ޠj hSrSSKJr SSKrSSKrSSKrSSKrSSKrSSKr SSK r SSK r SSK r SSK r SSKrSSKrSSKrSSKrSSKrSSKJrJr SSKJrJrJr SSKJr SSKJrJrJrJ r J!r! SSK"r"\(aSSK#J$r$ \ RJ"\&5r'S r(S r)S r*S r+S r,Sr-Sr.Sr/Sr0Sr1Sr2\"SS9r3\Rh"5S- S- r5\"SS9"SS55r6"SS\75r8\!"SS\ 55r9SIS jr:SJS!jr;SKS"jrSNS&jr?SOS'jr@SPS(jrASQS)jrB\RSRS*j5rDSSS+jrESTS,jrFSUS-jrGS.S/.SVS0jjrH\I"S1S215rJS.S/.SVS3jjrKS.S/.SVS4jjrL\"S5S655rMSWS7jrN\2SS8.SXS9jjrO"S:S;\ RR5rRSYS<jrSSYS=jrTSZS>jrUS[S?jrVS\S@jrWS\(\/\0\1\2SSASB.S]SCjjrXS\(SDSESF.S^SGjjrY/SHQrZg)_aJChatGPT OAuth helpers for `_ChatOpenAICodex`. Implements OAuth 2.0 Authorization Code Flow with PKCE against the OpenAI auth endpoints used by Codex/ChatGPT subscription auth, plus a small file-backed token store and refresh logic. These helpers exist to keep login and token management *separate* from model invocation. `_ChatOpenAICodex` only consumes a `_ChatGPTOAuthTokenProvider`. !!! warning This is provider-specific subscription auth and is independent from the standard OpenAI API-key flow used by `ChatOpenAI`. Refresh-token rotation against `~/.codex/auth.json` can break Codex CLI / VS Code sessions, so the default store lives at `~/.langchain/chatgpt-auth.json`. !!! warning "Experimental and unofficial" These helpers are not an official OpenAI API integration. Use them only where your OpenAI account, workspace, plan, and applicable OpenAI terms permit ChatGPT-authenticated Codex access. You are responsible for ensuring your implementation complies with OpenAI's terms, usage policies, account restrictions, rate limits, and safeguards. ) annotationsN) dataclassfield)datetime timedeltatimezone)Path) TYPE_CHECKINGAnyLiteralProtocolruntime_checkable)Iteratorapp_EMoamEEZ73f0CkXaXp7hrannz'https://auth.openai.com/oauth/authorizez#https://auth.openai.com/oauth/tokenz8https://auth.openai.com/api/accounts/deviceauth/usercodez5https://auth.openai.com/api/accounts/deviceauth/tokenz+https://auth.openai.com/deviceauth/callbackzhttps://api.openai.com/auth localhostiz/auth/callbackz#openid profile email offline_access)minutesz .langchainzchatgpt-auth.jsonT)frozenc\rSrSr%Sr\"SS9rS\S'\"SS9rS\S'S\S 'S r S \S 'S r S \S 'S r S \S'\"S SS9r S \S'SSjr \S.SSjjrSrg ) _ChatGPTTokenGajA ChatGPT OAuth token bundle. `expires_at` is timezone-aware. The JWT-derived optionals (`account_id`, `plan_type`, `user_id`) are populated when decodable from the `id_token`; `id_token` itself is the raw token, not derived from it. Secret-bearing fields (`access_token`, `refresh_token`, `id_token`) are excluded from the default `repr` so the token does not leak into logs or tracebacks. Instances are frozen: the constructor invariants below hold for the life of the object, which matters because providers cache and share a single token and replace it wholesale on refresh rather than mutating fields in place. F)reprstr access_token refresh_tokenr expires_atN str | None account_id plan_typeuser_id)defaultrid_tokencUR(d Sn[U5eUR(d Sn[U5eURRc Sn[U5eg)z;Validate non-empty secrets and timezone-aware `expires_at`.z*`access_token` must be a non-empty string.z+`refresh_token` must be a non-empty string.Nz*`expires_at` must be timezone-aware (UTC).)r ValueErrorrrtzinfo)selfmsgs X/var/www/html/gaurav/venv/lib/python3.13/site-packages/langchain_openai/chatgpt_oauth.py __post_init___ChatGPTToken.__post_init__^sV  >CS/ !!!?CS/ ! ?? ! ! )>CS/ ! *skewcj[R"[R5URU- :$)z@Return `True` if the token is past (or within `skew` of) expiry.)rnowrutcr)r&r-s r( is_expired_ChatGPTToken.is_expiredjs#||HLL)doo.DEEr+returnNone)r-rr5bool)__name__ __module__ __qualname____firstlineno____doc__rr__annotations__rrrr r"r)DEFAULT_REFRESH_SKEWr1__static_attributes__r3r+r(rrGss 5)L#)E*M3*!J ! Iz GZ E:Hj: "/CFFr+rc\rSrSrSrSrg)_ChatGPTOAuthRefreshErrorozRaised when a refresh-token grant fails irrecoverably. Typically signals that the stored refresh token has been revoked or has expired; the caller should re-run `login_chatgpt()` (or the device-code equivalent) to obtain a new bundle. r3N)r8r9r:r;r<r?r3r+r(rArAosr+rAc@\rSrSrSrS SjrS SjrS SjrS SjrSr g) _ChatGPTOAuthTokenProviderxz:Refresh-aware token source consumed by `_ChatOpenAICodex`.cg)z0Return a current token, refreshing if necessary.Nr3r&s r( get_token$_ChatGPTOAuthTokenProvider.get_token| r+c # g7f)zAsync variant of `get_token`. Implementations must offer the same locking and refresh guarantees as `get_token`: concurrent callers must not race on token storage. Nr3rGs r( aget_token%_ChatGPTOAuthTokenProvider.aget_tokens cg)z=Return only the access token string (sync callable for SDKs).Nr3rGs r(get_access_token+_ChatGPTOAuthTokenProvider.get_access_tokenrJr+c # g7f)z>Return only the access token string (async callable for SDKs).Nr3rGs r(aget_access_token,_ChatGPTOAuthTokenProvider.aget_access_tokens rNr3Nr5rr5r) r8r9r:r;r<rHrLrPrSr?r3r+r(rDrDxsD    r+rDcVS[U5*S--n[R"X-5$)z@Decode a single base64url JWT segment, handling missing padding.=)lenbase64urlsafe_b64decode)segmentpaddings r(_b64url_decode_segmentr_s+c'l]Q&'G  # #G$5 66r+cU(aURS5S:a0$URSS5upn[R"[ U55$![ [R [4a 0s$f=f)aQDecode a JWT's payload without signature verification. !!! danger This is for *local claim extraction only*. Never use the returned claims for security or authorization decisions. Args: token: A JWT (`header.payload.signature`). Returns: Decoded payload as a dict. Returns an empty dict if the token is malformed. .)countsplitjsonloadsr_r$JSONDecodeErrorUnicodeDecodeError)token_payloads r(decode_jwt_claimsrlsl EKK$q(  C+ Azz09:: ,,.@ A s3A!A87A8cNSSSS.nU(dU$[U5nUR[5=(d 0n[U[5(a<URS5US'URS5US'URS5US'USc[ R S 5 U$) z>Pull the ChatGPT account/plan/user IDs out of an ID-token JWT.N)rrr chatgpt_account_idrchatgpt_plan_typerchatgpt_user_idr zsNo `chatgpt_account_id` claim extracted from the ChatGPT id_token; the `ChatGPT-Account-Id` header will be omitted.)rlgetCHATGPT_AUTH_CLAIMS_NAMESPACE isinstancedictloggerdebug)r"outclaimsauths r(_extract_chatgpt_claimsrzs"C  x (F ::3 4 :D$ HH%9:L88$78K"34I <    I  Jr+cURS5nUb [U5OSnUS::a Sn[ U5e[ R "[R5[US9-$![[4anSU<3n[ U5UeSnAff=f)N expires_inrz/OAuth token response had invalid `expires_in`: znOAuth token response had missing or non-positive `expires_in`; refusing to store an immediately-expired token.)seconds) rqint TypeErrorr$rArr/rr0r)rkrawr|excr's r(_expires_at_from_responsers ++l #C6!$SXa Q > (,, << % *(E EE z "6?wG',#56sA$$B 4BB fallback_refresh_tokenc $URS5(d Sn[U5eURS5n[U5nURS5=(d UnU(d Sn[U5e[USU[ U5USUSUSUS 9$) z>Build a `_ChatGPTToken` from an OAuth token-endpoint response.rz7OAuth token response did not include an `access_token`.r"rzzOAuth token response did not include a `refresh_token` and no prior refresh token was available; re-run `login_chatgpt()`.rrr rrrrrr r")rqrArzrr)rkrr'r"rxrs r(_token_from_responsers ;;~ & &G',,{{:&H $X .FKK0J4JM  K (,, ^,#,W5,'%y! r+cURURURR[R 5R 5URURURURS.$)Nr) rrr astimezonerr0 isoformatrrr r")ris r(_serialize_tokenrs]**,,&&11(,,?IIK&&__==NN r+c  URS5n[U[5(aA[R"U5nUR cUR [RS9nOL[U[[45(a$[R"U[RS9nO Sn[U5e[USUSUURS5URS5URS 5URS 5S 9$) Nr)r%)tzz%Stored token is missing `expires_at`.rrrrr r"r)rqrsrr fromisoformatr%replacerr0r~float fromtimestampr$r)dataexpires_at_rawrr's r(_deserialize_tokenrsXXl+N.#&&++N;    $#++8<<+@J NS%L 1 1++Nx||L 5o .)?+88L)((;'#*% r+c[R"X5 g![[4a"n[R SUUU5 SnAgSnAff=f)aBest-effort `chmod` that logs (but does not raise) on failure. On filesystems without POSIX perms (Windows, some FUSE/SMB mounts) the file may end up world-readable. Logging surfaces that to operators so they don't silently trust the "private perms" claim of the caller. ukFailed to set permissions %o on %s: %s — token store may not have private permissions on this filesystem.N)oschmodOSErrorNotImplementedErrorruwarning)pathmoders r( _chmod_warnrsH    ( )  ;       sA AA cURnURSSS9 [US5 URURS-5n[ R "USSS9n[R[R-[R-n[R"X5S5n[R"USS S 9nURU5 S S S 5 UR'U5 [US5 g !,(df  N,=f![aF [R "["5 UR%5 S S S 5 e!,(df  e=ff=f) zAWrite `data` as JSON to `path` with 0600 perms (where supported).Tparentsexist_okiz.tmprb)indent sort_keyswutf-8encodingN)parentmkdirr with_suffixsuffixredumpsrO_WRONLYO_CREATO_TRUNCopenfdopenwrite Exception contextlibsuppressrunlinkr)rrrtmprkflagsfdfhs r(_atomic_write_private_jsonr*s [[F LLL-   4;;/ 0Cjja48G KK"** $rzz 1E U #B YYr3 1R HHW 2 KKe2 1    ) JJL* * ) sB'D=C5D5 D?DD$E*E; E E Ec## URURS-5nURRSSS9 [R "U[R [R-S5nSnSSKnURX$R5 SnSv U(a SSKnURX$R5 [R "U5 g![a!n[RSUU5 SnANhSnAff=f![a [RS U5 Nf=f![[4a n[RS X5 SnANSnAff=f!U(aTSSKnURX$R5 O3![[4a n[RS X5 SnAOSnAff=f[R "U5 f=f7f) a4Best-effort cross-platform file lock around refresh + write. On POSIX this acquires an exclusive `fcntl.flock` on a sibling `.lock` file. On Windows (or any platform where `fcntl` is unavailable) the lock degrades to a no-op and a warning is logged so callers know that cross-process safety is best-effort. z.lockTrrFrNuZfcntl.flock failed on %s: %s — token store is not protected against cross-process races.znfcntl is unavailable on this platform; ChatGPT token store at %s is not protected against cross-process races.z%Failed to release file lock on %s: %s)rrrrrrrO_RDWRfcntlflockLOCK_EXrrur ImportErrorLOCK_UNclose)r lock_pathrlockedrrs r( _file_lockr>s  w!67I 4$7 BJJ2E :B F    B .   X B .  ! =    NNF  0 ) XF WW X  X B .) XF WW X  sA2G6D;CE!G$D.G D$D;E!DE! D+(E!*D++E!.E>EGEG!G*F  G F:F50G5F::GGc0U(dgS[U5S3$)Nzz)rZ)values r(_redactrks  CJ (,, cU"6t7G7G6H7) TC s r+>@timeoutc[R"US9nURUUSS0S9nSSS5 [UW5 UR 5$!,(df  N*=f)z4POST a form payload and return the parsed JSON body.rAcceptapplication/jsonrheadersN)httpxClientpostrrerrrclientrs r( _post_formrsZ g &&{{ 12  ' c4( 99; ' &s A  Aauthorization_pending slow_downcH[R"US9nURUUSS0S9nSSS5 WRS:aUR 5$[ U5upVU[ ;aUR 5$[X5 UR 5$!,(df  Np=f)zCPOST a device-code poll and return expected pending error payloads.rrrrNr)rrrrrer_DEVICE_POLL_PENDING_ERRORSr)rrrrrrrjs r(_post_device_poll_formrs g &&{{ 12  '  #yy{&t,MJ00yy{c( 99; ' &s B B!c# [R"US9IShvN nURUUSS0S9IShvN nSSS5IShvN [UW5 UR 5$NKN2N$!,IShvN (df  N9=f7f)zCPOST a form payload asynchronously and return the parsed JSON body.rNrrr)r AsyncClientrrrers r( _apost_formrsy  11V[[ 12!  21 c4( 99;2 2111sSBA'BA-A)A- BA+!B)A-+B-B3A6 4 BBcT\rSrSr%Sr\"SS9rS\S'\r S\S'\ r S\S '\ r S \S 'S rS \S'\"SSSS9rS\S'\"\R"SSS9rS\S'\S&Sj5rS'SjrS(SjrS(SjrS)SjrS*SjrS+SjrS,SjrS,SjrS,S jrS,S!jrS,S"jrS-S#jr S-S$jr!S%r"g)._FileChatGPTOAuthTokenProvideriaFile-backed `_ChatGPTOAuthTokenProvider`. Stores tokens at `path` (defaults to `DEFAULT_STORE_PATH`) with private permissions and refreshes them on read when they are within `refresh_skew` of expiry. Refresh token rotation is preserved across writes: if the OAuth response omits `refresh_token`, the existing one is reused. !!! warning The default path is intentionally distinct from `~/.codex/auth.json` so that refresh-token rotation here does not invalidate Codex CLI / VS Code sessions. c[$N)DEFAULT_STORE_PATHr3r+r('_FileChatGPTOAuthTokenProvider.s/Ar+)default_factoryr rr client_id token_urlr refresh_skewrrrNF)r!initr_ChatGPTToken | None_cached)rrrzthreading.Lock_lockcU"5$)zConstruct a provider with all defaults (path, client ID, etc.). Equivalent to `_FileChatGPTOAuthTokenProvider()`; the alias exists as a discoverable entry point for callers reading the default-path contract from the module docstring. r3)clss r(from_default_store1_FileChatGPTOAuthTokenProvider.from_default_stores u r+cURR5(dgURRSS9n[ R"U5n[U5$![[4a$nSURSUS3n[ U5UeSnAff=f![ Ra$nSURSUS 3n[ U5UeSnAff=f![[4a$nSURS US 3n[ U5UeSnAff=f) uReturn the stored token, or `None` if no store exists. Raises `RuntimeError` (rather than returning `None`) if the file exists but cannot be parsed — that way the user is not told to "re-login" when the actual fix is to repair or remove a corrupt store at `self.path`. Nrrz&Failed to read ChatGPT token store at rzS. Repair file permissions/encoding or delete the file and re-run `login_chatgpt()`.zChatGPT token store at z is not valid JSON: z/. Delete the file and re-run `login_chatgpt()`.z is missing required fields (z0). Delete the file and re-run `login_chatgpt()`.) rexists read_textrrhrrerfrgrKeyErrorr$)r&raw_textrr'rs r(_read_from_disk._FileChatGPTOAuthTokenProvider._read_from_disks1yy!! -yy**G*u.EFr+cUR [UR5 URU5 XlSSS5 SSS5 g!,(df  N=f!,(df  g=f)z/Persist `token` to disk and cache it in memory.N)rrrrrrs r(save#_FileChatGPTOAuthTokenProvider.saves< ZZDII.    & L/ZZ..ZZs!AA A A A A+c"SUURS.$)Nr) grant_typerr)r)r&rs r(_build_refresh_payload5_FileChatGPTOAuthTokenProvider._build_refresh_payloads)*  r+cF[XS9nURU5 X0lU$)Nr)rrr)r&responseprevious_refreshris r(_apply_refresh_response6_FileChatGPTOAuthTokenProvider._apply_refresh_response!s&%XW E"  r+c[RS[UR55 [ UR UR UR5URS9nURX!R5$)Nz3Refreshing ChatGPT access token (refresh_token=%s).r) rurvrrrrrrr)r&existingrs r( _refresh_sync,_FileChatGPTOAuthTokenProvider._refresh_sync)sf A H** +  NN  ' '(>(> ?LL  ++H6L6LMMr+cUR=(d UR5nUcSURS3n[U5eU$)Nz No ChatGPT OAuth token found at z=. Run `langchain_openai.chatgpt_oauth.login_chatgpt()` first.)rr rFileNotFoundError)r&r r's r(_load_existing-_FileChatGPTOAuthTokenProvider._load_existing5sM<<94#7#7#9  2499+>JJ $C( (r+cUR5nURURS9(dU$UR5nUbX lU$U$Nr,)r%r1rr r)r&r  disk_tokens r(_load_existing_before_refresh<_FileChatGPTOAuthTokenProvider._load_existing_before_refresh?sP&&(""(9(9":O))+  !%L r+ctUR [UR5 UR5nUR UR S9(dXlUsSSS5 sSSS5 $URU5sSSS5 sSSS5 $!,(df  O=fSSS5 g!,(df  g=f)a!Return a fresh token, refreshing on disk if needed. Raises: FileNotFoundError: No token store exists at `self.path`; run `login_chatgpt()` first. _ChatGPTOAuthRefreshError: The stored refresh token was rejected (e.g. revoked or expired); re-run `login_chatgpt()`. r,Nrrrr*r1rrr!r&r s r(rH(_FileChatGPTOAuthTokenProvider.get_tokenIsyZZDII.99;H&&D,=,=&>'  /.ZZ %%h/ /.ZZ..ZZZ.B)6B B),B< B) B B)) B7c^# [R"UR5IShvN $N7f)aAsync variant of `get_token` with the same locking guarantees. The thread lock and cross-process file lock are acquired off the event loop via `asyncio.to_thread` so concurrent async callers do not race on `_cached` or on the on-disk token bundle. The HTTP refresh runs synchronously inside that worker thread; this avoids nesting event loops while still keeping the cross-process lock held for the entire refresh + write window. Raises: FileNotFoundError: No token store exists at `self.path`; run `login_chatgpt()` first. _ChatGPTOAuthRefreshError: The stored refresh token was rejected (e.g. revoked or expired); re-run `login_chatgpt()`. N)asyncio to_thread_aget_token_locked_blockingrGs r(rL)_FileChatGPTOAuthTokenProvider.aget_tokenYs$ &&t'G'GHHHHs $-+-ctUR [UR5 UR5nUR UR S9(dXlUsSSS5 sSSS5 $URU5sSSS5 sSSS5 $!,(df  O=fSSS5 g!,(df  g=fr(r-r.s r(r4:_FileChatGPTOAuthTokenProvider._aget_token_locked_blockingksw ZZDII.99;H&&D,=,=&>'  /.ZZ %%h/ /.ZZ..ZZZr0c6UR5R$)z$Return only the access-token string.)rHrrGs r(rP/_FileChatGPTOAuthTokenProvider.get_access_tokenss~~,,,r+cV# UR5IShvN nUR$N7f)z,Return only the access-token string (async).N)rLrrs r(rS0_FileChatGPTOAuthTokenProvider.aget_access_tokenws%oo''!!!(s )'))r)r5r)r5r)rirr5r6)rrr5dict[str, str])rdict[str, Any]rrr5r)r rr5rrUrV)#r8r9r:r;r<rrr=CHATGPT_CLIENT_IDrCHATGPT_TOKEN_URLrr>rrr threadingLockr classmethodrr rrrrr!r%r*rHrLr4rPrSr?r3r+r(rrs 'ABD$B&Is&&Is&2L)2GU$)$U$OG !O!!UE>#-JG!  &:=  N0 I$0-"r+rcf[R"[R"S55R S5R S5n[ R"URS55R5n[R"U5R S5R S5nX4$)z;Return a `(code_verifier, code_challenge)` pair using S256.@=ascii) r[urlsafe_b64encodesecrets token_bytesrstripdecodehashlibsha256encodedigest)verifierrO challenges r(_generate_pkce_pairrR}s   !4!4R!89@@FMMgV ^^HOOG4 5 < < >F((077=DDWMI  r+)scope extra_paramscUSUUUSUS.nU(aURU5 [S[RR U53$)NcodeS256)r response_type redirect_urirScode_challengecode_challenge_methodstate?)updateCHATGPT_AUTHORIZE_URLurllibparse urlencode)rrYr\rZrSrTparamss r(_build_authorize_urlrdsS$(!'F l## $Afll&<&&.M3.,/\r+rfc[SSUSS9$)NzChatGPT sign-in completezYou're signed insuccesstitleheadingmessagestatus_oauth_result_htmlrs r(rsrss ("  r+c[SSUSS9$)NzChatGPT sign-in failedzSign-in failedrrrrs r(rrrrs &   r+c US:XaSOSnUS:XaSOSnUS:XaSOSn[R"U5n[R"U5n[R"U5n SUS US US US US U S3 $)Nrz#137333z#b3261ez#eef7f0z#fceeeez✓!zaM��
z

z

z

)htmlescape) rrrraccent backgroundmark escaped_titleescaped_headingescaped_messages r(rrs!I-Y9F$ 1yJ)+9DKK&Mkk'*Okk'*O !/&0:l'& &x'89/ r+c"SS[5nX$l[RR X4U5nSUl[R"5U-n[R"5U:aUR5 URRS5(d URRS 5(a%[UR5UR5 $[R"5U:aMUR5 S USU3n[U5e![ anSUSUSUS3n[ U5UeSnAff=f!UR5 f=f) Nc$\rSrSr%0rS\S'Srg)1_wait_for_callback.._BoundCallbackHandlerir<rgr3N)r8r9r:r;rgr=r?r3r+r(_BoundCallbackHandlerrs (* ~*r+rz7Could not bind ChatGPT OAuth callback server on http://:rzI. Free the port or pass `port=` to `login_chatgpt()` with an unused port.g?rVrz7Timed out waiting for ChatGPT OAuth callback on http://)rfrhhttpserver HTTPServerrrrtime monotonichandle_requestrgrqrt server_close TimeoutError) hostportrhrrrrr'deadlines r(_wait_for_callbackrsN+ 0++8')'' 6KLFN~~')Hnn)  ! ! #$2266&4488AA1??@nn)  CD64& QC s ' )V1TF"SE*8 8 3S( )" s*!D$A=E&E$ E .EE E cUS:Xag[R"U5RnU(dSU<S3n[U5eg![a SnN(f=f)uReject non-loopback callback hosts. The callback server receives the OAuth authorization `code` in the request URL. Binding it to a non-loopback interface (e.g. `0.0.0.0`) would expose that code on the local network, so only loopback hosts are permitted — RFC 8252 §8.3 expects a loopback redirect for native-app PKCE flows. Args: host: The callback host passed to `login_chatgpt`. Raises: ValueError: `host` is not `localhost` or a loopback IP address. rNFz`host=z` is not a loopback address. The OAuth callback server receives the authorization code in the request URL, so it must bind to a loopback interface (`localhost`, `127.0.0.1`, or `::1`) to avoid exposing the code on the network.) ipaddress ip_address is_loopbackr$)rrr's r(_validate_loopback_hostr5sn {**40<<  TH@ @ o   s A AAgr@) store_pathrrrrhrS open_browserrc [U5 SUSUU3n[R"S5n [5up[ UUU U US9n [ SU S35 [ RS[5 U(a[R"U 5 [X#XGS 9nURS 5U :wa S n[U5eS U;a(URSS5nSUS SU3n[U5eURS5nU(d Sn[U5e[!["SUUUU S.5n[%U5n['U=(d [(US9nUR+U5 U$![Ra n [ RSU 5 S n A NS n A ff=f)aRun the ChatGPT OAuth 2.0 Authorization Code Flow with PKCE. Starts a loopback callback server, optionally opens a browser to the OpenAI authorize endpoint (when `open_browser=True`; the URL is always printed as a fallback), exchanges the returned code for tokens, and persists them via `_FileChatGPTOAuthTokenProvider`. Args: store_path: Where to persist the token. Defaults to `DEFAULT_STORE_PATH`. client_id: OAuth client ID (defaults to Codex/ChatGPT client). host: Local callback host. Must be a loopback address. port: Local callback port. callback_path: Local callback path. scope: OAuth scope string. open_browser: Whether to launch the system browser. timeout: Seconds to wait for the callback. Returns: A `_FileChatGPTOAuthTokenProvider` ready for use by `_ChatOpenAICodex`. Raises: ValueError: `host` is not a loopback address. RuntimeError: The callback server could not bind, the `state` did not match (CSRF), the provider returned an OAuth error, or no authorization code was returned. TimeoutError: No callback was received within `timeout` seconds. See Also: `login_chatgpt_device`: Headless fallback for environments without a browser or the ability to bind a localhost callback port. zhttp://r )rrYr\rZrSz9 ChatGPT sign-in: open the following URL in a browser:  z"Opening ChatGPT sign-in flow at %sz;Could not launch a browser: %s. Copy the URL above instead.N)rrrhrr\z&ChatGPT OAuth callback state mismatch.rrrz'ChatGPT OAuth callback returned error:  rVz=ChatGPT OAuth callback did not include an authorization code.authorization_coderrVrYr code_verifierrr)rrH token_urlsaferRrdprintruinfor_ webbrowserrErrorrrrqrrr?rrrr)rrrrrhrSrrrYr\rPrQ authorize_urlrresultr'rrVrriproviders r( login_chatgptrTsXD!TF!D6-9L  ! !" %E-/H(!  M Em_TVW KK46KL  OOM * MF zz'e#63&jj!4b9 7w7H+W3 ::f D M3.("%   H ! *E-  --H MM% OO  NNM   s6EF *FF g@g@)rr poll_intervalrc [5upE[[U[USS.5nUR S5nUR S5nUR S5=(d UR S5n U(aU(aU (d Sn [ U 5e[ RSX5 [R"5U-n S n Un [R"5U :a[[XS .5nUR S 5(aUS n OkUR S 5nUS :XaU S- n OU(aUS:waSU3n [ U 5e[R"U 5 [R"5U :aMU (d Sn [U 5e[[S U [UUS.5n[!U5n[#U=(d [$US9nUR'U5 U$)aRun the ChatGPT device-code OAuth flow. This is the headless fallback for environments without a browser. The function prints a verification URL and user code, polls for completion, then exchanges the resulting code via the OAuth token endpoint using `CHATGPT_DEVICE_REDIRECT_URI`. Args: store_path: Where to persist the token. Defaults to `DEFAULT_STORE_PATH`. client_id: OAuth client ID (defaults to Codex/ChatGPT client). poll_interval: Seconds between polls. timeout: Total seconds to wait. Returns: A configured `_FileChatGPTOAuthTokenProvider`. Raises: RuntimeError: The device-code response was missing required fields, or device authorization failed with a terminal error. TimeoutError: Authorization was not completed within `timeout` seconds. See Also: `login_chatgpt`: Browser-based loopback flow preferred when a local browser and free callback port are available. rW)rrSrZr[ device_code user_codeverification_uriverification_uri_completez5ChatGPT device-code response missing required fields.z,Open %s in a browser and enter user code: %sN)rrrrrrrzDevice authorization failed: z3Timed out waiting for ChatGPT device authorization.rr)rRrCHATGPT_DEVICE_CODE_URL DEFAULT_SCOPErqrrurrrrCHATGPT_DEVICE_TOKEN_URLsleeprr?CHATGPT_DEVICE_REDIRECT_URIrrrr)rrrr _verifierrQstartrrrr'rrcurrent_intervalpollrrrirs r(login_chatgpt_devicersB/0I ""'%+   E))M*K +&Iyy!34 #9 I*:E3 KK68H~~')H%)$ .. X %% $# @  88( ) )!%&:!;  ! K   !  u 771%9Cs# # #$! .. X %" C3.&7"&   H ! *E-  --H MM% Or+)r_r>r?rlrr)r]rr5bytes)rirr5r=)r"rr5zdict[str, str | None])rkr=r5r)rkr=rrr5r)rirr5r=)rr=r5r)rr rr~r5r6)rr rr=r5r6)rr r5zIterator[None])rrr5r)rhttpx.Responser5ztuple[str | None, str])rrrrr5r6)rrrr<rrr5r=)r5ztuple[str, str])rrrYrr\rrZrrSrrTzdict[str, str] | Noner5r)rrr5r) rrrrrrrzLiteral['success', 'error']r5r) rrrr~rhrrrr5r<)rrr5r6)r Path | Nonerrrrrr~rhrrSrrr7rrr5r) rrrrrrrrr5r)[r< __future__rr2r[rrLr http.serverrrreloggingrrHr@r urllib.parser`r dataclassesrrrrrpathlibr typingr r r r rrcollections.abcr getLoggerr8rur>r_r?rrrrrDEFAULT_REDIRECT_HOSTDEFAULT_REDIRECT_PORTrrr>homerrrrArDr_rlrzrrrrrrcontextmanagerrrrrr frozensetrrrrrRrdrBaseHTTPRequestHandlerrfrsrrrrrrr__all__r3r+r(rs 2#     (22KK (   8 $3A9TRK =#(5  +YY[</2EE $$F$F$FN    07 .4 F&*. ' : , &( ))X* ! $      "()@+(NO      4      " q"q" q"h *.GGG  G  G  G(G G.4t{{994n( (( ( ( (  (V          FB#&%%.hhh  h  h  h hhh$hZ#& ^^^ ^  ^ $ ^B r+