sjױdZddlmZddlZddlZddlZddlmZddlm Z m Z m Z ej e ZddlmZddlmZmZmZmZmZddlmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.dd l/m0Z0m1Z1m2Z2dd l3m4Z4m5Z5dd l6m7Z7dd l3m8Z8ddl9m:Z:m;Z;mdcdZ?dddZ@dedZAd`dfd"ZBdgd%ZCdhd&ZDdid'ZEdhd(ZFdjd)ZGdkdld+ZHdd,dmd/ZIhd0ZJdnd3ZKdod4ZLdpd7ZMdddd8dqd>ZNdkdrd@ZO dsdtdDZPdudGZQdudHZRdvdIZSdwdJZTdedKZUdxdLZVddddMdydOZWdodPZXdzdRZYddddSd{dVZZdddWd|dXZ[ddddSd}dYZ\ddddSd~dZZ]ddddd[dd\Z^dd_Z_dS)zGShared runtime provider resolution for CLI, gateway, cron, and helpers.) annotationsN)urlparse)AnyDictOptional)auth)CredentialPoolPooledCredential credential_pool_matches_providerget_custom_provider_pool_key load_pool) get_secret)ACTUAL_LOCAL_NOAUTH_PLACEHOLDER AuthErrorDEFAULT_CODEX_BASE_URLDEFAULT_QWEN_BASE_URLDEFAULT_XAI_OAUTH_BASE_URLPROVIDER_REGISTRY_agent_key_is_usable_nous_inference_env_overrideformat_auth_errorresolve_provider resolve_nous_runtime_credentials!resolve_codex_runtime_credentials%resolve_xai_oauth_runtime_credentials resolve_qwen_runtime_credentials$resolve_api_key_provider_credentials-resolve_external_process_provider_credentialshas_usable_secretis_actual_local_base_urlnormalize_actual_base_url)get_compatible_custom_providers load_confignormalize_extra_headers)custom_provider_aliasescustom_provider_slug)OPENROUTER_BASE_URL)is_official_openai_host)base_url_host_matchesbase_url_hostnameenv_intnamestrdefaultreturnc.t||}||n|S)aProfile-scoped replacement for ``os.getenv`` on credential/provider reads. Routes through the secret scope (Workstream A): identical to ``os.getenv`` when multiplexing is off, scope-aware (and fail-closed on an unscoped read) when on. Genuinely-global vars are handled inside ``get_secret`` and still read ``os.environ``. Keeps the ``(name, default) -> str`` contract every call site here already relies on. ) _get_secret)r-r/vals ?/home/agent/.hermes/hermes-agent/hermes_cli/runtime_provider.py_getenvr56s! dG $ $C/33w.valuecv|ddS)N -)striplowerreplacer7s r4_normalize_custom_provider_namer?Cs, ;;==   ( (c 2 22r6hostboolc\|pdd}|dvS)Nr,.>::10.0.0.0 localhost 127.0.0.1)r<rstrip)r@hs r4_loopback_hostnamerJGs1 ##C((A < <!!i:&=&=## 4r6providermodelcRt|}|r|Sddlm}||||pdS)uResolve api_mode when no explicit/persisted mode applies. Precedence: URL detection (host-mandated wire shapes) first, then the transport the provider overlay itself declares via ``providers.determine_api_mode`` — which already handles host mandates, dual-wire providers, and the registry transport map — and only then the ``chat_completions`` default for genuinely unknown providers/endpoints. Before this helper the runtime paths consulted URL detection ONLY and silently landed reasoning providers on ``chat_completions`` whenever the hostname wasn't literally recognized. That is how ``openai-api`` pointed at OpenAI's data-residency hosts (``us.api.openai.com``) 400'd on every tool-calling turn: the provider declares ``codex_responses`` but the declaration was never consulted. Same latent class covered the other non-chat overlays (MiniMax family, copilot-acp). r)determine_api_modechat_completions)rbhermes_cli.providersrf)rcrWrddetectedrfs r4_fallback_api_moderjsK"(11H777777  h% 8 8 N_API_KEY` in the env, derived from the base URL host. Examples: https://api.deepseek.com/v1 → DEEPSEEK_API_KEY https://api.groq.com/openai/v1 → GROQ_API_KEY https://api.mistral.ai/v1 → MISTRAL_API_KEY https://generativelanguage.googleapis.com/v1beta/openai/ → GOOGLEAPIS_API_KEY Returns the env value (stripped) or "". Never returns env vars whose names are already explicitly checked elsewhere — those are handled by their own host-gated paths (OPENAI/OPENROUTER/OLLAMA). The vendor label is the *registrable* portion of the hostname: strip ``api.`` / ``www.`` prefixes, then take the second-to-last label (``api.deepseek.com`` → ``deepseek``). Falls back to "" for hostnames that don't yield a usable vendor label (IPs, loopback, single-label hosts). r,c3>K|]}|VdSN)isdigit.0chs r4 z(_host_derived_api_key..s* : :B2::<< : : : : : :r6rC)rF:cg|]}||Sr)r{lbls r4 z)_host_derived_api_key..s 8 8 8cC 8c 8 8 8r6r)apiwwwc3FK|]}|r|ndVdS)_N)isalnumrzs r4r}z(_host_derived_api_key..s3EEbjjll3EEEEEEr6)OPENAI OPENROUTEROLLAMA_API_KEY) r*anysplitpoplenjoinupperisalphar5r;)rWralabelsvendor sanitizedenv_names r4_host_derived_api_keyrsv&!**H r : :(.."5"5b"9 : : :::r>!!SH__r 8 8X^^C00 8 8 8F VAY.00 1  VAY.00 6{{QrBZFEEfEEEEEKKMMI IaL0022r666r%%%H Hb ! ! 'R . . 0 00r6cD|pd}|sdSt|pd}|sdS|dks*|ds|drdS|drdSt |dkrdSdS) uDecide whether a configured ``model.base_url`` may back native Anthropic. Native ``provider: anthropic`` resolution honors ``model.base_url`` so users can point at Anthropic-compatible endpoints (official Anthropic/Claude hosts, Azure Foundry, MiniMax/Zhipu/LiteLLM-style ``/anthropic`` proxies, Kimi's ``/coding`` route). But a config can carry a *stale* non-Anthropic URL — e.g. ``provider: anthropic`` left with ``base_url: https://openrouter.ai/api/v1`` after a provider switch — which would route Anthropic OAuth/setup-token traffic to an OpenAI-compatible aggregator and 404. Ignore those. Returns True only when the URL plausibly speaks the Anthropic Messages protocol; otherwise the caller falls back to ``https://api.anthropic.com``. r,Fr\z.anthropic.comz .claude.comTz .azure.comr])r;r*r<r_rb)rW candidateras r4_anthropic_base_url_override_okrsR&&((I u!),,299;;H u&&&(*;*;r002288::06B==??EEGG th&&$0_4I4T4TU^4_4__ $7 77r6 target_modelapi_keyrct|dpd}t |d}|rt d|r|St|p|dpd}|sdS ddlm}||| S#t$rYdSwxYw) Nrcr,rncopilotr/rgr)copilot_model_api_mode)r) r.rpr;r<rorhermes_cli.modelsrrR)rkrrrrs model_namers r4_copilot_runtime_api_moderts immJ77=2>>DDFFLLNN%immJ&?&?@@O? K^__\CY]]9%=%=CDDJJLLJ "!!"<<<<<<%%j'BBBB """!!!"s<C CC>r[bedrock_conversergcodex_app_serverr]rawrct|tr.ddlm}||}|t vr|SdS)unValidate an api_mode value from config. Returns None if invalid. Legacy/alias spellings (``openai``, ``anthropic``, ``responses``, …) are canonicalized via the shared alias map before validation, so configs written against older releases keep selecting the transport they named instead of silently falling through to hostname-based detection. r)_canonical_api_modeN)rr.rrr<_VALID_API_MODES)rrr`s r4roros[#s999999((--3355 ) ) )  4r6c"tpdS)uVReturn the trusted Nous runtime base URL override, if configured. Delegates to ``auth._nous_inference_env_override`` so every ``NOUS_INFERENCE_BASE_URL`` read shares one normalization path (trailing-slash stripping, blank → empty). The env source is trusted and intentionally bypasses the network host allowlist there. r,)rrr6r4!_nous_inference_base_url_overriders ( ) ) /R/r6rnOptional[Dict[str, Any]]c|s|S|dvr|St|dpd}|dkrdS|S)uOptional opt-in: rewrite api_mode → "codex_app_server" for OpenAI/Codex providers when the user has explicitly enabled that runtime via `model.openai_runtime: codex_app_server` in config.yaml. Default behavior is preserved: when the key is unset, "auto", or empty, this function is a no-op. Only providers in {"openai", "openai-codex"} are eligible — other providers (anthropic, openrouter, etc.) cannot be rerouted through codex. Returns the (possibly-rewritten) api_mode.>openai openai-codexopenai_runtimer,r)r.rpr;r<)rcrnrkruntimes r4%_maybe_apply_codex_app_server_runtimersp 111)-- 0117R88>>@@FFHHG$$$!! Or6)rkpoolrentryr requested_providerrOptional[CredentialPool]c  |p t}|p|dpd}t|ddpt|ddpdd}t|ddpt|dd}d} |d kr d } |pt}n|d kr d } |pt }n|d kr d} |pt }n|d kr%d} tj|} |p | r| jnd}n|dkrd} t|dpd } d} | dkrZt|dpd d} t| sd} | p|pd}n|dkr |pt}n|dkrd } n|dkr#ddlm} | |} t!p|}n|dkr7t#|t|dd|} |ptdj}ng|dkrt|dpd } | dkrst|dpd d} | r| }t%|d}|r|} |r/| dkr) ddlm}||}n#t*$rd}YnwxYw|r|} | dkrt-jdd|}nPt|dpd }tj|} | o0|d| jdk}||krO|rMt|dpd d} | r| }t%|d}ddlm}||ddlm}|||} n&|rt5||r|} nt7|||} ddlm}||ddlm}||| |}t;|| | } |d!krt=j|}|| ||t|d"d#||d$S)%Nr/r,runtime_base_urlrWrZruntime_api_key access_tokenrgrr[ xai-oauth qwen-oauth minimax-oauthr] anthropicrchttps://api.anthropic.com openrouterxainousr nous_api_moderr azure-foundryrnazure_foundry_model_api_mode/v1/?$opencode_provider_familyopencode_model_api_modenormalize_opencode_base_url)rcrnrklmstudiosourcer)rcrnrWrrcredential_poolr) rrpgetattrrHrrrrinference_base_urlr.r;r<rr'rhrrrrorrrRresubrrrrjrrauth_mod$_normalize_lmstudio_runtime_base_url)rcrrrkrreffective_modelrWrrnpconfigrLrKrrsrinferredrpool_url_is_defaultrrrs r4 _resolve_runtime_from_pool_entryrs0.00I$Ey}}Y'?'?E2O1488bGE:W[<\<\b`bjjknooHe.55[XZ9[9[G!H>!!$55 [ $99 \ ! !%44 _ $ $ (#'11Ng M : :2 [ '9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! J8J/J \ ! !22 U  $ V  666666 =11466B( Y  ,  E,b 1 1(    N0;N _ $ $9==44:;;AACCIIKK ? * *y}}Z88>B??EEGGNNsSSL ('-immJ.G.GHHO +*  $x+??? JJJJJJ77HH     $# + + +viX66H!)-- ";";"ArBBHHJJPPRR $'11%h(//#*>*>'B\BcBcdgBhBh*h ( * */B *y}}Z88>B??EEGGNNsSSL ('))-- *C*CDD>>>>>> # #H - - 9 B A A A A A..xIIHH  O!EhPc!d!d O&HH *(HoNNH;:::::))5AAAAAA..x8LL5H H:@JJ%6220  s5L LL requestedc|r:|r&|St}|d}t |t r:|r&|St dd}|r|SdS)z=Resolve provider request from explicit arg, config, then env.rcHERMES_INFERENCE_PROVIDERr,auto)r;r<rrprr.r5)rrkrL env_providers r4resolve_requested_providerrjs)Y__&&)  &&(((!##I==,,L,$$,););)=)=,!!##))+++6;;AACCIIKKL 6r6provider_labelapi_mode_override provider_namect||}|sdS t|}|sdS|}|dSt |ddpt |dd}|sdSt |st t|rd}||pt|pd||d||d S#t$rYdSwxYw) zXCheck if a credential pool exists for a custom endpoint and return a runtime dict if so.r Nrrr,no-key-requiredrgzpool:)rcrnrWrrr) r r has_credentialsselectrrrJr*rbrR)rWr r r pool_keyrr pool_api_keys r4_try_resolve_from_custom_poolr}s),HMRRRH t""##%% 4  =4u&7>>d'%Q_acBdBd  4 .. -3EFWX`FaFa3b3b --L&)e-Eh-O-OeSe #(h((#     tts##CC$C:A C CCresultNonecdD]:}||}t|tr|dkr||d<dS;dS)aqPropagate a per-provider output cap onto the resolved runtime dict. Accepts ``max_output_tokens`` or ``max_tokens`` on a ``custom_providers`` entry so a provider block can pin its own output limit. Gateway and CLI map this onto ``AIAgent.max_tokens`` only when the top-level ``model.max_tokens`` isn't set, so the documented global key still wins. )max_output_tokens max_tokensrrN)rprint)rr_k_vs r4_lift_max_output_tokensrsY2 YYr]] b#   266*,F& ' FF r6c\t|d}|r||d<dSdS)zCopy a validated ``extra_headers`` dict from a provider entry. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Never log them. extra_headersN)r$rp)rrrs r4_lift_extra_headersrs? ,EIIo,F,FGGM0"/00r6c  t|pd}|sdS|dkrdS|dkri|dsT tj|}|pd|krdSn#t $rYnwxYwt}|d}t|trddl m }| D]x\}}t|ts||s(t|dp|d pd}|r"t|dnd} | s7t|d dpd} |d d} |t!t| p|t|vra|d p+|d p|dpd} | r|d || | |ddd} |d} t| trt| | d<t#|| t|ddpd}|r|| d<t%|dp|d}|r|| d<t'|| | cSz|d}t|trt(ddSt-|}|sdS|D]!}t|ts|d }|d} t|trt| tsnt|ddpd}|t!||vr|| t|d dpdd} t|ddpd}|r|| d<|r|| d<|d} t| trt| | d<t#|| t%|d}|r|| d<t|ddpd}|r|| d<t'|| | cSdS)Nr,rrNr providersr)is_provider_enabledkey_env api_key_envrr-rrrW default_model)r-rWrrd extra_bodykey_cmdrn transportcustom_providerszcustom_providers in config.yaml is a dict, not a list. Each entry must be prefixed with '-' in YAML. Run 'hermes doctor' for details. provider_key)r-rWrrd)r?rrrr;r<rr#rprrrr"itemsr.r5r%rrorrqwarningr")rrequested_norm canonicalrr!r"ep_namerr#resolved_api_key display_namerWrr&r'rnr)r-r*rs r4_get_named_custom_providerr2s45G5M2NNN t"t!!.*C*CI*N*N!  1.AAIR&&((..00NBBtC    D ]]F ;''I)T""8"999999'oo//6 "6 "NGUeT**  '&u--  )$$F -(@(@FBegg @GNww3399;;;B # O#&uyyB'?'?'E2#F#F#L#L#N#N  99VR00L!8L+G,,G "" !99U++^uyy/?/?^599ZCXCX^\^" % &' : :$,NN$4$4#3!&?B!?!? F "'> t!%&&  yy  99Z(($$$ Jx,E,E  599^R88>B??EEGG !8|!L!L L L JJLL ((599Y339r::@@BB   eii 2..4"55;;==  ( 'F9   2%1F> "YY|,, j$ ' ' 4#' #3#3F< E6***"599Z#8#899  *!)F: 7B//5266<<>>  )(F7Ov... 4sA== B  B cH t|duS#t$rYdSwxYw)u~Return True when config defines a custom provider matching the request. Thin public wrapper around :func:`_get_named_custom_provider` so other modules (e.g. the cronjob tool) can decide whether a provider name will actually resolve to a configured ``providers:`` / ``custom_providers:`` entry — without reaching into a private helper or duplicating the scan. NF)r2rR)rs r4has_named_custom_providerr4Zs=)*<==TII uus  !!c t|}|sdS t}n#t$rYdSwxYw|d}t |t r|D]\}}t |t s|dp+|dp|dpd}t||kr,tt|t|cS t|}n#t$rd}YnwxYw|pgD]}t |t s|d}t |tr| sWt|d|kr5t|t|ddpdcSdS) uDMap an endpoint URL back to its canonical ``custom:`` menu key. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose base_url matches, or ``None`` when no entry owns the URL. Session persistence stores the agent's *resolved* provider, and for every named custom endpoint that is the literal string ``"custom"`` — the entry name is lost, and the api_key is deliberately never persisted. The endpoint URL is the one durable fact that survives the round-trip, so this reverse lookup lets persist/rebuild paths recover the entry identity (and with it key_env/api_key/api_mode resolution via :func:`_get_named_custom_provider`) instead of failing with ``auth_unavailable`` or silently rebuilding with placeholder credentials. Nr!rrrWr,r-r*) _normalize_base_url_for_matchr#rRrprrr+r&r.r"r;) rWtargetrr!r/r entry_urlr)r-s r4find_custom_provider_identityr9hs' +8 4 4F t tt ;''I)T""H'oo// H HNGUeT**  %  SEIIe$4$4S *8M8MSQS -Y776AA+CLL#g,,GGGGGB :6BB     !'R  %&&  yy  $$$ DJJLL   (:)>)> ? ?6 I I'EIInb117R88    J 4s$ 22D D/.D/c ht|pdsdS t}n#t$rYdSwxYwd fd }|d}t |trg|D]R\}}t |ts||r,tt|t|cSS t|}n#t$rd}YnwxYw|pgD]}t |ts|d }t |tr|sW||r5t|t|d dpdcSdS) aMap a model id back to the ``custom:`` entry that serves it. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose ``model`` / ``default_model`` matches, or whose ``models`` catalog (dict or list shape) contains the id. ``None`` when no entry serves the model. Companion to :func:`find_custom_provider_identity` (URL reverse-lookup) for the persistence paths where no base_url survived the round-trip: the session row always stores the model name, and a custom endpoint's model ids (e.g. an in-house SFT checkpoint) virtually never collide with catalog models on built-in providers, so the model is the last durable fact that can recover the entry identity. r,Nrrlr0rAc(dD]Y}||}t|tr-|krdSZ|d}t|t r-t fd|DSt|tr|D]}t|tr-|krdSt|t rl|dp|d}t|tr-|krdSdS)N)rdr%Trc3K|];}t|kV._entry_serves_model..sU7:C  &&((F2r6rr-F) rprr.r;r<rrkeyslist)rkeyr7ritemr=r7s r4_entry_serves_modelzCfind_custom_provider_identity_by_model.._entry_serves_models-  CIIcNNE%%% %++--*=*=*?*?6*I*Itt8$$ fd # # >Dkkmm  fd # # $ $ $dC(( TZZ\\-?-?-A-AV-K-K44dD))$((4..`` identity for a bare custom provider. The bare string ``"custom"`` is the *resolved billing class* shared by every named ``providers:`` / ``custom_providers:`` entry — it is NOT a routable provider identity (``resolve_runtime_provider("custom")`` falls through to the OpenRouter default URL with no api_key, which surfaces to the user as "No LLM provider configured"). Any code path that persists or restores a session's provider override must run the resolved provider through this helper so a bare ``"custom"`` is upgraded back to its durable ``custom:`` menu key. Three recovery sources, in priority order: 1. ``base_url`` — reverse-lookup the entry that owns the endpoint URL (the one fact that always survives the persistence round-trip when a URL was recorded). 2. ``model`` — reverse-lookup the entry that serves the session's model (``model``/``default_model``/``models`` catalog). The session row always stores the model name, so when no base_url survived (the recurring Desktop/TUI regression vector) the model is the last session-scoped fact that can recover the entry — and unlike the config fallback below it stays correct after the user points their global default at a different provider. 3. ``config_provider`` — the active ``config.model.provider`` (or its ``provider``/``HERMES_INFERENCE_PROVIDER`` equivalent). When neither a base_url nor a model recovered the entry, the configured provider is the only durable identity left, so fall back to it when it names a real entry. Returns ``custom:`` when a routable identity is recovered, else ``None`` (caller keeps whatever it had — bare ``"custom"`` only as a last resort, e.g. a genuine ad-hoc endpoint with no config entry). r,rcr>rrNrNrWr) r9rCr.r;rrprRosenvironr?r2r)rWrDrdidentityrcandidate_normrs r4canonical_custom_identityrJsP0::  O 9%@@  OO)r**0022I  -//33J??E2FFLLNNII   III  LJNN#>CCIIKK 4Y??N ^/OOOt *955  5S:9N9N9TRT5U5UVVH ((33 &%%-^-- -       4s2AB B#"B#2AE8EE E"!E"ct|pddS)Nr,rZ)r.r;rHr<r>s r4r6r6=s: u{   ! ! # # * *3 / / 5 5 7 77r6custom_providerc|d}t|tr|siSdt|iS)Nr&)rprr)rLr&s r4"_custom_provider_request_overridesrNAsF $$\22J j$ ' 'z $z** ++r6)explicit_api_keyexplicit_base_urlrrOrPc  |pd}|r/|dkr) ddlm}||dkrd}n#t$rYnwxYw|dkr|r|d}t |dd}|rd|d<|St|dpt|d }t|d } |pd|r"td dnd| r"td dndt|g} td | Ddpd} dt|pd|| d|dSt|} | sdS|pdp| ddd}|sdSt |d| d| d}|r| d} | r| |d<t| dtr | d|d<t!| }|r+it#| dpi||d<| drt#| d|d<|St|dpt|d }t|d }|pdt%| ddpdtt%| ddpdd|r"td dnd|r"td dndt|g} td| Dd} t%| ddpd}|r\t'|pds9ddlm}||t%| d|pd}||} d| dpt|pd|| pdd| d|d}| dr | d|d<t| dtr | d|d<| drt#| d|d<t!| }|r||d<dd lm}||}|U dd!lm}||d"krd#|vrd$nd%}n#t$rd}YnwxYw|| dsdd&lm}m}t%|p7| dp"t9 d'pd}|r||||d<|||d|d|d<|S)(Nr,rNrrOrZz direct-aliasr openai.comopenai.azure.comrPOPENAI_API_KEYOPENROUTER_API_KEYc38K|]}t||VdSrxr)r{cs r4r}z0_resolve_named_custom_runtime..vs0 C C1.?.B.B CQ C C C C C Cr6rrgrcrnrWrrrrWrnr-r rdrrequest_overridesrrr#c38K|]}t||VdSrxrWr{rs r4r}z0_resolve_named_custom_runtime..s1bb)EVW`EaEabIbbbbbbr6r')build_command_token_providerzcustom_provider:rcrnrWrrr)r*z opencode.aiz/zen/goz opencode-goz opencode-zen)rrr/)r;r<rQrrRrHrr)r5rnextrbr2rprrrNrr.ragent.command_token_sourcer]rrutilsr*rrr)rrOrPrr-rUrW pool_result_da_is_openai_url_da_is_openrouterapi_key_candidatesrrLrrZ_cp_is_openai_url_cp_is_openrouterr'r]token_providerrr _oc_familyr*rr_effective_models r4_resolve_named_custom_runtimerkHs2).B5577==??N.H44  M M M M M M  00H<P $"4    11CDDO t  b'')) /   z2 . . fSkk  t0(ODWDWXbDcDctCtGtGHNtOtOPPPK%((11  .#-K o))*=>> D D T/>?R/SK+ ,>OO  0{':;;ArBB0#0K+ ,    / / R+/0P+Q+QK (/,GG~K`aik}K~K~//JJ  R&&(( O   2 . . 4"55;;==O'' 266<"==CCEErJJPPRR7H P!2 & & , , . . .b6G P%r * * 0 0 2 2 2b h'' bb/AbbbdfggG/%%i44:;;AACCG%(*:*@b)G)G)I)IJJ%KKKKKK55  ##F,>??K8 L L    %$G#'' 33 #H - - //V_%8%8AS%T%TVVF7##3)'2w/%%&9::C@@K&56I&J"#?++I"&'G"H"H:?KK8&7"#;:::::))*<==J  / / / / / /  **0022mCC%.(..2B2B%B%BMM   JJJ o&9&9*&E&E          ""7++  ""&&y11    %''   W!8!8EU!V!VF: 88 z*F:,>  z Ms$A AA AW WWrOrPc t}t|dtr|dnd}t|dtr|dnd}d}dD]V}||}t|tr*|r|}nW|pd} |}| r/| dkr) ddlm} | | dkrd} n#t$rYnwxYwtdd} td d} d } |r+|s)| d kr |r|d krd } n| dkrt||rd } |pdp"| p | r|ndp| pt d }t|d}|p(| dko"| p|| ko|| pd d k}|r |tdtdg}n~t|d}t|d}t|d}|| r|nd|rtdnd|s|rtdnd|rtdndt|g}td|Dd}|s|rdnd}| dkrdnd}|dkrA|r?t!||t#|d| dkr|nd}|r|S|dkr|s|sd}||dkrt%||n2t#|dpt'|pd|||dS)NrWr,rc)rrrNrrOr'CUSTOM_BASE_URLFrTrZrPrrUrTz ollama.comrRrSOLLAMA_API_KEYc3zK|]6}t|t|pdV7dS)r,N)rr.r;r\s r4r}z._resolve_openrouter_runtime..isIjj)M^_hMiMijY_"   # # % %jjjjjjr6explicitz env/configrnr rrgr^)rrrpr.r;r<rQrrRr5rVr'rHr)rr_rrorurb)rrOrPrkrKrL cfg_api_keykvr-rUenv_openrouter_base_urlenv_custom_base_urluse_config_base_urlrW_is_openrouter_url_is_openrouter_contextre_is_ollama_url_is_openai_url_is_openai_azurerreffective_providerrbs r4_resolve_openrouter_runtimer~s "##I0:9==;T;TVY0Z0Zb9==,,,`bL0:9==;T;TVY0Z0Zb9==,,,`bLK  MM!   a   !'')) ''))K E(.B5577==??N%%''--//L .H44  M M M M M M  00H<>@@  '$5' V # # +<6#9#9&*# x ' ',X ,- - '#'   b''))   $7 ?L   R  #   fSkk  /xII0,& D $ K4K(K D 06B>>sCC C    ( ) ) $ % % 2(LII1(LII1((0J0J,,PT      X%%g%>P%#'  ) )39hGGG Y]]:66 7 7 #H - -    s?E E$#E$c t|pd}t|pdd}t|dpd}d}d}d} i} |dkrt|dpdd}t |dpd}t|d pdpd} |d } t | tr| } t|p|d pd} | r/|d kr) d dlm } | | }n#t$rd}YnwxYw|r|}tddd}|p|p|}|std|d krtjdd|}| dkr|r|}d}d}n d dlm}m}m}n&#t$r}td|d|d}~wwxYwt| dpdp|} ||}||}n/#t&$r"}tt||d}~wwxYw|}d}d}i}|dkr=t| dpd}|r||d<d|||||||dS|}|s' d dlm}|dpd}n#t$rd}YnwxYw|s"tdd}|std|s|rdnd}d|||d||d S)!aResolve an Azure Foundry runtime entry. Reads ``model.base_url`` + ``model.api_mode`` from config.yaml (or explicit overrides), pulls the API key from ``.env`` / env var, and strips a trailing ``/v1`` for Anthropic-style endpoints because the Anthropic SDK appends ``/v1/messages`` internally. When ``model.auth_mode == "entra_id"`` (and the model is OpenAI-style), the returned ``api_key`` is a zero-arg callable produced by :func:`agent.azure_identity_adapter.build_token_provider` rather than a string. Downstream code that constructs an OpenAI SDK client passes this through unchanged (the SDK accepts ``Callable[[], str]`` for ``api_key`` and calls it before every request). Code paths that need a string (logging, manual HTTP probes, header injection) must use the helpers in ``agent.azure_identity_adapter``. Raises :class:`AuthError` when required values are missing. r,rZrcrgrrrWrn auth_modeentrar/r]rrNAZURE_FOUNDRY_BASE_URLzpAzure Foundry requires a base URL. Set it via 'hermes model' or the AZURE_FOUNDRY_BASE_URL environment variable.rentra_idrq)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULTbuild_token_providerzAzure Foundry Entra ID auth requires the 'azure-identity' package. Install it with: pip install azure-identity (import failed: )scope)r)r)rcrnrWrrrrr) get_env_valueAZURE_FOUNDRY_API_KEYaAzure Foundry requires an API key. Set AZURE_FOUNDRY_API_KEY in ~/.hermes/.env or run 'hermes model' to configure. To use keyless Microsoft Entra ID auth instead, set model.auth_mode: entra_id in config.yaml (or pick 'Microsoft Entra ID' in 'hermes model').r)rcrnrWrrrr)r.r;rHrpr<rorrrrrRr5rrragent.azure_identity_adapterrrr ImportErrorrr)rrkrOrPrexplicit_base_url_cleanrLrK cfg_api_mode cfg_auth_mode cfg_entra_entrarrr env_base_urlrWrrrrrrrr entra_configrh clean_entraconfigured_scopers r4_resolve_azure_foundry_runtimers14+1r2288::!"3"9r::@@BBII#NNy}}Z006B77==??EEGGLL%LM "I&&9==44:;;AACCJJ3OO &y}}Z'@'@AAWEW IMM+66C)DDJJLLRRTTaXa w'' fd # # I,H)-- *B*BHbIIOOQQO$<+???  F F F F F F33ODDHH   HHH   $#L3R88>>@@GGLLL&F,F,H   ?   +++6)R22  "" ! #,GF!II     .'*...  IMM'**0b117799*)  322    "6!5\!J!J!J 3 3 3C))s2 3$GF"I  " ""9==#9#9#?R@@FFHH  8'7 G$($ " "4   G   7 7 7 7 7 7#m$;<<BGG   GGG  ?1266<<>>   7   - P0A PZZF# 0  sTG&& G54G55 J J# JJ#K88 L$LL$N N%$N%c  t|pd}t|pdd}|s|sdS|dkrt|dpd}d}|dkrZt|dpdd}t |sd}|p|pd}|} | s!ddlm} | } | std dd || d |d S|d kr|pt}|} d} | sft} | dd} | d} |s+| dddp|}d d|| d | |dS|dkrddl m } tjdpi}|p`tpRt|dp tjd}|pct#|t%dt'ddr6t|dpdnd} |dp|d}| st)t+t-dd} | dd} | d}|s+| dddp|}d| |p|dpd|| d ||dS|d krt/||||!St1j|}|r$|jdkrd}|jr:t-|jdd}|}|sF|d"vr9t7|} | ddd}n |p|j}|d#krt;|}|} | set7|} | dd} |s>| ddd}|d#krt;|}d$}|d%krt=|| |&}n|d'krd}n|d#krd}nt|dpd}t?|d(}|rtA||r|}n'tC|||p|dd}|d#kr| stE|rtF} |||d| d |d SdS))Nr,rZrrcrWrrresolve_anthropic_tokenNo Anthropic credentials found. Set ANTHROPIC_TOKEN or ANTHROPIC_API_KEY, run 'claude setup-token', or authenticate with 'claude /login'.r]rqrYrr last_refreshr[rcrnrWrrrrrrr<HERMES_NOUS_MIN_KEY_TTL_SECONDS agent_keyagent_key_expires_at expires_atHERMES_NOUS_TIMEOUT_SECONDS15timeout_secondsr/rcrnrWrrrrr)rrkrOrP> kimi-codingkimi-coding-cnactualrgrrrrn)$r.r;rHrpr<ragent.anthropic_adapterrrrrrhrrget_provider_auth_staterDEFAULT_NOUS_INFERENCE_URLrmaxr+rfloatr5rr auth_typebase_url_env_varrrr!rrorrjr r)rcrrkrOrPrrLrKrWrrrcredsrstaterrenv_urlrnrrss r4_resolve_explicit_runtimer9s+1r2288::-344::<<CCCHH $5t;9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! $S S8S"  G G G G G G--//G V $,  "4    >!!$>(>"  M577Eii 2..G 99^44L$ M 99Z44;;C@@LH&)  ("4   6666666088>B  o022 o599122Yh6YZZ``bbiijmnn # #B A4HHII C +&&," - - 3 3 5 5 5  YY566Q%))L:Q:Q  M4 %g.KT&R&R S SEii 2..G<00J$ M 99Z44;;C@@LH% l&TimmI6N6N&TRTUU  $"4   ?""-1-/      #H--G: 7$ 11  # Pg6;;AACCJJ3OOG$ A<<<S|d1kr dd?l)m*}'tWtYtd@dAB}(d1|'|p|d&pd |(dd  d|(dCd |(dDdE|(dF|dGS#t $r$|dHkrtH-dIYnwxYw|dJkr t]}(dJdK|(dd  d|(dCd |(dDdL|(dM|dNS#t $r$|dHkrtH-dOYnwxYw|dPkr t_}(dPdK|(dpd dpt`|(dCd |(dDdL|(dM|dNS#t $r$|dHkrtH-dQYnwxYw|dRkr tc}(dRd |(dd  d|(dCd |(dDdS|(dT|dUS#t $r$|dHkrtH-dVYnwxYw|dWkrZtej|})|)rD|)j3dXkr9ddYl4m5}*|*}(|d|(d|(dC|(dDdZ|d S|d[krtm|}(d[d |(dd  d|(dCd |(d\d to|(d]pg|(dDd^|d_S|dkrt%|dpd }d H|dkrM|dpd  dHtqHsd HHpd`}t|dpHotHd}+|+rd }daD]`},t%||,pd }-|-r&t|-d }|rna|s6t%|dCpd }|sDtdd p!tdd }|st!dbn!ddcl9m:}.|.}|st!dddd||de|d S|dfkrddgl;m<}/m=}0m>}1m?}2|dhv}3|3s|/st!didjk|dfi}4|4dlpd p |1}5|0pdm}6|4dni}7d}8|7dorf|7dprQ|7do|7dpdq}8|7drr |7dr|8ds<|7dtr |7dt|8dt<t%|p|d&pd }9t7tjAdud }:|2|9r|:sdfddv|5dwdx|6|5d-|dy}ndfdzdv|5dwdx|6|5|d{}|8r|8|d|<|Stej|})|)r'|)j3dCkrt|}(|d}kr)t|(dCst%|dpd };d }<|;|kr<|dpd  d}|>rd|>dnd }?t!d|d|?|dt%|dpd }d H||kr<|dpd  dHHp(|(dd  d}|d}krt|}d }@|dkr't||(dCd |}@n|dkrdK}@n|d}krdK}@nt%|dpd }At|d}Bddlm}C|C|+ddlmK}D|p|d&d }E|D||E}@n<|Brt||Ar|B}@n't|||p|d&d }@ddlm}C|C|ddlmN}F|F||@|}|dkrtjP|}|(dCd }G|d}kr|Gst|rt}G||@||G|(dDde|d St+|||#}||d<|S)a)Resolve runtime provider credentials for agent execution. target_model: Optional override for model_cfg.get("default") when computing provider-specific api_mode (e.g. OpenCode Zen/Go where different models route through different API surfaces). Callers performing an explicit mid-session model switch should pass the new model here so api_mode is derived from the model they are switching TO, not the stale persisted default. Other callers can leave it None to preserve existing behavior (api_mode derived from config). r)r"r#r!Nz provider z" is disabled in config (providers.z.enabled: false)moargz moa://localzmoa-virtual-providerrYr,rz azure.comAZURE_ANTHROPIC_KEYANTHROPIC_API_KEYr]rZzazure-explicitr)rrkrOrPr)vertexz google-vertexz vertex-aiz gcp-vertexvertexai)get_vertex_configaVertex AI credentials could not be resolved. Vertex uses OAuth2 (not a static API key): provide a service-account JSON via GOOGLE_APPLICATION_CREDENTIALS (or VERTEX_CREDENTIALS_PATH) in ~/.hermes/.env, or run 'gcloud auth application-default login' for ADC. Set the GCP project/region under vertex: in config.yaml if they aren't embedded in the credentials. Run `hermes setup` to install Vertex support.rz vertex-oauth)rrOrPrrrcrW)rr,)rPz anthropic.comrRc38K|]}t|VdSrx)r))r{r@rKs r4r}z+resolve_runtime_provider..sA&lD99r6)rrOrPrl)ropencode_zen_free_runtimer/rd)rcrrkrOrPrrOPENAI_BASE_URLr'>rrNT>rrrrrrrrrrr)rrrzINous pool entry agent_key expired/missing, refreshing selected pool entryz"Nous pool entry refresh failed: %szRNous pool entry agent_key still unavailable, falling through to runtime resolutionr)rW)rcrrrkrrrrrrrrportalrrrzUAuto-detected Nous provider but credentials failed; falling through to next provider.rr[zhermes-auth-storerrzVAuto-detected Codex provider but credentials failed; falling through to next provider.rzZAuto-detected xAI OAuth provider but credentials failed; falling through to next provider.rzqwen-cli expires_at_ms)rcrnrWrrrrz@Qwen OAuth credentials failed; falling through to next provider.r oauth_minimax))resolve_minimax_oauth_runtime_credentialsoauthz copilot-acpcommandargsprocess)rcrnrWrrrrrr)r#r$zNo Azure Anthropic API key found. Set AZURE_ANTHROPIC_KEY or ANTHROPIC_API_KEY, or point key_env/api_key_env in your config.yaml model section at a custom env var.rrenvbedrock)has_aws_credentialsresolve_aws_auth_env_varresolve_bedrock_regionis_anthropic_bedrock_model> aws-bedrockamazon-bedrockawsamazonrzNo AWS credentials found for Bedrock. Configure one of: - AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - AWS_PROFILE (for SSO / named profiles) - IAM instance role (EC2, ECS, Lambda) Or run 'aws configure' to set up credentials.no_aws_credentials)coderegionzaws-sdk-default-chain guardrailguardrail_identifierguardrail_version)guardrailIdentifierguardrailVersionstream_processing_modestreamProcessingModetraceAWS_BEARER_TOKEN_BEDROCKzhttps://bedrock-runtime.z.amazonaws.comzaws-sdk)rcrnrWrrrbedrock_anthropicrr)rcrnrWrrrrguardrail_configrz local-offlinez, z Set rCz*No usable credentials found for provider 'z'.missing_api_key)rcrrrrrnrrrr)Qrrr"r#rrrp ValueErrorr;r)r5rHrragent.vertex_adapterrrrkr.r<rr~rrrrrrAr rRrrrrr+rrqrtry_refresh_currentr rrhrrrrrrrrrrrrQrrr?rrragent.bedrock_adapterrrrrrFrGrrr!r rrapi_key_env_varsrrorrrjrrr)IrrOrPrrr"r# _full_cfg _provs_cfg_block _eff_base _azure_key azure_runtimertokenrWcustom_runtimerkrL_known_cloud_hostsrrc _oc_family_fn_oc_free_runtime_fn _oc_model _free_runtimeexplicit_runtimeshould_use_poolenv_openai_base_urlruhas_custom_endpointhas_runtime_overriderrrmin_ttl nous_state refreshedrrrrr_is_azure_endpointhint_keyenv_varrrrrr is_explicit _bedrock_cfgr auth_source_grr_current_model_has_bearer_token _cfg_provider_cfg_url_effective_url env_nameshintrnrrsrr _effectiverrrKsI @r4resolve_runtime_providerr s]"4I>>CBBBBBBB I/9)T/J/JT{+++PTJ*d## 233 fd # # ,?,?,G,G C.CC0CCC  U""*%-,"4    #(b//11I[((-B9k-Z-Z(  # * * , , 8,b117799 8*B//5577  $,!((--!&"4    _,,61'))-/%    ___::::::++--x H @ !* ,,$"4    3-)+! N /A+, %5%'' 9==44:;;AACCIIKK 9==44:;;AACC  LL88"  . 6'9%5&7 1C,-)+H "##I}X*  TIMM)44 T g8N8N TRT  %'' ,+Hi@@  $2DM. / 0-)+!  ,.O<9==44:;;AACCIIKK 9==44:;;AACC %&7<<BBDD")*?"D"D"J"J"L"L"  '" '&    'L,>>>"& #$4$I8IJJ "8 8 )'' )((  &5?y"""4  >$$&&>   0$7765."55  v  %"3"g&GNNOOG$UK>>(/7Mt(T(T 66J ( G<< & hiii% $ 8 8 : :II %%%LL!EsKKK $IIIIII%(%E'8$??>"5."==! &-UK%F%F07?UW[0\0\!(!>!>""J $&+? G+T+T&LL!uvvv#%L   0E#5t<<uj$77  4!#5#)  6 = : : : : : :4 %g.KT&R&R S SE#)M,*X)-- :R:R*XVXYY!IIj"55<!! =577E*-!IIj"55<#>38[II  M2<MM  % E6  immH55;<<BBDD#GR006688E DIMM)44:;;AACC 1266<<>>@2B77==?? E  H G G G G G++--E V $, "4    9            ),ii  #6#6#8#8 @ *  #{}}((B77 ""8,,299;;W?U?U?W?W..00K4K {B// 77) * * 9sww7J/K/K 9'*+A'B$'(;$<   ww/00 Y;>?W;X !78www 9,/L )\KY]]9-E-EKLLRRTT 0JB!O!O!U!U!W!WXX % %n 5 5 >O &0MvMMM$% %)&8  GG&.MvMMM$% &8G  ;*:G& ' #H--Ga 7$ 114X>> x  (9%))I:N:N(O(O  j 9 9 ?R@@FFHHNNPPMH((%MM*55;BBDDKKCPP6AEIIj"55<>>>> # #H - - 9 E E E E E E228XxPPH z ! !DXNNH))Ir** x   4LX4V4V 5G   ii%00"4    *-)+G %7G ! Nsv)Q== R  R 'U<< V-V((V- B<]+]65]6A9_::+`('`(2Bb44+c"!c",A9e&&+fferrorrRcht|trt|St|Srx)rrrr.)r s r4format_runtime_provider_errorr t s.%##( ''' u::r6)r,)r-r.r/r.r0r.)r7r.r0r.)r@r.r0rA)rKr.rLr.r0rA)rWr.r0rX)rcr.rWr.rdr.r0r.)rkrlrWr.r0r.)rWr.r0r.)rWr.r0rA)r0rlrx)rcrXrrXr0rA)rkrlrr.rrXr0r.)rrr0rX)r0r.)rcr.rnr.rkrr0r.)rcr.rr rr.rkrrrrrXr0rl)rrXr0r.)NN) rWr.r r.r rXr rXr0r)rrlrrlr0r)rr.r0r)rr.r0rA)rdr.r0rX)rWrXrDrXrdrXr0rX)rLrlr0rl) rr.rOrXrPrXrrXr0r)rr.rOrXrPrXr0rl) rr.rkrlrOrXrPrXrrXr0rl)rcr.rr.rkrlrOrXrPrXrrXr0r) rrXrOrXrPrXrrXr0rl)r rRr0r.)`__doc__ __future__rloggingrFr urllib.parsertypingrrr getLogger__name__rq hermes_clirragent.credential_poolr r r r r agent.secret_scoperr2rQrrrrrrrrrrrrrrrrrr r!rr"r#r$rhr%r&hermes_constantsr'r(rar)r*r+r5r?rJrVrbrjrurrrrrrrrorrrrrrrr2r4r9rCrJr6rNrkr~rrr r rr6r4rsMM"""""" !!!!!!&&&&&&&&&&  8 $ $''''''988888* ONNNNNNN000000888888CCCCCCCCCC / / / / /3333==== 5555<1111hOOOOO2BBBB.61616161r""""J.@88888*#' """""":   "0000>+/%)"&RRRRRRj,(,#' )))))X    0000TTTTn    3333lCCCCP#%) VVVVVVr8888,,,,'+'+"& wwwwwwz'+'+ KKKKKKd'+'+"& ffffff\'+'+"&jjjjjj^ $&*'+"& K K K K K K \r6