+
    D#j                    x    ^ RI Ht ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIHt Rt	Rt
 ! R R]4      t ! R R	4      tR# )
    )annotationsN)Pathzhttps://api.openai.com/authzopenai-codexc                      ] tR t^tRtR# )PiAuthSyncError N)__name__
__module____qualname____firstlineno____static_attributes__r       ]/home/user/overdeck-private-tests/subrouter-s5-systray-latest/modules/systray/pi_auth_sync.pyr   r      s    r   r   c                      ] tR t^tRtRR R llt]R R l4       tR R ltR R	 lt	R
 R lt
R R lt]R R l4       t]R R l4       t]R R l4       t]R R l4       tRtR# )
PiAuthSynca  Mirrors the active codex account into pi's auth store.

pi's `openai-codex` provider uses the same OAuth client as the codex CLI
(client id app_EMoamEEZ73f0CkXaXp7hrann), so pi credentials are derived
from the account's CODEX_HOME/auth.json. Rotation is non-destructive
(a rotated-away refresh token stays valid), so pi and codex may each
refresh their own copy; every switch re-derives from codex's copy.
c               (    V ^8  d   QhRRRRRRRR/# )   	agent_dirr   accounts_diraccount_home_namestrreturnNoner   )formats   "r   __annotate__PiAuthSync.__annotate__   s2     4 44 4 	4
 
4r   c                	*    Wn         W n        W0n        R # N)r   r   _account_home_name)selfr   r   r   s   &&&&r   __init__PiAuthSync.__init__   s     #("3r   c                   V ^8  d   QhRR/# )r   r   r   r   )r   s   "r   r   r   '   s     , ,$ ,r   c                	(    V P                   R ,          # )	auth.json)r   r   s   &r   active_auth_pathPiAuthSync.active_auth_path&   s    ~~++r   c                    V ^8  d   QhRRRR/# )r   slugr   r   zPath | Noner   )r   s   "r   r   r   *   s      C K r   c                   V P                   P                  4       '       g/   \        RV P                    RV R2\        P                  R7       R# V P
                  V,          V P                  ,          R,          pV P                  W!4      pV P
                  V,          R,          R,          pV P                  V4      pW5\        &   V P                  V\        P                  ! V^R7      R	,           4       V# )
a	  Derive and write the per-account pi auth file; no active-link mutation.

Returns the per-account file to activate, or None (with a warning)
when pi is not installed. Raises PiAuthSyncError when pi is installed
but the account's codex credentials cannot be derived.
zpi agent dir 'z/' not found; switching codex only for account '')fileNr$   PI_HOME)indent
)r   is_dirprintsysstderrr   r   _derive_credential_read_json_dictPI_PROVIDER_KEY_atomic_write_privatejsondumps)r   r)   
codex_auth
credentialtargetmergeds   &&    r   preparePiAuthSync.prepare*   s     ~~$$&&  0 1559F!=ZZ
 &&-0G0GG+U
,,Z>
""T)I5C%%f-",""64::fQ+G$+NOr   c                    V ^8  d   QhRRRR/# )r   r<   r   r   r   r   )r   s   "r   r   r   B   s     < <t < <r   c                	<    V P                  WP                  4       R # r   )_atomic_symlinkr&   )r   r<   s   &&r   activatePiAuthSync.activateB   s    V%:%:;r   c                   V ^8  d   QhRR/# )r   r   r   r   )r   s   "r   r   r   E   s     + +d +r   c                	~    V P                   P                  4       '       d   V P                   P                  4        R # R # r   )r&   
is_symlinkunlinkr%   s   &r   clear_activePiAuthSync.clear_activeE   s.      ++--!!((* .r   c               $    V ^8  d   QhRRRRRR/# )r   r:   r   r)   r   r   zdict[str, object]r   )r   s   "r   r   r   I   s"     
 
T 
 
AR 
r   c                	    \         P                  ! VP                  R R7      4      pVR,          pVR,          pVR,          p\        V\        4      '       d   VP                  4       '       g   \        R4      h\        V\        4      '       d   VP                  4       '       g   \        R4      hV P                  VP                  R4      ^,          4      pVR,          p\        V\        \        34      '       g   \        R	4      hVP                  \        4      p	\        V	\        4      '       g   / p	VP                  R
4      ;'       g    V	P                  R4      p
\        V
\        4      '       d	   V
'       g   \        R4      h RRRTRTR\        TR,          4      RT
/#   \         d   p\        RT RT RT 24      ThRp?ii ; i)utf-8encodingtokensaccess_tokenrefresh_tokenzempty access_tokenzempty refresh_token.expz%access_token exp claim is not numeric
account_idchatgpt_account_idzmissing account_idz*cannot derive pi credentials for account 'z' from z: Ntypeoauthaccessrefreshexpiresi  	accountId)r8   loads	read_text
isinstancer   strip
ValueError_decode_jwt_payloadsplitintfloatgetAUTH_NAMESPACEdict	Exceptionr   )r   r:   r)   payloadrP   rY   rZ   claims	expires_sauth_claimsrU   excs   &&&         r   r4   PiAuthSync._derive_credentialI   s   	jj!5!5w!5!GHGX&FN+F_-Gvs++ !566w,, !677--fll3.?.BCFuIi#u66 !HII **^4Kk400 L1ZZ[__EY5ZJz3//J !566 5? Gfws9t+,
 	
  	!<TF'*UWX[W\]	s1   A,F% /6F% &B&F% /F% =F% %G
0GG
c                    V ^8  d   QhRRRR/# )r   pathr   r   rh   r   )r   s   "r   r   r   k   s     < <d <t <r   c                	     \         P                  ! V P                  R R7      4      p\        T\        4      '       d   T# / #   \        \         P                  3 d    / u # i ; i)rM   rN   )r8   r]   r^   OSErrorJSONDecodeErrorr_   rh   )rq   rj   s   & r   r5   PiAuthSync._read_json_dictj   sZ    	jj!ABG %Wd33w;; --. 	I	s   &A A"!A"c                    V ^8  d   QhRRRR/# )r   segmentr   r   rh   r   )r   s   "r   r   r   s   s     0 0S 0T 0r   c                	    R \        V 4      ) ^,          ,          p\        P                  ! W,           4      p\        P                  ! VP                  R4      4      # )=rM   )lenbase64urlsafe_b64decoder8   r]   decode)rw   paddingdatas   &  r   rb   PiAuthSync._decode_jwt_payloadr   sB    #g,*+''(9:zz$++g.//r   c               $    V ^8  d   QhRRRRRR/# )r   rq   r   contentr   r   r   r   )r   s   "r   r   r   y   s!     $ $D $3 $4 $r   c                	   V P                   P                  R R R7       \        P                  ! RRV P                   RR7      ;_uu_ 4       pVP	                  V4       \
        P                  ! VP                  4       R4       VP                  pRRR4       \
        P                  ! XV 4       R#   + '       g   i     L); i)Tparentsexist_okwrM   F)rO   dirdeletei  N)
parentmkdirtempfileNamedTemporaryFilewriteosfchmodfilenonamereplace)rq   r   handle	temp_names   &&  r   r7    PiAuthSync._atomic_write_privatex   s    $6((	
 

 LL!IIfmmou-I
 	

9d#
 
s   
AB..B>	c               $    V ^8  d   QhRRRRRR/# )r   sourcer   r<   r   r   r   )r   s   "r   r   r      s!     & & &d &t &r   c                	   V P                  4       '       g   \        V 4      hVP                  P                  R R R7       VP                  RVP                   R\
        P                  ! 4        2,          pVP                  4       '       g   VP                  4       '       d   VP                  4        VP                  V 4       \
        P                  ! W!4       R# )Tr   rS   z.tmp-N)existsFileNotFoundErrorr   r   r   r   getpidrG   rH   
symlink_tor   )r   r<   	temp_paths   && r   rB   PiAuthSync._atomic_symlink   s    }}#F++D48MMa}E"))+$GG	!5!5!7!7V$


9%r   )r   r   r   N)
CODEX_HOME)r   r	   r
   r   __doc__r    propertyr&   r>   rC   rI   r4   staticmethodr5   rb   r7   rB   r   r   r   r   r   r      s    4 , ,0<+
B < < 0 0
 $ $ & &r   r   )
__future__r   r{   r8   r   r2   r   pathlibr   rg   r6   RuntimeErrorr   r   r   r   r   <module>r      s<    "   	 
  . 	l 	}& }&r   