PmjKdZddlmZddlZddlZddlZddlmZddlm Z m Z m Z ej e ZddlmZddlmZmZmZmZmZddlmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+dd l,m-Z-m.Z.m/Z/dd l0m1Z1m2Z2dd l3m4Z4dd l0m5Z5ddl6m7Z7m8Z8m9Z9d`dadZ:dbdZ;dcdZd`dfd"Z?dgd%Z@dhd&ZAdid'ZBdhd(ZCdjd)ZDdkdld+ZEdd,dmd/ZFhd0ZGdnd3ZHdod4ZIdpd7ZJdddd8dqd>ZKdkdrd@ZL dsdtdDZMdudGZNdudHZOdvdIZPdwdJZQdedKZRdxdLZSddddMdydOZTdodPZUdzdRZVdddSd{dVZWdddSd|dWZXddddXd}dYZYddddXd~dZZZddddd[dd\Z[dd_Z\dS)zGShared runtime provider resolution for CLI, gateway, cron, and helpers.) annotationsN)urlparse)AnyDictOptional)auth)CredentialPoolPooledCredential credential_pool_matches_providerget_custom_provider_pool_key load_pool) get_secret) AuthErrorDEFAULT_CODEX_BASE_URLDEFAULT_QWEN_BASE_URLDEFAULT_XAI_OAUTH_BASE_URLPROVIDER_REGISTRY_agent_key_is_usable_nous_inference_env_overrideformat_auth_errorresolve_provider resolve_nous_runtime_credentials!resolve_codex_runtime_credentials%resolve_xai_oauth_runtime_credentials resolve_qwen_runtime_credentials$resolve_api_key_provider_credentials-resolve_external_process_provider_credentialshas_usable_secret)get_compatible_custom_providers load_confignormalize_extra_headers)custom_provider_aliasescustom_provider_slug)OPENROUTER_BASE_URL)is_official_openai_host)base_url_host_matchesbase_url_hostnameenv_intnamestrdefaultreturnc.t||}||n|S)aProfile-scoped replacement for ``os.getenv`` on credential/provider reads. Routes through the secret scope (Workstream A): identical to ``os.getenv`` when multiplexing is off, scope-aware (and fail-closed on an unscoped read) when on. Genuinely-global vars are handled inside ``get_secret`` and still read ``os.environ``. Keeps the ``(name, default) -> str`` contract every call site here already relies on. ) _get_secret)r*r,vals A/home/thesage/.hermes/hermes-agent/hermes_cli/runtime_provider.py_getenvr23s! dG $ $C/33w.valuecv|ddS)N -)striplowerreplacer4s r1_normalize_custom_provider_namer<@s, ;;==   ( (c 2 22r3hostboolc\|pdd}|dvS)Nr).>::10.0.0.0 localhost 127.0.0.1)r9rstrip)r=hs r1_loopback_hostnamerGDs1 ##C((A < <!!i:&=&=## 4r3providermodelcRt|}|r|Sddlm}||||pdS)uResolve api_mode when no explicit/persisted mode applies. Precedence: URL detection (host-mandated wire shapes) first, then the transport the provider overlay itself declares via ``providers.determine_api_mode`` — which already handles host mandates, dual-wire providers, and the registry transport map — and only then the ``chat_completions`` default for genuinely unknown providers/endpoints. Before this helper the runtime paths consulted URL detection ONLY and silently landed reasoning providers on ``chat_completions`` whenever the hostname wasn't literally recognized. That is how ``openai-api`` pointed at OpenAI's data-residency hosts (``us.api.openai.com``) 400'd on every tool-calling turn: the provider declares ``codex_responses`` but the declaration was never consulted. Same latent class covered the other non-chat overlays (MiniMax family, copilot-acp). r)determine_api_modechat_completions)r_hermes_cli.providersrc)r`rTradetectedrcs r1_fallback_api_modergsK"(11H777777  h% 8 8 N_API_KEY` in the env, derived from the base URL host. Examples: https://api.deepseek.com/v1 → DEEPSEEK_API_KEY https://api.groq.com/openai/v1 → GROQ_API_KEY https://api.mistral.ai/v1 → MISTRAL_API_KEY https://generativelanguage.googleapis.com/v1beta/openai/ → GOOGLEAPIS_API_KEY Returns the env value (stripped) or "". Never returns env vars whose names are already explicitly checked elsewhere — those are handled by their own host-gated paths (OPENAI/OPENROUTER/OLLAMA). The vendor label is the *registrable* portion of the hostname: strip ``api.`` / ``www.`` prefixes, then take the second-to-last label (``api.deepseek.com`` → ``deepseek``). Falls back to "" for hostnames that don't yield a usable vendor label (IPs, loopback, single-label hosts). r)c3>K|]}|VdSN)isdigit.0chs r1 z(_host_derived_api_key..s* : :B2::<< : : : : : :r3r@)rC:cg|]}||Sr~)rxlbls r1 z)_host_derived_api_key..s 8 8 8cC 8c 8 8 8r3r)apiwwwc3FK|]}|r|ndVdS)_N)isalnumrws r1rzz(_host_derived_api_key..s3EEbjjll3EEEEEEr3)OPENAI OPENROUTEROLLAMA_API_KEY) r'anysplitpoplenjoinupperisalphar2r8)rTr^labelsvendor sanitizedenv_names r1_host_derived_api_keyrsv&!**H r : :(.."5"5b"9 : : :::r>!!SH__r 8 8X^^C00 8 8 8F VAY.00 1  VAY.00 6{{QrBZFEEfEEEEEKKMMI IaL0022r666r%%%H Hb ! ! 'R . . 0 00r3cD|pd}|sdSt|pd}|sdS|dks*|ds|drdS|drdSt |dkrdSdS) uDecide whether a configured ``model.base_url`` may back native Anthropic. Native ``provider: anthropic`` resolution honors ``model.base_url`` so users can point at Anthropic-compatible endpoints (official Anthropic/Claude hosts, Azure Foundry, MiniMax/Zhipu/LiteLLM-style ``/anthropic`` proxies, Kimi's ``/coding`` route). But a config can carry a *stale* non-Anthropic URL — e.g. ``provider: anthropic`` left with ``base_url: https://openrouter.ai/api/v1`` after a provider switch — which would route Anthropic OAuth/setup-token traffic to an OpenAI-compatible aggregator and 404. Ignore those. Returns True only when the URL plausibly speaks the Anthropic Messages protocol; otherwise the caller falls back to ``https://api.anthropic.com``. r)FrYz.anthropic.comz .claude.comTz .azure.comrZ)r8r'r9r\r_)rT candidater^s r1_anthropic_base_url_override_okrsR&&((I u!),,299;;H u&&&(*;*;r002288::06B==??EEGG th&&$0_4I4T4TU^4_4__ $7 77r3 target_modelapi_keyrct|dpd}t |d}|rt d|r|St|p|dpd}|sdS ddlm}||| S#t$rYdSwxYw) Nr`r)rkcopilotr,rdr)copilot_model_api_mode)r) r+rmr8r9rlrhermes_cli.modelsrrO)rhrrrrp model_namers r1_copilot_runtime_api_moder_s immJ77=2>>DDFFLLNN%immJ&?&?@@O? K^__\CY]]9%=%=CDDJJLLJ "!!"<<<<<<%%j'BBBB """!!!"s<C CC>rXbedrock_converserdcodex_app_serverrZrawrct|tr1|}|tvr|SdS)z@Validate an api_mode value from config. Returns None if invalid.N)rr+r8r9_VALID_API_MODES)rr]s r1rlrlsD#sYY[[&&(( ) ) )  4r3c"tpdS)uVReturn the trusted Nous runtime base URL override, if configured. Delegates to ``auth._nous_inference_env_override`` so every ``NOUS_INFERENCE_BASE_URL`` read shares one normalization path (trailing-slash stripping, blank → empty). The env source is trusted and intentionally bypasses the network host allowlist there. r))rr~r3r1!_nous_inference_base_url_overriders ( ) ) /R/r3rkOptional[Dict[str, Any]]c|s|S|dvr|St|dpd}|dkrdS|S)uOptional opt-in: rewrite api_mode → "codex_app_server" for OpenAI/Codex providers when the user has explicitly enabled that runtime via `model.openai_runtime: codex_app_server` in config.yaml. Default behavior is preserved: when the key is unset, "auto", or empty, this function is a no-op. Only providers in {"openai", "openai-codex"} are eligible — other providers (anthropic, openrouter, etc.) cannot be rerouted through codex. Returns the (possibly-rewritten) api_mode.>openai openai-codexopenai_runtimer)r)r+rmr8r9)r`rkrhruntimes r1%_maybe_apply_codex_app_server_runtimersp 111)-- 0117R88>>@@FFHHG$$$!! Or3)rhpoolrentryr requested_providerrOptional[CredentialPool]c  |p t}|p|dpd}t|ddpt|ddpdd}t|ddpt|dd}d} |d kr d } |pt}n|d kr d } |pt }n|d kr d} |pt }n|d kr%d} tj|} |p | r| jnd}n|dkrd} t|dpd } d} | dkrZt|dpd d} t| sd} | p|pd}n|dkr |pt}n|dkrd } n|dkr#ddlm} | |} t!p|}n|dkr7t#|t|dd|} |ptdj}nZ|dkrt|dpd } | dkrst|dpd d} | r| }t%|d}|r|} |r/| dkr) ddlm}||}n#t*$rd}YnwxYw|r|} | dkrt-jdd|}nCt|dpd }tj|} | o0|d| jdk}||krO|rMt|dpd d} | r| }t%|d}|dvrddlm}|||} n&|rt3||r|} nt5|||} |dvrddlm}||| |}t9|| | } |d!krt;j|}|| ||t|d"d#||d$S)%Nr,r)runtime_base_urlrTrWruntime_api_key access_tokenrdrrX xai-oauth qwen-oauth minimax-oauthrZ anthropicr`https://api.anthropic.com openrouterxainousr nous_api_moderr azure-foundryrkazure_foundry_model_api_mode/v1/?$ opencode-go opencode-zenopencode_model_api_modenormalize_opencode_base_url)r`rkrhlmstudiosourcer)r`rkrTrrcredential_poolr)rrmgetattrrErrrrinference_base_urlr+r8r9rr$rerrrrlrrrOresubrrrgrrauth_mod$_normalize_lmstudio_runtime_base_url)r`rrrhrreffective_modelrTrrkpconfigrIrHrrprinferredrpool_url_is_defaultrrs r1 _resolve_runtime_from_pool_entryrs0.00I$Ey}}Y'?'?E2O1488bGE:W[<\<\b`bjjknooHe.55[XZ9[9[G!H>!!$55 [ $99 \ ! !%44 _ $ $ (#'11Ng M : :2 [ '9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! J8J/J \ ! !22 U  $ V  666666 =11466B( Y  ,  E,b 1 1(    N0;N _ $ $9==44:;;AACCIIKK ? * *y}}Z88>B??EEGGNNsSSL ('-immJ.G.GHHO +*  $x+??? JJJJJJ77HH     $# + + +viX66H!)-- ";";"ArBBHHJJPPRR $'11%h(//#*>*>'B\BcBcdgBhBh*h ( * */B *y}}Z88>B??EEGGNNsSSL ('))-- *C*CDD 6 6 6 B A A A A A..xIIHH  O!EhPc!d!d O&HH *(HoNNH222AAAAAA..x8LL5H H:@JJ%6220  s5L LL requestedc|r:|r&|St}|d}t |t r:|r&|St dd}|r|SdS)z=Resolve provider request from explicit arg, config, then env.r`HERMES_INFERENCE_PROVIDERr)auto)r8r9rrmrr+r2)rrhrI env_providers r1resolve_requested_providerrKs)Y__&&)  &&(((!##I==,,L,$$,););)=)=,!!##))+++6;;AACCIIKKL 6r3provider_labelapi_mode_override provider_namecPt||}|sdS t|}|sdS|}|dSt |ddpt |dd}|sdS||pt |pd||d||dS#t $rYdSwxYw) zXCheck if a credential pool exists for a custom endpoint and return a runtime dict if so.rNrrr)rdzpool:)r`rkrTrrr)r r has_credentialsselectrr_rO)rTrrrpool_keyrr pool_api_keys r1_try_resolve_from_custom_poolr ^s,HMRRRH t""##%% 4  =4u&7>>d'%Q_acBdBd  4&)e-Eh-O-OeSe #(h((#     tts"#BB$B:B B%$B%resultNonecdD]:}||}t|tr|dkr||d<dS;dS)aqPropagate a per-provider output cap onto the resolved runtime dict. Accepts ``max_output_tokens`` or ``max_tokens`` on a ``custom_providers`` entry so a provider block can pin its own output limit. Gateway and CLI map this onto ``AIAgent.max_tokens`` only when the top-level ``model.max_tokens`` isn't set, so the documented global key still wins. )max_output_tokens max_tokensrrN)rmrint)rr _k_vs r1_lift_max_output_tokensr~sY2 YYr]] b#   266*,F& ' FF r3c\t|d}|r||d<dSdS)zCopy a validated ``extra_headers`` dict from a provider entry. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Never log them. extra_headersN)r!rm)rr rs r1_lift_extra_headersrs? ,EIIo,F,FGGM0"/00r3c  t|pd}|sdS|dkrdS|dkri|dsT tj|}|pd|krdSn#t $rYnwxYwt}|d}t|trAddl m }| D]%\}}t|ts||s(t|ddpd}|r"t|dnd} | s7t|d dpd} |d d} |t!t| p|t|vr"|d p+|d p|d pd} | r|d || | |ddd} |d} t| trt| | d<t#|| t%|dp|d}|r|| d<t'|| | cS'|d}t|trt(ddSt-|}|sdS|D]!}t|ts|d }|d } t|trt| tsnt|ddpd}|t!||vr|| t|d dpdd} t|ddpd}|r|| d<|r|| d<|d} t| trt| | d<t#|| t%|d}|r|| d<t|ddpd}|r|| d<t'|| | cSdS)Nr)rrKr providersr)is_provider_enabledkey_envrr*rrrT default_model)r*rTrra extra_bodyrk transportcustom_providerszcustom_providers in config.yaml is a dict, not a list. Each entry must be prefixed with '-' in YAML. Run 'hermes doctor' for details. provider_key)r*rTrra)r<rrrr8r9rr rmrrhermes_cli.configritemsr+r2r"rrlrrnwarningr)rrequested_norm canonicalrrrep_namerrresolved_api_key display_namerTr rrkrr*r rs r1_get_named_custom_providerr)s45G5M2NNN t"t!!.*C*CI*N*N!  1.AAIR&&((..00NBBtC    D ]]F ;''I)T""/"999999'oo//- "- "NGUeT**  '&u-- %))Ir228b99??AAG?FNww3399;;;B # O#&uyyB'?'?'E2#F#F#L#L#N#N  99VR00L!8L+G,,G "" !99U++^uyy/?/?^599ZCXCX^\^" % &' : :$,NN$4$4#3!&?B!?!? F "'> t!%&&  yy  99Z(($$$ Jx,E,E  599^R88>B??EEGG !8|!L!L L L JJLL ((599Y339r::@@BB   eii 2..4"55;;==  ( 'F9   2%1F> "YY|,, j$ ' ' 4#' #3#3F< E6***"599Z#8#899  *!)F: 7B//5266<<>>  )(F7Ov... 4sA== B  B cH t|duS#t$rYdSwxYw)u~Return True when config defines a custom provider matching the request. Thin public wrapper around :func:`_get_named_custom_provider` so other modules (e.g. the cronjob tool) can decide whether a provider name will actually resolve to a configured ``providers:`` / ``custom_providers:`` entry — without reaching into a private helper or duplicating the scan. NF)r)rO)rs r1has_named_custom_providerr+&s=)*<==TII uus  !!c t|}|sdS t}n#t$rYdSwxYw|d}t |t r|D]\}}t |t s|dp+|dp|dpd}t||kr,tt|t|cS t|}n#t$rd}YnwxYw|pgD]}t |t s|d}t |tr| sWt|d|kr5t|t|ddpdcSdS) uDMap an endpoint URL back to its canonical ``custom:`` menu key. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose base_url matches, or ``None`` when no entry owns the URL. Session persistence stores the agent's *resolved* provider, and for every named custom endpoint that is the literal string ``"custom"`` — the entry name is lost, and the api_key is deliberately never persisted. The endpoint URL is the one durable fact that survives the round-trip, so this reverse lookup lets persist/rebuild paths recover the entry identity (and with it key_env/api_key/api_mode resolution via :func:`_get_named_custom_provider`) instead of failing with ``auth_unavailable`` or silently rebuilding with placeholder credentials. NrrrrTr)r*r ) _normalize_base_url_for_matchr rOrmrrr"r#r+rr8) rTtargetrrr&r entry_urlrr*s r1find_custom_provider_identityr04s' +8 4 4F t tt ;''I)T""H'oo// H HNGUeT**  %  SEIIe$4$4S *8M8MSQS -Y776AA+CLL#g,,GGGGGB :6BB     !'R  %&&  yy  $$$ DJJLL   (:)>)> ? ?6 I I'EIInb117R88    J 4s$ 22D D/.D/c ht|pdsdS t}n#t$rYdSwxYwd fd }|d}t |trg|D]R\}}t |ts||r,tt|t|cSS t|}n#t$rd}YnwxYw|pgD]}t |ts|d }t |tr|sW||r5t|t|d dpdcSdS) aMap a model id back to the ``custom:`` entry that serves it. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose ``model`` / ``default_model`` matches, or whose ``models`` catalog (dict or list shape) contains the id. ``None`` when no entry serves the model. Companion to :func:`find_custom_provider_identity` (URL reverse-lookup) for the persistence paths where no base_url survived the round-trip: the session row always stores the model name, and a custom endpoint's model ids (e.g. an in-house SFT checkpoint) virtually never collide with catalog models on built-in providers, so the model is the last durable fact that can recover the entry identity. r)Nrrir-r>c(dD]Y}||}t|tr-|krdSZ|d}t|t r-t fd|DSt|tr|D]}t|tr-|krdSt|t rl|dp|d}t|tr-|krdSdS)N)rarTrc3K|];}t|kV._entry_serves_model..sU7:C  &&((F2r3rr*F) rmrr+r8r9rrkeyslist)rkeyr4ritemr4r.s r1_entry_serves_modelzCfind_custom_provider_identity_by_model.._entry_serves_models-  CIIcNNE%%% %++--*=*=*?*?6*I*Itt8$$ fd # # >Dkkmm  fd # # $ $ $dC(( TZZ\\-?-?-A-AV-K-K44dD))$((4..) r+r8r9r rOrmrrr"r#r) rarr9rr&rrr*r.s @r1&find_custom_provider_identity_by_modelr:js"   # # % % + + - -F t tt( ;''I)T""H'oo// H HNGUeT** ""5)) H+CLL#g,,GGGGG H :6BB     !'R  %&&  yy  $$$ DJJLL    u % % 'EIInb117R88     4s#A AA4D DD)rTconfig_providerrar;c|rt|}|r|S|rt|}|r|St|pd}|sV tt dpd}n#t $rd}YnwxYw|s2tjdd}t|}|r|dvrdS t|}|Qtt|dpd}|r|S| dr|Sd|Sn#t $rYnwxYwdS)uqRecover a routable ``custom:`` identity for a bare custom provider. The bare string ``"custom"`` is the *resolved billing class* shared by every named ``providers:`` / ``custom_providers:`` entry — it is NOT a routable provider identity (``resolve_runtime_provider("custom")`` falls through to the OpenRouter default URL with no api_key, which surfaces to the user as "No LLM provider configured"). Any code path that persists or restores a session's provider override must run the resolved provider through this helper so a bare ``"custom"`` is upgraded back to its durable ``custom:`` menu key. Three recovery sources, in priority order: 1. ``base_url`` — reverse-lookup the entry that owns the endpoint URL (the one fact that always survives the persistence round-trip when a URL was recorded). 2. ``model`` — reverse-lookup the entry that serves the session's model (``model``/``default_model``/``models`` catalog). The session row always stores the model name, so when no base_url survived (the recurring Desktop/TUI regression vector) the model is the last session-scoped fact that can recover the entry — and unlike the config fallback below it stays correct after the user points their global default at a different provider. 3. ``config_provider`` — the active ``config.model.provider`` (or its ``provider``/``HERMES_INFERENCE_PROVIDER`` equivalent). When neither a base_url nor a model recovered the entry, the configured provider is the only durable identity left, so fall back to it when it names a real entry. Returns ``custom:`` when a routable identity is recovered, else ``None`` (caller keeps whatever it had — bare ``"custom"`` only as a last resort, e.g. a genuine ad-hoc endpoint with no config entry). r)r`r>rrKrNrTr) r0r:r+r8rrmrOosenvironr<r)r)rTr;raidentityrcandidate_normrs r1canonical_custom_identityrAsP0::  O 9%@@  OO)r**0022I  -//33J??E2FFLLNNII   III  LJNN#>CCIIKK 4Y??N ^/OOOt *955  5S:9N9N9TRT5U5UVVH ((33 &%%-^-- -       4s2AB B#"B#2AE8EE E"!E"ct|pddS)Nr)rW)r+r8rEr9r;s r1r-r- s: u{   ! ! # # * *3 / / 5 5 7 77r3custom_providerc|d}t|tr|siSdt|iS)Nr)rmrr)rCrs r1"_custom_provider_request_overridesrE sF $$\22J j$ ' 'z $z** ++r3explicit_api_keyexplicit_base_urlrGrHc  |pd}|r/|dkr) ddlm}||dkrd}n#t$rYnwxYw|dkr|r|d}t |dd}|rd|d<|St|dpt|d }t|d }|pd|r"td dnd|r"td dndt|g} td | Ddpd} dt|pd|| d|dSt|} | sdS|pdp| ddd}|sdSt |d| d| d}|r| d} | r| |d<t| dtr | d|d<t!| } | r+it#| dpi| |d<| drt#| d|d<|St|dpt|d }t|d }|pdt%| ddpdtt%| ddpdd|r"td dnd|r"td dndt|g} td| Dd} d| dpt|pd|| pdd| d|d}| dr | d|d<t| dtr | d|d<| drt#| d|d<t!| } | r| |d<|S)Nr)rKrrLrWz direct-aliasr openai.comopenai.azure.comrMOPENAI_API_KEYOPENROUTER_API_KEYc38K|]}t||VdSrur)rxcs r1rzz0_resolve_named_custom_runtime..As0 C C1.?.B.B CQ C C C C C Cr3no-key-requiredrdr`rkrTrrrrTrkr*rrarrequest_overridesrrrc38K|]}t||VdSrurOrxrs r1rzz0_resolve_named_custom_runtime..}s1bb)EVW`EaEabIbbbbbbr3zcustom_provider:r`rkrTrr)r8r9rNrrOrEr r&r2rnextr_r)rmrrrErr+)rrGrHr$rRrT pool_result_da_is_openai_url_da_is_openrouterapi_key_candidatesrrCrrS_cp_is_openai_url_cp_is_openrouterr s r1_resolve_named_custom_runtimer^s).B5577==??N.H44  M M M M M M  00H<P $"4    11CDDO t  b'')) /   z2 . . fSkk  t0(ODWDWXbDcDctCtGtGHNtOtOPPPK%((11  .#-K o))*=>> D D T/>?R/SK+ ,>OO  0{':;;ArBB0#0K+ ,    / / R+/0P+Q+QK (/,GG~K`aik}K~K~//JJ  R&&(( O   2 . . 4"55;;==O'' 266<"==CCEErJJPPRR7H P!2 & & , , . . .b6G P%r * * 0 0 2 2 2b h'' bb/AbbbdfggG#'' 33 #H - - //V_%8%8AS%T%TVVF7##3)'2w/%%&9::C@@K&56I&J"#?++I"&'G"H"H:?KK8&7"# MsA AAc t}t|dtr|dnd}t|dtr|dnd}d}dD]V}||}t|tr*|r|}nW|pd} |}| r/| dkr) ddlm} | | dkrd} n#t$rYnwxYwtdd} td d} d } |r+|s)| d kr |r|d krd } n| dkrt||rd } |pdp"| p | r|ndp| pt d }t|d}|p(| dko"| p|| ko|| pd d k}|r |tdtdg}n~t|d}t|d}t|d}|| r|nd|rtdnd|s|rtdnd|rtdndt|g}td|Dd}|s|rdnd}| dkrdnd}|dkrA|r?t!||t#|d| dkr|nd}|r|S|dkr|s|sd}||dkrt%||n2t#|dpt'|pd|||dS)NrTr)r`)rrrKrrLr$CUSTOM_BASE_URLFrTrWrMrrMrLz ollama.comrJrKOLLAMA_API_KEYc3zK|]6}t|t|pdV7dS)r)N)rr+r8rUs r1rzz._resolve_openrouter_runtime..sIjj)M^_hMiMijY_"   # # % %jjjjjjr3explicitz env/configrkrrQrdrV)rrrmr+r8r9rNrrOr2rSr$rEr&rrWr rlrrr_)rrGrHrhrHrI cfg_api_keykvr$rRenv_openrouter_base_urlenv_custom_base_urluse_config_base_urlrT_is_openrouter_url_is_openrouter_contextr[_is_ollama_url_is_openai_url_is_openai_azurerreffective_providerrXs r1_resolve_openrouter_runtimerps "##I0:9==;T;TVY0Z0Zb9==,,,`bL0:9==;T;TVY0Z0Zb9==,,,`bLK  MM!   a   !'')) ''))K E(.B5577==??N%%''--//L .H44  M M M M M M  00H<>@@  '$5' V # # +<6#9#9&*# x ' ',X ,- - '#'   b''))   $7 ?L   R  #   fSkk  /xII0,& D $ K4K(K D 06B>>sCC C    ( ) ) $ % % 2(LII1(LII1((0J0J,,PT      X%%g%>P%#'  ) )39hGGG Y]]:66 7 7 #H - -    s?E E$#E$)rGrHrc t|pd}t|pdd}t|dpd}d}d}d} i} |dkrt|dpdd}t |dpd}t|d pdpd} |d } t | tr| } t|p|d pd} | r/|d kr) d dlm } | | }n#t$rd}YnwxYw|r|}tddd}|p|p|}|std|d krtjdd|}| dkr|r|}d}d}n d dlm}m}m}n&#t$r}td|d|d}~wwxYwt| dpdp|} ||}||}n/#t&$r"}tt||d}~wwxYw|}d}d}i}|dkr=t| dpd}|r||d<d|||||||dS|}|s' d dlm}|dpd}n#t$rd}YnwxYw|s"tdd}|std|s|rdnd}d|||d||d S)!aResolve an Azure Foundry runtime entry. Reads ``model.base_url`` + ``model.api_mode`` from config.yaml (or explicit overrides), pulls the API key from ``.env`` / env var, and strips a trailing ``/v1`` for Anthropic-style endpoints because the Anthropic SDK appends ``/v1/messages`` internally. When ``model.auth_mode == "entra_id"`` (and the model is OpenAI-style), the returned ``api_key`` is a zero-arg callable produced by :func:`agent.azure_identity_adapter.build_token_provider` rather than a string. Downstream code that constructs an OpenAI SDK client passes this through unchanged (the SDK accepts ``Callable[[], str]`` for ``api_key`` and calls it before every request). Code paths that need a string (logging, manual HTTP probes, header injection) must use the helpers in ``agent.azure_identity_adapter``. Raises :class:`AuthError` when required values are missing. r)rWr`rdrrrTrk auth_modeentrar,rZrrNAZURE_FOUNDRY_BASE_URLzpAzure Foundry requires a base URL. Set it via 'hermes model' or the AZURE_FOUNDRY_BASE_URL environment variable.rentra_idrc)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULTbuild_token_providerzAzure Foundry Entra ID auth requires the 'azure-identity' package. Install it with: pip install azure-identity (import failed: )scope)rz)r)r`rkrTrrrrsrr) get_env_valueAZURE_FOUNDRY_API_KEYaAzure Foundry requires an API key. Set AZURE_FOUNDRY_API_KEY in ~/.hermes/.env or run 'hermes model' to configure. To use keyless Microsoft Entra ID auth instead, set model.auth_mode: entra_id in config.yaml (or pick 'Microsoft Entra ID' in 'hermes model').r)r`rkrTrrrrr)r+r8rErmr9rlrrrrrOr2rrragent.azure_identity_adapterrvrwrx ImportErrorr!r{)rrhrGrHrexplicit_base_url_cleanrIrH cfg_api_mode cfg_auth_mode cfg_entra_entrarrr env_base_urlrTrrrrrvrwrxrrz entra_configtoken_provider clean_entraconfigured_scoper{s r1_resolve_azure_foundry_runtimer&s14+1r2288::!"3"9r::@@BBII#NNy}}Z006B77==??EEGGLL%LM "I&&9==44:;;AACCJJ3OO &y}}Z'@'@AAWEW IMM+66C)DDJJLLRRTTaXa w'' fd # # I,H)-- *B*BHbIIOOQQO$<+???  F F F F F F33ODDHH   HHH   $#L3R88>>@@GGLLL&F,F,H   ?   +++6)R22  "" ! #,GF!II     .'*...  IMM'**0b117799*)  322    "6!5\!J!J!J 3 3 3C))s2 3$GF"I  " ""9==#9#9#?R@@FFHH  8'7 G$($ " "4   G   7 7 7 7 7 7#m$;<<BGG   GGG  ?1266<<>>   7   - P0A PZZF# 0  sTG&& G54G55 J J# JJ#K88 L$LL$N N%$N%c & t|pd}t|pdd}|s|sdS|dkrt|dpd}d}|dkrZt|dpdd}t |sd}|p|pd}|} | s!ddlm} | } | std dd || d |d S|d kr|pt}|} d} | sft} | dd} | d} |s+| dddp|}d d|| d | |dS|dkrddl m } tjdpi}|p`tpRt|dp tjd}|pct#|t%dt'ddr6t|dpdnd} |dp|d}| st)t+t-dd} | dd} | d}|s+| dddp|}d| |p|dpd|| d ||dS|d krt/||||!St1j|}|r|jdkrd}|jr:t-|jdd}|}|sF|d"vr9t7|} | ddd}n |p|j}|} | sPt7|} | dd} |s)| ddd}d#}|d$krt;|| |%}n|d&krd}nt|dpd}t=|d'}|rt?||r|}n'tA|||p|dd}|||d| d |d SdS)(Nr)rWrr`rTrrresolve_anthropic_tokenNo Anthropic credentials found. Set ANTHROPIC_TOKEN or ANTHROPIC_API_KEY, run 'claude setup-token', or authenticate with 'claude /login'.rZrcrRrr last_refreshrXr`rkrTrrrrrrr<HERMES_NOUS_MIN_KEY_TTL_SECONDS agent_keyagent_key_expires_at expires_atHERMES_NOUS_TIMEOUT_SECONDS15timeout_secondsr,r`rkrTrrrrr)rrhrGrH> kimi-codingkimi-coding-cnrdrrrrk)!r+r8rErmr9ragent.anthropic_adapterrrrrrerrget_provider_auth_staterDEFAULT_NOUS_INFERENCE_URLrmaxr(rfloatr2rr auth_typebase_url_env_varrrrrlrrg)r`rrhrGrHrrIrHrTrrrcredsrstaterrenv_urlrkrrps r1_resolve_explicit_runtimersu+1r2288::-344::<<CCCHH $5t;9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! $S S8S"  G G G G G G--//G V $,  "4    >!!$>(>"  M577Eii 2..G 99^44L$ M 99Z44;;C@@LH&)  ("4   6666666088>B  o022 o599122Yh6YZZ``bbiijmnn # #B A4HHII C +&&," - - 3 3 5 5 5  YY566Q%))L:Q:Q  M4 %g.KT&R&R S SEii 2..G<00J$ M 99Z44;;C@@LH% l&TimmI6N6N&TRTUU  $"4   ?""-1-/      #H--G0 7$ 11  # Pg6;;AACCJJ3OOG$ A<<<}$d-|#|p|d?pd |$dd  d|$d@d |$dAdB|$dC|dDS#t$r$|dEkrt@)dFYnwxYw|dGkr tU}$dGdH|$dd  d|$d@d |$dAdI|$dJ|dKS#t$r$|dEkrt@)dLYnwxYw|dMkr tW}$dMdH|$dpd dptX|$d@d |$dAdI|$dJ|dKS#t$r$|dEkrt@)dNYnwxYw|dOkr t[}$dOd |$dd  d|$d@d |$dAdP|$dQ|dRS#t$r$|dEkrt@)dSYnwxYw|dTkrZt]j|}%|%rD|%j/dUkr9ddVl0m1}&|&}$|d|$d|$d@|$dAdW|d S|dXkrte|}$dXd |$dd  d|$d@d |$dYd tg|$dZpg|$dAd[|d\S|dkrt#|dpd }d ?|dkrM|dpd  d?ti?sd ??pd]}d|vp?od?v}'|'rd }d^D]`}(t#||(pd })|)r&t|)d }|rna|s6t#|d@pd }|sDtdd p!tdd }|std_n!dd`l5m6}*|*}|stdadd||db|d S|dckrdddl7m8}+m9},m:}-m;}.|dev}/|/s|+stdfdgh|dci}0|0dipd p |-}1|,pdj}2|0dki}3d}4|3dlrf|3dmrQ|3dl|3dmdn}4|3dor |3do|4dp<|3dqr |3dq|4dq<t#|p|d?pd }5t/txj=drd }6|.|5r|6sdcdds|1dtdu|2|1d)|dv}ndcdwds|1dtdu|2|1|dx}|4r|4|dy<|St]j|}%|%r|%j/d@krt}|}$t|$d@s|>||9|}|dkrtjJ|}||9||$d@d |$dAdb|d St)|||}||d<|S)a)Resolve runtime provider credentials for agent execution. target_model: Optional override for model_cfg.get("default") when computing provider-specific api_mode (e.g. OpenCode Zen/Go where different models route through different API surfaces). Callers performing an explicit mid-session model switch should pass the new model here so api_mode is derived from the model they are switching TO, not the stale persisted default. Other callers can leave it None to preserve existing behavior (api_mode derived from config). r)rr rNz provider z" is disabled in config (providers.z.enabled: false)moardz moa://localzmoa-virtual-providerrRr)rz azure.comAZURE_ANTHROPIC_KEYANTHROPIC_API_KEYrZrWzazure-explicitr)rrhrGrHr)vertexz google-vertexz vertex-aiz gcp-vertexvertexai)get_vertex_configaVertex AI credentials could not be resolved. Vertex uses OAuth2 (not a static API key): provide a service-account JSON via GOOGLE_APPLICATION_CREDENTIALS (or VERTEX_CREDENTIALS_PATH) in ~/.hermes/.env, or run 'gcloud auth application-default login' for ADC. Set the GCP project/region under vertex: in config.yaml if they aren't embedded in the credentials. Run `hermes setup` to install Vertex support.rz vertex-oauth)rrGrHrr`rT)rr))rMz anthropic.comrJc38K|]}t|VdSru)r&)rxr=rHs r1rzz+resolve_runtime_provider.. sA&lD99r3rF)r`rrhrGrHrrOPENAI_BASE_URLr$>rrKT>rrrrrrrrrrrz)rrrzzINous pool entry agent_key expired/missing, refreshing selected pool entryz"Nous pool entry refresh failed: %szRNous pool entry agent_key still unavailable, falling through to runtime resolutionr)rT)r`rrrhrrrrrrr,rrportalrrrzUAuto-detected Nous provider but credentials failed; falling through to next provider.rrXzhermes-auth-storerrzVAuto-detected Codex provider but credentials failed; falling through to next provider.rzZAuto-detected xAI OAuth provider but credentials failed; falling through to next provider.rzqwen-cli expires_at_ms)r`rkrTrrrrz@Qwen OAuth credentials failed; falling through to next provider.r oauth_minimax))resolve_minimax_oauth_runtime_credentialsoauthz copilot-acpcommandargsprocess)r`rkrTrrrrrr)r api_key_envzNo Azure Anthropic API key found. Set AZURE_ANTHROPIC_KEY or ANTHROPIC_API_KEY, or point key_env/api_key_env in your config.yaml model section at a custom env var.rrenvbedrock)has_aws_credentialsresolve_aws_auth_env_varresolve_bedrock_regionis_anthropic_bedrock_model> aws-bedrockamazon-bedrockawsamazonrzNo AWS credentials found for Bedrock. Configure one of: - AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - AWS_PROFILE (for SSO / named profiles) - IAM instance role (EC2, ECS, Lambda) Or run 'aws configure' to set up credentials.no_aws_credentials)coderegionzaws-sdk-default-chain guardrailguardrail_identifierguardrail_version)guardrailIdentifierguardrailVersionstream_processing_modestreamProcessingModetraceAWS_BEARER_TOKEN_BEDROCKzhttps://bedrock-runtime.z.amazonaws.comzaws-sdk)r`rkrTrrrbedrock_anthropicrr)r`rkrTrrrrguardrail_configz, z Set r@z*No usable credentials found for provider 'z'.missing_api_key)r`rrrrrkrrrr)Krr!rr rrrm ValueErrorr8r2rErragent.vertex_adapterrrr^r+r9rrprrr>r rOrrrrr(rrnrtry_refresh_currentr rrerrrrorrrrrrrNrrr6rrragent.bedrock_adapterrrrrr=r>rrrapi_key_env_varsrrlrrrrgrrr)@rrGrHrrrr _full_cfg _provs_cfg_block _eff_base _azure_key azure_runtimertokenrTcustom_runtimerhrI_known_cloud_hostsrr`explicit_runtimeshould_use_poolenv_openai_base_urlrghas_custom_endpointhas_runtime_overriderrr min_ttl nous_state refreshedrrrrr_is_azure_endpointhint_keyenv_varrrrrr is_explicit _bedrock_cfgr auth_source_grr_current_model_has_bearer_token env_nameshintrkrrpr _effectiverrHs@ @r1resolve_runtime_providerrrs""4I>>CBBBBBBB I/9)T/J/JT{+++PTJ*d## 233 fd # # ,?,?,G,G C.CC0CCC  U""*%-,"4    #(b//11I[(([I-E-E  # * * , , 8,b117799 8*B//5577  $,!((--!&"4    _,,61'))-/%    ___::::::++--x H @ !* ,,$"4    3-)+N /A+, %5%'' 9==44:;;AACCIIKK 9==44:;;AACC  LL88"  . 6'9%5&7 1C,-)+H "##I0-)+!  ,.O<9==44:;;AACCIIKK 9==44:;;AACC %&7<<BBDD")*?"D"D"J"J"L"L"  '" '&    'L,>>>"& #$4$I8IJJ "8 8 )'' )((  &5?y"""4  >$$&&>   0$7765."55  v  %"3"g&GNNOOG$UK>>(/7Mt(T(T 66J ( G<< & hiii% $ 8 8 : :II %%%LL!EsKKK $IIIIII%(%E'8$??>"5."==! &-UK%F%F07?UW[0\0\!(!>!>""J $&+? G+T+T&LL!uvvv#%L   0E#5t<<uj$77  4!#5#)  6 = : : : : : :4 %g.KT&R&R S SE#)M,*X)-- :R:R*XVXYY!IIj"55<!! =577E*-!IIj"55<#>)HNN,<,<<  @[L,>,>,@,@@  % E6  immH55;<<BBDD#GR006688E DIMM)44:;;AACC 1266<<>>@2B77==?? E  H G G G G G++--E V $, "4    9            ),ii  #6#6#8#8 @ *  #{}}((B77 ""8,,299;;W?U?U?W?W..00K4K {B// 77) * * 9sww7J/K/K 9'*+A'B$'(;$<   ww/00 Y;>?W;X !78www 9,/L )\KY]]9-E-EKLLRRTT 0JB!O!O!U!U!W!WXX % %n 5 5 >O &0MvMMM$% %)&8  GG&.MvMMM$% &8G  ;*:G& ' #H--GH 7$ 114X>>!9!5!566  '":;;I+4<'9''''"DOXOOOO!& 9==44:;;AACCIIKK  8 # #%MM*55;BBDDKKCPPLH599Z#<#<#C#CC#H#H% y 0 )R(()HH   (HH"%immJ&?&?&E2"F"F"L"L"N"N"T"T"V"V -immJ.G.GHHO:::FEEEEE)IY]]9b-I-I 228ZHH  %I(Tg%h%h * .h (T iQS8T8T 6 6 6 E E E E E E228XxPPH z ! !DXNNH   yyB//ii%00"4    *-)+G %7G ! Nsv'O;; P  P %S:: T+T&&T+ B<[+[43[4>A9]88+^&%^&0B`22+a a *A9c$$+dderrorrOcht|trt|St|Sru)rrrr+)rs r1format_runtime_provider_errorrs.%##( ''' u::r3)r))r*r+r,r+r-r+)r4r+r-r+)r=r+r-r>)rHr+rIr+r-r>)rTr+r-rU)r`r+rTr+rar+r-r+)rhrirTr+r-r+)rTr+r-r+)rTr+r-r>)r-riru)r`rUrrUr-r>)rhrirr+rrUr-r+)rrr-rU)r-r+)r`r+rkr+rhrr-r+)r`r+rr rr+rhrrrrrUr-ri)rrUr-r+)NN) rTr+rr+rrUrrUr-r)rrir rir-r )rr+r-r)rr+r-r>)rar+r-rU)rTrUr;rUrarUr-rU)rCrir-ri)rr+rGrUrHrUr-r)rr+rGrUrHrUr-ri) rr+rhrirGrUrHrUrrUr-ri)r`r+rr+rhrirGrUrHrUrrUr-r) rrUrGrUrHrUrrUr-ri)rrOr-r+)]__doc__ __future__rloggingr=r urllib.parsertypingrrr getLogger__name__rn hermes_clirragent.credential_poolr r r r r agent.secret_scoperr/rNrrrrrrrrrrrrrrrrr!rr r!rer"r#hermes_constantsr$r%utilsr&r'r(r2r<rGrSr_rgrrrrrrrrrrlrrrrr rrr)r+r0r:rAr-rEr^rprrrrr~r3r1rsMM"""""" !!!!!!&&&&&&&&&&  8 $ $''''''988888$ ONNNNNNN000000888888CCCCCCCCCC / / / / /3333==== 5555<****ZOOOOO2BBBB,61616161r""""J.,88888*#' """""":   0000>+/%)"&PPPPPPf,(,#' @    0000KKKK\    3333lCCCCP#%) VVVVVVr8888,,,,'+'+ AAAAAAN'+'+ KKKKKKd'+'+"& ffffff\'+'+"&``````J $&*'+"& \ \ \ \ \ \ ~r3