epjŹ',0UdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlmZddlmZddlmZmZmZmZmZmZmZmZddlmZmZmZerddlm Z da!ee"e#d<d e"fd Z$Gd d Z%e%Z dd l&m'Z'ddl(m)Z)m*Z*ddl+m,Z,ddl-m.Z.ddl/m0Z0m1Z1m2Z2m3Z3m4Z4ej5e6Z7e8Z9e8e#d<e8Z:e8e#d<e8Z;e8e#d<e8Zda?dddee=de@d ee=effdZAde=de=ded efdZBe jCZDGdd eEZFd e@fd!ZGd e@fd"ZHejI dd$e@fd%ZJd eegeffd&ZKd'egefd e@fd(ZLGd)d*ZMe jCZNdd+ZOd e@fd,ZPejId-ZQd.eeRe=efgefdeRe=efd efd/ZSd0ed1ed e@fd2ZTd3e=fd4ZUdaVid5d6d7d6d8d6d9d:d;d:dd?d>d@d>dAd>dBdCdDdCdEdFdGdFdHdIdJdIdKdLdLdMdMdNdNdNdNdOdOdPdPdPdPdQ ZWdRee=d e=fdSZXeYZZeYe#dT<dUee=d e@fdVZ[dUee=d e@fdWZ\dXZ]dYZ^ddUee=dRee=d e@fdZZ_ddUee=dRee=d e@fd[Z` ddUee=dee=d d\fd]Za dd#d^dUee=dRee=d_e@d eebfd`Zcdae=d e=fdbZddcdddedfdedgdhdidjdkdldmdndo Zeee=e=fe#dp<eeZfee=e=fe#dq<drdsdtZgee=e=fe#du<dRe=d ee=fdvZheidCdFhZjeie#dw<dxdydzd{Zkeihd|Zld}eRdzd eRdzfd~ZmddeRdzd eRfdZnddiZode=dzd eRfdZpddlqmrZsdxdydesdZtddlumvZwd eRfdZxexZydaze@e#d<dlZ{dlZ|dZ}dZ~e,dz ZdZde=d ee=e=ffdZde=d e=fdZdRe=d ee@eeffdZdRe=d eefdZded e=fdZddede=d e=fdZeidhZd3e=d e@fdZd efdZde=d e=fdZGddZGddZGddZGddZGddZGddZGddZGddZGddZGddZGddZGddZGddZGddZGddZGddZGddZGddZde=d e@fdZ ddedUe=de=de=dee=d ef dĄZd eeRfdńZdReRd e=fdƄZd e=fdDŽZddȜde@d eee=e=ffdʄZddȜde@d eee=e=ffd˄Zd eee=e=ffd̄Zd ee=fd̈́Zd eee ee=ffd΄Ze8Ze8e#d<dUee=d e@fdЄZd ee@e=ffdфZdUe=d dfd҄Zdde=dUe=d eee ee=ffdԄZd e=fdՄZdde@d eee ee=ffdׄZde@dee=d ee=fdلZd e=fdڄZd e=fdۄZd e=fd܄Zd e=fd݄Zdee=d eee=ee=ffd߄Zd e=fdZde=d e=fdZdae=e#d<dae=e#d<dae=e#d<daee#d<dae=e#d<dae=e#d<ejddZejeee=efe#d<ejddZejeee=efe#d<dZdZdRe=dzdUe=dzde=dzd dfdZddddRe=dzde=dzd ee=e=eRe=effdzfdZdddddedeRe=efdRe=dzde=dzdeeRe=efgefdzd ef dZdddddedeRe=efdRe=dzde=dzdeeRe=efgefdzd ef dZddddedeRe=efdRe=dzde=dzd ef dZdaeedfe#d<e jZd eee=effdZde=d efdZdddddddRe=dUe=de=de=dede=de=d ejfdZΐdejd dfdZejIdeee=effdZАddZd eee=ee=ee=ffdZd e=fd ZӐdd Zde=d dfd Zd eeeee=ffd ZdUe=d eeeee=ffd ZdUe=d eeeee=ffdZddddddUee=dee=dee=dee=d eeeee=ff dZِdde=d eeeee=ffdZڐdddddZېdZeܐdzZݐdeee=efd ee=effdZd eefdZߐdZiZee=ebfe#d<iZee=ebfe#d<ddddddd ZdRe=d e=fd!ZddRe=d"eebd dfd#Zd$e=d e@fd%Zdd$e=d&ee=d dfd'Zdd(Zd)ed e@fd*Zd e@fd+Zd)ed e@fd,Zd)ed e@fd-Zd)ed e@fd.Zd)ed e@fd/Zd0Zd1Zd efd2Zd)ed e@fd3Zd)ed4e=d e@fd5Zd)ed e@fd6Zd)ed e@fd7Zd)ed e@fd8Zd)ed e@fd9ZdRe=d dfd:Zd;ed e@fd<Zdd=dRe=deee=efd e=fd>Zd)ed ee=effd?Z dd@e=dedeee=efd ee=fdAZddBdRe=d)edCe=d e@fdDZddEd&ee=d@e=dFee=dGee=dHee=dIee=deee=efdJee=dKedLeebdMeedNeedOebdPeRdQeeRdReee=e=fd ef"dSZddEd&ee=d@e=dFee=dGee=dHee=dIee=dJee=dKedLeebdMeedNeedOebdPeRdQeeRdReee=e=fd ef dTZdRe=d e@fdUZd@ee=dVe=d e=fdWZd&ee=dXe=d eee=effdYZd&ee=dXe=d eebfdZZd$e=d e=fd[ZGd\d]eZdRe=de=dee=dUee=d ef d^Zdee=efd_ed`ee=d efdaZ d&ee=d_ed`ee=dXe=d ef dbZ dKedNeedced eeeffddZ d_ed`ee=dXe=d&ee=dKedLeebdMeedNeedOebdPeRdQeeRd eefdeZ d_ed`ee=dXe=d&ee=dKedLeebdMeedNeedOebdPeRdQeeRd eefdfZ ddhe=d&e=die=d eeeee=e=ffdjZ ddhe=d&e=die=dlee=d eeeee=e=ff dmZd&ee=d eefdnZ ddRe=dUe=de=de=d eef doZ dd&e=dhe=die=dlee=d eeeee=e=ff dpZd&ee=dhe=d eeeee=e=ffdqZdee=efd ee=fdrZdee=efd eeeee=ffdsZ dd&ee=dhe=die=d eeeee=e=ffdtZ ddRe=dUee=dee=dee=d eef duZ ddeee=efd&ee=d eee ee=ffdvZddUe=dwe@fdxZdyee=dRe=d ee=fdzZ ddRe=dUe=de@d{e@de=de=de=deee=efdwe@d&ee=d eeeee=ffd|Z ddd=d&e=deee=efd eee ee=ffd}Zddd=d&e=deee=effd~ZdZdRe=dUee=d e@fdZdRee=d e=fdZ ddRe=dUee=d eeeee=ffdZ!dRe=d e@fdZ"d ee=fdZ# dddddddRee=dUee=dee=dee=de@deee=efd eee=eeee=ffdZ$d eRfdZ%dddedUee=d eRfdZ&iZ'eeefe#d<e jZ(dZ)GddZ*de=ded efdZ+dddddddddRe=de@dee=dee=dee=deee=efdwe@d&ee=dUee=d efdZ,dddededee=ded df dZ-ddddddde=dUee=de@dee=dee=dee=deee=efdwe@d eeeee=ffdZ.ddZ/ded dfdZ0ded dfdZ1ddZ2ddZ3ded e@fdZ4dedee=d e@fdZ5dedUee=dee=d ee=fdZ6 ddRe=dUe=de@de=de=de=deee=efdwe@d&ee=d eeeee=ffdZ7ddiZ8ee=e=fe#d< dd&e=dRe=dUe=dee=dee=d ee=ee=ee=ee=ee=ff dZ9dZ:dZ;d&e=d ee=effdZ<e:fd&e=debd ebfdZ=d&e=deebd ebfdZ>d&e=d ee=effdZ?iZ@ee=eee jAffe#d<iZBeee=efeeeffe#d<e jZCd&ee=d eefdZDd&ee=d ee jAfdZEd&ee=fdZFddZGeihdZHdRe=de=d e@fdZIdKed efdZJhdZKded e@fdZL ddRe=dUe=dKedLeebdMeedNeedebdeeRdQeeRdee=d&ee=d eRfdZM dded&ee=dRee=dee=d ef dZNddde=d dfd„ZOddÄZPded eefdĄZQded e=fdńZRdd0ede=ded efdDŽZSdȐZTdɐZUdOeebd ebfdʄZVded e@fd˄ZWd)ed e@fd̄ZXdRe=dee=d e@fd̈́ZY dddΜdedee=efd&ee=de@d ef dЄZZdddќdedUe=deebd efdԄZ[GdՄd֦Z\dddќdedUe=deebd efdׄZ] ddedee=efd&ee=d efd؄Z^e dddddddddddddddddٜd&e=dRe=dUe=de=de=deee=efdKedLeebdMedNedebdeRdQeeRdReee=e=fde=de@deRd ef$d܄Z_dede jAfdބZ` dddddddddddddddddٜd&e=dRe=dUe=de=de=deee=efdKedLeebdMedNedebdeRdQeeRdReee=e=fde=de@deRd ef$d߄Zad e=fdZbe ddddddddddddd d&e=dRe=dUe=de=de=deee=efdKedLeebdMedNedebdeRdQeeRd efdZc ddddddddddddd d&e=dRe=dUe=de=de=deee=efdKedLeebdMedNedebdeRdQeeRd efdZddS(uShared auxiliary client router for side tasks. Provides a single resolution chain so every consumer (context compression, session search, web extraction, vision analysis, browser vision) picks up the best available backend without duplicating fallback logic. Resolution order for text tasks (auto mode): 1. User's main provider + main model (used regardless of provider type — aggregators, direct API-key providers, native Anthropic, Codex, etc.) 2. OpenRouter (OPENROUTER_API_KEY) 3. Nous Portal (~/.hermes/auth.json active provider) 4. Custom endpoint (config.yaml model.base_url + OPENAI_API_KEY) 5. Native Anthropic 6. Direct API-key providers (z.ai/GLM, Kimi/Moonshot, MiniMax, MiniMax-CN) 7. None OpenRouter fallback cost guard: ``auxiliary.free_only: true`` restricts the step-2 fallback to ``:free`` SKUs; ``auxiliary.openrouter_model`` overrides the default. A one-time WARNING is logged for non-``:free`` models. Resolution order for vision/multimodal tasks (auto mode): 1. Selected main provider, if it is one of the supported vision backends below 2. OpenRouter 3. Nous Portal 4. Native Anthropic 5. Custom endpoint (for local vision models: Qwen-VL, LLaVA, Pixtral, etc.) 6. None Codex OAuth (ChatGPT-account auth) is intentionally NOT in either fallback chain: OpenAI gates this endpoint behind an undocumented, shifting model allow-list, so "just try Codex with a hardcoded model" rots on its own. Codex is used only when the user's main provider *is* openai-codex (Step 1 above) or when a caller explicitly requests it with a model (auxiliary..provider + auxiliary..model). Per-task overrides are configured in config.yaml under the ``auxiliary:`` section (e.g. ``auxiliary.vision.provider``, ``auxiliary.compression.model``). Default "auto" follows the chains above. Payment / credit exhaustion fallback: When a resolved provider returns HTTP 402 or a credit-related error, call_llm() automatically retries with the next available provider in the auto-detection chain. This handles the common case where a user depletes their OpenRouter balance but has Codex OAuth or another provider available. N)Path)SimpleNamespace)AnyCallableDictList NamedTupleOptionalTuple TYPE_CHECKING)urlparseparse_qs urlunparseOpenAI_OPENAI_CLS_CACHEreturnc.tddlm}|atS)z#Import and cache ``openai.OpenAI``.Nrr)ropenair)_clss rrs r__repr__z_OpenAIProxy.__repr__ls++rN)__name__ __module__ __qualname____doc__ __slots__r"r&r)rrrrr]sR I333333,,,,,rr) load_pool)MINIMUM_CONTEXT_LENGTHget_model_context_length)get_hermes_home)OPENROUTER_BASE_URL)base_url_host_matchesbase_url_hostname env_float"model_forces_max_completion_tokensnormalize_proxy_env_vars_LOGGED_UNKNOWN_PROVIDER_KEYS_LOGGED_UNHANDLED_AUTHTYPE_KEYS _LOGGED_UNSUPPORTED_EXTPROC_KEYS_LOGGED_UNSUPPORTED_OAUTH_KEYSbase_urlc ddlm}ddlm}m}|t |pd|}||d|dt |pdS#t$rYd SwxYw) aResolve httpx ``verify`` for an auxiliary-client base_url. Mirrors the main client's TLS resolution so auxiliary calls (compression, vision, web_extract, title generation, etc.) honor per-provider ``ssl_ca_cert`` / ``ssl_verify`` config and the ``HERMES_CA_BUNDLE`` / ``SSL_CERT_FILE`` env conventions. Best-effort: any failure falls back to the httpx/certifi default (``True``). r)resolve_httpx_verify) get_custom_provider_tls_settingsload_config_readonly)config ssl_ca_cert ssl_verify) ca_bundlerEr=T)agent.ssl_verifyr?hermes_cli.configr@rAstrget Exception)r=r?r@rAtlss r_resolve_aux_verifyrMs999999        /. B  (<(<(>(>   $#ggm,,ww|,,R((    ttsA4A77 BBF async_moderOc ddlm}|t|pd|t|}n<#tt f$r(t sdatdd}YnwxYw|iSd|iS) zKInject keepalive httpx client with env-only proxy (not macOS system proxy).r)build_keepalive_http_clientrB)rOverifyTuagent.process_bootstrap.build_keepalive_http_client is unavailable — mixed/stale install detected (#64333). Falling back to the SDK default HTTP client. Run `hermes update` (or reinstall the Desktop app) to resync the runtime.N http_client) agent.process_bootstraprQrIrM ImportErrorAttributeError_WARNED_KEEPALIVE_IMPORT_SKEWloggerwarning)r=rOrQclients r_openai_http_client_kwargsr[s GGGGGG,, B  !&x00     (- ,0 ) NND    '*~ 6 ""s036A,+A,api_keyr!c rit||}|ddtd||d|S)N max_retriesrr\r=r)r[ setdefaultr)r\r=r!s r_create_openai_clientrasM ?*844 ? ?F mQ'''  ?'H ? ? ? ??rc(eZdZdZdZdfd ZxZS)AuxiliaryExplicitCancellationaFrozen signal that an auxiliary attempt was explicitly hard-cancelled. This deliberately follows ``asyncio.CancelledError`` and inherits directly from ``BaseException``: provider retry/fallback code catches ``Exception`` broadly and must never reinterpret an explicit host stop as a transport failure. ``cause`` is immutable class data so downstream compression code does not re-query a mutable host Event after the transport has unwound. explicit_host_cancelrNcJtddS)Nz.auxiliary request explicitly cancelled by host)super__init__)r __class__s rrgz&AuxiliaryExplicitCancellation.__init__s" IJJJJJrrN)r*r+r,r-causerg __classcell__)rhs@rrcrcsX #EKKKKKKKKKKrrccHtttddS)NactiveF)boolgetattr_aux_interrupt_protectionrrr_aux_interrupt_protectedrqs 18UCC D DDrcttdd}|O t|S#t$r t ddYdSwxYwttdd}t|sdS t|S#t$r t ddYdSwxYw) z@Return whether an explicit host cancel overrides aux protection. cancel_eventNz'aux interrupt cancel event check failedTexc_infoF cancel_checkz!aux interrupt cancel check failed)rorprnis_setrKrXdebugcallable)eventchecks r_aux_interrupt_cancel_requestedr|s -~t D DE   '' '    LLBTL R R R55  -~t D DE E??uEEGG}}  84 HHHuus! ;&A%$A%B''&CCTrmc#Kttdd}ttdd}ttdd}|t_t|r |t_|*tt|ddr |t_ dV|t_|t_|t_dS#|t_|t_|t_wxYw)aMark the current thread's auxiliary LLM call as interrupt-protected. Used by atomic aux tasks (compression) so a mid-flight gateway interrupt doesn't abort the call and trigger a degraded fallback. Re-entrant-safe: restores the previous value on exit. ``cancel_check`` lets the host retain an explicit hard-cancel path; ``cancel_event`` is preferred when the host already owns an Event. Nested protection scopes inherit both values. rmFrvNrsrw)rorprmryrvrs)rmrvrsprevprev_cancel_checkprev_cancel_events raux_interrupt_protectionrs ,h > >D 9>4PP 9>4PP'-$ >1=!.HW\8T-R-R$S$S1=!.C +/!(1B!.1B!...,0!(1B!.1B!.BBBBs C&C)cttdd}t|dd}t|r|Sttdd}t|r|SdS)zHCapture the current explicit-cancel source on the owning request thread.rsNrwrv)rorpry)rzrwr{s r_capture_aux_cancel_checkr4sf -~t D DE UHd + +F -~t D DE 4rrvc t|S#t$r tddYdSwxYw)zGRead a request-thread cancellation source without leaking its failures.z captured aux cancel check failedTrtF)rnrKrXrxrvs r_captured_aux_cancel_requestedrBsTLLNN###  7$ GGGuus&AAcJeZdZdZdegefddfdZdefdZdefdZ dS)_AuxiliaryCancellationDecisionzHAtomically choose explicit cancellation or provider timeout per attempt.source_cancel_checkrNcR||_tj|_d|_dS)Nrm)_source_cancel_check threadingLock_lock_outcome)rrs rrgz'_AuxiliaryCancellationDecision.__init__Ns$$7!^%%   rc|j5|jdkr ddddS|jdkr ddddSt|jrd|_ ddddS ddddS#1swxYwYdS)N cancelledT timed_outFrrrrr(s rr"z'_AuxiliaryCancellationDecision.__call__Ss, Z  } ++        } ++          .d.GHH  +                           s! A2 A2A2$A22A69A6c|j5|jdkr#t|jrd|_nd|_|jdkcdddS#1swxYwYdS)z@Return whether timeout won and destructive cleanup is permitted.rmrrNrr(s rbegin_timeout_cleanupz4_AuxiliaryCancellationDecision.begin_timeout_cleanup^s Z 0 0}((1$2KLL0$/DMM$/DM=K/  0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0s9AAA) r*r+r,r-rrrgrnr"rrrrrrKs{RR!HRW,=!$!!!! $    0t000000rrcttdd}|dS |dS#t$r tddYdSwxYw)z?Tick the installed forward-progress hook, if any. Never raises.hookNzaux progress hook failedTrt)ro _aux_progressrKrXrx)rs r_notify_aux_progressrwsq =&$ / /D |@  @@@ /$ ??????@s (&AAc2ttddduS)Nr)rorrrr_aux_progress_activers =&$ / /t ;;rc#Kttdd}t|r|n|t_ dV|t_dS#|t_wxYw)zInstall *hook* as the current thread's aux forward-progress callback. ``hook=None`` is a no-op passthrough so callers can wire it unconditionally. Re-entrant-safe: restores the previous hook on exit. rN)rorryr)rr~s raux_progress_hookrs` =&$ / /D!)$9TM" ! T !!!!s A Acallbackc t}trt|s St|rt t t dd tj}tj id  fd }tj |j |fdd  trt ds4trt d }||d S) a;Run one protected provider callback in an attempt-isolated daemon. A hard cancel must release the compression-owning thread promptly, but auxiliary clients are process-shared and cannot safely be closed or evicted to wake one request. Only protected calls with a captured hard-cancel source use this seam. Their provider callback (including stream aggregation) runs in a daemon worker while the owner polls cancellation. On cancel the owner unwinds immediately; the worker is left to finish under the provider timeout already present in ``kwargs``. It owns no transcript or compressor commit state and never holds the session lock. Ordinary auxiliary calls, and protected calls without a cancellation source, retain the historical direct synchronous path with no extra thread. rNrcX t5t5d<dddn #1swxYwYdddn #1swxYwYn#t$r}|d<Yd}~nd}~wwxYwdS#wxYw)Nrresult exception)rr BaseExceptionset)excrrvdoner!outcome progress_hooks r_provider_workerz;_run_protected_sync_provider_call.._provider_workersN "=11 5 53K)444 5 5%-HV$4$4! 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5 ' ' '#&GK  ' HHJJJJJDHHJJJJsrA!A> AA AA A A!AA!AA! B! A:+A50B5A::BB)zhermes-protected-aux-providerT)targetr namedaemong{Gz?rrri)rrqryrrcror contextvars copy_contextrEventThreadrunstartrwaitrJ) rr!rprovider_contextrrrvrrrs `` @@@@r!_run_protected_sync_provider_callrs$455 # % % X6I-J-J x 22EFFL|~~.+---M6488M"/11 ?  D G           # ,   eggg % *, 7 7 2/11 1yy   ), 7 7 2/11 1KK ,,  O{{8$$$rr% maybe_typecF t||S#t$rYdSwxYw)zDReturn False instead of raising when a patched symbol is not a type.F)r$ TypeError)r%rs r_safe_isinstancers9#z*** uus   urlct|}|jrWt|d}dt |jD}||fS|dfS)zNExtract query params from URL, return (clean_url, default_query dict or None).rB)queryc&i|]\}}||dSrr.0kvs r z-_extract_url_query_params..s"EEEda!QqTEEErN)r rr_replaceritems)rparsedcleanparamss r_extract_url_query_paramsrso c]]F |6???4455EEhv|&<&<&B&B&D&DEEEf} 9rgooglegemini google-geminigoogle-ai-studiozx-aixaix.aigrokglmzaizz-aizz.aizhipukimi kimi-codingmoonshotzkimi-cnkimi-coding-cnz moonshot-cnz gmi-cloudgmigmicloudz minimax-china minimax-cn anthropiccopilot copilot-acptencent-tokenhub) minimax_cnclaudez claude-codegithubzgithub-copilotz github-modelz github-modelszgithub-copilot-acpzcopilot-acp-agenttencenttokenhubz tencent-cloud tencentmaasproviderc|pd}|dr4|ddd}|sdS|}|dkrdS|dkr?t pd }|r|d vr|}ndSt ||S) Nautocustom::customcodex openai-codexmainrB>rBrr)striplower startswithsplit_read_main_provider_PROVIDER_ALIASESrJ)r normalizedsuffix main_provs r_normalize_aux_providerrs$f++--3355JY''!!#q))!,2244 8 W~V)**0b7799??AA  *>>>"JJ8  Z 8 88rOMIT_TEMPERATUREmodelc|pdddd}|dp|dkS)zHTrue for any Kimi / Moonshot model that manages temperature server-side.rB/rzkimi-rrrrsplitrrbares r_is_kimi_modelr-sS KR   & & ( ( / /Q 7 7 ;D ??7 # # 5tv~5rc|pdddd}|dkS)zATrue for Arcee Trinity Large Thinking (direct or via OpenRouter).rBrrrztrinity-large-thinkingrrrrs r_is_arcee_trinity_thinkingr3sD KR   & & ( ( / /Q 7 7 ;D + ++rg333333?gffffff?c|pd}|dkrdS|pdddd}|dkp|dpt|d p_|d kpY|d pD|d p/|d kp)|dp|dS)uTrue for gpt-5.4 / gpt-5.5 / gpt-5.6 on the ChatGPT Codex OAuth backend. Matches only the Codex OAuth route (provider ``openai-codex``), not the direct OpenAI API, OpenRouter, or GitHub Copilot paths — those expose a larger context window for the same slug and must keep the user's default compaction threshold. ``-pro`` variants and dated snapshots are matched via prefix so the override tracks every 272K-capped family (5.4, 5.5, 5.6 sol/terra/luna incl. their ``-pro`` modes) without re-listing every variant. (Name kept for backward compatibility with the ``compression.codex_gpt55_autoraise`` config key.) rBrFrrrzgpt-5.4zgpt-5.4-zgpt-5.4.zgpt-5.5zgpt-5.5-zgpt-5.5.zgpt-5.6zgpt-5.6-zgpt-5.6.rrrprovrs r_is_codex_gpt54_or_gpt55r Qs N ! ! # # ) ) + +D ~u KR   & & ( ( / /Q 7 7 ;D  ' ??: & & ' ??: & & ' 9  ' ??: & &  ' ??: & &  ' 9   ' ??: & & ' ??: & & rc|pd}|dkrdS|pdddd}|dkS)u'True for ``gpt-5.3-codex-spark`` on the ChatGPT Codex OAuth backend. The model is Codex-OAuth-only (ChatGPT Pro entitlement) with a native 128K context window. Only the Codex OAuth route (provider ``openai-codex``) is matched — the slug is not available on other routes. rBrFrrrzgpt-5.3-codex-sparkrrs r_is_codex_sparkr nsw N ! ! # # ) ) + +D ~u KR   & & ( ( / /Q 7 7 ;D ( ((rzOptional[float] | objectct|r"td|tSt |rdSdS)uReturn a temperature directive for models with strict contracts. Returns: ``OMIT_TEMPERATURE`` — caller must remove the ``temperature`` key so the provider chooses its own default. Used for all Kimi / Moonshot models whose gateway selects temperature server-side. ``float`` — a specific value the caller must use (reserved for future models with fixed-temperature contracts). ``None`` — no override; caller should use its own default. z7Omitting temperature for Kimi model %r (server-managed)g?N)rrXrxrr)rr=s r_fixed_temperature_for_modelr }sJe  NPUVVV!%((s 4r)allow_codex_gpt55_autoraiserct|rdS|rt||rtSt||rtSdS)uReturn a context-compression threshold override for specific models. The threshold is the fraction of the model's context window that must be consumed before Hermes triggers summarization. Higher values delay compression and preserve more raw context. Per-model/route overrides: - Arcee Trinity Large Thinking → 0.75 (preserve reasoning context). - gpt-5.4 / gpt-5.5 / gpt-5.6 on the Codex OAuth route → 0.85, because Codex caps all three families at 272K and the default 50% trigger would compact at ~136K. Gated by ``allow_codex_gpt55_autoraise`` (historical config-key name kept for backward compatibility) so the user can opt back down to the global default (the caller passes the config flag through here). - gpt-5.3-codex-spark on the Codex OAuth route → 0.70, because the model has a native 128K window and the default 50% trigger would compact at ~64K — wasting half the usable context. Not gated by the gpt-5.5 opt-out flag: 128K is the model's native window, so the raise is unambiguously correct. Returns a float in (0, 1] to override the global ``compression.threshold`` config value, or ``None`` to leave the user's config value unchanged. g?N)rr '_CODEX_GPT54_GPT55_COMPACTION_THRESHOLDr !_CODEX_SPARK_COMPACTION_THRESHOLD)rrrs r _compression_threshold_for_modelrsV:"%((t"7'?x'P'P766uh''100 4r provider_idc ddlm}||}|r|jr|jSn#t$rYnwxYwt|dS)zReturn the cheap auxiliary model for a provider. Reads from ProviderProfile.default_aux_model first, falling back to the legacy hardcoded dict for providers that predate the profiles system. rget_provider_profilerB) providersrdefault_aux_modelrK%_API_KEY_PROVIDER_AUX_MODELS_FALLBACKrJ)rr_ps r_get_aux_model_for_providerrs{  222222 ! !+ . .  ("& (' '      0 4 4[" E EEs $ 11zgemini-3.6-flashz glm-4.5-flashzkimi-k2-turbo-previewzstep-3.5-flashz$google/gemini-3.1-flash-lite-previewclaude-haiku-4-5-20251001zgoogle/gemini-3-flashzgemini-3-flashzglm-5zgoogle/gemini-3.6-flashznemotron-3-nano:30bz hy3-preview) rrrstepfunrrrz ai-gatewayz opencode-zenz opencode-gokilocodez ollama-cloudrr_API_KEY_PROVIDER_AUX_MODELSz mimo-v2.5z glm-5v-turbo)xiaomir_PROVIDER_VISION_MODELSct|}|r|S ddlm}||}n#t$rYdSwxYw|dS |S#t$rYdSwxYw)uReturn the provider's preferred default vision model id, or None. Static entries in :data:`_PROVIDER_VISION_MODELS` win first (xiaomi / zai have dedicated vision-only model names that don't live in any discoverable catalog). Otherwise the provider's :class:`ProviderProfile` gets a chance to supply one via its ``default_vision_model()`` hook — that's where catalog-backed providers (DeepInfra) resolve a live default, keeping the discovery logic inside their plugin instead of a name-check branch here. rrN)r!rJrrrKdefault_vision_model)rstaticrprofiles r _resolve_provider_vision_defaultr&s% ( ( 2 2F  222222&&x00 ttt++--- tts 2 AAA A*)A*_PROVIDERS_WITHOUT_VISIONz%https://hermes-agent.nousresearch.comz Hermes Agentzproductivity,cli-agent) HTTP-RefererX-TitlezX-OpenRouter-Categories>1onyestrueheadersc  ddlm}m}|}||dd}||dd}t|trE|rCi}t|tr|||||}n#t $r|cYSwxYwt|tr|s|St |pi}|D]'\}} | t| |t|<(|p|S)uMerge user-configured ``model.default_headers`` onto resolved headers. User values take precedence over provider/SDK defaults, mirroring the main agent client (``AIAgent._apply_user_default_headers``). This lets a ``custom`` OpenAI-compatible endpoint behind a gateway/WAF that rejects the OpenAI SDK's identifying headers (``User-Agent: OpenAI/Python ...``, ``X-Stainless-*``) override them for auxiliary calls too — otherwise the main turn would succeed but title/compression/vision calls to the same endpoint would still fail. (#40033) Returns the merged dict, or the original ``headers`` (possibly ``None``) when nothing is configured. No allocation when there are no overrides. rcfg_get load_configrdefault_headers extra_headers) rHr1r2r$dictupdaterKrrI) r.r1r2_cfg user_headers alias_headers merged_usermergedkeyvalues r_apply_user_default_headersr>$sO::::::::{}}wtW.?@@  g?? mT * * '} ' "K,-- 1""<000   } - - -&L  lD ) ) '-R F"((**&& U = u::s3xx  WsBB BB or_configc6tt}|8 ddlm}|di}n#t $ri}YnwxYwt jdd }|r |tv}n|dd}|s|Sd |d <t jd d}|rF| r1t|}d |cxkrd krnntt||d<na|dd}t|ttfr/d |cxkrd kr"nntt||d<|S)uBuild OpenRouter headers, optionally including response-cache headers. Precedence for response cache: env var > config.yaml > default (enabled). Environment variables: ``HERMES_OPENROUTER_CACHE`` — truthy (``1``/``true``/``yes``/``on``) enables caching; ``0``/``false``/``no``/``off`` disables. Overrides ``openrouter.response_cache`` in config.yaml. ``HERMES_OPENROUTER_CACHE_TTL`` — integer seconds (1-86400). Overrides ``openrouter.response_cache_ttl`` in config.yaml. *or_config* is the ``openrouter`` section from config.yaml. When *None*, falls back to reading config from disk via ``load_config_readonly()``. NrrA openrouterHERMES_OPENROUTER_CACHErBresponse_cacheFr-zX-OpenRouter-CacheHERMES_OPENROUTER_CACHE_TTLriQzX-OpenRouter-Cache-TTLresponse_cache_ttli,)r5_OR_HEADERS_BASErHrArJrKosenvironrr_TRUTHY_ENV_VALUESisdigitintrIr$float)r?r.rA env_cache cache_enabledenv_ttlttls rbuild_or_headersrRMs#$$G  > > > > > >,,..22<DDII   III  8"==CCEEKKMMI?!%77 ! &6>> $*G !jnn:B??EEGGG> ??   =g,,CC    5     47HH01mm0#66 cC< ( ( >Q#->->->->->->->->->03CHH G, - Ns$= A  A zX-BILLING-INVOKE-ORIGIN HermesAgentcltt|pddrttSiS)zIReturn NVIDIA NIM cloud attribution headers for build.nvidia.com traffic.rBintegrate.api.nvidia.com)r4rIr5_NVIDIA_NIM_CLOUD_HEADERS)r=s rbuild_nvidia_nim_headersrWs5SR002LMM/-... Ir) __version__z HermesAgent/)r(r) User-Agent)nous_portal_tagsc"dtiS)zReturn a fresh Nous Portal ``extra_body`` dict. Computed at call time so a hot-reloaded ``hermes_cli.__version__`` is reflected without restarting long-running processes. tags)_nous_portal_tagsrrr_nous_extra_bodyr^s %'' ((rauxiliary_is_nousz)https://inference-api.nousresearch.com/v1zhttps://api.anthropic.comz auth.jsonz%https://chatgpt.com/backend-api/codex access_tokencddd}t|tr|s|S ddl}|d}t |dkr|S|dd t |d d zzz}t j||}| d i d }t|tr|r||d <n#t$rYnwxYw|S)uHeaders required to avoid Cloudflare 403s on chatgpt.com/backend-api/codex. The Cloudflare layer in front of the Codex endpoint whitelists a small set of first-party originators (``codex_cli_rs``, ``codex_vscode``, ``codex_sdk_ts``, anything starting with ``Codex``). Requests from non-residential IPs (VPS, server-hosted agents) that don't advertise an allowed originator are served a 403 with ``cf-mitigated: challenge`` regardless of auth correctness. We pin ``originator: codex_cli_rs`` to match the upstream codex-rs CLI, set ``User-Agent`` to a codex_cli_rs-shaped string (beats SDK fingerprinting), and extract ``ChatGPT-Account-ID`` (canonical casing, from codex-rs ``auth.rs``) out of the OAuth JWT's ``chatgpt_account_id`` claim. Malformed tokens are tolerated — we drop the account-ID header rather than raise, so a bad token still surfaces as an auth error (401) instead of a crash at client construction. z!codex_cli_rs/0.0.0 (Hermes Agent) codex_cli_rs)rY originatorrN.r=zhttps://api.openai.com/authchatgpt_account_idzChatGPT-Account-ID) r$rIrbase64rlenjsonloadsurlsafe_b64decoderJrK)r`r.riparts payload_b64claimsacct_ids r_codex_cloudflare_headersrrs%&:$G lC ( ( 0B0B0D0D   ""3'' u::>>NAhU1X(:!;; F44[AABB**:B??CCDXYY gs # # 4 4,3G( )      Ns-C2 BC22 C?>C?ct|pdd}|drzd|vsd|vr9|dt d dz}t d|||S|dt d d z}t d |||Sd |vr8|d r#|d z}t d |||S|S)uNormalize an Anthropic-style base URL to OpenAI-compatible format. Some providers (MiniMax, MiniMax-CN) expose an ``/anthropic`` endpoint for the Anthropic Messages API and a separate ``/v1`` endpoint for OpenAI chat completions. The auxiliary client uses the OpenAI SDK, so it must hit the ``/v1`` surface. Passing the raw ``inference_base_url`` causes requests to land on ``/anthropic/chat/completions`` — a 404. rBr /anthropiczopen.bigmodel.cnbigmodelNz/paas/v4u0Auxiliary client: rewrote ZAI base URL %s → %sz/v1u,Auxiliary client: rewrote base URL %s → %s api.kimi.com/codingu1Auxiliary client: rewrote Kimi base URL %s → %s)rIrrstripendswithrjrXrx)r=r rewrittens r_to_openai_base_urlr{s hn"   # # % % , ,S 1 1C ||L!!   $ $ c(9(90s<00001J>I LLKSR[ \ \ \ ,3|,,,,-5  CS)TTTi!8!8%K  H#yYYY JrcR t|}n4#t$r'}td||Yd}~dSd}~wwxYw|r|sdS d|fS#t$r'}td||Yd}~dSd}~wwxYw)z2Return (pool_exists_for_provider, selected_entry).z0Auxiliary client: could not load pool for %s: %sNFNTz8Auxiliary client: could not select pool entry for %s: %s)TN)r/rKrXrxhas_credentialsselect)rpoolrs r_select_pool_entryr s""  GSVWWW{{{{{ t++--{T[[]]""  OQY[^___zzzzzs* A>AA55 B&?B!!B&c t|}n4#t$r'}td||Yd}~dSd}~wwxYw|r|sdS t |dd}t |r|}||St |dd}t |r |Sn3#t$r&}td||Yd}~nd}~wwxYwdS)zEBest-effort current/next pool entry without mutating selection order.z7Auxiliary client: could not load pool for %s (peek): %sNcurrentpeekz6Auxiliary client: could not peek pool entry for %s: %s)r/rKrXrxr~rory)rrr current_fnrpeek_fns r_peek_pool_entryrs;""  NPXZ]^^^ttttt t++--t ^T9d33 J    jllG"$-- G   799   ^^^ MxY\]]]]]]]]^ 4s0 A>A-B8 )B88 C(C##C(entryc|dSt|ddpt|dd}t|pdS)NrBruntime_api_keyr`)rorIr)rr<s r_pool_runtime_api_keyr4sN }r %*D 1 1 WWUNTV5W5WC syb>>   ! !!rrBfallbackc|6t|pddSt|dddkrddlm}|}|r|St|ddp#t|ddpt|d dp|}t|pddS) NrBrrnousr)_nous_inference_env_overrideruntime_base_urlinference_base_urlr=)rIrrxrohermes_cli.authr)rrrenv_urlrs r_pool_runtime_base_urlr=s }8>r""((**11#666uj$''611 A@@@@@..00  N )400  5. 5 5  5*d + +    syb>>   ! ! ( ( - --rapi.anthropic.comc|sdS ddlm}||jpdd}|t vS#t$rYdSwxYw)zRReturn True if ``url``'s hostname is an Anthropic endpoint we trust for aux calls.Frr rBrd) urllib.parser hostnamerrrx_ANTHROPIC_COMPATIBLE_HOSTSrK)rr hosts r_is_anthropic_compatible_hostr]s u)))))) &,"3355;;==DDSII222 uusAA A,+A,c  tdttjddS#tt f$rYdSwxYw)N<HERMES_NOUS_MIN_KEY_TTL_SECONDS1800i)maxrLrHgetenvr ValueErrorrrr_nous_min_key_ttl_secondsrisS2s29%FOOPPQQQ z "tts/2AArc|sdS ddlm}m} ||pdS#|$rYnwxYwn#t$rYnwxYwt j|pdS)uRead a provider API key env var through the profile secret scope. Auxiliary-client resolution runs both inside agent turns (secret scope installed — its verdict is authoritative under multiplex, so a scoped miss must NOT borrow another profile's process-env key) and on unscoped startup/CLI probe paths, which keep the legacy ``os.environ`` read via the ``UnscopedSecretError`` fallback (Slack pattern, #59739). rBr)UnscopedSecretError get_secret)agent.secret_scoperrrrKrHr)rrrs r_scoped_key_envrps r FFFFFFFF Jt$$*1133 3"    D        IdOO !r ( ( * **s#:.6:6: AAc.eZdZdZdedefdZdefdZdS)_CodexCompletionsAdapterzyDrop-in shim that accepts chat.completions.create() kwargs and routes them through the Codex Responses streaming API. real_clientrc"||_||_dSr)_client_model)rrrs rrgz!_CodexCompletionsAdapter.__init__s"  rrc F6789:;<=>|dg}|dj}ddlm}ddlm}d}g}|D]q}|dd} |d pd } | d kr't | tr| nt| }\||rttj d d pd } || d } ||| } ||| pdd dgdd}|d}|||d<|dpi}t |tro|d}t |trE|ddurn-|dpd}|dkrd}|dd|d<dg|d<|d}|r ddl }ddl m}m}|t#|}||\}}||\}}n2#t$$r%}t&d |Yd}~nd}~wwxYwg}|D]}t |tr|d!ini}|d"}|sG|d!||d#d |d$id%|r||d< dd&lm}m}ddlm}ttj d d pd }||d'p ||d(} ||d p ||d)}!| s,|!s*d*|vr&|||d}"|"r|"|d*<d+|vr|||}#|#r|#|d+<n,#t$$rt&d,d-.YnwxYwg}$g}%d}&t |t2t4fr|dkr|nd>>r#t7jt5>znd;t;j=d}'t?rtAndfd0 8dV9:<=fd1 7dV78;=fd2 6 >r=t;j"t5>7}'d-|'_#|'$6dd3l%m&}(t|})d-|)d4<d5tNd/df6fd6 }*j j(j)dWi|)}+:59|+dddn #1swxYwY=*rvtW<rgtY<rXt|+d7d},tW|,r8 |,n,#t$$rt&d8d-.YnwxYw t[|+d9r|+}-n0|(|+t|dp||*:}-t|+d7d},tW|,r |,n#t$$rYnwxYw:59.dddn #1swxYwYno#t|+d7d},tW|,r |,n#t$$rYnwxYw:59.dddw#1swxYwYwxYw|-t_d;dXdtNd/tNfd?}.t|-d9dpgD]}/|.|/d@}0|0dAkrB|.|/d pgD]2}1|.|1d@}2|2dBvr |$|.|1dCd 3V|0dDkrU|%ta|.|/dEd d!ta|.|/d"d |.|/dFdGHIt|-dJd}3|3rtat|3dKdp,t |3tr|3dKdndt|3dLdp,t |3tr|3dLdndt|3dMdp,t |3tr|3dMdndN}&nZ#t$$rM}=*rtc8|t&dO|d}~wwxYw|'|'2n#|'|'2wwxYwd 3|$4pd} tadP| |%pdQ}4tad|4|%sdRndST}5ta|5g||&US)YNmessagesrr)!_chat_messages_to_responses_input)r4zYou are a helpful assistant.roleusercontentrBsystemr=githubcopilot.com)is_github_responses)rrF)r instructionsinputstoretimeout extra_body reasoningenabledeffortmediumminimallowr)rsummaryzreasoning.encrypted_contentincludetools)strip_pattern_and_formatstrip_slash_enumzRAuxiliary client: failed to sanitize tool schemas for Codex/xAI Responses path: %sfunctionr description parameters)typerrr)_content_cache_key+_default_prompt_cache_retention_for_requestrapi.x.aizmodels.github.aiprompt_cache_keyprompt_cache_retentionz4Codex auxiliary: prompt_cache_key derivation skippedTrtrc,dtddS)Nz*Codex auxiliary Responses stream exceeded z.1fzs total timeout)rM) total_timeoutsr_timeout_messagez9_CodexCompletionsAdapter.create.._timeout_messageUsim@T@Tiiii irc tdd}t|rt|}ntot } |s5rdnd}dddn #1swxYwYt|dd}t|r8 |n,#t $rt ddYnwxYwdStjdd}t|r8 |n,#t $rt ddYnwxYw tjdS#t $r t ddYdSwxYw) NrrclosezECodex auxiliary: cancelled attempt stream close during timeout failedTrtz3Codex auxiliary: client close during timeout failedz1Codex auxiliary: cache eviction on timeout failed) roryrnrrrKrXrxr_evict_cached_client_instance) r timeout_wonstream close_streamrattempt_streamattempt_stream_lockprotected_cancel_checkrrs r_close_client_on_timeoutzA_CodexCompletionsAdapter.create.._close_client_on_timeoutXsW$+&(?%% !-.. "#8#8#:#:;; 344O67MNN MMOOO  )KK2@J^A..dFKKKKKKKKKKKKKKK&vw== L))$ $ 4%)% DL'488E ggEGGGG gggLL!VaeLfffffg a-dl;;;;; a a a P[_ `````` asH1 B  BB6 C&C*)C* D &E E  E##&F  F cLtjkr5s t ddlm}t rt|rtstddSdS#ttf$rt$rYdSwxYw)Nr)is_interruptedz,Codex auxiliary Responses stream interrupted) time monotonicrw TimeoutErrortools.interruptrr|rcrqInterruptedErrorrK)rrrdeadliners r_check_cancelledz9_CodexCompletionsAdapter.create.._check_cancelleds#(8(8H(D(D ''))/,,..."#3#3#5#5666 :::::: 344:7999!>##[,D,F,F[*+YZZZ[[[[$&CD       sA BB=<B=)_consume_codex_event_streamr_eventc8tdSrr)rrs r_on_each_eventz7_CodexCompletionsAdapter.create.._on_each_events& %&&&  """""rrz;Codex auxiliary: late cancelled attempt stream close failedoutput)ron_eventz@Codex auxiliary Responses stream did not return a final responser%r<defaultct||d}|+t|tr|||}||n|Srror$r5rJ)r%r<rvals r _item_getz2_CodexCompletionsAdapter.create.._item_getsGc3--;:c4#8#8;''#w//C!oss7:rrmessage>text output_textr function_callcall_id argumentsz{}rridrrusage input_tokens output_tokens total_tokens prompt_tokenscompletion_tokensrz-Codex auxiliary Responses API call failed: %s assistant)rr tool_callsstoprindexr finish_reasonchoicesrrrirr)5rJragent.codex_responses_adapterrutilsr4r$rIappendrorr5copytools.schema_sanitizerrrdeepcopylistrKrXrYagent.transports.codexrrrxrLrMrrrrrqrrTimerrragent.codex_runtimerr responsescreaterwryrhasattrclear RuntimeErrorrrcanceljoinr)?rr!rrrr4rreplay_messagesmsgrr_host_for_input_is_github_for_input input_items resp_kwargsrr reasoning_cfgrr_copyrr_r convertedtfnrrr _host_src_is_xai _is_github _cache_key_cache_retention text_partstool_calls_rawr timeout_timerr stream_kwargsr event_streamclose_fnfinalritem item_typepartptype resp_usagerchoicerrrrrrrrrs?` @@@@@@@@@rrz_CodexCompletionsAdapter.creates ::j"-- 7DK00 TSSSSS//////5 02 , ,C7766**Dggi((.BGx*4Wc*B*BTwwG &&s++++gdlJCCIrJJ44_FYZZ77 1E   ( Ef%D%D$E ' ' **Y''  %,K "ZZ --3 j$ ' ' M&NN;77M-.. M $$Y//588 +..x88DHF**!&"(#)00K ,/L-LK * 7## % 1 $$$$tE{{3333E::q++E22qq   347  I  .8D.A.AIQUU:r***rvvf~~  & #%66-#<#<"$&&r":": ""  1'0 G$          4 3 3 3 3 3GDL*bAAGRHHI++Iv>>nBWBWXacmBnBnG%%i1DEEH((4FGG  A: A2DK2W2W// koog>V>VWW A6@K 23'{::#N#N$$ $MKU4>##eM&:&:::QUO%% 37 ,D+E+E O % ' ' '4 (n..$& j# j j j j j j0 a0 a0 a0 a0 a0 a0 a0 a0 a0 ad         .y ' & )m0D0DF^ _ _ '+ $##%%%      H G G G G G --M&*M( # #s #t # # # # # #94<18II=IIL$ 4 4%%l333 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4   "" 344 33IJJ  #<$??H%%  $ Y%)%  + <22(EE77$!+//'":":"CeDD!/E #<$??H%%  $(++"((***+++++++++++++++ #<$??H%%  $(++"((***++++++++++++++++}"#efff  ; ;s ; ;s ;c ; ; ; ; !$77=2  %IdF33  ))!*4!;!;!ArKK ) $ 7 7 $;;;&--iifb.I.IJJJK/11"))/$9T9b99'!0!*4!1===cd&-j/1&M&M'gBLZY]B^B^eJNN?A>>>de!(^Q!G!G"fAKJX\A]A]dJNN>1===cd    !! @"#3#3#5#566C? LLH# N N N    ($$&&&($$&&&&)''*%%++--5"%-    !(6H&&L    H    sKA H&& I0II.B(N&O?O?B b0 T, b0,T00b03T04Ab0 Vb0&V>;b0=V>>b0AY0 b0& X10b01 X>;b0=X>>b0Y$ b0$Y((b0+Y(,b00![ Z[ Z*'[)Z**[/[ [[ [[ [Gb0/d!0 d:Addd!!d:N) r*r+r,r-rrIrgrrrrrrrsb>>F3X #X X X X X X rrceZdZdZdefdZdS)_CodexChatShimz>Wraps the adapter to provide client.chat.completions.create().adapterc||_dSr completionsrr=s rrgz_CodexChatShim.__init__3"rN)r*r+r,r-rrgrrrr<r<0s6HH# 8######rr<c(eZdZdZdedefdZdZdS)CodexAuxiliaryClientzOpenAI-client-compatible wrapper that routes through Codex Responses API. Consumers can call client.chat.completions.create(**kwargs) as normal. Also exposes .api_key and .base_url for introspection by async wrappers. rrc||_t||}t||_|j|_|j|_dSr) _real_clientrr<chatr\r=)rrrr=s rrgzCodexAuxiliaryClient.__init__>s@'*;>>"7++ "* #, rc8|jdSr)rFrr(s rrzCodexAuxiliaryClient.closeEs !!!!!rN)r*r+r,r-rrIrgrrrrrDrD7sO -F-3----"""""rrDc*eZdZdZdefdZdefdZdS)_AsyncCodexCompletionsAdapterzAsync version of the Codex Responses adapter. Wraps the sync adapter via asyncio.to_thread() so async consumers (web_tools, session_search) can await it as normal. sync_adapterc||_dSr_syncrrKs rrgz&_AsyncCodexCompletionsAdapter.__init__P ! rrcJKddl}|j|jjfi|d{VSNrasyncio to_threadrNrrr!rTs rrz$_AsyncCodexCompletionsAdapter.createSA&W&tz'8CCFCCCCCCCCCrN)r*r+r,r-rrgrrrrrrJrJIs\ "%=""""DDDDDDDrrJceZdZdefdZdS)_AsyncCodexChatShimr=c||_dSrr?rAs rrgz_AsyncCodexChatShim.__init__YrBrN)r*r+r,rJrgrrrrYrYXs0# =######rrYceZdZdZddZdS)AsyncCodexAuxiliaryClientzHAsync-compatible wrapper matching AsyncOpenAI.chat.completions.create(). sync_wrapperrDc|jj}t|}t||_|j|_|j|_|j|_dSr)rGr@rJrYr\r=rFrr]rK async_adapters rrgz"AsyncCodexAuxiliaryClient.__init__`sP#(4 5lCC ' 66 #+ $- )5rN)r]rD)r*r+r,r-rgrrrr\r\]s.RR 6 6 6 6 6 6rr\c BeZdZdZ d dededededzfdZd efd ZdS) _AnthropicCompletionsAdapterzrnonerequiredrr)rrrrqreasoning_configrnrcr=_forbids_sampling_paramscji|]0\}}|dk t|d-||1S)rr%)rIrrs rrz7_AnthropicCompletionsAdapter.create..sLA ##CFF,=,=c,B,B#1###rctSrr)rs rz5_AnthropicCompletionsAdapter.create..s 4 6 6r)on_stream_eventanthropic_messages)strip_tool_prefix)rrrrrrrrrr )rhrkrlagent.transportsrmrJrpopr$rIr5rrfrgrxrrrnormalize_responserrrrr rrro)!rr!rkrlrmrrrrnrv_skip_mtrqrsnormalized_tool_choice choice_type_reasoning_cfg_eb_rcanthropic_kwargsrxcaller_extra_body passthroughexistingresponse _transport_nrassistant_messager rrrrr:s! rrz#_AnthropicCompletionsAdapter.creates[\\\\\\\\222222::j"-- 7DK00 7##jj// !::&9::::4e<<  YJJL11XVZZ@W5X5XJjj// !% k3 ' ' 5%0 " "  T * * 5koofb99::@@BBKj(()4R)H)H)L)LV)T)T&& <<<)4&*  !**\**C#t$$ )ggk**c4(()%(N11!+.^ ^    "  " H H H H H H++E22 >2= /#JJ|44  M,=t!D!D M!2!8!8!:!:K M+// ==C!(D11"!H1LH1L 1L .++ L ())4666/3    #]#788 ++ ,   ,K~m    )  8W % % (. #HNNAFFK!M ' K K Pq "8>>1EEl-ZkJkL#+"3)E !%'    H    rr}) r*r+r,r-rrIrnrgrrrrrbrbpsFF #   * 6G #G G G G G G rrbceZdZdefdZdS)_AnthropicChatShimr=c||_dSrr?rAs rrgz_AnthropicChatShim.__init__rBrN)r*r+r,rbrgrrrrrs0# <######rrc 6eZdZdZd dededededef dZd Zd S) AnthropicAuxiliaryClientz@OpenAI-client-compatible wrapper over a native Anthropic client.Frrr\r=rcc~||_t||||}t||_||_||_dS)N)rcr=)rFrbrrGr\r=)rrrr\r=rcr=s rrgz!AnthropicAuxiliaryClient.__init__ sJ'. H   'w//    rcht|jdd}t|r |dSdS)Nr)rorFry)rr3s rrzAnthropicAuxiliaryClient.close)s?4,gt<< H    HJJJJJ  rNF) r*r+r,r-rrIrnrgrrrrrrsfJJ!!C!!c!S!\`!!!!rrc&eZdZdefdZdefdZdS)!_AsyncAnthropicCompletionsAdapterrKc||_dSrrMrOs rrgz*_AsyncAnthropicCompletionsAdapter.__init__0rPrrcJKddl}|j|jjfi|d{VSrRrSrVs rrz(_AsyncAnthropicCompletionsAdapter.create3rWrN)r*r+r,rbrgrrrrrrr/sR"%A""""DDDDDDDrrceZdZdefdZdS)_AsyncAnthropicChatShimr=c||_dSrr?rAs rrgz _AsyncAnthropicChatShim.__init__9rBrN)r*r+r,rrgrrrrr8s0# A######rrceZdZddZdS)AsyncAnthropicAuxiliaryClientr]rc|jj}t|}t||_|j|_|j|_|j|_dSr)rGr@rrr\r=rFr_s rrgz&AsyncAnthropicAuxiliaryClient.__init__>sP#(4 9,GG +M:: #+ $- )5rN)r]rr*r+r,rgrrrrr=s(666666rrc.eZdZdZdedefdZdefdZdS)_BedrockCompletionsAdapterzGTranslates ``chat.completions.create(**kwargs)`` into Bedrock Converse.regionrc"||_||_dSr)_regionr)rrrs rrgz#_BedrockCompletionsAdapter.__init__Ls  rrc ddlm}|dg}|d|j}|dp|d}|d}t |t r|g}|d.t d |d|d rt d |||j|||d |rt|nd |d|d|S)Nr) call_converserrrqrrrrnuVBedrockAuxiliaryClient: tool_choice=%r not supported by the Converse shim — ignored.ruBedrockAuxiliaryClient: stream=True requested for %s — returning a complete response (Converse shim does not stream); caller downgrades to non-streaming.rirstop_p)rrrrrqrsrstop_sequences) agent.bedrock_adapterrrJrr$rIrXrxrrL)rr!rrrrqrs rrz!_BedrockCompletionsAdapter.createPsg777777::j"-- 7DK00ZZ --Ts:$ =11**W%%    rN)r*r+r,r-rIrgrrrrrrrIsWQQs3% #% % % % % % rrceZdZddZdS)_BedrockChatShimr=rc||_dSrr?rAs rrgz_BedrockChatShim.__init__yrBrN)r=rrrrrrrxs(######rrc(eZdZdZdedefdZdZdS)BedrockAuxiliaryClientz?OpenAI-client-compatible wrapper over AWS Bedrock Converse API.rrc||_||_t||}t||_d|_d|d|_dS)Naws-sdkhttps://bedrock-runtime..amazonaws.com)rrrrrGr\r=)rrrr=s rrgzBedrockAuxiliaryClient.__init__sK  ,VU;;$W--   I6III rcdSrrr(s rrzBedrockAuxiliaryClient.closes rN)r*r+r,r-rIrgrrrrrr}sQIIJsJ3JJJJ     rrc&eZdZdefdZdefdZdS)_AsyncBedrockCompletionsAdapterrKc||_dSrrMrOs rrgz(_AsyncBedrockCompletionsAdapter.__init__rPrrcJKddl}|j|jjfi|d{VSrRrSrVs rrz&_AsyncBedrockCompletionsAdapter.createrWrN)r*r+r,rrgrrrrrrrsR"%?""""DDDDDDDrrceZdZdefdZdS)_AsyncBedrockChatShimr=c||_dSrr?rAs rrgz_AsyncBedrockChatShim.__init__rBrN)r*r+r,rrgrrrrrs0# ?######rrceZdZddZdS)AsyncBedrockAuxiliaryClientr]rc|jj}t|}t||_|j|_|j|_dSr)rGr@rrr\r=r_s rrgz$AsyncBedrockAuxiliaryClient.__init__sA#(4 7 EE )-88 #+ $- rN)r]rrrrrrrs(......rrcp|pdd}|sdSt|jd}|ds|drdSt |}|dkrdS|dkrd |vrdSdS) uTrue if the endpoint at ``base_url`` speaks the Anthropic Messages protocol instead of OpenAI chat.completions. Mirrors ``hermes_cli.runtime_provider._detect_api_mode_for_url`` so the auxiliary client and the main agent stay in sync on transport selection. Covers: - Any URL ending in ``/anthropic`` (MiniMax, Zhipu GLM, LiteLLM proxies, Anthropic-compatible gateways). - ``api.kimi.com/coding`` (Kimi Coding Plan — the /coding route only speaks Claude-Code's native Anthropic shape; ``chat.completions`` returns 404 on Anthropic-only model aliases like ``kimi-for-coding``). - ``api.anthropic.com`` (native Anthropic). rBrFrtz /anthropic/v1Trrvrw)rrrxr pathryr5)r=rrrs r#_endpoint_speaks_anthropic_messagesrs.b''))//1188==J u J   $ + +C 0 0D }}\""dmmO&D&Dt ,,H&&&t>!!i:&=&=t 5r client_objapi_modect|tr|St|tr|St|tr|S ddlm}t||r|Sn#t $rYnwxYw ddlm}t||r|Sn#t $rYnwxYw|r|dkr|S|dkpt|}|s|S ddl m }n-#t $r t d||cYSwxYw |||} n5#t$r(} t d|| |cYd} ~ Sd} ~ wwxYwtd ||r |dd nd |pd t| |||d S)aRewrap a plain OpenAI client in ``AnthropicAuxiliaryClient`` when the endpoint actually speaks Anthropic Messages. This is the single chokepoint for aux-client transport correction. Runs at the end of every ``resolve_provider_client`` branch so that api_key providers (Kimi Coding Plan), the ``custom`` endpoint, and future /anthropic gateways all land on the right wire format regardless of which branch built the client. Returns ``client_obj`` unchanged when: - It's already an Anthropic/Codex/Gemini/CopilotACP wrapper. - The endpoint is an OpenAI-wire endpoint. - ``api_mode`` is explicitly set to a non-Anthropic transport. - The ``anthropic`` SDK is not installed (falls back to OpenAI wire). r)GeminiNativeClientCopilotACPClientr}build_anthropic_clientuEndpoint %s speaks Anthropic Messages but the anthropic SDK is not installed — falling back to OpenAI-wire (will likely 404).uTFailed to build Anthropic client for %s (%s) — falling back to OpenAI-wire client.NzeAuxiliary transport: wrapping client in AnthropicAuxiliaryClient (model=%s, base_url=%s, api_mode=%s)rrB auto-detectedFrc)rrrrDagent.gemini_native_adapterrrUagent.copilot_acp_clientrrrhrrXrYrKrx) rrr\r=rrr should_wraprrrs r_maybe_wrap_anthropicrss0 $<== $:;; $899 BBBBBB J(: ; ;          ====== J(8 9 9         H 444 (( 9 .x 8 8 BBBBBBB  O     ,,Wh??  "#+S     LL / 0x}}b(2Mo $UGX   sTA A-,A-1B BB>C'C/.C/3 D D2 D-'D2-D2c  td\}}|r|dSt|ddt|ddt|ddt|tt|ddt|ddt|d dt|d d d d S tsdSt jtd}| ddkrdS| di di}| ds| dsdS|S#t$r&}t d|Yd}~dSd}~wwxYw)zRead and validate ~/.hermes/auth.json for an active Nous provider. Returns the provider state dict if Nous is active with tokens, otherwise None. rNr`rB refresh_token agent_keyportal_base_url client_idscope token_typeBearerr) r`rrrrrrrsourceutf-8)encodingactive_providerrzCould not read Nous auth: %s) rror_NOUS_DEFAULT_BASE_URL_AUTH_JSON_PATHis_filerkrl read_textrJrKrXrx) pool_presentrdatarrs r_read_nous_authrs -V44L%  =4#E>2>>$UOTBB  T::"8@V"W"W&u.?FF  T::UGT22!%x@@    &&(( 4z/33W3EEFF 88% & && 0 0488K,,00<<||K(( n1M1M 4  3S999ttttts,"E=AEAEE F 'FF cddlm}dD]|\}}||}t|tr|sD|||d||r|cS}dS)z;Extract a usable Nous inference JWT from stored auth state.r)_nous_invoke_jwt_is_usable))ragent_key_expires_at)r` expires_atr)rrrB)rrrJr$rIr)rr token_key expiry_keytokens r _nous_api_keyr:s::::::"   : Y''%%% U[[]]   % % ,,w''||J//     LLL   2rc6tjdtS)z8Resolve the Nous inference base URL from env or default.NOUS_INFERENCE_BASE_URL)rHrrrrr_nous_base_urlrNs 9.0F G GGr force_refreshrc  ddlm}td}n3#t$r&}td|Yd}~dSd}~wwxYw|r|sdS |}n3#t$r&}td|Yd}~dSd}~wwxYw|dSt|ddt|ddt|d dd }|s||tsP | }n4#t$r'}td |d}Yd}~nd}~wwxYw|dS|}t|ddt|ddt|d dt|d dt|d dd}t|}t|t} |r| sdS|| fS)z@Resolve Nous auxiliary credentials from the selected pool entry.r)_agent_key_is_usablerz4Auxiliary Nous pool credential resolution failed: %sNz(Auxiliary Nous pool selection failed: %srrr)rrrz&Auxiliary Nous pool refresh failed: %sr`r)rrr`rr)rrr/rKrXrxr~rrortry_refresh_currentrrr) rrrrrstate refreshedrr\r=s r_resolve_nous_pool_runtime_apirSsS888888    KSQQQttttt t++--t   ?EEEttttt }tUK66 '/Et L L..  E 008Q8S8STT 0022II    LLA3 G G GIIIIII   4UK66 '/Et L L~t<<e\488.. HH%%G%e-CDDH (t H sD AAA$A99 B)B$$B)>D ED??Ect|}||S ddlm}|tdd|}n3#t$r&}t d|Yd}~dSd}~wwxYwt|d pd  }t|d pd  d }|r|sdS||fS) a9Return fresh Nous runtime credentials when available. This mirrors the main agent's 401 recovery path and keeps auxiliary clients aligned with the singleton auth store + JWT refresh flow instead of relying only on whatever raw tokens happen to be sitting in auth.json or the credential pool. rNr resolve_nous_runtime_credentialsHERMES_NOUS_TIMEOUT_SECONDStimeout_secondsrz7Auxiliary Nous runtime credential resolution failed: %sr\rBr=r) rrrr6rKrXrxrIrJrrx)rpooledrcredsrr\r=s r_resolve_nous_runtime_apirs',- H H HF   DDDDDD00%&CRHH'     NPSTTTttttt%))I&&,"--3355G599Z((.B//5577>>sCCH (t H s!8 A(A##A(c : ddlm}m}td}|r|rk|}|Tt t|ddpt|ddpd}|tj dd d ptj d d d pt t|d dpd d pDt t|d dpd d | }|r|r||fSn2#t$r%}td|Yd}~nd}~wwxYw ddlm}|}n3#t$r&}td|Yd}~dSd}~wwxYwt |dpd}t |d pd d }|r|sdS||fS)aWResolve a fresh xAI OAuth (api_key, base_url) for auxiliary clients. Prefer the credential pool, matching the main runtime/provider status path. Some xAI OAuth logins live only as pool entries; falling straight to the singleton auth-store resolver would make auxiliary tasks such as compression report "no provider configured" even though ``hermes auth status`` shows xAI OAuth as logged in. Falls back to ``hermes_cli.auth``'s singleton runtime resolver for older auth-store-only logins. Returns ``None`` if the user is not authenticated with xAI Grok OAuth. r)DEFAULT_XAI_OAUTH_BASE_URL _xai_validate_inference_base_url xai-oauthNrr`rBHERMES_XAI_BASE_URLr XAI_BASE_URLrr=)rz9Auxiliary xAI OAuth pool credential resolution failed: %s%resolve_xai_oauth_runtime_credentialsz>@@GGLLWy44::<<CCCHHW75*>sCCH (t H s0FF G 'GG G!! H+H  Hc&td\}}|rt|}|r|S ddlm}|}|di}|d}t |t r|sdS ddl}| dd}|d t| d zzz }tj | |} | d d} | r4tj| krtd | dSn#t"$rYnwxYw|S#t"$r&} td | Yd} ~ dSd} ~ wwxYw)aRead a valid, non-expired Codex OAuth access token from Hermes auth store. If a credential pool exists but currently has no selectable runtime entry (for example all pool slots are marked exhausted), fall back to the profile's auth.json token instead of hard-failing. This keeps explicit fallback-to-Codex working when the pool state is stale but the stored OAuth token is still valid. rr)_read_codex_tokenstokensr`Nrdrrfrgexpz-Codex access token expired (exp=%s), skippingz2Could not read Codex auth for auxiliary client: %s)rrrr rJr$rIrrirrjrkrlrmrrXrxrK) rrrr rr r`ripayloadrprrs r_read_codex_access_tokenrs-^<<L%%e,,  L666666!!##(B''zz.11 ,,, L4F4F4H4H 4  MMM"((--a0G ss7||ma/0 0GZ 8 8 A ABBF**UA&&C ty{{S(( LcRRRt    D !!###  I3OOOttttts=A$E B)D<;E < E E E  E F*F  Fc ddlm}m}n+#t$rtdYdSwxYw|D]\}}|jdkrt|rtd|=|dkr4 ddlm }|dsVn#t$rYnwxYwtcSt|\}}|rt|}|st||jp|j}t|} t!|pd } | td |j| |d kr$dd lm} m} | | r| || | fcSi} t+| drddi| d<nt+| drddlm}|| d<nft+| drt1| | d<nC ddlm}||}|r|jrt9|j| d<n#t:$rYnwxYwt=| d}|r|| d<tAd|| d | }tC|| ||}|| fcS||}tE|dd#}|s`tE|dd#$dp|j}t|} t!|pd } | td|j| |d kr$dd lm} m} | | r| || | fcSi} t+| drddi| d<nt+| drddlm}|| d<nft+| drt1| | d<nC ddlm}||}|r|jrt9|j| d<n#t:$rYnwxYwt=| d}|r|| d<tAd|| d | }tC|| ||}|| fcSdS)zTry each API-key provider in PROVIDER_REGISTRY order. Returns (client, model) for the first provider with usable runtime credentials, or (None, None) if none are configured. r)PROVIDER_REGISTRY$resolve_api_key_provider_credentialsz7Could not import PROVIDER_REGISTRY for API-key fallbackNNr\z2Auxiliary api-key chain: %s is unhealthy, skippingr)!is_provider_explicitly_configuredNz'Auxiliary text client: %s (%s) via poolrris_native_gemini_base_urlr_rvrYclaude-code/0.1.0r3r)copilot_default_headersrUrrBr=rzAuxiliary text client: %s (%s)r)%rrrrUrXrxr auth_type_is_provider_unhealthyr_try_anthropicrrrrr{rrrrrr4hermes_cli.modelsrrWrrr3r5rKr>rJrarrIrrx)rrrpconfigrrrr\ raw_base_urlr=rrrextrar_gpf_aux_ph_aux _merged_auxrr _gpf_aux2_ph_aux2 _merged_aux2s r_resolve_api_key_providerr' s [[[[[[[[[  NOOOzz!2 7 7 9 9aa W   ) )  !+ . .  LLM{ [ [ [  + % % MMMMMM88EE    !## # # #0== e & "+E22G 1%9STTrX_XrL*<88H/ <<DE} LLBGLRW X X Xh&&eeeeeeee,,X66Y--gQQQSXXXXXE$X~>> ,8:M+N'((&x1DEE EEEEEE+B+B+D+D'((&x1KLL +CH+M+M'((JJJJJJ&h{33GQ7#:Q378O3P3P/0 D5eii@Q6R6RSSK 7+6'(+XGhXXRWXXG+GUG\RRGE> ! ! !44[AAeii 2..//5577  599Z4455;;==DDSIIgWMg &|44+K88@D =  5w|UKKK ( " " a a a a a a a a((22 U))'HMMMuTTTT > : : (46I'JE# $ $ "8-@ A A  A A A A A A'>'>'@'@E# $ $ "8-G H H '?'I'IE# $ $ GGGGGG$9[11N 8N/3H4L/M/ME+,    2599=N3O3OPP  4'3E# $'T(TTeTT'NN~ :sB $33B!! B.-B.1H HH 1O<< P P _paid_lane_warnedct|o3t|dS)zATrue when ``model`` is an OpenRouter free SKU (``:free`` suffix).z:free)rnrIrryrs r_is_free_modelr+~ s3 ;; ?3u::++--66w???rc< ddlm}m}|}t||ddd}||dd}t |t r(|r|nt}||fS#t$r dtfcYSwxYw)uRead free_only and openrouter_model from config in one pass. Returns (free_only, model) — defaults (False, _OPENROUTER_MODEL) on any config-read failure. r)r1rA auxiliary free_onlyFropenrouter_model) rHr1rArnr$rIr_OPENROUTER_MODELrK)r1rAcfgr.rrs r_aux_openrouter_settingsr3 s (CCCCCCCC""$$k;NNNOO gc;(:;;)#s33Z Z IZ% ((('''''(sBBBBc|tvrdSt|td|dS)zELog a WARNING the first time a non-:free OpenRouter model is engaged.NuAuxiliary client: PAID lane engaged for auxiliary task — OpenRouter fallback model %r is not a :free SKU and may incur real spend. Set auxiliary.free_only: true to restrict auxiliary fallbacks to free models, or auxiliary.openrouter_model to a :free model.)r(addrXrYr*s r_warn_paid_lane_oncer6 sR !!!%    NN B  rexplicit_api_keyct\}}|p|}|r=t|s.td|t dddSt|st |t d\}}|r|pt|}|rVt|tpt}t dt||t|fSt d|ptd }|st dddSt d t|tt|fS) Nu Auxiliary client: auxiliary.free_only is enabled but the OpenRouter fallback model %r is not a :free SKU — skipping the OpenRouter fallback. Set auxiliary.openrouter_model to a :free model (e.g. nvidia/nemotron-3-ultra-550b-a55b:free) or disable auxiliary.free_only.rBrrQrz%Auxiliary client: OpenRouter via poolr\r=r3zFAuxiliary client: OpenRouter pool exhausted, trying OPENROUTER_API_KEYOPENROUTER_API_KEYzAuxiliary client: OpenRouter)r3r+rXrY_mark_provider_unhealthyr6rrrr3rxrarRr) r7rr. cfg_modelor_modelrror_keyr=s r_try_openrouterr@ s355Iy! H 11  #      !26666z ( # #'X&&&,\::L% _!A%:5%A%A  I-e5HII`M`H LL@ A A A((+;+=+=???@HI I  ]^^^  F1E!F!FF  26666z LL/000 :M#3#5#5 7 7 78@ AArcztd\}}|r|dSt|sdStdsdSdS)z>Return a more precise OpenRouter auth failure reason for logs.rBNzOOpenRouter credential pool has no usable entries (credentials may be exhausted)z=OpenRouter credential pool entry is missing a runtime API keyr;zOPENROUTER_API_KEY not setz&no usable OpenRouter credentials found)rrr)rrs r _describe_openrouter_unavailablerB s\,\::L%S =dd$U++ SRR / 0 0,++ 3 3rvisionc4 ddlm}|}|4|dkr.td|t d|dSn#t $rYnwxYwt }td}|/|s-td t dd dS||rtd d a td t} ddl m }||}|r#|}td|rdnd|n td|rdnd|n8#t $r+}td|rdnd||Yd}~nd}~wwxYw||\} } nt|pi} | s-tdt dd dSt|pidp t!d} t%| | |fS)Nr)nous_rate_limit_remainingz?Auxiliary: skipping Nous Portal (rate-limited, resets in %.0fs)rr9rFrzSAuxiliary Nous client unavailable: no Nous authentication found (run: hermes auth).rzLAuxiliary Nous: runtime JWT refresh failed; checking stored auth.json token.TzAuxiliary client: Nous Portalget_nous_recommended_aux_modelrCz/Auxiliary/%s: using Portal-recommended model %srCrz:Auxiliary/%s: no Portal recommendation, falling back to %szGAuxiliary/%s: recommended-models lookup failed (%s); falling back to %sz]Auxiliary Nous client unavailable: no usable inference JWT found (run: hermes auth add nous).rrr_)agent.nous_rate_guardrErXrxr<rKrrrYr_ _NOUS_MODELrrGrrIrJrrxra) rCrE _remainingrruntimerrG recommendedrr\r=s r _try_nousrN s  CCCCCC..00  !j1nn LLQ    %V < < < <:         D'e<< to the aggregator's real provider+model through this single helper (shared by ``_resolve_auto``, ``_resolve_task_provider_model``, and ``resolve_provider_client`` so the preset lookup and validation cannot drift between paths). Args: preset_name: The MoA preset name (usually carried in the "model" field), or None/"" to resolve the user's default preset. Returns: (aggregator_provider, aggregator_model), or (None, None) when the preset cannot be resolved (missing config, renamed/deleted preset, or a malformed aggregator slot). rr[)resolve_moa_presetmoaN aggregatorrrBrz.MoA aggregator resolution failed for preset %rTrtr) rHr2hermes_cli.moa_configrdrJrIrrrKrXrx)rbr2rdpresetagg agg_provider agg_models r_resolve_moa_aggregatorrl sF*  111111<<<<<<##KKMM$5$5e$<$<$BKDWSWXXjj&&,"377:..4"55;;== ((.B//5577  +I +,*<*<*>*>%*G*G* *     .wrapped s6tAwwFJJv$6$6'++) **3!133* - -    18T,V,, $ ) )% 0 0 0 0     & ( ( (   $ ) )% 0 0 0 0s+B B''B**C functoolswrapsrrs` r_relay_auxiliary_callr :_X11111$ NrcFtjfd}|S)z3Async counterpart to :func:`_relay_auxiliary_call`.c K|r|dn|d}tt|pddt jjddddd} |i|d{V t|S#t$rtwxYw#t|wxYwrrrs rrz,_relay_auxiliary_call_async..wrapped6 s6tAwwFJJv$6$6'++) **3!133* - -    1!42622222222 2 $ ) )% 0 0 0 0     & ( ( (   $ ) )% 0 0 0 0s- BB00B33Crrs` r_relay_auxiliary_call_asyncr3 rrct}|dSt|pd|d<t|pd|d<t|pd|d<dS)Nr-rrrrr)r}rJrI)rrrcontexts r_set_relay_auxiliary_routerL sk &))++Gh5+66GJ5-I..GGh<*<==GJrrrc t}|dSt|dpd}|dz|d<t|p|dpd}t|dpd}||t|p|dpd t|d d |d |t|d d fS)Nrrrrr-rrrrrz auxiliary:r)rapi_request_id call_role retry_countauxiliary_task)r}rJrLrI)rrrr provider_name model_names r_relay_auxiliary_metadatarY s &))++Gt O449::M,q0GOJGKK $;$;J{KKMW[[))6Y77J *QGKK $;$;Q?QRRgl3443'&/33$gfo.. '' rrrrrZrc  |pfd t||}|t |S|\}}}ddlm} | | fd|t |dp||dS) Nc2jjjdi|SNrrGr@rrequestrZs rr{z(_relay_sync_completion..v *H&+*A*H*S*S7*S*Srrr relay_llmc$t|Sr)r)rrs rr{z(_relay_sync_completion.. s9(GLLrrTrrmetadatadefer_logical_completion)rragentrexecute_currentrIrJ) rZr!rrrrouterfallback_modelrrrs ` @r_relay_sync_completionrn sTSSSSH %x( K K KE }06BBB.3+M>8  $ $LLLL vzz'**. rrrrrrTr)rrrexecute_current_asyncrIrJ) rZr!rrrrrrrrrs ` r_relay_async_completionr sTSSSSH %x( K K KE }Xf%%%%%%%%%.3+M>800 vzz'**. s 6 /6AAAArrc"t|dS)Nr )r)r=s rr{z$_relay_sync_stream.. s75)3L3Lr)rr finalizerrcompleted_response_predicater) rrGr@rrrstream_currentrIrJr5) rZr!rrrrrrrs ` r_relay_sync_streamr s &x( K K KE }-v{&-77777.3+M>8  # #AAAA vzz'**)@)@@@t F...t (&11 2 22rfieldct}|t}t|tr||}|r|SdS)zERead one runtime field through context-local/controlled legacy state.NrB)r{rJrr$r5)rrLr=s rrUrU sX#''))G&(('4   E""  L 2r)requested_providerr=r\r auth_moderrc|pd|pd|pd|pdt|tr|nt |r|nd|pd|pddt }t5fdtD\a a a a a atfdtDadddn #1swxYwY|S)zRecord the current context's live main runtime for auxiliary routing. Context-local state prevents concurrent gateway sessions from overwriting one another while retaining compatibility mirrors for legacy readers. rB)rrrr=r\rrc3(K|] }|V dSrrrrrLs r z#set_runtime_main.. s' > >WU^ > > > > > >rc3(K|] }|V dSrrrs rrz#set_runtime_main.. s8. . $GEN. . . . . . rN)rrr$rIryr{r_RUNTIME_MAIN_COMPAT_LOCKrrtrurvrwrxrytupler) rrrr=r\rrrrLs @rset_runtime_mainr s&^**,,224417R>>@@FFHH+2$$&&^**,,'3'' 6GMMOOO$W--52^**,,o2,,..4466  G " % %g . .E "    ? > > >)= > > > "  " ! " #(-. . . . (<. . . ) ) %                 Ls;EE #E rct|dS t|dS#ttf$rYdSwxYw)z:Restore the runtime binding that preceded one scoped turn.N)r{rrr)rs rreset_runtime_mainr sT } ##E***** * %     s "77 main_runtimec#Kt|}t|pd} |Vt|dS#t|wxYw)zETemporarily bind an explicit runtime without touching legacy mirrors.N)_normalize_main_runtimer{rr)rrLrs rscoped_runtime_mainr so&l33G ! % %go 6 6E+ ##E*****##E****s AA+ctdt5dadadadadadada ddddS#1swxYwYdS)z2Clear the runtime override in the current context.NrBr) r{rrrtrurvrwrxryrrrrclear_runtime_mainr( s d### "AA!# !# "!#"$(@%AAAAAAAAAAAAAAAAAAs>AAc ddlm}|d}n4#t$r'}td|d}Yd}~nd}~wwxYwt |t sRtjdd d }td }|sd S||d }| d }| d}| d}t |tr| sd S| d }t|drd St |tr| sd}t |tr| sd}|| |fS)zResolve the active custom/main endpoint the same way the main CLI does. This covers both env-driven OPENAI_BASE_URL setups and config-saved custom endpoints where the base URL lives in config.yaml instead of the live environment. rresolve_runtime_providerr) requestedz6Auxiliary client: custom runtime resolution failed: %sNOPENAI_BASE_URLrBrOPENAI_API_KEYNNNr=r\r=r\r openrouter.aino-key-required)hermes_cli.runtime_providerrrKrXrxr$r5rHrrrxrrJrIr4)rrLr openai_base openai_key custom_base custom_key custom_modes r_resolve_custom_runtimer8 sHHHHHH**X>>>  MsSSS gt $ $ i 1266<<>>EEcJJ $%566  $###!   ++j))KY''J++j))K k3 ' ' {/@/@/B/B ##%%,,S11K[/::   j# & &'j.>.>.@.@'& k3 ' '{/@/@/B/B  ((**K 77s AAAc.t\}}}|pdSNrB)r)rr%s r_current_custom_base_urlrj s/11KA  "rc Dddlm}tdD]}ttj|pd}|sE ||}|jr|j }`#t$r}td|d|d|d}~wwxYwdS) aFail fast with a clear error when proxy env vars have malformed URLs. Common cause: shell config (e.g. .zshrc) with a typo like ``export HTTP_PROXY=http://127.0.0.1:6153export NEXT_VAR=...`` which concatenates 'export' into the port number. Without this check the OpenAI/httpx client raises a cryptic ``Invalid port`` error that doesn't name the offending env var. rr) HTTPS_PROXY HTTP_PROXY ALL_PROXY https_proxy http_proxy all_proxyrBz%Malformed proxy environment variable rfz1. Fix or unset your proxy settings and try again.N) rr r8rIrHrIrJrschemeportrr)r r<r=rr%rs r_validate_proxy_env_urlsro s&%%%%%:  BJNN3''-2..4466   Xe__F} K   BBBeBBB    sA77 BBBcddlm}t|pd}|r|drdS ||}|jdvr |j}dSdS#t$r}td|d|d}~wwxYw) zEReject obviously broken custom endpoint URLs before they reach httpx.rrrBzacp://N>httphttpszMalformed custom endpoint URL: zJ. Run `hermes setup` or `hermes model` and enter a valid http(s) base URL.) rr rIrrrrrr)r=r rirr%rs r_validate_base_urlr s%%%%%%HN##))++I  ,,X66)$$ =- - - AAA . -  Wi W W W   sA## B-BBct}t|dkr|\}}d}n|\}}}|r|sdS|trdSt pd}t d||pdt|\}}|rd|ini}td}|r||d<|dkr!td||d |} t| ||fS|d kre d d l m } | ||} n;#t$r.t d td||d ||fcYSwxYwt!| |||d|fStd||d |} t#| ||||} | |fS)Nrer gpt-4o-miniz3Auxiliary client: custom endpoint (%s, api_mode=%s)r default_queryr3codex_responsesr_r}rru|Custom endpoint declares api_mode=anthropic_messages but the anthropic SDK is not installed — falling back to OpenAI-wire.Frr)rrjrr_CODEX_AUX_BASE_URLrnrXrxrr>rarDrhrrUrYrr) rLrrrr _clean_base_dq_extra_custom_headersrr_fallback_clients r_try_custom_endpointr  s=%''G 7||q") Z /6, Z jz%%&9&?&?&A&ABBz $ & & 7-E LLF{Op^pqqq0==K'* 2os # #F 2$77O4$3 !'''+_J__X^__ #K77>>*** d F F F F F F00[IIKK d d d NNR   )\k\\U[\\^cc c c c  d %[%[[` a a a   -`Z+``Y_``,%[+ U ""sD5E  E c|stddSt}|dS|\}}td|ddlm}t |||}t|||fS)u Build a CodexAuxiliaryClient for an xAI Grok OAuth-authenticated session. xAI's ``/v1/responses`` endpoint speaks the OpenAI Responses API, so we wrap a plain ``OpenAI`` client in ``CodexAuxiliaryClient`` to translate ``chat.completions.create()`` calls into ``responses.stream()`` requests. The caller must pass an explicit model — pinning a default for Grok would silently rot when xAI's allowlist drifts. Returns ``(None, None)`` when the user has not authenticated with xAI Grok OAuth. zuAuxiliary client: xai-oauth requested without a model; pass model explicitly (auxiliary..model in config.yaml).rNz2Auxiliary client: xAI OAuth (%s via Responses API)rhermes_xai_default_headersr:)rXrYr rxtools.xai_httpr rarD)rresolvedr\r=r rs r_build_xai_oauth_aux_clientr s  M   z)++Hz GX LLEuMMM999999'2244K U 3 3U ::rc|stddStd\}}|rHt|}|rt |t pt }n3t }|sdSt }nt }|sdSt }td|t||t|}t|||fS)aBuild a CodexAuxiliaryClient for an explicitly-requested model. There is no auto-selection of the Codex model: the ChatGPT-account Codex endpoint's accepted model list is an undocumented, drifting allow-list, so any hardcoded default we pick goes stale. The caller is responsible for passing the model (e.g. from the user's own ``model.model`` or ``auxiliary..model`` config). Returns (None, None) when no Codex OAuth token is available. zxAuxiliary client: openai-codex requested without a model; pass model explicitly (auxiliary..model in config.yaml).rrz4Auxiliary client: Codex OAuth (%s via Responses API)r:) rXrYrrrrrrxrarrrD)rrr codex_tokenr=rs r_build_codex_clientr s  M   z,^<<L% '+E22  +-e5HII`M`HH244K "!z*HH.00  :& LLGOOO'1+>>K U 3 3U ::rrr7explicit_base_urlrrcl ddlm}ddlm}ddlm}n#t $rYdSwxYw |}t|tr| dni}t|tsi}n#t$ri}YnwxYw |d||||} n\#|$r&} t d | Yd } ~ dSd } ~ wt$r&} t d | Yd } ~ dSd } ~ wwxYw| d } t| d dpd} |p| dpd} t| st| nd}|r| sdSt!|p#t| dpdd}|s1t d|| ddSi}t#| \}}|r||d<t%d| |d|}| dkrt'|||fS| dkrt)||| | | |fS||fS)uResolve an Azure Foundry auxiliary client via the runtime resolver. Mirrors the ``_try_anthropic`` / ``_try_nous`` shape but delegates to :func:`hermes_cli.runtime_provider._resolve_azure_foundry_runtime` — the same resolver the main agent uses — so: * ``auth_mode: api_key`` (default) gets the static ``AZURE_FOUNDRY_API_KEY`` string. * ``auth_mode: entra_id`` gets a callable bearer-token provider (``Callable[[], str]`` from :mod:`agent.azure_identity_adapter`). * Per-model ``api_mode`` auto-routing for GPT-5.x / o-series / codex models works. * ``model.entra.{tenant_id,client_id,authority,scope}`` config fields propagate. * Non-default ``model.base_url`` overrides are honored. The OpenAI SDK accepts both shapes for ``api_key`` so the caller can forward the result without coercion. Returns ``(client, model)`` or ``(None, None)`` on failure. r)_resolve_azure_foundry_runtime) AuthErrorrArr azure-foundry)rrWr7r target_modelzAuxiliary azure-foundry: %sNz)Auxiliary azure-foundry runtime error: %sr\r=rBrrTrzAAuxiliary azure-foundry: no model resolved (model=%r, default=%r)rr_rr}r)rrrrrHrArUr$r5rJrKrXrxrIryrn_normalize_resolved_modelrrarDr)rr7rrrrrAr2rWrLrr\r=runtime_api_mode_has_key final_modelr rrrZs r_try_azure_foundryr s:NNNNNN------::::::: zz""$$(23(=(=ECGGG$$$2 )T** I   00.-/      2C888zzzzz  @#FFFzzzzzkk)$$G7;;z2..4"55HP7;;z#:#:P>P %-W$5$5?tG}}}4H 8z+ 4Y]]9--344K   O 9==++   z E0::K %!$o " R7[ R RE R RF,,,$FK88+EE/// % K &     ; sB ##A A55 BBBC2B?? C2 C--C2c ddlm}m}n#t$rYdSwxYwt d\}}|r||pt |}nd}|p |}|sdS|rt |tnt} ddlm }|}| d} t| trt| dpd} | dkrO| d pdd } | rt#| r| }n#t$$rYnwxYwdd lm} | |} t)dpd }t*d |||  |||}n#t$rYdSwxYwt/||||| |fS)Nr)rresolve_anthropic_tokenrrrArrrBr=r)_is_oauth_tokenrz8Auxiliary client: Anthropic native (%s) at %s (oauth=%s)r)rhrr!rUrrr_ANTHROPIC_DEFAULT_BASE_URLrHrArJr$r5rIrrrxrrKr"rrXrxr)r7rr!rrrr=rAr2rW cfg_provider cfg_base_urlr"rcrrs rrr sj[[[[[[[[[ zz-[99L%>) @$9%$@$@ =$;$;$=$= zNZz%e-HIII_zH  ::::::""$$GGG$$ i & & ,y}}Z88>B??EEGGMMOOL{** ) j 9 9 ?RFFHHOOPSTT ,$A,$O$O,+H      877777u%%H ' 4 4 S8SE LLKUT\^fggg,,UH== zz  $KxRZ [ [ []b bbs1 5CE EE F** F87F8rBr local/customapi-keyr@rNr r')rrr=r\rr)rc8|)t}|t}t|tsiSi}t D]}||}|dkr*t |rt|ts|||<Gt|tr+|r|||<dD]C}||}t|tr| ||<D|S)uReturn a sanitized copy of a live main-runtime override. Most fields are stripped strings. ``api_key`` may legitimately be a zero-arg callable (Azure Foundry Entra ID token provider) — preserve those as-is so auxiliary clients inherit the same authentication surface as the main agent. The OpenAI SDK accepts ``Callable[[], str]`` for ``api_key`` and calls it before every request. Nr\)rr) r{rJrr$r5_MAIN_RUNTIME_CONTEXT_FIELDSryrIrr)rrrr=identity_fieldidentitys rrr s -0022  /11L lD ) ) !#J-..  '' I  (5// *UC:P:P  %Ju   eS ! ! .ekkmm . % Ju <::>>.11 h $ $ :)1)9)9J~ & rcFdtfdtfdtfdtfgS)aBReturn the ordered provider detection chain. Built at call time (not module level) so that test patches on the ``_try_*`` functions are picked up correctly. NOTE: ``openai-codex`` is deliberately NOT in this chain. The ChatGPT-account Codex endpoint only accepts a shifting, undocumented allow-list of model IDs, so falling back to it with a guessed model fails more often than not. Codex is used only when the user's main provider *is* openai-codex (see Step 1 of ``_resolve_auto``) or when a caller explicitly requests it with a model. rBrr&r'r(rrr_get_provider_chainr. s0 '  -. -.  rX_aux_unhealthy_until_aux_unhealthy_logged_atr)rBrrr&rrc|sdSt|}t||S)a Normalize a resolved_provider value to a chain label used by ``_get_provider_chain()``. Falls back to the lowercased input for direct API-key providers (deepseek, alibaba, minimax, etc.) which each report their own provider name from the api-key chain. rB)rIrr_AUX_UNHEALTHY_LABEL_ALIASESrJ)rps r_normalize_chain_labelr53sJ r H ##%%A ' + +Aq 1 11rrQc .t|}|sdStj||ntz}|t|<td|t ||nttjdtj|dS)zMark ``provider`` as recently-402'd, hidden from chain iteration until the TTL expires. Called from the payment-fallback branches in ``call_llm`` and ``acall_llm`` after a confirmed payment error. NzsAuxiliary: marking %s unhealthy for %ds (payment / credit error). Subsequent auxiliary calls will skip it until %s.z%H:%M:%S) r5r_AUX_UNHEALTHY_TTL_SECONDSr0rXrYrLstrftime localtime)rrQlabelrs rr<r<?s #8 , ,E s*?*?#@#@     rcjttdS)zvClear the unhealthy cache. Used by tests and by a future explicit user trigger (e.g. ``hermes config aux reset``).N)r0rr1rrr_reset_aux_unhealthy_cacherDrs.   ""$$$$$rrct|dd}|dkrdSt||dvrtfddDrdSdS) u Detect payment/credit/quota exhaustion errors. Returns True for HTTP 402 (Payment Required) and for 429/other errors whose message indicates billing exhaustion or daily quota exhaustion rather than transient rate limiting. Daily token quota errors (e.g. Bedrock "Too many tokens per day", Vertex AI "quota exceeded") are functionally equivalent to credit exhaustion — the provider cannot serve the request until the quota resets — and should trigger the same provider-fallback logic. status_codeNT>NrGc3 K|]}|vV dSrrrkw err_lowers rrz$_is_payment_error..s7  2rY      r)creditsinsufficient fundscan only affordbillingpayment required out of fundsrun out of fundsbalance_depletedno usable credits model_not_supported_on_free_tiernot available on the free tierzrequires a subscriptionzupgrade for accesszupgrade for higher limitsz reached your session usage limitzquota exceededquota_exceededztoo many tokens per dayz daily limitztokens per dayz daily quotazresource exhaustedzweekly usage limitz weekly limitFrorIranyrstatusrNs @r_is_payment_errorr_ysS- . .F }}tC  I +++     *       "4 5rc ddlm}|d}|jduS#t$r&}td|Yd}~dSd}~wwxYw)zMReturn True only when the fresh Nous account API says paid access is allowed.r)get_nous_portal_account_infoT) force_freshz8Auxiliary Nous paid-entitlement refresh check failed: %sNF)hermes_cli.nous_accountrapaid_service_accessrKrXrx)ra account_infors r*_nous_portal_account_has_fresh_paid_accessrfs|HHHHHH33EEE /477  OQTUUUuuuuus A AA c t|dd}t|t|jdkrdS|dkr:t fddDrdSt fdd DsdSd S) aHDetect rate-limit errors that warrant provider fallback. Returns True for HTTP 429 errors whose message indicates rate limiting (as opposed to billing/quota exhaustion, which _is_payment_error handles). Also catches OpenAI SDK RateLimitError instances that may not set .status_code on the exception object. rFNRateLimitErrorTrJc3 K|]}|vV dSrrrLs rrz'_is_rate_limit_error..s7  2rY      r) rate limit rate_limitztoo many requestsz try againz retry afterz resets inc3 K|]}|vV dSrrrLs rrz'_is_rate_limit_error..s7  r2?      r) rOrPrRrSrQrTrUrVrWrXrYF)rorIrrr*r\r]s @r_is_rate_limit_errorrmsS- . .FC  I Cyy---t }}     *       4    .       4 5rc ddlm}t||rdSn#t$rYnwxYwdt |jvrdSdt |vS)uDetect a request timeout — the full-budget stall, distinct from a fast connection drop. A timeout burns the entire configured ``timeout`` before surfacing, so a same-provider retry on the critical compression path doubles the user-visible wall time (issue #54465). A streaming-close / dropped connection, by contrast, fails fast and is cheap to retry — those stay on the retry path even for compression. r)APITimeoutErrorTTimeout timed out)rror$rUrr*rIr)rros r_is_timeout_errorrrs ****** c? + + 4       DII&&&t #c((..** **s  ((cD ddlm}m}t|||frdSn#t$rYnwxYwt |jtfddDrdSt| tfddDrdSdS) aEDetect connection/network errors that warrant provider fallback. Returns True for errors indicating the provider endpoint is unreachable (DNS failure, connection refused, TLS errors, timeouts). These are distinct from API errors (4xx/5xx) which indicate the provider IS reachable but returned an error. r)APIConnectionErrorroTc3 K|]}|vV dSrr)rrMerr_types rrz'_is_connection_error..s' L Lb2> L L L L L Lr) ConnectionrpDNSSSLc3 K|]}|vV dSrrrLs rrz'_is_connection_error..s7  r2?      r) zconnection refusedzname or service not knownzno route to hostznetwork is unreachablerqzconnection resetzincomplete chunked readzpeer closed connectionzresponse ended prematurelyzunexpected eofremoteprotocolerrorlocalprotocolerrorF) rrtror$rUrr*r\rIr)rrtrorNrvs @@r_is_connection_errorr}s >>>>>>>> c.@ A A 4       Cyy!H L L L L$K L L LLLtC  I     &   t 5s ! ..ct|rdSt|ddptt|dddd}t|to|dkpd|cxkodkncS)a(Return True for a one-off transport blip worth retrying ON the same provider before any provider/model fallback. Covers connection/streaming-close errors (via the canonical ``_is_connection_error`` detector, shared so the two cannot drift) plus a pure 5xx/408 HTTP status. Deliberately narrow: this is the "retry the same target once" gate, distinct from ``_is_payment_error`` / ``_is_auth_error`` / ``_is_rate_limit_error`` which the except-chain handles by switching provider, refreshing creds, or rotating the pool. TrFNriir/)r}ror$rL)rr^s r_is_transient_transport_errorrsC  t S- . .'Z&& t33F fc " " M# (L9L9L9L9L9L9L9L9LMrreg?c ddlm}m}||dd}|tSt |}t dt |dS#t$r tcYSwxYw)uNumber of same-provider retries for a transient transport blip. Read from ``auxiliary.transient_retries`` in config.yaml (default 2 → 3 total attempts). Clamped to [0, 6] to bound worst-case wall time. A connection blip to a pinned auxiliary target (e.g. a MoA reference advisor) has no meaningful provider fallback, so a couple of retries with backoff is the difference between recovering and silently losing the call. Best-effort: any config-read failure falls back to the default. rr0r-transient_retriesN)rHr1r2_DEFAULT_TRANSIENT_RETRIESrLrminrK)r1r2rns r_transient_retry_countr(s *::::::::gkkmm[2EFF ;- - HH1c!Qii   ***))))*s%A,AA)(A)ct|dd}|dkrdSt|}d|vs(dt|jvrdS|dkrd|vrdSd |vrd|vrdSd S) zCDetect auth failures that should trigger provider-specific refresh.rFNTzerror code: 401authenticationerrorrHzbad-credentialsunauthenticatedF)rorIrrr*r]s r_is_auth_errorr>s S- . .F }}tC  II%%)>$s))BTBZBZB\B\)\)\t}}*i77tI%%*;y*H*Ht 5rparamc|pd}|sdSt||vrdStfddDS)a/Detect provider 400s for an unsupported request parameter. Different OpenAI-compatible endpoints phrase the same class of error a few ways: ``Unsupported parameter: X``, ``unsupported_parameter`` with a ``param`` field, ``X is not supported``, ``unknown parameter: X``, ``unrecognized request argument: X``. We match on both the parameter name and a generic "unsupported/unknown/unrecognized parameter" marker so call sites can reactively retry without the offending key instead of surfacing a noisy auxiliary failure. Generalizes the temperature-specific detector that originally shipped with PR #15621 so the same retry strategy can cover ``max_tokens``, ``seed``, ``top_p``, and any future quirk. Credit @nicholasrae (PR #15416) for the generalization pattern. rBFc3 K|]}|vV dSrr)rmarkerrNs rrz2_is_unsupported_parameter_error..fs8  vv"      r)zunsupported parameterunsupported_parameter not supportedzdoes not supportzunknown parameterzunrecognized request argumentzunrecognized parameterzinvalid parameter)rrIr\)rr param_lowerrNs @r_is_unsupported_parameter_errorrPs ;B%%''K uC  I)##u      2      rc"t|dS)zBack-compat wrapper: detect API errors where the model rejects ``temperature``. Delegates to :func:`_is_unsupported_parameter_error`; kept as a separate public symbol because existing tests and call sites import it by name. rs)r)rs r!_is_unsupported_temperature_errorrrs +3 > >>rct|dd}t|tfddDrdS|dvrdStfddDS) u!Detect "the requested model doesn't exist" errors (404 / invalid model). This fires when a resolved model name is no longer served by the endpoint — most commonly when a long-lived process pinned a Portal-recommended model that has since been dropped from the Nous → OpenRouter catalog. The Nous proxy returns 404 with a body like:: Model 'gpt-5.4-mini' not found. The requested model does not exist in our configuration or OpenRouter catalog. Distinct from :func:`_is_payment_error` (which also matches some 404s for free-tier/credit language) — this one keys on "does not exist / not found / not a valid model" phrasing, and explicitly excludes the billing keywords that the payment path already owns so the two predicates don't overlap. rFNc3 K|]}|vV dSrrrLs rrz,_is_model_not_found_error..s7  r2?      r) rOrPrRrTrVrW free tier free-tierrYF>NrIc3 K|]}|vV dSrrrLs rrz,_is_model_not_found_error..s7  2rY      r) zmodel does not existz#does not exist in our configurationzopenrouter catalogzis not a valid modelz no such modelzmodel not foundz the model `model_not_foundz unknown modelr[r]s @r_is_model_not_found_errorr{s S- . .FC  I     &    u %%%u      *      rct|dd}|dvrdSt|t|rdSt fddDrdSt fddDS) uDetect "this route cannot serve this model" 400s (capability mismatch). Distinct from :func:`_is_model_not_found_error` (the model does not exist anywhere): here the model name is valid but the *current provider/account* is structurally unable to run it. The canonical case is a configured fallback that cannot run the main model — e.g. an ``openai-codex`` / ChatGPT-account fallback asked to compress a ``glm-5.2`` conversation:: Error code: 400 - {'detail': "The 'glm-5.2' model is not supported when using Codex with a ChatGPT account."} The candidate authenticates fine and builds a client, so the auth and payment predicates don't fire and the call would otherwise raise and abort the whole auxiliary task (commonly compression — which then drops middle turns and churns the session, destroying the prompt cache). Treating it as a fallback-worthy capability error lets the chain skip the incapable route and continue to the next candidate, mirroring the context-window feasibility screen (#52392). Billing/quota 400s belong to :func:`_is_payment_error`; "model does not exist" 400s belong to :func:`_is_model_not_found_error`. This predicate explicitly excludes both so the three don't overlap. rFN>NrFc3 K|]}|vV dSrrrLs rrz/_is_model_incompatible_error..s7  r2?      r) rOrPrRrTrVrWrSrrrYrXquotac3 K|]}|vV dSrrrLs rrz/_is_model_incompatible_error..s72rYr)zis not supported when usingzmodel is not supportedznot supported with thisznot supported for this accountmodel_not_supportedzdoes not support this modelzunsupported model)rorIrrr\r]s @r_is_model_incompatible_errorrs0S- . .F [  uC  I!%%u     &    u *  rct|tsdSt|}d|vod|vod|vS)aDetect provider responses that authenticated but cannot serve aux shape. Some OpenAI-compatible routes return HTTP 200 with an empty/malformed ChatCompletion instead of a normal provider error. That is still a provider/model capability failure for auxiliary tasks: downstream callers need ``choices[0].message`` and should be able to continue through the same fallback path as explicit model-incompatibility errors. Fz auxiliary zllm returned invalid responsezchoices[0].message)r$rrIr)rrs r_is_invalid_aux_response_errorrsW c< ( (u c((..  C ( +s 2 ( C 'rc2t|t5fdtD}|D]O}t|dd}|t |t|dP ddddS#1swxYwYdS)zEDrop cached auxiliary clients for a provider so fresh creds are used.c`g|]*}tt|dk(|+Sr)rrI)rr<rs r z)_evict_cached_clients..s@   &s3q6{{33zAA AAArrrN)r_client_cache_lock _client_cacherJ_close_cached_clientr)r stale_keysr<rZrs @r_evict_cached_clientsrs(22J  ) )    (    ) )C"&&s,>??BF!$V,,,   c4 ( ( ( (  ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )sA&B  BBrc:|dSd}t5ttD]M}t|}||d}|*t |dd}||us||ur t|=d}N dddn #1swxYwY|S)u@Drop the cache entry whose stored client is *target*. Used when a specific cached client has been poisoned (closed httpx transport after a timeout, broken streaming session, etc.) so the next auxiliary call rebuilds rather than reusing the dead instance. Walks both sync and async wrappers (``CodexAuxiliaryClient``, ``AnthropicAuxiliaryClient``, ``AsyncCodexAuxiliaryClient``, etc.) via their ``_real_client`` attribute so a timeout that closes the underlying ``OpenAI`` (or native provider) client evicts every cached shim that exposed it. Async wrappers must mirror their sync sibling's ``_real_client`` for this to work — otherwise the sync entry is evicted but the async entry survives and keeps reusing the dead transport. Returns True when at least one entry was evicted. NFrrFT)rrrkeysrJro)revictedr<rcachedreals rrrs"~uG    **,,--  C!%%c**E}1XF~6>488D46>>!#&                 NsA5BBBrcVt|}|dkr?t|}t|dp t}|dvrdSt |}|dSt t |ddpd}|sdS|d|S)z9Return a stable cache discriminator for pooled providers.rr>rBrrrBNrr)rrrJrrrIror)rrrrLrentry_ids r_pool_cache_hintrs )22JV),77,W[[-D-D-]H[H]H]^^ +++r Z ( (E }r75$++1r2288::H r % %8 % %%rcXt|dd}dt|i}|||d<|S)NrFr)rorI)rr^rs r_pool_error_contextr3s8 S- . .F(#c((3G !'  Nrresolved_providerct|}|dvr|Stt|ddpd}t|drdSt|drdSt|drd St|d rd St|d rd St|drdSt|drdS|rt |}|dd}|r|dvr ddlm}||}|rit|dddkrTtt|ddpdd} | rt|t| r|Sn#t$rYnwxYwdS)zCInfer which provider pool can recover the current auxiliary client.>rBrrr=rB chatgpt.comrrrBinference-api.nousresearch.comrrrrrrvrrrrr)rrNr\rr) rrIror4rrJrrrxr5rK) rrZrrr`rt rt_providerrrrt_bases r_recoverable_pool_providerr;s )):;;J/// wvz2..4" 5 5DT=11~T?33|T#CDDvT#677{T#677yT>22}T:..{  $\ 2 2ffZ,,  ;.DDD ======+// <<+ww TBBiOO!''3G"L"L"RPRSSZZ[^__G+#8?PQX?Y?Y#Z#Z+**     4s"BE)) E65E6failed_api_keyrct|} t|}n4#t$r'}td||Yd}~dSd}~wwxYw|r|sdSt |dd}t|}|pd}t|rX| } | t|dS| ||nd||} | t|dSdSt|st|rBt|rdnd } | ||n| ||} | t|dSdS) avTry same-provider credential-pool recovery for auxiliary calls. ``failed_api_key`` is the API key that was actually used for the failing request. Passing it lets mark_exhausted_and_rotate identify the correct pool entry even when another process has already rotated the pool (which would leave current() as None, causing the wrong entry to be marked). z9Auxiliary client: could not load pool for %s recovery: %sNFrFTr)rF error_context api_key_hintrGrJ)rr/rKrXrxr~rorrrrmark_exhausted_and_rotater_rm) rrrrrload_excrFrhintr next_entryfallback_statuss r_recover_provider_poolrfs)22J$$  PR\^fggguuuuu t++--u#}d33K',,M  !TDc ,,..  !* - - -433'2'> C'4   ! !* - - -4u !5c!:!: !23!7!7@##S33'2'> O'4   ! !* - - -4 5s! AA  A)r4resolved_modelresolved_base_urlresolved_api_keyresolved_api_moderrrsrqreffective_timeouteffective_extra_bodyrvr4c |dkrt||||d\}}}nt||||||\}}|td|pdd|dtt |d d pd }t ||p||| | | | | ||p|| }|rt ||d <t||rt|d |d <tt|||||S)NrCFrrr=r\rOr=r\rr Auxiliary r> : provider $ could not be rebuilt after recoveryr=rBrsrqrrrrvr=rr4rr) resolve_vision_provider_client_get_cached_clientrrIro_build_call_kwargsr5_is_anthropic_compat_endpoint#_convert_openai_images_to_anthropic_validate_llm_responser)rrrrrrrrrrsrqrrrrvr4r% retry_client retry_model retry_base retry_kwargss r_retry_same_provider_syncrsz& x'E&&$ ( ( ( $<%7  &$&% % % % ! k k k k4E k k k   W\:r::@bAAJ%"{!')00    L <(,](;(; _%$%6 CCa#F|T^G_#`#` Z !  &&      rc K|dkrt||||d\}}}nt||d|||\}}|td|pdd|dtt |d d pd }t ||p|||| | | | | |p|| }|rt ||d <t||rt|d |d <tt||||d{V|S)NrCTr)rOr=r\rrr>rrr=rBrr4rr) rrrrIrorr5rrrr)rrrrrrrrrsrqrrrrvr4r%rrrrs r_retry_same_provider_asyncrs$ x'E&&$ ( ( ( $<%7  &$& % % % ! k k k k4E k k k   W\:r::@bAAJ%"{!')00    L<(,](;(; _%$%6 CCa#F|T^G_#`#` Z !%  &&            rct|} |dkryddlm}m}m}m}|\}}t |pdsdS|||d||t|dS|dkr\dd l m }|d } t | d dpdsdSt|dS|d krkdd l m } | tddd} t | d dpdsdSt|dS|dkrddlm} m} m} | } t'| t(r | dr | | nd}t |pds | }t |pdsdSt|dS|dkrt+|}|r|rm||}|Ct t3|ddpdrt|dSddl m}|d } t | d dpdsdSt|dS|dkrzddlm}|\}}t'|t r|sdSt'|t r|sdSt|dSn4#t:$r'}t<d||Yd}~dSd}~wwxYwdS)zERefresh short-lived credentials for OAuth-backed auxiliary providers.rr) _jwt_cache_token_fingerprintexchange_copilot_tokenresolve_copilot_tokenrBFNTr)!resolve_codex_runtime_credentialsrr\rrrrrr)read_claude_code_credentials_refresh_oauth_tokenr! refreshTokenrrrvertex)get_vertex_configz7Auxiliary provider credential refresh failed for %s: %s) rhermes_cli.copilot_authrrrrrIrrrrrrJrr6rhrrr!r$r5r/r~rrror agent.vertex_adapterrrKrXrx)rrrrrr raw_token_sourcerrrrrr!rrrr rr=rs r_refresh_provider_credentialsr's(22JT  " "            "7!6!8!8 IwyB''--// u NN--i88$ ? ? ? " "9 - - - !* - - -4  ' ' I I I I I I55DIIIEuyyB//5266<<>> u !* - - -4    H H H H H H44 )*G L L"EuyyB//5266<<>> u !* - - -4  $ $ { { { { { { { { { {0022E3=eT3J3JruyyYgOhOhr((///nrEu{##))++ 2//11u{##))++ u !* - - -4  $ $Z((D ,,..   4466 (SDUWY1Z1Z1`^`-a-a-g-g-i-i()*5554 M M M M M M99MMMEuyyB//5266<<>> u !* - - -4  ! ! ? > > > > >//11OE8eS))  uh,, HNN4D4D u !* - - -4# "$  NPZ\_```uuuuu 5slAN 9N AN !N 2AN N #B!N N BN /A N :N AN )N :N N=N88N=client_base_urlct|}|r|dkr|St|drdSt|drdSt|drdSt|drd S|S) udReturn the provider whose short-lived credentials should be refreshed. Auto-routed auxiliary calls keep ``resolved_provider == "auto"`` even after _get_cached_client() selects a concrete backend. Infer the backend from the selected client's base URL so auth refresh works for auto → Copilot/Codex/Anthropic/Nous routes too. (#20832) rapi.githubcopilot.comrrrrrrr)rr4)rrrs r _auth_refresh_provider_for_routers)):;;JjF**_.EFFy_m<<~_.ABB{_.NOOv rfb_labelcZ|r|sdStjd|}|sdS t|d}t |t r(|t |dnd}n#t$rYdSwxYwt |tr|ndS)a[Resolve the configured ``fallback_chain`` entry a label points at. Labels minted by :func:`_try_configured_fallback_chain` carry the entry index in our own stable format (``fallback_chain[]()``). Returns ``None`` when the label is not a configured-chain candidate or the index no longer resolves to a dict entry. Nzfallback_chain\[(\d+)\]fallback_chainr) rematch_get_auxiliary_task_configrJr$rrLgrouprKr5)rrmchainrs r_fallback_chain_entryrs xt +X66A t*400445EFF*4UD*A*AKc!''!**oo&&t ttud++ 5555sA!B BBct||}|r|dnd}t|ttfr*t|t s|dkrt |SdS)u,Resolve a per-entry ``timeout`` for a configured fallback candidate. A fallback candidate previously inherited the exact timeout the primary provider was called with. When that deadline was tuned for the primary (or the primary simply consumed its whole budget before failing over), the fallback aborted on the same clock even when independently healthy — a 163k-token compression that needs ~90s on the fallback died at the primary's 30s deadline every turn (#62452). Entries in ``auxiliary..fallback_chain`` may declare their own ``timeout`` (seconds). Returns ``None`` when the label is not a configured-chain candidate, the entry has no ``timeout``, or the value is invalid — callers then keep the task-level timeout, preserving existing behavior. rNr)rrJr$rLrMrn)rrrraws r_fallback_entry_timeoutrsn "$ 1 1E"' 1%))I   TC#U|$$ZT-B-BsQwwSzz 4rctjd|pd}|r'|dn"t |pdS)z>Recover the provider identifier from a fallback display label.z0(?:fallback_chain\[\d+\]|main-agent)\(([^)]+)\)$rBr)rrrrrI)r:rs r_fallback_provider_from_labelrsW HH%+SU V VE%* H5;;q>>   ! ! !EKR0@0@0F0F0H0HHrcPeZdZUeed<eed<eeed<eeed<dS)_FallbackDestinationrr=rrN)r*r+r,rI__annotations__r rrrr r sDMMMMMMsm C=rr c|stt|rd}nb ddlm}|||pd|pd}t|dpdpd}n#t $rYnwxYwt||||S)Nr}rrrB)rrrr)rrrrIrJrrKr )rr=rrrrLs r_complete_fallback_destinationr s  .x 8 8 +HH PPPPPP22&&.&6$!&" w{{:66<"==CCEEM     (He D DDsAA'' A43A4 fb_clientfb_modelc.t|dpd}t|dpt|ddpd}t|dp|dpdpd}|p7t|dpdpd}t ||||S)NrrBr=r transportr)rIrJrror )rrrrr=rrs r _fallback_destination_from_entryrs 599Z((.B//5577H *IJ!C!CIr egg  *=;!7!7=2 egg   EEIIg..4"55;;== EE )(Hh N NNrc"t|dd}t|tr|St|}t t|ddpd}d}|}t ||} | t | ||St||||S)z>Return the resolved route identity used by a fallback request._hermes_fallback_destinationNr=rB)ror$r rrIrrr ) rrrrattachedrr=rrrs r_fallback_destinationrsy"@$GGH(011,X66H79j"55;<rrr>NrBr)r=rr=rBukAuxiliary %s: fallback candidate %s has a stale/unrefreshable credential (%s) — skipping to next fallback)rrXr?rrrrrr=rrrrKrrrrr rIror<rYrrrrrrsrqrrrrv fb_timeoutrfallback_messagesfallback_tools fb_kwargsfb_err fb_providerrrretry_destinationretry_messages retry_toolsr retry_errs r_call_fallback_candidate_syncr*&sSD)x88J*0A"A"A  % NFHj2C   ''i8LLK(J )))%~ #k/1BJ&7':J%D 222I D% "$-$-         :::f%%  6  +"6   0 0 05RS^5_5_ 0(:!$-5$- ))) %L+ '$8(H7<R@@FBGG(4;#4 %%!/Q 1///+ 2%.%+" + %/@3%5.7d D D D  1.((%6%?%6%?  !))44 !!8999 < NFHf   tttttu:sC *B77 H>C)H9,*GH> H&G;6H9;H3H99H>cKt||} | (| |kr"td|pd|| || }t||||} t ||| \} }t | j| j| ||||| | | j| } tt||| j| j d{V|S#t$r}t|st| j| j}|dvrt|r t!|| jd| jpd| j \}}|t#|| jpt%t'|d d pd | j |p| j}t |||\}}t |j|j|||||| | |j| } tt|||j|j d{V|cYd}~S#t$r}t|sYd}~nd}~wwxYwt)|p|td |pd||Yd}~dSd}~wwxYw) z6Async mirror of :func:`_call_fallback_candidate_sync`.Nrr>rrr>NrBrT)rOr=rr=rBusAuxiliary %s (async): fallback candidate %s has a stale/unrefreshable credential (%s) — skipping to next fallback)rrXr?rrrrrr=rrrrKrrrrr rIror<rYrs r_call_fallback_candidate_asyncr,s)x88J*0A"A"A  % NFHj2C   ''i8LLK(J )))%~ #k/1BJ&7':J%D 222I A%)$-$-            777f%%  6  +"6   0 0 05RS^5_5_ 0(:!$-5$- ))) %L+'$8(H7<R@@FBGG(4;#4 %%!/Q 1///+ 2%.%+" + %/@3%5.7d D D D  15((%6%?%6%?  !))44 !!8999 < NFHf   ttttto7sC0B?? I  C*I50G+%I + H5H I H3II  payment errorfailed_providerreasonc  |}t}|h}|r=||vr'||ddddddd fd|D}g}t D]\}} ||vr t |r)t ||||dB| \} } | *t d |pd |||| pd | | |fcS||t d |pd ||d |dS)zTry alternative providers after a payment/credit or connection error. Iterates the standard auto-detection chain, skipping the provider that failed. Returns: (client, model, provider_label) or (None, None, "") if no fallback. rBrrr&)rBrrrrr&c<h|]}||Sr)rJ)rs_alias_to_labels r z(_try_payment_fallback..#s)HHHq,,Q22HHHr (unhealthy)Nu2Auxiliary %s: %s on %s — falling back to %s (%s)r>rz s  " " ( ( * *D())M&K/,,..$66 ++--...%16'5!/QQOIHHHKHHH E,.. v % % %  !% ( (  t , , , LLE/// 0 0 0     KKD@R   5%' ' ' ' U NNF 51A1A >rerror failed_modelc tpd}tpd}|dkrt |\}}|r|sdS||}}|r|r|dvrdSddlm}m} m} |pdpd} | | ||| || | r| j n| j rdSt|rt||dS t||\} } n#t$rd \} } YnwxYw| dSd |d }t d |pd |||| p|| | p||fS)uLast-resort fallback to the user's main agent provider + model. Used after the configured fallback_chain is exhausted (or empty) for users with an explicit auxiliary provider. This is the "safety net" layer: if nothing the user asked for can serve the request, try the main chat model before giving up. ``failed_model`` narrows the same-provider skip to the exact (provider, model) pair that just failed, mirroring :func:`_try_configured_fallback_chain`. This matters for self-hosted / custom endpoints serving several models behind one provider label: the aux compression model timing out says nothing about the health of the main agent model deployed on the same URL (real incident: aux ``glm-5.2`` hung and timed out while main ``macaron-v1-venti`` on the identical endpoint was serving 448K-token turns fine — the provider-label skip discarded the one fallback that would have worked). - Model-specific runtime failures (timeout, connection, rate limit, model-incompatible, invalid response) pass ``failed_model``: skip the main model only when it IS the exact model that failed. - Provider-wide failures (auth 401, payment 402) and legacy callers leave ``failed_model`` as None, keeping the whole-provider skip — the shared credentials/account are broken, so the main model on the same provider cannot help either. Returns: (client, model, provider_label) or (None, None, "") if no fallback. rBrer7>rBrrBackendIdentity FailureScopeshould_skip_candidateNrrrz main-agent()uCAuxiliary %s: %s on %s — falling back to main agent model %s (%s)r>)rrrXrrlagent.backend_identityrCrDrEbuildMODEL CREDENTIALrrBresolve_provider_clientrKrXr?)r.rr/r@r9 main_model _agg_provider _agg_modelrCrDrE skip_modelrZrr:s r_try_main_agent_model_fallbackrQ=s7D)**0b7799M"$$*1133J%%%$1:z  m.A.A.C.C|.S.S~  $"++--3355=J}JGGjII(E l.E~m,,M4000~,!8"*" " "  ,,,!+,~~ *- * * *E KKM 8T* >/Z 66s2EEEc(|sdS|dkrtSdS)ujReturn the minimum context length required for an auxiliary task. Only ``compression`` carries an explicit minimum today (the same ``MINIMUM_CONTEXT_LENGTH`` (64K) floor that ``check_compression_model_feasibility`` already enforces at startup). Other tasks (``vision``, ``title_generation``, ``web_extract``, ``skills_hub``, ``mcp``, ``session_search``) return ``None`` — they have no per-task context floor and the runtime chain must remain permissive for them. Returns ``None`` for an empty/``None`` task name so the helper is a safe no-op when called from generic sites. N compression)r0)rs r_task_minimum_context_lengthrTs' t }%% 4rc|sdS t||||}n5#t$r(}td|||Yd}~dSd}~wwxYwt |t r|dkr|SdS)u9Resolve the effective context window for a fallback candidate. Thin wrapper around :func:`agent.model_metadata.get_model_context_length` that swallows probe failures (returns ``None``). Callers treat ``None`` as "unknown — pass through" so the existing fallback surface is preserved when the context-length resolver chain cannot determine a value (custom endpoints, models not in the registry, offline endpoints). Best-effort, never raises — the runtime fallback chain must keep moving even if the resolver hits a probe error. N)r=r\rzBAuxiliary fallback: could not resolve context window for %s/%s: %sr)r1rKrXrxr$rL)rrr=r\ctxrs r_candidate_context_windowrWs$ t &       P eS   ttttt #sa 4s A AA c |sdSt|}|d}|rt|tsdS|pdpd}ddlm}m}m } | ||} |r|j n|j } g} t|} t|D]\}}t|tst!|dd}|sTt!|d d}| | ||t!|d pd | | r|pd}d |d |d} t#|\}}n#t$$rd\}}YnwxYw|| |rt'||t!|d pdt)|pd}|E|| kr?t*d||||| | |d|d| dt*d|||||p|pd||p||fcS| || r/t*d|d| dS)uTry user-configured fallback_chain for a specific auxiliary task. Reads auxiliary..fallback_chain from config.yaml and tries each entry in order. Each entry must have at least ``provider``; ``model``, ``base_url``, and ``api_key`` are optional. ``failed_model`` narrows the skip check to the exact (provider, model) pair that just failed, rather than the whole provider. Without it every entry sharing the failed provider is skipped (the original behaviour). Callers pass it only when a sibling model on the same provider could plausibly recover: - Model-specific runtime failures (timeout, connection, rate limit, model-incompatible, invalid response) pass ``failed_model`` so a chain that intentionally lists several models under the same provider — e.g. two more NVIDIA NIM models after the primary NIM model times out — is not skipped wholesale. Only the exact model that failed is skipped; the siblings still run instead of jumping straight to the main-agent-model safety net. - Provider-wide failures (auth 401, payment 402) and "no client could be built" callers leave ``failed_model`` as None, keeping the whole provider skipped — the shared credentials/account behind every model on that provider are broken, so a sibling can't help and the main-agent-model safety net should be reached instead. Returns: (client, model, provider_label) or (None, None, "") if no fallback. r7rrBNrrBrFrrr=)rrr=zfallback_chain[](rGrrzDAuxiliary %s: skipping %s (%s context=%d < min=%d), continuing chain (context too small: sF--F?>F?c|pd}|r|r|dvrdSt||dS)aTry task fallback_chain when an explicit aux provider cannot build. This covers the "no client" case before any request is sent: missing raw env key, unavailable OAuth/pool credentials, or provider resolver returning ``(None, None)``. It deliberately stops at the configured per-task fallback chain; the main-agent model remains the last-resort runtime fallback for request-time capacity errors. rB>rr7zprovider unavailabler/)rrrf)rr.explicits r/_try_configured_fallback_for_unavailable_clientrj\sd %2,,..4466H x8x#7#7~ ) %   rc$ddlm}||S)a3Resolve inline or env-backed API key from a fallback-chain entry. Delegates to the centralized, secret-scope-aware resolver so this path doesn't leak another profile's credential via a raw ``os.getenv`` under gateway multiplexing (see ``hermes_cli.fallback_config.resolve_entry_api_key``). r)resolve_entry_api_key)hermes_cli.fallback_configrl)rrls rr^r^rs(A@@@@@  ' ''rct|dpd}t|dpdpd}|r|sdSt|dpdpd}t|}t|dp|dpdpd}t ||||| \}}|( t ||||_n#t$rYnwxYw||fS) z?Resolve one fallback entry through the central provider router.rrBrNrr=rr)rrr7r)rIrJrr^rLrrrK)rrrr=r\rrZrs rr]r]~sj599Z((.B//5577H  '""(b ) ) / / 1 1 9TE 5z599Z((.B//5577?4H%e,,G599Z((HEIIk,B,BHbIIOOQQYUYH4"  FN 2Rv~33F / /    D  > !!s#D:: EEc  ddlm}ddlm}||}n6#t$r)}t d|pd|Yd}~dSd}~wwxYw|sdS|pd}tpd}d ||d fD} g} t|} t|D]#\} } t| tst| d pd}t| d pd}|r|s|}d | d|d}|| vr| |dt#|r)t%||| |d t'| \}}n;#t$r.}t d|pd||d\}}Yd}~nd}~wwxYw|| t)||p|t| dpdt+| pd}|F|| kr@t d|pd||| | |d|d| dt d|pd||pd ||p|||p||fcS| |%| r1t d|pdd| dS)aTry the top-level main-agent fallback chain for an auxiliary call. ``provider: auto`` auxiliary tasks should respect the user's declared main fallback policy before dropping into Hermes' built-in discovery chain. The top-level chain is read through ``get_fallback_chain`` so both modern ``fallback_providers`` and legacy ``fallback_model`` entries participate in the same order as the main agent. rrA)get_fallback_chainz4Auxiliary %s: could not load main fallback chain: %sr>Nr7rBch|]}||Srr)rr4s rr4z+_try_main_fallback_chain..s = = =!1 =A = = =rrrrzfallback_providers[rYrGz (skipped)r5z4Auxiliary %s: main fallback %s failed to resolve: %srr=rzAAuxiliary %s: skipping %s (context=%d < min=%d), continuing chainrZr[u9Auxiliary %s: %s on %s — main fallback chain to %s (%s)z7Auxiliary %s: main fallback chain exhausted (tried: %s)r6)rHrArmrprKrXrxrrrrTr\r$r5rIrJrrrBr]rWr^r?r)rr.r/rArprr failed_norm main_normr8r<rbrcrr%rfb_normr:rrres r_try_main_fallback_chainrus::::::AAAAAA""#7#7#9#9::  KT^U[]`aaa~~~~~ ~"(b//117799K$&&,"3355;;==I = = Y7 = = =DE*400Ge$$**5%&&  %))J//5266<<>> uyy))/R006688 (  ##%%9a99;999 d?? LLE--- . . .  !' * *   . . . LLE/// 0 0 0  3(?(F(F %I~~ 3 3 3 LLOQUQ_Y_afhk l l l(2 %I~~~~~~ 3  "2".h :!6!6!<"==3E::@b  %&7*:*:KK[vwLLE!S!S!S!S!S!S!STTT KKK(A65*(    n8+E E E E U   E NFDIIe,,    >s," AAA'G:: H2$H--H2c2t||||\}}|S)zResolve a single provider entry from fallback_chain to an OpenAI client. Uses the existing provider resolution infrastructure where possible. )rrrr7)rL)rrr=r\rZrs r_resolve_single_providerrws05" FN Mrc Pdat|}|dd}t|dpd}t|dpd}|dd}t|dpd}tstt jdd}|p t} |r;| r9| d kr3| d st d || d at|ptpd} t|ptpd} | d kr t| \} } | r | r | } | } d}d}d}| r| r| dvr| }|pd}d}|r| d kr d }|}|pd}nW| d r>d} ddlm}|| du}n#t $rYnwxYw|r| }d}n|r d }|}|pd}n |r|}n|r|}t#|}|rt%|rt'|n?t)|| |||pd\}}|$td| |p| ||p| fS|rt-|| pdd\}}}|||fSt/|| pdd\}}}|||fSg}t1D]\}}t%|r(t'|||d<|\}}|Y|r3td||pdd|ntd||pd||fcS||t dd|dS)uFull auto-detection chain. Priority: 1. User's main provider + main model, regardless of provider type. This means auxiliary tasks (compression, vision, web extraction, session search, etc.) use the same model the user configured for chat. Users on OpenRouter/Nous get their chosen chat model; users on DeepSeek/ZAI/Alibaba get theirs; etc. Running aux tasks on the user's picked model keeps behavior predictable — no surprise switches to a cheap fallback model for side tasks. 2. OpenRouter → Nous → custom → Codex → API-key providers (fallback chain, only used when the main provider has no working client). FrrBrr=r\rrrrzOPENAI_BASE_URL is set (%s) but model.provider is '%s'. Auxiliary clients may route to the wrong endpoint. Run: hermes model to reconfigure, or remove OPENAI_BASE_URL from ~/.hermes/.envTre>rBrNr_get_named_custom_provider)rr7rz2Auxiliary auto-detect: using main provider %s (%s)rzmain provider unavailablerhr5u4Auxiliary auto-detect: using %s (%s) — skipped: %srr6z$Auxiliary auto-detect: using %s (%s)zAuxiliary auto-detect: no provider available (tried: %s). Compression, summarization, and memory flush will not work. Set OPENROUTER_API_KEY or configure a local model in config.yaml.r)r_rrJrI_stale_base_url_warnedrHrrrrrXrYrXrlrrzrUr5rrBrLr?rfrur.rr)rrrLruntime_provider runtime_modelrrr _env_base _cfg_providerr9rMrNrOrrr7_has_named_entryrzmain_chain_labelrZrrr _fb_labelr<r:r=rs r _resolve_autors6$%l33G{{:r22 G,,233M7;;z228b99kk)R00O7;;z228b99 " *I/44::<< (A,?,A,A  *- *!X--%00;;. NN6=    &* "(G,?,A,AGRHHM]>&6&8&8>B??J$;J$G$G! z  "Z ")M#J "  O! @6*@6\11),4 ' /  9 9!)  0 .6$    % %i 0 0! /$  RRRRRR#=#=m#L#LTX#X       3%2!$(!!! 3%-!$4!#2#:d    3#2  / /  22CDD  6 67G H H 6  0 1 1 1 16!"3!1)1T     FH! P)8+AzCCCx5:55 ')G -)62M*O*O*O& 8Y  h& &%= m%v.I&K&K&K"Ix("" E,..   v !% ( (   & & & LLE/// 0 0 0     _ R!5#5Ityy7G7GIIII BE5K]T]^^^5=  U NNW99U##%%% :sG G#"G# is_visioncddlm}t|trt ||fSt|t rt ||fSt|trt||fS ddl m }m }t||r |||fSn#t$rYnwxYw ddl m}t||r||fSn#t$rYnwxYw|jt!|jd}t!|j}t%|drt'|d<nt%|drdd lm} | d | |d<nt%|d rd di|d<nt%|drt-||d<nzt%|drddlm} | |d<nV ddlm} ddlm} | |} | r+| | }|r|jrt=|j|d<n#t>$rYnwxYwtA|!d}|r||d<itE|d |}|#dd|di||fS)aaConvert a sync client to its async counterpart, preserving Codex routing. When ``is_vision=True`` and the underlying base URL is Copilot, the resulting async client carries the ``Copilot-Vision-Request: true`` header so the request is routed to Copilot's vision-capable infrastructure (otherwise vision payloads silently time out). r) AsyncOpenAI)rAsyncGeminiNativeClientrr_rr3rcopilot_request_headersT is_agent_turnrrvrYrrUrr )_infer_provider_from_urlrrNr^r)$rrr$rDr\rrrrrrrrUrrr\rIr=r4rRrrrWrr agent.model_metadatarrrr3r5rKr>rJr[r`) sync_clientrrrrrr async_kwargs sync_base_urlrr r _gpf_async _inferred _ph_async _merged_asyncs r_to_async_clientrs#"""""+344=(55u<<+788A,[995@@+566?*;77>> [[[[[[[[ k#5 6 6 ?**;77> > ?       ====== k#3 4 4 &% % &      & ,--L ,--M]O<<*:*<*< &'' }.A B BCCCCCC*A*A)+ + + &'' }n = =+79L*M &'' }.H I I*B=*Q*Q &'' }f 5 5======*D*D*F*F &''  E E E E E E D D D D D D00??I V&Jy11 V!:V6:9;T6U6UL!23    D / 0@0@AR0S0STTM8*7 &' $]t D D D L M1--- ; & & & & --s7:$B B-,B-1C CC5AG:: HHrcT|s|S ddlm}|||S#t$r|cYSwxYw)zANormalize a resolved model for the provider that will receive it.r)normalize_model_for_provider)hermes_cli.model_normalizerrK)rrrs rrr sa KKKKKK++JAAA s  '' raw_codexc j*[t|pd} t|}|dkrt |\} } | rs| rq| } t| }| }|r8t |drd}d}|dko|} |s'|dkr!| st|ptp|}dt dt d tffd [ dyd t dt d t f[fd }|dkr^t|| \}}|dS|r(d|vr$|r"d|vrt d||d}|p|}|rt|||n||fS|dkrht|\}}|)tdt!dSt#|p||}|rt|||n||fS|dkr|pF|t$vp+|pddk}t)|\}}|tddSt#|p||}ddlm}||}t t/|ddpd}t t/|ddpd}t1|||||}|rt|||n||fS|dkr|stddSrdt3}|stddSt#||}t5|t6t9| }||fSt;|\}}|tddSt#|p||}|rt|||n||fS|d!krZt=|\}}|td"dSt#|p||}|rt|||n||fS|d#kr2d}d}|rvt?|}|pdptAd$ptC|pd%}|std&dSn|rt |"dpd#d}t |"dpd}|r|r|}|}|rL|rIt#|p|r|"d'ndpd(|}i}tI|\}} | r| |d)<tK|d*rd+d,i|d-<ntK|d.rdd/l&m'}!|!d0|1|d-<nftK|d2rtQ||d-<nC dd3l)m*}"|"|}#|#r|#j+rtY|#j+|d-<n#tZ$rYnwxYwt]|"d-}$|$r|$|d-<t5dz||d4|}|||||}|rt|||n||fSt^t`fD]}%|%\}}|t#|p||}t t/|ddpd}&t/|dd}'tc|'rte|'t sdnt |'pd}(||||&|(}|rt|||n||fcStd5dS dd6l3m4})d}*| r| |kr |)| }*|* |)|}*|*r>|*"dpd}|*"dpd}|*"d7p|*"d8pd}+|s|+rtA|+}|pd%}|d%kr0td9|*"d:p|p|*"d;pd},|rt#|p=|*"d'p(|r|"d'ndptpd(|}|,d|,d}=m?}>n,#tn$rt dI|YdSwxYw|<"|}?|?@|tvr5tA|t dJ|dS|?jBdkr|dKkr[t|\}};|tdLdSt#|p|;|}|rt|||n||fS|=|}@t |@"dd}A|r|p|A}A|As`t|?jE}B|dMkr|BFdNt dO|dPG|BdSt |@"dd#dp|?jH}Ct?|C}D|r4t?|#d}Dt|};t#|p|;|}|dQkrTddRlImJ}EmK}F|F|DrA|E|A|D4}t dS|||rt|||n||fSi}GtK|Dd*rd,|Gd+<ntK|Dd.r'dd/l&m'}!|GL|!d0|1ntK|Dd2r#|GLtQ|DnztK|DdTr$ddUlMmN}H|GL|HnF dd3l)m*}I|I|}J|Jr!|Jj+r|GL|Jj+n#tZ$rYnwxYwt]|G}K|Kr|K}Gt5dz|A|Dd4|Grd-|Gini}|dMkrR|rPsN ddVlOmP}L|L|r+t dW|tu||}n#tn$rYnwxYw||||C|A}t dS|||rt|||n||fS|?jBdXkr|>|}@t#|p&|r|"d'ndp t|}|dYkrLt |@"dd}At |@"dd}Dt |@"dZdpd}Mt|@"d[pg}N|std\dS|Ar|Dstd]dSdd^lQmR}O|O|A|D|M|N_}t dS|||rt|||n||fS|tvr5tA|t d`|dS|?jBdakr ddblTmU}PmV}Qn+#tn$rtdcYdSwxYw|Qst dddS|P\}R}D|Rr|DstdedSdf};t#|p|;|} ddglWmX}S|S|R|D4}n3#tZ$r&}Ttdh|TYd}T~TdSd}T~TwwxYwt di||rt|||n||fS|?jBdjkrF ddklYmZ}Um[}Vm\}Wddll5m]}Xn+#tn$rtdmYdSwxYw|Ust dndS|W}Ydo};t#|p|;|}dp|Ydq}D|V|rp |X|Y}4n3#tn$r&}Ttdr|TYd}T~TdSd}T~TwwxYwtq|4|ds|D4}t dt||Yn,t|Y|}t du||Y|rt|||n||fS|?jBdvvr|dkrtd||S|dkrtd||S|d!krtd!||S|tvr5tA|t dw|dS|?jB|f}Z|Ztvr;tA|Zt dx|?jB|dS){uCentral router: given a provider name and optional model, return a configured client with the correct auth, base URL, and API format. The returned client always exposes ``.chat.completions.create()`` — for Codex/Responses API providers, an adapter handles the translation transparently. Args: provider: Provider identifier. One of: "openrouter", "nous", "openai-codex" (or "codex"), "zai", "kimi-coding", "minimax", "minimax-cn", "custom" (OPENAI_BASE_URL + OPENAI_API_KEY), "auto" (full auto-detection chain). model: Model slug override. If None, uses the provider's default auxiliary model. async_mode: If True, return an async-compatible client. raw_codex: If True, return a raw OpenAI client for Codex providers instead of wrapping in CodexAuxiliaryClient. Use this when the caller needs direct access to responses.stream() (e.g., the main agent loop). explicit_base_url: Optional direct OpenAI-compatible endpoint. explicit_api_key: Optional API key paired with explicit_base_url. api_mode: API mode override. One of "chat_completions", "codex_responses", or None (auto-detect). When set to "codex_responses", the client is wrapped in CodexAuxiliaryClient to route through the Responses API. Returns: (client, resolved_model) or (None, None) if auth is unavailable. rBrezmoa://Nrr base_url_str model_strrct|trdSrdSdkrdSrdkrdSt|dkr|pd}d|vrdSdS)a(Decide if a plain OpenAI client should be wrapped for Responses API. Returns True when api_mode is explicitly "codex_responses", or when auto-detection (api.openai.com + codex-family model) suggests it. Already-wrapped clients (CodexAuxiliaryClient) are skipped. FrTapi.openai.comrBr)r$rDr5r)rrr model_lowerrrs r_needs_codex_wrapz2resolve_provider_client.._needs_codex_wraps j"6 7 7 5  5 ( ( (4  $5555 \ * *.> > >$?1133K+%%turfinal_model_str api_key_strc|||r;tdpd||r |ddndt||St||||S)a@Wrap a plain OpenAI client in the correct transport adapter. Handles two cases: - ``CodexAuxiliaryClient`` when the endpoint needs the Responses API (explicit ``api_mode=codex_responses`` or api.openai.com + codex model name). - ``AnthropicAuxiliaryClient`` when the endpoint speaks Anthropic Messages (explicit ``api_mode=anthropic_messages``, any ``/anthropic`` suffix, ``api.kimi.com/coding``, or ``api.anthropic.com``). Clients that are already specialized wrappers pass through unchanged. zeresolve_provider_client: wrapping client in CodexAuxiliaryClient (api_mode=%s, model=%s, base_url=%s)rNrrB)rXrxrDr)rrrrrrs r_wrap_if_neededz0resolve_provider_client.._wrap_if_neededs  Z G G E LL7+O_%19 SbS!!r  ; ; ; ( ODD D% lH   rrrrrz\Dropping OpenRouter-format model %r for non-OpenRouter auxiliary provider (using %r instead)rrB)r7z4resolve_provider_client: openrouter requested but %sz mimo-v2-omnirHzYresolve_provider_client: nous requested but Nous Portal not configured (run: hermes auth)r nous_api_moder\r=rzresolve_provider_client: openai-codex requested without a model; pass model explicitly (e.g. model.model in config.yaml or auxiliary..model for per-task aux routing).zbresolve_provider_client: openai-codex requested but no Codex OAuth token found (run: hermes model)r:ruresolve_provider_client: xai-oauth requested but no xAI OAuth token found (run: hermes model -> xAI Grok OAuth — SuperGrok / Premium+)rrrzQresolve_provider_client: explicit custom endpoint requested but base_url is emptyrrrrvrYrr3rrTrrUrr_zPresolve_provider_client: custom/main requested but no endpoint credentials foundrykey_env api_key_envuresolve_provider_client: named custom provider %r has no resolvable api_key — request will be sent with placeholder no-key-required and will 401 on auth-required endpointsrrr}zCresolve_provider_client: named custom provider %r (%s, api_mode=%s)rruNamed custom provider %r declares api_mode=anthropic_messages but the anthropic SDK is not installed — falling back to OpenAI-wire.FrrzAresolve_provider_client: named custom provider %r has no base_urlrrzsresolve_provider_client: azure-foundry requested but runtime resolution failed (run: hermes doctor for diagnostics))rr-resolve_external_process_provider_credentialsz-hermes_cli.auth not available for provider %sz,resolve_provider_client: unknown provider %rrzOresolve_provider_client: anthropic requested but no Anthropic credentials foundrz gh auth tokenzJresolve_provider_client: provider %s has no API key configured (tried: %s)r6rrz resolve_provider_client: %s (%s)rr )!_should_use_copilot_responses_apiudresolve_provider_client: copilot model %s needs Responses API — wrapping with CodexAuxiliaryClientexternal_processrcommandr zVresolve_provider_client: copilot-acp requested but no model was provided or configuredz^resolve_provider_client: copilot-acp requested but external process credentials are incompleter)r\r=rr zLresolve_provider_client: external-process provider %s not directly supportedr)rhas_vertex_credentialszGresolve_provider_client: vertex requested but google-auth not installedzFresolve_provider_client: vertex requested but no GCP credentials foundzTresolve_provider_client: vertex requested but could not mint token / resolve projectzgoogle/gemini-3-flash-previewrz8resolve_provider_client: cannot create Vertex client: %sz$resolve_provider_client: vertex (%s)aws_sdk)has_aws_credentialsis_anthropic_bedrock_modelresolve_bedrock_region)build_anthropic_bedrock_clientzSresolve_provider_client: bedrock requested but boto3 or anthropic SDK not installedzGresolve_provider_client: bedrock requested but no AWS credentials foundz(anthropic.claude-haiku-4-5-20251001-v1:0rrz9resolve_provider_client: cannot create Bedrock client: %srz3resolve_provider_client: bedrock anthropic (%s, %s)z2resolve_provider_client: bedrock converse (%s, %s)>oauth_externaloauth_device_codezMresolve_provider_client: OAuth provider %s not directly supported, try 'auto'z6resolve_provider_client: unhandled auth_type %s for %srBrBr)brrrrrlrIrrrnrnrrXrxrr@rYrBrr!rrNhermes_cli.providersrrorrrarrrrrr{rrsrJrxrr4rrrWrrr3r5rKr>r r'ryr$rrzrhrrUrrrDrrrrrr9r5rrrapi_key_env_varsrrrrrrr6rr rrrrr;rrrrrrrrrrrrLr<r:)\rrrOrrr7rrrroriginal_providerrNrO_nous_portal_visionrrZrrr _is_visionr portal_moderrr raw_clientrr _main_base _main_keyr rrr _gpf_custom _ph_custom_merged_customr=_cbase _raw_ckey_ckeyrz custom_entrycustom_key_enventry_api_moderraw_base_for_wrap _clean_base2_dq2_extra2 _headers2rr_fallback_base _fb_clean_fb_dq _fb_extra _fb_headerssync_anthropic default_modelrrrrrr\ tried_sourcesrr=rrr.r  _gpf_main_ph_main _merged_mainrrr rrrrrrrrrrr_auth_dedup_keyrs\ ` ` @rrLrLsT "R..006688&x00H5$;E$B$B! z  (Z ( - 3 3 5 5 ; ; = = .}==HE! (S):%;%;%A%A%C%C%N%Nx%X%X ($(!#' b#f,: ]X''0C'+H55\9Q9S9S\W\CCD,OQ+-  S  %(       86(lNNN >:  SE\\h\3h3F3F LL89> J J JE'x NX+  JJJJk* ,<);KLLL > NNF022   :/0@(KK NX+  JJJJk* ,6  ?/66888 ? ""$$**,,>  $:666 > NNO P P P:/0@(KK  766666#mK00 '&)R88>B?? 76:r::@bAA & KlK  OY+  JJJJk* ,>!!  NNG    :  -344K " TUUU!z3E8DDK.#, 9+ F FJ  , ,-e44 > NNP Q Q Q:/0@(KK NX+  JJJJk* ,;5e<< > NNc   :/0@(KK NX+  JJJJk* ,8   '-.?@@FFHHK!'R..00%"#344%2;??%%   ","z  "  '\--j99?R@@FFHHOOPSTTJL,,Y77=2>>DDFFI 'i '( & " 0:" 03_|M,**7333_R_KE8EE K -),o&$[.AA ,8:M+N'((&{4GHH KKKKKK+B+B"&),,,'(('{4NOO +CK+P+P'((MMMMMM!,X!6!6J!Tj&@T37 8R3S3S/0 D8CT9U9UVVN :+9'(*]: ]]W\]]F$_V[+zRRFR\/$V[INNNN +. 0,-FG 4 4F$fhhOFG!78H(SS WVZ<<BCC$FIr:: ' 22p:iQT;U;Up\_`i`omo\p\p(feLLV`3( RRRR$k2444" ; < < <zk JJJJJJ  I!2h!>!>556GHHL  55h??L [ '++J77=2DDFFK&**955;BBDDJ*..y99b\=M=Mm=\=\b`biikkN =. =,^<< #8'8J...>!$$V,,8 'L,*:*::*F*FL"SSUUNF 47%#''00%5AK ((111t%011%%  "%999"-K(3%%"5k"B"BK(3%%>{%K%K" d59A?D11r7 DU8V8VWW ;1:G-. Yk>+O=OQQQ "%999<RRRRRR&<&#[*kTY&&&N"Z<^LLkYY);66.dzLdd\cdd "%666z0@@62&+FFFF,_V[BSU_``FV`3( RRRR$k24 NNS   :w[ x      &?"" 2-/ ! ! !  > NN    :/0FQQ NX+  JJJJk* ,            DhOOOzz ##H--G 8 8 8 ) - -h 7 7 7 LLG R R RzI%% { " "$2DT$U$U$U !FM~pqqq!z3E4J]HUUKR\w$V[INNNNcikvbw x44X>>eii 2..//5577  :&,,..9'G  !9::M9$$$$_555 LL6!499]#;#; = = =:599Z4455;;==DDSIIgWMg &|44  R*+<+B+B+D+D+K+KC+P+PQQH3H== /0FQQ x   a a a a a a a a((22 4++GhOOO ?;WWWV`3( RRRR$k24 > : : $7GL ! ! "8-@ A A  G G G G G G NN22"i    #8-G H H  NN3H== > > > > "8V 4 4  A A A A A A NN5577 8 8 8 8  GGGGGG$9X..= 8=NN8#;<<<    27;;  #"G&MwMM;BJ-w77MM y [   OOOOOO44[AAGLLO#%%%2&+FFF    !lGLL 7;OOONX+  JJJJk* ,...==hGG/  *-9C   )))t *'))    } $ $%))Ir223399;;G599Z4455;;==H%))Ir223399;;CtG &))/R00D "1"z "( "9"z A A A A A A%%! F LL;X{ S S SR\/$V[INNNN +. 0 ; ; ; , 0 0 : : : LL./7 9 9 9z  h & &   V V V V V V V V V    NN7 8 8 8::  &%''  LL4 5 5 5:++--x H  NND E E E:7 /0FQQ   % % % % % %VEH===FF    NN(), . . .:::::   ;[IIINX+  JJJJk* ,  i ' '            O N N N N N N    NNB C C C::  #"$$  LL4 5 5 5:''))B /0FQQ DfDDD % %k 2 2 . "<5*MM M { " "*;zJJ J 9 9 9 * . .x 8 8 8 LL:;C E E Ez ((3O==='++O<<< M& 2 2 2 :s"1Y Y! Y!!Hl *f=<l =Bil i)l l A l -l ll n %n43n4;4|00 |=<|=3<~00 ~=<~=G0AG9G9$AH!H AH!J AJ J AKJ*AK K AKLAL$L$$AM M AM N% AN1N1 AO!N;AOOAO!cZt|pd\}}}}}t||||||S)aRReturn (client, default_model_slug) for text-only auxiliary tasks. Args: task: Optional task name ("compression", "web_extract") to check for a task-specific provider override. Callers may override the returned model via config.yaml (e.g. auxiliary.compression.model, auxiliary.web_extract.model). N)rrr7rr_resolve_task_provider_modelrLrrrrr=r\rs rget_text_auxiliary_clientr3sM4PPTP\X\3]3]0HeXw "" !    rc \t|pd\}}}}}t||d||||S)aReturn (async_client, model_slug) for async consumers. For standard providers returns (AsyncOpenAI, model). For Codex returns (AsyncCodexAuxiliaryClient, model) which wraps the Responses API. Returns (None, None) when no provider is available. NTrrOrr7rrrrs rget_async_text_auxiliary_clientrLsP4PPTP\X\3]3]0HeXw "" !   r)rBr deepinfrac ddlm}ddlm}n#t$rYdSwxYw ||||}n#t $rYdSwxYw|dSt |S)uReturn True when ``provider``/``model`` is known to accept image input. Used by the vision auto-detect chain to skip the user's main provider when it's known to be text-only (e.g. DeepSeek, gpt-oss without vision). Without this guard, ``resolve_vision_provider_client(provider="auto")`` would happily return the main-provider client and any subsequent image payload would surface as a cryptic provider-side error (``unknown variant `image_url`, expected `text```, #31179). Returns True when capability lookup is unknown — preserves the historical behaviour of attempting the call, so providers we haven't catalogued yet don't silently regress to text-only. r)_lookup_supports_visionrAT)agent.image_routingrrHrArUrKrn)rrrrAsupportss r_main_model_supports_visionrfs??????::::::: tt**8U>s  7 AAc t|Sr)rrs r_normalize_vision_providerrs "8 , ,,rct|}|dkrtd|dS|dkrt|S|dkrtd|dS|dkrtd|dS|dkrtS|d krA|pt d }|st d d Std |dS|d krtSd S) NrTrrBr*rrrrubVision auto-detect: deepinfra catalog unreachable or returned no vision-tagged models — skippingrr)rrLr@rr&rXrxr )rr vision_models r_resolve_strict_vision_backendrs$*(33H9&y%4HHHH<U++++6'vuEEEE>!!'~uMMMM;;M @ M M   LL@   :&{LDQQQQ8#%%% :rc0t|dduSrR)rrs r _strict_vision_backend_availablers )( 3 3A 6d BBrc^g}t}|rh|dvrd|tvr%t|r||n6t |t \}}|||tD]*}||vr$t|r||+|S)uReturn the currently available vision backends in auto-selection order. Order: active provider → OpenRouter → Nous → stop. This is the single source of truth for setup, tool gating, and runtime auto-routing of vision tasks. >rBr)r_VISION_AUTO_PROVIDER_ORDERrrrLrX) availabler9rZr%r4s rget_available_vision_backendsrsI'))M0l:: 7 7 7/ >> 0  //// ?O?Q?QRRIFA!  /// (   I  "B1"E"E    Q    r)r=r\rOrc #t|}td||||\}#}} } t|}dtdtdt tf#fd } |r/|r|dvr|nd} t | #|| | |\} }| | d d fS| | |fS|d krt|d p t}t|d p t}| d kr8t|\}}|r$|r"||}}t|}d|d<d|d<d|d<|r|dvrt|}|p|}|dkrFt|#p|\}}|-t d||p#p|| |||Sn"|t$vrt d|nt)||st d|nd }d }| }|dks|drh|d}|r3|}|dpd }| p|dpd }nt-\}}}|r |}|}| p|pd }t ||||||d\}}|-t d||p|| |||p|St.D],} | |kr t| \}}|| | ||cS-t ddS|t.vr t|#\}}| |||S|dkr\|sZddg}!|!D]/}"t1|#|"| pd d|d \} }| | || |cS0t1|#| |d!\} }| |d d fS|| |fSt1|#| |d!\} }| |d d fS|| |fS)"arResolve the client actually used for vision tasks. Direct endpoint overrides take precedence over provider selection. Explicit provider overrides still use the generic provider router for non-standard backends, so users can intentionally force experimental providers. Auto mode stays conservative and only tries vision backends known to work today. rCrrrc\||ddfSp|}rt||d\}}|||fS|||fS)NTr)r)rrrr async_client async_modelrOrs r _finalizez1resolve_vision_provider_client.._finalizes]  $dD0 0$5  @(8k]a(b(b(b %L+$lK? ? +{::r>rBrrrNrrrrerBr=r\r>rBrerrz/Vision auto-detect: using main provider %s (%s)uiVision auto-detect: skipping main provider %s (no vision support) — falling through to aggregator chainutVision auto-detect: skipping main provider %s (reports no vision capability) — falling through to aggregator chainrT)rrr7rrz'Auxiliary vision client: none availablerrz$https://open.bigmodel.cn/api/paas/v4zhttps://api.z.ai/api/paas/v4rr=r\rrr)rrr)rrrrIrr rLrJrrXrrrlr5r&rrXr?r'rxrrrrr)$rrr=r\rOrrLrrrrrprovider_for_base_overriderZrr9rMrNrOprovider_vision_defaultrrr rpc_base_url rpc_api_key rpc_api_moderrrr rpc_client rpc_modelrizai_openai_urls_zai_urlrs$ ` @rrrs &l33GXt(E8WYYUI~02BDU+955I;S;s;8TW=;;;;;;;?" Ry 'D'DII( #6 & !/-&      >-tT9 9)6;>>F$GKK 33L7J7L7LMM W--C1A1C1CDD    & & ( (E 1 1)@ (K(K %M: ) ),9:z w--&( #%' "&( # c N]2EEE'G}&U&U #2@jL&&.L!>#L5L..* ]*KKI%}'T'T*%9]KOOO + ";;; N! 1 MM< N '"  $ " 0  H,, 0H0H0S0S,'.{{:'>'>$'T'7 &-kk)&<&<&D -$&{{:66$#% @W?X?X< Z&T+6L*4K+<+S +StL(?!<)&2%0!(" )$)$)$% I)KKI%y'@L%9%z93L NNN 5 H HIM)))G )R)R &K& yKGGGGG'  >???///%C ~& & " ]yK??? E"3 2 * ( A AH"4>:!(0D+$ ### FK! yFK@@@@@"1NJ:K>E;?AAA  >dD( (&+--,Y 6G:A7;===FK~$$$ fk ))rc0trtniS)zReturn extra_body kwargs for auxiliary API calls. Includes Nous Portal product tags when the auxiliary client is backed by Nous Portal. Returns empty dict otherwise. )r_r^rrrget_auxiliary_extra_bodyrs "3 :    :rr*r=ct}td}t|pd}|s3t%|dks|dks|drd|iSt |rd|iSd|iS) uReturn the correct max tokens kwarg for the auxiliary client's provider. OpenRouter and local models use 'max_tokens'. Direct OpenAI with newer models (gpt-4o, gpt-4.1, gpt-5+, o-series) requires 'max_completion_tokens'. The Codex adapter translates max_tokens internally, so we use max_tokens for it as well. Pass ``model`` so third-party OpenAI-compatible endpoints fronting the newer families are also recognised — URL-only detection misses the case where a custom base URL serves e.g. ``gpt-5.4``. r;rBNrrz.githubcopilot.comrrrq)rrr5rryr7)r=rrr? _custom_hosts rauxiliary_max_tokens_paramrs+,,K 1 2 2F%[117RL 0!!) 000#:::(()=>>;(//)%000'// %  rr@cNeZdZdZdZdeddfdZdefdZde de fd Z de fd Z dS) _CallableCacheDiscriminatorzBHash a credential callback by identity without exposing its state. _callbackrrNc||_dSrr )rrs rrgz$_CallableCacheDiscriminator.__init__s !rc*t|jSr)rr r(s r__hash__z$_CallableCacheDiscriminator.__hash__s$.!!!rothercHt|to |j|juSr)r$r r )rrs r__eq__z"_CallableCacheDiscriminator.__eq__ s& u9 : : 2%/1 rcdS)Nzrr(s rr)z$_CallableCacheDiscriminator.__repr__s##r)r*r+r,r-r.rrgrLrobjectrnrrIr)rrrr r sLLI"""""""#"""" F t    $#$$$$$$rr c|dkrt|rt|S|dkrVt|trA|r?t j|dd}d|fS|S)z;Return a hashable, secret-safe runtime cache-key component.r\r) digest_sizezapi-key-digest)ryr r$rIhashlibblake2bencodedigest)rr=rs r_runtime_cache_discriminatorrs huoo*5111 j44g!6!6BGGGNNPP &)) Lr)r=r\rrrrrc  t||dkr tfdtDnd} |dkr|pdnd} t||} |pdd} t d|pd} |||pd| |pd| || | | f S)Nrc3`K|](}t||dV)dSrBN)rrJrs rrz$_client_cache_key..+sO  %UGKKr,B,BCCrrrBrrr\)rrrrrJr)rrOr=r\rrrrr runtime_keytask_key pool_hint model_key api_key_keyrLs @r_client_cache_keyr&s&l33G V  )"$ (611 rH  EEEI1Wb11I.y'-RHHK j(.b+x~2{\egoqz}F GGr bound_loop cache_keyrr(ct5t|}||d|urt|d|||ft|<ddddS#1swxYwYdSrR)rrrJr)r)rZrr( old_entrys r_store_cached_clientr,Bs GG!%%i00  Yq\%?%? 1 . . .$*M:#F i GGGGGGGGGGGGGGGGGGsA AA"%A"rcache_providerc Jtd}|d|fS|\} } t| | } |} d} |rB ddl}|} n#t$rYnwxYwt | | pd|\}} n| }t |||||||| }t||| | || fS) zLRefresh Nous runtime creds, rebuild the client, and replace the cache entry.TrNr_rrBr)rOr=r\rrrrr')rrarTget_event_looprrr&r,)r-rrOr=r\rrrrL fresh_keyfresh_base_urlrr current_loop_aiorZr)s r_refresh_nous_auxiliary_clientr4Js (d;;;GU{ 'I~' NSSSKKL  " " " "..00LL    D .{K.strN)openai._base_clientr7__del__rUrVr6s rneuter_async_httpx_delr;wsR4 ??????*;*;'''  (     s ''c ddlm}t|dd}|t|dds|j|_dSdSdS#t $rYdSwxYw)uMark the httpx AsyncClient inside an AsyncOpenAI client as closed. This prevents ``AsyncHttpxClientWrapper.__del__`` from scheduling ``aclose()`` on a (potentially closed) event loop, which causes ``RuntimeError: Event loop is closed`` → prompt_toolkit's "Press ENTER to continue..." handler. We intentionally do NOT run the full async close path — the connections will be dropped by the OS when the process exits. r) ClientStaterN is_closedT) httpx._clientr=roCLOSED_staterK)rZr=inners r_force_close_async_httpxrCs ------ 400  WUK%F%F &-ELLL          s6> A  A c|dSt| t|dd}t|r tj|s|dSdSdS#t $rYdSwxYw)zBApply the canonical best-effort close policy to one cached client.Nr)rCroryinspectiscoroutinefunctionrK)rZr3s rrrs ~V$$$ 67D11 H   g&A(&K&K  HJJJJJ          s>A A'&A'ct5ttD]\}}|d}|t | tddddS#1swxYwYdS)zClose all cached clients (sync and async) to prevent event-loop errors. Call this during CLI shutdown, *before* the event loop is closed, to avoid ``AsyncHttpxClientWrapper.__del__`` raising on a dead loop. rN)rrrrrr)r<rrZs rshutdown_cached_clientsrHs }224455 ) )JC1XF~  ( ( ( ( sA A55A9<A9c$t5g}tD]E\}}|\}}}|8|r$t |||F|D] }t|= ddddS#1swxYwYdS)uKForce-close cached async clients whose event loop is closed. Call this after each agent turn to proactively clean up stale clients before GC can trigger ``AsyncHttpxClientWrapper.__del__`` on them. This is defense-in-depth — the primary fix is ``neuter_async_httpx_del`` which disables ``__del__`` entirely. N)rrrr>rCr)rr<rrZ_default cached_loops rcleanup_stale_async_clientsrLs ## '--// ' 'JC,1 )FHk&;+@+@+B+B&(000!!#&&& # #Cc"" ###################sA/BB  B c |t|ddt|ddfD]5}|r1ttt|ddpddrdS6dS)NrrZr=rBrTF)ror4rI)rZr%s r_is_openrouter_clientrNsr 488'&(TX:Y:YZ  (WS*b-I-I-OR)P)PRabb 44 5rcached_defaultcJt|rdSt|od|vS)zFBest-effort check for cached clients that accept ``vendor/model`` IDs.Tr)rNrn)rZrOs r#_cached_client_accepts_slash_modelsrQs/V$$t 83.#8 9 99rc:|rd|vrt||s|S|p|S)zKeep slash-bearing model IDs only for cached clients that support them. Mirrors the guard in resolve_provider_client() which is skipped on cache hits. r)rQ)rZrrOs r _compat_modelrSs5  &I&R`&a&a  "N"rc >d} |r* ddl} | } n#t$rYnwxYwt|} t ||||||||| } t 5| t vrt | \} }}|rX|duo|| uo| }|r!t| ||}| |fcdddSt| t | =n!t| ||}| |fcdddSdddn #1swxYwY|}|s1tt|}|t|}|r|}t||||||| || \}}|| }t 5| t vrqtt tkrFt!t#t }t |=tt tkF|||ft | <n"|}t | \}}}t%|dddn #1swxYwY||p|fS)aGet or create a cached client for the given provider. Async clients (AsyncOpenAI) use httpx.AsyncClient internally, which binds to the event loop that was current when the client was created. Using such a client on a *different* loop causes deadlocks or RuntimeError. To prevent cross-loop issues, the cache validates on every async hit that the cached loop is the *current, open* loop. If the loop changed (e.g. a new gateway worker-thread loop), the stale entry is replaced in-place rather than creating an additional entry. This keeps cache size bounded to one entry per unique provider config, preventing the fd-exhaustion that previously occurred in long-running gateways where recycled worker threads created unbounded entries (#10200). Nr)rOr=r\rrrrr)rr7rrrr)rTr/rrr&rrr>rSrCrrrrLrj_CLIENT_CACHE_MAX_SIZEnextiterr)rrrOr=r\rrrrr2r3rLr) cached_clientrOrKloop_ok effectiveeffective_api_key_pe_pkrZrr( evict_key built_clientr%s rrrsr>L  " " " "..00LL    D %l33G!!    I 00  % %9Fy9Q 6M>; 0  t+4#|34'11333 4 -mUN S SI()300000000 )777!),,)-OO $i/)000000000000000000000006  (6x@@AA ?',,C ($'!3 "*    FM"  3 3 ---((,BBB $T-%8%8 9 9I%i0-((,BBB-3M:+N i((% +8+C( q%\222# 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3$ 5)M ))s8 ,,AC?:,C??DD%BHHHrzhttps://api.openai.com/v1_AUX_DIRECT_API_BASE_URLSc d}d}d}d}d} |rt|} t| ddpd}t| ddpd}t| ddpd}t| ddpd}|s^t| dp| dpd} | rt | pd}t| d dpd} |r|d krd}|r|d krd}|p|} | } d td t td ttt tffd}|ret|dkr.||| \}} |r|dkrd}d}nh|rft|dkr/||| \}}|r|dkr|} d}d}d t tdt td tt tt tffd}d t td tfd}|r|||\}}|r|||\}}|r|d kr|s|r |d|fvr|}|s|}|r||r|| ||| fS|rd| ||| fS|r|| ||| fS|r2|r |rd| ||| fS|r|r |d kr|| |d| fS|r |d kr|| ||| fSd | dd| fSd | dd| fS)adDetermine provider + model for a call. Priority: 1. Explicit provider/model/base_url/api_key args (always win) 2. Config file (auxiliary.{task}.provider/model/base_url) 3. "auto" (full auto-detection chain) Returns (provider, model, base_url, api_key, api_mode) where model may be None (use provider default). A bare base_url is treated as custom, but a first-class provider plus base_url keeps the provider identity so its auth, transport, and request-shaping behavior still apply. api_mode is one of "chat_completions", "codex_responses", or None (auto-detect). NrrBrr=r\rrrrrmdlrc|dkr||fSt|\}}|r|r||fS||fS)Nre)rrrl)rrbrjrks r_unwrap_moa_providerz:_resolve_task_provider_model.._unwrap_moa_providersa ::<<    5 ( (9 "9#">"> i  +I +* *Syrre existing_basec|s||fSt|}|||fSd|p|fS)Nr)r`rJrr)rre target_bases r_expand_direct_api_aliasz>_resolve_task_provider_model.._expand_direct_api_aliass] '& &/33DJJLL4F4F4H4HII  & &5+55rct|pd}|dvs|drdS ddlm}||duS#t $r|dvcYSwxYw)NrB>rBrrrFr) get_provider> qwen-oauthrrrrrr minimax-oauth)rIrrrrrjrK)rrrjs r _preserve_provider_with_base_urlzF_resolve_task_provider_model.._preserve_provider_with_base_urls__**,,2244 / / /:3H3H3S3S /5  9 9 9 9 9 9< ++47 7    "     sA%%A65A6r) rrIrJrrrr r rn)rrrr=r\r$r=r% cfg_api_key cfg_api_moder_ cfg_key_envrrrdrhrms rrr|s(LILKL L066 ;??:r::;;AACCKt  4455;;==E ;??:r::;;AACCKt +//)R8899??AAIT  C **Rkoom.L.LRPRegg  C-k::Bd ;??:r::;;AACCKt  &((Y__&&&00 'iN$3Xc]uS(SV-EW?XCMM''))//11U::#7#7.#Q#Q .  ((E11HG #l++113399;;uDD"6"6|^"T"T i  L..00E99&NLK6x}6Xc]6W\]efi]jltuxly]yWz6666x},J55hII(Z%=%=lL%Y%Y" l"H&&x&L&\^bdl]mMmMm "!GN44X>>N74/@ @@r>@gr@c`|siS ddlm}|}n#t$ricYSwxYwt|tr|dini}t|tr||ini}t|tsi} ddlm}|D]q}|d|krV|dpi}t|tr(t |}|||cSnrn#t$rYnwxYw|S)uReturn the config dict for auxiliary., or {} when unavailable. For plugin-registered auxiliary tasks (see :meth:`hermes_cli.plugins.PluginContext.register_auxiliary_task`) the plugin's declared *defaults* are layered underneath the user's config so an unconfigured plugin task still works: plugin defaults ← config.yaml auxiliary. (user wins) Built-in tasks ignore this path (their defaults live in DEFAULT_CONFIG). rrAr-)get_plugin_auxiliary_tasksr<defaults) rHrArUr$r5rJhermes_cli.pluginsrsr6rK) rrArCauxr_rs_entry _defaultsr;s rrr;s  ::::::%%''  )3FD)A)A I&**[" % % %rC'1#t'<'<D#''$###"K k4 ( (  AAAAAA0022  Fzz%  D(("JJz228b i.."!)__FMM+...!MMM )       s% &&A>DD D+*D+rc|s|St|}|d}|' t|S#ttf$rYnwxYw|S)zPRead timeout from auxiliary.{task}.timeout in config, falling back to *default*.r)rrJrMrr)rrr_rs r_get_task_timeoutrzgsm ,T22K //) $ $C  :: I&    D  Ns;AArcf||nt|}||dkrt|t}|S)uVResolve the effective timeout for an auxiliary LLM call. Uses the caller-provided ``timeout`` when given; otherwise reads ``auxiliary.{task}.timeout`` from config via :func:`_get_task_timeout`. For the ``compression`` task only, applies a bounded floor so a reasoning model summarising a large context is not cut off by the default timeout (#54915). The floor is intentionally skipped when the caller passes an explicit ``timeout=`` — explicit per-call deadlines are always honoured — and it is a minimum (``max``), so a config value already above it is kept. NrS)rzr"_COMPRESSION_TIMEOUT_FLOOR_SECONDS)rrrZs r_effective_aux_timeoutr}us@#.4Ed4K4KI4=00 #EFF rct|}|d}t|trt|ni}d|vrs|d}|\|dkrV|dvrtd||Sdd lm}||}|||d<ntd |||S) uRead auxiliary..extra_body and return a shallow copy when valid. Also folds in ``auxiliary..reasoning_effort`` as an ``extra_body.reasoning`` config dict ({"enabled": ..., "effort": ...}) when set. An explicit ``extra_body.reasoning`` in config wins over the ``reasoning_effort`` shorthand (it is the more specific wire control). Downstream, each wire already translates ``extra_body.reasoning``: chat.completions passes it through, the Codex Responses adapter maps it to top-level ``reasoning``/``include``, and the Anthropic auxiliary client maps it to ``build_anthropic_kwargs(reasoning_config=...)``. MoA tasks are excluded by design: reasoning depth for MoA is a per-slot setting in the MoA preset (``moa.presets..reference_models[]. reasoning_effort`` / ``aggregator.reasoning_effort``), not an auxiliary-task knob — an ensemble-wide value would override the per-slot ones. rrreasoning_effortNrB) moa_referencemoa_aggregatoruauxiliary.%s.reasoning_effort is not supported — MoA reasoning depth is per-slot: set reasoning_effort on the preset's reference_models entries / aggregator instead (moa.presets....). Ignoring.r)parse_reasoning_effortuxauxiliary.%s.reasoning_effort %r is not a valid level (none, minimal, low, medium, high, xhigh, max, ultra) — ignoring)rrJr$r5rXrYhermes_constantsr)rr_rrrrrs r_get_task_extra_bodyrs$-T22K //, ' 'C$S$// 7T#YYYRF&  !344  &B,,:::9  ? ? ? ? ? ?++F33F!&,{##Y& Mr_aux_sync_semaphores_aux_async_semaphoresc|r|dkrdSt|d}|dS t|}n#ttf$rYdSwxYw|dkr|ndS)zGReturn ``auxiliary..max_concurrency`` as a positive int, or None.rCNmax_concurrencyr)rrJrLrr)rrr=s r_get_task_max_concurrencyrs 48##t $T * * . ./@ A AC {tC z "ttAII554'sAAAc&t|}|dSt5t|}| |d|kr.t j|}||ft|<|cdddS|dcdddS#1swxYwYdS)zCGet a per-task sync semaphore, rebuilding it after a config change.Nrr)r _aux_sem_lockrrJrBoundedSemaphore)rlimitr semaphores r_acquire_sync_aux_semaphorers %d + +E }t $((.. =E!H--!2599I*/);  &  Qx sA B2BB  B ct|}|dSddl} |}n#t$rYdSwxYw|t |f}t 5t |}| |d|kr/||}||ft |<|cdddS|dcdddS#1swxYwYdS)zCGet a per-task, per-event-loop async semaphore after config lookup.Nrr) rrTget_running_looprrrrrJ Semaphore)rrrTloopr<rrs r_acquire_async_aux_semaphorersS %d + +E }tNNN'')) tt D C %))#.. =E!H--))%00I*/); !# &  Qx s%. <<A C/CC Cct5ttddddS#1swxYwYdS)z%Drop cached semaphores (test helper).N)rrrrrrr_reset_aux_semaphoresrs &&""$$$##%%%&&&&&&&&&&&&&&&&&&s3AA A >minimaxrrlcL|tvrdS|pd}d|vS)zDetect if an endpoint expects Anthropic-format content blocks. Returns True for known Anthropic-compatible providers (MiniMax) and any endpoint whose URL contains ``/anthropic`` in the path. TrBrt)_ANTHROPIC_COMPAT_PROVIDERSr)rr= url_lowers rrrs5 ...tR&&((I 9 $$rc g}|D]]}|d}t|ts||Cg}d}|D]}|ddkr|dpidd}|drv|d\}} } d } d |vr:d |vr6|d d d d d d } |dd| | ddn|dd|ddd}|ddkr|dpidd} | drv| d\}} } d} d |vr:d |vr6|d d d d d d } |dd| | ddn|dd| ddd}||||ri|d|in|_|S)asConvert OpenAI ``image_url``/``video_url`` blocks to Anthropic format. Converts: - ``image_url`` blocks to Anthropic ``image`` blocks - ``video_url`` blocks to Anthropic ``video`` blocks (MiniMax M3 compat) Only touches messages that have list-type content with ``image_url`` or ``video_url`` blocks; plain text messages pass through unchanged. rFr image_urlrrBzdata:,z image/pngr;rrimageri)r media_typer)rr)rrT video_urlz video/mp4video)rJr$rrr partitionr) rr&rr new_contentchangedblock image_url_valheaderr%b64datar video_url_vals rrrsIENEN'')$$'4((    S ! ! !  = *= *Eyy  K//!&;!7!7!=2 B B5" M M  ++G44)6)@)@)E)E&FAw!,Jf}}%+\\#q%9%9!%<%B%B3%J%J1%M && '$,*4$+##(( && '$)#0##((6""k11"';!7!7!=2 B B5" M M  ++G44)6)@)@)E)E&FAw!,Jf}}%+\\#q%9%9!%<%B%B3%J%J1%M && '$,*4$+##(( && '$)#0##((""5))))GL8C8K888MMMM r> thinkthinkingr verbositythinkingbudgetthinkingconfigenable_thinkingthinking_budgetthinking_configrc t|tsdS|D]V\}}t|}|t vrdSt|rdSWdS)zCReturn whether a profile payload contains a reasoning wire control.FT)r$r5rrIrr_PROFILE_REASONING_KEYS"_contains_profile_reasoning_fields)r=r<nestedrs rrrrs eT " "u{{}} VXX^^%%++-- 0 0 044 -f 5 5 44  5rrc  |||d} t|| } | turd}n| | }|ddlm} | |rd}||| d<|| p|dkrt nd}t |pd}|dvpt|d }t| ot | d k}|d v}|s%|r# dd l m }||}n#t$rYnwxYwd }|dvrddl m}||dk}t||s|s|s|s|r$| t#|||rt%}g}|D]}}|dpidd}|r"||vrt(d|||Q|r||||~|| d<| p|dkrt nd}i}i}i}d } ddlm}ddlm} |t |pd}!|!|!|||pi}|!||du||\}}|pi}|pi}t=|!j| jup,t?|pt?|pt?|}n3#t$r&}"t( d||"Yd}"~"nd}"~"wwxYw| |tC|pi}#|#||#||rUtE|tBr@|s>|dd urdd i|#d<n|dpd}$d|$d |#d<t |pd}%|%dvrDd!|#vrtG|#d!<d"|#vr+ dd#l$m%}&|&}'n#t$rd}'YnwxYw|'r|'|#d"<|#r|#| d$<|rtE|tBrt |pd}(| pd}d }|(dvrddl m}||dk}|(d%ks!|stM|st|(|rtC|| d&<| S)'zLBuild kwargs for .chat.completions.create() with model/provider adjustments.)rrrNrrwrsrrB> nvidia-nim build-nvidianimnvidianemotronrUr>rrrr)rF> nous-portalr nousresearchrr}r*rrzK_build_call_kwargs: duplicate tool name '%s' removed (provider=%s model=%s)rr)ProviderProfile)rr=rv)rvsupports_reasoningrr=zA_build_call_kwargs: provider profile projection failed for %s: %srrrrT)rrr\ session_id)get_conversation_contextrrro)'r rrhrxrrIrrr4rnrrrKrrrr6rrrJrXrYr5rrrproviders.baserbuild_extra_bodybuild_api_kwargs_extrasrrrxr5r$r]agent.portal_tagsrr))rrrrsrqrrrrvr=rr!fixed_temperaturerx_effective_base_provider_norm_is_nvidia_nim_is_moa_is_gemini_nativer_nous_on_messagesr_seen_deduped_t_tnameeffective_base profile_bodyprofile_reasoning_extraprofile_top_levelprofile_handles_reasoningrrr%r merged_extrar_provider_for_portalr sticky_key provider_norms) rrrs/F 5UHEE,,,  &' DDDDDD # #E * * K +}(# *2h*>*> $ & & &B X^,,2244::<< Y Y R$_6PQQ t**=To!=+/  ! _  QQQQQQ$=$=o$N$N!!    ! D D D : : : : : : - e 4 48L L  )(O D D O  O O O ! O MM4ZuMMM N N N # UU BffZ((.B33FB??F &E//-He  " &!!! OOB    "w&.(&:&: """$&L.0(* %! 222222222222&&s8>r':':'@'@'B'B'H'H'J'JKK  "33'!14  //%5'7t'C+ 0 7 #%6'>&C # 1 7R W 5&>?I5lCCI66MNNI66GHH &     O            MM#$$$ (b))L %%%/000 L ' . . L* L    * *e 3 3)2E(:L % %%))(33?xF48F(K(KL % x~2..4466<<>>FFF  % %#4#6#6L | + + "FFFFFF5577  " " "!  " 8-7 \*,+|AJ'7>>AHN++113399;; !R! C C C : : : : : : - e 4 48L L  [ ( (  )2>BB )-]NKK ) +//?*@*@F& ' Ms=C$$ C10C1CK L"LLP P%$P%rc |td|pddddlm}||||| |j}|rt |ddst d n#t t tf$rr}t|}|t|cYd}~St|j }t|dd } td|pdd |d | d |d}~wwxYwt|S)u<Validate that an LLM response has the expected .choices[0].message shape. Fails fast with a clear error instead of letting malformed payloads propagate to downstream consumers where they crash with misleading AttributeError (e.g. "'str' object has no attribute 'choices'"). See #7264. Also the single accounting chokepoint for auxiliary usage: every successful non-streaming aux response passes through here exactly once, so token usage is recorded against the ambient session context published by the agent loop (``agent.aux_accounting``, issue #23270). Recording is best-effort and never affects validation. *provider*/*base_url* are optional accounting hints — fallback-path calls omit them and the row keeps the model (read from the response itself) with an empty route. Nrr>z: LLM returned None responser)record_aux_usagerr=rzmissing choices[0].messagexz&: LLM returned invalid response (type=z): ug. Expected object with .choices[0].message — check provider adapter or custom endpoint compatibility.) ragent.aux_accountingrr rrVr IndexError_recover_aux_response_message_complete_relay_auxiliary_callrr*rI) rrrr=rr r recovered response_typeresponse_previews rrrdsu, E E E E   655555XthJJJJ" ?ggaj)<< ? !=>> > ? Iz 2   1(;;  * , , ,      X/ x==#. 9 9 9" 9 9'7 9 9 9     #$$$ Os$.AC&4 C!C&AC!!C&successrrct}|dSddlm}|t |dpd|dS)zFClose one auxiliary logical call after acceptance or terminal failure.NrrrrBr)r}rJrrcomplete_logical_callrI)rrrs rrrsu%))++G ## GKK % % +,,$rc tddS#t$r tddYdSwxYw)zDClose a terminally failed call without replacing its original error.failedrz+Relay auxiliary failure finalization failedTrtN)rrKrXrYrrrrrsi &x888888     9        s &>>c `t|}|sdStt|t|ddpd} |g|_|S#t$rTtt|ddt|ddt|d d |gt|d d cYSwxYw) a,Synthesize chat-completions shape from Responses-style text fields. Auxiliary callers consume ``choices[0].message``. Some compatible endpoints return text outside ``choices`` (for example ``output_text`` or ``output`` items). Preserve that response before declaring it malformed. N)rr r)rr rrBrrchat.completionrrrrr r)_extract_aux_response_textrror rK)rrr:s rrrs &h / /D t ---h>>H&F  "8    xr**(GR008X/@AAH(GT22        s AAB-,B-ct|d}t|tr(|r|St|d}t|tsdSg}|D]}t|d}|r|dkrt|dpgD]v}t|d}|dvr`t|d}t|tr;|r'||wd |S) NrrrBrrr>Nrrr )_obj_getr$rIrrrr) rrrrnr5r6r7 part_typers rrrsO8]33K+s### (9(9(;(;#  """ h ) )F fd # #rE / /T6**  i// dI..4" / /D v..I999f--dC((/TZZ\\/LL...  / 99U   ! ! # ##rr<ct|||}||ur+t|tr|||}|Srr)r%r<rr=s rrrsE Cg & &E JsD11W%% Lrg@g@c |t|nd}n#ttf$rd}YnwxYwttt |zS)uAbsolute wall-clock bound for a progress-hooked streamed aux call. Generous by design — the idle timeout is the real guard; this only stops a degenerate stream that trickles one token per idle window forever. Nr=)rMrrr!_AUX_STREAM_CEILING_FLOOR_SECONDS_AUX_STREAM_CEILING_MULTIPLIER)rrs r_aux_stream_total_ceilingrsh .?.K%)***QT z " 0-7 9 99s ,,cFt|tttfS)aWire adapters that consume a stream inside .create() already tick the progress hook themselves (Codex per SSE event, Anthropic per stream event); Bedrock's Converse shim cannot stream at all. None of them accept chat-completions ``stream=True`` semantics from us.)r$rDrr)rZs r_client_streams_internallyr s& f   rcxt|}d|vrdSd|vod|vp d|vpd|vpd|vS)z@Provider explicitly refused a streamed chat.completions request.stream_optionsTrr unsupportedz not alloweddisabled)rIr)rerrs r_is_streaming_rejected_errorr si c((..  C3t s? 3  C   C     rct|pd}|sdSt|drdS ddlm}|pidi}|dpg}t |ttfrY|D]V}t |tr?| r+| |vrdSWn#t$rYnwxYwdS) uRDetect providers that only accept streaming (non-stream = HTTP 400). Some OpenAI-compatible endpoints reject non-streaming chat requests outright — e.g. Tencent Copilot returns ``{"code": 11101, "msg": "Non-stream chat request is currently not supported"}``. The main conversation loop already streams, so interactive chat works; auxiliary tasks (title generation, compression, web extract) used the non-streaming path and failed on every call. When this returns True the auxiliary client sends ``stream=True`` and aggregates the chunks itself (see :func:`_aggregate_chat_stream`). Credit @kudi88 (PR #60686). Beyond the known-host list, users can mark ANY custom endpoint as stream-only via ``auxiliary.stream_only_base_urls`` in config.yaml (list of substrings matched against the endpoint URL). rBFzcopilot.tencent.comTrr[r-stream_only_base_urls) rIrr4rHr2rJr$rrrrK)rr=_urlr2aux_cfgmarkersrs r_provider_requires_streamr# s) x~2   $ $ & &D uT#899t  111111;==&B++K<<++566<" ge} - - !  fc** v||~~ &,,..BVBVBXBX\`B`B`44       5sB/C.,C.. C;:C; force_streamrctts|rt|r|jjjd i|St |d}t|}d|d<ddi|d< |jjjd i|}n#t$r~}|sNr rrBr total_ceilingr)rrrrGr@rrrJr5rKrrr_rmrXrxr_aggregate_chat_streamrI)rZr!rrr r1chunksrs r_create_with_progressrG s. " "8<8. st   D# 4y#, ["$''#k*:";";   rrrB)rrrrrrrrr) rsortedrrrrrr rrr)rrrr:s rrz_ChatStreamAccumulator.finish s     "((;(A(A(C(C!D!D   J"GGD.//!ggd233;t     !,6    |/$H*     rr ) r*r+r,r-rIr rMrgrrrrrrrr s & &c &x & & & &,:#,:$,:,:,:,:\       rrcFKt||} |23d{V}||6 t|ddpt|dd}t|r8 |}t j|r|d{Vn#t $rYntwxYwno#t|ddpt|dd}t|r9 |}t j|r |d{Vww#t $rYwwxYwwxYw|S)u Async mirror of :func:`_aggregate_chat_stream` (``async for`` consumer). The AsyncOpenAI stream contract is an async iterator — consuming it with the sync helper raises. Same accumulation and ceiling semantics via :class:`_ChatStreamAccumulator`. r Nraclose)rrroryrE isawaitablerKr)rrr rrr3rs r_aggregate_chat_stream_asyncr. !s !uM J J JC !       % HHUOOOO"667D11TWVXt5T5T H    !&v..! LLLLLLL      67D11TWVXt5T5T H    !&v..! LLLLLLLL!       ::<<sJB 4B (&B BB 2D &C;9D ; DD DD cRKt|d}t|}d|d<ddi|d<|jjjd i|d{V}t |dr|St|t|dpd | d{VS) uAsync chat.completions.create() for stream-only providers. Sends ``stream=True`` and aggregates the async chunk stream into a complete response (credit @kudi88, PR #60686 — async contract fixed to ``async for`` and tool-call deltas preserved per sweeper review). rTrr rNr rrBr r) rrJr5rGr@rrr.rI)rZr!rr r1rs r_acreate_with_streamr0%!s.fjj.C.CDDMLLM"M('6&=M"#16;*1BBMBB B B B B B BFvy!! -c&**W--344M      r)rrr=r\rrsrqrrrrvr4rrrrrct|}|| tdid|d|d|d|d|d|d|d |d |d | d | d | d| d| d|d|d|}|r-|+|}d}t||||SS|||SS#||wwxYw)zARun an auxiliary LLM request, applying the configured task limit.Nrrrr=r\rrrsrqrrrrvr4rrrr)racquire_call_llm_impl$_release_sync_semaphore_after_streamrelease)rrrr=r\rrrsrqrrrrvr4rrrrrstream_semaphores rcall_llmr7=!s,,D11I !    X % X  G  &  X $  "z % G "z .- (- X 6! "*># &  Ti+( I7BRSS         !         !9        !sAB,B,,Crc#K |Ed{V t|dd}t|r ||dS#|wxYw# t|dd}t|r ||w#|wxYwxYw)zGRelease a permit only after a streaming response is consumed or closed.Nr)roryr5)rrrs rr4r4t!s  FGT22E         I        FGT22E        I      s.A&*A A#&C(*B'C'B==Cc:;<=t|}t||||\=}<}}|r|}t}|| pidkrt =dkr=n||p||p|d?<d@|dA|dB|dC|d|d+|d-|dD| dE|dF|dG| d| cYd}$~$Sts=;|H}0t!t#;dId pd }1|0rtW|$stS|$st[|$ri|$}2t[|$r}tS|$sn t9t;;|=| cYd}$~$S#t<$r:}&tW|&stS|&st[|&s|&}2Yd}&~&nd}&~&wwxYwtu|0|2|1Jrt dKpd|0tw|2j< tqd\id<d==d>|d?<d@|dA|dB|dC|d|d+|d-|dD| dE|dF|dG| d| cYd}$~$S#t<$rK}3tS|3stW|3st[|3rtu|0|3|3}$nYd}3~3nd}3~3wwxYwtW|$pJtS|$p;tU|$p,t[|$pt{|$pt}|$}4=d:v}5tS|$p;tU|$p,t[|$pt{|$pt}|$}6|4r|5s|6rtW|$rdL}7nktS|$r$dM}7tts=;|Hp=n8t[|$rdN}7n&t{|$rdO}7nt}|$rdP}7ndQ}7t dRpd|7=|$|7dSvrdn|}8dT\}}}|5rLt=pd|7|8U\}}}|t=pd|7V\}}}|t=|7V\}}}n2t=pd|7|8U\}}}|t=|7|8U\}}}|^t||||||| ||| W }9|9|9cYd}$~$St=dXV\}}}|#t||||||| ||| W }9|9|9cYd}$~$St dYpd|7=tU|$r= t;n,#t<$rt FdZd[YnwxYwd}$~$wwxYw)]uCentralized synchronous LLM call. Resolves provider + model (from task config, explicit args, or auto-detect), handles auth, request formatting, and model-specific arg adjustments. Args: task: Auxiliary task name ("compression", "vision", "web_extract", "session_search", "skills_hub", "mcp", "title_generation"). Reads provider:model from config/env. Ignored if provider is set. provider: Explicit provider override. model: Explicit model override. api_mode: Explicit API mode override (e.g. "codex_responses", "anthropic_messages"). Takes precedence over task config. messages: Chat messages list. temperature: Sampling temperature (None = provider default). max_tokens: Max output tokens (handles max_tokens vs max_completion_tokens). tools: Tool definitions (for function calling). timeout: Request timeout in seconds (None = read from auxiliary.{task}.timeout config). extra_body: Additional request body fields. reasoning_config: Optional Hermes reasoning config for direct model calls such as MoA reference/aggregator slots. extra_headers: Additional per-request HTTP headers. These override client-level defaults for providers that gate capabilities on request attribution (for example Copilot's ``x-initiator``). stream: When True, return the raw SDK streaming iterator instead of a validated complete response. The caller is responsible for consuming chunks (and for any fallback). Used by the MoA aggregator so its output can stream to the user. stream_options: Passed through to the request when stream is True (e.g. {"include_usage": True}). Returns: Response object with .choices[0].message.content, OR — when stream=True — the raw streaming iterator from client.chat.completions.create(). Raises: RuntimeError: If no provider is configured. rCrFrrr=r\rOrNDVision provider %s unavailable, falling back to auto vision backendsrrrOr$No LLM provider configured for task= provider=. Run: hermes setuprrB>rrrB Provider ':' is set in config.yaml but no API key was found. Set the U_API_KEY environment variable, or switch to a different provider with `hermes model`.BAuxiliary %s: provider %s unavailable, trying auto-detection chainr>rr=zAuxiliary %s: using %s (%s)%srrBz at rr4rTrrrrc Jt|tpSNrrrr _base_inforZrrrs rr{z _call_llm_impl..d"s8+@%>-z/N=N&& ,,,rrrrSzfAuxiliary compression: timeout on the critical path; skipping same-provider retry and falling back: %srg@g @zoAuxiliary %s: transient transport error (attempt %d/%d); retrying same provider after %.1fs before fallback: %sc Jt|tpSrErFrGs rr{z _call_llm_impl.."s93H & ' $-F$5$.$C2C."." 444rrszEAuxiliary %s: provider rejected temperature; retrying once without itrqr1210rurrrrrrCrOz[Auxiliary %s: model %r no longer in Nous catalog; retrying with refreshed recommendation %r)r-rrOr=r\rrrzSAuxiliary %s: refreshed Nous runtime credentials after paid account check, retryingzDAuxiliary %s: refreshed Nous runtime credentials after 401, retrying>NrBrzAAuxiliary %s: refreshed %s credentials after auth error, retryingrrrrrrrrrrrrvrr\rz@Auxiliary %s: recovered %s via credential-pool rotation after %s auth errorr-rjmodel incompatible with routeinvalid provider responseconnection errorz,Auxiliary %s: %s on %s (%s), trying fallbackrLr-r7r/r@rhrrrsrqrrrrvstale fallback credentialzoAuxiliary %s: %s on %s and all fallbacks exhausted (fallback_chain + main agent model). Raising original error.z7Auxiliary: cache eviction after connection error failedrtr)Grrrr6rrXrYrrrrrjupperr?r}rrIrorr5rrr$rDrGr@rrrrrKrrrrranger_TRANSIENT_RETRY_BACKOFF_BASErsleeprrr_r}rrrmr4rrSrJrfr4rrrrrrrrr*rrr<rfrur>rQr*rrx)>rrrr=r\rrrsrqrrrrvr4rrrrrrreffective_providerr _explicitrrrrr! _client_base transient_err_max_transient_retries_last_transient_attempt_backoffretry_transient first_errrr) retry_err_strerr_str_is_zai_param_error _heal_is_nous healed_modelclient_is_nousrefreshed_clientrefreshed_modelauth_refresh_provider pool_provider_client_api_key recovery_err retry2_errshould_fallbackis_autois_capacity_errorr/_chain_failed_modelfb_resprHrZrrs>` @@@@rr3r3!sn|+<88L`| hxa2a2]~'8:JL]%$/55 0b111 x2P*;v*E*E&&8 )E&2($/% 3 3 3 /FK >/699BS9 NNV!   7U$ ) 777 3  >%t%%GX%%% /C2C0  &$&%      > +0b7799??AAI Y.NNN0_)11- 8X(*3X'FK(0(E4E%%&\Y\\.7oo.?.?\\\~&7~ ` NF,=???&8lae&f&f&f# >%t%%GX%%%&& &/tW==WVZ1BCCIrJJJ c 3,6 8Py,6a)=&6%5 #0-!(33Df[ghhh gfi<<BCC 4 nY774 ;LY;W;W4 [opy[z[z4 $L$I.. -7H7S7S - -1.""%6%6   !!!!!!!!!---*9559J99U9UYmnwYxYx#,LLLLLL-&m\Rabbb#  VNFM4 3E3E3N4!T*;*;(6~+<*;  *:)9  +<*; &2\%0K"*%0K$.:$e+<*;.B-A*:)9 '4m!$!    **55 9S9S3J??.}jIII$. "  N 9 % % 9 ++ 9#I.. 9$I.. 9,I66  9 .i88 $'99 i ( ( 9#I.. 9#I.. 9,I66 9.i88  Y Y +<Y i(( ,%"9-- ,( )./@&Wcdddyhy&i00 ,%-i88 ,8/ :: ,4+ KKF0A9 N N N"AAA{ -= )Ix :0N+5vf!4161616- 8X$4L/96&5J5J5J1Ix$4I)45@5@5@1Ix1O+5vf!4161616- 8X$4R)4%85:5:5:1Ix$7x + 3D)=%5 777&"NNNNNN1F%t4O1Q1Q1Q- 8X(;!8X!H$/J#7H-A)9 ;;;G*& NNO(9    * * , ,-f5555 , , , V&*,,,,, , E bs:+L&& Q 1B9Q+(PQQ Q Q%P<7Q<QQQ  Q wAw/ Sw T2A T-(w-T22A>w1 Ww X!0XwXB$w [& w& [<0[72w7[<w"w(5ww#.wv"!w"&w w w  wwcddl}|jdj}|jpd}|r7|jdd||j|jz}|r|Sg}dD]i}t||d}|rTt|tr?|r+||vr'| |jt|dd}|rt|tr|D]} t| tr| dp)| d p| d } | rO| |vrK| t| tr| nt| |rd |SdS) uExtract content from an LLM response, falling back to reasoning fields. Mirrors the main agent loop's behavior when a reasoning model (DeepSeek-R1, Qwen-QwQ, etc.) returns ``content=None`` with reasoning in structured fields. Resolution order: 1. ``message.content`` — strip inline think/reasoning blocks, check for remaining non-whitespace text. 2. ``message.reasoning`` / ``message.reasoning_content`` — direct structured reasoning fields (DeepSeek, Moonshot, NovitaAI, etc.). 3. ``message.reasoning_details`` — OpenRouter unified array format. Returns the best available text, or ``""`` if nothing found. rNrBzz<(?:think|thinking|reasoning|thought|REASONING_SCRATCHPAD)>.*?)flags)rr!reasoning_detailsrrrz )rr rrrsubDOTALL IGNORECASEror$rIrrr5rJr) rrrrcleanedrrrdetailsdetailrs rextract_content_or_reasoningr}I$sIII  1  %C{ b''))G "& L ry2=8    %''   N"$O300c5$''  0:c3'' 0CIIKK 0CV>V+h7==???\_`g\h\hiii,{{?+++ 2r) rrr=r\rrsrqrrrrvc  Kt|} | | d{V t|||||||||| | | |  d{V | | SS#| | wwxYw)zERun an asynchronous auxiliary LLM request under the configured limit.N) rrrr=r\rrrsrqrrrrv)rr2_async_call_llm_implr5)rrrr=r\rrrsrqrrrrvrs rasync_call_llmr$s$-T22I!!!!!!!!! )%#!!-                  !9        !s !A))Bc ~67Kt|}t||||\} }}}}t}|| pidkrt | dkr| n||p||p||p|d|\}7}7:| dkr4|s2t d| t d|d|\}7}7tdd | d |p| } nt| |d|||| \7}7| pd }|rb|d vr^t|\}}}| t||pd dk\7}|p| } n(td|d| d76|s4t dpd| tdd|\7}7tdd | d t| }t!| ||t#t%7dd pd }t'| ||||| ||| |p| }t)| |rt+|d|d< t-| |p|o"t/7t0t2t4f 6dt6t"t8fdt8f67fd } t;t=7|| ||d{V| |S#t>$r}tA|sdkr+tC|rt d|t dpd|t;t=7|| ||d{VcYd}~Sd}~wwxYw#t>$ r}d |vrtE|rtG|}|$d dt d!pd t;t=7|| |"d{VcYd}~S#t>$rS} t#| }!tK| s'tM| stO| s d#|!vsd$|!vs| }|}Yd} ~ nd} ~ wwxYwt#|}"d%|"vod&t#t%7dd v}#|d#|"vsd$|"vstQ|d#s|#r|$d#d|$d'd t;t=7|| |"d{VcYd}~S#t>$r:} tK| stM| stS| s| }Yd} ~ nd} ~ wwxYw| d(kptU|d)}$tW|r|$rtYdk|-d*+}%|%r|%|-d*kr}t d,pd|-d*|%|%|d*< t;t=7|| |"d{VcYd}~S#t>$r } | }Yd} ~ nd} ~ wwxYw| d(kptU|d)}&tK|r|&rt]rt_| pd(|d|||dk-\}'}(|'t d.pd|(r|(|-d*kr|(|d*< t;t=|'|| |"d{VcYd}~S#t>$rI} tO| s.tK| stM| stS| s| }Yd} ~ nd} ~ wwxYwtO|r|&rt_| pd(|d|||dk-\}'}(|'it d/pd|(r|(|-d*kr|(|d*<t;t=|'|| |"d{VcYd}~Sta| |})tO|r|)d0vr{|&sytc|)rj|)te| krtg| t d1pd|)ti|)|p||||||||| ||| 2d{VcYd}~Stk| 7|3}*t#t%7d4d pd }+|*rtO|stK|stS|rX|},tS|rtK|st t;t=7|| |"d{VcYd}~S#t>$r:} tO| stK| stS| s| },Yd} ~ nd} ~ wwxYwtm|*|,|+5rt d6pd|*to|,j8 ti| ||||||||| ||| 2d{VcYd}~S#t>$rK}-tK|-stO|-stS|-rtm|*|-|-}nYd}-~-nd}-~-wwxYwtO|pJtK|p;tM|p,tS|pts|ptu|}.| d0v}/tK|p;tM|p,tS|pts|ptu|}0|.r|/s|0rtO|rd7}1nitK|r"d8}1twtk| 7p| n8tS|rd9}1n&ts|rd:}1ntu|rd;}1nd<}1t d=pd|1| ||1d>vrdn|}2d?\}}}|/rLty| pd|1|2@\}}}|t{| pd|1A\}}}|t}| |1A\}}}n2ty| pd|1|2@\}}}|t| |1|2@\}}}|t||pd dk\}3}4t|3|4p|||||| ||| B d{V}5|5|5cYd}~St}| dCA\}}}|Ft||pd dk\}3}4t|3|4p|||||| ||| B d{V}5|5|5cYd}~St dDpd|1| tM|r= t7n,#t>$rt BdEdFYnwxYwd}~wwxYw)GzqCentralized asynchronous LLM call. Same as call_llm() but async. See call_llm() for full documentation. rCrTr:Nr;r<r=r>r?)rOr=r\rrrB>rrrBrr@rArBrCr>)rOrrr=rr_kwargsrctKrt|d{VSjjjdi|d{VSr)r0rGr@r)r_force_stream_asyncrZrs r_acreatez&_async_call_llm_impl.._acreate*%sd" I1&'4HHHHHHHHH707BB'BBBBBBBB BrrrrSznAuxiliary compression (async): timeout on the critical path; skipping same-provider retry and falling back: %szgAuxiliary %s (async): transient transport error; retrying once on the same provider before fallback: %srszMAuxiliary %s (async): provider rejected temperature; retrying once without itrrqrrJrurrrrrrKzcAuxiliary %s (async): model %r no longer in Nous catalog; retrying with refreshed recommendation %r)r-rrOr=r\rrz[Auxiliary %s (async): refreshed Nous runtime credentials after paid account check, retryingzLAuxiliary %s (async): refreshed Nous runtime credentials after 401, retrying>NrBrzIAuxiliary %s (async): refreshed %s credentials after auth error, retrying)rrrrrrrrrsrqrrrrvrr\rzHAuxiliary %s (async): recovered %s via credential-pool rotation after %srLr-rjrMrNrOz4Auxiliary %s (async): %s on %s (%s), trying fallbackrPr7rQrhrRrSzwAuxiliary %s (async): %s on %s and all fallbacks exhausted (fallback_chain + main agent model). Raising original error.z?Auxiliary (async): cache eviction after connection error failedrt)Crrrr6rrXrYrrrrrjrrTr?r}rrIrorrrrr$r\rrrrrrrKrrrrr5rr_r}rrrmr4rrSrJrfr4rrrrrrrrr*rrr<rfrur>rQr,rrx)8rrrr=r\rrrsrqrrrrvrrrrrrrXrrYrrrrrZr!rr[rarr)rbrcrdrerfrgrhrirjrkrlrmrnrorprqr/rrasync_fbasync_fb_modelrsrrZs8` @@rrr$sh,+<88L`| hxa2a2]~'8:JL]/55 0b111 x2P*;v*E*E&&8 )E&2($/% 3 3 3 /FK >/699BS9 NNV!   7U$) 777 3  >%t%%GX%%% /C2C0  &$&%     >*0b7799??AAI Y.NNN0_)11- 8X(*:!8>rdh>N+++'FK)1(E4E%%&\Y\\.7oo.?.?\\\ ~&7~ ` NF,=???&8D_krv&w&w&w# >%t%%GX%%%&& &/tW==wvz266<"==L ;J.;O)2!2 ???F%%6 EEU@ ASTTzi &!<#D3D   v)-+(  CDcN Cs C C C C C C C C % )-..# *\ C C C C   0?? }$$):=)I)I$ N!  KK@     *-..#       % 6 ooo F " "'H'S'S "<rdh>N000,Hn%C ."5*K M;*BM60M;1M>6M;;M>> t< At7&P t< Q(A Q#t7#Q((A>t7'&T t< U0U t7UB$t7<&X("t<( X>2X94t79X>>Bt7&\;t< ] ?] t7]Bt7,t<2Bt7 t<Bt7&e:t< f 0e?:t7?fAt7 "g3-t<3 i=Ai>t7iHt7't<-At7t< .t7:t  t7 &t30t72t33t77t<)TNNrir)rBrr)Nr-)Nr?Nr)r?N)rBr?r) NFFNNNNFN)NFNNNNFN)NNNNN)NNNrqNNNN(er- contextlibrrrrrErkloggingrHrrrrpathlibrtypesrtypingrrrrr r r r rr rrrrrrr rragent.credential_poolr/rr0r1rHr2rr3r r4r5r6r7r8 getLoggerr*rXrr9r:r;r<rIrMrWrnr[ralocalrprrcrqr|contextmanagerrrrrrrrrr5rrrr{rrrrrrrrr r r rMrrrrr!r& frozensetr'rGrJr>rRrVrW hermes_clirX_HERMES_VERSION_AI_GATEWAY_HEADERSrrZr]r^NOUS_EXTRA_BODYr_r1rJrr#rrrrr{rrrrrrrLrrrr<rDrJrYr\rbrrrrrrrrrrrrrrrrrrrr rr'r(r+r3r6r@rBrNrSrXrr]rarlrnrsrtrurvrwrxry ContextVarr{r}rrrrrrrrrrrrUTokenrrrrrrrrr rrrr_AUTO_PROVIDER_LABELSrr*rr.r7r0r1r3r5r<rrBrDrKr_rfrmrrr}rrrVrrrrrrrrrrrrrrrrrrrrrr r rrrr*r,r>rQrTrWrfrjr^r]rurwrrrrLrrrrrrrrrrrrrrUr rr&r,r4r;rCrrHrLrNrQrSrr`r_DEFAULT_AUX_TIMEOUTr|rrzr}rrrrrrrrrrrrrrrrrrrrrrrrrrrrr rr.r0r7r4r3r}rrrrrrsq<,,,\    !!!!!!XXXXXXXXXXXXXXXXXXXX7777777777$(8D>((($,,,,,,,,& ++++++QQQQQQQQ------000000DDDDDDDDDDDDDD  8 $ $&)SUUs***'*suu,,,), #---&)cee+++(3-C8!& $#$#$#sm$#$# #s(^ $#$#$#$#L @c @S @C @C @ @ @ @4,IO-- K K K K KM K K K E$EEEE& CC CCCC: 8HRW,=#>    "c'1Bt00000000R !! @@@@$C$DcN$$$$N##<  tXc]/B)C     sx}.""""""..#..c....6(i) s t    3+#+#++++:` ` ` ` ` ` ` ` F ########""""""""$ D D D D D D D D######## 66666666&e e e e e e e e P######## $DDDDDDDD######## 6 6 6 6 6 6 6 6, , , , , , , , ^########         DDDDDDDD######## ........#$D# QQQ QQ Q sm Q  QQQQh#$####LDS(HHHHH =B000T0huUXZ]U]F_0000f8=%PSUXPX/AZ<4HU38_$=4444n((3-((((Vo5&)98C=)H#Iooooj3@(3-@D@@@@ (%c "2(((($      #A#Ac#A#AhW]N^`hil`mNmHn#A#A#A#AL 4# 4 4 4 4QQdQuXf-=x}-L'MQQQQh&&"*3-& c]&&&&R#<S2C:S*###5#PXY\P]A];^####L#$ # #    .! S  s  !!!!K3TBBB{-htCH~.FG K14@@@/c3h0HI 22 >Dj > : >Dj > > > > > DjDj 3T#s(^ #$t+ 2 59   cNDj  Dj  d38n%s* +d 2  @ 59   cNDj  Dj  d38n%s* +d 2  :    cNDj  Dj   ,2JuS#XIII*IN,,3htCH~63333. s s     !.... . .  .  .......b  k/  D      +htCH~&>++++ A A A A /8x}hsmXc]'R!S/8/8/8/8d# :$0#eHSM8C=$@A0#0#0#0#f;s;uXc]HSM5Q/R;;;;@&;s&;uXc]HSM-I'J&;&;&;&;V &*'+" ooo C=osmo } o sm o  8C=(3- '( ooood<c<cS<cE(3-RU:V4W<c<c<c<c@$*!* ]36MM (4S>*B tCQTH~    FT%[R!)+d3:&+++-/$sEz*///  ""     2S 2S 2 2 2 2s%D& # $       s  (3-  4     %%%%'9'''''T D    "i"D""""J+9+++++*#i#D####LNyNTNNNN&!$*****, d$34D?9?????%9%%%%%P3i3D3333l d& )C )D ) ) ) ) # $    L.2&&&&4S>*& &&&&*Y4S>.2((( (4S>*(c] ((((VTV...S.y.S.Z^....D/3#FFF 3-FFSM F  } F sm F }F4S>*F#FF%F F D>FFF tn!F"DcN+#F$ %FFFFr/3!DDD 3-DDSM D  } D sm D }D#DD%D D D>DDDtnD DcN+!D" #DDDDNXCXDXXXXv} 26 66$sTWx.AY6666*(3-38E?.IIIIII :EEEsmE C= E  EEEE0 O S> O Osm O O O O O O 3-OOsmO O  OOOO. D>&   4: &zzsmzz 3- z  z%z z D>zzztnzc]zzzzzddsmdd 3- d  d%d d D>dddtndc]ddddR!000 0 0 8C=(3- ,- 0000j"& S7S7S7 S7 S73- S7  8C=(3- ,- S7S7S7S7Rx}#0 ''' '' ' c] ''''Z"& tt tt t3- t  8C=(3- ,- ttttn 3- 8C=(3- ,-, (4S> (hsm ( ( ( ("4S>"eHSM8TW=*r 3-r 8F Xc] *+rrrr@K.K.K.K.K.K.K.\ (3- 3 8TW=    ! -1V V V  V V  V   V   V V 4S>*V V  3-V  8C=(3- '(V V V V x.2 4S>* 8F Xc] *+ 2`d#XdSVX[S[nE]&#hsm>-#-3----  &&& C=& 8C=(3- '(&&&&RCsCtCCCCtCy4#o*#!-1o*o*o*smo* C=o*sm o* c] o*  o*4S>*o* 8C=(3-# 67o*o*o*o*d;$;;;;FJ!!!c!Xc]!d!!!!^%' tE5L!&&&#Y^%%$$$$$$$$,CC#!"-1!G!G!G!G!Gsm !G c] !G sm !G4S>*!G!G 3-!G C=!G !G!G!G!GHlpGGGEG3GxPS}GehGtxGGGG#!"-1**** C=* * sm * c] *sm*4S>*** 8C=(3- '(****Z    B S T    (             ####&#$::Xc]:W[::::###hsm#Xc]#W_`cWd####-1u*u*u* u*u* u*  u*  u*4S>*u*u* 3-u* 8C=(3- '(u*u*u*u*J )-4S> "! nAnA nAnA nAsm nA c] nA  3 x}hsmXc] JK nAnAnAnAb&+")S)T#s(^))))X3G  C % 5    x5"+s+tCH~++++nKMd3c9+E&E FFGLLL@BtE#s(OU38_<=BBB    (HSM (hsm ( ( ( ( hsm A[8\    x}(&&&&(i(R(R(RSS %C %3 %4 % % % %Q$Q4QQQQh    c d    "$( $ !%'+"bbb bb% b  b D> bbbtnbsmb 3-b bbbbN"" 000 3-0sm0sm 0  0000f6?   s 4         C HSM    8$$$$$$.#C#,%*!!$ 9% 9U 9 9 9 9 s t     i D    !!x}!!!!!N?  ??? ? cN? 3-?  ?  ????J%)   E?   :` ` ` ` ` ` ` ` L%)   E?   >  cN 3- 03 -1#''+.2%3 3 3 3 3   3  3  3 4S>*3 3 %3 3  3 3 3 tn3 DcN+3 !3 " #3 $%3 & '3 3 3 3 l    %6     C -1#''+.2%C C C  C C   C   C   C 4S>*C C %C C  C C C tnC DcN+C  !C " #C $%C & 'C C C C L5c5555p& -1#''+& & & & &   &  &  & 4S>*& & %& &  & & & tn&  & & & & TY-1#''+YYY YY  Y  Y  Y4S>*YY%YY YYYtnY YYYYYYr