yjdZddlmZddlZddlZddlZddlmZddlm Z m Z m Z ej e ZddlmZddlmZmZmZmZmZddlmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.dd l/m0Z0m1Z1m2Z2dd l3m4Z4m5Z5dd l6m7Z7dd l3m8Z8ddl9m:Z:m;Z;mdcdZ?dddZ@dedZAd`dfd"ZBdgd%ZCdhd&ZDdid'ZEdhd(ZFdjd)ZGdkdld+ZHdd,dmd/ZIhd0ZJdnd3ZKdod4ZLdpd7ZMdddd8dqd>ZNdkdrd@ZO dsdtdDZPdudGZQdudHZRdvdIZSdwdJZTdedKZUdxdLZVddddMdydOZWdodPZXdzdRZYdddSd{dVZZdddSd|dWZ[ddddXd}dYZ\ddddXd~dZZ]ddddd[dd\Z^dd_Z_dS)zGShared runtime provider resolution for CLI, gateway, cron, and helpers.) annotationsN)urlparse)AnyDictOptional)auth)CredentialPoolPooledCredential credential_pool_matches_providerget_custom_provider_pool_key load_pool) get_secret)ACTUAL_LOCAL_NOAUTH_PLACEHOLDER AuthErrorDEFAULT_CODEX_BASE_URLDEFAULT_QWEN_BASE_URLDEFAULT_XAI_OAUTH_BASE_URLPROVIDER_REGISTRY_agent_key_is_usable_nous_inference_env_overrideformat_auth_errorresolve_provider resolve_nous_runtime_credentials!resolve_codex_runtime_credentials%resolve_xai_oauth_runtime_credentials resolve_qwen_runtime_credentials$resolve_api_key_provider_credentials-resolve_external_process_provider_credentialshas_usable_secretis_actual_local_base_urlnormalize_actual_base_url)get_compatible_custom_providers load_confignormalize_extra_headers)custom_provider_aliasescustom_provider_slug)OPENROUTER_BASE_URL)is_official_openai_host)base_url_host_matchesbase_url_hostnameenv_intnamestrdefaultreturnc.t||}||n|S)aProfile-scoped replacement for ``os.getenv`` on credential/provider reads. Routes through the secret scope (Workstream A): identical to ``os.getenv`` when multiplexing is off, scope-aware (and fail-closed on an unscoped read) when on. Genuinely-global vars are handled inside ``get_secret`` and still read ``os.environ``. Keeps the ``(name, default) -> str`` contract every call site here already relies on. ) _get_secret)r-r/vals A/home/ragecks/.hermes/hermes-agent/hermes_cli/runtime_provider.py_getenvr56s! dG $ $C/33w.valuecv|ddS)N -)striplowerreplacer7s r4_normalize_custom_provider_namer?Cs, ;;==   ( (c 2 22r6hostboolc\|pdd}|dvS)Nr,.>::10.0.0.0 localhost 127.0.0.1)r<rstrip)r@hs r4_loopback_hostnamerJGs1 ##C((A < <!!i:&=&=## 4r6providermodelcRt|}|r|Sddlm}||||pdS)uResolve api_mode when no explicit/persisted mode applies. Precedence: URL detection (host-mandated wire shapes) first, then the transport the provider overlay itself declares via ``providers.determine_api_mode`` — which already handles host mandates, dual-wire providers, and the registry transport map — and only then the ``chat_completions`` default for genuinely unknown providers/endpoints. Before this helper the runtime paths consulted URL detection ONLY and silently landed reasoning providers on ``chat_completions`` whenever the hostname wasn't literally recognized. That is how ``openai-api`` pointed at OpenAI's data-residency hosts (``us.api.openai.com``) 400'd on every tool-calling turn: the provider declares ``codex_responses`` but the declaration was never consulted. Same latent class covered the other non-chat overlays (MiniMax family, copilot-acp). r)determine_api_modechat_completions)rbhermes_cli.providersrf)rcrWrddetectedrfs r4_fallback_api_moderjsK"(11H777777  h% 8 8 N_API_KEY` in the env, derived from the base URL host. Examples: https://api.deepseek.com/v1 → DEEPSEEK_API_KEY https://api.groq.com/openai/v1 → GROQ_API_KEY https://api.mistral.ai/v1 → MISTRAL_API_KEY https://generativelanguage.googleapis.com/v1beta/openai/ → GOOGLEAPIS_API_KEY Returns the env value (stripped) or "". Never returns env vars whose names are already explicitly checked elsewhere — those are handled by their own host-gated paths (OPENAI/OPENROUTER/OLLAMA). The vendor label is the *registrable* portion of the hostname: strip ``api.`` / ``www.`` prefixes, then take the second-to-last label (``api.deepseek.com`` → ``deepseek``). Falls back to "" for hostnames that don't yield a usable vendor label (IPs, loopback, single-label hosts). r,c3>K|]}|VdSN)isdigit.0chs r4 z(_host_derived_api_key..s* : :B2::<< : : : : : :r6rC)rF:cg|]}||Sr)r{lbls r4 z)_host_derived_api_key..s 8 8 8cC 8c 8 8 8r6r)apiwwwc3FK|]}|r|ndVdS)_N)isalnumrzs r4r}z(_host_derived_api_key..s3EEbjjll3EEEEEEr6)OPENAI OPENROUTEROLLAMA_API_KEY) r*anysplitpoplenjoinupperisalphar5r;)rWralabelsvendor sanitizedenv_names r4_host_derived_api_keyrsv&!**H r : :(.."5"5b"9 : : :::r>!!SH__r 8 8X^^C00 8 8 8F VAY.00 1  VAY.00 6{{QrBZFEEfEEEEEKKMMI IaL0022r666r%%%H Hb ! ! 'R . . 0 00r6cD|pd}|sdSt|pd}|sdS|dks*|ds|drdS|drdSt |dkrdSdS) uDecide whether a configured ``model.base_url`` may back native Anthropic. Native ``provider: anthropic`` resolution honors ``model.base_url`` so users can point at Anthropic-compatible endpoints (official Anthropic/Claude hosts, Azure Foundry, MiniMax/Zhipu/LiteLLM-style ``/anthropic`` proxies, Kimi's ``/coding`` route). But a config can carry a *stale* non-Anthropic URL — e.g. ``provider: anthropic`` left with ``base_url: https://openrouter.ai/api/v1`` after a provider switch — which would route Anthropic OAuth/setup-token traffic to an OpenAI-compatible aggregator and 404. Ignore those. Returns True only when the URL plausibly speaks the Anthropic Messages protocol; otherwise the caller falls back to ``https://api.anthropic.com``. r,Fr\z.anthropic.comz .claude.comTz .azure.comr])r;r*r<r_rb)rW candidateras r4_anthropic_base_url_override_okrsR&&((I u!),,299;;H u&&&(*;*;r002288::06B==??EEGG th&&$0_4I4T4TU^4_4__ $7 77r6 target_modelapi_keyrct|dpd}t |d}|rt d|r|St|p|dpd}|sdS ddlm}||| S#t$rYdSwxYw) Nrcr,rncopilotr/rgr)copilot_model_api_mode)r) r.rpr;r<rorhermes_cli.modelsrrR)rkrrrrs model_namers r4_copilot_runtime_api_moderds immJ77=2>>DDFFLLNN%immJ&?&?@@O? K^__\CY]]9%=%=CDDJJLLJ "!!"<<<<<<%%j'BBBB """!!!"s<C CC>r[bedrock_conversergcodex_app_serverr]rawrct|tr1|}|tvr|SdS)z@Validate an api_mode value from config. Returns None if invalid.N)rr.r;r<_VALID_API_MODES)rr`s r4rorosD#sYY[[&&(( ) ) )  4r6c"tpdS)uVReturn the trusted Nous runtime base URL override, if configured. Delegates to ``auth._nous_inference_env_override`` so every ``NOUS_INFERENCE_BASE_URL`` read shares one normalization path (trailing-slash stripping, blank → empty). The env source is trusted and intentionally bypasses the network host allowlist there. r,)rrr6r4!_nous_inference_base_url_overriders ( ) ) /R/r6rnOptional[Dict[str, Any]]c|s|S|dvr|St|dpd}|dkrdS|S)uOptional opt-in: rewrite api_mode → "codex_app_server" for OpenAI/Codex providers when the user has explicitly enabled that runtime via `model.openai_runtime: codex_app_server` in config.yaml. Default behavior is preserved: when the key is unset, "auto", or empty, this function is a no-op. Only providers in {"openai", "openai-codex"} are eligible — other providers (anthropic, openrouter, etc.) cannot be rerouted through codex. Returns the (possibly-rewritten) api_mode.>openai openai-codexopenai_runtimer,r)r.rpr;r<)rcrnrkruntimes r4%_maybe_apply_codex_app_server_runtimersp 111)-- 0117R88>>@@FFHHG$$$!! Or6)rkpoolrentryr requested_providerrOptional[CredentialPool]c  |p t}|p|dpd}t|ddpt|ddpdd}t|ddpt|dd}d} |d kr d } |pt}n|d kr d } |pt }n|d kr d} |pt }n|d kr%d} tj|} |p | r| jnd}n|dkrd} t|dpd } d} | dkrZt|dpd d} t| sd} | p|pd}n|dkr |pt}n|dkrd } n|dkr#ddlm} | |} t!p|}n|dkr7t#|t|dd|} |ptdj}nZ|dkrt|dpd } | dkrst|dpd d} | r| }t%|d}|r|} |r/| dkr) ddlm}||}n#t*$rd}YnwxYw|r|} | dkrt-jdd|}nCt|dpd }tj|} | o0|d| jdk}||krO|rMt|dpd d} | r| }t%|d}|dvrddlm}|||} n&|rt3||r|} nt5|||} |dvrddlm}||| |}t9|| | } |d!krt;j|}|| ||t|d"d#||d$S)%Nr/r,runtime_base_urlrWrZruntime_api_key access_tokenrgrr[ xai-oauth qwen-oauth minimax-oauthr] anthropicrchttps://api.anthropic.com openrouterxainousr nous_api_moderr azure-foundryrnazure_foundry_model_api_mode/v1/?$ opencode-go opencode-zenopencode_model_api_modenormalize_opencode_base_url)rcrnrklmstudiosourcer)rcrnrWrrcredential_poolr)rrpgetattrrHrrrrinference_base_urlr.r;r<rr'rhrrrrorrrRresubrrrjrrauth_mod$_normalize_lmstudio_runtime_base_url)rcrrrkrreffective_modelrWrrnpconfigrLrKrrsrinferredrpool_url_is_defaultrrs r4 _resolve_runtime_from_pool_entryrs0.00I$Ey}}Y'?'?E2O1488bGE:W[<\<\b`bjjknooHe.55[XZ9[9[G!H>!!$55 [ $99 \ ! !%44 _ $ $ (#'11Ng M : :2 [ '9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! J8J/J \ ! !22 U  $ V  666666 =11466B( Y  ,  E,b 1 1(    N0;N _ $ $9==44:;;AACCIIKK ? * *y}}Z88>B??EEGGNNsSSL ('-immJ.G.GHHO +*  $x+??? JJJJJJ77HH     $# + + +viX66H!)-- ";";"ArBBHHJJPPRR $'11%h(//#*>*>'B\BcBcdgBhBh*h ( * */B *y}}Z88>B??EEGGNNsSSL ('))-- *C*CDD 6 6 6 B A A A A A..xIIHH  O!EhPc!d!d O&HH *(HoNNH222AAAAAA..x8LL5H H:@JJ%6220  s5L LL requestedc|r:|r&|St}|d}t |t r:|r&|St dd}|r|SdS)z=Resolve provider request from explicit arg, config, then env.rcHERMES_INFERENCE_PROVIDERr,auto)r;r<rrprr.r5)rrkrL env_providers r4resolve_requested_providerrPs)Y__&&)  &&(((!##I==,,L,$$,););)=)=,!!##))+++6;;AACCIIKKL 6r6provider_labelapi_mode_override provider_namecPt||}|sdS t|}|sdS|}|dSt |ddpt |dd}|sdS||pt |pd||d||dS#t $rYdSwxYw) zXCheck if a credential pool exists for a custom endpoint and return a runtime dict if so.rNrrr,rgzpool:)rcrnrWrrr)r r has_credentialsselectrrbrR)rWrrrpool_keyrr pool_api_keys r4_try_resolve_from_custom_poolrcs,HMRRRH t""##%% 4  =4u&7>>d'%Q_acBdBd  4&)e-Eh-O-OeSe #(h((#     tts"#BB$B:B B%$B%resultNonecdD]:}||}t|tr|dkr||d<dS;dS)aqPropagate a per-provider output cap onto the resolved runtime dict. Accepts ``max_output_tokens`` or ``max_tokens`` on a ``custom_providers`` entry so a provider block can pin its own output limit. Gateway and CLI map this onto ``AIAgent.max_tokens`` only when the top-level ``model.max_tokens`` isn't set, so the documented global key still wins. )max_output_tokens max_tokensrrN)rprint)rr_k_vs r4_lift_max_output_tokensrsY2 YYr]] b#   266*,F& ' FF r6c\t|d}|r||d<dSdS)zCopy a validated ``extra_headers`` dict from a provider entry. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Never log them. extra_headersN)r$rp)rrrs r4_lift_extra_headersrs? ,EIIo,F,FGGM0"/00r6c  t|pd}|sdS|dkrdS|dkri|dsT tj|}|pd|krdSn#t $rYnwxYwt}|d}t|trAddl m }| D]%\}}t|ts||s(t|ddpd}|r"t|dnd} | s7t|d dpd} |d d} |t!t| p|t|vr"|d p+|d p|d pd} | r|d || | |ddd} |d} t| trt| | d<t#|| t%|dp|d}|r|| d<t'|| | cS'|d}t|trt(ddSt-|}|sdS|D]!}t|ts|d }|d } t|trt| tsnt|ddpd}|t!||vr|| t|d dpdd} t|ddpd}|r|| d<|r|| d<|d} t| trt| | d<t#|| t%|d}|r|| d<t|ddpd}|r|| d<t'|| | cSdS)Nr,rrNr providersr)is_provider_enabledkey_envrr-rrrW default_model)r-rWrrd extra_bodyrn transportcustom_providerszcustom_providers in config.yaml is a dict, not a list. Each entry must be prefixed with '-' in YAML. Run 'hermes doctor' for details. provider_key)r-rWrrd)r?rrrr;r<rr#rprrhermes_cli.configritemsr.r5r%rrorrqwarningr")rrequested_norm canonicalrrrep_namerrresolved_api_key display_namerWrr rnr"r-r#rs r4_get_named_custom_providerr,s45G5M2NNN t"t!!.*C*CI*N*N!  1.AAIR&&((..00NBBtC    D ]]F ;''I)T""/"999999'oo//- "- "NGUeT**  '&u-- %))Ir228b99??AAG?FNww3399;;;B # O#&uyyB'?'?'E2#F#F#L#L#N#N  99VR00L!8L+G,,G "" !99U++^uyy/?/?^599ZCXCX^\^" % &' : :$,NN$4$4#3!&?B!?!? F "'> t!%&&  yy  99Z(($$$ Jx,E,E  599^R88>B??EEGG !8|!L!L L L JJLL ((599Y339r::@@BB   eii 2..4"55;;==  ( 'F9   2%1F> "YY|,, j$ ' ' 4#' #3#3F< E6***"599Z#8#899  *!)F: 7B//5266<<>>  )(F7Ov... 4sA== B  B cH t|duS#t$rYdSwxYw)u~Return True when config defines a custom provider matching the request. Thin public wrapper around :func:`_get_named_custom_provider` so other modules (e.g. the cronjob tool) can decide whether a provider name will actually resolve to a configured ``providers:`` / ``custom_providers:`` entry — without reaching into a private helper or duplicating the scan. NF)r,rR)rs r4has_named_custom_providerr.+s=)*<==TII uus  !!c t|}|sdS t}n#t$rYdSwxYw|d}t |t r|D]\}}t |t s|dp+|dp|dpd}t||kr,tt|t|cS t|}n#t$rd}YnwxYw|pgD]}t |t s|d}t |tr| sWt|d|kr5t|t|ddpdcSdS) uDMap an endpoint URL back to its canonical ``custom:`` menu key. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose base_url matches, or ``None`` when no entry owns the URL. Session persistence stores the agent's *resolved* provider, and for every named custom endpoint that is the literal string ``"custom"`` — the entry name is lost, and the api_key is deliberately never persisted. The endpoint URL is the one durable fact that survives the round-trip, so this reverse lookup lets persist/rebuild paths recover the entry identity (and with it key_env/api_key/api_mode resolution via :func:`_get_named_custom_provider`) instead of failing with ``auth_unavailable`` or silently rebuilding with placeholder credentials. NrrrrWr,r-r#) _normalize_base_url_for_matchr#rRrprrr%r&r.r"r;) rWtargetrrr)r entry_urlr"r-s r4find_custom_provider_identityr39s' +8 4 4F t tt ;''I)T""H'oo// H HNGUeT**  %  SEIIe$4$4S *8M8MSQS -Y776AA+CLL#g,,GGGGGB :6BB     !'R  %&&  yy  $$$ DJJLL   (:)>)> ? ?6 I I'EIInb117R88    J 4s$ 22D D/.D/c ht|pdsdS t}n#t$rYdSwxYwd fd }|d}t |trg|D]R\}}t |ts||r,tt|t|cSS t|}n#t$rd}YnwxYw|pgD]}t |ts|d }t |tr|sW||r5t|t|d dpdcSdS) aMap a model id back to the ``custom:`` entry that serves it. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose ``model`` / ``default_model`` matches, or whose ``models`` catalog (dict or list shape) contains the id. ``None`` when no entry serves the model. Companion to :func:`find_custom_provider_identity` (URL reverse-lookup) for the persistence paths where no base_url survived the round-trip: the session row always stores the model name, and a custom endpoint's model ids (e.g. an in-house SFT checkpoint) virtually never collide with catalog models on built-in providers, so the model is the last durable fact that can recover the entry identity. r,Nrrlr0rAc(dD]Y}||}t|tr-|krdSZ|d}t|t r-t fd|DSt|tr|D]}t|tr-|krdSt|t rl|dp|d}t|tr-|krdSdS)N)rdrTrc3K|];}t|kV._entry_serves_model..sU7:C  &&((F2r6rr-F) rprr.r;r<rrkeyslist)rkeyr7ritemr7r1s r4_entry_serves_modelzCfind_custom_provider_identity_by_model.._entry_serves_models-  CIIcNNE%%% %++--*=*=*?*?6*I*Itt8$$ fd # # >Dkkmm  fd # # $ $ $dC(( TZZ\\-?-?-A-AV-K-K44dD))$((4..c|rt|}|r|S|rt|}|r|St|pd}|sV tt dpd}n#t $rd}YnwxYw|s2tjdd}t|}|r|dvrdS t|}|Qtt|dpd}|r|S| dr|Sd|Sn#t $rYnwxYwdS)uqRecover a routable ``custom:`` identity for a bare custom provider. The bare string ``"custom"`` is the *resolved billing class* shared by every named ``providers:`` / ``custom_providers:`` entry — it is NOT a routable provider identity (``resolve_runtime_provider("custom")`` falls through to the OpenRouter default URL with no api_key, which surfaces to the user as "No LLM provider configured"). Any code path that persists or restores a session's provider override must run the resolved provider through this helper so a bare ``"custom"`` is upgraded back to its durable ``custom:`` menu key. Three recovery sources, in priority order: 1. ``base_url`` — reverse-lookup the entry that owns the endpoint URL (the one fact that always survives the persistence round-trip when a URL was recorded). 2. ``model`` — reverse-lookup the entry that serves the session's model (``model``/``default_model``/``models`` catalog). The session row always stores the model name, so when no base_url survived (the recurring Desktop/TUI regression vector) the model is the last session-scoped fact that can recover the entry — and unlike the config fallback below it stays correct after the user points their global default at a different provider. 3. ``config_provider`` — the active ``config.model.provider`` (or its ``provider``/``HERMES_INFERENCE_PROVIDER`` equivalent). When neither a base_url nor a model recovered the entry, the configured provider is the only durable identity left, so fall back to it when it names a real entry. Returns ``custom:`` when a routable identity is recovered, else ``None`` (caller keeps whatever it had — bare ``"custom"`` only as a last resort, e.g. a genuine ad-hoc endpoint with no config entry). r,rcr>rrNrNrWr) r3r=r.r;rrprRosenvironr?r,r)rWr>rdidentityrcandidate_normrs r4canonical_custom_identityrDsP0::  O 9%@@  OO)r**0022I  -//33J??E2FFLLNNII   III  LJNN#>CCIIKK 4Y??N ^/OOOt *955  5S:9N9N9TRT5U5UVVH ((33 &%%-^-- -       4s2AB B#"B#2AE8EE E"!E"ct|pddS)Nr,rZ)r.r;rHr<r>s r4r0r0s: u{   ! ! # # * *3 / / 5 5 7 77r6custom_providerc|d}t|tr|siSdt|iS)Nr )rprr)rFr s r4"_custom_provider_request_overridesrHsF $$\22J j$ ' 'z $z** ++r6explicit_api_keyexplicit_base_urlrJrKc  |pd}|r/|dkr) ddlm}||dkrd}n#t$rYnwxYw|dkr|r|d}t |dd}|rd|d<|St|dpt|d }t|d }|pd|r"td dnd|r"td dndt|g} td | Ddpd} dt|pd|| d|dSt|} | sdS|pdp| ddd}|sdSt |d| d| d}|r| d} | r| |d<t| dtr | d|d<t!| } | r+it#| dpi| |d<| drt#| d|d<|St|dpt|d }t|d }|pdt%| ddpdtt%| ddpdd|r"td dnd|r"td dndt|g} td| Dd} d| dpt|pd|| pdd| d|d}| dr | d|d<t| dtr | d|d<| drt#| d|d<t!| } | r| |d<|S)Nr,rNrrOrZz direct-aliasr openai.comopenai.azure.comrPOPENAI_API_KEYOPENROUTER_API_KEYc38K|]}t||VdSrxr)r{cs r4r}z0_resolve_named_custom_runtime..Fs0 C C1.?.B.B CQ C C C C C Cr6no-key-requiredrgrcrnrWrrrrWrnr-r rdrrequest_overridesrrrc38K|]}t||VdSrxrRr{rs r4r}z0_resolve_named_custom_runtime..s1bb)EVW`EaEabIbbbbbbr6zcustom_provider:rcrnrWrr)r;r<rQrrRrHrr)r5rnextrbr,rprrrHrr.)rrJrKr'rUrW pool_result_da_is_openai_url_da_is_openrouterapi_key_candidatesrrFrrV_cp_is_openai_url_cp_is_openrouterrs r4_resolve_named_custom_runtimeras).B5577==??N.H44  M M M M M M  00H<P $"4    11CDDO t  b'')) /   z2 . . fSkk  t0(ODWDWXbDcDctCtGtGHNtOtOPPPK%((11  .#-K o))*=>> D D T/>?R/SK+ ,>OO  0{':;;ArBB0#0K+ ,    / / R+/0P+Q+QK (/,GG~K`aik}K~K~//JJ  R&&(( O   2 . . 4"55;;==O'' 266<"==CCEErJJPPRR7H P!2 & & , , . . .b6G P%r * * 0 0 2 2 2b h'' bb/AbbbdfggG#'' 33 #H - - //V_%8%8AS%T%TVVF7##3)'2w/%%&9::C@@K&56I&J"#?++I"&'G"H"H:?KK8&7"# MsA AAc t}t|dtr|dnd}t|dtr|dnd}d}dD]V}||}t|tr*|r|}nW|pd} |}| r/| dkr) ddlm} | | dkrd} n#t$rYnwxYwtdd} td d} d } |r+|s)| d kr |r|d krd } n| dkrt||rd } |pdp"| p | r|ndp| pt d }t|d}|p(| dko"| p|| ko|| pd d k}|r |tdtdg}n~t|d}t|d}t|d}|| r|nd|rtdnd|s|rtdnd|rtdndt|g}td|Dd}|s|rdnd}| dkrdnd}|dkrA|r?t!||t#|d| dkr|nd}|r|S|dkr|s|sd}||dkrt%||n2t#|dpt'|pd|||dS)NrWr,rc)rrrNrrOr'CUSTOM_BASE_URLFrTrZrPrrPrOz ollama.comrMrNOLLAMA_API_KEYc3zK|]6}t|t|pdV7dS)r,N)rr.r;rXs r4r}z._resolve_openrouter_runtime..sIjj)M^_hMiMijY_"   # # % %jjjjjjr6explicitz env/configrnr rTrgrY)rrrpr.r;r<rQrrRr5rVr'rHr)rrZrrorurb)rrJrKrkrKrL cfg_api_keykvr'rUenv_openrouter_base_urlenv_custom_base_urluse_config_base_urlrW_is_openrouter_url_is_openrouter_contextr^_is_ollama_url_is_openai_url_is_openai_azurerreffective_providerr[s r4_resolve_openrouter_runtimerss "##I0:9==;T;TVY0Z0Zb9==,,,`bL0:9==;T;TVY0Z0Zb9==,,,`bLK  MM!   a   !'')) ''))K E(.B5577==??N%%''--//L .H44  M M M M M M  00H<>@@  '$5' V # # +<6#9#9&*# x ' ',X ,- - '#'   b''))   $7 ?L   R  #   fSkk  /xII0,& D $ K4K(K D 06B>>sCC C    ( ) ) $ % % 2(LII1(LII1((0J0J,,PT      X%%g%>P%#'  ) )39hGGG Y]]:66 7 7 #H - -    s?E E$#E$)rJrKrc t|pd}t|pdd}t|dpd}d}d}d} i} |dkrt|dpdd}t |dpd}t|d pdpd} |d } t | tr| } t|p|d pd} | r/|d kr) d dlm } | | }n#t$rd}YnwxYw|r|}tddd}|p|p|}|std|d krtjdd|}| dkr|r|}d}d}n d dlm}m}m}n&#t$r}td|d|d}~wwxYwt| dpdp|} ||}||}n/#t&$r"}tt||d}~wwxYw|}d}d}i}|dkr=t| dpd}|r||d<d|||||||dS|}|s' d dlm}|dpd}n#t$rd}YnwxYw|s"tdd}|std|s|rdnd}d|||d||d S)!aResolve an Azure Foundry runtime entry. Reads ``model.base_url`` + ``model.api_mode`` from config.yaml (or explicit overrides), pulls the API key from ``.env`` / env var, and strips a trailing ``/v1`` for Anthropic-style endpoints because the Anthropic SDK appends ``/v1/messages`` internally. When ``model.auth_mode == "entra_id"`` (and the model is OpenAI-style), the returned ``api_key`` is a zero-arg callable produced by :func:`agent.azure_identity_adapter.build_token_provider` rather than a string. Downstream code that constructs an OpenAI SDK client passes this through unchanged (the SDK accepts ``Callable[[], str]`` for ``api_key`` and calls it before every request). Code paths that need a string (logging, manual HTTP probes, header injection) must use the helpers in ``agent.azure_identity_adapter``. Raises :class:`AuthError` when required values are missing. r,rZrcrgrrrWrn auth_modeentrar/r]rrNAZURE_FOUNDRY_BASE_URLzpAzure Foundry requires a base URL. Set it via 'hermes model' or the AZURE_FOUNDRY_BASE_URL environment variable.rentra_idrf)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULTbuild_token_providerzAzure Foundry Entra ID auth requires the 'azure-identity' package. Install it with: pip install azure-identity (import failed: )scope)r})r)rcrnrWrrurvrr) get_env_valueAZURE_FOUNDRY_API_KEYaAzure Foundry requires an API key. Set AZURE_FOUNDRY_API_KEY in ~/.hermes/.env or run 'hermes model' to configure. To use keyless Microsoft Entra ID auth instead, set model.auth_mode: entra_id in config.yaml (or pick 'Microsoft Entra ID' in 'hermes model').r)rcrnrWrrurr)r.r;rHrpr<rorrrrrRr5rrragent.azure_identity_adapterryrzr{ ImportErrorr$r~)rrkrJrKrexplicit_base_url_cleanrLrK cfg_api_mode cfg_auth_mode cfg_entra_entrarrr env_base_urlrWrrruryrzr{rr} entra_configtoken_provider clean_entraconfigured_scoper~s r4_resolve_azure_foundry_runtimer+s14+1r2288::!"3"9r::@@BBII#NNy}}Z006B77==??EEGGLL%LM "I&&9==44:;;AACCJJ3OO &y}}Z'@'@AAWEW IMM+66C)DDJJLLRRTTaXa w'' fd # # I,H)-- *B*BHbIIOOQQO$<+???  F F F F F F33ODDHH   HHH   $#L3R88>>@@GGLLL&F,F,H   ?   +++6)R22  "" ! #,GF!II     .'*...  IMM'**0b117799*)  322    "6!5\!J!J!J 3 3 3C))s2 3$GF"I  " ""9==#9#9#?R@@FFHH  8'7 G$($ " "4   G   7 7 7 7 7 7#m$;<<BGG   GGG  ?1266<<>>   7   - P0A PZZF# 0  sTG&& G54G55 J J# JJ#K88 L$LL$N N%$N%c  t|pd}t|pdd}|s|sdS|dkrt|dpd}d}|dkrZt|dpdd}t |sd}|p|pd}|} | s!ddlm} | } | std dd || d |d S|d kr|pt}|} d} | sft} | dd} | d} |s+| dddp|}d d|| d | |dS|dkrddl m } tjdpi}|p`tpRt|dp tjd}|pct#|t%dt'ddr6t|dpdnd} |dp|d}| st)t+t-dd} | dd} | d}|s+| dddp|}d| |p|dpd|| d ||dS|d krt/||||!St1j|}|r$|jdkrd}|jr:t-|jdd}|}|sF|d"vr9t7|} | ddd}n |p|j}|d#krt;|}|} | set7|} | dd} |s>| ddd}|d#krt;|}d$}|d%krt=|| |&}n|d'krd}n|d#krd}nt|dpd}t?|d(}|rtA||r|}n'tC|||p|dd}|d#kr| stE|rtF} |||d| d |d SdS))Nr,rZrrcrWrrresolve_anthropic_tokenNo Anthropic credentials found. Set ANTHROPIC_TOKEN or ANTHROPIC_API_KEY, run 'claude setup-token', or authenticate with 'claude /login'.r]rfrUrr last_refreshr[rcrnrWrrrrrrr<HERMES_NOUS_MIN_KEY_TTL_SECONDS agent_keyagent_key_expires_at expires_atHERMES_NOUS_TIMEOUT_SECONDS15timeout_secondsr/rcrnrWrrrrr)rrkrJrK> kimi-codingkimi-coding-cnactualrgrrrrn)$r.r;rHrpr<ragent.anthropic_adapterrrrrrhrrget_provider_auth_staterDEFAULT_NOUS_INFERENCE_URLrmaxr+rfloatr5rr auth_typebase_url_env_varrrr!rrorrjr r)rcrrkrJrKrrLrKrWrrrcredsrstaterrenv_urlrnrrss r4_resolve_explicit_runtimers+1r2288::-344::<<CCCHH $5t;9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! $S S8S"  G G G G G G--//G V $,  "4    >!!$>(>"  M577Eii 2..G 99^44L$ M 99Z44;;C@@LH&)  ("4   6666666088>B  o022 o599122Yh6YZZ``bbiijmnn # #B A4HHII C +&&," - - 3 3 5 5 5  YY566Q%))L:Q:Q  M4 %g.KT&R&R S SEii 2..G<00J$ M 99Z44;;C@@LH% l&TimmI6N6N&TRTUU  $"4   ?""-1-/      #H--G: 7$ 11  # Pg6;;AACCJJ3OOG$ A<<<}$d-|#|p|d?pd |$dd  d|$d@d |$dAdB|$dC|dDS#t$r$|dEkrt@)dFYnwxYw|dGkr tU}$dGdH|$dd  d|$d@d |$dAdI|$dJ|dKS#t$r$|dEkrt@)dLYnwxYw|dMkr tW}$dMdH|$dpd dptX|$d@d |$dAdI|$dJ|dKS#t$r$|dEkrt@)dNYnwxYw|dOkr t[}$dOd |$dd  d|$d@d |$dAdP|$dQ|dRS#t$r$|dEkrt@)dSYnwxYw|dTkrZt]j|}%|%rD|%j/dUkr9ddVl0m1}&|&}$|d|$d|$d@|$dAdW|d S|dXkrte|}$dXd |$dd  d|$d@d |$dYd tg|$dZpg|$dAd[|d\S|dkrt#|dpd }d C|dkrM|dpd  dCtiCsd CCpd]}d|vpCodCv}'|'rd }d^D]`}(t#||(pd })|)r&t|)d }|rna|s6t#|d@pd }|sDtdd p!tdd }|std_n!dd`l5m6}*|*}|stdadd||db|d S|dckrdddl7m8}+m9},m:}-m;}.|dev}/|/s|+stdfdgh|dci}0|0dipd p |-}1|,pdj}2|0dki}3d}4|3dlrf|3dmrQ|3dl|3dmdn}4|3dor |3do|4dp<|3dqr |3dq|4dq<t#|p|d?pd }5t/txj=drd }6|.|5r|6sdcdds|1dtdu|2|1d)|dv}ndcdwds|1dtdu|2|1|dx}|4r|4|dy<|St]j|}%|%r |%j/d@krt}|}$|dzkr)t|$d@st#|dpd }7d }8|7|kr<|dpd  d}8t|8p(|$dd  d}9t|9r3t |$}$t|$d@<|$dApd{|$dA<t|$d@s|dvr+ddlGmH}?|p|d?d }@|?||@}rt||=r|>}.sA&lD99r6rI)rcrrkrJrKrrOPENAI_BASE_URLr'>rrNT>rrrrrrrrrrr})rrr}zINous pool entry agent_key expired/missing, refreshing selected pool entryz"Nous pool entry refresh failed: %szRNous pool entry agent_key still unavailable, falling through to runtime resolutionr)rW)rcrrrkrrrrrrr/rrportalrrrzUAuto-detected Nous provider but credentials failed; falling through to next provider.rr[zhermes-auth-storerrzVAuto-detected Codex provider but credentials failed; falling through to next provider.rzZAuto-detected xAI OAuth provider but credentials failed; falling through to next provider.rzqwen-cli expires_at_ms)rcrnrWrrrrz@Qwen OAuth credentials failed; falling through to next provider.r oauth_minimax))resolve_minimax_oauth_runtime_credentialsoauthz copilot-acpcommandargsprocess)rcrnrWrrrrrr)r api_key_envzNo Azure Anthropic API key found. Set AZURE_ANTHROPIC_KEY or ANTHROPIC_API_KEY, or point key_env/api_key_env in your config.yaml model section at a custom env var.rrenvbedrock)has_aws_credentialsresolve_aws_auth_env_varresolve_bedrock_regionis_anthropic_bedrock_model> aws-bedrockamazon-bedrockawsamazonrzNo AWS credentials found for Bedrock. Configure one of: - AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - AWS_PROFILE (for SSO / named profiles) - IAM instance role (EC2, ECS, Lambda) Or run 'aws configure' to set up credentials.no_aws_credentials)coderegionzaws-sdk-default-chain guardrailguardrail_identifierguardrail_version)guardrailIdentifierguardrailVersionstream_processing_modestreamProcessingModetraceAWS_BEARER_TOKEN_BEDROCKzhttps://bedrock-runtime.z.amazonaws.comzaws-sdk)rcrnrWrrrbedrock_anthropicrr)rcrnrWrrrrguardrail_configrz local-offlinez, z Set rCz*No usable credentials found for provider 'z'.missing_api_key)rcrrrrrnrrrr)Nrr$rr#rrrp ValueErrorr;r5rHrragent.vertex_adapterrrrar.r<rrsrrrAr rRr r rrr+rrqrtry_refresh_currentr rrhrrrrrrrrrrrrQrrr9rrragent.bedrock_adapterrrrrr@rArrr!r rrapi_key_env_varsrrorrrrjrrr)DrrJrKrrrr# _full_cfg _provs_cfg_block _eff_base _azure_key azure_runtimertokenrWcustom_runtimerkrL_known_cloud_hostsrrcexplicit_runtimeshould_use_poolenv_openai_base_urlrjhas_custom_endpointhas_runtime_overriderrr min_ttl nous_state refreshedrrrrr_is_azure_endpointhint_keyenv_varrrrrr is_explicit _bedrock_cfgr auth_source_grr_current_model_has_bearer_token _cfg_provider_cfg_url_effective_url env_nameshintrnrrsr _effectiverrrKsD @r4resolve_runtime_providerrs"4I>>CBBBBBBB I/9)T/J/JT{+++PTJ*d## 233 fd # # ,?,?,G,G C.CC0CCC  U""*%-,"4    #(b//11I[(([I-E-E  # * * , , 8,b117799 8*B//5577  $,!((--!&"4    _,,61'))-/%    ___::::::++--x H @ !* ,,$"4    3-)+N /A+, %5%'' 9==44:;;AACCIIKK 9==44:;;AACC  LL88"  . 6'9%5&7 1C,-)+H "##I0-)+!  ,.O<9==44:;;AACCIIKK 9==44:;;AACC %&7<<BBDD")*?"D"D"J"J"L"L"  '" '&    'L,>>>"& #$4$I8IJJ "8 8 )'' )((  &5?y"""4  >$$&&>   0$7765."55  v  %"3"g&GNNOOG$UK>>(/7Mt(T(T 66J ( G<< & hiii% $ 8 8 : :II %%%LL!EsKKK $IIIIII%(%E'8$??>"5."==! &-UK%F%F07?UW[0\0\!(!>!>""J $&+? G+T+T&LL!uvvv#%L   0E#5t<<uj$77  4!#5#)  6 = : : : : : :4 %g.KT&R&R S SE#)M,*X)-- :R:R*XVXYY!IIj"55<!! =577E*-!IIj"55<#>)HNN,<,<<  @[L,>,>,@,@@  % E6  immH55;<<BBDD#GR006688E DIMM)44:;;AACC 1266<<>>@2B77==?? E  H G G G G G++--E V $, "4    9            ),ii  #6#6#8#8 @ *  #{}}((B77 ""8,,299;;W?U?U?W?W..00K4K {B// 77) * * 9sww7J/K/K 9'*+A'B$'(;$<   ww/00 Y;>?W;X !78www 9,/L )\KY]]9-E-EKLLRRTT 0JB!O!O!U!U!W!WXX % %n 5 5 >O &0MvMMM$% %)&8  GG&.MvMMM$% &8G  ;*:G& ' #H--G_ 7$ 114X>> x  (9%))I:N:N(O(O  j 9 9 ?R@@FFHHNNPPMH((%MM*55;BBDDKKCPP6AEIIj"55<A9]88+^&%^&0B`22+a a *A9c$$+dderrorrRcht|trt|St|Srx)rrrr.)rs r4format_runtime_provider_errorrs.%##( ''' u::r6)r,)r-r.r/r.r0r.)r7r.r0r.)r@r.r0rA)rKr.rLr.r0rA)rWr.r0rX)rcr.rWr.rdr.r0r.)rkrlrWr.r0r.)rWr.r0r.)rWr.r0rA)r0rlrx)rcrXrrXr0rA)rkrlrr.rrXr0r.)rrr0rX)r0r.)rcr.rnr.rkrr0r.)rcr.rr rr.rkrrrrrXr0rl)rrXr0r.)NN) rWr.rr.rrXrrXr0r)rrlrrlr0r)rr.r0r)rr.r0rA)rdr.r0rX)rWrXr>rXrdrXr0rX)rFrlr0rl)rr.rJrXrKrXr0r)rr.rJrXrKrXr0rl) rr.rkrlrJrXrKrXrrXr0rl)rcr.rr.rkrlrJrXrKrXrrXr0r) rrXrJrXrKrXrrXr0rl)rrRr0r.)`__doc__ __future__rloggingr@r urllib.parsertypingrrr getLogger__name__rq hermes_clirragent.credential_poolr r r r r agent.secret_scoperr2rQrrrrrrrrrrrrrrrrrr r!r$r"r#r$rhr%r&hermes_constantsr'r(utilsr)r*r+r5r?rJrVrbrjrurrrrrrrrorrrrrrrr,r.r3r=rDr0rHrarsrrrrrr6r4r sMM"""""" !!!!!!&&&&&&&&&&  8 $ $''''''988888* ONNNNNNN000000888888CCCCCCCCCC / / / / /3333==== 5555<,,,,^OOOOO2BBBB,61616161r""""J.,88888*#' """""":   0000>+/%)"&PPPPPPf,(,#' @    0000KKKK\    3333lCCCCP#%) VVVVVVr8888,,,,'+'+ AAAAAAN'+'+ KKKKKKd'+'+"& ffffff\'+'+"&jjjjjj^ $&*'+"& s s s s s s lr6