PmjU0UdZddlmZddlZddlmZddlmZmZm Z m Z m Z ddl m Z mZejeZedGd d Zid ed d dded ddded dddeddddeddddedddd !d"ed dd#d$!d%ed d&d'd(d)*d+edd,d-d.!d/ed d01d2ed3d41d5ed d6d78d9ed d:;d<ed d=d>d?@dAed3dB;dCed3ddDdEed3dF;idGed dH;dIed dJ;dKed dL;dMed dNdOed ddPdQed ddRdSed ddTdUed ddVdWed ddXdYeddd dZed d[d\d]ed d^;d_ed d`;daed dbdcdded dedfdg@dhed didjkdled dmdndo@ed dpdqed dr;edsdtued dvudwZdxedy<eGdzd{Zid|dd}d5d~d5dd5dd5ddYddYddYddddddddddZddZddZddZdd9idd9dd9dd9dd<dd<ddEddEdd2dd2dd/dd/dd+ddMddMddMddOddOiddQddQddSddSddSddGddIddIddIddIddKddKddKddUddUddUddWiddWdd]dd]dd_dd_dd_dd_ddddddddddaddaddddddddhddhdld%d%d%ddddddœ Zded<ddddddddddddddddԜZded<dd3ddsdלZded<dd܄ZddݜddZddZddZedQdOhZded<ddZddZ dddZ!dddZ"dddZ#ddZ$dd dZ% dd dZ&d dZ' d d dZ(dS(u Single source of truth for provider identity in Hermes Agent. Two data sources, merged at runtime: 1. **models.dev catalog** — 109+ providers with base URLs, env vars, display names, and full model metadata (context, cost, capabilities). This is the primary database. 2. **Hermes overlays** — transport type, auth patterns, aggregator flags, and additional env vars that models.dev doesn't track. Small dict, maintained here. 3. **User config** (``providers:`` section in config.yaml) — user-defined endpoints and overrides. Merged on top of everything else. Other modules import from this file. No parallel registries. ) annotationsN) dataclass)AnyDictListOptionalTuple)base_url_host_matchesbase_url_hostnameT)frozencheZdZUdZdZded<dZded<dZded <d Zd ed <d Z ded<d Z ded<dS) HermesOverlayz?Hermes-specific provider metadata layered on top of models.dev. openai_chatstr transportFbool is_aggregatorapi_key auth_typeTuple[str, ...]extra_env_varsbase_url_overridebase_url_env_varN) __name__ __module__ __qualname____doc__r__annotations__rrrrrr:/home/thesage/.hermes/hermes-agent/hermes_cli/providers.pyrr"sII"I""""MI&(N((((r!rmoarvirtualz moa://local)rrr openrouterOPENROUTER_BASE_URL)rrrnousoauth_device_codez)https://inference-api.nousresearch.com/v1 openai-codexcodex_responsesoauth_externalz%https://chatgpt.com/backend-api/codexz openai-apizhttps://api.openai.com/v1OPENAI_BASE_URL)rrr xai-oauthzhttps://api.x.ai/v1 XAI_BASE_URL)rrrrz qwen-oauthzhttps://portal.qwen.ai/v1HERMES_QWEN_BASE_URLlmstudior) LM_API_KEYzhttp://127.0.0.1:1234/v1 LM_BASE_URL)rrrrr copilot-acpexternal_processz acp://copilotCOPILOT_ACP_BASE_URLzgithub-copilot)COPILOT_GITHUB_TOKENGH_TOKEN)rr anthropicanthropic_messages)ANTHROPIC_TOKENCLAUDE_CODE_OAUTH_TOKENzai) GLM_API_KEY ZAI_API_KEY Z_AI_API_KEY GLM_BASE_URL)rrrzkimi-for-coding KIMI_BASE_URL)rrstepfun)STEPFUN_API_KEYz#https://api.stepfun.ai/step_plan/v1STEPFUN_BASE_URL)rrrrminimaxMINIMAX_BASE_URLz minimax-oauthz https://api.minimax.io/anthropicz minimax-cnMINIMAX_CN_BASE_URLdeepseekDEEPSEEK_BASE_URLalibabaDASHSCOPE_BASE_URLzalibaba-coding-planALIBABA_CODING_PLAN_BASE_URLvercel)rropencodeOPENCODE_ZEN_BASE_URLz opencode-goOPENCODE_GO_BASE_URLkiloKILOCODE_BASE_URL huggingface HF_BASE_URLnovitaNOVITA_BASE_URLxainvidiaz#https://integrate.api.nvidia.com/v1NVIDIA_BASE_URLxiaomiXIAOMI_BASE_URLtencent-tokenhubTOKENHUB_BASE_URLarceezhttps://api.arcee.ai/api/v1ARCEE_BASE_URLgmi) GMI_API_KEYzhttps://api.gmi-serving.com/v1 GMI_BASE_URL fireworks)FIREWORKS_API_KEYz%https://api.fireworks.ai/inference/v1)rrrupstage)UPSTAGE_API_KEYzhttps://api.upstage.ai/v1UPSTAGE_BASE_URLzhttps://ollama.com/v1OLLAMA_BASE_URLAZURE_FOUNDRY_BASE_URLbedrock_converseaws_sdk)rrvertex) ollama-cloudz azure-foundrybedrockrlzDict[str, HermesOverlay]HERMES_OVERLAYSceZdZUdZded<ded<ded<ded<dZded <dZded <d Zd ed <dZded<dZ ded<dZ ded<dS) ProviderDefu9Complete provider definition — merged from all sources.ridnamerrapi_key_env_varsrbase_urlrFrrrrdocsourceN) rrrrr rurrrrvrwrr!r"rqrqsCC GGG IIINNN%%%%HMICMMMMFr!rqopenaiglmzz-aizz.aizhipuzx-aizx.aigrokz grok-oauthz x-ai-oauthzxai-grok-oauthnimz nvidia-nimz build-nvidianemotronkimiz kimi-codingzkimi-coding-cnmoonshotstepzstepfun-coding-planz minimax-china minimax_cnclaudez claude-codecopilotgithubzgithub-copilot-acpz ai-gateway aigatewayzvercel-ai-gatewayz opencode-zenzengozopencode-go-subkilocodez kilo-codez kilo-gatewayz deep-seek dashscopealiyunqwenz alibaba-cloudalibaba_codingzalibaba-codingalibaba_coding_planhfz hugging-facezhuggingface-hubz novita-ainovitaaimimoz xiaomi-mimotencenttokenhubz tencent-cloud tencentmaasawsrnz aws-bedrockzamazon-bedrockamazonzarcee-aiarceeaiz gmi-cloudgmicloudz fireworks-aifwcustomlocal) solarr0z lm-studio lm_studioollamavllmllamacppz llama.cppz llama-cppzDict[str, str]ALIASESzMixture of Agentsz Nous Portalz OpenAI CodexzGitHub Copilot ACPzStepFun Step Planz Xiaomi MiMoz GMI Cloudz Upstage SolarzTencent TokenHubz LM StudiozLocal endpointz AWS BedrockzGoogle Vertex AIz Ollama Cloudz%xAI Grok OAuth (SuperGrok / Premium+))r#r'r)r3rBrZr`rer\r0rrnrlrmr-_LABEL_OVERRIDESchat_completions)rr9r*rjTRANSPORT_TO_API_MODErsrreturnc|}t||S)zResolve aliases and normalise casing to a canonical provider id. Returns the canonical id string. Does *not* validate that the id corresponds to a known provider. )striplowerrget)rskeys r"normalize_providerrs1 **,,    C ;;sC  r! allow_networkrrOptional[ProviderDef]c t|} ddlm}|r ||n ||d}n#t$rd}YnwxYwt|}||r|jnd}|r|jnd}|r|jnd}|r|j nd} |r|j nd} t|j } |r*|j r#|j D]} | | vr| | t||j|t#| | p|j| |||jd S|Ot|t(|||j|j |j |j |j|jd SdS) aALook up a built-in provider by id or alias. Resolution order: 1. Hermes overlays (for providers not in models.dev: nous, openai-codex, etc.) 2. models.dev catalog + Hermes overlay User-defined providers from config.yaml (``providers:`` / ``custom_providers:``) are resolved by :func:`resolve_provider_full`, which layers ``resolve_user_provider`` and ``resolve_custom_provider`` on top of this function. Callers that need user-config support should use ``resolve_provider_full`` instead. Returns a fully-resolved ProviderDef or None. rget_provider_infoFrNrrr models.dev) rrrsrrtrurrrrvrwhermes) rrrsrrtrurrrrw)ragent.models_devr Exceptionrorrrrrrlistenvrappendrqrstupleapirvr) rsr canonical_mdev_provider mdev_infooverlayris_aggauth base_url_envrenv_varsevs r" get_providerrs#4((I HHHHHH  @NN9 % % % ???   !!),,G)0CG%%m *1<&&u$+:w  3:Bw// 9@HG55b &&  (w- (, ( (X%%OOB'''"8__&7)-)      !%%i;;'$3.$5!/'     4s 2 AA provider_idct|}|tvr t|St|}|r|jS|S)z1Get a human-readable display name for a provider.)rrrrs)rrpdefs r" get_labelrsM";//I$$$ **  " "D y r!providerct|pd}|drdSt|}|r|jndS)z:Return True when the provider is a multi-model aggregator.rcustom:TF)r startswithrr)r provider_normrs r"rrsN&x~266M **t  & &D!% 04  50r!frozenset[str]_FLAT_NAMESPACE_RESELLERScXt|pd}|tvrdSt|S)uxReturn True only for TRUE routing aggregators (e.g. OpenRouter, named ``custom:*`` proxies) — those that route bare/vendor-slugged model names to *other* providers' endpoints. Distinct from :func:`is_aggregator`, which also reports True for flat-namespace resellers (opencode-go/zen) whose catalog is entirely first-party. Use this gate when the question is "would selecting this model silently re-route the call away from the user's intended provider?" — i.e. the picker dedup. Resellers answer no: their listed models are their own, so their rows must not be deduped against user proxies. rF)rrr)rrs r"is_routing_aggregatorr3s4'x~266M111u  ' ''r!ruc"t|dS)uTrue when *base_url* points at OpenAI's official API host family. Matches the canonical host (``api.openai.com``) and OpenAI's documented data-residency / regional hosts (``us.api.openai.com``, ``eu.api.openai.com``, and any future ``.api.openai.com``) — those serve the same API surface with the same transport requirements and the same access-scoped ``/v1/models`` listing. Hostname-parsed matching only — never substring — so lookalike hosts (``api.openai.com.attacker.test``) and path-segment spoofs (``proxy.test/api.openai.com/v1``) are rejected. A genuine ``*.api.openai.com`` subdomain requires control of openai.com DNS, so the dot-suffix match does not reopen the #32243 spoofing hole. Delegates to ``utils.base_url_host_matches``, which owns the exact-or-dot-suffix hostname contract (userinfo/port stripped, lowercased, trailing dot removed) — one implementation, not two. zapi.openai.com)r )rus r"is_official_openai_hostrEs$ !+; < <!!i9&<&<##&&&)*<*<\*J*J&## x((!  -.."3HSb3c3c"!! 4r!modelct|pddrdSdS)uResolve the wire protocol for a Nous Portal model. Portal serves its ``anthropic/*`` catalog on a native Anthropic Messages route (``/v1/messages``) alongside the OpenAI-compatible ``/v1/chat/completions`` used by every other model it proxies. Claude traffic goes to the native route so it gets Anthropic's own request shape (inner-block ``cache_control`` breakpoints, thinking blocks) instead of the OpenAI-wire translation. When *model* is empty/unknown, defaults to ``chat_completions`` — the historical Nous transport — so callers that don't yet know the model stay on the safer OpenAI-compatible path. rz anthropic/r9r)rrrr)rs r" nous_api_modersJ 5;B%%''22<@@$##  r!ct|}||S|pd}|dvrt|St |}| t |jdS|dkrdSdS)uDetermine the API mode (wire protocol) for a provider/endpoint. Resolution order: 1. Host-mandated mode (special endpoints that only accept one protocol). 2. Nous Portal dual-wire (model-derived; overlay alone is openai_chat). 3. Known provider → transport → TRANSPORT_TO_API_MODE. 4. Direct provider checks (bedrock). 5. Default: 'chat_completions'. *model* is optional but required for dual-wire providers (Nous) whose transport depends on the catalog id, not just the provider/host. Nr> nous-portalr' nousresearchrrnrj)rrrrrrrr)rrurmandatedrrs r"determine_api_moders&h//H ^**,,2244M???U###  ! !D $((9KLLL9!!  r! user_configDict[str, Any]c |rt|tsdS||}t|tsdS|ddp|}|ddp-|ddp|ddpd}|ddpd}|dd pd }g}|r||t |||t ||d d d S)zResolve a provider from the user's config.yaml ``providers:`` section. Args: name: Provider name as given by the user. user_config: The ``providers:`` dict from config.yaml. Returns: ProviderDef if found, else None. Nrsrrurlrukey_envrrFr user-configrrrsrrtrurrrw) isinstancedictrrrqr)rsrentry display_nameapi_urlrrrs r"resolve_user_providerrs( jd;;t OOD ! !E eT " "t99VR((0DLiir""]eiir&:&:]eii TV>W>W][]Gii 2&&,"G +}55FIH!     x    r!r provider_keyct|pdp"t|pd}|dd}|dr|nd|S)a0Build the stable ``custom:`` identity for a configured provider. Keyed ``providers:`` entries keep their config key as the durable identity even when their display name changes. Legacy ``custom_providers:`` entries have no key, so their normalized display name remains the identity. r -r)rrrreplacer)rridentity normalizeds r"custom_provider_slugrs<%2&&,,..Q#l6Hb2I2I2O2O2Q2QH!!))#s33J#..y99 U::?U?U?UUr!ct}||fD]}t|pd}|s:|dd}|||t |h|dr8|ddd}|r||d|ht|S)zCReturn every current and legacy identity accepted for one endpoint.rrrr:) setrrrrupdaterrsplit frozenset)rraliasesvaluerawrsuffixs r"custom_provider_aliasesrs G - A A%+2$$&&,,..  [[c** Z)=j)I)IJKKK   + + A%%c1--a0F A(>*(>(>?@@@ W  r!custom_providersOptional[List[Dict[str, Any]]]c |rt|tsdS|pd}|sdS|dk}d}|D]s}t|ts|dpd}|ddp-|ddp|ddpd}|r|s|dpd}|d pd} g} |r| ||!||t| t|| f}t|| } |t|| vrOt| |d t| |d d d cS|r |r|\} } }} t| | d || d d d SdS)zIResolve a provider from the user's config.yaml ``custom_providers`` list.NrrrsrurrrrrFrrr) rrrrrrrrrrrq)rsr requestedbare_custom_fallback first_validrrrrrrslugdnameaurldenvs r"resolve_custom_providerrs^ :.>#E#Et""$$**,,I t %0CGK!* * %&&   &))/R6688 IIj" % % yy## yy##  %''   7  99Y''-24466 .117R>>@@    % OOG $ $ $  h$\<@@ K$L,?? 3L,OO O O #"8__        "-tT4#!      4r!user_providersOptional[Dict[str, Any]]c t| |}|rt||}||S |kr ddlm}||}|[ fd|D}t|dkr:t|j |j dt|j pd|j pdd Sn#t$rYnwxYwt }||S|r(t |}||St||}||St!||} | | S dd lm} | } | $t | j d| j| jd Sn#t$rYnwxYwdS) uFull resolution chain: built-in → models.dev → user config. This is the main entry point for --provider flag resolution. Args: name: Provider name or alias. user_providers: The ``providers:`` dict from config.yaml (optional). custom_providers: The ``custom_providers:`` list from config.yaml (optional). Returns: ProviderDef if found, else None. Nr)PROVIDER_REGISTRYc:g|]}t|k|Sr)r).0_ridrs r" z)resolve_provider_full..}s6''')$//9<<<<>   C  T T T T T T+//44E '''' 7'''# *++a//& 8"Z"/).u/E/K)L)L!&!9!?R5     D   " "D  ))^DD   )#~>>   *$0@AAK  HHHHHH"N9--  ^'!*"#   !       4s%A7C CC/6E'' E43E4)rsrrr)rsrrrrr)rrrr)rrrr)rurrr)r)rurrr)rrrr)rr)rrrurrrrr)rsrrrrr)rrrrrr)rrrrrr)rsrrrrr)NN)rsrrrrrrr))r __future__rlogging dataclassesrtypingrrrrr utilsr r getLoggerrloggerrror rqrrrrrrrrrrrrrrrrrrrrr!r"r's &#"""""!!!!!!33333333333333::::::::  8 $ $  $D- =='   D- --. D- MM%E   D- MM#"A!D-*--#5*+D-4#"/' 5D-@--"5/ AD-L &4& MD-Z==#$)/ [D-fmm;gD-n&EoD-v ==E'   wD-@}}(AD-H}}+?+ ID-T}}&+UD-\]]&"<]D-f--&.gD-D-n ,oD-v}}-wD-~==7D-F mmGD-N 0OD-X==/YD-b MM,   cD-l==&mD-v mm*wD-@ ==#/'   AD-J mm?*KD-T mm*UD-\ ,]D-d ]]7)eD-n ==':'    oD-z-A{D-D}}+5+ ED-D-P"M1*#]1}$mAD-D-D-DDDDT          & l  5   E  E U E E E+ +!"k#( 8)*(+,H-./4 56$78'9:!;@ IAB9CH\IJ,KP kQR;SXYZ [\-]b(cdefglJmn :ot -uv}w|}~@FAFGLMN iOP IQRYST+UV+WX0Y^ -_`Mab}chijkp Hqr8sx!yz"{|'}~%D 9EF9GHiIJ iKPQRwSXYZ[`Kab +ch }N  "'" *  "8$$,&.(* ))!!!!6:IIIIIIX    $1111&-6I7--(((($====*#####L&!!!!!L$$$$N V V V V V&LLLLb047;dddddddr!