepseek-v3.2\",\n \"moonshotai/kimi-k2.6\",\n \"minimaxai/minimax-m2.5\",\n \"z-ai/glm5\",\n \"openai/gpt-oss-120b\",\n ],\n \"kimi-coding\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"kimi-for-coding\",\n \"kimi-k2-thinking\",\n \"kimi-k2-thinking-turbo\",\n \"kimi-k2-turbo-preview\",\n \"kimi-k2-0905-preview\",\n ],\n \"kimi-coding-cn\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"kimi-k2-thinking\",\n \"kimi-k2-turbo-preview\",\n \"kimi-k2-0905-preview\",\n ],\n \"stepfun\": [\n \"step-3.5-flash\",\n \"step-3.5-flash-2603\",\n ],\n \"moonshot\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"kimi-k2-thinking\",\n \"kimi-k2-turbo-preview\",\n \"kimi-k2-0905-preview\",\n ],\n \"minimax\": [\n \"MiniMax-M3\",\n \"MiniMax-M2.7\",\n \"MiniMax-M2.5\",\n \"MiniMax-M2.1\",\n \"MiniMax-M2\",\n ],\n \"minimax-oauth\": [\n \"MiniMax-M3\",\n \"MiniMax-M2.7\",\n \"MiniMax-M2.7-highspeed\",\n ],\n \"minimax-cn\": [\n \"MiniMax-M3\",\n \"MiniMax-M2.7\",\n \"MiniMax-M2.5\",\n \"MiniMax-M2.1\",\n \"MiniMax-M2\",\n ],\n \"anthropic\": [\n \"claude-opus-4-8\",\n \"claude-opus-4-7\",\n \"claude-opus-4-6\",\n \"claude-sonnet-4-6\",\n \"claude-opus-4-5-20251101\",\n \"claude-sonnet-4-5-20250929\",\n \"claude-opus-4-20250514\",\n \"claude-sonnet-4-20250514\",\n \"claude-haiku-4-5-20251001\",\n ],\n \"deepseek\": [\n \"deepseek-v4-pro\",\n \"deepseek-v4-flash\",\n \"deepseek-chat\",\n \"deepseek-reasoner\",\n ],\n \"xiaomi\": [\n \"mimo-v2.5-pro\",\n \"mimo-v2.5\",\n \"mimo-v2-pro\",\n \"mimo-v2-omni\",\n \"mimo-v2-flash\",\n ],\n \"tencent-tokenhub\": [\n \"hy3-preview\",\n ],\n \"arcee\": [\n \"trinity-large-thinking\",\n \"trinity-large-preview\",\n \"trinity-mini\",\n ],\n \"gmi\": [\n \"zai-org/GLM-5.1-FP8\",\n \"deepseek-ai/DeepSeek-V3.2\",\n \"moonshotai/Kimi-K2.5\",\n \"google/gemini-3.1-flash-lite-preview\",\n \"anthropic/claude-sonnet-4.6\",\n \"openai/gpt-5.4\",\n ],\n \"opencode-zen\": [\n \"kimi-k2.5\",\n \"gpt-5.4-pro\",\n \"gpt-5.4\",\n \"gpt-5.3-codex\",\n \"gpt-5.2\",\n \"gpt-5.2-codex\",\n \"gpt-5.1\",\n \"gpt-5.1-codex\",\n \"gpt-5.1-codex-max\",\n \"gpt-5.1-codex-mini\",\n \"gpt-5\",\n \"gpt-5-codex\",\n \"gpt-5-nano\",\n \"claude-opus-4-6\",\n \"claude-opus-4-5\",\n \"claude-opus-4-1\",\n \"claude-sonnet-4-6\",\n \"claude-sonnet-4-5\",\n \"claude-sonnet-4\",\n \"claude-haiku-4-5\",\n \"claude-3-5-haiku\",\n \"gemini-3.1-pro\",\n \"gemini-3-pro\",\n \"gemini-3-flash\",\n \"minimax-m2.7\",\n \"minimax-m2.5\",\n \"minimax-m2.5-free\",\n \"minimax-m2.1\",\n \"glm-5\",\n \"glm-4.7\",\n \"glm-4.6\",\n \"kimi-k2-thinking\",\n \"kimi-k2\",\n \"qwen3-coder\",\n \"big-pickle\",\n ],\n \"opencode-go\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"glm-5.1\",\n \"glm-5\",\n \"mimo-v2.5-pro\",\n \"mimo-v2.5\",\n \"mimo-v2-pro\",\n \"mimo-v2-omni\",\n \"minimax-m2.7\",\n \"minimax-m2.5\",\n \"qwen3.7-max\",\n \"qwen3.6-plus\",\n \"qwen3.5-plus\",\n ],\n \"kilocode\": [\n \"anthropic/claude-opus-4.6\",\n \"anthropic/claude-sonnet-4.6\",\n \"openai/gpt-5.4\",\n \"google/gemini-3-pro-preview\",\n \"google/gemini-3-flash-preview\",\n ],\n # Alibaba DashScope Coding platform (coding-intl) — default endpoint.\n # Supports Qwen models + third-party providers (GLM, Kimi, MiniMax).\n # Users with classic DashScope keys should override DASHSCOPE_BASE_URL\n # to https://dashscope-intl.aliyuncs.com/compatible-mode/v1 (OpenAI-compat)\n # or https://dashscope-intl.aliyuncs.com/apps/anthropic (Anthropic-compat).\n \"alibaba\": [\n \"qwen3.7-max\",\n \"qwen3.6-plus\",\n \"kimi-k2.5\",\n \"qwen3.5-plus\",\n \"qwen3-coder-plus\",\n \"qwen3-coder-next\",\n # Third-party models available on coding-intl\n \"glm-5\",\n \"glm-4.7\",\n \"MiniMax-M2.5\",\n ],\n # Alibaba Coding Plan — same platform as alibaba (DashScope coding-intl),\n # separate provider ID with its own base_url_env_var.\n \"alibaba-coding-plan\": [\n \"qwen3.7-max\",\n \"qwen3.6-plus\",\n \"qwen3.5-plus\",\n \"qwen3-coder-plus\",\n \"qwen3-coder-next\",\n \"kimi-k2.5\",\n \"glm-5\",\n \"glm-4.7\",\n \"MiniMax-M2.5\",\n ],\n # Curated HF model list — only agentic models that map to OpenRouter defaults.\n \"huggingface\": [\n \"moonshotai/Kimi-K2.5\",\n \"Qwen/Qwen3.5-397B-A17B\",\n \"Qwen/Qwen3.5-35B-A3B\",\n \"deepseek-ai/DeepSeek-V3.2\",\n \"MiniMaxAI/MiniMax-M2.5\",\n \"zai-org/GLM-5\",\n \"XiaomiMiMo/MiMo-V2-Flash\",\n \"moonshotai/Kimi-K2-Thinking\",\n \"moonshotai/Kimi-K2.6\",\n ],\n # AWS Bedrock — static fallback list used when dynamic discovery is\n # unavailable (no boto3, no credentials, or API error). The agent\n # prefers live discovery via ListFoundationModels + ListInferenceProfiles.\n # Use inference profile IDs (us.*) since most models require them.\n \"bedrock\": [\n \"us.anthropic.claude-sonnet-4-6\",\n \"us.anthropic.claude-opus-4-6-v1\",\n \"us.anthropic.claude-haiku-4-5-20251001-v1:0\",\n \"us.anthropic.claude-sonnet-4-5-20250929-v1:0\",\n \"us.amazon.nova-pro-v1:0\",\n \"us.amazon.nova-lite-v1:0\",\n \"us.amazon.nova-micro-v1:0\",\n \"deepseek.v3.2\",\n \"us.meta.llama4-maverick-17b-instruct-v1:0\",\n \"us.meta.llama4-scout-17b-instruct-v1:0\",\n ],\n # Azure Foundry: user-provided endpoint and model.\n # Empty list because models depend on the endpoint configuration.\n \"azure-foundry\": [],\n \"novita\": [\n \"moonshotai/kimi-k2.5\",\n \"minimax/minimax-m2.7\",\n \"zai-org/glm-5\",\n \"deepseek/deepseek-v3-0324\",\n \"deepseek/deepseek-r1-0528\",\n \"qwen/qwen3-235b-a22b-fp8\",\n ],\n}\n\n# ---------------------------------------------------------------------------\n# Removed provider Portal free-model helper\n# ---------------------------------------------------------------------------\n# The Removed provider Portal models endpoint is the source of truth for which models\n# are currently offered (free or paid). We trust whatever it returns and\n# surface it to users as-is — no local allowlist filtering.\n\n\ndef _is_model_free(model_id: str, pricing: dict[str, dict[str, str]]) -> bool:\n \"\"\"Return True if *model_id* has zero-cost prompt AND completion pricing.\"\"\"\n p = pricing.get(model_id)\n if not p:\n return False\n try:\n return float(p.get(\"prompt\", \"1\")) == 0 and float(p.get(\"completion\", \"1\")) == 0\n except (TypeError, ValueError):\n return False\n\n\n# ---------------------------------------------------------------------------\n# Removed provider Portal account tier detection\n# ---------------------------------------------------------------------------\ndef is_removed_provider_free_tier(account_info: dict[str, Any]) -> bool:\n \"\"\"Return True if the account info indicates a free (unpaid) tier.\n\n Prefer the Portal's explicit ``paid_service_access.allowed`` entitlement\n decision. Legacy payloads fall back to ``subscription.monthly_charge == 0``.\n Returns False when both signals are missing or unparseable.\n \"\"\"\n paid_access = account_info.get(\"paid_service_access\")\n if isinstance(paid_access, dict):\n allowed = paid_access.get(\"allowed\")\n if isinstance(allowed, bool):\n return not allowed\n paid = paid_access.get(\"paid_access\")\n if isinstance(paid, bool):\n return not paid\n\n sub = account_info.get(\"subscription\")\n if not isinstance(sub, dict):\n return False\n charge = sub.get(\"monthly_charge\")\n if charge is None:\n return False\n try:\n return float(charge) == 0\n except (TypeError, ValueError):\n return False\n\n\ndef partition_removed_provider_models_by_tier(\n model_ids: list[str],\n pricing: dict[str, dict[str, str]],\n free_tier: bool,\n) -> tuple[list[str], list[str]]:\n \"\"\"Split Removed provider models into (selectable, unavailable) based on user tier.\n\n For paid-tier users: all models are selectable, none unavailable.\n\n For free-tier users: only free models are selectable; paid models\n are returned as unavailable (shown grayed out in the menu).\n \"\"\"\n if not free_tier:\n return (model_ids, [])\n\n if not pricing:\n return (model_ids, []) # can't determine, show everything\n\n selectable: list[str] = []\n unavailable: list[str] = []\n for mid in model_ids:\n if _is_model_free(mid, pricing):\n selectable.append(mid)\n else:\n unavailable.append(mid)\n return (selectable, unavailable)\n\n\ndef union_with_portal_free_recommendations(\n curated_ids: list[str],\n pricing: dict[str, dict[str, str]],\n portal_base_url: str = \"\",\n *,\n force_refresh: bool = False,\n) -> tuple[list[str], dict[str, dict[str, str]]]:\n \"\"\"Augment curated list + pricing with the Portal's ``freeRecommendedModels``.\n\n The Portal's ``/api/removed_provider/recommended-models`` endpoint advertises which\n models are free *right now* — independent of what the in-repo\n ``_PROVIDER_MODELS[\"removed_provider\"]`` list happens to contain or whether the\n docs-hosted catalog manifest has been rebuilt since the last release.\n\n For free-tier users this is the source of truth: any model the Portal\n flags as free should be selectable, even if the user is running an\n older Arcen that doesn't ship that model in its hardcoded curated\n list. This function returns an augmented ``(model_ids, pricing)``\n pair where:\n\n * Portal free recommendations missing from ``curated_ids`` are\n appended after the curated list (so the in-repo curated models\n show first and Portal-only picks follow).\n * ``pricing`` gets a synthetic ``{\"prompt\": \"0\", \"completion\": \"0\"}``\n entry for any free recommendation missing from the live pricing\n map, so :func:`partition_removed_provider_models_by_tier` keeps it.\n\n Failures (network, parse, missing field) are silent and degrade to\n returning the inputs unchanged.\n \"\"\"\n try:\n payload = fetch_removed_provider_recommended_models(\n portal_base_url, force_refresh=force_refresh\n )\n except Exception:\n return (list(curated_ids), dict(pricing))\n\n free_block = payload.get(\"freeRecommendedModels\") if isinstance(payload, dict) else None\n if not isinstance(free_block, list) or not free_block:\n return (list(curated_ids), dict(pricing))\n\n portal_free_ids: list[str] = []\n for entry in free_block:\n name = _extract_model_name(entry)\n if name:\n portal_free_ids.append(name)\n if not portal_free_ids:\n return (list(curated_ids), dict(pricing))\n\n augmented_pricing = dict(pricing)\n free_synthetic = {\"prompt\": \"0\", \"completion\": \"0\"}\n for mid in portal_free_ids:\n if mid not in augmented_pricing:\n augmented_pricing[mid] = dict(free_synthetic)\n\n augmented_ids = list(curated_ids)\n seen = set(augmented_ids)\n # Append Portal free recommendations that aren't already curated, so the\n # in-repo curated (\"HA\") models show first and Portal-only picks follow.\n new_ones = [mid for mid in portal_free_ids if mid not in seen]\n if new_ones:\n augmented_ids = augmented_ids + new_ones\n\n return (augmented_ids, augmented_pricing)\n\n\ndef union_with_portal_paid_recommendations(\n curated_ids: list[str],\n pricing: dict[str, dict[str, str]],\n portal_base_url: str = \"\",\n *,\n force_refresh: bool = False,\n) -> tuple[list[str], dict[str, dict[str, str]]]:\n \"\"\"Augment curated list with the Portal's ``paidRecommendedModels``.\n\n Mirror of :func:`union_with_portal_free_recommendations` for paid-tier\n users. The Portal's ``/api/removed_provider/recommended-models`` endpoint advertises\n which paid models are blessed *right now* — independent of what the\n in-repo ``_PROVIDER_MODELS[\"removed_provider\"]`` list happens to contain or whether\n the docs-hosted catalog manifest has been rebuilt since the last release.\n\n For paid-tier users this lets newly-launched paid models surface in the\n picker even if the user is running an older Arcen that doesn't ship\n them in its hardcoded curated list. This function returns an augmented\n ``(model_ids, pricing)`` pair where:\n\n * Portal paid recommendations missing from ``curated_ids`` are\n appended after the curated list (so the in-repo curated models\n show first and Portal-only picks follow).\n * ``pricing`` is left untouched — we deliberately do NOT synthesize\n pricing entries for paid models. Live pricing is fetched separately\n via :func:`get_pricing_for_provider`; if the live endpoint hasn't\n published pricing yet, the picker shows a blank price column rather\n than fabricating numbers. (The free helper synthesizes ``$0`` so\n :func:`partition_removed_provider_models_by_tier` keeps free models selectable;\n no equivalent gating applies on the paid side, so synthesis would\n only mislead the user.)\n\n Failures (network, parse, missing field) are silent and degrade to\n returning the inputs unchanged — never block the picker on a\n Portal-side hiccup.\n \"\"\"\n try:\n payload = fetch_removed_provider_recommended_models(\n portal_base_url, force_refresh=force_refresh\n )\n except Exception:\n return (list(curated_ids), dict(pricing))\n\n paid_block = payload.get(\"paidRecommendedModels\") if isinstance(payload, dict) else None\n if not isinstance(paid_block, list) or not paid_block:\n return (list(curated_ids), dict(pricing))\n\n portal_paid_ids: list[str] = []\n for entry in paid_block:\n name = _extract_model_name(entry)\n if name:\n portal_paid_ids.append(name)\n if not portal_paid_ids:\n return (list(curated_ids), dict(pricing))\n\n augmented_ids = list(curated_ids)\n seen = set(augmented_ids)\n # Append Portal paid recommendations that aren't already curated, so the\n # in-repo curated (\"HA\") models show first and Portal-only picks follow.\n new_ones = [mid for mid in portal_paid_ids if mid not in seen]\n if new_ones:\n augmented_ids = augmented_ids + new_ones\n\n return (augmented_ids, dict(pricing))\n\n\n# ---------------------------------------------------------------------------\n# TTL cache for free-tier detection — avoids repeated API calls within a\n# session while still picking up upgrades quickly.\n# ---------------------------------------------------------------------------\n_FREE_TIER_CACHE_TTL: int = 180 # seconds (3 minutes)\n_free_tier_cache: tuple[bool, float] | None = None # (result, timestamp)\n\n\ndef check_removed_provider_free_tier(*, force_fresh: bool = False) -> bool:\n \"\"\"Check if the current Removed provider Portal user is on a free (unpaid) tier.\n\n Results are cached for ``_FREE_TIER_CACHE_TTL`` seconds to avoid\n hitting the Portal API on every call. The cache is short-lived so\n that an account upgrade is reflected within a few minutes.\n\n Returns True only when entitlement is known to be free. Unknown/error\n states return False so this compatibility wrapper does not block users.\n \"\"\"\n global _free_tier_cache\n now = time.monotonic()\n if not force_fresh and _free_tier_cache is not None:\n cached_result, cached_at = _free_tier_cache\n if now - cached_at < _FREE_TIER_CACHE_TTL:\n return cached_result\n\n try:\n from arcen_cli.removed_provider_account import get_removed_provider_portal_account_info\n\n account_info = get_removed_provider_portal_account_info(force_fresh=force_fresh)\n result = account_info.is_free_tier\n _free_tier_cache = (result, now)\n return result\n except Exception:\n _free_tier_cache = (False, now)\n return False # default to paid on error — don't block users\n\n\n# ---------------------------------------------------------------------------\n# Removed provider Portal recommended models\n#\n# The Portal publishes a curated list of suggested models (separated into\n# paid and free tiers) plus dedicated recommendations for compaction (text\n# summarisation / auxiliary) and vision tasks. We fetch it once per process\n# with a TTL cache so callers can ask \"what's the best aux model right now?\"\n# without hitting the network on every lookup.\n#\n# Shape of the response (fields we care about):\n# {\n# \"paidRecommendedModels\": [ {modelName, ...}, ... ],\n# \"freeRecommendedModels\": [ {modelName, ...}, ... ],\n# \"paidRecommendedCompactionModel\": {modelName, ...} | null,\n# \"paidRecommendedVisionModel\": {modelName, ...} | null,\n# \"freeRecommendedCompactionModel\": {modelName, ...} | null,\n# \"freeRecommendedVisionModel\": {modelName, ...} | null,\n# }\n# ---------------------------------------------------------------------------\n\nREMOVED_PROVIDER_RECOMMENDED_MODELS_PATH = \"/api/removed_provider/recommended-models\"\n_REMOVED_PROVIDER_RECOMMENDED_CACHE_TTL: int = 600 # seconds (10 minutes)\n# (result_dict, timestamp) keyed by portal_base_url so staging vs prod don't collide.\n_removed_provider_recommended_cache: dict[str, tuple[dict[str, Any], float]] = {}\n\n\ndef fetch_removed_provider_recommended_models(\n portal_base_url: str = \"\",\n timeout: float = 5.0,\n *,\n force_refresh: bool = False,\n) -> dict[str, Any]:\n \"\"\"Fetch the Removed provider Portal's curated recommended-models payload.\n\n Hits ``<portal>/api/removed_provider/recommended-models``. The endpoint is public —\n no auth is required. Results are cached per portal URL for\n ``_REMOVED_PROVIDER_RECOMMENDED_CACHE_TTL`` seconds; pass ``force_refresh=True`` to\n bypass the cache.\n\n Returns the parsed JSON dict on success, or ``{}`` on any failure\n (network, parse, non-2xx). Callers must treat missing/null fields as\n \"no recommendation\" and fall back to their own default.\n \"\"\"\n base = (portal_base_url or \"https://\").rstrip(\"/\")\n now = time.monotonic()\n cached = _removed_provider_recommended_cache.get(base)\n if not force_refresh and cached is not None:\n payload, cached_at = cached\n if now - cached_at < _REMOVED_PROVIDER_RECOMMENDED_CACHE_TTL:\n return payload\n\n url = f\"{base}{REMOVED_PROVIDER_RECOMMENDED_MODELS_PATH}\"\n try:\n req = urllib.request.Request(\n url,\n headers={\"Accept\": \"application/json\"},\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n data = json.loads(resp.read().decode())\n if not isinstance(data, dict):\n data = {}\n except Exception:\n data = {}\n\n _removed_provider_recommended_cache[base] = (data, now)\n return data\n\n\ndef _resolve_removed_provider_portal_url() -> str:\n \"\"\"Best-effort lookup of the Portal base URL the user is authed against.\"\"\"\n try:\n from arcen_cli.auth import (\n DEFAULT_REMOVED_PROVIDER_PORTAL_URL,\n get_provider_auth_state,\n )\n state = get_provider_auth_state(\"removed_provider\") or {}\n portal = str(state.get(\"portal_base_url\") or \"\").strip()\n if portal:\n return portal.rstrip(\"/\")\n return str(DEFAULT_REMOVED_PROVIDER_PORTAL_URL).rstrip(\"/\")\n except Exception:\n return \"https://\"\n\n\ndef _extract_model_name(entry: Any) -> Optional[str]:\n \"\"\"Pull the ``modelName`` field from a recommended-model entry, else None.\"\"\"\n if not isinstance(entry, dict):\n return None\n model_name = entry.get(\"modelName\")\n if isinstance(model_name, str) and model_name.strip():\n return model_name.strip()\n return None\n\n\ndef get_removed_provider_recommended_aux_model(\n *,\n vision: bool = False,\n free_tier: Optional[bool] = None,\n portal_base_url: str = \"\",\n force_refresh: bool = False,\n) -> Optional[str]:\n \"\"\"Return the Portal's recommended model name for an auxiliary task.\n\n Picks the best field from the Portal's recommended-models payload:\n\n * ``vision=True`` → ``paidRecommendedVisionModel`` (paid tier) or\n ``freeRecommendedVisionModel`` (free tier)\n * ``vision=False`` → ``paidRecommendedCompactionModel`` or\n ``freeRecommendedCompactionModel``\n\n When ``free_tier`` is ``None`` (default) the user's tier is auto-detected\n via :func:`check_removed_provider_free_tier`. Pass an explicit bool to bypass the\n detection — useful for tests or when the caller already knows the tier.\n\n For paid-tier users we prefer the paid recommendation but gracefully fall\n back to the free recommendation if the Portal returned ``null`` for the\n paid field (common during the staged rollout of new paid models).\n\n Returns ``None`` when every candidate is missing, null, or the fetch\n fails — callers should fall back to their own default (currently\n ``google/gemini-3-flash-preview``).\n \"\"\"\n base = portal_base_url or _resolve_removed_provider_portal_url()\n payload = fetch_removed_provider_recommended_models(base, force_refresh=force_refresh)\n if not payload:\n return None\n\n if free_tier is None:\n try:\n free_tier = check_removed_provider_free_tier()\n except Exception:\n # On any detection error, assume paid — paid users see both fields\n # anyway so this is a safe default that maximises model quality.\n free_tier = False\n\n if vision:\n paid_key, free_key = \"paidRecommendedVisionModel\", \"freeRecommendedVisionModel\"\n else:\n paid_key, free_key = \"paidRecommendedCompactionModel\", \"freeRecommendedCompactionModel\"\n\n # Preference order:\n # free tier → free only\n # paid tier → paid, then free (if paid field is null)\n candidates = [free_key] if free_tier else [paid_key, free_key]\n for key in candidates:\n name = _extract_model_name(payload.get(key))\n if name:\n return name\n return None\n\n\n# ---------------------------------------------------------------------------\n# Canonical provider list — single source of truth for provider identity.\n# Every code path that lists, displays, or iterates providers derives from\n# this list: arcen model, /model, list_authenticated_providers.\n#\n# Fields:\n# slug — internal provider ID (used in config.yaml, --provider flag)\n# label — short display name\n# tui_desc — longer description for the `arcen model` interactive picker\n# ---------------------------------------------------------------------------\n\nclass ProviderEntry(NamedTuple):\n slug: str\n label: str\n tui_desc: str # detailed description for `arcen model` TUI\n\nCANONICAL_PROVIDERS: list[ProviderEntry] = [\n ProviderEntry(\"openrouter\", \"OpenRouter\", \"OpenRouter (Pay-per-use API aggregator)\"),\n ProviderEntry(\"novita\", \"NovitaAI\", \"NovitaAI (Cloud: Model API, Agent Sandbox, GPU Cloud)\"),\n ProviderEntry(\"lmstudio\", \"LM Studio\", \"LM Studio (Local desktop app with built-in model server)\"),\n ProviderEntry(\"anthropic\", \"Anthropic\", \"Anthropic (Claude models via API key or Claude Code)\"),\n ProviderEntry(\"openai-codex\", \"OpenAI Codex\", \"OpenAI Codex (Codex CLI via ChatGPT subscription or API key)\"),\n ProviderEntry(\"openai-api\", \"OpenAI API\", \"OpenAI API (api.openai.com, API key)\"),\n ProviderEntry(\"alibaba\", \"Qwen Cloud\", \"Qwen Cloud / DashScope (Qwen + multi-provider)\"),\n ProviderEntry(\"xai-oauth\", \"xAI Grok OAuth (SuperGrok / Premium+)\", \"xAI Grok OAuth (SuperGrok / Premium+ subscription)\"),\n ProviderEntry(\"xiaomi\", \"Xiaomi MiMo\", \"Xiaomi MiMo (MiMo-V2.5 and V2 models: pro, omni, flash)\"),\n ProviderEntry(\"tencent-tokenhub\", \"Tencent TokenHub\", \"Tencent TokenHub (Hy3 Preview via tokenhub.tencentmaas.com)\"),\n ProviderEntry(\"nvidia\", \"NVIDIA NIM\", \"NVIDIA NIM (Nemotron models via build.nvidia.com or local NIM)\"),\n ProviderEntry(\"copilot\", \"GitHub Copilot\", \"GitHub Copilot (Uses GITHUB_TOKEN or gh auth token)\"),\n ProviderEntry(\"copilot-acp\", \"GitHub Copilot ACP\", \"GitHub Copilot ACP (Spawns copilot --acp --stdio)\"),\n ProviderEntry(\"huggingface\", \"Hugging Face\", \"Hugging Face Inference Providers\"),\n ProviderEntry(\"gemini\", \"Google AI Studio\", \"Google AI Studio (Native Gemini API)\"),\n ProviderEntry(\"google-gemini-cli\", \"Google Gemini (OAuth)\", \"Google Gemini via OAuth + Code Assist (Code Assist OAuth flow)\"),\n ProviderEntry(\"deepseek\", \"DeepSeek\", \"DeepSeek (V3, R1, coder, direct API)\"),\n ProviderEntry(\"xai\", \"xAI\", \"xAI Grok (Direct API)\"),\n ProviderEntry(\"zai\", \"Z.AI / GLM\", \"Z.AI / GLM (Zhipu direct API)\"),\n ProviderEntry(\"kimi-coding\", \"Kimi / Kimi Coding Plan\", \"Kimi Coding Plan (api.kimi.com & Moonshot API)\"),\n ProviderEntry(\"kimi-coding-cn\", \"Kimi / Moonshot (China)\", \"Kimi / Moonshot China (Domestic direct API)\"),\n ProviderEntry(\"stepfun\", \"StepFun Step Plan\", \"StepFun Step Plan (Agent / coding models via Step Plan API)\"),\n ProviderEntry(\"minimax\", \"MiniMax\", \"MiniMax (Global direct API)\"),\n ProviderEntry(\"minimax-oauth\", \"MiniMax (OAuth)\", \"MiniMax via OAuth browser login (Coding Plan, minimax.io)\"),\n ProviderEntry(\"minimax-cn\", \"MiniMax (China)\", \"MiniMax China (Domestic direct API)\"),\n ProviderEntry(\"ollama-cloud\", \"Ollama Cloud\", \"Ollama Cloud (Cloud-hosted open models, ollama.com)\"),\n ProviderEntry(\"arcee\", \"Arcee AI\", \"Arcee AI (Trinity models, direct API)\"),\n ProviderEntry(\"gmi\", \"GMI Cloud\", \"GMI Cloud (Multi-model direct API)\"),\n ProviderEntry(\"kilocode\", \"Kilo Code\", \"Kilo Code (Kilo Gateway API)\"),\n ProviderEntry(\"opencode-zen\", \"OpenCode Zen\", \"OpenCode Zen (Curated models, pay-as-you-go)\"),\n ProviderEntry(\"opencode-go\", \"OpenCode Go\", \"OpenCode Go (Open models subscription)\"),\n ProviderEntry(\"bedrock\", \"AWS Bedrock\", \"AWS Bedrock (Claude, Nova, Llama, DeepSeek; IAM or API key)\"),\n ProviderEntry(\"azure-foundry\", \"Azure Foundry\", \"Azure Foundry (OpenAI-style or Anthropic-style endpoint, your Azure AI deployment)\"),\n ProviderEntry(\"qwen-oauth\", \"Qwen OAuth (Portal)\", \"Qwen OAuth (Reuses local Qwen CLI login)\"),\n]\n\n# Auto-extend CANONICAL_PROVIDERS with any provider registered in providers/\n# that is not already in the list above. Adding plugins/model-providers/<name>/\n# is sufficient to expose a new provider in the model picker, /model, and all\n# downstream consumers — no edits to this file needed.\n_canonical_slugs = {p.slug for p in CANONICAL_PROVIDERS}\ntry:\n from providers import list_providers as _list_providers_for_canonical\n for _pp in _list_providers_for_canonical():\n if _pp.name in _canonical_slugs:\n continue\n if _pp.auth_type in {\"oauth_device_code\", \"oauth_external\", \"external_process\", \"aws_sdk\", \"copilot\"}:\n continue # non-api-key flows need bespoke picker UX; skip auto-inject\n _label = _pp.display_name or _pp.name\n _desc = _pp.description or f\"{_label} (direct API)\"\n CANONICAL_PROVIDERS.append(ProviderEntry(_pp.name, _label, _desc))\n _canonical_slugs.add(_pp.name)\nexcept Exception:\n pass\n\n# Derived dicts — used throughout the codebase\n_PROVIDER_LABELS = {p.slug: p.label for p in CANONICAL_PROVIDERS}\n_PROVIDER_LABELS[\"custom\"] = \"Custom endpoint\" # special case: not a named provider\n\n\n# ---------------------------------------------------------------------------\n# Provider groups — DISPLAY ONLY\n#\n# Some vendors expose several Arcen provider slugs (one per endpoint /\n# auth method: global API, China API, OAuth coding plan, ...). Listing every\n# slug as a top-level row in the interactive `arcen model` / setup wizard /\n# Telegram `/model` pickers makes that list long and noisy.\n#\n# These groups fold related slugs under one top-level row in INTERACTIVE\n# PICKERS only. They do NOT change ``CANONICAL_PROVIDERS``, slug identity,\n# the ``--provider`` flag, ``/model <provider:model>``, or any typed path —\n# every member slug remains individually addressable. Grouping is a pure\n# display affordance; ``group_providers()`` is the single fold used by all\n# three picker surfaces so they stay consistent.\n#\n# group_id -> (display_label, group_description, [member_slug, ...])\n#\n# ``group_description`` is a short blurb shown on the collapsed top-level group\n# row in the interactive pickers (alongside the label). Member-specific detail\n# lives in each member's ``tui_desc`` and shows in the drill-down sub-picker.\n# Member order is the order shown inside the group submenu.\n# ---------------------------------------------------------------------------\nPROVIDER_GROUPS: dict[str, tuple[str, str, list[str]]] = {\n \"kimi\": (\"Kimi / Moonshot\", \"Coding Plan, Moonshot global & China endpoints\", [\"kimi-coding\", \"kimi-coding-cn\"]),\n \"minimax\": (\"MiniMax\", \"Global, OAuth Coding Plan & China endpoints\", [\"minimax\", \"minimax-oauth\", \"minimax-cn\"]),\n \"xai\": (\"xAI Grok\", \"Direct API or SuperGrok / Premium+ OAuth\", [\"xai\", \"xai-oauth\"]),\n \"google\": (\"Google Gemini\", \"AI Studio API or OAuth + Code Assist\", [\"gemini\", \"google-gemini-cli\"]),\n \"openai\": (\"OpenAI\", \"Codex CLI or direct OpenAI API\", [\"openai-codex\", \"openai-api\"]),\n \"opencode\": (\"OpenCode\", \"Zen pay-as-you-go or Go subscription\", [\"opencode-zen\", \"opencode-go\"]),\n \"copilot\": (\"GitHub Copilot\", \"GitHub token API or copilot --acp process\", [\"copilot\", \"copilot-acp\"]),\n}\n\n# Reverse index: member slug -> group_id. Built once at import.\n_SLUG_TO_GROUP: dict[str, str] = {\n slug: gid for gid, (_label, _desc, members) in PROVIDER_GROUPS.items() for slug in members\n}\n\n\ndef provider_group_for_slug(slug: str) -> str:\n \"\"\"Return the group_id a provider slug belongs to, or \"\" if ungrouped.\"\"\"\n return _SLUG_TO_GROUP.get(str(slug or \"\").strip().lower(), \"\")\n\n\ndef group_providers(slugs):\n \"\"\"Fold a flat ordered slug iterable into picker rows by provider group.\n\n DISPLAY ONLY. Used by every interactive picker (``arcen model``, the\n setup wizard, the Telegram ``/model`` keyboard) so grouping is identical\n across surfaces.\n\n Each returned row is a dict::\n\n {\"kind\": \"single\", \"slug\": <slug>} # ungrouped, or\n # 1-member group\n {\"kind\": \"group\", \"group_id\": <gid>, \"label\": <label>,\n \"description\": <desc>, \"members\": [<slug>, ...]} # 2+ members\n\n Rules:\n * A group row appears at the position of its FIRST present member, in\n the input order. Subsequent members fold into that row (and are not\n emitted again).\n * Member order inside a group follows ``PROVIDER_GROUPS`` declaration,\n restricted to the members actually present in ``slugs``.\n * A group reduced to a single present member degrades to a ``single``\n row — no pointless one-item submenu.\n * Slugs not in any group pass through as ``single`` rows, order\n preserved.\n * Duplicate slugs in the input are ignored after first sight.\n \"\"\"\n seen: set[str] = set()\n # Which present members each group has, in declaration order.\n group_members: dict[str, list[str]] = {}\n for gid, (_label, _desc, members) in PROVIDER_GROUPS.items():\n present = [m for m in members if m in set(slugs)]\n if present:\n group_members[gid] = present\n\n rows = []\n emitted_groups: set[str] = set()\n for slug in slugs:\n s = str(slug or \"\").strip().lower()\n if not s or s in seen:\n continue\n seen.add(s)\n gid = _SLUG_TO_GROUP.get(s, \"\")\n if not gid:\n rows.append({\"kind\": \"single\", \"slug\": s})\n continue\n if gid in emitted_groups:\n continue # already folded at the first member's position\n emitted_groups.add(gid)\n members = group_members.get(gid, [s])\n if len(members) <= 1:\n rows.append({\"kind\": \"single\", \"slug\": members[0]})\n else:\n label, desc, _ = PROVIDER_GROUPS[gid]\n rows.append(\n {\"kind\": \"group\", \"group_id\": gid, \"label\": label,\n \"description\": desc, \"members\": list(members)}\n )\n return rows\n\n\n_PROVIDER_ALIASES = {\n \"glm\": \"zai\",\n \"z-ai\": \"zai\",\n \"z.ai\": \"zai\",\n \"zhipu\": \"zai\",\n \"github\": \"copilot\",\n \"github-copilot\": \"copilot\",\n \"github-models\": \"copilot\",\n \"github-model\": \"copilot\",\n \"github-copilot-acp\": \"copilot-acp\",\n \"copilot-acp-agent\": \"copilot-acp\",\n \"google\": \"gemini\",\n \"google-gemini\": \"gemini\",\n \"google-ai-studio\": \"gemini\",\n \"kimi\": \"kimi-coding\",\n \"moonshot\": \"kimi-coding\",\n \"kimi-cn\": \"kimi-coding-cn\",\n \"moonshot-cn\": \"kimi-coding-cn\",\n \"step\": \"stepfun\",\n \"stepfun-coding-plan\": \"stepfun\",\n \"arcee-ai\": \"arcee\",\n \"arceeai\": \"arcee\",\n \"gmi-cloud\": \"gmi\",\n \"gmicloud\": \"gmi\",\n \"minimax-china\": \"minimax-cn\",\n \"minimax_cn\": \"minimax-cn\",\n \"minimax-portal\": \"minimax-oauth\",\n \"minimax-global\": \"minimax-oauth\",\n \"minimax_oauth\": \"minimax-oauth\",\n \"claude\": \"anthropic\",\n \"claude-code\": \"anthropic\",\n \"deep-seek\": \"deepseek\",\n \"opencode\": \"opencode-zen\",\n \"zen\": \"opencode-zen\",\n \"go\": \"opencode-go\",\n \"opencode-go-sub\": \"opencode-go\",\n \"kilo\": \"kilocode\",\n \"kilo-code\": \"kilocode\",\n \"kilo-gateway\": \"kilocode\",\n \"dashscope\": \"alibaba\",\n \"aliyun\": \"alibaba\",\n \"qwen\": \"alibaba\",\n \"alibaba-cloud\": \"alibaba\",\n \"qwen-portal\": \"qwen-oauth\",\n \"gemini-cli\": \"google-gemini-cli\",\n \"gemini-oauth\": \"google-gemini-cli\",\n \"hf\": \"huggingface\",\n \"hugging-face\": \"huggingface\",\n \"huggingface-hub\": \"huggingface\",\n \"novita-ai\": \"novita\",\n \"novitaai\": \"novita\",\n \"mimo\": \"xiaomi\",\n \"xiaomi-mimo\": \"xiaomi\",\n \"tencent\": \"tencent-tokenhub\",\n \"tokenhub\": \"tencent-tokenhub\",\n \"tencent-cloud\": \"tencent-tokenhub\",\n \"tencentmaas\": \"tencent-tokenhub\",\n \"aws\": \"bedrock\",\n \"aws-bedrock\": \"bedrock\",\n \"amazon-bedrock\": \"bedrock\",\n \"amazon\": \"bedrock\",\n \"grok\": \"xai\",\n \"grok-oauth\": \"xai-oauth\",\n \"xai-oauth\": \"xai-oauth\",\n \"x-ai-oauth\": \"xai-oauth\",\n \"xai-grok-oauth\": \"xai-oauth\",\n \"x-ai\": \"xai\",\n \"x.ai\": \"xai\",\n \"nim\": \"nvidia\",\n \"nvidia-nim\": \"nvidia\",\n \"build-nvidia\": \"nvidia\",\n \"nemotron\": \"nvidia\",\n \"lmstudio\": \"lmstudio\",\n \"lm-studio\": \"lmstudio\",\n \"lm_studio\": \"lmstudio\",\n \"ollama\": \"custom\", # bare \"ollama\" = local; use \"ollama-cloud\" for cloud\n \"ollama_cloud\": \"ollama-cloud\",\n}\n\n\n# Cost-safe overrides for the *silent* auto-default\n# (``get_default_model_for_provider``). Most providers' curated lists lead with a\n_PROVIDER_SILENT_DEFAULT_OVERRIDES: dict[str, str] = {}\n\n\ndef get_default_model_for_provider(provider: str) -> str:\n \"\"\"Return a cost-safe default model for a provider, or \"\" if unknown.\n\n Used as a NON-INTERACTIVE fallback when a provider is configured but no\n model was ever selected (e.g. ``arcen auth add openai-codex`` without\n ``arcen model``, or a profile that sets ``provider`` with no ``model``).\n\n For most providers this is the first entry in ``_PROVIDER_MODELS`` — the\n same model the ``arcen model`` picker offers first. For metered aggregators\n whose curated list is ordered most-capable-first, that entry is also the\n most EXPENSIVE one, so silently defaulting to it is a billing footgun. Such\n providers carry an explicit low-cost override in\n ``_PROVIDER_SILENT_DEFAULT_OVERRIDES``; a missing model must never\n auto-escalate to the flagship.\n \"\"\"\n models = _PROVIDER_MODELS.get(provider, [])\n override = _PROVIDER_SILENT_DEFAULT_OVERRIDES.get(provider)\n if override and override in models:\n return override\n return models[0] if models else \"\"\n\n\ndef _openrouter_model_is_free(pricing: Any) -> bool:\n \"\"\"Return True when both prompt and completion pricing are zero.\"\"\"\n if not isinstance(pricing, dict):\n return False\n try:\n return float(pricing.get(\"prompt\", \"0\")) == 0 and float(pricing.get(\"completion\", \"0\")) == 0\n except (TypeError, ValueError):\n return False\n\n\ndef _openrouter_model_supports_tools(item: Any) -> bool:\n \"\"\"Return True when the model's ``supported_parameters`` advertise tool calling.\n\n arcen-agent is tool-calling-first — every provider path assumes the model\n can invoke tools. Models that don't advertise ``tools`` in their\n ``supported_parameters`` (e.g. image-only or completion-only models) cannot\n be driven by the agent loop and would fail at the first tool call.\n\n **Permissive when the field is missing.** Some OpenRouter-compatible gateways\n (Removed provider Portal, private mirrors, older catalog snapshots) don't populate\n ``supported_parameters`` at all. Treat that as \"unknown capability → allow\"\n so the picker doesn't silently empty for those users. Only hide models\n whose ``supported_parameters`` is an explicit list that omits ``tools``.\n\n Ported from Kilo-Org/kilocode#9068.\n \"\"\"\n if not isinstance(item, dict):\n return True\n params = item.get(\"supported_parameters\")\n if not isinstance(params, list):\n # Field absent / malformed / None — be permissive.\n return True\n return \"tools\" in params\n\n\ndef fetch_openrouter_models(\n timeout: float = 8.0,\n *,\n force_refresh: bool = False,\n) -> list[tuple[str, str]]:\n \"\"\"Return the curated OpenRouter picker list, refreshed from the live catalog when possible.\"\"\"\n global _openrouter_catalog_cache\n\n if _openrouter_catalog_cache is not None and not force_refresh:\n return list(_openrouter_catalog_cache)\n\n # Prefer the remotely-hosted catalog manifest; fall back to the in-repo\n # snapshot when the manifest is unreachable. Both are curated lists that\n # drive the picker; the OpenRouter live /v1/models filter (tool support,\n # free pricing) is applied on top either way.\n try:\n from arcen_cli.model_catalog import get_curated_openrouter_models\n remote = get_curated_openrouter_models()\n except Exception:\n remote = None\n fallback = list(remote) if remote else list(OPENROUTER_MODELS)\n preferred_ids = [mid for mid, _ in fallback]\n\n try:\n req = urllib.request.Request(\n \"https://openrouter.ai/api/v1/models\",\n headers={\"Accept\": \"application/json\"},\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except Exception:\n return list(_openrouter_catalog_cache or fallback)\n\n live_items = payload.get(\"data\", [])\n if not isinstance(live_items, list):\n return list(_openrouter_catalog_cache or fallback)\n\n live_by_id: dict[str, dict[str, Any]] = {}\n for item in live_items:\n if not isinstance(item, dict):\n continue\n mid = str(item.get(\"id\") or \"\").strip()\n if not mid:\n continue\n live_by_id[mid] = item\n\n curated: list[tuple[str, str]] = []\n for preferred_id in preferred_ids:\n live_item = live_by_id.get(preferred_id)\n if live_item is None:\n continue\n # Hide models that don't advertise tool-calling support — arcen-agent\n # requires it and surfacing them leads to immediate runtime failures\n # when the user selects them. Ported from Kilo-Org/kilocode#9068.\n if not _openrouter_model_supports_tools(live_item):\n continue\n desc = \"free\" if _openrouter_model_is_free(live_item.get(\"pricing\")) else \"\"\n curated.append((preferred_id, desc))\n\n if not curated:\n return list(_openrouter_catalog_cache or fallback)\n\n first_id, _ = curated[0]\n curated[0] = (first_id, \"recommended\")\n _openrouter_catalog_cache = curated\n return list(curated)\n\n\ndef model_ids(*, force_refresh: bool = False) -> list[str]:\n \"\"\"Return just the OpenRouter model-id strings.\"\"\"\n return [mid for mid, _ in fetch_openrouter_models(force_refresh=force_refresh)]\n\n\ndef get_curated_removed_provider_model_ids() -> list[str]:\n \"\"\"Return the curated Removed provider Portal model-id list.\n\n Prefers the remotely-hosted catalog manifest (published under\n ``website/static/api/model-catalog.json``); falls back to the in-repo\n snapshot in ``_PROVIDER_MODELS[\"removed_provider\"]`` when the manifest is\n unreachable. Always returns a list (never None).\n \"\"\"\n try:\n from arcen_cli.model_catalog import get_curated_removed_provider_models\n remote = get_curated_removed_provider_models()\n except Exception:\n remote = None\n if remote:\n return list(remote)\n return list(_PROVIDER_MODELS.get(\"removed_provider\", []))\n\n\n# ---------------------------------------------------------------------------\n# Pricing helpers — fetch live pricing from OpenRouter-compatible /v1/models\n# ---------------------------------------------------------------------------\n\n# Cache: maps model_id → {\"prompt\": str, \"completion\": str} per endpoint\n_pricing_cache: dict[str, dict[str, dict[str, str]]] = {}\n\n\ndef _format_price_per_mtok(per_token_str: str) -> str:\n \"\"\"Convert a per-token price string to a human-friendly $/Mtok string.\n\n Always uses 2 decimal places so that prices align vertically when\n right-justified in a column (the decimal point stays in the same position).\n\n Examples:\n \"0.000003\" → \"$3.00\" (per million tokens)\n \"0.00003\" → \"$30.00\"\n \"0.00000015\" → \"$0.15\"\n \"0.0000001\" → \"$0.10\"\n \"0.00018\" → \"$180.00\"\n \"0\" → \"free\"\n \"\"\"\n try:\n val = float(per_token_str)\n except (TypeError, ValueError):\n return \"?\"\n if val == 0:\n return \"free\"\n per_m = val * 1_000_000\n return f\"${per_m:.2f}\"\n\n\ndef fetch_models_with_pricing(\n api_key: str | None = None,\n base_url: str = \"https://openrouter.ai/api\",\n timeout: float = 8.0,\n *,\n force_refresh: bool = False,\n) -> dict[str, dict[str, str]]:\n \"\"\"Fetch ``/v1/models`` and return ``{model_id: {prompt, completion}}`` pricing.\n\n Results are cached per *base_url* so repeated calls are free.\n Works with any OpenRouter-compatible endpoint (OpenRouter, Removed provider Portal).\n \"\"\"\n cache_key = (base_url or \"\").rstrip(\"/\")\n if not force_refresh and cache_key in _pricing_cache:\n return _pricing_cache[cache_key]\n\n url = cache_key.rstrip(\"/\") + \"/v1/models\"\n headers: dict[str, str] = {\n \"Accept\": \"application/json\",\n \"User-Agent\": _ARCEN_USER_AGENT,\n }\n if api_key:\n headers[\"Authorization\"] = f\"Bearer {api_key}\"\n\n try:\n req = urllib.request.Request(url, headers=headers)\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except Exception:\n _pricing_cache[cache_key] = {}\n return {}\n\n result: dict[str, dict[str, str]] = {}\n for item in payload.get(\"data\", []):\n mid = item.get(\"id\")\n pricing = item.get(\"pricing\")\n if mid and isinstance(pricing, dict):\n entry: dict[str, str] = {\n \"prompt\": str(pricing.get(\"prompt\", \"\")),\n \"completion\": str(pricing.get(\"completion\", \"\")),\n }\n if pricing.get(\"input_cache_read\"):\n entry[\"input_cache_read\"] = str(pricing[\"input_cache_read\"])\n if pricing.get(\"input_cache_write\"):\n entry[\"input_cache_write\"] = str(pricing[\"input_cache_write\"])\n result[mid] = entry\n\n _pricing_cache[cache_key] = result\n return result\n\n\ndef _resolve_openrouter_api_key() -> str:\n \"\"\"Best-effort OpenRouter API key for pricing fetch.\"\"\"\n return os.getenv(\"OPENROUTER_API_KEY\", \"\").strip()\n\n\n_DEFAULT_REMOVED_PROVIDER_INFERENCE_BASE = \"https://\"\n\n\ndef _resolve_removed_provider_pricing_credentials() -> tuple[str, str]:\n \"\"\"Return ``(api_key, base_url)`` for Removed provider Portal pricing.\n\n The Removed provider inference ``/v1/models`` endpoint exposes pricing without\n authentication, so the api_key is best-effort: when runtime credential\n resolution fails (expired refresh token, missing auth.json, etc.) we\n still return the default inference base URL so the picker keeps\n working with anonymous pricing data. Free-tier users in particular\n need this — pricing drives the free/paid partition, and silently\n returning empty pricing because of an auth blip makes the picker\n look broken (\"No free models currently available\").\n \"\"\"\n try:\n from arcen_cli.auth import resolve_removed_provider_runtime_credentials\n creds = resolve_removed_provider_runtime_credentials()\n if creds:\n return (creds.get(\"api_key\", \"\"), creds.get(\"base_url\", \"\"))\n except Exception:\n pass\n return (\"\", _DEFAULT_REMOVED_PROVIDER_INFERENCE_BASE)\n\n\ndef get_pricing_for_provider(provider: str, *, force_refresh: bool = False) -> dict[str, dict[str, str]]:\n \"\"\"Return live pricing for providers that support it (openrouter, removed_provider, novita).\"\"\"\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\":\n return fetch_models_with_pricing(\n api_key=_resolve_openrouter_api_key(),\n base_url=\"https://openrouter.ai/api\",\n force_refresh=force_refresh,\n )\n if normalized == \"novita\":\n return _fetch_novita_pricing(force_refresh=force_refresh)\n if normalized == \"removed_provider\":\n api_key, base_url = _resolve_removed_provider_pricing_credentials()\n if base_url:\n # Removed provider base_url typically looks like https:///v1\n # We need the part before /v1 for our fetch function\n stripped = base_url.rstrip(\"/\")\n if stripped.endswith(\"/v1\"):\n stripped = stripped[:-3]\n return fetch_models_with_pricing(\n api_key=api_key,\n base_url=stripped,\n force_refresh=force_refresh,\n )\n return {}\n\n\ndef _fetch_novita_pricing(\n timeout: float = 8.0,\n *,\n force_refresh: bool = False,\n) -> dict[str, dict[str, str]]:\n \"\"\"Fetch pricing from NovitaAI /v1/models.\n\n NovitaAI returns input/output prices per million tokens in units of\n 0.0001 USD. Convert them to the per-token strings used by the shared\n pricing formatter.\n\n Results are cached in ``_pricing_cache`` keyed on the resolved base URL —\n without this, every menu render or pricing lookup re-hits the network.\n \"\"\"\n api_key = os.getenv(\"NOVITA_API_KEY\", \"\").strip()\n if not api_key:\n return {}\n\n base_url = os.getenv(\"NOVITA_BASE_URL\", \"\").strip() or \"https://api.novita.ai/openai/v1\"\n cache_key = base_url.rstrip(\"/\")\n if not force_refresh and cache_key in _pricing_cache:\n return _pricing_cache[cache_key]\n\n url = cache_key + \"/models\"\n headers = {\n \"Authorization\": f\"Bearer {api_key}\",\n \"Accept\": \"application/json\",\n \"User-Agent\": _ARCEN_USER_AGENT,\n }\n\n try:\n req = urllib.request.Request(url, headers=headers)\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except Exception:\n _pricing_cache[cache_key] = {}\n return {}\n\n result: dict[str, dict[str, str]] = {}\n for item in payload.get(\"data\", []):\n if not isinstance(item, dict):\n continue\n mid = item.get(\"id\")\n if not mid:\n continue\n inp = item.get(\"input_token_price_per_m\")\n out = item.get(\"output_token_price_per_m\")\n if inp is None and out is None:\n continue\n result[str(mid)] = {\n \"prompt\": str(float(inp or 0) / 10_000 / 1_000_000),\n \"completion\": str(float(out or 0) / 10_000 / 1_000_000),\n }\n\n _pricing_cache[cache_key] = result\n return result\n\n\n# All provider IDs and aliases that are valid for the provider:model syntax.\n_KNOWN_PROVIDER_NAMES: set[str] = (\n set(_PROVIDER_LABELS.keys())\n | set(_PROVIDER_ALIASES.keys())\n | {\"openrouter\", \"custom\"}\n)\n\n\ndef list_available_providers() -> list[dict[str, str]]:\n \"\"\"Return info about all providers the user could use with ``provider:model``.\n\n Each dict has ``id``, ``label``, and ``aliases``.\n Checks which providers have valid credentials configured.\n\n Derives the provider list from :data:`CANONICAL_PROVIDERS` (single\n source of truth shared with ``arcen model``, ``/model``, etc.).\n \"\"\"\n # Derive display order from canonical list + custom\n provider_order = [p.slug for p in CANONICAL_PROVIDERS] + [\"custom\"]\n\n # Build reverse alias map\n aliases_for: dict[str, list[str]] = {}\n for alias, canonical in _PROVIDER_ALIASES.items():\n aliases_for.setdefault(canonical, []).append(alias)\n\n result = []\n for pid in provider_order:\n label = _PROVIDER_LABELS.get(pid, pid)\n alias_list = aliases_for.get(pid, [])\n # Check if this provider has credentials available\n has_creds = False\n try:\n from arcen_cli.auth import get_auth_status, has_usable_secret\n if pid == \"custom\":\n custom_base_url = _get_custom_base_url() or \"\"\n has_creds = bool(custom_base_url.strip())\n elif pid == \"openrouter\":\n has_creds = has_usable_secret(os.getenv(\"OPENROUTER_API_KEY\", \"\"))\n else:\n status = get_auth_status(pid)\n has_creds = bool(status.get(\"logged_in\") or status.get(\"configured\"))\n except Exception:\n pass\n result.append({\n \"id\": pid,\n \"label\": label,\n \"aliases\": alias_list,\n \"authenticated\": has_creds,\n })\n return result\n\n\ndef parse_model_input(raw: str, current_provider: str) -> tuple[str, str]:\n \"\"\"Parse ``/model`` input into ``(provider, model)``.\n\n Supports ``provider:model`` syntax to switch providers at runtime::\n\n openrouter:anthropic/claude-sonnet-4.5 → (\"openrouter\", \"anthropic/claude-sonnet-4.5\")\n removed_provider:arcen-3 → (\"removed_provider\", \"arcen-3\")\n anthropic/claude-sonnet-4.5 → (current_provider, \"anthropic/claude-sonnet-4.5\")\n gpt-5.4 → (current_provider, \"gpt-5.4\")\n\n The colon is only treated as a provider delimiter if the left side is a\n recognized provider name or alias. This avoids misinterpreting model names\n that happen to contain colons (e.g. ``anthropic/claude-3.5-sonnet:beta``).\n\n Returns ``(provider, model)`` where *provider* is either the explicit\n provider from the input or *current_provider* if none was specified.\n \"\"\"\n stripped = raw.strip()\n colon = stripped.find(\":\")\n if colon > 0:\n provider_part = stripped[:colon].strip().lower()\n model_part = stripped[colon + 1:].strip()\n if provider_part and model_part and provider_part in _KNOWN_PROVIDER_NAMES:\n # Support custom:name:model triple syntax for named custom\n # providers. ``custom:local:qwen`` → (\"custom:local\", \"qwen\").\n # Single colon ``custom:qwen`` → (\"custom\", \"qwen\") as before.\n if provider_part == \"custom\" and \":\" in model_part:\n second_colon = model_part.find(\":\")\n custom_name = model_part[:second_colon].strip()\n actual_model = model_part[second_colon + 1:].strip()\n if custom_name and actual_model:\n return (f\"custom:{custom_name}\", actual_model)\n return (normalize_provider(provider_part), model_part)\n return (current_provider, stripped)\n\n\ndef _get_custom_base_url() -> str:\n \"\"\"Get the custom endpoint base_url from config.yaml.\"\"\"\n try:\n from arcen_cli.config import load_config\n config = load_config()\n model_cfg = config.get(\"model\", {})\n if isinstance(model_cfg, dict):\n return str(model_cfg.get(\"base_url\", \"\")).strip()\n except Exception:\n pass\n return \"\"\n\n\ndef curated_models_for_provider(\n provider: Optional[str],\n *,\n force_refresh: bool = False,\n) -> list[tuple[str, str]]:\n \"\"\"Return ``(model_id, description)`` tuples for a provider's model list.\n\n Tries to fetch the live model list from the provider's API first,\n falling back to the static ``_PROVIDER_MODELS`` catalog if the API\n is unreachable.\n \"\"\"\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\":\n return fetch_openrouter_models(force_refresh=force_refresh)\n\n # Try live API first (Codex, Removed provider, etc. all support /models)\n live = provider_model_ids(normalized)\n if live:\n return [(m, \"\") for m in live]\n\n # Fallback to static catalog\n models = _PROVIDER_MODELS.get(normalized, [])\n return [(m, \"\") for m in models]\n\n\ndef _provider_keys(provider: str) -> set[str]:\n key = (provider or \"\").strip().lower()\n normalized = normalize_provider(provider)\n return {k for k in (key, normalized) if k}\n\n\ndef _model_in_provider_catalog(name_lower: str, providers: set[str]) -> bool:\n return any(\n name_lower == model.lower()\n for provider in providers\n for model in _PROVIDER_MODELS.get(provider, [])\n )\n\n\n_AGGREGATOR_PROVIDERS = frozenset(\n {\"removed_provider\", \"openrouter\", \"copilot\", \"kilocode\"}\n)\n\n\ndef _resolve_static_model_alias(\n name_lower: str,\n current_keys: set[str],\n) -> Optional[tuple[str, str]]:\n \"\"\"Resolve short aliases (e.g. sonnet/opus) using static catalogs only.\"\"\"\n try:\n from arcen_cli.model_switch import MODEL_ALIASES\n except Exception:\n return None\n\n identity = MODEL_ALIASES.get(name_lower)\n if identity is None:\n return None\n\n vendor = identity.vendor\n family = identity.family\n\n def _match(provider: str) -> Optional[str]:\n models = _PROVIDER_MODELS.get(provider, [])\n if not models:\n return None\n prefix = (\n f\"{vendor}/{family}\"\n if provider in _AGGREGATOR_PROVIDERS\n else family\n ).lower()\n for model in models:\n if model.lower().startswith(prefix):\n return model\n return None\n\n for provider in current_keys:\n if matched := _match(provider):\n return provider, matched\n\n for provider in _PROVIDER_MODELS:\n if provider in current_keys or provider in _AGGREGATOR_PROVIDERS:\n continue\n if matched := _match(provider):\n return provider, matched\n\n for provider in _AGGREGATOR_PROVIDERS:\n if provider in current_keys and (matched := _match(provider)):\n return provider, matched\n\n return None\n\n\ndef detect_static_provider_for_model(\n model_name: str,\n current_provider: str,\n) -> Optional[tuple[str, str]]:\n \"\"\"Auto-detect a provider from static catalogs only.\n\n Returns ``(provider_id, model_name)``. The model name may be remapped\n when a static alias or bare provider name resolves to a catalog default.\n Returns ``None`` when no confident match is found.\n \"\"\"\n name = (model_name or \"\").strip()\n if not name:\n return None\n\n name_lower = name.lower()\n current_keys = _provider_keys(current_provider)\n\n alias_match = _resolve_static_model_alias(name_lower, current_keys)\n if alias_match:\n return alias_match\n\n # --- Step 0: bare provider name typed as model ---\n # If someone types `/model removed_provider` or `/model anthropic`, treat it as a\n # provider switch and pick the first model from that provider's catalog.\n # Skip \"custom\" and \"openrouter\" — custom has no model catalog, and\n # openrouter requires an explicit model name to be useful.\n resolved_provider = _PROVIDER_ALIASES.get(name_lower, name_lower)\n if resolved_provider not in {\"custom\", \"openrouter\"}:\n default_models = _PROVIDER_MODELS.get(resolved_provider, [])\n if (\n resolved_provider in _PROVIDER_LABELS\n and default_models\n and resolved_provider not in current_keys\n ):\n return (resolved_provider, default_models[0])\n\n # Aggregators list other providers' models — never auto-switch TO them\n # If the model belongs to the current provider's catalog, don't suggest switching\n if _model_in_provider_catalog(name_lower, current_keys):\n return None\n\n # --- Step 1: check static provider catalogs for a direct match ---\n for pid, models in _PROVIDER_MODELS.items():\n if pid in current_keys or pid in _AGGREGATOR_PROVIDERS:\n continue\n if any(name_lower == m.lower() for m in models):\n return (pid, name)\n\n return None\n\n\ndef detect_provider_for_model(\n model_name: str,\n current_provider: str,\n) -> Optional[tuple[str, str]]:\n \"\"\"Auto-detect the best provider for a model name.\n\n Returns ``(provider_id, model_name)`` — the model name may be remapped\n (e.g. bare ``deepseek-chat`` → ``deepseek/deepseek-chat`` for OpenRouter).\n Returns ``None`` when no confident match is found.\n\n Priority:\n 0. Bare provider name → switch to that provider's default model\n 1. Direct provider static catalog match\n 2. OpenRouter catalog match\n \"\"\"\n name = (model_name or \"\").strip()\n if not name:\n return None\n\n static_match = detect_static_provider_for_model(name, current_provider)\n if static_match:\n return static_match\n if _model_in_provider_catalog(name.lower(), _provider_keys(current_provider)):\n return None\n\n # --- Step 2: check OpenRouter catalog ---\n # First try exact match (handles provider/model format)\n or_slug = _find_openrouter_slug(name)\n if or_slug:\n if current_provider != \"openrouter\":\n return (\"openrouter\", or_slug)\n # Already on openrouter, just return the resolved slug\n if or_slug != name:\n return (\"openrouter\", or_slug)\n return None # already on openrouter with matching name\n\n return None\n\n\ndef _find_openrouter_slug(model_name: str) -> Optional[str]:\n \"\"\"Find the full OpenRouter model slug for a bare or partial model name.\n\n Handles:\n - Exact match: ``anthropic/claude-opus-4.6`` → as-is\n - Bare name: ``deepseek-chat`` → ``deepseek/deepseek-chat``\n - Bare name: ``claude-opus-4.6`` → ``anthropic/claude-opus-4.6``\n \"\"\"\n name_lower = model_name.strip().lower()\n if not name_lower:\n return None\n\n # Exact match (already has provider/ prefix)\n for mid in model_ids():\n if name_lower == mid.lower():\n return mid\n\n # Try matching just the model part (after the /)\n for mid in model_ids():\n if \"/\" in mid:\n _, model_part = mid.split(\"/\", 1)\n if name_lower == model_part.lower():\n return mid\n\n return None\n\n\ndef normalize_provider(provider: Optional[str]) -> str:\n \"\"\"Normalize provider aliases to Arcen' canonical provider ids.\n\n Note: ``\"auto\"`` passes through unchanged — use\n ``arcen_cli.auth.resolve_provider()`` to resolve it to a concrete\n provider based on credentials and environment.\n \"\"\"\n normalized = (provider or \"openrouter\").strip().lower()\n return _PROVIDER_ALIASES.get(normalized, normalized)\n\n\ndef provider_label(provider: Optional[str]) -> str:\n \"\"\"Return a human-friendly label for a provider id or alias.\"\"\"\n original = (provider or \"openrouter\").strip()\n normalized = original.lower()\n if normalized == \"auto\":\n return \"Auto\"\n normalized = normalize_provider(normalized)\n return _PROVIDER_LABELS.get(normalized, original or \"OpenRouter\")\n\n\n# Models that support OpenAI Priority Processing (service_tier=\"priority\").\n# See https://openai.com/api-priority-processing/ for the canonical list.\n#\n# Pattern-based matching — any OpenAI flagship model (gpt-*, o1*, o3*, o4*)\n# is assumed to support Priority Processing. service_tier=priority is silently\n# ignored by non-OpenAI endpoints (OpenRouter/Copilot/opencode-zen proxies\n# strip the field), so false positives are harmless. Codex-series models\n# (gpt-5-codex, gpt-5.3-codex, etc.) are excluded — they don't expose the\n# service_tier parameter through the Codex Responses API.\n_OPENAI_FAST_MODE_PREFIXES: tuple[str, ...] = (\n \"gpt-\",\n \"o1\",\n \"o3\",\n \"o4\",\n)\n\n\ndef _is_openai_fast_model(model_id: Optional[str]) -> bool:\n \"\"\"Return True if the model is an OpenAI flagship eligible for Priority Processing.\"\"\"\n raw = _strip_vendor_prefix(str(model_id or \"\"))\n base = raw.split(\":\")[0]\n if not base:\n return False\n # Exclude Codex-series — they route through the Codex Responses API\n # which doesn't accept service_tier.\n if \"codex\" in base:\n return False\n return any(base.startswith(prefix) for prefix in _OPENAI_FAST_MODE_PREFIXES)\n\n\n# Models that support Anthropic Fast Mode (speed=\"fast\").\n# See https://platform.claude.com/docs/en/build-with-claude/fast-mode\n#\n# Pattern-based matching — any claude-* model is eligible. The anthropic\n# adapter gates speed=fast on native Anthropic endpoints only (see\n# _is_third_party_anthropic_endpoint in agent/anthropic_adapter.py), so\n# third-party proxies that would reject the beta header are protected.\n\n\ndef _strip_vendor_prefix(model_id: str) -> str:\n \"\"\"Strip vendor/ prefix from a model ID (e.g. 'anthropic/claude-opus-4-6' -> 'claude-opus-4-6').\"\"\"\n raw = str(model_id or \"\").strip().lower()\n if \"/\" in raw:\n raw = raw.split(\"/\", 1)[1]\n return raw\n\n\ndef model_supports_fast_mode(model_id: Optional[str]) -> bool:\n \"\"\"Return whether Arcen should expose the /fast toggle for this model.\"\"\"\n return _is_anthropic_fast_model(model_id) or _is_openai_fast_model(model_id)\n\n\ndef _is_anthropic_fast_model(model_id: Optional[str]) -> bool:\n \"\"\"Return True if the model accepts the Anthropic Fast Mode ``speed`` param.\n\n This gates the *speed=fast request parameter*, which Anthropic supports on\n Opus 4.6 only (Opus 4.7 explicitly 400s). It is deliberately NOT a general\n \"is this a fast model\" check: for Opus 4.8 the fast offering is a SEPARATE\n model id (``…-opus-4.8-fast``) selected via the model field, not the speed\n parameter — see ``agent.anthropic_adapter._supports_fast_mode`` and its\n test. Keep this in lock-step with that adapter gate so the UI never shows a\n Fast toggle that the runtime would silently drop.\n \"\"\"\n raw = _strip_vendor_prefix(str(model_id or \"\"))\n base = raw.split(\":\")[0]\n if not base.startswith(\"claude-\"):\n return False\n # Only Opus 4.6 supports the speed=fast parameter at present.\n return \"opus-4-6\" in base or \"opus-4.6\" in base\n\n\ndef resolve_fast_mode_overrides(model_id: Optional[str]) -> dict[str, Any] | None:\n \"\"\"Return request_overrides for fast/priority mode, or None if unsupported.\n\n Returns provider-appropriate overrides:\n - OpenAI models: ``{\"service_tier\": \"priority\"}`` (Priority Processing)\n - Anthropic models: ``{\"speed\": \"fast\"}`` (Anthropic Fast Mode beta)\n\n The overrides are injected into the API request kwargs by\n ``_build_api_kwargs`` in run_agent.py — each API path handles its own\n keys (service_tier for OpenAI/Codex, speed for Anthropic Messages).\n \"\"\"\n if not model_supports_fast_mode(model_id):\n return None\n if _is_anthropic_fast_model(model_id):\n return {\"speed\": \"fast\"}\n return {\"service_tier\": \"priority\"}\n\n\ndef _resolve_copilot_catalog_api_key() -> str:\n \"\"\"Best-effort GitHub token for fetching the Copilot model catalog.\n\n Resolution order:\n 1. ``resolve_api_key_provider_credentials(\"copilot\")`` — env vars\n (``COPILOT_GITHUB_TOKEN`` / ``GH_TOKEN`` / ``GITHUB_TOKEN``) plus\n the ``gh auth token`` CLI fallback.\n 2. ``read_credential_pool(\"copilot\")`` — a token (typically a\n ``gho_*`` from device-code login, or a fine-grained PAT) stored in\n ``auth.json`` under ``credential_pool.copilot[]``. The pool is\n populated by ``arcen auth add copilot`` and by ``_seed_from_env``\n when the env var is set in ``~/.arcen/.env``.\n\n Without (2), users whose only Copilot credential is in the pool see\n the ``/model`` picker fall back to a stale hardcoded list because the\n live catalog fetch silently 401s. To avoid wedging on a malformed pool\n entry, each candidate is exchanged via ``exchange_copilot_token`` —\n only entries that actually exchange successfully are returned, so a\n later valid entry is reachable when an earlier one is unsupported.\n \"\"\"\n try:\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n creds = resolve_api_key_provider_credentials(\"copilot\")\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n if api_key:\n return api_key\n except Exception:\n pass\n\n try:\n from arcen_cli.auth import read_credential_pool\n from arcen_cli.copilot_auth import (\n exchange_copilot_token,\n validate_copilot_token,\n )\n\n for entry in read_credential_pool(\"copilot\"):\n if not isinstance(entry, dict):\n continue\n raw = str(entry.get(\"access_token\") or \"\").strip()\n if not raw:\n continue\n valid, _ = validate_copilot_token(raw)\n if not valid:\n continue\n try:\n api_token, _expires_at = exchange_copilot_token(raw)\n except Exception:\n continue\n if api_token:\n return api_token\n except Exception:\n pass\n\n return \"\"\n\n\n# Providers where models.dev is treated as authoritative: curated static\n# lists are kept only as an offline fallback and to capture custom additions\n# the registry doesn't publish yet. Adding a provider here causes its\n# curated list to be merged with fresh models.dev entries (fresh first, any\n# curated-only names appended) for both the CLI and the gateway /model picker.\n#\n# DELIBERATELY EXCLUDED:\n# - \"openrouter\": curated list is already a hand-picked agentic subset of\n# OpenRouter's 400+ catalog. Blindly merging would dump everything.\n# - \"removed_provider\": curated list and Portal /models endpoint are the source of\n# truth for the subscription tier.\n# Also excluded: providers that already have dedicated live-endpoint\n# branches below (copilot, anthropic, ollama-cloud, custom,\n# stepfun, openai-codex) — those paths handle freshness themselves.\n_MODELS_DEV_PREFERRED: frozenset[str] = frozenset({\n \"opencode-go\",\n \"opencode-zen\",\n \"deepseek\",\n \"kilocode\",\n \"fireworks\",\n \"mistral\",\n \"togetherai\",\n \"cohere\",\n \"perplexity\",\n \"groq\",\n \"nvidia\",\n \"huggingface\",\n \"zai\",\n \"gemini\",\n \"google\",\n})\n\n\ndef _merge_with_models_dev(provider: str, curated: list[str]) -> list[str]:\n \"\"\"Merge curated list with fresh models.dev entries for a preferred provider.\n\n Returns models.dev entries first (in models.dev order), then any\n curated-only entries appended. Preserves case for curated fallbacks\n (e.g. ``MiniMax-M2.7``) while trusting models.dev for newer variants.\n\n If models.dev is unreachable or returns nothing, the curated list is\n returned unchanged — this is the offline/CI fallback path.\n \"\"\"\n try:\n from agent.models_dev import list_agentic_models\n mdev = list_agentic_models(provider)\n except Exception:\n mdev = []\n\n if not mdev:\n return list(curated)\n\n # Case-insensitive dedup while preserving order and curated casing.\n seen_lower: set[str] = set()\n merged: list[str] = []\n for mid in mdev:\n key = str(mid).lower()\n if key in seen_lower:\n continue\n seen_lower.add(key)\n merged.append(mid)\n for mid in curated:\n key = str(mid).lower()\n if key in seen_lower:\n continue\n seen_lower.add(key)\n merged.append(mid)\n return merged\n\n\ndef provider_model_ids(provider: Optional[str], *, force_refresh: bool = False) -> list[str]:\n \"\"\"Return the best known model catalog for a provider.\n\n Tries live API endpoints for providers that support them (Codex, Removed provider),\n falling back to static lists. For providers in ``_MODELS_DEV_PREFERRED``\n (opencode-go/zen, xiaomi, deepseek, smaller inference providers, etc.),\n models.dev entries are merged on top of curated so new models released\n on the platform appear in ``/model`` without an Arcen release.\n \"\"\"\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\":\n return model_ids(force_refresh=force_refresh)\n if normalized == \"openai-codex\":\n from arcen_cli.codex_models import get_codex_model_ids\n\n # Pass the live OAuth access token so the picker matches whatever\n # ChatGPT lists for this account right now (new models appear without\n # an Arcen release). Falls back to the hardcoded catalog if no token\n # or the endpoint is unreachable.\n access_token = None\n try:\n from arcen_cli.auth import resolve_codex_runtime_credentials\n\n creds = resolve_codex_runtime_credentials(refresh_if_expiring=True)\n access_token = creds.get(\"api_key\")\n except Exception:\n access_token = None\n return get_codex_model_ids(access_token=access_token)\n if normalized == \"xai-oauth\":\n return list(_PROVIDER_MODELS.get(\"xai-oauth\", _PROVIDER_MODELS.get(\"xai\", [])))\n if normalized in {\"copilot\", \"copilot-acp\"}:\n try:\n live = _fetch_github_models(_resolve_copilot_catalog_api_key())\n if live:\n return live\n except Exception:\n pass\n if normalized == \"copilot-acp\":\n return list(_PROVIDER_MODELS.get(\"copilot\", []))\n if normalized == \"removed_provider\":\n # Try live Removed provider Portal /models endpoint\n try:\n from arcen_cli.auth import fetch_removed_provider_models, resolve_removed_provider_runtime_credentials\n creds = resolve_removed_provider_runtime_credentials()\n if creds:\n live = fetch_removed_provider_models(api_key=creds.get(\"api_key\", \"\"), inference_base_url=creds.get(\"base_url\", \"\"))\n if live:\n return live\n except Exception:\n pass\n # Live failed (or no creds). Fall back to the docs-hosted manifest\n # — NOT the in-repo _PROVIDER_MODELS[\"removed_provider\"] snapshot — so newly\n # added Portal models still surface without an Arcen release.\n manifest_ids = get_curated_removed_provider_model_ids()\n if manifest_ids:\n return manifest_ids\n if normalized == \"stepfun\":\n try:\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n creds = resolve_api_key_provider_credentials(\"stepfun\")\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n base_url = str(creds.get(\"base_url\") or \"\").strip()\n if api_key and base_url:\n live = fetch_api_models(api_key, base_url)\n if live:\n return live\n except Exception:\n pass\n if normalized == \"anthropic\":\n live = _fetch_anthropic_models()\n if live:\n return live\n if normalized == \"ollama-cloud\":\n live = fetch_ollama_cloud_models(force_refresh=force_refresh)\n if live:\n return live\n if normalized in (\"openai\", \"openai-api\"):\n api_key = os.getenv(\"OPENAI_API_KEY\", \"\").strip()\n if api_key:\n base_raw = os.getenv(\"OPENAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n base = base_raw or \"https://api.openai.com/v1\"\n # Custom OpenAI-compatible endpoints (proxies, gateways, self-hosted)\n # may serve a small curated catalog — use the live list verbatim so\n # discovery works. But the canonical api.openai.com /v1/models dump\n # is 120+ entries of embeddings, whisper, tts, dall-e, moderation and\n # legacy chat models — none of which belong in the agent model picker.\n # For the default endpoint, intersect the live list with our curated\n # agentic catalog so ``/model`` matches what ``arcen model`` shows.\n is_default_openai = base.rstrip(\"/\") in (\n \"https://api.openai.com/v1\",\n \"https://api.openai.com\",\n )\n try:\n live = fetch_api_models(api_key, base)\n if live:\n if is_default_openai:\n live_lower = {m.lower() for m in live}\n curated = list(_PROVIDER_MODELS.get(normalized, []))\n # Keep curated order; only surface curated models the\n # account actually has access to.\n filtered = [m for m in curated if m.lower() in live_lower]\n if filtered:\n return filtered\n # Account serves none of the curated models (rare —\n # e.g. org without GPT-5 access). Fall back to curated\n # so the picker still offers sane defaults.\n return curated or live\n return live\n except Exception:\n pass\n if normalized == \"gmi\":\n try:\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n creds = resolve_api_key_provider_credentials(\"gmi\")\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n base_url = str(creds.get(\"base_url\") or \"\").strip()\n if api_key and base_url:\n live = fetch_api_models(api_key, base_url)\n if live:\n return live\n except Exception:\n pass\n if normalized == \"custom\":\n base_url = _get_custom_base_url()\n if base_url:\n # Try common API key env vars for custom endpoints\n api_key = (\n os.getenv(\"CUSTOM_API_KEY\", \"\")\n or os.getenv(\"OPENAI_API_KEY\", \"\")\n or os.getenv(\"OPENROUTER_API_KEY\", \"\")\n )\n live = fetch_api_models(api_key, base_url)\n if live:\n return live\n # Bedrock uses live discovery keyed by the resolved AWS region so that\n # EU/AP users see eu.*/ap.* model IDs instead of the static us.* list.\n # Note: early return intentionally skips _MODELS_DEV_PREFERRED merge\n # below — bedrock is not expected to appear in that table.\n if normalized == \"bedrock\":\n try:\n from agent.bedrock_adapter import bedrock_model_ids_or_none\n ids = bedrock_model_ids_or_none()\n if ids is not None:\n return ids\n except Exception:\n pass\n\n # ── Profile-based generic live fetch (all simple api-key providers) ──\n # Handles any provider registered in providers/ with auth_type=\"api_key\".\n # Replaces per-provider copy-paste blocks (stepfun, gmi, zai, etc.).\n try:\n from providers import get_provider_profile\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n _p = get_provider_profile(normalized)\n if _p and _p.auth_type == \"api_key\" and _p.base_url:\n try:\n creds = resolve_api_key_provider_credentials(normalized)\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n base_url = str(creds.get(\"base_url\") or \"\").strip()\n except Exception:\n api_key, base_url = \"\", _p.base_url\n if not base_url:\n base_url = _p.base_url\n if api_key:\n live = _p.fetch_models(api_key=api_key)\n if live:\n return live\n # Use profile's fallback_models if defined\n if _p.fallback_models:\n return list(_p.fallback_models)\n except Exception:\n pass\n\n curated_static = list(_PROVIDER_MODELS.get(normalized, []))\n if normalized in _MODELS_DEV_PREFERRED:\n return _merge_with_models_dev(normalized, curated_static)\n return curated_static\n\n\n# ---------------------------------------------------------------------------\n# Generic disk cache for provider_model_ids() — keeps /model picker fast.\n# ---------------------------------------------------------------------------\n#\n# Without this layer, every /model picker open re-fetches every authed\n# provider's /v1/models endpoint. On a well-configured user (anthropic +\n# openai + copilot + gemini + huggingface + ...) that's 2+ seconds of cold\n# HTTP roundtrips just to render the provider list.\n#\n# Cache strategy:\n# - One JSON file at $ARCEN_HOME/provider_models_cache.json\n# - Per-provider entries keyed by (provider, credential fingerprint)\n# - Credential fingerprint = sha256 of env-var values that the provider\n# normally reads. Swap your OPENAI_API_KEY and the entry invalidates.\n# - 1h TTL by default. `force_refresh=True` skips the cache entirely\n# and overwrites it on success.\n# - Only NON-EMPTY results are cached. An empty/None response from a\n# transient network error never gets pinned.\n# - Cache file is best-effort. Any read/write error degrades silently\n# to a live fetch — the picker keeps working.\n\n_PROVIDER_MODELS_CACHE_TTL = 3600 # 1h\n\n\ndef _provider_models_cache_path() -> Path:\n from arcen_constants import get_arcen_home\n return get_arcen_home() / \"provider_models_cache.json\"\n\n\ndef _credential_fingerprint(provider: str) -> str:\n \"\"\"Return a short hash representing the credentials that\n ``provider_model_ids(provider)`` would see right now.\n\n Rotating any of the relevant env vars invalidates the cached entry\n for that provider. We hash AT LEAST the api-key + base-url env vars\n declared in ``PROVIDER_REGISTRY``. For OAuth-backed providers\n (codex, copilot, anthropic-via-claude-code, removed_provider portal), the\n relevant tokens live in ``$ARCEN_HOME/auth.json`` and external\n credential files. Rather than parse every shape, we additionally\n fold the mtime of those files into the fingerprint so refreshes\n after re-auth bust the cache.\n \"\"\"\n import hashlib\n import os as _os\n\n parts: list[str] = []\n\n # Env vars from PROVIDER_REGISTRY for this slug\n try:\n from arcen_cli.auth import PROVIDER_REGISTRY\n pcfg = PROVIDER_REGISTRY.get(provider)\n if pcfg is not None:\n for ev in getattr(pcfg, \"api_key_env_vars\", ()) or ():\n parts.append(f\"{ev}={_os.environ.get(ev, '')}\")\n bev = getattr(pcfg, \"base_url_env_var\", \"\") or \"\"\n if bev:\n parts.append(f\"{bev}={_os.environ.get(bev, '')}\")\n except Exception:\n pass\n\n # OAuth / external-file mtimes that change on re-auth\n try:\n from arcen_constants import get_arcen_home\n for rel in (\"auth.json\", \"credentials.json\"):\n p = get_arcen_home() / rel\n try:\n parts.append(f\"{rel}@{p.stat().st_mtime_ns}\")\n except FileNotFoundError:\n parts.append(f\"{rel}@missing\")\n except Exception:\n pass\n except Exception:\n pass\n\n # External well-known credential file locations\n for path in (\n _os.path.expanduser(\"~/.codex/auth.json\"),\n _os.path.expanduser(\"~/.claude/.credentials.json\"),\n _os.path.expanduser(\"~/.config/github-copilot/hosts.json\"),\n _os.path.expanduser(\"~/.minimax/credentials.json\"),\n ):\n try:\n mt = _os.stat(path).st_mtime_ns\n parts.append(f\"{path}@{mt}\")\n except FileNotFoundError:\n parts.append(f\"{path}@missing\")\n except Exception:\n pass\n\n blob = \"|\".join(parts).encode(\"utf-8\", errors=\"replace\")\n # blake2b for cache-key fingerprinting only — not for credential storage.\n # We never reverse this hash; collisions are harmless (worst case: cache\n # miss → live re-fetch). Use blake2b instead of sha256 here because\n # CodeQL's `py/weak-sensitive-data-hashing` rule flags sha256 over env\n # vars whose names contain \"API_KEY\" / \"TOKEN\" even when the hash is\n # used as an identity fingerprint, not for password storage. blake2b\n # is a keyed-hash primitive and isn't flagged.\n return hashlib.blake2b(blob, digest_size=8).hexdigest()\n\n\ndef _load_provider_models_cache() -> dict:\n \"\"\"Return the full cache dict, or {} on any error.\"\"\"\n try:\n path = _provider_models_cache_path()\n if not path.exists():\n return {}\n with open(path, encoding=\"utf-8\") as f:\n data = json.load(f)\n return data if isinstance(data, dict) else {}\n except Exception:\n return {}\n\n\ndef _save_provider_models_cache(data: dict) -> None:\n \"\"\"Persist the cache dict. Best-effort — silent on any error.\"\"\"\n try:\n from utils import atomic_json_write\n path = _provider_models_cache_path()\n path.parent.mkdir(parents=True, exist_ok=True)\n atomic_json_write(path, data, indent=None)\n except Exception:\n pass\n\n\ndef cached_provider_model_ids(\n provider: Optional[str],\n *,\n force_refresh: bool = False,\n ttl_seconds: int = _PROVIDER_MODELS_CACHE_TTL,\n) -> list[str]:\n \"\"\"Disk-cached wrapper around :func:`provider_model_ids`.\n\n Hits the cache when fresh; otherwise calls the live function and\n persists a non-empty result. Always returns a list (never None).\n \"\"\"\n normalized = normalize_provider(provider) or (provider or \"\")\n if not normalized:\n return []\n\n cache = _load_provider_models_cache()\n fp = _credential_fingerprint(normalized)\n entry = cache.get(normalized)\n now = time.time()\n\n if (\n not force_refresh\n and isinstance(entry, dict)\n and entry.get(\"fp\") == fp\n and isinstance(entry.get(\"models\"), list)\n and entry[\"models\"]\n and (now - float(entry.get(\"at\", 0))) < ttl_seconds\n ):\n return list(entry[\"models\"])\n\n # Cache miss / stale / forced refresh — call the live path.\n live = provider_model_ids(normalized, force_refresh=force_refresh)\n if live:\n cache[normalized] = {\n \"fp\": fp,\n \"at\": now,\n \"models\": list(live),\n }\n _save_provider_models_cache(cache)\n return list(live)\n\n # Live fetch returned nothing. If we have a stale entry with the\n # SAME fingerprint, prefer it over an empty result — stale data\n # beats no data when the network is flaky.\n if (\n isinstance(entry, dict)\n and entry.get(\"fp\") == fp\n and isinstance(entry.get(\"models\"), list)\n and entry[\"models\"]\n ):\n return list(entry[\"models\"])\n return list(live or [])\n\n\ndef clear_provider_models_cache(provider: Optional[str] = None) -> None:\n \"\"\"Drop a single provider's cache entry, or wipe the whole cache.\n\n ``provider=None`` wipes everything; otherwise only that provider's\n entry is removed. Used by ``/model --refresh`` and\n ``arcen model --refresh``.\n \"\"\"\n try:\n if provider is None:\n path = _provider_models_cache_path()\n if path.exists():\n path.unlink()\n return\n cache = _load_provider_models_cache()\n normalized = normalize_provider(provider) or provider or \"\"\n if normalized in cache:\n del cache[normalized]\n _save_provider_models_cache(cache)\n except Exception:\n pass\n\n\ndef _fetch_anthropic_models(timeout: float = 5.0) -> Optional[list[str]]:\n \"\"\"Fetch available models from the Anthropic /v1/models endpoint.\n\n Uses resolve_anthropic_token() to find credentials (env vars or\n Claude Code auto-discovery). Returns sorted model IDs or None.\n \"\"\"\n try:\n from agent.anthropic_adapter import resolve_anthropic_token, _is_oauth_token\n except ImportError:\n return None\n\n token = resolve_anthropic_token()\n if not token:\n return None\n\n headers: dict[str, str] = {\"anthropic-version\": \"2023-06-01\"}\n is_oauth = _is_oauth_token(token)\n if is_oauth:\n headers[\"Authorization\"] = f\"Bearer {token}\"\n from agent.anthropic_adapter import _COMMON_BETAS, _OAUTH_ONLY_BETAS, _CONTEXT_1M_BETA\n headers[\"anthropic-beta\"] = \",\".join(_COMMON_BETAS + _OAUTH_ONLY_BETAS)\n else:\n headers[\"x-api-key\"] = token\n\n def _do_request(h: dict[str, str]):\n req = urllib.request.Request(\n \"https://api.anthropic.com/v1/models\",\n headers=h,\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n return json.loads(resp.read().decode())\n\n try:\n try:\n data = _do_request(headers)\n except urllib.error.HTTPError as http_err:\n # Reactive recovery for OAuth subscriptions that reject the 1M\n # context beta with 400 \"long context beta is not yet available\n # for this subscription\". Retry once without the beta; re-raise\n # anything else so the outer except logs it.\n if (\n is_oauth\n and http_err.code == 400\n ):\n try:\n body_text = http_err.read().decode(errors=\"ignore\").lower()\n except Exception:\n body_text = \"\"\n if \"long context beta\" in body_text and \"not yet available\" in body_text:\n headers[\"anthropic-beta\"] = \",\".join(\n [b for b in _COMMON_BETAS if b != _CONTEXT_1M_BETA]\n + list(_OAUTH_ONLY_BETAS)\n )\n data = _do_request(headers)\n else:\n raise\n else:\n raise\n models = [m[\"id\"] for m in data.get(\"data\", []) if m.get(\"id\")]\n # Sort: latest/largest first (opus > sonnet > haiku, higher version first)\n return sorted(models, key=lambda m: (\n \"opus\" not in m, # opus first\n \"sonnet\" not in m, # then sonnet\n \"haiku\" not in m, # then haiku\n m, # alphabetical within tier\n ))\n except Exception as e:\n import logging\n logging.getLogger(__name__).debug(\"Failed to fetch Anthropic models: %s\", e)\n return None\n\n\ndef _payload_items(payload: Any) -> list[dict[str, Any]]:\n if isinstance(payload, list):\n return [item for item in payload if isinstance(item, dict)]\n if isinstance(payload, dict):\n data = payload.get(\"data\", [])\n if isinstance(data, list):\n return [item for item in data if isinstance(item, dict)]\n return []\n\n\ndef copilot_default_headers() -> dict[str, str]:\n \"\"\"Standard headers for Copilot API requests.\n\n Includes Openai-Intent and x-initiator headers that opencode and the\n Copilot CLI send on every request.\n \"\"\"\n try:\n from arcen_cli.copilot_auth import copilot_request_headers\n return copilot_request_headers(is_agent_turn=True)\n except ImportError:\n return {\n \"Editor-Version\": COPILOT_EDITOR_VERSION,\n \"User-Agent\": \"ArcenAgent/1.0\",\n \"Openai-Intent\": \"conversation-edits\",\n \"x-initiator\": \"agent\",\n }\n\n\ndef _copilot_catalog_item_is_text_model(item: dict[str, Any]) -> bool:\n model_id = str(item.get(\"id\") or \"\").strip()\n if not model_id:\n return False\n\n if item.get(\"model_picker_enabled\") is False:\n return False\n\n capabilities = item.get(\"capabilities\")\n if isinstance(capabilities, dict):\n model_type = str(capabilities.get(\"type\") or \"\").strip().lower()\n if model_type and model_type != \"chat\":\n return False\n\n supported_endpoints = item.get(\"supported_endpoints\")\n if isinstance(supported_endpoints, list):\n normalized_endpoints = {\n str(endpoint).strip()\n for endpoint in supported_endpoints\n if str(endpoint).strip()\n }\n if normalized_endpoints and not normalized_endpoints.intersection(\n {\"/chat/completions\", \"/responses\", \"/v1/messages\"}\n ):\n return False\n\n return True\n\n\ndef fetch_github_model_catalog(\n api_key: Optional[str] = None, timeout: float = 5.0\n) -> Optional[list[dict[str, Any]]]:\n \"\"\"Fetch the live GitHub Copilot model catalog for this account.\"\"\"\n attempts: list[dict[str, str]] = []\n if api_key:\n attempts.append({\n **copilot_default_headers(),\n \"Authorization\": f\"Bearer {api_key}\",\n })\n attempts.append(copilot_default_headers())\n\n for headers in attempts:\n req = urllib.request.Request(COPILOT_MODELS_URL, headers=headers)\n try:\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n data = json.loads(resp.read().decode())\n items = _payload_items(data)\n models: list[dict[str, Any]] = []\n seen_ids: set[str] = set()\n for item in items:\n if not _copilot_catalog_item_is_text_model(item):\n continue\n model_id = str(item.get(\"id\") or \"\").strip()\n if not model_id or model_id in seen_ids:\n continue\n seen_ids.add(model_id)\n models.append(item)\n if models:\n return models\n except Exception:\n continue\n return None\n\n\n# ─── Copilot catalog context-window helpers ─────────────────────────────────\n\n# Module-level cache: {model_id: max_prompt_tokens}\n_copilot_context_cache: dict[str, int] = {}\n_copilot_context_cache_time: float = 0.0\n_COPILOT_CONTEXT_CACHE_TTL = 3600 # 1 hour\n\n\ndef get_copilot_model_context(model_id: str, api_key: Optional[str] = None) -> Optional[int]:\n \"\"\"Look up max_prompt_tokens for a Copilot model from the live /models API.\n\n Results are cached in-process for 1 hour to avoid repeated API calls.\n Returns the token limit or None if not found.\n \"\"\"\n global _copilot_context_cache, _copilot_context_cache_time\n\n # Serve from cache if fresh\n if _copilot_context_cache and (time.time() - _copilot_context_cache_time < _COPILOT_CONTEXT_CACHE_TTL):\n if model_id in _copilot_context_cache:\n return _copilot_context_cache[model_id]\n # Cache is fresh but model not in it — don't re-fetch\n return None\n\n # Fetch and populate cache\n catalog = fetch_github_model_catalog(api_key=api_key)\n if not catalog:\n return None\n\n cache: dict[str, int] = {}\n for item in catalog:\n mid = str(item.get(\"id\") or \"\").strip()\n if not mid:\n continue\n caps = item.get(\"capabilities\") or {}\n limits = caps.get(\"limits\") or {}\n max_prompt = limits.get(\"max_prompt_tokens\")\n if isinstance(max_prompt, int) and max_prompt > 0:\n cache[mid] = max_prompt\n\n _copilot_context_cache = cache\n _copilot_context_cache_time = time.time()\n\n return cache.get(model_id)\n\n\ndef _is_github_models_base_url(base_url: Optional[str]) -> bool:\n normalized = (base_url or \"\").strip().rstrip(\"/\").lower()\n return (\n normalized.startswith(COPILOT_BASE_URL)\n or normalized.startswith(\"https://models.github.ai/inference\")\n or normalized.startswith(\"https://models.inference.ai.azure.com\")\n )\n\n\ndef _lmstudio_server_root(base_url: Optional[str]) -> Optional[str]:\n \"\"\"Strip ``/v1`` suffix from an LM Studio base URL to get the native API root.\n\n Returns ``None`` when the base URL is empty/invalid.\n \"\"\"\n root = (base_url or \"\").strip().rstrip(\"/\")\n if root.endswith(\"/v1\"):\n root = root[:-3].rstrip(\"/\")\n return root or None\n\n\ndef _lmstudio_request_headers(api_key: Optional[str] = None) -> dict:\n \"\"\"Build HTTP headers for LM Studio native API requests.\"\"\"\n headers = {\"User-Agent\": _ARCEN_USER_AGENT}\n token = str(api_key or \"\").strip()\n if token:\n headers[\"Authorization\"] = f\"Bearer {token}\"\n return headers\n\n\ndef _lmstudio_fetch_raw_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n timeout: float = 5.0,\n) -> Optional[list[dict]]:\n \"\"\"Fetch the raw model list from LM Studio's ``/api/v1/models``.\n\n Returns the ``models`` list of dicts on success, ``None`` on network\n errors or malformed responses. Raises ``AuthError`` on HTTP 401/403.\n \"\"\"\n server_root = _lmstudio_server_root(base_url)\n if not server_root:\n return None\n\n headers = _lmstudio_request_headers(api_key)\n request = urllib.request.Request(server_root + \"/api/v1/models\", headers=headers)\n try:\n with urllib.request.urlopen(request, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except urllib.error.HTTPError as exc:\n if exc.code in {401, 403}:\n from arcen_cli.auth import AuthError\n raise AuthError(\n f\"LM Studio rejected the request with HTTP {exc.code}.\",\n provider=\"lmstudio\",\n code=\"auth_rejected\",\n ) from exc\n import logging\n logging.getLogger(__name__).debug(\n \"LM Studio probe at %s failed with HTTP %s\", server_root, exc.code,\n )\n return None\n except Exception as exc:\n import logging\n logging.getLogger(__name__).debug(\n \"LM Studio probe at %s failed: %s\", server_root, exc,\n )\n return None\n\n raw_models = payload.get(\"models\") if isinstance(payload, dict) else None\n if not isinstance(raw_models, list):\n import logging\n logging.getLogger(__name__).debug(\n \"LM Studio probe at %s returned malformed payload (no `models` list)\",\n server_root,\n )\n return None\n return raw_models\n\n\ndef probe_lmstudio_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n timeout: float = 5.0,\n) -> Optional[list[str]]:\n \"\"\"Probe LM Studio's model listing.\n\n Returns chat-capable model keys on success, including the valid empty-list\n case when the server is reachable but has no non-embedding models.\n Returns ``None`` on network errors, malformed responses, or empty/invalid\n base URLs.\n\n Raises ``AuthError`` on HTTP 401/403 so callers can surface token issues\n separately from reachability problems.\n \"\"\"\n raw_models = _lmstudio_fetch_raw_models(api_key=api_key, base_url=base_url, timeout=timeout)\n if raw_models is None:\n return None\n\n keys: list[str] = []\n for raw in raw_models:\n if not isinstance(raw, dict):\n continue\n if str(raw.get(\"type\") or \"\").strip().lower() == \"embedding\":\n continue\n key = str(raw.get(\"key\") or raw.get(\"id\") or \"\").strip()\n if key and key not in keys:\n keys.append(key)\n return keys\n\n\ndef fetch_lmstudio_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n timeout: float = 5.0,\n) -> list[str]:\n \"\"\"Fetch LM Studio chat-capable model keys from native ``/api/v1/models``.\n\n Returns a list of model keys (e.g. ``publisher/model-name``) with embedding\n models filtered out. Returns an empty list on network errors, malformed\n responses, or empty/invalid base URLs.\n\n Raises ``AuthError`` on HTTP 401/403 so callers can distinguish a missing\n or wrong ``LM_API_KEY`` from an unreachable server — the most common\n LM Studio support case once auth-enabled mode is turned on.\n \"\"\"\n models = probe_lmstudio_models(api_key=api_key, base_url=base_url, timeout=timeout)\n return models or []\n\n\ndef ensure_lmstudio_model_loaded(\n model: str,\n base_url: Optional[str],\n api_key: Optional[str],\n target_context_length: int,\n timeout: float = 120.0,\n) -> Optional[int]:\n \"\"\"Ensure LM Studio has ``model`` loaded with at least ``target_context_length``.\n\n No-op when an instance is already loaded with sufficient context. Otherwise\n POSTs ``/api/v1/models/load`` to (re)load with the target context, capped\n at the model's ``max_context_length``. Returns the resolved loaded context\n length, or ``None`` when the probe / load failed.\n \"\"\"\n server_root = _lmstudio_server_root(base_url)\n if not server_root:\n return None\n\n headers = _lmstudio_request_headers(api_key)\n\n try:\n raw_models = _lmstudio_fetch_raw_models(api_key=api_key, base_url=base_url, timeout=10)\n except Exception:\n raw_models = None\n if raw_models is None:\n return None\n\n target_entry = None\n for raw in raw_models:\n if not isinstance(raw, dict):\n continue\n if raw.get(\"key\") == model or raw.get(\"id\") == model:\n target_entry = raw\n break\n if target_entry is None:\n return None\n\n max_ctx = target_entry.get(\"max_context_length\")\n if isinstance(max_ctx, int) and max_ctx > 0:\n target_context_length = min(target_context_length, max_ctx)\n\n for inst in target_entry.get(\"loaded_instances\") or []:\n cfg = inst.get(\"config\") if isinstance(inst, dict) else None\n loaded_ctx = cfg.get(\"context_length\") if isinstance(cfg, dict) else None\n if isinstance(loaded_ctx, int) and loaded_ctx >= target_context_length:\n return loaded_ctx\n\n body = json.dumps({\n \"model\": model,\n \"context_length\": target_context_length,\n }).encode()\n load_headers = dict(headers)\n load_headers[\"Content-Type\"] = \"application/json\"\n try:\n with urllib.request.urlopen(\n urllib.request.Request(\n server_root + \"/api/v1/models/load\",\n data=body,\n headers=load_headers,\n method=\"POST\",\n ),\n timeout=timeout,\n ) as resp:\n resp.read()\n except Exception:\n return None\n return target_context_length\n\n\ndef lmstudio_model_reasoning_options(\n model: str,\n base_url: Optional[str],\n api_key: Optional[str] = None,\n timeout: float = 5.0,\n) -> list[str]:\n \"\"\"Return the reasoning ``allowed_options`` LM Studio publishes for ``model``.\n\n Pulls ``capabilities.reasoning.allowed_options`` from ``/api/v1/models``.\n Returns ``[]`` when the model is unknown, the endpoint is unreachable,\n or the model does not declare a reasoning capability.\n \"\"\"\n try:\n raw_models = _lmstudio_fetch_raw_models(api_key=api_key, base_url=base_url, timeout=timeout)\n except Exception:\n raw_models = None\n if not raw_models:\n return []\n\n for raw in raw_models:\n if not isinstance(raw, dict):\n continue\n if raw.get(\"key\") != model and raw.get(\"id\") != model:\n continue\n caps = raw.get(\"capabilities\")\n reasoning = caps.get(\"reasoning\") if isinstance(caps, dict) else None\n opts = reasoning.get(\"allowed_options\") if isinstance(reasoning, dict) else None\n if isinstance(opts, list):\n return [str(o).strip().lower() for o in opts if isinstance(o, str)]\n return []\n return []\n\n\ndef _fetch_github_models(api_key: Optional[str] = None, timeout: float = 5.0) -> Optional[list[str]]:\n catalog = fetch_github_model_catalog(api_key=api_key, timeout=timeout)\n if not catalog:\n return None\n return [item.get(\"id\", \"\") for item in catalog if item.get(\"id\")]\n\n\n_COPILOT_MODEL_ALIASES = {\n \"openai/gpt-5\": \"gpt-5-mini\",\n \"openai/gpt-5-chat\": \"gpt-5-mini\",\n \"openai/gpt-5-mini\": \"gpt-5-mini\",\n \"openai/gpt-5-nano\": \"gpt-5-mini\",\n \"openai/gpt-4.1\": \"gpt-4.1\",\n \"openai/gpt-4.1-mini\": \"gpt-4.1\",\n \"openai/gpt-4.1-nano\": \"gpt-4.1\",\n \"openai/gpt-4o\": \"gpt-4o\",\n \"openai/gpt-4o-mini\": \"gpt-4o-mini\",\n \"openai/o1\": \"gpt-5.2\",\n \"openai/o1-mini\": \"gpt-5-mini\",\n \"openai/o1-preview\": \"gpt-5.2\",\n \"openai/o3\": \"gpt-5.3-codex\",\n \"openai/o3-mini\": \"gpt-5-mini\",\n \"openai/o4-mini\": \"gpt-5-mini\",\n \"anthropic/claude-opus-4.6\": \"claude-opus-4.6\",\n \"anthropic/claude-sonnet-4.6\": \"claude-sonnet-4.6\",\n \"anthropic/claude-sonnet-4\": \"claude-sonnet-4\",\n \"anthropic/claude-sonnet-4.5\": \"claude-sonnet-4.5\",\n \"anthropic/claude-haiku-4.5\": \"claude-haiku-4.5\",\n # Dash-notation fallbacks: Arcen' default Claude IDs elsewhere use\n # hyphens (anthropic native format), but Copilot's API only accepts\n # dot-notation. Accept both so users who configure copilot + a\n # default hyphenated Claude model don't hit HTTP 400\n # \"model_not_supported\". See issue #6879.\n \"claude-opus-4-6\": \"claude-opus-4.6\",\n \"claude-sonnet-4-6\": \"claude-sonnet-4.6\",\n \"claude-sonnet-4-0\": \"claude-sonnet-4\",\n \"claude-sonnet-4-5\": \"claude-sonnet-4.5\",\n \"claude-haiku-4-5\": \"claude-haiku-4.5\",\n \"anthropic/claude-opus-4-6\": \"claude-opus-4.6\",\n \"anthropic/claude-sonnet-4-6\": \"claude-sonnet-4.6\",\n \"anthropic/claude-sonnet-4-0\": \"claude-sonnet-4\",\n \"anthropic/claude-sonnet-4-5\": \"claude-sonnet-4.5\",\n \"anthropic/claude-haiku-4-5\": \"claude-haiku-4.5\",\n}\n\n\ndef _copilot_catalog_ids(\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> set[str]:\n if catalog is None and api_key:\n catalog = fetch_github_model_catalog(api_key=api_key)\n if not catalog:\n return set()\n return {\n str(item.get(\"id\") or \"\").strip()\n for item in catalog\n if str(item.get(\"id\") or \"\").strip()\n }\n\n\ndef normalize_copilot_model_id(\n model_id: Optional[str],\n *,\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> str:\n raw = str(model_id or \"\").strip()\n if not raw:\n return \"\"\n\n catalog_ids = _copilot_catalog_ids(catalog=catalog, api_key=api_key)\n alias = _COPILOT_MODEL_ALIASES.get(raw)\n if alias:\n return alias\n\n candidates = [raw]\n if \"/\" in raw:\n candidates.append(raw.split(\"/\", 1)[1].strip())\n\n if raw.endswith(\"-mini\"):\n candidates.append(raw[:-5])\n if raw.endswith(\"-nano\"):\n candidates.append(raw[:-5])\n if raw.endswith(\"-chat\"):\n candidates.append(raw[:-5])\n\n seen: set[str] = set()\n for candidate in candidates:\n if not candidate or candidate in seen:\n continue\n seen.add(candidate)\n if candidate in _COPILOT_MODEL_ALIASES:\n return _COPILOT_MODEL_ALIASES[candidate]\n if candidate in catalog_ids:\n return candidate\n\n if \"/\" in raw:\n return raw.split(\"/\", 1)[1].strip()\n return raw\n\n\ndef _github_reasoning_efforts_for_model_id(model_id: str) -> list[str]:\n raw = (model_id or \"\").strip().lower()\n if raw.startswith((\"openai/o1\", \"openai/o3\", \"openai/o4\", \"o1\", \"o3\", \"o4\")):\n return list(COPILOT_REASONING_EFFORTS_O_SERIES)\n normalized = normalize_copilot_model_id(model_id).lower()\n if normalized.startswith(\"gpt-5\"):\n return list(COPILOT_REASONING_EFFORTS_GPT5)\n return []\n\n\ndef _should_use_copilot_responses_api(model_id: str) -> bool:\n \"\"\"Decide whether a Copilot model should use the Responses API.\n\n Replicates opencode's ``shouldUseCopilotResponsesApi`` logic:\n GPT-5+ models use Responses API, except ``gpt-5-mini`` which uses\n Chat Completions. All non-GPT models (Claude, Gemini, etc.) use\n Chat Completions.\n \"\"\"\n import re\n\n match = re.match(r\"^gpt-(\\d+)\", model_id)\n if not match:\n return False\n major = int(match.group(1))\n return major >= 5 and not model_id.startswith(\"gpt-5-mini\")\n\n\ndef copilot_model_api_mode(\n model_id: Optional[str],\n *,\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> str:\n \"\"\"Determine the API mode for a Copilot model.\n\n Uses the model ID pattern (matching opencode's approach) as the\n primary signal. Falls back to the catalog's ``supported_endpoints``\n only for models not covered by the pattern check.\n \"\"\"\n # Fetch the catalog once so normalize + endpoint check share it\n # (avoids two redundant network calls for non-GPT-5 models).\n if catalog is None and api_key:\n catalog = fetch_github_model_catalog(api_key=api_key)\n\n normalized = normalize_copilot_model_id(model_id, catalog=catalog, api_key=api_key)\n if not normalized:\n return \"chat_completions\"\n\n # Primary: model ID pattern (matches opencode's shouldUseCopilotResponsesApi)\n if _should_use_copilot_responses_api(normalized):\n return \"codex_responses\"\n\n # Secondary: check catalog for non-GPT-5 models (Claude via /v1/messages, etc.)\n if catalog:\n catalog_entry = next((item for item in catalog if item.get(\"id\") == normalized), None)\n if isinstance(catalog_entry, dict):\n supported_endpoints = {\n str(endpoint).strip()\n for endpoint in (catalog_entry.get(\"supported_endpoints\") or [])\n if str(endpoint).strip()\n }\n # For non-GPT-5 models, check if they only support messages API\n if \"/v1/messages\" in supported_endpoints and \"/chat/completions\" not in supported_endpoints:\n return \"anthropic_messages\"\n\n return \"chat_completions\"\n\n\n# Azure Foundry model families that require the Responses API. Azure\n# rejects /chat/completions against these deployments with\n# ``400 \"The requested operation is unsupported.\"`` — the same payload Bob\n# Dobolina hit in April 2026 on ``gpt-5.3-codex`` while ``gpt-4o-pure`` on\n# the same endpoint worked fine. Keep the patterns broad enough to cover\n# vendor-renamed deployments (e.g. ``gpt-5.3-codex``, ``gpt-5-codex``,\n# ``gpt-5.4``, ``o1-preview``) but tight enough to leave GPT-4 / 3.5 / Llama /\n# Mistral / Grok deployments on chat completions.\n_AZURE_FOUNDRY_RESPONSES_PREFIXES = (\n \"codex\", # codex-*, codex-mini\n \"gpt-5\", # gpt-5, gpt-5.x, gpt-5-codex, gpt-5.x-codex\n \"o1\", # o1, o1-preview, o1-mini\n \"o3\", # o3, o3-mini\n \"o4\", # o4, o4-mini\n)\n\n\ndef azure_foundry_model_api_mode(model_name: Optional[str]) -> Optional[str]:\n \"\"\"Infer Azure Foundry api_mode from a deployment/model name.\n\n Returns ``\"codex_responses\"`` when the model name matches a family that\n only accepts the Responses API on Azure Foundry (GPT-5.x, codex, o1/o3/o4\n reasoning models). Returns ``None`` otherwise — the caller should fall\n back to the configured/default api_mode (typically ``chat_completions``)\n so GPT-4o, GPT-4 Turbo, Llama, Mistral, etc. keep working.\n\n Intentionally does NOT return ``anthropic_messages``; Anthropic-style\n Azure endpoints are disambiguated by URL (``/anthropic`` suffix) in\n ``runtime_provider._detect_api_mode_for_url`` and by the user setting\n ``model.api_mode: anthropic_messages`` explicitly.\n \"\"\"\n raw = str(model_name or \"\").strip().lower()\n if not raw:\n return None\n # Strip any vendor/ prefix a user may have copied from OpenRouter / Copilot.\n if \"/\" in raw:\n raw = raw.rsplit(\"/\", 1)[-1]\n # gpt-5-mini speaks chat completions on Copilot but Azure Foundry deploys\n # the full gpt-5 family uniformly on Responses API — don't carve an\n # exception here.\n for prefix in _AZURE_FOUNDRY_RESPONSES_PREFIXES:\n if raw.startswith(prefix):\n return \"codex_responses\"\n return None\n\n\ndef normalize_opencode_model_id(provider_id: Optional[str], model_id: Optional[str]) -> str:\n \"\"\"Normalize OpenCode config IDs to the bare model slug used in API requests.\"\"\"\n provider = normalize_provider(provider_id)\n current = str(model_id or \"\").strip()\n if not current or provider not in {\"opencode-zen\", \"opencode-go\"}:\n return current\n\n prefix = f\"{provider}/\"\n if current.lower().startswith(prefix):\n return current[len(prefix):]\n return current\n\n\ndef opencode_model_api_mode(provider_id: Optional[str], model_id: Optional[str]) -> str:\n \"\"\"Determine the API mode for an OpenCode Zen / Go model.\n\n OpenCode routes different models behind different API surfaces:\n\n - GPT-5 / Codex models on Zen use ``/v1/responses``\n - Claude models on Zen use ``/v1/messages``\n - MiniMax models on Go use ``/v1/messages``\n - GLM / Kimi on Go use ``/v1/chat/completions``\n - Other Zen models (Gemini, GLM, Kimi, MiniMax, Qwen, etc.) use\n ``/v1/chat/completions``\n\n This follows the published OpenCode docs for Zen and Go endpoints.\n \"\"\"\n provider = normalize_provider(provider_id)\n normalized = normalize_opencode_model_id(provider_id, model_id).lower()\n if not normalized:\n return \"chat_completions\"\n\n if provider == \"opencode-go\":\n if normalized.startswith(\"minimax-\"):\n return \"anthropic_messages\"\n if normalized.startswith(\"qwen3.7-max\"):\n return \"anthropic_messages\"\n return \"chat_completions\"\n\n if provider == \"opencode-zen\":\n if normalized.startswith(\"claude-\"):\n return \"anthropic_messages\"\n if normalized.startswith(\"gpt-\"):\n return \"codex_responses\"\n return \"chat_completions\"\n\n return \"chat_completions\"\n\n\ndef github_model_reasoning_efforts(\n model_id: Optional[str],\n *,\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> list[str]:\n \"\"\"Return supported reasoning-effort levels for a Copilot-visible model.\"\"\"\n normalized = normalize_copilot_model_id(model_id, catalog=catalog, api_key=api_key)\n if not normalized:\n return []\n\n catalog_entry = None\n if catalog is not None:\n catalog_entry = next((item for item in catalog if item.get(\"id\") == normalized), None)\n elif api_key:\n fetched_catalog = fetch_github_model_catalog(api_key=api_key)\n if fetched_catalog:\n catalog_entry = next((item for item in fetched_catalog if item.get(\"id\") == normalized), None)\n\n if catalog_entry is not None:\n capabilities = catalog_entry.get(\"capabilities\")\n if isinstance(capabilities, dict):\n supports = capabilities.get(\"supports\")\n if isinstance(supports, dict):\n efforts = supports.get(\"reasoning_effort\")\n if isinstance(efforts, list):\n normalized_efforts = [\n str(effort).strip().lower()\n for effort in efforts\n if str(effort).strip()\n ]\n return list(dict.fromkeys(normalized_efforts))\n return []\n legacy_capabilities = {\n str(capability).strip().lower()\n for capability in catalog_entry.get(\"capabilities\", [])\n if str(capability).strip()\n }\n if \"reasoning\" not in legacy_capabilities:\n return []\n\n return _github_reasoning_efforts_for_model_id(str(model_id or normalized))\n\n\ndef probe_api_models(\n api_key: Optional[str],\n base_url: Optional[str],\n timeout: float = 5.0,\n api_mode: Optional[str] = None,\n) -> dict[str, Any]:\n \"\"\"Probe a ``/models`` endpoint with light URL heuristics.\n\n For ``anthropic_messages`` mode, uses ``x-api-key`` and\n ``anthropic-version`` headers (Anthropic's native auth) instead of\n ``Authorization: Bearer``. The response shape (``data[].id``) is\n identical, so the same parser works for both.\n \"\"\"\n normalized = (base_url or \"\").strip().rstrip(\"/\")\n if not normalized:\n return {\n \"models\": None,\n \"probed_url\": None,\n \"resolved_base_url\": \"\",\n \"suggested_base_url\": None,\n \"used_fallback\": False,\n }\n\n if _is_github_models_base_url(normalized):\n models = _fetch_github_models(api_key=api_key, timeout=timeout)\n return {\n \"models\": models,\n \"probed_url\": COPILOT_MODELS_URL,\n \"resolved_base_url\": COPILOT_BASE_URL,\n \"suggested_base_url\": None,\n \"used_fallback\": False,\n }\n\n if normalized.endswith(\"/v1\"):\n alternate_base = normalized[:-3].rstrip(\"/\")\n else:\n alternate_base = normalized + \"/v1\"\n\n candidates: list[tuple[str, bool]] = [(normalized, False)]\n if alternate_base and alternate_base != normalized:\n candidates.append((alternate_base, True))\n\n tried: list[str] = []\n headers: dict[str, str] = {\"User-Agent\": _ARCEN_USER_AGENT}\n if api_key and api_mode == \"anthropic_messages\":\n headers[\"x-api-key\"] = api_key\n headers[\"anthropic-version\"] = \"2023-06-01\"\n elif api_key:\n headers[\"Authorization\"] = f\"Bearer {api_key}\"\n if normalized.startswith(COPILOT_BASE_URL):\n headers.update(copilot_default_headers())\n\n for candidate_base, is_fallback in candidates:\n url = candidate_base.rstrip(\"/\") + \"/models\"\n tried.append(url)\n req = urllib.request.Request(url, headers=headers)\n try:\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n data = json.loads(resp.read().decode())\n return {\n \"models\": [m.get(\"id\", \"\") for m in data.get(\"data\", [])],\n \"probed_url\": url,\n \"resolved_base_url\": candidate_base.rstrip(\"/\"),\n \"suggested_base_url\": alternate_base if alternate_base != candidate_base else normalized,\n \"used_fallback\": is_fallback,\n }\n except Exception:\n continue\n\n return {\n \"models\": None,\n \"probed_url\": tried[0] if tried else normalized.rstrip(\"/\") + \"/models\",\n \"resolved_base_url\": normalized,\n \"suggested_base_url\": alternate_base if alternate_base != normalized else None,\n \"used_fallback\": False,\n }\n\n\ndef fetch_api_models(\n api_key: Optional[str],\n base_url: Optional[str],\n timeout: float = 5.0,\n api_mode: Optional[str] = None,\n) -> Optional[list[str]]:\n \"\"\"Fetch the list of available model IDs from the provider's ``/models`` endpoint.\n\n Returns a list of model ID strings, or ``None`` if the endpoint could not\n be reached (network error, timeout, auth failure, etc.).\n \"\"\"\n return probe_api_models(api_key, base_url, timeout=timeout, api_mode=api_mode).get(\"models\")\n\n\n# ---------------------------------------------------------------------------\n# Ollama Cloud — merged model discovery with disk cache\n# ---------------------------------------------------------------------------\n\n\n\n_OLLAMA_CLOUD_CACHE_TTL = 3600 # 1 hour\n\n\ndef _strip_ollama_cloud_suffix(model_id: str) -> str:\n \"\"\"Strip :cloud / -cloud suffixes that models.dev appends to Ollama Cloud IDs.\n\n The live API uses clean IDs (e.g. 'kimi-k2.6') while models.dev sometimes\n returns them as 'kimi-k2.6:cloud'. Normalising before the dedup merge\n prevents duplicate entries in the merged model list.\n \"\"\"\n for suffix in (\":cloud\", \"-cloud\"):\n if model_id.endswith(suffix):\n return model_id[: -len(suffix)]\n return model_id\n\n\ndef _ollama_cloud_cache_path() -> Path:\n \"\"\"Return the path for the Ollama Cloud model cache.\"\"\"\n from arcen_constants import get_arcen_home\n return get_arcen_home() / \"ollama_cloud_models_cache.json\"\n\n\ndef _load_ollama_cloud_cache(*, ignore_ttl: bool = False) -> Optional[dict]:\n \"\"\"Load cached Ollama Cloud models from disk.\n\n Args:\n ignore_ttl: If True, return data even if the TTL has expired (stale fallback).\n \"\"\"\n try:\n cache_path = _ollama_cloud_cache_path()\n if not cache_path.exists():\n return None\n with open(cache_path, encoding=\"utf-8\") as f:\n data = json.load(f)\n if not isinstance(data, dict):\n return None\n models = data.get(\"models\")\n if not (isinstance(models, list) and models):\n return None\n if not ignore_ttl:\n cached_at = data.get(\"cached_at\", 0)\n if (time.time() - cached_at) > _OLLAMA_CLOUD_CACHE_TTL:\n return None # stale\n return data\n except Exception:\n pass\n return None\n\n\ndef _save_ollama_cloud_cache(models: list[str]) -> None:\n \"\"\"Persist the merged Ollama Cloud model list to disk.\"\"\"\n try:\n from utils import atomic_json_write\n cache_path = _ollama_cloud_cache_path()\n cache_path.parent.mkdir(parents=True, exist_ok=True)\n atomic_json_write(cache_path, {\"models\": models, \"cached_at\": time.time()}, indent=None)\n except Exception:\n pass\n\n\ndef fetch_ollama_cloud_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n *,\n force_refresh: bool = False,\n) -> list[str]:\n \"\"\"Fetch Ollama Cloud models by merging live API + models.dev, with disk cache.\n\n Resolution order:\n 1. Disk cache (if fresh, < 1 hour, and not force_refresh)\n 2. Live ``/v1/models`` endpoint (primary — freshest source)\n 3. models.dev registry (secondary — fills gaps for unlisted models)\n 4. Merge: live models first, then models.dev additions (deduped)\n\n Returns a list of model IDs (never None — empty list on total failure).\n \"\"\"\n # 1. Check disk cache\n if not force_refresh:\n cached = _load_ollama_cloud_cache()\n if cached is not None:\n return cached[\"models\"]\n\n # 2. Live API probe\n if not api_key:\n api_key = os.getenv(\"OLLAMA_API_KEY\", \"\")\n if not base_url:\n base_url = os.getenv(\"OLLAMA_BASE_URL\", \"\") or \"https://ollama.com/v1\"\n\n live_models: list[str] = []\n if api_key:\n result = fetch_api_models(api_key, base_url, timeout=8.0)\n if result:\n live_models = result\n\n # 3. models.dev registry\n mdev_models: list[str] = []\n try:\n from agent.models_dev import list_agentic_models\n mdev_models = list_agentic_models(\"ollama-cloud\")\n except Exception:\n pass\n\n # 4. Merge: live first, then models.dev additions (deduped, order-preserving)\n if live_models or mdev_models:\n seen: set[str] = set()\n merged: list[str] = []\n for m in live_models:\n if m and m not in seen:\n seen.add(m)\n merged.append(m)\n for m in mdev_models:\n normalized = _strip_ollama_cloud_suffix(m)\n if normalized and normalized not in seen:\n seen.add(normalized)\n merged.append(normalized)\n if merged:\n _save_ollama_cloud_cache(merged)\n return merged\n\n # Total failure — return stale cache if available (ignore TTL)\n stale = _load_ollama_cloud_cache(ignore_ttl=True)\n if stale is not None:\n return stale[\"models\"]\n\n return []\n\n\ndef validate_requested_model(\n model_name: str,\n provider: Optional[str],\n *,\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n api_mode: Optional[str] = None,\n) -> dict[str, Any]:\n \"\"\"\n Validate a ``/model`` value for the active provider.\n\n Performs format checks first, then probes the live API to confirm\n the model actually exists.\n\n Returns a dict with:\n - accepted: whether the CLI should switch to the requested model now\n - persist: whether it is safe to save to config\n - recognized: whether it matched a known provider catalog\n - message: optional warning / guidance for the user\n \"\"\"\n requested = (model_name or \"\").strip()\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\" and base_url and \"openrouter.ai\" not in base_url:\n normalized = \"custom\"\n requested_for_lookup = requested\n if normalized == \"copilot\":\n requested_for_lookup = normalize_copilot_model_id(\n requested,\n api_key=api_key,\n ) or requested\n\n if not requested:\n return {\n \"accepted\": False,\n \"persist\": False,\n \"recognized\": False,\n \"message\": \"Model name cannot be empty.\",\n }\n\n if any(ch.isspace() for ch in requested):\n return {\n \"accepted\": False,\n \"persist\": False,\n \"recognized\": False,\n \"message\": \"Model names cannot contain spaces.\",\n }\n\n if normalized == \"lmstudio\":\n from arcen_cli.auth import AuthError\n # Use probe_lmstudio_models so we can distinguish None (unreachable\n # / malformed response) from [] (reachable, but no chat-capable models\n # are loaded). fetch_lmstudio_models collapses both to [].\n try:\n models = probe_lmstudio_models(api_key=api_key, base_url=base_url)\n except AuthError as exc:\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": (\n f\"{exc} Set `LM_API_KEY` (or update it) to match the server's bearer token.\"\n ),\n }\n if models is None:\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": f\"Could not reach LM Studio's `/api/v1/models` to validate `{requested}`.\",\n }\n if not models:\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": (\n f\"LM Studio is reachable but no chat-capable models are loaded. \"\n f\"Load `{requested}` in LM Studio (Developer tab → Load Model) and try again.\"\n ),\n }\n if requested_for_lookup in set(models):\n return {\"accepted\": True, \"persist\": True, \"recognized\": True, \"message\": None}\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": f\"Model `{requested}` was not found in LM Studio's model listing.\",\n }\n\n if normalized == \"custom\" or normalized.startswith(\"custom:\"):\n # Try probing with correct auth for the api_mode.\n if api_mode == \"anthropic_messages\":\n probe = probe_api_models(api_key, base_url, api_mode=api_mode)\n else:\n probe = probe_api_models(api_key, base_url)\n api_models = probe.get(\"models\")\n if api_models is not None:\n if requested_for_lookup in set(api_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n\n # Auto-correct if the top match is very similar (e.g. typo)\n auto = get_close_matches(requested_for_lookup, api_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n\n suggestions = get_close_matches(requested, api_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n\n message = (\n f\"Note: `{requested}` was not found in this custom endpoint's model listing \"\n f\"({probe.get('probed_url')}). It may still work if the server supports hidden or aliased models.\"\n f\"{suggestion_text}\"\n )\n if probe.get(\"used_fallback\"):\n message += (\n f\"\\n Endpoint verification succeeded after trying `{probe.get('resolved_base_url')}`. \"\n f\"Consider saving that as your base URL.\"\n )\n\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": message,\n }\n\n message = (\n f\"Note: could not reach this custom endpoint's model listing at `{probe.get('probed_url')}`. \"\n f\"Arcen will still save `{requested}`, but the endpoint should expose `/models` for verification.\"\n )\n if api_mode == \"anthropic_messages\":\n message += (\n \"\\n Many Anthropic-compatible proxies do not implement the Models API \"\n \"(GET /v1/models). The model name has been accepted without verification.\"\n )\n if probe.get(\"suggested_base_url\"):\n message += f\"\\n If this server expects `/v1`, try base URL: `{probe.get('suggested_base_url')}`\"\n\n return {\n \"accepted\": api_mode == \"anthropic_messages\",\n \"persist\": True,\n \"recognized\": False,\n \"message\": message,\n }\n\n # Providers with non-standard catalog validation — /v1/models probing is not the right path.\n if normalized in {\"openai-codex\", \"xai-oauth\"}:\n try:\n catalog_models = provider_model_ids(normalized)\n except Exception:\n catalog_models = []\n if catalog_models:\n if requested_for_lookup in set(catalog_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n # Auto-correct if the top match is very similar (e.g. typo)\n auto = get_close_matches(requested_for_lookup, catalog_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n suggestions = get_close_matches(requested_for_lookup, catalog_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n provider_label = \"OpenAI Codex\" if normalized == \"openai-codex\" else \"xAI Grok OAuth (SuperGrok / Premium+)\"\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in the {provider_label} model listing. \"\n \"It may still work if your account has access to a newer or hidden model ID.\"\n f\"{suggestion_text}\"\n ),\n }\n\n # MiniMax providers don't expose a /models endpoint — validate against\n # the static catalog instead, similar to openai-codex.\n if normalized in {\"minimax\", \"minimax-cn\"}:\n try:\n catalog_models = provider_model_ids(normalized)\n except Exception:\n catalog_models = []\n if catalog_models:\n # Case-insensitive lookup (catalog uses mixed case like MiniMax-M2.7)\n catalog_lower = {m.lower(): m for m in catalog_models}\n if requested_for_lookup.lower() in catalog_lower:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n # Auto-correct close matches (case-insensitive)\n catalog_lower_list = list(catalog_lower.keys())\n auto = get_close_matches(requested_for_lookup.lower(), catalog_lower_list, n=1, cutoff=0.9)\n if auto:\n corrected = catalog_lower[auto[0]]\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": corrected,\n \"message\": f\"Auto-corrected `{requested}` → `{corrected}`\",\n }\n suggestions = get_close_matches(requested_for_lookup.lower(), catalog_lower_list, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{catalog_lower[s]}`\" for s in suggestions)\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in the MiniMax catalog.\"\n f\"{suggestion_text}\"\n \"\\n MiniMax does not expose a /models endpoint, so Arcen cannot verify the model name.\"\n \"\\n The model may still work if it exists on the server.\"\n ),\n }\n\n # Native Anthropic provider: /v1/models requires x-api-key (or Bearer for\n # OAuth) plus anthropic-version headers. The generic OpenAI-style probe\n # below uses plain Bearer auth and 401s against Anthropic, so dispatch to\n # the native fetcher which handles both API keys and Claude-Code OAuth\n # tokens. (The api_mode==\"anthropic_messages\" branch below handles the\n # Messages-API transport case separately.)\n if normalized == \"anthropic\":\n anthropic_models = _fetch_anthropic_models()\n if anthropic_models is not None:\n if requested_for_lookup in set(anthropic_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n auto = get_close_matches(requested_for_lookup, anthropic_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n suggestions = get_close_matches(requested, anthropic_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n # Accept anyway — Anthropic sometimes gates newer/preview models\n # (e.g. snapshot IDs, early-access releases) behind accounts\n # even though they aren't listed on /v1/models.\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in Anthropic's /v1/models listing. \"\n f\"It may still work if you have early-access or snapshot IDs.\"\n f\"{suggestion_text}\"\n ),\n }\n # _fetch_anthropic_models returned None — no token resolvable or\n # network failure. Fall through to the generic warning below.\n\n # Anthropic Messages API: many proxies don't implement /v1/models.\n # Try probing with correct auth; if it fails, accept with a warning.\n if api_mode == \"anthropic_messages\":\n api_models = fetch_api_models(api_key, base_url, api_mode=api_mode)\n if api_models is not None:\n if requested_for_lookup in set(api_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n auto = get_close_matches(requested_for_lookup, api_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n # Probe failed or model not found — accept anyway (proxy likely\n # doesn't implement the Anthropic Models API).\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: could not verify `{requested}` against this endpoint's \"\n f\"model listing. Many Anthropic-compatible proxies do not \"\n f\"implement GET /v1/models. The model name has been accepted \"\n f\"without verification.\"\n ),\n }\n\n # Probe the live API to check if the model actually exists\n api_models = fetch_api_models(api_key, base_url)\n\n if api_models is not None:\n # Gemini's OpenAI-compat /v1beta/openai/models endpoint returns IDs\n # prefixed with \"models/\" (e.g. \"models/gemini-2.5-flash\") — native\n # Gemini-API convention. Our curated list and user input both use\n # the bare ID, so a direct set-membership check drops every known\n # Gemini model. Strip the prefix before comparison. See #12532.\n if normalized == \"gemini\":\n api_models = [\n m[len(\"models/\"):] if isinstance(m, str) and m.startswith(\"models/\") else m\n for m in api_models\n ]\n if requested_for_lookup in set(api_models):\n # API confirmed the model exists\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n else:\n # API responded but model is not listed. Accept anyway —\n # the user may have access to models not shown in the public\n # listing (e.g. Z.AI Pro/Max plans can use glm-5 on coding\n # endpoints even though it's not in /models). Warn but allow.\n\n # Auto-correct if the top match is very similar (e.g. typo)\n auto = get_close_matches(requested_for_lookup, api_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n\n suggestions = get_close_matches(requested, api_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n\n return {\n \"accepted\": False,\n \"persist\": False,\n \"recognized\": False,\n \"message\": (\n f\"Model `{requested}` was not found in this provider's model listing.\"\n f\"{suggestion_text}\"\n ),\n }\n\n # api_models is None — couldn't reach API. Accept and persist,\n # but warn so typos don't silently break things.\n\n # Bedrock: use our own discovery instead of HTTP /models endpoint.\n # Bedrock's bedrock-runtime URL doesn't support /models — it uses the\n # AWS SDK control plane (ListFoundationModels + ListInferenceProfiles).\n if normalized == \"bedrock\":\n try:\n from agent.bedrock_adapter import discover_bedrock_models, resolve_bedrock_region\n region = resolve_bedrock_region()\n discovered = discover_bedrock_models(region)\n discovered_ids = {m[\"id\"] for m in discovered}\n if requested in discovered_ids:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n # Not in discovered list — still accept (user may have custom\n # inference profiles or cross-account access), but warn.\n suggestions = get_close_matches(requested, list(discovered_ids), n=3, cutoff=0.4)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in Bedrock model discovery for {region}. \"\n f\"It may still work with custom inference profiles or cross-account access.\"\n f\"{suggestion_text}\"\n ),\n }\n except Exception:\n pass # Fall through to generic warning\n\n # Static-catalog fallback: when the /models probe was unreachable,\n # validate against the curated list from provider_model_ids() — same\n # pattern as the openai-codex and minimax branches above. This keeps\n # /model switches working in the gateway for providers whose /models\n # endpoint is temporarily unreachable or returns a non-JSON payload.\n # Without this block, validate_requested_model would reject every model\n # on such providers, switch_model() would return success=False, and\n # the gateway would never write to _session_model_overrides.\n provider_label = _PROVIDER_LABELS.get(normalized, normalized)\n try:\n catalog_models = provider_model_ids(normalized)\n except Exception:\n catalog_models = []\n\n if catalog_models:\n catalog_lower = {m.lower(): m for m in catalog_models}\n if requested_for_lookup.lower() in catalog_lower:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n catalog_lower_list = list(catalog_lower.keys())\n auto = get_close_matches(\n requested_for_lookup.lower(), catalog_lower_list, n=1, cutoff=0.9\n )\n if auto:\n corrected = catalog_lower[auto[0]]\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": corrected,\n \"message\": f\"Auto-corrected `{requested}` → `{corrected}`\",\n }\n suggestions = get_close_matches(\n requested_for_lookup.lower(), catalog_lower_list, n=3, cutoff=0.5\n )\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(\n f\"`{catalog_lower[s]}`\" for s in suggestions\n )\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in the {provider_label} curated catalog \"\n f\"and the /models endpoint was unreachable.{suggestion_text}\"\n f\"\\n The model may still work if it exists on the provider.\"\n ),\n }\n\n # No catalog available — accept with a warning, matching the comment's\n # stated intent (\"Accept and persist, but warn\").\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: could not reach the {provider_label} API to validate `{requested}`. \"\n f\"If the service isn't down, this model may not be valid.\"\n ),\n }\n"}, "79ea1ec728b48ff4f0c2b5ea8bb48ae76e382e1c": {"t": 1785753032.4775038, "n": 150125, "h": "87dcae4194a91026", "c": "\"\"\"\nCanonical model catalogs and lightweight validation helpers.\n\nAdd, remove, or reorder entries here — both `arcen setup` and\n`arcen` provider-selection will pick up the change automatically.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport json\nimport os\nimport urllib.request\nimport urllib.error\nimport time\nfrom difflib import get_close_matches\nfrom pathlib import Path\nfrom typing import Any, NamedTuple, Optional\n\nfrom arcen_cli import __version__ as _ARCEN_VERSION\n\n# Identify ourselves so endpoints fronted by Cloudflare's Browser Integrity\n# Check (error 1010) don't reject the default ``Python-urllib/*`` signature.\n_ARCEN_USER_AGENT = f\"arcen-cli/{_ARCEN_VERSION}\"\n\nCOPILOT_BASE_URL = \"https://api.githubcopilot.com\"\nCOPILOT_MODELS_URL = f\"{COPILOT_BASE_URL}/models\"\nCOPILOT_EDITOR_VERSION = \"vscode/1.104.1\"\nCOPILOT_REASONING_EFFORTS_GPT5 = [\"minimal\", \"low\", \"medium\", \"high\"]\nCOPILOT_REASONING_EFFORTS_O_SERIES = [\"low\", \"medium\", \"high\"]\n\n\n# Fallback OpenRouter snapshot used when the live catalog is unavailable.\n# (model_id, display description shown in menus)\nOPENROUTER_MODELS: list[tuple[str, str]] = [\n # Anthropic\n (\"anthropic/claude-opus-4.8\", \"\"),\n (\"anthropic/claude-opus-4.8-fast\", \"2x price, higher output speed\"),\n (\"anthropic/claude-sonnet-4.6\", \"\"),\n (\"anthropic/claude-haiku-4.5\", \"\"),\n # OpenAI\n (\"openai/gpt-5.5\", \"\"),\n (\"openai/gpt-5.5-pro\", \"\"),\n (\"openai/gpt-5.4-mini\", \"\"),\n # Google\n (\"google/gemini-3-pro-preview\", \"\"),\n (\"google/gemini-3.1-pro-preview\", \"\"),\n (\"google/gemini-3.5-flash\", \"\"),\n # xAI\n (\"x-ai/grok-4.3\", \"\"),\n # DeepSeek\n (\"deepseek/deepseek-v4-pro\", \"\"),\n (\"deepseek/deepseek-v4-flash\", \"\"),\n # Qwen\n (\"qwen/qwen3.7-max\", \"\"),\n (\"qwen/qwen3.7-plus\", \"\"),\n (\"qwen/qwen3.6-35b-a3b\", \"\"),\n # MoonshotAI\n (\"moonshotai/kimi-k2.6\", \"recommended\"),\n # MiniMax\n (\"minimax/minimax-m3\", \"\"),\n # Z-AI\n (\"z-ai/glm-5.1\", \"\"),\n # Xiaomi\n (\"xiaomi/mimo-v2.5-pro\", \"\"),\n # Tencent\n (\"tencent/hy3-preview\", \"\"),\n # StepFun\n (\"stepfun/step-3.7-flash\", \"\"),\n # NVIDIA\n (\"nvidia/nemotron-3-super-120b-a12b\", \"\"),\n # OpenRouter routers\n (\"openrouter/pareto-code\", \"auto-routes to cheapest coder meeting openrouter.min_coding_score\"),\n # Free tier\n (\"openrouter/elephant-alpha\", \"free\"),\n (\"openrouter/owl-alpha\", \"free\"),\n (\"tencent/hy3-preview:free\", \"free\"),\n (\"nvidia/nemotron-3-super-120b-a12b:free\", \"free\"),\n (\"inclusionai/ring-2.6-1t:free\", \"free\"),\n]\n\n_openrouter_catalog_cache: list[tuple[str, str]] | None = None\n\n\n\n\ndef _codex_curated_models() -> list[str]:\n \"\"\"Derive the openai-codex curated list from codex_models.py.\n\n Single source of truth: DEFAULT_CODEX_MODELS + forward-compat synthesis.\n This keeps the gateway /model picker in sync with the CLI `arcen model`\n flow without maintaining a separate static list.\n \"\"\"\n from arcen_cli.codex_models import DEFAULT_CODEX_MODELS, _add_forward_compat_models\n return _add_forward_compat_models(list(DEFAULT_CODEX_MODELS))\n\n\n# Static fallback for xAI when the models.dev disk cache is empty (fresh\n# install, offline first run, etc.). Mirrors the xAI-direct model IDs from\n# $ARCEN_HOME/models_dev_cache.json as of 2026-04-28. Whenever xAI renames\n# or retires a model, the disk cache picks it up on the next refresh and the\n# fallback here only matters until that refresh lands.\n#\n# Models retired by xAI on May 15, 2026 are excluded — see\n# https://docs.x.ai/developers/migration/may-15-retirement\n# (grok-4, grok-4-0709, grok-4-fast{,-reasoning,-non-reasoning},\n# grok-4-1-fast{,-reasoning,-non-reasoning}, grok-code-fast-1 → grok-4.3).\n_XAI_STATIC_FALLBACK: list[str] = [\n \"grok-4.3\",\n \"grok-4.20-0309-reasoning\",\n \"grok-4.20-0309-non-reasoning\",\n \"grok-4.20-multi-agent-0309\",\n]\n\n\n_XAI_TOP_MODEL = \"grok-4.3\"\n\n\ndef _xai_promote_top(ids: list[str]) -> list[str]:\n \"\"\"Pin the headline xAI model to the top of the curated list.\"\"\"\n if _XAI_TOP_MODEL in ids:\n return [_XAI_TOP_MODEL] + [m for m in ids if m != _XAI_TOP_MODEL]\n return ids\n\n\ndef _xai_curated_models() -> list[str]:\n \"\"\"Derive the xAI-direct curated list from models.dev disk cache.\n\n Reads $ARCEN_HOME/models_dev_cache.json directly (no network) so this\n runs at import time without blocking. Falls back to ``_XAI_STATIC_FALLBACK``\n when the cache is empty or unreadable. Arcen refreshes the cache from\n https://models.dev/api.json on normal use, so this list self-heals as\n xAI renames models.\n\n Mirrors ``_codex_curated_models()``'s role for openai-codex.\n \"\"\"\n try:\n from agent.models_dev import _load_disk_cache\n data = _load_disk_cache()\n xai = data.get(\"xai\") if isinstance(data, dict) else None\n models = xai.get(\"models\") if isinstance(xai, dict) else None\n if isinstance(models, dict) and models:\n ids = [mid for mid in models.keys() if isinstance(mid, str)]\n if ids:\n return _xai_promote_top(sorted(ids))\n except Exception:\n # Any failure (missing file, malformed JSON, import error)\n # falls through to the static list.\n pass\n return list(_XAI_STATIC_FALLBACK)\n\n\n_PROVIDER_MODELS: dict[str, list[str]] = {\n \"nous\": [\n # Anthropic\n \"anthropic/claude-opus-4.8\",\n \"anthropic/claude-sonnet-4.6\",\n \"anthropic/claude-haiku-4.5\",\n # OpenAI\n \"openai/gpt-5.5\",\n \"openai/gpt-5.5-pro\",\n \"openai/gpt-5.4-mini\",\n # Google\n \"google/gemini-3-pro-preview\",\n \"google/gemini-3.1-pro-preview\",\n \"google/gemini-3.5-flash\",\n # xAI\n \"x-ai/grok-4.3\",\n # DeepSeek\n \"deepseek/deepseek-v4-pro\",\n \"deepseek/deepseek-v4-flash\",\n # Qwen\n \"qwen/qwen3.7-max\",\n \"qwen/qwen3.7-plus\",\n \"qwen/qwen3.6-35b-a3b\",\n # MoonshotAI\n \"moonshotai/kimi-k2.6\",\n # MiniMax\n \"minimax/minimax-m3\",\n # Z-AI\n \"z-ai/glm-5.1\",\n # Xiaomi\n \"xiaomi/mimo-v2.5-pro\",\n # Tencent\n \"tencent/hy3-preview\",\n # StepFun\n \"stepfun/step-3.7-flash\",\n # NVIDIA\n \"nvidia/nemotron-3-super-120b-a12b\",\n ],\n # Native OpenAI Chat Completions (api.openai.com). Used by /model counts and\n # provider_model_ids fallback when /v1/models is unavailable.\n \"openai\": [\n \"gpt-5.4\",\n \"gpt-5.4-mini\",\n \"gpt-5-mini\",\n \"gpt-5.3-codex\",\n \"gpt-5.2-codex\",\n \"gpt-4.1\",\n \"gpt-4o\",\n \"gpt-4o-mini\",\n ],\n \"openai-api\": [\n \"gpt-5.5\",\n \"gpt-5.5-pro\",\n \"gpt-5.4\",\n \"gpt-5.4-mini\",\n \"gpt-5.4-nano\",\n \"gpt-5-mini\",\n \"gpt-5.3-codex\",\n \"gpt-4.1\",\n \"gpt-4o\",\n \"gpt-4o-mini\",\n ],\n \"openai-codex\": _codex_curated_models(),\n \"xai-oauth\": _xai_curated_models(),\n \"copilot-acp\": [\n \"copilot-acp\",\n ],\n \"copilot\": [\n \"gpt-5.4\",\n \"gpt-5.4-mini\",\n \"gpt-5-mini\",\n \"gpt-5.3-codex\",\n \"gpt-5.2-codex\",\n \"gpt-4.1\",\n \"gpt-4o\",\n \"gpt-4o-mini\",\n \"claude-sonnet-4.6\",\n \"claude-sonnet-4\",\n \"claude-sonnet-4.5\",\n \"claude-haiku-4.5\",\n \"gemini-3.1-pro-preview\",\n \"gemini-3-pro-preview\",\n \"gemini-3-flash-preview\",\n \"gemini-2.5-pro\",\n ],\n \"gemini\": [\n \"gemini-3.1-pro-preview\",\n \"gemini-3-pro-preview\",\n \"gemini-3.5-flash\",\n \"gemini-3.1-flash-lite-preview\",\n ],\n \"google-gemini-cli\": [\n \"gemini-3.1-pro-preview\",\n \"gemini-3-pro-preview\",\n # Code Assist serves two flash slugs with different access gates\n # (gemini-cli models.ts): gemini-3-flash-preview is the preview flash\n # that subscription/free-tier OAuth users actually reach, while\n # gemini-3.5-flash is GA-channel-gated. Offer both so non-GA users\n # aren't stuck with a slug cloudcode-pa 404s for them.\n \"gemini-3-flash-preview\",\n \"gemini-3.5-flash\",\n ],\n \"zai\": [\n \"glm-5.1\",\n \"glm-5\",\n \"glm-5v-turbo\",\n \"glm-5-turbo\",\n \"glm-4.7\",\n \"glm-4.5\",\n \"glm-4.5-flash\",\n ],\n \"xai\": _xai_curated_models(),\n \"nvidia\": [\n # NVIDIA flagship reasoning models\n \"nvidia/nemotron-3-super-120b-a12b\",\n \"nvidia/nemotron-3-nano-30b-a3b\",\n \"nvidia/llama-3.3-nemotron-super-49b-v1.5\",\n # Third-party agentic models hosted on build.nvidia.com\n # (map to OpenRouter defaults — users get familiar picks on NIM)\n \"qwen/qwen3.5-397b-a17b\",\n \"deepseek-ai/deepseek-v3.2\",\n \"moonshotai/kimi-k2.6\",\n \"minimaxai/minimax-m2.5\",\n \"z-ai/glm5\",\n \"openai/gpt-oss-120b\",\n ],\n \"kimi-coding\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"kimi-for-coding\",\n \"kimi-k2-thinking\",\n \"kimi-k2-thinking-turbo\",\n \"kimi-k2-turbo-preview\",\n \"kimi-k2-0905-preview\",\n ],\n \"kimi-coding-cn\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"kimi-k2-thinking\",\n \"kimi-k2-turbo-preview\",\n \"kimi-k2-0905-preview\",\n ],\n \"stepfun\": [\n \"step-3.5-flash\",\n \"step-3.5-flash-2603\",\n ],\n \"moonshot\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"kimi-k2-thinking\",\n \"kimi-k2-turbo-preview\",\n \"kimi-k2-0905-preview\",\n ],\n \"minimax\": [\n \"MiniMax-M3\",\n \"MiniMax-M2.7\",\n \"MiniMax-M2.5\",\n \"MiniMax-M2.1\",\n \"MiniMax-M2\",\n ],\n \"minimax-oauth\": [\n \"MiniMax-M3\",\n \"MiniMax-M2.7\",\n \"MiniMax-M2.7-highspeed\",\n ],\n \"minimax-cn\": [\n \"MiniMax-M3\",\n \"MiniMax-M2.7\",\n \"MiniMax-M2.5\",\n \"MiniMax-M2.1\",\n \"MiniMax-M2\",\n ],\n \"anthropic\": [\n \"claude-opus-4-8\",\n \"claude-opus-4-7\",\n \"claude-opus-4-6\",\n \"claude-sonnet-4-6\",\n \"claude-opus-4-5-20251101\",\n \"claude-sonnet-4-5-20250929\",\n \"claude-opus-4-20250514\",\n \"claude-sonnet-4-20250514\",\n \"claude-haiku-4-5-20251001\",\n ],\n \"deepseek\": [\n \"deepseek-v4-pro\",\n \"deepseek-v4-flash\",\n \"deepseek-chat\",\n \"deepseek-reasoner\",\n ],\n \"xiaomi\": [\n \"mimo-v2.5-pro\",\n \"mimo-v2.5\",\n \"mimo-v2-pro\",\n \"mimo-v2-omni\",\n \"mimo-v2-flash\",\n ],\n \"tencent-tokenhub\": [\n \"hy3-preview\",\n ],\n \"arcee\": [\n \"trinity-large-thinking\",\n \"trinity-large-preview\",\n \"trinity-mini\",\n ],\n \"gmi\": [\n \"zai-org/GLM-5.1-FP8\",\n \"deepseek-ai/DeepSeek-V3.2\",\n \"moonshotai/Kimi-K2.5\",\n \"google/gemini-3.1-flash-lite-preview\",\n \"anthropic/claude-sonnet-4.6\",\n \"openai/gpt-5.4\",\n ],\n \"opencode-zen\": [\n \"kimi-k2.5\",\n \"gpt-5.4-pro\",\n \"gpt-5.4\",\n \"gpt-5.3-codex\",\n \"gpt-5.2\",\n \"gpt-5.2-codex\",\n \"gpt-5.1\",\n \"gpt-5.1-codex\",\n \"gpt-5.1-codex-max\",\n \"gpt-5.1-codex-mini\",\n \"gpt-5\",\n \"gpt-5-codex\",\n \"gpt-5-nano\",\n \"claude-opus-4-6\",\n \"claude-opus-4-5\",\n \"claude-opus-4-1\",\n \"claude-sonnet-4-6\",\n \"claude-sonnet-4-5\",\n \"claude-sonnet-4\",\n \"claude-haiku-4-5\",\n \"claude-3-5-haiku\",\n \"gemini-3.1-pro\",\n \"gemini-3-pro\",\n \"gemini-3-flash\",\n \"minimax-m2.7\",\n \"minimax-m2.5\",\n \"minimax-m2.5-free\",\n \"minimax-m2.1\",\n \"glm-5\",\n \"glm-4.7\",\n \"glm-4.6\",\n \"kimi-k2-thinking\",\n \"kimi-k2\",\n \"qwen3-coder\",\n \"big-pickle\",\n ],\n \"opencode-go\": [\n \"kimi-k2.6\",\n \"kimi-k2.5\",\n \"glm-5.1\",\n \"glm-5\",\n \"mimo-v2.5-pro\",\n \"mimo-v2.5\",\n \"mimo-v2-pro\",\n \"mimo-v2-omni\",\n \"minimax-m2.7\",\n \"minimax-m2.5\",\n \"qwen3.7-max\",\n \"qwen3.6-plus\",\n \"qwen3.5-plus\",\n ],\n \"kilocode\": [\n \"anthropic/claude-opus-4.6\",\n \"anthropic/claude-sonnet-4.6\",\n \"openai/gpt-5.4\",\n \"google/gemini-3-pro-preview\",\n \"google/gemini-3-flash-preview\",\n ],\n # Alibaba DashScope Coding platform (coding-intl) — default endpoint.\n # Supports Qwen models + third-party providers (GLM, Kimi, MiniMax).\n # Users with classic DashScope keys should override DASHSCOPE_BASE_URL\n # to https://dashscope-intl.aliyuncs.com/compatible-mode/v1 (OpenAI-compat)\n # or https://dashscope-intl.aliyuncs.com/apps/anthropic (Anthropic-compat).\n \"alibaba\": [\n \"qwen3.7-max\",\n \"qwen3.6-plus\",\n \"kimi-k2.5\",\n \"qwen3.5-plus\",\n \"qwen3-coder-plus\",\n \"qwen3-coder-next\",\n # Third-party models available on coding-intl\n \"glm-5\",\n \"glm-4.7\",\n \"MiniMax-M2.5\",\n ],\n # Alibaba Coding Plan — same platform as alibaba (DashScope coding-intl),\n # separate provider ID with its own base_url_env_var.\n \"alibaba-coding-plan\": [\n \"qwen3.7-max\",\n \"qwen3.6-plus\",\n \"qwen3.5-plus\",\n \"qwen3-coder-plus\",\n \"qwen3-coder-next\",\n \"kimi-k2.5\",\n \"glm-5\",\n \"glm-4.7\",\n \"MiniMax-M2.5\",\n ],\n # Curated HF model list — only agentic models that map to OpenRouter defaults.\n \"huggingface\": [\n \"moonshotai/Kimi-K2.5\",\n \"Qwen/Qwen3.5-397B-A17B\",\n \"Qwen/Qwen3.5-35B-A3B\",\n \"deepseek-ai/DeepSeek-V3.2\",\n \"MiniMaxAI/MiniMax-M2.5\",\n \"zai-org/GLM-5\",\n \"XiaomiMiMo/MiMo-V2-Flash\",\n \"moonshotai/Kimi-K2-Thinking\",\n \"moonshotai/Kimi-K2.6\",\n ],\n # AWS Bedrock — static fallback list used when dynamic discovery is\n # unavailable (no boto3, no credentials, or API error). The agent\n # prefers live discovery via ListFoundationModels + ListInferenceProfiles.\n # Use inference profile IDs (us.*) since most models require them.\n \"bedrock\": [\n \"us.anthropic.claude-sonnet-4-6\",\n \"us.anthropic.claude-opus-4-6-v1\",\n \"us.anthropic.claude-haiku-4-5-20251001-v1:0\",\n \"us.anthropic.claude-sonnet-4-5-20250929-v1:0\",\n \"us.amazon.nova-pro-v1:0\",\n \"us.amazon.nova-lite-v1:0\",\n \"us.amazon.nova-micro-v1:0\",\n \"deepseek.v3.2\",\n \"us.meta.llama4-maverick-17b-instruct-v1:0\",\n \"us.meta.llama4-scout-17b-instruct-v1:0\",\n ],\n # Azure Foundry: user-provided endpoint and model.\n # Empty list because models depend on the endpoint configuration.\n \"azure-foundry\": [],\n \"novita\": [\n \"moonshotai/kimi-k2.5\",\n \"minimax/minimax-m2.7\",\n \"zai-org/glm-5\",\n \"deepseek/deepseek-v3-0324\",\n \"deepseek/deepseek-r1-0528\",\n \"qwen/qwen3-235b-a22b-fp8\",\n ],\n}\n\n# ---------------------------------------------------------------------------\n# Nous Portal free-model helper\n# ---------------------------------------------------------------------------\n# The Nous Portal models endpoint is the source of truth for which models\n# are currently offered (free or paid). We trust whatever it returns and\n# surface it to users as-is — no local allowlist filtering.\n\n\ndef _is_model_free(model_id: str, pricing: dict[str, dict[str, str]]) -> bool:\n \"\"\"Return True if *model_id* has zero-cost prompt AND completion pricing.\"\"\"\n p = pricing.get(model_id)\n if not p:\n return False\n try:\n return float(p.get(\"prompt\", \"1\")) == 0 and float(p.get(\"completion\", \"1\")) == 0\n except (TypeError, ValueError):\n return False\n\n\n# ---------------------------------------------------------------------------\n# Nous Portal account tier detection\n# ---------------------------------------------------------------------------\ndef is_nous_free_tier(account_info: dict[str, Any]) -> bool:\n \"\"\"Return True if the account info indicates a free (unpaid) tier.\n\n Prefer the Portal's explicit ``paid_service_access.allowed`` entitlement\n decision. Legacy payloads fall back to ``subscription.monthly_charge == 0``.\n Returns False when both signals are missing or unparseable.\n \"\"\"\n paid_access = account_info.get(\"paid_service_access\")\n if isinstance(paid_access, dict):\n allowed = paid_access.get(\"allowed\")\n if isinstance(allowed, bool):\n return not allowed\n paid = paid_access.get(\"paid_access\")\n if isinstance(paid, bool):\n return not paid\n\n sub = account_info.get(\"subscription\")\n if not isinstance(sub, dict):\n return False\n charge = sub.get(\"monthly_charge\")\n if charge is None:\n return False\n try:\n return float(charge) == 0\n except (TypeError, ValueError):\n return False\n\n\ndef partition_nous_models_by_tier(\n model_ids: list[str],\n pricing: dict[str, dict[str, str]],\n free_tier: bool,\n) -> tuple[list[str], list[str]]:\n \"\"\"Split Nous models into (selectable, unavailable) based on user tier.\n\n For paid-tier users: all models are selectable, none unavailable.\n\n For free-tier users: only free models are selectable; paid models\n are returned as unavailable (shown grayed out in the menu).\n \"\"\"\n if not free_tier:\n return (model_ids, [])\n\n if not pricing:\n return (model_ids, []) # can't determine, show everything\n\n selectable: list[str] = []\n unavailable: list[str] = []\n for mid in model_ids:\n if _is_model_free(mid, pricing):\n selectable.append(mid)\n else:\n unavailable.append(mid)\n return (selectable, unavailable)\n\n\ndef union_with_portal_free_recommendations(\n curated_ids: list[str],\n pricing: dict[str, dict[str, str]],\n portal_base_url: str = \"\",\n *,\n force_refresh: bool = False,\n) -> tuple[list[str], dict[str, dict[str, str]]]:\n \"\"\"Augment curated list + pricing with the Portal's ``freeRecommendedModels``.\n\n The Portal's ``/api/nous/recommended-models`` endpoint advertises which\n models are free *right now* — independent of what the in-repo\n ``_PROVIDER_MODELS[\"nous\"]`` list happens to contain or whether the\n docs-hosted catalog manifest has been rebuilt since the last release.\n\n For free-tier users this is the source of truth: any model the Portal\n flags as free should be selectable, even if the user is running an\n older Arcen that doesn't ship that model in its hardcoded curated\n list. This function returns an augmented ``(model_ids, pricing)``\n pair where:\n\n * Portal free recommendations missing from ``curated_ids`` are\n appended after the curated list (so the in-repo curated models\n show first and Portal-only picks follow).\n * ``pricing`` gets a synthetic ``{\"prompt\": \"0\", \"completion\": \"0\"}``\n entry for any free recommendation missing from the live pricing\n map, so :func:`partition_nous_models_by_tier` keeps it.\n\n Failures (network, parse, missing field) are silent and degrade to\n returning the inputs unchanged.\n \"\"\"\n try:\n payload = fetch_nous_recommended_models(\n portal_base_url, force_refresh=force_refresh\n )\n except Exception:\n return (list(curated_ids), dict(pricing))\n\n free_block = payload.get(\"freeRecommendedModels\") if isinstance(payload, dict) else None\n if not isinstance(free_block, list) or not free_block:\n return (list(curated_ids), dict(pricing))\n\n portal_free_ids: list[str] = []\n for entry in free_block:\n name = _extract_model_name(entry)\n if name:\n portal_free_ids.append(name)\n if not portal_free_ids:\n return (list(curated_ids), dict(pricing))\n\n augmented_pricing = dict(pricing)\n free_synthetic = {\"prompt\": \"0\", \"completion\": \"0\"}\n for mid in portal_free_ids:\n if mid not in augmented_pricing:\n augmented_pricing[mid] = dict(free_synthetic)\n\n augmented_ids = list(curated_ids)\n seen = set(augmented_ids)\n # Append Portal free recommendations that aren't already curated, so the\n # in-repo curated (\"HA\") models show first and Portal-only picks follow.\n new_ones = [mid for mid in portal_free_ids if mid not in seen]\n if new_ones:\n augmented_ids = augmented_ids + new_ones\n\n return (augmented_ids, augmented_pricing)\n\n\ndef union_with_portal_paid_recommendations(\n curated_ids: list[str],\n pricing: dict[str, dict[str, str]],\n portal_base_url: str = \"\",\n *,\n force_refresh: bool = False,\n) -> tuple[list[str], dict[str, dict[str, str]]]:\n \"\"\"Augment curated list with the Portal's ``paidRecommendedModels``.\n\n Mirror of :func:`union_with_portal_free_recommendations` for paid-tier\n users. The Portal's ``/api/nous/recommended-models`` endpoint advertises\n which paid models are blessed *right now* — independent of what the\n in-repo ``_PROVIDER_MODELS[\"nous\"]`` list happens to contain or whether\n the docs-hosted catalog manifest has been rebuilt since the last release.\n\n For paid-tier users this lets newly-launched paid models surface in the\n picker even if the user is running an older Arcen that doesn't ship\n them in its hardcoded curated list. This function returns an augmented\n ``(model_ids, pricing)`` pair where:\n\n * Portal paid recommendations missing from ``curated_ids`` are\n appended after the curated list (so the in-repo curated models\n show first and Portal-only picks follow).\n * ``pricing`` is left untouched — we deliberately do NOT synthesize\n pricing entries for paid models. Live pricing is fetched separately\n via :func:`get_pricing_for_provider`; if the live endpoint hasn't\n published pricing yet, the picker shows a blank price column rather\n than fabricating numbers. (The free helper synthesizes ``$0`` so\n :func:`partition_nous_models_by_tier` keeps free models selectable;\n no equivalent gating applies on the paid side, so synthesis would\n only mislead the user.)\n\n Failures (network, parse, missing field) are silent and degrade to\n returning the inputs unchanged — never block the picker on a\n Portal-side hiccup.\n \"\"\"\n try:\n payload = fetch_nous_recommended_models(\n portal_base_url, force_refresh=force_refresh\n )\n except Exception:\n return (list(curated_ids), dict(pricing))\n\n paid_block = payload.get(\"paidRecommendedModels\") if isinstance(payload, dict) else None\n if not isinstance(paid_block, list) or not paid_block:\n return (list(curated_ids), dict(pricing))\n\n portal_paid_ids: list[str] = []\n for entry in paid_block:\n name = _extract_model_name(entry)\n if name:\n portal_paid_ids.append(name)\n if not portal_paid_ids:\n return (list(curated_ids), dict(pricing))\n\n augmented_ids = list(curated_ids)\n seen = set(augmented_ids)\n # Append Portal paid recommendations that aren't already curated, so the\n # in-repo curated (\"HA\") models show first and Portal-only picks follow.\n new_ones = [mid for mid in portal_paid_ids if mid not in seen]\n if new_ones:\n augmented_ids = augmented_ids + new_ones\n\n return (augmented_ids, dict(pricing))\n\n\n# ---------------------------------------------------------------------------\n# TTL cache for free-tier detection — avoids repeated API calls within a\n# session while still picking up upgrades quickly.\n# ---------------------------------------------------------------------------\n_FREE_TIER_CACHE_TTL: int = 180 # seconds (3 minutes)\n_free_tier_cache: tuple[bool, float] | None = None # (result, timestamp)\n\n\ndef check_nous_free_tier(*, force_fresh: bool = False) -> bool:\n \"\"\"Check if the current Nous Portal user is on a free (unpaid) tier.\n\n Results are cached for ``_FREE_TIER_CACHE_TTL`` seconds to avoid\n hitting the Portal API on every call. The cache is short-lived so\n that an account upgrade is reflected within a few minutes.\n\n Returns True only when entitlement is known to be free. Unknown/error\n states return False so this compatibility wrapper does not block users.\n \"\"\"\n global _free_tier_cache\n now = time.monotonic()\n if not force_fresh and _free_tier_cache is not None:\n cached_result, cached_at = _free_tier_cache\n if now - cached_at < _FREE_TIER_CACHE_TTL:\n return cached_result\n\n try:\n from arcen_cli.nous_account import get_nous_portal_account_info\n\n account_info = get_nous_portal_account_info(force_fresh=force_fresh)\n result = account_info.is_free_tier\n _free_tier_cache = (result, now)\n return result\n except Exception:\n _free_tier_cache = (False, now)\n return False # default to paid on error — don't block users\n\n\n# ---------------------------------------------------------------------------\n# Nous Portal recommended models\n#\n# The Portal publishes a curated list of suggested models (separated into\n# paid and free tiers) plus dedicated recommendations for compaction (text\n# summarisation / auxiliary) and vision tasks. We fetch it once per process\n# with a TTL cache so callers can ask \"what's the best aux model right now?\"\n# without hitting the network on every lookup.\n#\n# Shape of the response (fields we care about):\n# {\n# \"paidRecommendedModels\": [ {modelName, ...}, ... ],\n# \"freeRecommendedModels\": [ {modelName, ...}, ... ],\n# \"paidRecommendedCompactionModel\": {modelName, ...} | null,\n# \"paidRecommendedVisionModel\": {modelName, ...} | null,\n# \"freeRecommendedCompactionModel\": {modelName, ...} | null,\n# \"freeRecommendedVisionModel\": {modelName, ...} | null,\n# }\n# ---------------------------------------------------------------------------\n\nNOUS_RECOMMENDED_MODELS_PATH = \"/api/nous/recommended-models\"\n_NOUS_RECOMMENDED_CACHE_TTL: int = 600 # seconds (10 minutes)\n# (result_dict, timestamp) keyed by portal_base_url so staging vs prod don't collide.\n_nous_recommended_cache: dict[str, tuple[dict[str, Any], float]] = {}\n\n\ndef fetch_nous_recommended_models(\n portal_base_url: str = \"\",\n timeout: float = 5.0,\n *,\n force_refresh: bool = False,\n) -> dict[str, Any]:\n \"\"\"Fetch the Nous Portal's curated recommended-models payload.\n\n Hits ``<portal>/api/nous/recommended-models``. The endpoint is public —\n no auth is required. Results are cached per portal URL for\n ``_NOUS_RECOMMENDED_CACHE_TTL`` seconds; pass ``force_refresh=True`` to\n bypass the cache.\n\n Returns the parsed JSON dict on success, or ``{}`` on any failure\n (network, parse, non-2xx). Callers must treat missing/null fields as\n \"no recommendation\" and fall back to their own default.\n \"\"\"\n base = (portal_base_url or \"https://portal.nousresearch.com\").rstrip(\"/\")\n now = time.monotonic()\n cached = _nous_recommended_cache.get(base)\n if not force_refresh and cached is not None:\n payload, cached_at = cached\n if now - cached_at < _NOUS_RECOMMENDED_CACHE_TTL:\n return payload\n\n url = f\"{base}{NOUS_RECOMMENDED_MODELS_PATH}\"\n try:\n req = urllib.request.Request(\n url,\n headers={\"Accept\": \"application/json\"},\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n data = json.loads(resp.read().decode())\n if not isinstance(data, dict):\n data = {}\n except Exception:\n data = {}\n\n _nous_recommended_cache[base] = (data, now)\n return data\n\n\ndef _resolve_nous_portal_url() -> str:\n \"\"\"Best-effort lookup of the Portal base URL the user is authed against.\"\"\"\n try:\n from arcen_cli.auth import (\n DEFAULT_NOUS_PORTAL_URL,\n get_provider_auth_state,\n )\n state = get_provider_auth_state(\"nous\") or {}\n portal = str(state.get(\"portal_base_url\") or \"\").strip()\n if portal:\n return portal.rstrip(\"/\")\n return str(DEFAULT_NOUS_PORTAL_URL).rstrip(\"/\")\n except Exception:\n return \"https://portal.nousresearch.com\"\n\n\ndef _extract_model_name(entry: Any) -> Optional[str]:\n \"\"\"Pull the ``modelName`` field from a recommended-model entry, else None.\"\"\"\n if not isinstance(entry, dict):\n return None\n model_name = entry.get(\"modelName\")\n if isinstance(model_name, str) and model_name.strip():\n return model_name.strip()\n return None\n\n\ndef get_nous_recommended_aux_model(\n *,\n vision: bool = False,\n free_tier: Optional[bool] = None,\n portal_base_url: str = \"\",\n force_refresh: bool = False,\n) -> Optional[str]:\n \"\"\"Return the Portal's recommended model name for an auxiliary task.\n\n Picks the best field from the Portal's recommended-models payload:\n\n * ``vision=True`` → ``paidRecommendedVisionModel`` (paid tier) or\n ``freeRecommendedVisionModel`` (free tier)\n * ``vision=False`` → ``paidRecommendedCompactionModel`` or\n ``freeRecommendedCompactionModel``\n\n When ``free_tier`` is ``None`` (default) the user's tier is auto-detected\n via :func:`check_nous_free_tier`. Pass an explicit bool to bypass the\n detection — useful for tests or when the caller already knows the tier.\n\n For paid-tier users we prefer the paid recommendation but gracefully fall\n back to the free recommendation if the Portal returned ``null`` for the\n paid field (common during the staged rollout of new paid models).\n\n Returns ``None`` when every candidate is missing, null, or the fetch\n fails — callers should fall back to their own default (currently\n ``google/gemini-3-flash-preview``).\n \"\"\"\n base = portal_base_url or _resolve_nous_portal_url()\n payload = fetch_nous_recommended_models(base, force_refresh=force_refresh)\n if not payload:\n return None\n\n if free_tier is None:\n try:\n free_tier = check_nous_free_tier()\n except Exception:\n # On any detection error, assume paid — paid users see both fields\n # anyway so this is a safe default that maximises model quality.\n free_tier = False\n\n if vision:\n paid_key, free_key = \"paidRecommendedVisionModel\", \"freeRecommendedVisionModel\"\n else:\n paid_key, free_key = \"paidRecommendedCompactionModel\", \"freeRecommendedCompactionModel\"\n\n # Preference order:\n # free tier → free only\n # paid tier → paid, then free (if paid field is null)\n candidates = [free_key] if free_tier else [paid_key, free_key]\n for key in candidates:\n name = _extract_model_name(payload.get(key))\n if name:\n return name\n return None\n\n\n# ---------------------------------------------------------------------------\n# Canonical provider list — single source of truth for provider identity.\n# Every code path that lists, displays, or iterates providers derives from\n# this list: arcen model, /model, list_authenticated_providers.\n#\n# Fields:\n# slug — internal provider ID (used in config.yaml, --provider flag)\n# label — short display name\n# tui_desc — longer description for the `arcen model` interactive picker\n# ---------------------------------------------------------------------------\n\nclass ProviderEntry(NamedTuple):\n slug: str\n label: str\n tui_desc: str # detailed description for `arcen model` TUI\n\nCANONICAL_PROVIDERS: list[ProviderEntry] = [\n ProviderEntry(\"nous\", \"Nous Portal\", \"Nous Portal (Everything your agent needs, 300+ models with bundled tool use)\"),\n ProviderEntry(\"openrouter\", \"OpenRouter\", \"OpenRouter (Pay-per-use API aggregator)\"),\n ProviderEntry(\"novita\", \"NovitaAI\", \"NovitaAI (Cloud: Model API, Agent Sandbox, GPU Cloud)\"),\n ProviderEntry(\"lmstudio\", \"LM Studio\", \"LM Studio (Local desktop app with built-in model server)\"),\n ProviderEntry(\"anthropic\", \"Anthropic\", \"Anthropic (Claude models via API key or Claude Code)\"),\n ProviderEntry(\"openai-codex\", \"OpenAI Codex\", \"OpenAI Codex (Codex CLI via ChatGPT subscription or API key)\"),\n ProviderEntry(\"openai-api\", \"OpenAI API\", \"OpenAI API (api.openai.com, API key)\"),\n ProviderEntry(\"alibaba\", \"Qwen Cloud\", \"Qwen Cloud / DashScope (Qwen + multi-provider)\"),\n ProviderEntry(\"xai-oauth\", \"xAI Grok OAuth (SuperGrok / Premium+)\", \"xAI Grok OAuth (SuperGrok / Premium+ subscription)\"),\n ProviderEntry(\"xiaomi\", \"Xiaomi MiMo\", \"Xiaomi MiMo (MiMo-V2.5 and V2 models: pro, omni, flash)\"),\n ProviderEntry(\"tencent-tokenhub\", \"Tencent TokenHub\", \"Tencent TokenHub (Hy3 Preview via tokenhub.tencentmaas.com)\"),\n ProviderEntry(\"nvidia\", \"NVIDIA NIM\", \"NVIDIA NIM (Nemotron models via build.nvidia.com or local NIM)\"),\n ProviderEntry(\"copilot\", \"GitHub Copilot\", \"GitHub Copilot (Uses GITHUB_TOKEN or gh auth token)\"),\n ProviderEntry(\"copilot-acp\", \"GitHub Copilot ACP\", \"GitHub Copilot ACP (Spawns copilot --acp --stdio)\"),\n ProviderEntry(\"huggingface\", \"Hugging Face\", \"Hugging Face Inference Providers\"),\n ProviderEntry(\"gemini\", \"Google AI Studio\", \"Google AI Studio (Native Gemini API)\"),\n ProviderEntry(\"google-gemini-cli\", \"Google Gemini (OAuth)\", \"Google Gemini via OAuth + Code Assist (Code Assist OAuth flow)\"),\n ProviderEntry(\"deepseek\", \"DeepSeek\", \"DeepSeek (V3, R1, coder, direct API)\"),\n ProviderEntry(\"xai\", \"xAI\", \"xAI Grok (Direct API)\"),\n ProviderEntry(\"zai\", \"Z.AI / GLM\", \"Z.AI / GLM (Zhipu direct API)\"),\n ProviderEntry(\"kimi-coding\", \"Kimi / Kimi Coding Plan\", \"Kimi Coding Plan (api.kimi.com & Moonshot API)\"),\n ProviderEntry(\"kimi-coding-cn\", \"Kimi / Moonshot (China)\", \"Kimi / Moonshot China (Domestic direct API)\"),\n ProviderEntry(\"stepfun\", \"StepFun Step Plan\", \"StepFun Step Plan (Agent / coding models via Step Plan API)\"),\n ProviderEntry(\"minimax\", \"MiniMax\", \"MiniMax (Global direct API)\"),\n ProviderEntry(\"minimax-oauth\", \"MiniMax (OAuth)\", \"MiniMax via OAuth browser login (Coding Plan, minimax.io)\"),\n ProviderEntry(\"minimax-cn\", \"MiniMax (China)\", \"MiniMax China (Domestic direct API)\"),\n ProviderEntry(\"ollama-cloud\", \"Ollama Cloud\", \"Ollama Cloud (Cloud-hosted open models, ollama.com)\"),\n ProviderEntry(\"arcee\", \"Arcee AI\", \"Arcee AI (Trinity models, direct API)\"),\n ProviderEntry(\"gmi\", \"GMI Cloud\", \"GMI Cloud (Multi-model direct API)\"),\n ProviderEntry(\"kilocode\", \"Kilo Code\", \"Kilo Code (Kilo Gateway API)\"),\n ProviderEntry(\"opencode-zen\", \"OpenCode Zen\", \"OpenCode Zen (Curated models, pay-as-you-go)\"),\n ProviderEntry(\"opencode-go\", \"OpenCode Go\", \"OpenCode Go (Open models subscription)\"),\n ProviderEntry(\"bedrock\", \"AWS Bedrock\", \"AWS Bedrock (Claude, Nova, Llama, DeepSeek; IAM or API key)\"),\n ProviderEntry(\"azure-foundry\", \"Azure Foundry\", \"Azure Foundry (OpenAI-style or Anthropic-style endpoint, your Azure AI deployment)\"),\n ProviderEntry(\"qwen-oauth\", \"Qwen OAuth (Portal)\", \"Qwen OAuth (Reuses local Qwen CLI login)\"),\n]\n\n# Auto-extend CANONICAL_PROVIDERS with any provider registered in providers/\n# that is not already in the list above. Adding plugins/model-providers/<name>/\n# is sufficient to expose a new provider in the model picker, /model, and all\n# downstream consumers — no edits to this file needed.\n_canonical_slugs = {p.slug for p in CANONICAL_PROVIDERS}\ntry:\n from providers import list_providers as _list_providers_for_canonical\n for _pp in _list_providers_for_canonical():\n if _pp.name in _canonical_slugs:\n continue\n if _pp.auth_type in {\"oauth_device_code\", \"oauth_external\", \"external_process\", \"aws_sdk\", \"copilot\"}:\n continue # non-api-key flows need bespoke picker UX; skip auto-inject\n _label = _pp.display_name or _pp.name\n _desc = _pp.description or f\"{_label} (direct API)\"\n CANONICAL_PROVIDERS.append(ProviderEntry(_pp.name, _label, _desc))\n _canonical_slugs.add(_pp.name)\nexcept Exception:\n pass\n\n# Derived dicts — used throughout the codebase\n_PROVIDER_LABELS = {p.slug: p.label for p in CANONICAL_PROVIDERS}\n_PROVIDER_LABELS[\"custom\"] = \"Custom endpoint\" # special case: not a named provider\n\n\n# ---------------------------------------------------------------------------\n# Provider groups — DISPLAY ONLY\n#\n# Some vendors expose several Arcen provider slugs (one per endpoint /\n# auth method: global API, China API, OAuth coding plan, ...). Listing every\n# slug as a top-level row in the interactive `arcen model` / setup wizard /\n# Telegram `/model` pickers makes that list long and noisy.\n#\n# These groups fold related slugs under one top-level row in INTERACTIVE\n# PICKERS only. They do NOT change ``CANONICAL_PROVIDERS``, slug identity,\n# the ``--provider`` flag, ``/model <provider:model>``, or any typed path —\n# every member slug remains individually addressable. Grouping is a pure\n# display affordance; ``group_providers()`` is the single fold used by all\n# three picker surfaces so they stay consistent.\n#\n# group_id -> (display_label, group_description, [member_slug, ...])\n#\n# ``group_description`` is a short blurb shown on the collapsed top-level group\n# row in the interactive pickers (alongside the label). Member-specific detail\n# lives in each member's ``tui_desc`` and shows in the drill-down sub-picker.\n# Member order is the order shown inside the group submenu.\n# ---------------------------------------------------------------------------\nPROVIDER_GROUPS: dict[str, tuple[str, str, list[str]]] = {\n \"kimi\": (\"Kimi / Moonshot\", \"Coding Plan, Moonshot global & China endpoints\", [\"kimi-coding\", \"kimi-coding-cn\"]),\n \"minimax\": (\"MiniMax\", \"Global, OAuth Coding Plan & China endpoints\", [\"minimax\", \"minimax-oauth\", \"minimax-cn\"]),\n \"xai\": (\"xAI Grok\", \"Direct API or SuperGrok / Premium+ OAuth\", [\"xai\", \"xai-oauth\"]),\n \"google\": (\"Google Gemini\", \"AI Studio API or OAuth + Code Assist\", [\"gemini\", \"google-gemini-cli\"]),\n \"openai\": (\"OpenAI\", \"Codex CLI or direct OpenAI API\", [\"openai-codex\", \"openai-api\"]),\n \"opencode\": (\"OpenCode\", \"Zen pay-as-you-go or Go subscription\", [\"opencode-zen\", \"opencode-go\"]),\n \"copilot\": (\"GitHub Copilot\", \"GitHub token API or copilot --acp process\", [\"copilot\", \"copilot-acp\"]),\n}\n\n# Reverse index: member slug -> group_id. Built once at import.\n_SLUG_TO_GROUP: dict[str, str] = {\n slug: gid for gid, (_label, _desc, members) in PROVIDER_GROUPS.items() for slug in members\n}\n\n\ndef provider_group_for_slug(slug: str) -> str:\n \"\"\"Return the group_id a provider slug belongs to, or \"\" if ungrouped.\"\"\"\n return _SLUG_TO_GROUP.get(str(slug or \"\").strip().lower(), \"\")\n\n\ndef group_providers(slugs):\n \"\"\"Fold a flat ordered slug iterable into picker rows by provider group.\n\n DISPLAY ONLY. Used by every interactive picker (``arcen model``, the\n setup wizard, the Telegram ``/model`` keyboard) so grouping is identical\n across surfaces.\n\n Each returned row is a dict::\n\n {\"kind\": \"single\", \"slug\": <slug>} # ungrouped, or\n # 1-member group\n {\"kind\": \"group\", \"group_id\": <gid>, \"label\": <label>,\n \"description\": <desc>, \"members\": [<slug>, ...]} # 2+ members\n\n Rules:\n * A group row appears at the position of its FIRST present member, in\n the input order. Subsequent members fold into that row (and are not\n emitted again).\n * Member order inside a group follows ``PROVIDER_GROUPS`` declaration,\n restricted to the members actually present in ``slugs``.\n * A group reduced to a single present member degrades to a ``single``\n row — no pointless one-item submenu.\n * Slugs not in any group pass through as ``single`` rows, order\n preserved.\n * Duplicate slugs in the input are ignored after first sight.\n \"\"\"\n seen: set[str] = set()\n # Which present members each group has, in declaration order.\n group_members: dict[str, list[str]] = {}\n for gid, (_label, _desc, members) in PROVIDER_GROUPS.items():\n present = [m for m in members if m in set(slugs)]\n if present:\n group_members[gid] = present\n\n rows = []\n emitted_groups: set[str] = set()\n for slug in slugs:\n s = str(slug or \"\").strip().lower()\n if not s or s in seen:\n continue\n seen.add(s)\n gid = _SLUG_TO_GROUP.get(s, \"\")\n if not gid:\n rows.append({\"kind\": \"single\", \"slug\": s})\n continue\n if gid in emitted_groups:\n continue # already folded at the first member's position\n emitted_groups.add(gid)\n members = group_members.get(gid, [s])\n if len(members) <= 1:\n rows.append({\"kind\": \"single\", \"slug\": members[0]})\n else:\n label, desc, _ = PROVIDER_GROUPS[gid]\n rows.append(\n {\"kind\": \"group\", \"group_id\": gid, \"label\": label,\n \"description\": desc, \"members\": list(members)}\n )\n return rows\n\n\n_PROVIDER_ALIASES = {\n \"glm\": \"zai\",\n \"z-ai\": \"zai\",\n \"z.ai\": \"zai\",\n \"zhipu\": \"zai\",\n \"github\": \"copilot\",\n \"github-copilot\": \"copilot\",\n \"github-models\": \"copilot\",\n \"github-model\": \"copilot\",\n \"github-copilot-acp\": \"copilot-acp\",\n \"copilot-acp-agent\": \"copilot-acp\",\n \"google\": \"gemini\",\n \"google-gemini\": \"gemini\",\n \"google-ai-studio\": \"gemini\",\n \"kimi\": \"kimi-coding\",\n \"moonshot\": \"kimi-coding\",\n \"kimi-cn\": \"kimi-coding-cn\",\n \"moonshot-cn\": \"kimi-coding-cn\",\n \"step\": \"stepfun\",\n \"stepfun-coding-plan\": \"stepfun\",\n \"arcee-ai\": \"arcee\",\n \"arceeai\": \"arcee\",\n \"gmi-cloud\": \"gmi\",\n \"gmicloud\": \"gmi\",\n \"minimax-china\": \"minimax-cn\",\n \"minimax_cn\": \"minimax-cn\",\n \"minimax-portal\": \"minimax-oauth\",\n \"minimax-global\": \"minimax-oauth\",\n \"minimax_oauth\": \"minimax-oauth\",\n \"claude\": \"anthropic\",\n \"claude-code\": \"anthropic\",\n \"deep-seek\": \"deepseek\",\n \"opencode\": \"opencode-zen\",\n \"zen\": \"opencode-zen\",\n \"go\": \"opencode-go\",\n \"opencode-go-sub\": \"opencode-go\",\n \"kilo\": \"kilocode\",\n \"kilo-code\": \"kilocode\",\n \"kilo-gateway\": \"kilocode\",\n \"dashscope\": \"alibaba\",\n \"aliyun\": \"alibaba\",\n \"qwen\": \"alibaba\",\n \"alibaba-cloud\": \"alibaba\",\n \"qwen-portal\": \"qwen-oauth\",\n \"gemini-cli\": \"google-gemini-cli\",\n \"gemini-oauth\": \"google-gemini-cli\",\n \"hf\": \"huggingface\",\n \"hugging-face\": \"huggingface\",\n \"huggingface-hub\": \"huggingface\",\n \"novita-ai\": \"novita\",\n \"novitaai\": \"novita\",\n \"mimo\": \"xiaomi\",\n \"xiaomi-mimo\": \"xiaomi\",\n \"tencent\": \"tencent-tokenhub\",\n \"tokenhub\": \"tencent-tokenhub\",\n \"tencent-cloud\": \"tencent-tokenhub\",\n \"tencentmaas\": \"tencent-tokenhub\",\n \"aws\": \"bedrock\",\n \"aws-bedrock\": \"bedrock\",\n \"amazon-bedrock\": \"bedrock\",\n \"amazon\": \"bedrock\",\n \"grok\": \"xai\",\n \"grok-oauth\": \"xai-oauth\",\n \"xai-oauth\": \"xai-oauth\",\n \"x-ai-oauth\": \"xai-oauth\",\n \"xai-grok-oauth\": \"xai-oauth\",\n \"x-ai\": \"xai\",\n \"x.ai\": \"xai\",\n \"nim\": \"nvidia\",\n \"nvidia-nim\": \"nvidia\",\n \"build-nvidia\": \"nvidia\",\n \"nemotron\": \"nvidia\",\n \"lmstudio\": \"lmstudio\",\n \"lm-studio\": \"lmstudio\",\n \"lm_studio\": \"lmstudio\",\n \"ollama\": \"custom\", # bare \"ollama\" = local; use \"ollama-cloud\" for cloud\n \"ollama_cloud\": \"ollama-cloud\",\n}\n\n\n# Cost-safe overrides for the *silent* auto-default\n# (``get_default_model_for_provider``). Most providers' curated lists lead with a\n# sensible default, but Nous Portal is a per-token *metered aggregator* whose\n# list is ordered best-/most-capable-first — entry [0] is the priciest flagship\n# (``anthropic/claude-opus-4.8``, $5/$25 per Mtok). Using that as the\n# non-interactive fallback when a profile sets ``provider: nous`` with no model\n# silently bills the most expensive model for traffic the user never opted into\n# (a missing default escalated to Opus and billed 863 requests before the user\n# noticed). Pin the silent default to a low-cost curated model instead so a\n# missing model can never escalate to the flagship.\n#\n# This is deliberately a fixed, side-effect-free default for the hot resolution\n# path. The *interactive* default (``arcen model``) uses the richer\n# free/paid-tier-aware resolver — see ``partition_nous_models_by_tier`` — which\n# can hit the Portal; this fallback must stay cheap and network-free.\n_PROVIDER_SILENT_DEFAULT_OVERRIDES: dict[str, str] = {\n \"nous\": \"deepseek/deepseek-v4-flash\",\n}\n\n\ndef get_default_model_for_provider(provider: str) -> str:\n \"\"\"Return a cost-safe default model for a provider, or \"\" if unknown.\n\n Used as a NON-INTERACTIVE fallback when a provider is configured but no\n model was ever selected (e.g. ``arcen auth add openai-codex`` without\n ``arcen model``, or a profile that sets ``provider`` with no ``model``).\n\n For most providers this is the first entry in ``_PROVIDER_MODELS`` — the\n same model the ``arcen model`` picker offers first. For metered aggregators\n whose curated list is ordered most-capable-first, that entry is also the\n most EXPENSIVE one, so silently defaulting to it is a billing footgun. Such\n providers carry an explicit low-cost override in\n ``_PROVIDER_SILENT_DEFAULT_OVERRIDES``; a missing model must never\n auto-escalate to the flagship.\n \"\"\"\n models = _PROVIDER_MODELS.get(provider, [])\n override = _PROVIDER_SILENT_DEFAULT_OVERRIDES.get(provider)\n if override and override in models:\n return override\n return models[0] if models else \"\"\n\n\ndef _openrouter_model_is_free(pricing: Any) -> bool:\n \"\"\"Return True when both prompt and completion pricing are zero.\"\"\"\n if not isinstance(pricing, dict):\n return False\n try:\n return float(pricing.get(\"prompt\", \"0\")) == 0 and float(pricing.get(\"completion\", \"0\")) == 0\n except (TypeError, ValueError):\n return False\n\n\ndef _openrouter_model_supports_tools(item: Any) -> bool:\n \"\"\"Return True when the model's ``supported_parameters`` advertise tool calling.\n\n arcen-agent is tool-calling-first — every provider path assumes the model\n can invoke tools. Models that don't advertise ``tools`` in their\n ``supported_parameters`` (e.g. image-only or completion-only models) cannot\n be driven by the agent loop and would fail at the first tool call.\n\n **Permissive when the field is missing.** Some OpenRouter-compatible gateways\n (Nous Portal, private mirrors, older catalog snapshots) don't populate\n ``supported_parameters`` at all. Treat that as \"unknown capability → allow\"\n so the picker doesn't silently empty for those users. Only hide models\n whose ``supported_parameters`` is an explicit list that omits ``tools``.\n\n Ported from Kilo-Org/kilocode#9068.\n \"\"\"\n if not isinstance(item, dict):\n return True\n params = item.get(\"supported_parameters\")\n if not isinstance(params, list):\n # Field absent / malformed / None — be permissive.\n return True\n return \"tools\" in params\n\n\ndef fetch_openrouter_models(\n timeout: float = 8.0,\n *,\n force_refresh: bool = False,\n) -> list[tuple[str, str]]:\n \"\"\"Return the curated OpenRouter picker list, refreshed from the live catalog when possible.\"\"\"\n global _openrouter_catalog_cache\n\n if _openrouter_catalog_cache is not None and not force_refresh:\n return list(_openrouter_catalog_cache)\n\n # Prefer the remotely-hosted catalog manifest; fall back to the in-repo\n # snapshot when the manifest is unreachable. Both are curated lists that\n # drive the picker; the OpenRouter live /v1/models filter (tool support,\n # free pricing) is applied on top either way.\n try:\n from arcen_cli.model_catalog import get_curated_openrouter_models\n remote = get_curated_openrouter_models()\n except Exception:\n remote = None\n fallback = list(remote) if remote else list(OPENROUTER_MODELS)\n preferred_ids = [mid for mid, _ in fallback]\n\n try:\n req = urllib.request.Request(\n \"https://openrouter.ai/api/v1/models\",\n headers={\"Accept\": \"application/json\"},\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except Exception:\n return list(_openrouter_catalog_cache or fallback)\n\n live_items = payload.get(\"data\", [])\n if not isinstance(live_items, list):\n return list(_openrouter_catalog_cache or fallback)\n\n live_by_id: dict[str, dict[str, Any]] = {}\n for item in live_items:\n if not isinstance(item, dict):\n continue\n mid = str(item.get(\"id\") or \"\").strip()\n if not mid:\n continue\n live_by_id[mid] = item\n\n curated: list[tuple[str, str]] = []\n for preferred_id in preferred_ids:\n live_item = live_by_id.get(preferred_id)\n if live_item is None:\n continue\n # Hide models that don't advertise tool-calling support — arcen-agent\n # requires it and surfacing them leads to immediate runtime failures\n # when the user selects them. Ported from Kilo-Org/kilocode#9068.\n if not _openrouter_model_supports_tools(live_item):\n continue\n desc = \"free\" if _openrouter_model_is_free(live_item.get(\"pricing\")) else \"\"\n curated.append((preferred_id, desc))\n\n if not curated:\n return list(_openrouter_catalog_cache or fallback)\n\n first_id, _ = curated[0]\n curated[0] = (first_id, \"recommended\")\n _openrouter_catalog_cache = curated\n return list(curated)\n\n\ndef model_ids(*, force_refresh: bool = False) -> list[str]:\n \"\"\"Return just the OpenRouter model-id strings.\"\"\"\n return [mid for mid, _ in fetch_openrouter_models(force_refresh=force_refresh)]\n\n\ndef get_curated_nous_model_ids() -> list[str]:\n \"\"\"Return the curated Nous Portal model-id list.\n\n Prefers the remotely-hosted catalog manifest (published under\n ``website/static/api/model-catalog.json``); falls back to the in-repo\n snapshot in ``_PROVIDER_MODELS[\"nous\"]`` when the manifest is\n unreachable. Always returns a list (never None).\n \"\"\"\n try:\n from arcen_cli.model_catalog import get_curated_nous_models\n remote = get_curated_nous_models()\n except Exception:\n remote = None\n if remote:\n return list(remote)\n return list(_PROVIDER_MODELS.get(\"nous\", []))\n\n\n# ---------------------------------------------------------------------------\n# Pricing helpers — fetch live pricing from OpenRouter-compatible /v1/models\n# ---------------------------------------------------------------------------\n\n# Cache: maps model_id → {\"prompt\": str, \"completion\": str} per endpoint\n_pricing_cache: dict[str, dict[str, dict[str, str]]] = {}\n\n\ndef _format_price_per_mtok(per_token_str: str) -> str:\n \"\"\"Convert a per-token price string to a human-friendly $/Mtok string.\n\n Always uses 2 decimal places so that prices align vertically when\n right-justified in a column (the decimal point stays in the same position).\n\n Examples:\n \"0.000003\" → \"$3.00\" (per million tokens)\n \"0.00003\" → \"$30.00\"\n \"0.00000015\" → \"$0.15\"\n \"0.0000001\" → \"$0.10\"\n \"0.00018\" → \"$180.00\"\n \"0\" → \"free\"\n \"\"\"\n try:\n val = float(per_token_str)\n except (TypeError, ValueError):\n return \"?\"\n if val == 0:\n return \"free\"\n per_m = val * 1_000_000\n return f\"${per_m:.2f}\"\n\n\ndef fetch_models_with_pricing(\n api_key: str | None = None,\n base_url: str = \"https://openrouter.ai/api\",\n timeout: float = 8.0,\n *,\n force_refresh: bool = False,\n) -> dict[str, dict[str, str]]:\n \"\"\"Fetch ``/v1/models`` and return ``{model_id: {prompt, completion}}`` pricing.\n\n Results are cached per *base_url* so repeated calls are free.\n Works with any OpenRouter-compatible endpoint (OpenRouter, Nous Portal).\n \"\"\"\n cache_key = (base_url or \"\").rstrip(\"/\")\n if not force_refresh and cache_key in _pricing_cache:\n return _pricing_cache[cache_key]\n\n url = cache_key.rstrip(\"/\") + \"/v1/models\"\n headers: dict[str, str] = {\n \"Accept\": \"application/json\",\n \"User-Agent\": _ARCEN_USER_AGENT,\n }\n if api_key:\n headers[\"Authorization\"] = f\"Bearer {api_key}\"\n\n try:\n req = urllib.request.Request(url, headers=headers)\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except Exception:\n _pricing_cache[cache_key] = {}\n return {}\n\n result: dict[str, dict[str, str]] = {}\n for item in payload.get(\"data\", []):\n mid = item.get(\"id\")\n pricing = item.get(\"pricing\")\n if mid and isinstance(pricing, dict):\n entry: dict[str, str] = {\n \"prompt\": str(pricing.get(\"prompt\", \"\")),\n \"completion\": str(pricing.get(\"completion\", \"\")),\n }\n if pricing.get(\"input_cache_read\"):\n entry[\"input_cache_read\"] = str(pricing[\"input_cache_read\"])\n if pricing.get(\"input_cache_write\"):\n entry[\"input_cache_write\"] = str(pricing[\"input_cache_write\"])\n result[mid] = entry\n\n _pricing_cache[cache_key] = result\n return result\n\n\ndef _resolve_openrouter_api_key() -> str:\n \"\"\"Best-effort OpenRouter API key for pricing fetch.\"\"\"\n return os.getenv(\"OPENROUTER_API_KEY\", \"\").strip()\n\n\n_DEFAULT_NOUS_INFERENCE_BASE = \"https://inference-api.nousresearch.com\"\n\n\ndef _resolve_nous_pricing_credentials() -> tuple[str, str]:\n \"\"\"Return ``(api_key, base_url)`` for Nous Portal pricing.\n\n The Nous inference ``/v1/models`` endpoint exposes pricing without\n authentication, so the api_key is best-effort: when runtime credential\n resolution fails (expired refresh token, missing auth.json, etc.) we\n still return the default inference base URL so the picker keeps\n working with anonymous pricing data. Free-tier users in particular\n need this — pricing drives the free/paid partition, and silently\n returning empty pricing because of an auth blip makes the picker\n look broken (\"No free models currently available\").\n \"\"\"\n try:\n from arcen_cli.auth import resolve_nous_runtime_credentials\n creds = resolve_nous_runtime_credentials()\n if creds:\n return (creds.get(\"api_key\", \"\"), creds.get(\"base_url\", \"\"))\n except Exception:\n pass\n return (\"\", _DEFAULT_NOUS_INFERENCE_BASE)\n\n\ndef get_pricing_for_provider(provider: str, *, force_refresh: bool = False) -> dict[str, dict[str, str]]:\n \"\"\"Return live pricing for providers that support it (openrouter, nous, novita).\"\"\"\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\":\n return fetch_models_with_pricing(\n api_key=_resolve_openrouter_api_key(),\n base_url=\"https://openrouter.ai/api\",\n force_refresh=force_refresh,\n )\n if normalized == \"novita\":\n return _fetch_novita_pricing(force_refresh=force_refresh)\n if normalized == \"nous\":\n api_key, base_url = _resolve_nous_pricing_credentials()\n if base_url:\n # Nous base_url typically looks like https://inference-api.nousresearch.com/v1\n # We need the part before /v1 for our fetch function\n stripped = base_url.rstrip(\"/\")\n if stripped.endswith(\"/v1\"):\n stripped = stripped[:-3]\n return fetch_models_with_pricing(\n api_key=api_key,\n base_url=stripped,\n force_refresh=force_refresh,\n )\n return {}\n\n\ndef _fetch_novita_pricing(\n timeout: float = 8.0,\n *,\n force_refresh: bool = False,\n) -> dict[str, dict[str, str]]:\n \"\"\"Fetch pricing from NovitaAI /v1/models.\n\n NovitaAI returns input/output prices per million tokens in units of\n 0.0001 USD. Convert them to the per-token strings used by the shared\n pricing formatter.\n\n Results are cached in ``_pricing_cache`` keyed on the resolved base URL —\n without this, every menu render or pricing lookup re-hits the network.\n \"\"\"\n api_key = os.getenv(\"NOVITA_API_KEY\", \"\").strip()\n if not api_key:\n return {}\n\n base_url = os.getenv(\"NOVITA_BASE_URL\", \"\").strip() or \"https://api.novita.ai/openai/v1\"\n cache_key = base_url.rstrip(\"/\")\n if not force_refresh and cache_key in _pricing_cache:\n return _pricing_cache[cache_key]\n\n url = cache_key + \"/models\"\n headers = {\n \"Authorization\": f\"Bearer {api_key}\",\n \"Accept\": \"application/json\",\n \"User-Agent\": _ARCEN_USER_AGENT,\n }\n\n try:\n req = urllib.request.Request(url, headers=headers)\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except Exception:\n _pricing_cache[cache_key] = {}\n return {}\n\n result: dict[str, dict[str, str]] = {}\n for item in payload.get(\"data\", []):\n if not isinstance(item, dict):\n continue\n mid = item.get(\"id\")\n if not mid:\n continue\n inp = item.get(\"input_token_price_per_m\")\n out = item.get(\"output_token_price_per_m\")\n if inp is None and out is None:\n continue\n result[str(mid)] = {\n \"prompt\": str(float(inp or 0) / 10_000 / 1_000_000),\n \"completion\": str(float(out or 0) / 10_000 / 1_000_000),\n }\n\n _pricing_cache[cache_key] = result\n return result\n\n\n# All provider IDs and aliases that are valid for the provider:model syntax.\n_KNOWN_PROVIDER_NAMES: set[str] = (\n set(_PROVIDER_LABELS.keys())\n | set(_PROVIDER_ALIASES.keys())\n | {\"openrouter\", \"custom\"}\n)\n\n\ndef list_available_providers() -> list[dict[str, str]]:\n \"\"\"Return info about all providers the user could use with ``provider:model``.\n\n Each dict has ``id``, ``label``, and ``aliases``.\n Checks which providers have valid credentials configured.\n\n Derives the provider list from :data:`CANONICAL_PROVIDERS` (single\n source of truth shared with ``arcen model``, ``/model``, etc.).\n \"\"\"\n # Derive display order from canonical list + custom\n provider_order = [p.slug for p in CANONICAL_PROVIDERS] + [\"custom\"]\n\n # Build reverse alias map\n aliases_for: dict[str, list[str]] = {}\n for alias, canonical in _PROVIDER_ALIASES.items():\n aliases_for.setdefault(canonical, []).append(alias)\n\n result = []\n for pid in provider_order:\n label = _PROVIDER_LABELS.get(pid, pid)\n alias_list = aliases_for.get(pid, [])\n # Check if this provider has credentials available\n has_creds = False\n try:\n from arcen_cli.auth import get_auth_status, has_usable_secret\n if pid == \"custom\":\n custom_base_url = _get_custom_base_url() or \"\"\n has_creds = bool(custom_base_url.strip())\n elif pid == \"openrouter\":\n has_creds = has_usable_secret(os.getenv(\"OPENROUTER_API_KEY\", \"\"))\n else:\n status = get_auth_status(pid)\n has_creds = bool(status.get(\"logged_in\") or status.get(\"configured\"))\n except Exception:\n pass\n result.append({\n \"id\": pid,\n \"label\": label,\n \"aliases\": alias_list,\n \"authenticated\": has_creds,\n })\n return result\n\n\ndef parse_model_input(raw: str, current_provider: str) -> tuple[str, str]:\n \"\"\"Parse ``/model`` input into ``(provider, model)``.\n\n Supports ``provider:model`` syntax to switch providers at runtime::\n\n openrouter:anthropic/claude-sonnet-4.5 → (\"openrouter\", \"anthropic/claude-sonnet-4.5\")\n nous:arcen-3 → (\"nous\", \"arcen-3\")\n anthropic/claude-sonnet-4.5 → (current_provider, \"anthropic/claude-sonnet-4.5\")\n gpt-5.4 → (current_provider, \"gpt-5.4\")\n\n The colon is only treated as a provider delimiter if the left side is a\n recognized provider name or alias. This avoids misinterpreting model names\n that happen to contain colons (e.g. ``anthropic/claude-3.5-sonnet:beta``).\n\n Returns ``(provider, model)`` where *provider* is either the explicit\n provider from the input or *current_provider* if none was specified.\n \"\"\"\n stripped = raw.strip()\n colon = stripped.find(\":\")\n if colon > 0:\n provider_part = stripped[:colon].strip().lower()\n model_part = stripped[colon + 1:].strip()\n if provider_part and model_part and provider_part in _KNOWN_PROVIDER_NAMES:\n # Support custom:name:model triple syntax for named custom\n # providers. ``custom:local:qwen`` → (\"custom:local\", \"qwen\").\n # Single colon ``custom:qwen`` → (\"custom\", \"qwen\") as before.\n if provider_part == \"custom\" and \":\" in model_part:\n second_colon = model_part.find(\":\")\n custom_name = model_part[:second_colon].strip()\n actual_model = model_part[second_colon + 1:].strip()\n if custom_name and actual_model:\n return (f\"custom:{custom_name}\", actual_model)\n return (normalize_provider(provider_part), model_part)\n return (current_provider, stripped)\n\n\ndef _get_custom_base_url() -> str:\n \"\"\"Get the custom endpoint base_url from config.yaml.\"\"\"\n try:\n from arcen_cli.config import load_config\n config = load_config()\n model_cfg = config.get(\"model\", {})\n if isinstance(model_cfg, dict):\n return str(model_cfg.get(\"base_url\", \"\")).strip()\n except Exception:\n pass\n return \"\"\n\n\ndef curated_models_for_provider(\n provider: Optional[str],\n *,\n force_refresh: bool = False,\n) -> list[tuple[str, str]]:\n \"\"\"Return ``(model_id, description)`` tuples for a provider's model list.\n\n Tries to fetch the live model list from the provider's API first,\n falling back to the static ``_PROVIDER_MODELS`` catalog if the API\n is unreachable.\n \"\"\"\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\":\n return fetch_openrouter_models(force_refresh=force_refresh)\n\n # Try live API first (Codex, Nous, etc. all support /models)\n live = provider_model_ids(normalized)\n if live:\n return [(m, \"\") for m in live]\n\n # Fallback to static catalog\n models = _PROVIDER_MODELS.get(normalized, [])\n return [(m, \"\") for m in models]\n\n\ndef _provider_keys(provider: str) -> set[str]:\n key = (provider or \"\").strip().lower()\n normalized = normalize_provider(provider)\n return {k for k in (key, normalized) if k}\n\n\ndef _model_in_provider_catalog(name_lower: str, providers: set[str]) -> bool:\n return any(\n name_lower == model.lower()\n for provider in providers\n for model in _PROVIDER_MODELS.get(provider, [])\n )\n\n\n_AGGREGATOR_PROVIDERS = frozenset(\n {\"nous\", \"openrouter\", \"copilot\", \"kilocode\"}\n)\n\n\ndef _resolve_static_model_alias(\n name_lower: str,\n current_keys: set[str],\n) -> Optional[tuple[str, str]]:\n \"\"\"Resolve short aliases (e.g. sonnet/opus) using static catalogs only.\"\"\"\n try:\n from arcen_cli.model_switch import MODEL_ALIASES\n except Exception:\n return None\n\n identity = MODEL_ALIASES.get(name_lower)\n if identity is None:\n return None\n\n vendor = identity.vendor\n family = identity.family\n\n def _match(provider: str) -> Optional[str]:\n models = _PROVIDER_MODELS.get(provider, [])\n if not models:\n return None\n prefix = (\n f\"{vendor}/{family}\"\n if provider in _AGGREGATOR_PROVIDERS\n else family\n ).lower()\n for model in models:\n if model.lower().startswith(prefix):\n return model\n return None\n\n for provider in current_keys:\n if matched := _match(provider):\n return provider, matched\n\n for provider in _PROVIDER_MODELS:\n if provider in current_keys or provider in _AGGREGATOR_PROVIDERS:\n continue\n if matched := _match(provider):\n return provider, matched\n\n for provider in _AGGREGATOR_PROVIDERS:\n if provider in current_keys and (matched := _match(provider)):\n return provider, matched\n\n return None\n\n\ndef detect_static_provider_for_model(\n model_name: str,\n current_provider: str,\n) -> Optional[tuple[str, str]]:\n \"\"\"Auto-detect a provider from static catalogs only.\n\n Returns ``(provider_id, model_name)``. The model name may be remapped\n when a static alias or bare provider name resolves to a catalog default.\n Returns ``None`` when no confident match is found.\n \"\"\"\n name = (model_name or \"\").strip()\n if not name:\n return None\n\n name_lower = name.lower()\n current_keys = _provider_keys(current_provider)\n\n alias_match = _resolve_static_model_alias(name_lower, current_keys)\n if alias_match:\n return alias_match\n\n # --- Step 0: bare provider name typed as model ---\n # If someone types `/model nous` or `/model anthropic`, treat it as a\n # provider switch and pick the first model from that provider's catalog.\n # Skip \"custom\" and \"openrouter\" — custom has no model catalog, and\n # openrouter requires an explicit model name to be useful.\n resolved_provider = _PROVIDER_ALIASES.get(name_lower, name_lower)\n if resolved_provider not in {\"custom\", \"openrouter\"}:\n default_models = _PROVIDER_MODELS.get(resolved_provider, [])\n if (\n resolved_provider in _PROVIDER_LABELS\n and default_models\n and resolved_provider not in current_keys\n ):\n return (resolved_provider, default_models[0])\n\n # Aggregators list other providers' models — never auto-switch TO them\n # If the model belongs to the current provider's catalog, don't suggest switching\n if _model_in_provider_catalog(name_lower, current_keys):\n return None\n\n # --- Step 1: check static provider catalogs for a direct match ---\n for pid, models in _PROVIDER_MODELS.items():\n if pid in current_keys or pid in _AGGREGATOR_PROVIDERS:\n continue\n if any(name_lower == m.lower() for m in models):\n return (pid, name)\n\n return None\n\n\ndef detect_provider_for_model(\n model_name: str,\n current_provider: str,\n) -> Optional[tuple[str, str]]:\n \"\"\"Auto-detect the best provider for a model name.\n\n Returns ``(provider_id, model_name)`` — the model name may be remapped\n (e.g. bare ``deepseek-chat`` → ``deepseek/deepseek-chat`` for OpenRouter).\n Returns ``None`` when no confident match is found.\n\n Priority:\n 0. Bare provider name → switch to that provider's default model\n 1. Direct provider static catalog match\n 2. OpenRouter catalog match\n \"\"\"\n name = (model_name or \"\").strip()\n if not name:\n return None\n\n static_match = detect_static_provider_for_model(name, current_provider)\n if static_match:\n return static_match\n if _model_in_provider_catalog(name.lower(), _provider_keys(current_provider)):\n return None\n\n # --- Step 2: check OpenRouter catalog ---\n # First try exact match (handles provider/model format)\n or_slug = _find_openrouter_slug(name)\n if or_slug:\n if current_provider != \"openrouter\":\n return (\"openrouter\", or_slug)\n # Already on openrouter, just return the resolved slug\n if or_slug != name:\n return (\"openrouter\", or_slug)\n return None # already on openrouter with matching name\n\n return None\n\n\ndef _find_openrouter_slug(model_name: str) -> Optional[str]:\n \"\"\"Find the full OpenRouter model slug for a bare or partial model name.\n\n Handles:\n - Exact match: ``anthropic/claude-opus-4.6`` → as-is\n - Bare name: ``deepseek-chat`` → ``deepseek/deepseek-chat``\n - Bare name: ``claude-opus-4.6`` → ``anthropic/claude-opus-4.6``\n \"\"\"\n name_lower = model_name.strip().lower()\n if not name_lower:\n return None\n\n # Exact match (already has provider/ prefix)\n for mid in model_ids():\n if name_lower == mid.lower():\n return mid\n\n # Try matching just the model part (after the /)\n for mid in model_ids():\n if \"/\" in mid:\n _, model_part = mid.split(\"/\", 1)\n if name_lower == model_part.lower():\n return mid\n\n return None\n\n\ndef normalize_provider(provider: Optional[str]) -> str:\n \"\"\"Normalize provider aliases to Arcen' canonical provider ids.\n\n Note: ``\"auto\"`` passes through unchanged — use\n ``arcen_cli.auth.resolve_provider()`` to resolve it to a concrete\n provider based on credentials and environment.\n \"\"\"\n normalized = (provider or \"openrouter\").strip().lower()\n return _PROVIDER_ALIASES.get(normalized, normalized)\n\n\ndef provider_label(provider: Optional[str]) -> str:\n \"\"\"Return a human-friendly label for a provider id or alias.\"\"\"\n original = (provider or \"openrouter\").strip()\n normalized = original.lower()\n if normalized == \"auto\":\n return \"Auto\"\n normalized = normalize_provider(normalized)\n return _PROVIDER_LABELS.get(normalized, original or \"OpenRouter\")\n\n\n# Models that support OpenAI Priority Processing (service_tier=\"priority\").\n# See https://openai.com/api-priority-processing/ for the canonical list.\n#\n# Pattern-based matching — any OpenAI flagship model (gpt-*, o1*, o3*, o4*)\n# is assumed to support Priority Processing. service_tier=priority is silently\n# ignored by non-OpenAI endpoints (OpenRouter/Copilot/opencode-zen proxies\n# strip the field), so false positives are harmless. Codex-series models\n# (gpt-5-codex, gpt-5.3-codex, etc.) are excluded — they don't expose the\n# service_tier parameter through the Codex Responses API.\n_OPENAI_FAST_MODE_PREFIXES: tuple[str, ...] = (\n \"gpt-\",\n \"o1\",\n \"o3\",\n \"o4\",\n)\n\n\ndef _is_openai_fast_model(model_id: Optional[str]) -> bool:\n \"\"\"Return True if the model is an OpenAI flagship eligible for Priority Processing.\"\"\"\n raw = _strip_vendor_prefix(str(model_id or \"\"))\n base = raw.split(\":\")[0]\n if not base:\n return False\n # Exclude Codex-series — they route through the Codex Responses API\n # which doesn't accept service_tier.\n if \"codex\" in base:\n return False\n return any(base.startswith(prefix) for prefix in _OPENAI_FAST_MODE_PREFIXES)\n\n\n# Models that support Anthropic Fast Mode (speed=\"fast\").\n# See https://platform.claude.com/docs/en/build-with-claude/fast-mode\n#\n# Pattern-based matching — any claude-* model is eligible. The anthropic\n# adapter gates speed=fast on native Anthropic endpoints only (see\n# _is_third_party_anthropic_endpoint in agent/anthropic_adapter.py), so\n# third-party proxies that would reject the beta header are protected.\n\n\ndef _strip_vendor_prefix(model_id: str) -> str:\n \"\"\"Strip vendor/ prefix from a model ID (e.g. 'anthropic/claude-opus-4-6' -> 'claude-opus-4-6').\"\"\"\n raw = str(model_id or \"\").strip().lower()\n if \"/\" in raw:\n raw = raw.split(\"/\", 1)[1]\n return raw\n\n\ndef model_supports_fast_mode(model_id: Optional[str]) -> bool:\n \"\"\"Return whether Arcen should expose the /fast toggle for this model.\"\"\"\n return _is_anthropic_fast_model(model_id) or _is_openai_fast_model(model_id)\n\n\ndef _is_anthropic_fast_model(model_id: Optional[str]) -> bool:\n \"\"\"Return True if the model accepts the Anthropic Fast Mode ``speed`` param.\n\n This gates the *speed=fast request parameter*, which Anthropic supports on\n Opus 4.6 only (Opus 4.7 explicitly 400s). It is deliberately NOT a general\n \"is this a fast model\" check: for Opus 4.8 the fast offering is a SEPARATE\n model id (``…-opus-4.8-fast``) selected via the model field, not the speed\n parameter — see ``agent.anthropic_adapter._supports_fast_mode`` and its\n test. Keep this in lock-step with that adapter gate so the UI never shows a\n Fast toggle that the runtime would silently drop.\n \"\"\"\n raw = _strip_vendor_prefix(str(model_id or \"\"))\n base = raw.split(\":\")[0]\n if not base.startswith(\"claude-\"):\n return False\n # Only Opus 4.6 supports the speed=fast parameter at present.\n return \"opus-4-6\" in base or \"opus-4.6\" in base\n\n\ndef resolve_fast_mode_overrides(model_id: Optional[str]) -> dict[str, Any] | None:\n \"\"\"Return request_overrides for fast/priority mode, or None if unsupported.\n\n Returns provider-appropriate overrides:\n - OpenAI models: ``{\"service_tier\": \"priority\"}`` (Priority Processing)\n - Anthropic models: ``{\"speed\": \"fast\"}`` (Anthropic Fast Mode beta)\n\n The overrides are injected into the API request kwargs by\n ``_build_api_kwargs`` in run_agent.py — each API path handles its own\n keys (service_tier for OpenAI/Codex, speed for Anthropic Messages).\n \"\"\"\n if not model_supports_fast_mode(model_id):\n return None\n if _is_anthropic_fast_model(model_id):\n return {\"speed\": \"fast\"}\n return {\"service_tier\": \"priority\"}\n\n\ndef _resolve_copilot_catalog_api_key() -> str:\n \"\"\"Best-effort GitHub token for fetching the Copilot model catalog.\n\n Resolution order:\n 1. ``resolve_api_key_provider_credentials(\"copilot\")`` — env vars\n (``COPILOT_GITHUB_TOKEN`` / ``GH_TOKEN`` / ``GITHUB_TOKEN``) plus\n the ``gh auth token`` CLI fallback.\n 2. ``read_credential_pool(\"copilot\")`` — a token (typically a\n ``gho_*`` from device-code login, or a fine-grained PAT) stored in\n ``auth.json`` under ``credential_pool.copilot[]``. The pool is\n populated by ``arcen auth add copilot`` and by ``_seed_from_env``\n when the env var is set in ``~/.arcen/.env``.\n\n Without (2), users whose only Copilot credential is in the pool see\n the ``/model`` picker fall back to a stale hardcoded list because the\n live catalog fetch silently 401s. To avoid wedging on a malformed pool\n entry, each candidate is exchanged via ``exchange_copilot_token`` —\n only entries that actually exchange successfully are returned, so a\n later valid entry is reachable when an earlier one is unsupported.\n \"\"\"\n try:\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n creds = resolve_api_key_provider_credentials(\"copilot\")\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n if api_key:\n return api_key\n except Exception:\n pass\n\n try:\n from arcen_cli.auth import read_credential_pool\n from arcen_cli.copilot_auth import (\n exchange_copilot_token,\n validate_copilot_token,\n )\n\n for entry in read_credential_pool(\"copilot\"):\n if not isinstance(entry, dict):\n continue\n raw = str(entry.get(\"access_token\") or \"\").strip()\n if not raw:\n continue\n valid, _ = validate_copilot_token(raw)\n if not valid:\n continue\n try:\n api_token, _expires_at = exchange_copilot_token(raw)\n except Exception:\n continue\n if api_token:\n return api_token\n except Exception:\n pass\n\n return \"\"\n\n\n# Providers where models.dev is treated as authoritative: curated static\n# lists are kept only as an offline fallback and to capture custom additions\n# the registry doesn't publish yet. Adding a provider here causes its\n# curated list to be merged with fresh models.dev entries (fresh first, any\n# curated-only names appended) for both the CLI and the gateway /model picker.\n#\n# DELIBERATELY EXCLUDED:\n# - \"openrouter\": curated list is already a hand-picked agentic subset of\n# OpenRouter's 400+ catalog. Blindly merging would dump everything.\n# - \"nous\": curated list and Portal /models endpoint are the source of\n# truth for the subscription tier.\n# Also excluded: providers that already have dedicated live-endpoint\n# branches below (copilot, anthropic, ollama-cloud, custom,\n# stepfun, openai-codex) — those paths handle freshness themselves.\n_MODELS_DEV_PREFERRED: frozenset[str] = frozenset({\n \"opencode-go\",\n \"opencode-zen\",\n \"deepseek\",\n \"kilocode\",\n \"fireworks\",\n \"mistral\",\n \"togetherai\",\n \"cohere\",\n \"perplexity\",\n \"groq\",\n \"nvidia\",\n \"huggingface\",\n \"zai\",\n \"gemini\",\n \"google\",\n})\n\n\ndef _merge_with_models_dev(provider: str, curated: list[str]) -> list[str]:\n \"\"\"Merge curated list with fresh models.dev entries for a preferred provider.\n\n Returns models.dev entries first (in models.dev order), then any\n curated-only entries appended. Preserves case for curated fallbacks\n (e.g. ``MiniMax-M2.7``) while trusting models.dev for newer variants.\n\n If models.dev is unreachable or returns nothing, the curated list is\n returned unchanged — this is the offline/CI fallback path.\n \"\"\"\n try:\n from agent.models_dev import list_agentic_models\n mdev = list_agentic_models(provider)\n except Exception:\n mdev = []\n\n if not mdev:\n return list(curated)\n\n # Case-insensitive dedup while preserving order and curated casing.\n seen_lower: set[str] = set()\n merged: list[str] = []\n for mid in mdev:\n key = str(mid).lower()\n if key in seen_lower:\n continue\n seen_lower.add(key)\n merged.append(mid)\n for mid in curated:\n key = str(mid).lower()\n if key in seen_lower:\n continue\n seen_lower.add(key)\n merged.append(mid)\n return merged\n\n\ndef provider_model_ids(provider: Optional[str], *, force_refresh: bool = False) -> list[str]:\n \"\"\"Return the best known model catalog for a provider.\n\n Tries live API endpoints for providers that support them (Codex, Nous),\n falling back to static lists. For providers in ``_MODELS_DEV_PREFERRED``\n (opencode-go/zen, xiaomi, deepseek, smaller inference providers, etc.),\n models.dev entries are merged on top of curated so new models released\n on the platform appear in ``/model`` without an Arcen release.\n \"\"\"\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\":\n return model_ids(force_refresh=force_refresh)\n if normalized == \"openai-codex\":\n from arcen_cli.codex_models import get_codex_model_ids\n\n # Pass the live OAuth access token so the picker matches whatever\n # ChatGPT lists for this account right now (new models appear without\n # an Arcen release). Falls back to the hardcoded catalog if no token\n # or the endpoint is unreachable.\n access_token = None\n try:\n from arcen_cli.auth import resolve_codex_runtime_credentials\n\n creds = resolve_codex_runtime_credentials(refresh_if_expiring=True)\n access_token = creds.get(\"api_key\")\n except Exception:\n access_token = None\n return get_codex_model_ids(access_token=access_token)\n if normalized == \"xai-oauth\":\n return list(_PROVIDER_MODELS.get(\"xai-oauth\", _PROVIDER_MODELS.get(\"xai\", [])))\n if normalized in {\"copilot\", \"copilot-acp\"}:\n try:\n live = _fetch_github_models(_resolve_copilot_catalog_api_key())\n if live:\n return live\n except Exception:\n pass\n if normalized == \"copilot-acp\":\n return list(_PROVIDER_MODELS.get(\"copilot\", []))\n if normalized == \"nous\":\n # Try live Nous Portal /models endpoint\n try:\n from arcen_cli.auth import fetch_nous_models, resolve_nous_runtime_credentials\n creds = resolve_nous_runtime_credentials()\n if creds:\n live = fetch_nous_models(api_key=creds.get(\"api_key\", \"\"), inference_base_url=creds.get(\"base_url\", \"\"))\n if live:\n return live\n except Exception:\n pass\n # Live failed (or no creds). Fall back to the docs-hosted manifest\n # — NOT the in-repo _PROVIDER_MODELS[\"nous\"] snapshot — so newly\n # added Portal models still surface without an Arcen release.\n manifest_ids = get_curated_nous_model_ids()\n if manifest_ids:\n return manifest_ids\n if normalized == \"stepfun\":\n try:\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n creds = resolve_api_key_provider_credentials(\"stepfun\")\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n base_url = str(creds.get(\"base_url\") or \"\").strip()\n if api_key and base_url:\n live = fetch_api_models(api_key, base_url)\n if live:\n return live\n except Exception:\n pass\n if normalized == \"anthropic\":\n live = _fetch_anthropic_models()\n if live:\n return live\n if normalized == \"ollama-cloud\":\n live = fetch_ollama_cloud_models(force_refresh=force_refresh)\n if live:\n return live\n if normalized in (\"openai\", \"openai-api\"):\n api_key = os.getenv(\"OPENAI_API_KEY\", \"\").strip()\n if api_key:\n base_raw = os.getenv(\"OPENAI_BASE_URL\", \"\").strip().rstrip(\"/\")\n base = base_raw or \"https://api.openai.com/v1\"\n # Custom OpenAI-compatible endpoints (proxies, gateways, self-hosted)\n # may serve a small curated catalog — use the live list verbatim so\n # discovery works. But the canonical api.openai.com /v1/models dump\n # is 120+ entries of embeddings, whisper, tts, dall-e, moderation and\n # legacy chat models — none of which belong in the agent model picker.\n # For the default endpoint, intersect the live list with our curated\n # agentic catalog so ``/model`` matches what ``arcen model`` shows.\n is_default_openai = base.rstrip(\"/\") in (\n \"https://api.openai.com/v1\",\n \"https://api.openai.com\",\n )\n try:\n live = fetch_api_models(api_key, base)\n if live:\n if is_default_openai:\n live_lower = {m.lower() for m in live}\n curated = list(_PROVIDER_MODELS.get(normalized, []))\n # Keep curated order; only surface curated models the\n # account actually has access to.\n filtered = [m for m in curated if m.lower() in live_lower]\n if filtered:\n return filtered\n # Account serves none of the curated models (rare —\n # e.g. org without GPT-5 access). Fall back to curated\n # so the picker still offers sane defaults.\n return curated or live\n return live\n except Exception:\n pass\n if normalized == \"gmi\":\n try:\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n creds = resolve_api_key_provider_credentials(\"gmi\")\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n base_url = str(creds.get(\"base_url\") or \"\").strip()\n if api_key and base_url:\n live = fetch_api_models(api_key, base_url)\n if live:\n return live\n except Exception:\n pass\n if normalized == \"custom\":\n base_url = _get_custom_base_url()\n if base_url:\n # Try common API key env vars for custom endpoints\n api_key = (\n os.getenv(\"CUSTOM_API_KEY\", \"\")\n or os.getenv(\"OPENAI_API_KEY\", \"\")\n or os.getenv(\"OPENROUTER_API_KEY\", \"\")\n )\n live = fetch_api_models(api_key, base_url)\n if live:\n return live\n # Bedrock uses live discovery keyed by the resolved AWS region so that\n # EU/AP users see eu.*/ap.* model IDs instead of the static us.* list.\n # Note: early return intentionally skips _MODELS_DEV_PREFERRED merge\n # below — bedrock is not expected to appear in that table.\n if normalized == \"bedrock\":\n try:\n from agent.bedrock_adapter import bedrock_model_ids_or_none\n ids = bedrock_model_ids_or_none()\n if ids is not None:\n return ids\n except Exception:\n pass\n\n # ── Profile-based generic live fetch (all simple api-key providers) ──\n # Handles any provider registered in providers/ with auth_type=\"api_key\".\n # Replaces per-provider copy-paste blocks (stepfun, gmi, zai, etc.).\n try:\n from providers import get_provider_profile\n from arcen_cli.auth import resolve_api_key_provider_credentials\n\n _p = get_provider_profile(normalized)\n if _p and _p.auth_type == \"api_key\" and _p.base_url:\n try:\n creds = resolve_api_key_provider_credentials(normalized)\n api_key = str(creds.get(\"api_key\") or \"\").strip()\n base_url = str(creds.get(\"base_url\") or \"\").strip()\n except Exception:\n api_key, base_url = \"\", _p.base_url\n if not base_url:\n base_url = _p.base_url\n if api_key:\n live = _p.fetch_models(api_key=api_key)\n if live:\n return live\n # Use profile's fallback_models if defined\n if _p.fallback_models:\n return list(_p.fallback_models)\n except Exception:\n pass\n\n curated_static = list(_PROVIDER_MODELS.get(normalized, []))\n if normalized in _MODELS_DEV_PREFERRED:\n return _merge_with_models_dev(normalized, curated_static)\n return curated_static\n\n\n# ---------------------------------------------------------------------------\n# Generic disk cache for provider_model_ids() — keeps /model picker fast.\n# ---------------------------------------------------------------------------\n#\n# Without this layer, every /model picker open re-fetches every authed\n# provider's /v1/models endpoint. On a well-configured user (anthropic +\n# openai + copilot + gemini + huggingface + ...) that's 2+ seconds of cold\n# HTTP roundtrips just to render the provider list.\n#\n# Cache strategy:\n# - One JSON file at $ARCEN_HOME/provider_models_cache.json\n# - Per-provider entries keyed by (provider, credential fingerprint)\n# - Credential fingerprint = sha256 of env-var values that the provider\n# normally reads. Swap your OPENAI_API_KEY and the entry invalidates.\n# - 1h TTL by default. `force_refresh=True` skips the cache entirely\n# and overwrites it on success.\n# - Only NON-EMPTY results are cached. An empty/None response from a\n# transient network error never gets pinned.\n# - Cache file is best-effort. Any read/write error degrades silently\n# to a live fetch — the picker keeps working.\n\n_PROVIDER_MODELS_CACHE_TTL = 3600 # 1h\n\n\ndef _provider_models_cache_path() -> Path:\n from arcen_constants import get_arcen_home\n return get_arcen_home() / \"provider_models_cache.json\"\n\n\ndef _credential_fingerprint(provider: str) -> str:\n \"\"\"Return a short hash representing the credentials that\n ``provider_model_ids(provider)`` would see right now.\n\n Rotating any of the relevant env vars invalidates the cached entry\n for that provider. We hash AT LEAST the api-key + base-url env vars\n declared in ``PROVIDER_REGISTRY``. For OAuth-backed providers\n (codex, copilot, anthropic-via-claude-code, nous portal), the\n relevant tokens live in ``$ARCEN_HOME/auth.json`` and external\n credential files. Rather than parse every shape, we additionally\n fold the mtime of those files into the fingerprint so refreshes\n after re-auth bust the cache.\n \"\"\"\n import hashlib\n import os as _os\n\n parts: list[str] = []\n\n # Env vars from PROVIDER_REGISTRY for this slug\n try:\n from arcen_cli.auth import PROVIDER_REGISTRY\n pcfg = PROVIDER_REGISTRY.get(provider)\n if pcfg is not None:\n for ev in getattr(pcfg, \"api_key_env_vars\", ()) or ():\n parts.append(f\"{ev}={_os.environ.get(ev, '')}\")\n bev = getattr(pcfg, \"base_url_env_var\", \"\") or \"\"\n if bev:\n parts.append(f\"{bev}={_os.environ.get(bev, '')}\")\n except Exception:\n pass\n\n # OAuth / external-file mtimes that change on re-auth\n try:\n from arcen_constants import get_arcen_home\n for rel in (\"auth.json\", \"credentials.json\"):\n p = get_arcen_home() / rel\n try:\n parts.append(f\"{rel}@{p.stat().st_mtime_ns}\")\n except FileNotFoundError:\n parts.append(f\"{rel}@missing\")\n except Exception:\n pass\n except Exception:\n pass\n\n # External well-known credential file locations\n for path in (\n _os.path.expanduser(\"~/.codex/auth.json\"),\n _os.path.expanduser(\"~/.claude/.credentials.json\"),\n _os.path.expanduser(\"~/.config/github-copilot/hosts.json\"),\n _os.path.expanduser(\"~/.minimax/credentials.json\"),\n ):\n try:\n mt = _os.stat(path).st_mtime_ns\n parts.append(f\"{path}@{mt}\")\n except FileNotFoundError:\n parts.append(f\"{path}@missing\")\n except Exception:\n pass\n\n blob = \"|\".join(parts).encode(\"utf-8\", errors=\"replace\")\n # blake2b for cache-key fingerprinting only — not for credential storage.\n # We never reverse this hash; collisions are harmless (worst case: cache\n # miss → live re-fetch). Use blake2b instead of sha256 here because\n # CodeQL's `py/weak-sensitive-data-hashing` rule flags sha256 over env\n # vars whose names contain \"API_KEY\" / \"TOKEN\" even when the hash is\n # used as an identity fingerprint, not for password storage. blake2b\n # is a keyed-hash primitive and isn't flagged.\n return hashlib.blake2b(blob, digest_size=8).hexdigest()\n\n\ndef _load_provider_models_cache() -> dict:\n \"\"\"Return the full cache dict, or {} on any error.\"\"\"\n try:\n path = _provider_models_cache_path()\n if not path.exists():\n return {}\n with open(path, encoding=\"utf-8\") as f:\n data = json.load(f)\n return data if isinstance(data, dict) else {}\n except Exception:\n return {}\n\n\ndef _save_provider_models_cache(data: dict) -> None:\n \"\"\"Persist the cache dict. Best-effort — silent on any error.\"\"\"\n try:\n from utils import atomic_json_write\n path = _provider_models_cache_path()\n path.parent.mkdir(parents=True, exist_ok=True)\n atomic_json_write(path, data, indent=None)\n except Exception:\n pass\n\n\ndef cached_provider_model_ids(\n provider: Optional[str],\n *,\n force_refresh: bool = False,\n ttl_seconds: int = _PROVIDER_MODELS_CACHE_TTL,\n) -> list[str]:\n \"\"\"Disk-cached wrapper around :func:`provider_model_ids`.\n\n Hits the cache when fresh; otherwise calls the live function and\n persists a non-empty result. Always returns a list (never None).\n \"\"\"\n normalized = normalize_provider(provider) or (provider or \"\")\n if not normalized:\n return []\n\n cache = _load_provider_models_cache()\n fp = _credential_fingerprint(normalized)\n entry = cache.get(normalized)\n now = time.time()\n\n if (\n not force_refresh\n and isinstance(entry, dict)\n and entry.get(\"fp\") == fp\n and isinstance(entry.get(\"models\"), list)\n and entry[\"models\"]\n and (now - float(entry.get(\"at\", 0))) < ttl_seconds\n ):\n return list(entry[\"models\"])\n\n # Cache miss / stale / forced refresh — call the live path.\n live = provider_model_ids(normalized, force_refresh=force_refresh)\n if live:\n cache[normalized] = {\n \"fp\": fp,\n \"at\": now,\n \"models\": list(live),\n }\n _save_provider_models_cache(cache)\n return list(live)\n\n # Live fetch returned nothing. If we have a stale entry with the\n # SAME fingerprint, prefer it over an empty result — stale data\n # beats no data when the network is flaky.\n if (\n isinstance(entry, dict)\n and entry.get(\"fp\") == fp\n and isinstance(entry.get(\"models\"), list)\n and entry[\"models\"]\n ):\n return list(entry[\"models\"])\n return list(live or [])\n\n\ndef clear_provider_models_cache(provider: Optional[str] = None) -> None:\n \"\"\"Drop a single provider's cache entry, or wipe the whole cache.\n\n ``provider=None`` wipes everything; otherwise only that provider's\n entry is removed. Used by ``/model --refresh`` and\n ``arcen model --refresh``.\n \"\"\"\n try:\n if provider is None:\n path = _provider_models_cache_path()\n if path.exists():\n path.unlink()\n return\n cache = _load_provider_models_cache()\n normalized = normalize_provider(provider) or provider or \"\"\n if normalized in cache:\n del cache[normalized]\n _save_provider_models_cache(cache)\n except Exception:\n pass\n\n\ndef _fetch_anthropic_models(timeout: float = 5.0) -> Optional[list[str]]:\n \"\"\"Fetch available models from the Anthropic /v1/models endpoint.\n\n Uses resolve_anthropic_token() to find credentials (env vars or\n Claude Code auto-discovery). Returns sorted model IDs or None.\n \"\"\"\n try:\n from agent.anthropic_adapter import resolve_anthropic_token, _is_oauth_token\n except ImportError:\n return None\n\n token = resolve_anthropic_token()\n if not token:\n return None\n\n headers: dict[str, str] = {\"anthropic-version\": \"2023-06-01\"}\n is_oauth = _is_oauth_token(token)\n if is_oauth:\n headers[\"Authorization\"] = f\"Bearer {token}\"\n from agent.anthropic_adapter import _COMMON_BETAS, _OAUTH_ONLY_BETAS, _CONTEXT_1M_BETA\n headers[\"anthropic-beta\"] = \",\".join(_COMMON_BETAS + _OAUTH_ONLY_BETAS)\n else:\n headers[\"x-api-key\"] = token\n\n def _do_request(h: dict[str, str]):\n req = urllib.request.Request(\n \"https://api.anthropic.com/v1/models\",\n headers=h,\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n return json.loads(resp.read().decode())\n\n try:\n try:\n data = _do_request(headers)\n except urllib.error.HTTPError as http_err:\n # Reactive recovery for OAuth subscriptions that reject the 1M\n # context beta with 400 \"long context beta is not yet available\n # for this subscription\". Retry once without the beta; re-raise\n # anything else so the outer except logs it.\n if (\n is_oauth\n and http_err.code == 400\n ):\n try:\n body_text = http_err.read().decode(errors=\"ignore\").lower()\n except Exception:\n body_text = \"\"\n if \"long context beta\" in body_text and \"not yet available\" in body_text:\n headers[\"anthropic-beta\"] = \",\".join(\n [b for b in _COMMON_BETAS if b != _CONTEXT_1M_BETA]\n + list(_OAUTH_ONLY_BETAS)\n )\n data = _do_request(headers)\n else:\n raise\n else:\n raise\n models = [m[\"id\"] for m in data.get(\"data\", []) if m.get(\"id\")]\n # Sort: latest/largest first (opus > sonnet > haiku, higher version first)\n return sorted(models, key=lambda m: (\n \"opus\" not in m, # opus first\n \"sonnet\" not in m, # then sonnet\n \"haiku\" not in m, # then haiku\n m, # alphabetical within tier\n ))\n except Exception as e:\n import logging\n logging.getLogger(__name__).debug(\"Failed to fetch Anthropic models: %s\", e)\n return None\n\n\ndef _payload_items(payload: Any) -> list[dict[str, Any]]:\n if isinstance(payload, list):\n return [item for item in payload if isinstance(item, dict)]\n if isinstance(payload, dict):\n data = payload.get(\"data\", [])\n if isinstance(data, list):\n return [item for item in data if isinstance(item, dict)]\n return []\n\n\ndef copilot_default_headers() -> dict[str, str]:\n \"\"\"Standard headers for Copilot API requests.\n\n Includes Openai-Intent and x-initiator headers that opencode and the\n Copilot CLI send on every request.\n \"\"\"\n try:\n from arcen_cli.copilot_auth import copilot_request_headers\n return copilot_request_headers(is_agent_turn=True)\n except ImportError:\n return {\n \"Editor-Version\": COPILOT_EDITOR_VERSION,\n \"User-Agent\": \"ArcenAgent/1.0\",\n \"Openai-Intent\": \"conversation-edits\",\n \"x-initiator\": \"agent\",\n }\n\n\ndef _copilot_catalog_item_is_text_model(item: dict[str, Any]) -> bool:\n model_id = str(item.get(\"id\") or \"\").strip()\n if not model_id:\n return False\n\n if item.get(\"model_picker_enabled\") is False:\n return False\n\n capabilities = item.get(\"capabilities\")\n if isinstance(capabilities, dict):\n model_type = str(capabilities.get(\"type\") or \"\").strip().lower()\n if model_type and model_type != \"chat\":\n return False\n\n supported_endpoints = item.get(\"supported_endpoints\")\n if isinstance(supported_endpoints, list):\n normalized_endpoints = {\n str(endpoint).strip()\n for endpoint in supported_endpoints\n if str(endpoint).strip()\n }\n if normalized_endpoints and not normalized_endpoints.intersection(\n {\"/chat/completions\", \"/responses\", \"/v1/messages\"}\n ):\n return False\n\n return True\n\n\ndef fetch_github_model_catalog(\n api_key: Optional[str] = None, timeout: float = 5.0\n) -> Optional[list[dict[str, Any]]]:\n \"\"\"Fetch the live GitHub Copilot model catalog for this account.\"\"\"\n attempts: list[dict[str, str]] = []\n if api_key:\n attempts.append({\n **copilot_default_headers(),\n \"Authorization\": f\"Bearer {api_key}\",\n })\n attempts.append(copilot_default_headers())\n\n for headers in attempts:\n req = urllib.request.Request(COPILOT_MODELS_URL, headers=headers)\n try:\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n data = json.loads(resp.read().decode())\n items = _payload_items(data)\n models: list[dict[str, Any]] = []\n seen_ids: set[str] = set()\n for item in items:\n if not _copilot_catalog_item_is_text_model(item):\n continue\n model_id = str(item.get(\"id\") or \"\").strip()\n if not model_id or model_id in seen_ids:\n continue\n seen_ids.add(model_id)\n models.append(item)\n if models:\n return models\n except Exception:\n continue\n return None\n\n\n# ─── Copilot catalog context-window helpers ─────────────────────────────────\n\n# Module-level cache: {model_id: max_prompt_tokens}\n_copilot_context_cache: dict[str, int] = {}\n_copilot_context_cache_time: float = 0.0\n_COPILOT_CONTEXT_CACHE_TTL = 3600 # 1 hour\n\n\ndef get_copilot_model_context(model_id: str, api_key: Optional[str] = None) -> Optional[int]:\n \"\"\"Look up max_prompt_tokens for a Copilot model from the live /models API.\n\n Results are cached in-process for 1 hour to avoid repeated API calls.\n Returns the token limit or None if not found.\n \"\"\"\n global _copilot_context_cache, _copilot_context_cache_time\n\n # Serve from cache if fresh\n if _copilot_context_cache and (time.time() - _copilot_context_cache_time < _COPILOT_CONTEXT_CACHE_TTL):\n if model_id in _copilot_context_cache:\n return _copilot_context_cache[model_id]\n # Cache is fresh but model not in it — don't re-fetch\n return None\n\n # Fetch and populate cache\n catalog = fetch_github_model_catalog(api_key=api_key)\n if not catalog:\n return None\n\n cache: dict[str, int] = {}\n for item in catalog:\n mid = str(item.get(\"id\") or \"\").strip()\n if not mid:\n continue\n caps = item.get(\"capabilities\") or {}\n limits = caps.get(\"limits\") or {}\n max_prompt = limits.get(\"max_prompt_tokens\")\n if isinstance(max_prompt, int) and max_prompt > 0:\n cache[mid] = max_prompt\n\n _copilot_context_cache = cache\n _copilot_context_cache_time = time.time()\n\n return cache.get(model_id)\n\n\ndef _is_github_models_base_url(base_url: Optional[str]) -> bool:\n normalized = (base_url or \"\").strip().rstrip(\"/\").lower()\n return (\n normalized.startswith(COPILOT_BASE_URL)\n or normalized.startswith(\"https://models.github.ai/inference\")\n or normalized.startswith(\"https://models.inference.ai.azure.com\")\n )\n\n\ndef _lmstudio_server_root(base_url: Optional[str]) -> Optional[str]:\n \"\"\"Strip ``/v1`` suffix from an LM Studio base URL to get the native API root.\n\n Returns ``None`` when the base URL is empty/invalid.\n \"\"\"\n root = (base_url or \"\").strip().rstrip(\"/\")\n if root.endswith(\"/v1\"):\n root = root[:-3].rstrip(\"/\")\n return root or None\n\n\ndef _lmstudio_request_headers(api_key: Optional[str] = None) -> dict:\n \"\"\"Build HTTP headers for LM Studio native API requests.\"\"\"\n headers = {\"User-Agent\": _ARCEN_USER_AGENT}\n token = str(api_key or \"\").strip()\n if token:\n headers[\"Authorization\"] = f\"Bearer {token}\"\n return headers\n\n\ndef _lmstudio_fetch_raw_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n timeout: float = 5.0,\n) -> Optional[list[dict]]:\n \"\"\"Fetch the raw model list from LM Studio's ``/api/v1/models``.\n\n Returns the ``models`` list of dicts on success, ``None`` on network\n errors or malformed responses. Raises ``AuthError`` on HTTP 401/403.\n \"\"\"\n server_root = _lmstudio_server_root(base_url)\n if not server_root:\n return None\n\n headers = _lmstudio_request_headers(api_key)\n request = urllib.request.Request(server_root + \"/api/v1/models\", headers=headers)\n try:\n with urllib.request.urlopen(request, timeout=timeout) as resp:\n payload = json.loads(resp.read().decode())\n except urllib.error.HTTPError as exc:\n if exc.code in {401, 403}:\n from arcen_cli.auth import AuthError\n raise AuthError(\n f\"LM Studio rejected the request with HTTP {exc.code}.\",\n provider=\"lmstudio\",\n code=\"auth_rejected\",\n ) from exc\n import logging\n logging.getLogger(__name__).debug(\n \"LM Studio probe at %s failed with HTTP %s\", server_root, exc.code,\n )\n return None\n except Exception as exc:\n import logging\n logging.getLogger(__name__).debug(\n \"LM Studio probe at %s failed: %s\", server_root, exc,\n )\n return None\n\n raw_models = payload.get(\"models\") if isinstance(payload, dict) else None\n if not isinstance(raw_models, list):\n import logging\n logging.getLogger(__name__).debug(\n \"LM Studio probe at %s returned malformed payload (no `models` list)\",\n server_root,\n )\n return None\n return raw_models\n\n\ndef probe_lmstudio_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n timeout: float = 5.0,\n) -> Optional[list[str]]:\n \"\"\"Probe LM Studio's model listing.\n\n Returns chat-capable model keys on success, including the valid empty-list\n case when the server is reachable but has no non-embedding models.\n Returns ``None`` on network errors, malformed responses, or empty/invalid\n base URLs.\n\n Raises ``AuthError`` on HTTP 401/403 so callers can surface token issues\n separately from reachability problems.\n \"\"\"\n raw_models = _lmstudio_fetch_raw_models(api_key=api_key, base_url=base_url, timeout=timeout)\n if raw_models is None:\n return None\n\n keys: list[str] = []\n for raw in raw_models:\n if not isinstance(raw, dict):\n continue\n if str(raw.get(\"type\") or \"\").strip().lower() == \"embedding\":\n continue\n key = str(raw.get(\"key\") or raw.get(\"id\") or \"\").strip()\n if key and key not in keys:\n keys.append(key)\n return keys\n\n\ndef fetch_lmstudio_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n timeout: float = 5.0,\n) -> list[str]:\n \"\"\"Fetch LM Studio chat-capable model keys from native ``/api/v1/models``.\n\n Returns a list of model keys (e.g. ``publisher/model-name``) with embedding\n models filtered out. Returns an empty list on network errors, malformed\n responses, or empty/invalid base URLs.\n\n Raises ``AuthError`` on HTTP 401/403 so callers can distinguish a missing\n or wrong ``LM_API_KEY`` from an unreachable server — the most common\n LM Studio support case once auth-enabled mode is turned on.\n \"\"\"\n models = probe_lmstudio_models(api_key=api_key, base_url=base_url, timeout=timeout)\n return models or []\n\n\ndef ensure_lmstudio_model_loaded(\n model: str,\n base_url: Optional[str],\n api_key: Optional[str],\n target_context_length: int,\n timeout: float = 120.0,\n) -> Optional[int]:\n \"\"\"Ensure LM Studio has ``model`` loaded with at least ``target_context_length``.\n\n No-op when an instance is already loaded with sufficient context. Otherwise\n POSTs ``/api/v1/models/load`` to (re)load with the target context, capped\n at the model's ``max_context_length``. Returns the resolved loaded context\n length, or ``None`` when the probe / load failed.\n \"\"\"\n server_root = _lmstudio_server_root(base_url)\n if not server_root:\n return None\n\n headers = _lmstudio_request_headers(api_key)\n\n try:\n raw_models = _lmstudio_fetch_raw_models(api_key=api_key, base_url=base_url, timeout=10)\n except Exception:\n raw_models = None\n if raw_models is None:\n return None\n\n target_entry = None\n for raw in raw_models:\n if not isinstance(raw, dict):\n continue\n if raw.get(\"key\") == model or raw.get(\"id\") == model:\n target_entry = raw\n break\n if target_entry is None:\n return None\n\n max_ctx = target_entry.get(\"max_context_length\")\n if isinstance(max_ctx, int) and max_ctx > 0:\n target_context_length = min(target_context_length, max_ctx)\n\n for inst in target_entry.get(\"loaded_instances\") or []:\n cfg = inst.get(\"config\") if isinstance(inst, dict) else None\n loaded_ctx = cfg.get(\"context_length\") if isinstance(cfg, dict) else None\n if isinstance(loaded_ctx, int) and loaded_ctx >= target_context_length:\n return loaded_ctx\n\n body = json.dumps({\n \"model\": model,\n \"context_length\": target_context_length,\n }).encode()\n load_headers = dict(headers)\n load_headers[\"Content-Type\"] = \"application/json\"\n try:\n with urllib.request.urlopen(\n urllib.request.Request(\n server_root + \"/api/v1/models/load\",\n data=body,\n headers=load_headers,\n method=\"POST\",\n ),\n timeout=timeout,\n ) as resp:\n resp.read()\n except Exception:\n return None\n return target_context_length\n\n\ndef lmstudio_model_reasoning_options(\n model: str,\n base_url: Optional[str],\n api_key: Optional[str] = None,\n timeout: float = 5.0,\n) -> list[str]:\n \"\"\"Return the reasoning ``allowed_options`` LM Studio publishes for ``model``.\n\n Pulls ``capabilities.reasoning.allowed_options`` from ``/api/v1/models``.\n Returns ``[]`` when the model is unknown, the endpoint is unreachable,\n or the model does not declare a reasoning capability.\n \"\"\"\n try:\n raw_models = _lmstudio_fetch_raw_models(api_key=api_key, base_url=base_url, timeout=timeout)\n except Exception:\n raw_models = None\n if not raw_models:\n return []\n\n for raw in raw_models:\n if not isinstance(raw, dict):\n continue\n if raw.get(\"key\") != model and raw.get(\"id\") != model:\n continue\n caps = raw.get(\"capabilities\")\n reasoning = caps.get(\"reasoning\") if isinstance(caps, dict) else None\n opts = reasoning.get(\"allowed_options\") if isinstance(reasoning, dict) else None\n if isinstance(opts, list):\n return [str(o).strip().lower() for o in opts if isinstance(o, str)]\n return []\n return []\n\n\ndef _fetch_github_models(api_key: Optional[str] = None, timeout: float = 5.0) -> Optional[list[str]]:\n catalog = fetch_github_model_catalog(api_key=api_key, timeout=timeout)\n if not catalog:\n return None\n return [item.get(\"id\", \"\") for item in catalog if item.get(\"id\")]\n\n\n_COPILOT_MODEL_ALIASES = {\n \"openai/gpt-5\": \"gpt-5-mini\",\n \"openai/gpt-5-chat\": \"gpt-5-mini\",\n \"openai/gpt-5-mini\": \"gpt-5-mini\",\n \"openai/gpt-5-nano\": \"gpt-5-mini\",\n \"openai/gpt-4.1\": \"gpt-4.1\",\n \"openai/gpt-4.1-mini\": \"gpt-4.1\",\n \"openai/gpt-4.1-nano\": \"gpt-4.1\",\n \"openai/gpt-4o\": \"gpt-4o\",\n \"openai/gpt-4o-mini\": \"gpt-4o-mini\",\n \"openai/o1\": \"gpt-5.2\",\n \"openai/o1-mini\": \"gpt-5-mini\",\n \"openai/o1-preview\": \"gpt-5.2\",\n \"openai/o3\": \"gpt-5.3-codex\",\n \"openai/o3-mini\": \"gpt-5-mini\",\n \"openai/o4-mini\": \"gpt-5-mini\",\n \"anthropic/claude-opus-4.6\": \"claude-opus-4.6\",\n \"anthropic/claude-sonnet-4.6\": \"claude-sonnet-4.6\",\n \"anthropic/claude-sonnet-4\": \"claude-sonnet-4\",\n \"anthropic/claude-sonnet-4.5\": \"claude-sonnet-4.5\",\n \"anthropic/claude-haiku-4.5\": \"claude-haiku-4.5\",\n # Dash-notation fallbacks: Arcen' default Claude IDs elsewhere use\n # hyphens (anthropic native format), but Copilot's API only accepts\n # dot-notation. Accept both so users who configure copilot + a\n # default hyphenated Claude model don't hit HTTP 400\n # \"model_not_supported\". See issue #6879.\n \"claude-opus-4-6\": \"claude-opus-4.6\",\n \"claude-sonnet-4-6\": \"claude-sonnet-4.6\",\n \"claude-sonnet-4-0\": \"claude-sonnet-4\",\n \"claude-sonnet-4-5\": \"claude-sonnet-4.5\",\n \"claude-haiku-4-5\": \"claude-haiku-4.5\",\n \"anthropic/claude-opus-4-6\": \"claude-opus-4.6\",\n \"anthropic/claude-sonnet-4-6\": \"claude-sonnet-4.6\",\n \"anthropic/claude-sonnet-4-0\": \"claude-sonnet-4\",\n \"anthropic/claude-sonnet-4-5\": \"claude-sonnet-4.5\",\n \"anthropic/claude-haiku-4-5\": \"claude-haiku-4.5\",\n}\n\n\ndef _copilot_catalog_ids(\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> set[str]:\n if catalog is None and api_key:\n catalog = fetch_github_model_catalog(api_key=api_key)\n if not catalog:\n return set()\n return {\n str(item.get(\"id\") or \"\").strip()\n for item in catalog\n if str(item.get(\"id\") or \"\").strip()\n }\n\n\ndef normalize_copilot_model_id(\n model_id: Optional[str],\n *,\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> str:\n raw = str(model_id or \"\").strip()\n if not raw:\n return \"\"\n\n catalog_ids = _copilot_catalog_ids(catalog=catalog, api_key=api_key)\n alias = _COPILOT_MODEL_ALIASES.get(raw)\n if alias:\n return alias\n\n candidates = [raw]\n if \"/\" in raw:\n candidates.append(raw.split(\"/\", 1)[1].strip())\n\n if raw.endswith(\"-mini\"):\n candidates.append(raw[:-5])\n if raw.endswith(\"-nano\"):\n candidates.append(raw[:-5])\n if raw.endswith(\"-chat\"):\n candidates.append(raw[:-5])\n\n seen: set[str] = set()\n for candidate in candidates:\n if not candidate or candidate in seen:\n continue\n seen.add(candidate)\n if candidate in _COPILOT_MODEL_ALIASES:\n return _COPILOT_MODEL_ALIASES[candidate]\n if candidate in catalog_ids:\n return candidate\n\n if \"/\" in raw:\n return raw.split(\"/\", 1)[1].strip()\n return raw\n\n\ndef _github_reasoning_efforts_for_model_id(model_id: str) -> list[str]:\n raw = (model_id or \"\").strip().lower()\n if raw.startswith((\"openai/o1\", \"openai/o3\", \"openai/o4\", \"o1\", \"o3\", \"o4\")):\n return list(COPILOT_REASONING_EFFORTS_O_SERIES)\n normalized = normalize_copilot_model_id(model_id).lower()\n if normalized.startswith(\"gpt-5\"):\n return list(COPILOT_REASONING_EFFORTS_GPT5)\n return []\n\n\ndef _should_use_copilot_responses_api(model_id: str) -> bool:\n \"\"\"Decide whether a Copilot model should use the Responses API.\n\n Replicates opencode's ``shouldUseCopilotResponsesApi`` logic:\n GPT-5+ models use Responses API, except ``gpt-5-mini`` which uses\n Chat Completions. All non-GPT models (Claude, Gemini, etc.) use\n Chat Completions.\n \"\"\"\n import re\n\n match = re.match(r\"^gpt-(\\d+)\", model_id)\n if not match:\n return False\n major = int(match.group(1))\n return major >= 5 and not model_id.startswith(\"gpt-5-mini\")\n\n\ndef copilot_model_api_mode(\n model_id: Optional[str],\n *,\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> str:\n \"\"\"Determine the API mode for a Copilot model.\n\n Uses the model ID pattern (matching opencode's approach) as the\n primary signal. Falls back to the catalog's ``supported_endpoints``\n only for models not covered by the pattern check.\n \"\"\"\n # Fetch the catalog once so normalize + endpoint check share it\n # (avoids two redundant network calls for non-GPT-5 models).\n if catalog is None and api_key:\n catalog = fetch_github_model_catalog(api_key=api_key)\n\n normalized = normalize_copilot_model_id(model_id, catalog=catalog, api_key=api_key)\n if not normalized:\n return \"chat_completions\"\n\n # Primary: model ID pattern (matches opencode's shouldUseCopilotResponsesApi)\n if _should_use_copilot_responses_api(normalized):\n return \"codex_responses\"\n\n # Secondary: check catalog for non-GPT-5 models (Claude via /v1/messages, etc.)\n if catalog:\n catalog_entry = next((item for item in catalog if item.get(\"id\") == normalized), None)\n if isinstance(catalog_entry, dict):\n supported_endpoints = {\n str(endpoint).strip()\n for endpoint in (catalog_entry.get(\"supported_endpoints\") or [])\n if str(endpoint).strip()\n }\n # For non-GPT-5 models, check if they only support messages API\n if \"/v1/messages\" in supported_endpoints and \"/chat/completions\" not in supported_endpoints:\n return \"anthropic_messages\"\n\n return \"chat_completions\"\n\n\n# Azure Foundry model families that require the Responses API. Azure\n# rejects /chat/completions against these deployments with\n# ``400 \"The requested operation is unsupported.\"`` — the same payload Bob\n# Dobolina hit in April 2026 on ``gpt-5.3-codex`` while ``gpt-4o-pure`` on\n# the same endpoint worked fine. Keep the patterns broad enough to cover\n# vendor-renamed deployments (e.g. ``gpt-5.3-codex``, ``gpt-5-codex``,\n# ``gpt-5.4``, ``o1-preview``) but tight enough to leave GPT-4 / 3.5 / Llama /\n# Mistral / Grok deployments on chat completions.\n_AZURE_FOUNDRY_RESPONSES_PREFIXES = (\n \"codex\", # codex-*, codex-mini\n \"gpt-5\", # gpt-5, gpt-5.x, gpt-5-codex, gpt-5.x-codex\n \"o1\", # o1, o1-preview, o1-mini\n \"o3\", # o3, o3-mini\n \"o4\", # o4, o4-mini\n)\n\n\ndef azure_foundry_model_api_mode(model_name: Optional[str]) -> Optional[str]:\n \"\"\"Infer Azure Foundry api_mode from a deployment/model name.\n\n Returns ``\"codex_responses\"`` when the model name matches a family that\n only accepts the Responses API on Azure Foundry (GPT-5.x, codex, o1/o3/o4\n reasoning models). Returns ``None`` otherwise — the caller should fall\n back to the configured/default api_mode (typically ``chat_completions``)\n so GPT-4o, GPT-4 Turbo, Llama, Mistral, etc. keep working.\n\n Intentionally does NOT return ``anthropic_messages``; Anthropic-style\n Azure endpoints are disambiguated by URL (``/anthropic`` suffix) in\n ``runtime_provider._detect_api_mode_for_url`` and by the user setting\n ``model.api_mode: anthropic_messages`` explicitly.\n \"\"\"\n raw = str(model_name or \"\").strip().lower()\n if not raw:\n return None\n # Strip any vendor/ prefix a user may have copied from OpenRouter / Copilot.\n if \"/\" in raw:\n raw = raw.rsplit(\"/\", 1)[-1]\n # gpt-5-mini speaks chat completions on Copilot but Azure Foundry deploys\n # the full gpt-5 family uniformly on Responses API — don't carve an\n # exception here.\n for prefix in _AZURE_FOUNDRY_RESPONSES_PREFIXES:\n if raw.startswith(prefix):\n return \"codex_responses\"\n return None\n\n\ndef normalize_opencode_model_id(provider_id: Optional[str], model_id: Optional[str]) -> str:\n \"\"\"Normalize OpenCode config IDs to the bare model slug used in API requests.\"\"\"\n provider = normalize_provider(provider_id)\n current = str(model_id or \"\").strip()\n if not current or provider not in {\"opencode-zen\", \"opencode-go\"}:\n return current\n\n prefix = f\"{provider}/\"\n if current.lower().startswith(prefix):\n return current[len(prefix):]\n return current\n\n\ndef opencode_model_api_mode(provider_id: Optional[str], model_id: Optional[str]) -> str:\n \"\"\"Determine the API mode for an OpenCode Zen / Go model.\n\n OpenCode routes different models behind different API surfaces:\n\n - GPT-5 / Codex models on Zen use ``/v1/responses``\n - Claude models on Zen use ``/v1/messages``\n - MiniMax models on Go use ``/v1/messages``\n - GLM / Kimi on Go use ``/v1/chat/completions``\n - Other Zen models (Gemini, GLM, Kimi, MiniMax, Qwen, etc.) use\n ``/v1/chat/completions``\n\n This follows the published OpenCode docs for Zen and Go endpoints.\n \"\"\"\n provider = normalize_provider(provider_id)\n normalized = normalize_opencode_model_id(provider_id, model_id).lower()\n if not normalized:\n return \"chat_completions\"\n\n if provider == \"opencode-go\":\n if normalized.startswith(\"minimax-\"):\n return \"anthropic_messages\"\n if normalized.startswith(\"qwen3.7-max\"):\n return \"anthropic_messages\"\n return \"chat_completions\"\n\n if provider == \"opencode-zen\":\n if normalized.startswith(\"claude-\"):\n return \"anthropic_messages\"\n if normalized.startswith(\"gpt-\"):\n return \"codex_responses\"\n return \"chat_completions\"\n\n return \"chat_completions\"\n\n\ndef github_model_reasoning_efforts(\n model_id: Optional[str],\n *,\n catalog: Optional[list[dict[str, Any]]] = None,\n api_key: Optional[str] = None,\n) -> list[str]:\n \"\"\"Return supported reasoning-effort levels for a Copilot-visible model.\"\"\"\n normalized = normalize_copilot_model_id(model_id, catalog=catalog, api_key=api_key)\n if not normalized:\n return []\n\n catalog_entry = None\n if catalog is not None:\n catalog_entry = next((item for item in catalog if item.get(\"id\") == normalized), None)\n elif api_key:\n fetched_catalog = fetch_github_model_catalog(api_key=api_key)\n if fetched_catalog:\n catalog_entry = next((item for item in fetched_catalog if item.get(\"id\") == normalized), None)\n\n if catalog_entry is not None:\n capabilities = catalog_entry.get(\"capabilities\")\n if isinstance(capabilities, dict):\n supports = capabilities.get(\"supports\")\n if isinstance(supports, dict):\n efforts = supports.get(\"reasoning_effort\")\n if isinstance(efforts, list):\n normalized_efforts = [\n str(effort).strip().lower()\n for effort in efforts\n if str(effort).strip()\n ]\n return list(dict.fromkeys(normalized_efforts))\n return []\n legacy_capabilities = {\n str(capability).strip().lower()\n for capability in catalog_entry.get(\"capabilities\", [])\n if str(capability).strip()\n }\n if \"reasoning\" not in legacy_capabilities:\n return []\n\n return _github_reasoning_efforts_for_model_id(str(model_id or normalized))\n\n\ndef probe_api_models(\n api_key: Optional[str],\n base_url: Optional[str],\n timeout: float = 5.0,\n api_mode: Optional[str] = None,\n) -> dict[str, Any]:\n \"\"\"Probe a ``/models`` endpoint with light URL heuristics.\n\n For ``anthropic_messages`` mode, uses ``x-api-key`` and\n ``anthropic-version`` headers (Anthropic's native auth) instead of\n ``Authorization: Bearer``. The response shape (``data[].id``) is\n identical, so the same parser works for both.\n \"\"\"\n normalized = (base_url or \"\").strip().rstrip(\"/\")\n if not normalized:\n return {\n \"models\": None,\n \"probed_url\": None,\n \"resolved_base_url\": \"\",\n \"suggested_base_url\": None,\n \"used_fallback\": False,\n }\n\n if _is_github_models_base_url(normalized):\n models = _fetch_github_models(api_key=api_key, timeout=timeout)\n return {\n \"models\": models,\n \"probed_url\": COPILOT_MODELS_URL,\n \"resolved_base_url\": COPILOT_BASE_URL,\n \"suggested_base_url\": None,\n \"used_fallback\": False,\n }\n\n if normalized.endswith(\"/v1\"):\n alternate_base = normalized[:-3].rstrip(\"/\")\n else:\n alternate_base = normalized + \"/v1\"\n\n candidates: list[tuple[str, bool]] = [(normalized, False)]\n if alternate_base and alternate_base != normalized:\n candidates.append((alternate_base, True))\n\n tried: list[str] = []\n headers: dict[str, str] = {\"User-Agent\": _ARCEN_USER_AGENT}\n if api_key and api_mode == \"anthropic_messages\":\n headers[\"x-api-key\"] = api_key\n headers[\"anthropic-version\"] = \"2023-06-01\"\n elif api_key:\n headers[\"Authorization\"] = f\"Bearer {api_key}\"\n if normalized.startswith(COPILOT_BASE_URL):\n headers.update(copilot_default_headers())\n\n for candidate_base, is_fallback in candidates:\n url = candidate_base.rstrip(\"/\") + \"/models\"\n tried.append(url)\n req = urllib.request.Request(url, headers=headers)\n try:\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n data = json.loads(resp.read().decode())\n return {\n \"models\": [m.get(\"id\", \"\") for m in data.get(\"data\", [])],\n \"probed_url\": url,\n \"resolved_base_url\": candidate_base.rstrip(\"/\"),\n \"suggested_base_url\": alternate_base if alternate_base != candidate_base else normalized,\n \"used_fallback\": is_fallback,\n }\n except Exception:\n continue\n\n return {\n \"models\": None,\n \"probed_url\": tried[0] if tried else normalized.rstrip(\"/\") + \"/models\",\n \"resolved_base_url\": normalized,\n \"suggested_base_url\": alternate_base if alternate_base != normalized else None,\n \"used_fallback\": False,\n }\n\n\ndef fetch_api_models(\n api_key: Optional[str],\n base_url: Optional[str],\n timeout: float = 5.0,\n api_mode: Optional[str] = None,\n) -> Optional[list[str]]:\n \"\"\"Fetch the list of available model IDs from the provider's ``/models`` endpoint.\n\n Returns a list of model ID strings, or ``None`` if the endpoint could not\n be reached (network error, timeout, auth failure, etc.).\n \"\"\"\n return probe_api_models(api_key, base_url, timeout=timeout, api_mode=api_mode).get(\"models\")\n\n\n# ---------------------------------------------------------------------------\n# Ollama Cloud — merged model discovery with disk cache\n# ---------------------------------------------------------------------------\n\n\n\n_OLLAMA_CLOUD_CACHE_TTL = 3600 # 1 hour\n\n\ndef _strip_ollama_cloud_suffix(model_id: str) -> str:\n \"\"\"Strip :cloud / -cloud suffixes that models.dev appends to Ollama Cloud IDs.\n\n The live API uses clean IDs (e.g. 'kimi-k2.6') while models.dev sometimes\n returns them as 'kimi-k2.6:cloud'. Normalising before the dedup merge\n prevents duplicate entries in the merged model list.\n \"\"\"\n for suffix in (\":cloud\", \"-cloud\"):\n if model_id.endswith(suffix):\n return model_id[: -len(suffix)]\n return model_id\n\n\ndef _ollama_cloud_cache_path() -> Path:\n \"\"\"Return the path for the Ollama Cloud model cache.\"\"\"\n from arcen_constants import get_arcen_home\n return get_arcen_home() / \"ollama_cloud_models_cache.json\"\n\n\ndef _load_ollama_cloud_cache(*, ignore_ttl: bool = False) -> Optional[dict]:\n \"\"\"Load cached Ollama Cloud models from disk.\n\n Args:\n ignore_ttl: If True, return data even if the TTL has expired (stale fallback).\n \"\"\"\n try:\n cache_path = _ollama_cloud_cache_path()\n if not cache_path.exists():\n return None\n with open(cache_path, encoding=\"utf-8\") as f:\n data = json.load(f)\n if not isinstance(data, dict):\n return None\n models = data.get(\"models\")\n if not (isinstance(models, list) and models):\n return None\n if not ignore_ttl:\n cached_at = data.get(\"cached_at\", 0)\n if (time.time() - cached_at) > _OLLAMA_CLOUD_CACHE_TTL:\n return None # stale\n return data\n except Exception:\n pass\n return None\n\n\ndef _save_ollama_cloud_cache(models: list[str]) -> None:\n \"\"\"Persist the merged Ollama Cloud model list to disk.\"\"\"\n try:\n from utils import atomic_json_write\n cache_path = _ollama_cloud_cache_path()\n cache_path.parent.mkdir(parents=True, exist_ok=True)\n atomic_json_write(cache_path, {\"models\": models, \"cached_at\": time.time()}, indent=None)\n except Exception:\n pass\n\n\ndef fetch_ollama_cloud_models(\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n *,\n force_refresh: bool = False,\n) -> list[str]:\n \"\"\"Fetch Ollama Cloud models by merging live API + models.dev, with disk cache.\n\n Resolution order:\n 1. Disk cache (if fresh, < 1 hour, and not force_refresh)\n 2. Live ``/v1/models`` endpoint (primary — freshest source)\n 3. models.dev registry (secondary — fills gaps for unlisted models)\n 4. Merge: live models first, then models.dev additions (deduped)\n\n Returns a list of model IDs (never None — empty list on total failure).\n \"\"\"\n # 1. Check disk cache\n if not force_refresh:\n cached = _load_ollama_cloud_cache()\n if cached is not None:\n return cached[\"models\"]\n\n # 2. Live API probe\n if not api_key:\n api_key = os.getenv(\"OLLAMA_API_KEY\", \"\")\n if not base_url:\n base_url = os.getenv(\"OLLAMA_BASE_URL\", \"\") or \"https://ollama.com/v1\"\n\n live_models: list[str] = []\n if api_key:\n result = fetch_api_models(api_key, base_url, timeout=8.0)\n if result:\n live_models = result\n\n # 3. models.dev registry\n mdev_models: list[str] = []\n try:\n from agent.models_dev import list_agentic_models\n mdev_models = list_agentic_models(\"ollama-cloud\")\n except Exception:\n pass\n\n # 4. Merge: live first, then models.dev additions (deduped, order-preserving)\n if live_models or mdev_models:\n seen: set[str] = set()\n merged: list[str] = []\n for m in live_models:\n if m and m not in seen:\n seen.add(m)\n merged.append(m)\n for m in mdev_models:\n normalized = _strip_ollama_cloud_suffix(m)\n if normalized and normalized not in seen:\n seen.add(normalized)\n merged.append(normalized)\n if merged:\n _save_ollama_cloud_cache(merged)\n return merged\n\n # Total failure — return stale cache if available (ignore TTL)\n stale = _load_ollama_cloud_cache(ignore_ttl=True)\n if stale is not None:\n return stale[\"models\"]\n\n return []\n\n\ndef validate_requested_model(\n model_name: str,\n provider: Optional[str],\n *,\n api_key: Optional[str] = None,\n base_url: Optional[str] = None,\n api_mode: Optional[str] = None,\n) -> dict[str, Any]:\n \"\"\"\n Validate a ``/model`` value for the active provider.\n\n Performs format checks first, then probes the live API to confirm\n the model actually exists.\n\n Returns a dict with:\n - accepted: whether the CLI should switch to the requested model now\n - persist: whether it is safe to save to config\n - recognized: whether it matched a known provider catalog\n - message: optional warning / guidance for the user\n \"\"\"\n requested = (model_name or \"\").strip()\n normalized = normalize_provider(provider)\n if normalized == \"openrouter\" and base_url and \"openrouter.ai\" not in base_url:\n normalized = \"custom\"\n requested_for_lookup = requested\n if normalized == \"copilot\":\n requested_for_lookup = normalize_copilot_model_id(\n requested,\n api_key=api_key,\n ) or requested\n\n if not requested:\n return {\n \"accepted\": False,\n \"persist\": False,\n \"recognized\": False,\n \"message\": \"Model name cannot be empty.\",\n }\n\n if any(ch.isspace() for ch in requested):\n return {\n \"accepted\": False,\n \"persist\": False,\n \"recognized\": False,\n \"message\": \"Model names cannot contain spaces.\",\n }\n\n if normalized == \"lmstudio\":\n from arcen_cli.auth import AuthError\n # Use probe_lmstudio_models so we can distinguish None (unreachable\n # / malformed response) from [] (reachable, but no chat-capable models\n # are loaded). fetch_lmstudio_models collapses both to [].\n try:\n models = probe_lmstudio_models(api_key=api_key, base_url=base_url)\n except AuthError as exc:\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": (\n f\"{exc} Set `LM_API_KEY` (or update it) to match the server's bearer token.\"\n ),\n }\n if models is None:\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": f\"Could not reach LM Studio's `/api/v1/models` to validate `{requested}`.\",\n }\n if not models:\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": (\n f\"LM Studio is reachable but no chat-capable models are loaded. \"\n f\"Load `{requested}` in LM Studio (Developer tab → Load Model) and try again.\"\n ),\n }\n if requested_for_lookup in set(models):\n return {\"accepted\": True, \"persist\": True, \"recognized\": True, \"message\": None}\n return {\n \"accepted\": False, \"persist\": False, \"recognized\": False,\n \"message\": f\"Model `{requested}` was not found in LM Studio's model listing.\",\n }\n\n if normalized == \"custom\" or normalized.startswith(\"custom:\"):\n # Try probing with correct auth for the api_mode.\n if api_mode == \"anthropic_messages\":\n probe = probe_api_models(api_key, base_url, api_mode=api_mode)\n else:\n probe = probe_api_models(api_key, base_url)\n api_models = probe.get(\"models\")\n if api_models is not None:\n if requested_for_lookup in set(api_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n\n # Auto-correct if the top match is very similar (e.g. typo)\n auto = get_close_matches(requested_for_lookup, api_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n\n suggestions = get_close_matches(requested, api_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n\n message = (\n f\"Note: `{requested}` was not found in this custom endpoint's model listing \"\n f\"({probe.get('probed_url')}). It may still work if the server supports hidden or aliased models.\"\n f\"{suggestion_text}\"\n )\n if probe.get(\"used_fallback\"):\n message += (\n f\"\\n Endpoint verification succeeded after trying `{probe.get('resolved_base_url')}`. \"\n f\"Consider saving that as your base URL.\"\n )\n\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": message,\n }\n\n message = (\n f\"Note: could not reach this custom endpoint's model listing at `{probe.get('probed_url')}`. \"\n f\"Arcen will still save `{requested}`, but the endpoint should expose `/models` for verification.\"\n )\n if api_mode == \"anthropic_messages\":\n message += (\n \"\\n Many Anthropic-compatible proxies do not implement the Models API \"\n \"(GET /v1/models). The model name has been accepted without verification.\"\n )\n if probe.get(\"suggested_base_url\"):\n message += f\"\\n If this server expects `/v1`, try base URL: `{probe.get('suggested_base_url')}`\"\n\n return {\n \"accepted\": api_mode == \"anthropic_messages\",\n \"persist\": True,\n \"recognized\": False,\n \"message\": message,\n }\n\n # Providers with non-standard catalog validation — /v1/models probing is not the right path.\n if normalized in {\"openai-codex\", \"xai-oauth\"}:\n try:\n catalog_models = provider_model_ids(normalized)\n except Exception:\n catalog_models = []\n if catalog_models:\n if requested_for_lookup in set(catalog_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n # Auto-correct if the top match is very similar (e.g. typo)\n auto = get_close_matches(requested_for_lookup, catalog_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n suggestions = get_close_matches(requested_for_lookup, catalog_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n provider_label = \"OpenAI Codex\" if normalized == \"openai-codex\" else \"xAI Grok OAuth (SuperGrok / Premium+)\"\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in the {provider_label} model listing. \"\n \"It may still work if your account has access to a newer or hidden model ID.\"\n f\"{suggestion_text}\"\n ),\n }\n\n # MiniMax providers don't expose a /models endpoint — validate against\n # the static catalog instead, similar to openai-codex.\n if normalized in {\"minimax\", \"minimax-cn\"}:\n try:\n catalog_models = provider_model_ids(normalized)\n except Exception:\n catalog_models = []\n if catalog_models:\n # Case-insensitive lookup (catalog uses mixed case like MiniMax-M2.7)\n catalog_lower = {m.lower(): m for m in catalog_models}\n if requested_for_lookup.lower() in catalog_lower:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n # Auto-correct close matches (case-insensitive)\n catalog_lower_list = list(catalog_lower.keys())\n auto = get_close_matches(requested_for_lookup.lower(), catalog_lower_list, n=1, cutoff=0.9)\n if auto:\n corrected = catalog_lower[auto[0]]\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": corrected,\n \"message\": f\"Auto-corrected `{requested}` → `{corrected}`\",\n }\n suggestions = get_close_matches(requested_for_lookup.lower(), catalog_lower_list, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{catalog_lower[s]}`\" for s in suggestions)\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in the MiniMax catalog.\"\n f\"{suggestion_text}\"\n \"\\n MiniMax does not expose a /models endpoint, so Arcen cannot verify the model name.\"\n \"\\n The model may still work if it exists on the server.\"\n ),\n }\n\n # Native Anthropic provider: /v1/models requires x-api-key (or Bearer for\n # OAuth) plus anthropic-version headers. The generic OpenAI-style probe\n # below uses plain Bearer auth and 401s against Anthropic, so dispatch to\n # the native fetcher which handles both API keys and Claude-Code OAuth\n # tokens. (The api_mode==\"anthropic_messages\" branch below handles the\n # Messages-API transport case separately.)\n if normalized == \"anthropic\":\n anthropic_models = _fetch_anthropic_models()\n if anthropic_models is not None:\n if requested_for_lookup in set(anthropic_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n auto = get_close_matches(requested_for_lookup, anthropic_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n suggestions = get_close_matches(requested, anthropic_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n # Accept anyway — Anthropic sometimes gates newer/preview models\n # (e.g. snapshot IDs, early-access releases) behind accounts\n # even though they aren't listed on /v1/models.\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in Anthropic's /v1/models listing. \"\n f\"It may still work if you have early-access or snapshot IDs.\"\n f\"{suggestion_text}\"\n ),\n }\n # _fetch_anthropic_models returned None — no token resolvable or\n # network failure. Fall through to the generic warning below.\n\n # Anthropic Messages API: many proxies don't implement /v1/models.\n # Try probing with correct auth; if it fails, accept with a warning.\n if api_mode == \"anthropic_messages\":\n api_models = fetch_api_models(api_key, base_url, api_mode=api_mode)\n if api_models is not None:\n if requested_for_lookup in set(api_models):\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n auto = get_close_matches(requested_for_lookup, api_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n # Probe failed or model not found — accept anyway (proxy likely\n # doesn't implement the Anthropic Models API).\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: could not verify `{requested}` against this endpoint's \"\n f\"model listing. Many Anthropic-compatible proxies do not \"\n f\"implement GET /v1/models. The model name has been accepted \"\n f\"without verification.\"\n ),\n }\n\n # Probe the live API to check if the model actually exists\n api_models = fetch_api_models(api_key, base_url)\n\n if api_models is not None:\n # Gemini's OpenAI-compat /v1beta/openai/models endpoint returns IDs\n # prefixed with \"models/\" (e.g. \"models/gemini-2.5-flash\") — native\n # Gemini-API convention. Our curated list and user input both use\n # the bare ID, so a direct set-membership check drops every known\n # Gemini model. Strip the prefix before comparison. See #12532.\n if normalized == \"gemini\":\n api_models = [\n m[len(\"models/\"):] if isinstance(m, str) and m.startswith(\"models/\") else m\n for m in api_models\n ]\n if requested_for_lookup in set(api_models):\n # API confirmed the model exists\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n else:\n # API responded but model is not listed. Accept anyway —\n # the user may have access to models not shown in the public\n # listing (e.g. Z.AI Pro/Max plans can use glm-5 on coding\n # endpoints even though it's not in /models). Warn but allow.\n\n # Auto-correct if the top match is very similar (e.g. typo)\n auto = get_close_matches(requested_for_lookup, api_models, n=1, cutoff=0.9)\n if auto:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": auto[0],\n \"message\": f\"Auto-corrected `{requested}` → `{auto[0]}`\",\n }\n\n suggestions = get_close_matches(requested, api_models, n=3, cutoff=0.5)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n\n return {\n \"accepted\": False,\n \"persist\": False,\n \"recognized\": False,\n \"message\": (\n f\"Model `{requested}` was not found in this provider's model listing.\"\n f\"{suggestion_text}\"\n ),\n }\n\n # api_models is None — couldn't reach API. Accept and persist,\n # but warn so typos don't silently break things.\n\n # Bedrock: use our own discovery instead of HTTP /models endpoint.\n # Bedrock's bedrock-runtime URL doesn't support /models — it uses the\n # AWS SDK control plane (ListFoundationModels + ListInferenceProfiles).\n if normalized == \"bedrock\":\n try:\n from agent.bedrock_adapter import discover_bedrock_models, resolve_bedrock_region\n region = resolve_bedrock_region()\n discovered = discover_bedrock_models(region)\n discovered_ids = {m[\"id\"] for m in discovered}\n if requested in discovered_ids:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n # Not in discovered list — still accept (user may have custom\n # inference profiles or cross-account access), but warn.\n suggestions = get_close_matches(requested, list(discovered_ids), n=3, cutoff=0.4)\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(f\"`{s}`\" for s in suggestions)\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in Bedrock model discovery for {region}. \"\n f\"It may still work with custom inference profiles or cross-account access.\"\n f\"{suggestion_text}\"\n ),\n }\n except Exception:\n pass # Fall through to generic warning\n\n # Static-catalog fallback: when the /models probe was unreachable,\n # validate against the curated list from provider_model_ids() — same\n # pattern as the openai-codex and minimax branches above. This keeps\n # /model switches working in the gateway for providers whose /models\n # endpoint is temporarily unreachable or returns a non-JSON payload.\n # Without this block, validate_requested_model would reject every model\n # on such providers, switch_model() would return success=False, and\n # the gateway would never write to _session_model_overrides.\n provider_label = _PROVIDER_LABELS.get(normalized, normalized)\n try:\n catalog_models = provider_model_ids(normalized)\n except Exception:\n catalog_models = []\n\n if catalog_models:\n catalog_lower = {m.lower(): m for m in catalog_models}\n if requested_for_lookup.lower() in catalog_lower:\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"message\": None,\n }\n catalog_lower_list = list(catalog_lower.keys())\n auto = get_close_matches(\n requested_for_lookup.lower(), catalog_lower_list, n=1, cutoff=0.9\n )\n if auto:\n corrected = catalog_lower[auto[0]]\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": True,\n \"corrected_model\": corrected,\n \"message\": f\"Auto-corrected `{requested}` → `{corrected}`\",\n }\n suggestions = get_close_matches(\n requested_for_lookup.lower(), catalog_lower_list, n=3, cutoff=0.5\n )\n suggestion_text = \"\"\n if suggestions:\n suggestion_text = \"\\n Similar models: \" + \", \".join(\n f\"`{catalog_lower[s]}`\" for s in suggestions\n )\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: `{requested}` was not found in the {provider_label} curated catalog \"\n f\"and the /models endpoint was unreachable.{suggestion_text}\"\n f\"\\n The model may still work if it exists on the provider.\"\n ),\n }\n\n # No catalog available — accept with a warning, matching the comment's\n # stated intent (\"Accept and persist, but warn\").\n return {\n \"accepted\": True,\n \"persist\": True,\n \"recognized\": False,\n \"message\": (\n f\"Note: could not reach the {provider_label} API to validate `{requested}`. \"\n f\"If the service isn't down, this model may not be valid.\"\n ),\n }\n"}}, "tests/arcen_cli/test_provider_config_validation.py": {"41d6a8164c24506a38253f69334701ad2e137204": {"t": 1785809844.0184307, "n": 7910, "h": "e994e3c2f309827a", "c": "\"\"\"Tests for providers config entry validation and normalization.\n\nCovers Issue #9332: camelCase keys silently ignored, non-URL strings\naccepted as base_url, and unknown keys go unreported.\n\"\"\"\n\nimport logging\n\n\nfrom arcen_cli.config import _normalize_custom_provider_entry\n\n\nclass TestNormalizeCustomProviderEntry:\n \"\"\"Tests for _normalize_custom_provider_entry validation.\"\"\"\n\n def test_valid_entry_snake_case(self):\n \"\"\"Standard snake_case entry should normalize correctly.\"\"\"\n entry = {\n \"base_url\": \"https://api.example.com/v1\",\n \"api_key\": \"sk-test-key\",\n }\n result = _normalize_custom_provider_entry(entry, provider_key=\"myhost\")\n assert result is not None\n assert result[\"name\"] == \"myhost\"\n assert result[\"base_url\"] == \"https://api.example.com/v1\"\n assert result[\"api_key\"] == \"sk-test-key\"\n\n def test_camel_case_api_key_mapped(self):\n \"\"\"camelCase apiKey should be auto-mapped to api_key.\"\"\"\n entry = {\n \"base_url\": \"https://api.example.com/v1\",\n \"apiKey\": \"sk-test-key\",\n }\n result = _normalize_custom_provider_entry(entry, provider_key=\"myhost\")\n assert result is not None\n assert result[\"api_key\"] == \"sk-test-key\"\n\n def test_camel_case_base_url_mapped(self):\n \"\"\"camelCase baseUrl should be auto-mapped to base_url.\"\"\"\n entry = {\n \"baseUrl\": \"https://api.example.com/v1\",\n \"api_key\": \"sk-test-key\",\n }\n result = _normalize_custom_provider_entry(entry, provider_key=\"myhost\")\n assert result is not None\n assert result[\"base_url\"] == \"https://api.example.com/v1\"\n\n def test_non_url_api_field_rejected(self):\n \"\"\"Non-URL string in 'api' field should be skipped with a warning.\"\"\"\n entry = {\n \"api\": \"openai-reverse-proxy\",\n \"api_key\": \"sk-test-key\",\n }\n result = _normalize_custom_provider_entry(entry, provider_key=\"nvidia\")\n # Should return None because no valid URL was found\n assert result is None\n\n def test_valid_url_in_api_field_accepted(self):\n \"\"\"Valid URL in 'api' field should still be accepted.\"\"\"\n entry = {\n \"api\": \"https://integrate.api.nvidia.com/v1\",\n \"api_key\": \"sk-test-key\",\n }\n result = _normalize_custom_provider_entry(entry, provider_key=\"nvidia\")\n assert result is not None\n assert result[\"base_url\"] == \"https://integrate.api.nvidia.com/v1\"\n\n def test_base_url_preferred_over_api(self):\n \"\"\"base_url should be checked before api field.\"\"\"\n entry = {\n \"base_url\": \"https://correct.example.com/v1\",\n \"api\": \"https://wrong.example.com/v1\",\n \"api_key\": \"sk-test-key\",\n }\n result = _normalize_custom_provider_entry(entry, provider_key=\"test\")\n assert result is not None\n assert result[\"base_url\"] == \"https://correct.example.com/v1\"\n\n def test_unknown_keys_logged(self, caplog):\n \"\"\"Unknown config keys should produce a warning.\"\"\"\n entry = {\n \"base_url\": \"https://api.example.com/v1\",\n \"api_key\": \"***\",\n \"unknownField\": \"value\",\n \"anotherBad\": 42,\n }\n with caplog.at_level(logging.WARNING):\n result = _normalize_custom_provider_entry(entry, provider_key=\"test\")\n assert result is not None\n assert any(\"unknown config keys\" in r.message.lower() for r in caplog.records)\n\n def test_timeout_keys_not_flagged_unknown(self, caplog):\n \"\"\"request_timeout_seconds and stale_timeout_seconds should not produce warnings.\"\"\"\n entry = {\n \"base_url\": \"https://api.example.com/v1\",\n \"api_key\": \"***\",\n \"request_timeout_seconds\": 300,\n \"stale_timeout_seconds\": 900,\n }\n with caplog.at_level(logging.WARNING):\n result = _normalize_custom_provider_entry(entry, provider_key=\"test\")\n assert result is not None\n assert not any(\"unknown config keys\" in r.message.lower() for r in caplog.records)\n\n def test_camel_case_warning_logged(self, caplog):\n \"\"\"camelCase alias mapping should produce a warning.\"\"\"\n entry = {\n \"baseUrl\": \"https://api.example.com/v1\",\n \"apiKey\": \"sk-test-key\",\n }\n with caplog.at_level(logging.WARNING):\n result = _normalize_custom_provider_entry(entry, provider_key=\"test\")\n assert result is not None\n camel_warnings = [r for r in caplog.records if \"camelcase\" in r.message.lower() or \"auto-mapped\" in r.message.lower()]\n assert len(camel_warnings) >= 1\n\n def test_snake_case_takes_precedence_over_camel(self):\n \"\"\"If both snake_case and camelCase exist, snake_case wins.\"\"\"\n entry = {\n \"api_key\": \"snake-key\",\n \"apiKey\": \"camel-key\",\n \"base_url\": \"https://api.example.com/v1\",\n }\n result = _normalize_custom_provider_entry(entry, provider_key=\"test\")\n assert result is not None\n assert result[\"api_key\"] == \"snake-key\"\n\n def test_non_dict_returns_none(self):\n \"\"\"Non-dict entry should return None.\"\"\"\n assert _normalize_custom_provider_entry(\"not-a-dict\") is None\n assert _normalize_custom_provider_entry(42) is None\n assert _normalize_custom_provider_entry(None) is None\n\n def test_no_url_returns_none(self):\n \"\"\"Entry with no valid URL in any field should return None.\"\"\"\n entry = {\n \"api_key\": \"sk-test-key\",\n }\n result = _normalize_custom_provider_entry(entry, provider_key=\"test\")\n assert result is None\n\n def test_no_name_returns_none(self):\n \"\"\"Entry with no name and no provider_key should return None.\"\"\"\n entry = {\n \"base_url\": \"https://api.example.com/v1\",\n }\n result = _normalize_custom_provider_entry(entry, provider_key=\"\")\n assert result is None\n\n def test_models_list_converted_to_dict(self):\n \"\"\"List-format models should be preserved as an empty-value dict so\n /model picks them up instead of showing the provider with (0) models.\"\"\"\n entry = {\n \"name\": \"tencent-coding-plan\",\n \"base_url\": \"https://api.lkeap.cloud.tencent.com/coding/v3\",\n \"models\": [\"glm-5\", \"kimi-k2.5\", \"minimax-m2.5\"],\n }\n result = _normalize_custom_provider_entry(entry)\n assert result is not None\n assert result[\"models\"] == {\"glm-5\": {}, \"kimi-k2.5\": {}, \"minimax-m2.5\": {}}\n\n def test_models_dict_preserved(self):\n \"\"\"Dict-format models should pass through unchanged.\"\"\"\n entry = {\n \"name\": \"acme\",\n \"base_url\": \"https://api.example.com/v1\",\n \"models\": {\"gpt-foo\": {\"context_length\": 32000}},\n }\n result = _normalize_custom_provider_entry(entry)\n assert result is not None\n assert result[\"models\"] == {\"gpt-foo\": {\"context_length\": 32000}}\n\n def test_models_list_filters_empty_and_non_string(self):\n \"\"\"List entries that are empty strings or non-strings are skipped.\"\"\"\n entry = {\n \"name\": \"acme\",\n \"base_url\": \"https://api.example.com/v1\",\n \"models\": [\"valid\", \"\", None, 42, \" \", \"also-valid\"],\n }\n result = _normalize_custom_provider_entry(entry)\n assert result is not None\n assert result[\"models\"] == {\"valid\": {}, \"also-valid\": {}}\n\n def test_models_empty_list_omitted(self):\n \"\"\"Empty list (falsy) should not produce a models key.\"\"\"\n entry = {\n \"name\": \"acme\",\n \"base_url\": \"https://api.example.com/v1\",\n \"models\": [],\n }\n result = _normalize_custom_provider_entry(entry)\n assert result is not None\n assert \"models\" not in result\n"}}}} |