`gj{dZddlmZddlZddlZddlZddlmZddlm Z m Z m Z eje ZddlmZddlmZmZmZmZmZddlmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+dd l,m-Z-m.Z.m/Z/dd l0m1Z1dd l2m3Z3m4Z4m5Z5d3d4d Z6d5dZ7d6dZ8d7dZ9d8dZ:d9dZ;d:dZddZ@d?dZAhdZBd@dZCdAdZD dBdZEdddd dCdZFd=dDdZG dE dFd ZHdGd!ZIdGd"ZJdHd#ZKdId$ZLd8d%ZMddd& dJd'ZNdAd(ZOdKd)ZPddd* dLd+ZQddd* dMd,ZRdddd- dNd.ZSddd* dOd/ZTddddd0 dPd1ZUdQd2ZVy)RzGShared runtime provider resolution for CLI, gateway, cron, and helpers.) annotationsN)urlparse)AnyDictOptional)auth)CredentialPoolPooledCredential credential_pool_matches_providerget_custom_provider_pool_key load_pool) get_secret) AuthErrorDEFAULT_CODEX_BASE_URLDEFAULT_QWEN_BASE_URLDEFAULT_XAI_OAUTH_BASE_URLPROVIDER_REGISTRY_agent_key_is_usable_nous_inference_env_overrideformat_auth_errorresolve_provider resolve_nous_runtime_credentials!resolve_codex_runtime_credentials%resolve_xai_oauth_runtime_credentials resolve_qwen_runtime_credentials$resolve_api_key_provider_credentials-resolve_external_process_provider_credentialshas_usable_secret)get_compatible_custom_providers load_confignormalize_extra_headers)OPENROUTER_BASE_URL)base_url_host_matchesbase_url_hostnameenv_intc&t||}||S|S)aProfile-scoped replacement for ``os.getenv`` on credential/provider reads. Routes through the secret scope (Workstream A): identical to ``os.getenv`` when multiplexing is off, scope-aware (and fail-closed on an unscoped read) when on. Genuinely-global vars are handled inside ``get_secret`` and still read ``os.environ``. Keeps the ``(name, default) -> str`` contract every call site here already relies on. ) _get_secret)namedefaultvals N/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/runtime_provider.py_getenvr,1s dG $C/3.w.c^|jjjddS)N -)striplowerreplacevalues r+_normalize_custom_provider_namer6>s$ ;;=   ( (c 22r-cP|xsdjjd}|dvS)N.>::10.0.0.0 localhost 127.0.0.1)r2rstrip)hosths r+_loopback_hostnamerABs+ ##C(A < <r$rpathendswith)base_url normalizedhostnamerSs r+_detect_api_mode_for_urlrXes*.b'')//188=J *H: ## &&# J  $ $ + +C 0D }}\"dmmO&D#>!i:&=# r-ct|jd}t|}|dk(r!|dk7rtj d|xsdd}|xs|xsdS)aResolve api_mode for legacy/plain ``provider: custom`` endpoints. Custom endpoints should stay conservative by default. Only direct OpenAI/xAI URLs imply Responses API automatically; named custom providers can opt in via their own ``api_mode`` field. This also prevents a stale persisted ``model.api_mode: codex_responses`` from forcing generic relays onto the Responses path after upgrades or /reset. api_moderPzMIgnoring persisted custom api_mode=codex_responses for non-OpenAI endpoint %sz (unknown)Nchat_completions)_parse_api_modegetrXloggerinfo) model_cfgrUconfigured_mode detected_modes r+_resolve_plain_custom_api_modercsa&immJ&?@O,X6M++ AR0R [  #    Am A/AAr-ct|}|sytd|jddDry|dvsd|vry|jdDcgc]}|s| }}|r"|ddvr|jd|r|ddvrt |d kry|d }dj d |Dj }|r|djsy|d vry|d }t|dxsdjScc}w)u_Look up `_API_KEY` in the env, derived from the base URL host. Examples: https://api.deepseek.com/v1 → DEEPSEEK_API_KEY https://api.groq.com/openai/v1 → GROQ_API_KEY https://api.mistral.ai/v1 → MISTRAL_API_KEY https://generativelanguage.googleapis.com/v1beta/openai/ → GOOGLEAPIS_API_KEY Returns the env value (stripped) or "". Never returns env vars whose names are already explicitly checked elsewhere — those are handled by their own host-gated paths (OPENAI/OPENROUTER/OLLAMA). The vendor label is the *registrable* portion of the hostname: strip ``api.`` / ``www.`` prefixes, then take the second-to-last label (``api.deepseek.com`` → ``deepseek``). Falls back to "" for hostnames that don't yield a usable vendor label (IPs, loopback, single-label hosts). r8c3<K|]}|jywN)isdigit.0chs r+ z(_host_derived_api_key..s :B2::< :sr9)r<:r)apiwwwc3DK|]}|jr|ndyw)_N)isalnumrhs r+rkz(_host_derived_api_key..sEbjjl3Es )OPENAI OPENROUTEROLLAMA_API_KEY) r$anysplitpoplenjoinupperisalphar,r1)rUrWlbllabelsvendor sanitizedenv_names r+_host_derived_api_keyrs&!*H  :(.."5b"9 ::>!SH_%^^C0 8cCc 8F 8 VAY.0 1  VAY.0 6{QBZFEfEEKKMI IaL00266H%H Hb ! 'R . . 0059s C:C:c|xsdj}|syt|xsdj}|sy|dk(s"|jds|jdry|jdryt |dk(ryy) uDecide whether a configured ``model.base_url`` may back native Anthropic. Native ``provider: anthropic`` resolution honors ``model.base_url`` so users can point at Anthropic-compatible endpoints (official Anthropic/Claude hosts, Azure Foundry, MiniMax/Zhipu/LiteLLM-style ``/anthropic`` proxies, Kimi's ``/coding`` route). But a config can carry a *stale* non-Anthropic URL — e.g. ``provider: anthropic`` left with ``base_url: https://openrouter.ai/api/v1`` after a provider switch — which would route Anthropic OAuth/setup-token traffic to an OpenAI-compatible aggregator and 404. Ignore those. Returns True only when the URL plausibly speaks the Anthropic Messages protocol; otherwise the caller falls back to ``https://api.anthropic.com``. r8FrQz.anthropic.comz .claude.comTz .azure.comrR)r1r$r2rTrX)rU candidaterWs r+_anthropic_base_url_override_okrsR&&(I !),299;H &&(*;*;rTr]okjsonr|rGr^debug)rUrurlrespmodelsmodel_idexcs r+_auto_detect_local_modelrs Looc"||E" 5LC||C)OQ|7 77YY[__VR0F6{a!!9==r2#O  L  ;XsKK LsBB C#B??Cct}|jd}t|trt|}|jds|jdr|d|d<|jdxsdj }|jdxsdj }d|vxsd|v}| }|r|r|rt |}|r||d<|St|t r"|j rd|j iSiS)Nmodelr)r8rUr<r=)r r] isinstancedictr1rstr)configr`cfgr)rUis_local is_fallbackdetecteds r+_get_model_configrs ]F 7#I)T"9owwy!cggg&6 \C N779%+224GGJ'-2446(*EkX.E!k  /9H!)I )S!ioo&79??,-- Ir-c|xsdjj}|xsdjj}|sy|dk(r|dk(xs|jdS||k(S)aTCheck whether a persisted api_mode should be honored for a given provider. Prevents stale api_mode from a previous provider leaking into a different one after a model/provider switch. Only applies the persisted mode when the config's provider matches the runtime provider (or when no configured provider is recorded). r8TrCcustom:)r1r2 startswith)providerconfigured_providernormalized_providernormalized_configureds r+$_provider_supports_explicit_api_moder/st$>r00288:06B==?EEG h&$0_4I4T4TU^4__ $7 77r-cht|jdxsdjj}t |jd}|rt d|r|St|jdxsdj}|sy ddlm}||| S#t$rYywxYw) Nrr8rZcopilotr)r[r)copilot_model_api_mode)api_key) rr]r1r2r\rhermes_cli.modelsrrG)r`rrra model_namers r+_copilot_runtime_api_moder@simmJ7=2>DDFLLN%immJ&?@O? K^_Y]]9-34::rPbedrock_converser[codex_app_serverrRctt|tr(|jj}|tvr|Sy)z@Validate an api_mode value from config. Returns None if invalid.N)rrr1r2_VALID_API_MODES)rawrVs r+r\r\`s2#sYY[&&( ) )  r-ctxsdS)uVReturn the trusted Nous runtime base URL override, if configured. Delegates to ``auth._nous_inference_env_override`` so every ``NOUS_INFERENCE_BASE_URL`` read shares one normalization path (trailing-slash stripping, blank → empty). The env source is trusted and intentionally bypasses the network host allowlist there. r8)rr-r+!_nous_inference_base_url_overrideris ( ) /R/r-c|s|S|dvr|St|jdxsdjj}|dk(ry|S)uOptional opt-in: rewrite api_mode → "codex_app_server" for OpenAI/Codex providers when the user has explicitly enabled that runtime via `model.openai_runtime: codex_app_server` in config.yaml. Default behavior is preserved: when the key is unset, "auto", or empty, this function is a no-op. Only providers in {"openai", "openai-codex"} are eligible — other providers (anthropic, openrouter, etc.) cannot be rerouted through codex. Returns the (possibly-rewritten) api_mode.>openai openai-codexopenai_runtimer8r)rr]r1r2)rrZr`runtimes r+%_maybe_apply_codex_app_server_runtimertsV 11)-- 017R8>>@FFHG$$! Or-)r`pool target_modelc f|xs t}|xs|jdxsd}t|ddxst|ddxsdjd}t|ddxs t|dd}d} |d k(rd } |xst}nH|d k(rd } |xst }n5|d k(rd} |xst }n"|d k(r-d} tj|} |xs| r | jnd}n|dk(rd} t|jdxsdjj} d} | dk(rHt|jdxsdjjd} t| sd} | xs|xsd}nT|dk(r |xst}nC|dk(rd } n:|dk(rd} txs|}n#|dk(r0t|t|dd} |xstdj}n|dk(rt|jdxsdjj} | dk(r]t|jdxsdjjd} | r| }t!|jd} | r| } |r| dk7r ddlm}||}|r|} | dk(r-t)j*dd|}nt|jdxsdjj}tj|} | xr-|jd| jjdk(}||k(rA|r?t|jdxsdjjd} | r| }t!|jd} |dvrddlm}|||} n | rt/||r| } nt1|}|r|} |dvrddlm}||| |}t5|| |} |dk(rt7j8|}|| ||t|d d!||d"S#t&$rd}YwxYw)#Nr)r8runtime_base_urlrUrOruntime_api_key access_tokenr[rrP xai-oauth qwen-oauth minimax-oauthrR anthropicrhttps://api.anthropic.com openrouterxainousr azure-foundryrZrazure_foundry_model_api_mode/v1/?$ opencode-go opencode-zenopencode_model_api_modenormalize_opencode_base_url)rrZr`lmstudiosourcer)rrZrUrrcredential_poolrequested_provider)rr]getattrr>rrrrinference_base_urlrr1r2rr"rrr\rrrGresubrrrXrrauth_mod$_normalize_lmstudio_runtime_base_url)rentryrr`rreffective_modelrUrrZpconfigrIrHrarinferredrpool_url_is_defaultrrrs r+ _resolve_runtime_from_pool_entryrsI0.0I$Ey}}Y'?E2O148bGE:W[<\b`bjjknoHe.5[XZ9[G!H>!$55 [ $99 \ !%44 _ $ (#''1Ng : :2 [ '9==4:;AACIIK  ; &y}}Z8>B?EEGNNsSL2<@! J8J/J \ !22 U $ V %46B( Y ,YGXZ\8]^N0;NN _ $9==4:;AACIIK ? *y}}Z8>B?EEGNNsSL'-immJ.GHO* x+?? J7H# + +vviX6H!)-- ";"ArBHHJPPR $''1%h(//#*>'B\B\BcBcdgBh*h ( */By}}Z8>B?EEGNNsSL'))-- *CD 6 6 B.xIH !EhPc!d&H 09H#22A.x8L5H H:@@J%620 s  s P!! P0/P0cn|r.|jr|jjSt}|jd}t |t r.|jr|jjSt ddjj}|r|Sy)z=Resolve provider request from explicit arg, config, then env.rHERMES_INFERENCE_PROVIDERr8auto)r1r2rr]rrr,) requestedr`rI env_providers r+resolve_requested_providerrsY__& &&((!#I==,L,$););)=!!#))++6;AACIIKL r-ct||}|sy t|}|jsy|j}|yt |ddxs t |dd}|sy||xst |xsd||d||dS#t $rYywxYw) zXCheck if a credential pool exists for a custom endpoint and return a runtime dict if so. provider_nameNrrr8r[zpool:)rrZrUrrr)r r has_credentialsselectrrXrG)rUprovider_labelapi_mode_overriderpool_keyrr pool_api_keys r+_try_resolve_from_custom_poolr0s,HMRH "##%  =u&7>d'%Q_acBd &)e-Eh-OeSe #hZ(#    s"A=A=A= A== B B cndD]0}|j|}t|ts%|dkDs+||d<yy)aqPropagate a per-provider output cap onto the resolved runtime dict. Accepts ``max_output_tokens`` or ``max_tokens`` on a ``custom_providers`` entry so a provider block can pin its own output limit. Gateway and CLI map this onto ``AIAgent.max_tokens`` only when the top-level ``model.max_tokens`` isn't set, so the documented global key still wins. )max_output_tokens max_tokensrrN)r]rint)rresult_k_vs r+_lift_max_output_tokensrPs>2 YYr] b# 26*,F& '  r-cHt|jd}|r||d<yy)zCopy a validated ``extra_headers`` dict from a provider entry. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Never log them. extra_headersN)r!r])rrrs r+_lift_extra_headersr_s) ,EIIo,FGM"/r-c , t|xsd}|sy|dk(ry|dk7rM|jds< tj|}|xsdj j |k(ryt}|jd}t|trddl m }|jD]\}}t|ts||s!t|}t|jddxsdj } | rt| dj nd} | s-t|jd dxsdj } |||d|hvr|jd xs(|jd xs|jd xsd} | r|jd || j | |jddd} |jd} t| trt| | d<t!|| t#|jdxs|jd}|r|| d<t%|| | cS|jd d}|st|}|||d|hvs|jd xs(|jd xs|jd xsd} | s || j | |jddd} |jd} t| trt| | d<t!|| t#|jdxs|jd}|r|| d<t%|| | cS|jd}t|trt&j)dyt+|}|sy|D]}t|ts|jd }|jd } t|trt| tsXt|}d|}t|jddxsdj }|r t|nd}|rd|nd}|||||hvr|j | j t|jd dxsdj d} t|jddxsdj } | r| | d<|r|| d<|jd} t| trt| | d<t!|| t#|jd}|r|| d<t|jddxsdj }|r|| d<t%|| | cSy#t $rY'wxYw)Nr8rrCr providersr)is_provider_enabledkey_envrrnrrUr( default_model)r(rUrr extra_bodyrZ transportcustom_providerszcustom_providers in config.yaml is a dict, not a list. Each entry must be prefixed with '-' in YAML. Run 'hermes doctor' for details. provider_key)r(rUrr)r6rrrr1r2rr r]rrhermes_cli.configritemsrr,rr\rr^warningr)rrequested_norm canonicalrrrep_namer name_normrresolved_api_keyrUrr rZ display_name display_normr r(menu_keyr provider_key_normprovider_menu_keyrs r+_get_named_custom_providerrjsP45G5M2NN "!.*C*CI*N  11.AIR&&(..0NB ]F ;'I)T"9'oo/B &NGUeT* 'u-7@I%))Ir28b9??AG?Fww399;B ##&uyyB'?'E2#F#L#L#N '9 {6K!LL 99U+^uyy/?^599ZCX^\^ % &' :$,NN$4#3!&?B!? F "'|L !lLGL>BZ%[[$yy/b599U3CbuyyQ[G\b`bH$0(0(8'7%*YY%C " &+YY|%< %j$737 3CF<0+E6:#2599Z3H3bEIIVaLb#c#19F:./v>% EB &Jzz"45"D) / 6v> !#%& yy 99Z($$Jx,E 3D9 YK(599^R8>B?EEG MY;LI_a=Ng&7%89TV )X7HJ[!\ \ JJL (599Y39r:@@B  eii 2.4"5;;=  'F9  %1F> "YY|, j$ '#' #3F< E6*"599Z#89 !)F: 7B/526<<> (F7Ov. G#J W   sV VVc< t|duS#t$rYywxYw)u~Return True when config defines a custom provider matching the request. Thin public wrapper around :func:`_get_named_custom_provider` so other modules (e.g. the cronjob tool) can decide whether a provider name will actually resolve to a configured ``providers:`` / ``custom_providers:`` entry — without reaching into a private helper or duplicating the scan. NF)rrG)rs r+has_named_custom_providerrs*)*<=TII s  ct|}|sy t}|jd}t |t r|j D]x\}}t |t s|jdxs(|jdxs|jdxsd}t||k(sadtt|cS t|}|xsgD]r}t |t s|jd}t |tr|jsFt|jd|k(sddt|cSy#t$rYywxYw#t$rd}YwxYw) uDMap an endpoint URL back to its canonical ``custom:`` menu key. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose base_url matches, or ``None`` when no entry owns the URL. Session persistence stores the agent's *resolved* provider, and for every named custom endpoint that is the literal string ``"custom"`` — the entry name is lost, and the api_key is deliberately never persisted. The endpoint URL is the one durable fact that survives the round-trip, so this reverse lookup lets persist/rebuild paths recover the entry identity (and with it key_env/api_key/api_mode resolution via :func:`_get_named_custom_provider`) instead of failing with ``auth_unavailable`` or silently rebuilding with placeholder credentials. NrrnrrUr8rr() _normalize_base_url_for_matchr rGr]rrrr6rrr1) rUtargetrrrr entry_urlr r(s r+find_custom_provider_identityr"sn +8 4F  ;'I)T"'oo/ QNGUeT* % SEIIe$4S *8MSQS -Y76A !@W!N OPP Q :6B"'RE%& yy $$DJJL  (:)> ?6 I`` identity for a bare custom provider. The bare string ``"custom"`` is the *resolved billing class* shared by every named ``providers:`` / ``custom_providers:`` entry — it is NOT a routable provider identity (``resolve_runtime_provider("custom")`` falls through to the OpenRouter default URL with no api_key, which surfaces to the user as "No LLM provider configured"). Any code path that persists or restores a session's provider override must run the resolved provider through this helper so a bare ``"custom"`` is upgraded back to its durable ``custom:`` menu key. Two recovery sources, in priority order: 1. ``base_url`` — reverse-lookup the entry that owns the endpoint URL (the one fact that always survives the persistence round-trip when a URL was recorded). 2. ``config_provider`` — the active ``config.model.provider`` (or its ``provider``/``HERMES_INFERENCE_PROVIDER`` equivalent). When the agent was built without a base_url on the override (the recurring Desktop/TUI regression vector), the configured provider is the only durable identity left, so fall back to it when it names a real entry. Returns ``custom:`` when a routable identity is recovered, else ``None`` (caller keeps whatever it had — bare ``"custom"`` only as a last resort, e.g. a genuine ad-hoc endpoint with no config entry). r8rr>rrCrNr) r"rr1rr]rGosenvironr6rr)rUr#identityrcandidate_norms r+canonical_custom_identityr)Rs@0: OO)r*002I  -/33J?E2FLLNI JJNN#>CIIK 4Y?N ^/OO %i 0 <((3%%^,- - = % I     s)4C)CC CC C+*C+cvt|xsdjjdjS)Nr8rO)rr1r>r2r4s r+rrs. u{  ! ! # * *3 / 5 5 77r-cf|jd}t|tr|siSdt|iS)Nr )r]rr)custom_providerr s r+"_custom_provider_request_overridesr-s3 $$\2J j$ 'z $z* ++r-explicit_api_keyexplicit_base_urlc |xsdjj}|r|dk7r ddlm}||dk(rd}|dk(r|r|jj d}t |dd}|rd|d<|St|dxs t|d }t|d }|xsdj|rtd djnd|rtd djndt|g} td | Ddxsd} dt|xsd|| d|dSt|} | sy|xsdjxs| jddj d}|syt |d| jd| jd}|r| jd} | r| |d<t| jdtr| d|d<t!| } | r%it#|jdxsi| |d<| jdrt#| d|d<|St|dxs t|d }t|d }|xsdjt%| jddxsdjtt%| jddxsdjdj|rtd djnd|rtd djndt|g} td| Dd} d| jdxst|xsd|| xsdd| jd|d}| jdr| d|d<t| jdtr| d|d<| jdrt#| d|d<t!| } | r| |d<|S#t$rYwxYw)Nr8rCrrDrOz direct-aliasr openai.comopenai.azure.comrEOPENAI_API_KEYOPENROUTER_API_KEYc38K|]}t|s|ywrfr)rics r+rkz0_resolve_named_custom_runtime..s C1.?.BQ Cno-key-requiredr[rrZrUrrrrUrZr(rrrrequest_overridesrrrc38K|]}t|s|ywrfr7rirs r+rkz0_resolve_named_custom_runtime..sb)EVW`EaIbr9zcustom_provider:rrZrUrr)r1r2rFrrGr>rr#r,rnextrXrr]rrr-rr)rr/r0rrLrU pool_result_da_is_openai_url_da_is_openrouterapi_key_candidatesrr,rr<_cp_is_openai_url_cp_is_openrouterrs r+_resolve_named_custom_runtimerGs).B557==?N.H4  M 0HP $"4   11CDO   b'') /   z2 . fSk  0(ODWDWXbDctCtGtGHNtOPK%((1 #-K o))*=> D/>?R/SK+ ,>O 0{':;ArB0#0K+ ,    /+/0P+QK (/,G~K`aik}K~//J  R&&( O   2 . 4"5;;=O'' 26<"=CCErJPPR7H!2 & , , .b6G%r * 0 0 2b h' b/AbdfgG#'' 3 #H - //$_%8%8AS%T$UVF7#)'2w/%%&9:C@&56I&J"#?+"&'G"H:?K&7"# MY   sO)) O65O6c tt}t|jdtr|jdnd}t|jdtr|jdnd}d}dD]F}|j|}t|ts%|j s6|j }n|xsdj j } |j j }| r| dk7r ddlm} | | dk(rd} tddj } td dj } d } |j r$|s"| d k(r |r|d k(rd } n| dk(rt||rd } |xsdj xs$| xs | r|j ndxs | xstjd }t|d}|xs*| dk(xr#| xs|| k(xr|| xsdjd k(}|r|tdtdg}nbt|d}t|d}t|d}|| r|nd|r tdnd|s|r tdnd|r tdndt|g}td|Dd}|s|rdnd}| dk(rdnd}|dk(r4|r2t!||t#|jd| dk7r|nd}|r|S|dk(r|s|sd}||dk(r t%||n*t#|jdxst'|xsd|||dS#t$rYwxYw)NrUr8r)rrnrCrrDr"CUSTOM_BASE_URLFrTrOrErr5r4z ollama.comr2r3OLLAMA_API_KEYc3nK|]-}t|st|xsdj/yw)r8N)rrr1r>s r+rkz._resolve_openrouter_runtime..s+j)M^_hMiY_"  # # %js5"5explicitz env/configrZrr:r[r?)rrr]rr1r2rFrrGr,rMr"r>r#rr@rr\rcrX)rr/r0r`rHrI cfg_api_keykvrrLenv_openrouter_base_urlenv_custom_base_urluse_config_base_urlrU_is_openrouter_url_is_openrouter_contextrD_is_ollama_url_is_openai_url_is_openai_azurerreffective_providerrAs r+_resolve_openrouter_runtimerY s "#I0:9==;TVY0Z9==,`bL0:9==;TVY0Z9==,`bLK  MM!  a !'')'')K   ).B557==?N%%'--/L .H4  M 0H>@  $5 V #<6#9&*# x ',X ,- #'   b'')   $7L   R  #   fSk  /xI0,& D $ K4K(K D 06B>>sC C   ( ) $ % 2(LI1(LI1((0J,PT   X%g>P#'  )39hG Y]]:6 7 #H -   K   sL** L76L7)r/r0rc t|xsdj}t|xsdjjd}t|jdxsdjj }d}d}d} i} |dk(rt|jdxsdjjd}t |jdxsd}t|jd xsdjj xsd} |jd } t | tr| } t|xs|jd xsdj} | r|d k7r d dlm } | | }|r|}tddjjd}|xs|xs|}|s td|d k(rtjdd|}| dk(r|r|}d}d}nT d dlm}m}m}t| jdxsdjxs|} ||}||}|}d}d}i}|dk(r3t| jdxsdj}|r||d<d|||||||dS|}|s d dlm}|dxsd}|stddj}|s td|s|rdnd}d|||d||d S#t$rd}YgwxYw#t$r}td|d|d}~wwxYw#t&$r}tt||d}~wwxYw#t$rd}YwxYw)!aResolve an Azure Foundry runtime entry. Reads ``model.base_url`` + ``model.api_mode`` from config.yaml (or explicit overrides), pulls the API key from ``.env`` / env var, and strips a trailing ``/v1`` for Anthropic-style endpoints because the Anthropic SDK appends ``/v1/messages`` internally. When ``model.auth_mode == "entra_id"`` (and the model is OpenAI-style), the returned ``api_key`` is a zero-arg callable produced by :func:`agent.azure_identity_adapter.build_token_provider` rather than a string. Downstream code that constructs an OpenAI SDK client passes this through unchanged (the SDK accepts ``Callable[[], str]`` for ``api_key`` and calls it before every request). Code paths that need a string (logging, manual HTTP probes, header injection) must use the helpers in ``agent.azure_identity_adapter``. Raises :class:`AuthError` when required values are missing. r8rOrr[rrrUrZ auth_modeentrar)rRrrNAZURE_FOUNDRY_BASE_URLzpAzure Foundry requires a base URL. Set it via 'hermes model' or the AZURE_FOUNDRY_BASE_URL environment variable.rentra_idrL)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULTbuild_token_providerzAzure Foundry Entra ID auth requires the 'azure-identity' package. Install it with: pip install azure-identity (import failed: )scope)rc)r)rrZrUrr[r\rr) get_env_valueAZURE_FOUNDRY_API_KEYaAzure Foundry requires an API key. Set AZURE_FOUNDRY_API_KEY in ~/.hermes/.env or run 'hermes model' to configure. To use keyless Microsoft Entra ID auth instead, set model.auth_mode: entra_id in config.yaml (or pick 'Microsoft Entra ID' in 'hermes model').r)rrZrUrr[rr)rr1r>r]r2r\rrrrrGr,rrragent.azure_identity_adapterr_r`ra ImportErrorrrd)rr`r/r0rexplicit_base_url_cleanrIrH cfg_api_mode cfg_auth_mode cfg_entra_entrarrr env_base_urlrUrrr[r_r`rarrc entra_configtoken_provider clean_entraconfigured_scoperds r+_resolve_azure_foundry_runtimerrs4+1r288:!"3"9r:@@BII#Ny}}Z06B7==?EEGLL%LM "I&9==4:;AACJJ3O &y}}Z'@AWEW IMM+6C)DJJLRRTaXa w' fd #I,H)-- *BHbIOOQO<+??  F3ODH #L3R8>>@GGLL&F,F,H  ?  ++66)R2  " ,GF!I IMM'*0b1779*)  32  "6\!J%GF"I  ""9==#9#?R@FFH '7 G$($ " "4  G   7#$;<BG 126<<>  7  -0AZF# 0 S H \ ''*e1.    3C)s2 3: G sTK* K<;LM* K98K9< LLL M&L;;M MMc t|xsdj}t|xsdjjd}|s|sy|dk(rt|jdxsdjj }d}|dk(rHt|jdxsdjjd}t |sd}|xs|xsd}|}|sddlm} | }|s td dd ||d |d S|d k(rn|xst}|}d} |sTt} | jdd}| jd} |s%| jddjdxs|}d d||d | |dS|dk(r]tjdxsi} |xsUtxsIt| jdxstjjjd}|xsNt| t!dt#ddr,t| jdxsdjnd}| jdxs| jd} |sit%t't)dd} | jdd}| jd} |s%| jddjdxs|}dd||d | |dS|dk(rt+|||| St-j|}|r<|j.dk(r,d}|j0r3t)|j0djjd}|}|sA|d!vr-t3|} | jddjd}n|xs |j4}|}|s@t3|} | jdd}|s!| jddjd}d}|d"k(r t7||}n6|d#k(rd}n.t9|jd$}|r|}nt;|}|r|}|||jd|d |d Sy)%Nr8rOrrrUrrresolve_anthropic_tokenNo Anthropic credentials found. Set ANTHROPIC_TOKEN or ANTHROPIC_API_KEY, run 'claude setup-token', or authenticate with 'claude /login'.rRrLr;rr last_refreshrPrrZrUrrrwrrr<HERMES_NOUS_MIN_KEY_TTL_SECONDS agent_keyagent_key_expires_at expires_atHERMES_NOUS_TIMEOUT_SECONDS15timeout_secondsr[rrZrUrrr~rr)rr`r/r0> kimi-codingkimi-coding-cnrrrZ)rr1r>r]r2ragent.anthropic_adapterrurrrrget_provider_auth_staterDEFAULT_NOUS_INFERENCE_URLrmaxr%rfloatr,rrr auth_typebase_url_env_varrrrr\rX)rrr`r/r0rIrHrUrrurwcredsstater~renv_urlrZrars r+_resolve_explicit_runtimerWs+1r288:-34::<CCCH $5;9==4:;AACIIK  ; &y}}Z8>B?EEGNNsSL2<@! $S S8S" G-/GV $,  "4   >!$>(>" 57Eii 2.G 99^4L$ 99Z4;;C@LH&)  ("4  6008>B  o02 o59912Yh6Y6YZ``biijmn # #B A4HI  +&," - 3 3 5  YY56Q%))L:Q 4 %g.KT&R SEii 2.G<0J$ 99Z4;;C@LH*  $"4  ?"-1-/    ##H-G7$$ 1  # #g66;AACJJ3OG$<<d |#j d?d@|#j dA|dBS|dEk(rc tQ}#dEdF|#j dd jd|#j d>d |#j d?dG|#j dH|dIS|dKk(rn tS}#dKdF|#j dxsd jdxstT|#j d>d |#j d?dG|#j dH|dIS|dMk(rc tW}#dMd |#j dd jd|#j d>d |#j d?dN|#j dO|dPS|dRk(rRtYj |}$|$r;|$jZdSk(r,ddTl.m/}%|%}#|d|#d|#d>|#j d?dU|d S|dVk(rta|}#dVd |#j dd jd|#j d>d |#j dWd tc|#j dXxsg|#j d?dY|dZS|dk(rt#|j dxsd jj%}d ?|dk(r?|j dxsd jjd?te?sd ??xsd[}d|j%vxs?xrd?j%v}&|&rd }d\D]O}'t#|j |'xsd j}(|(s2t|(d j}|sOn|s,t#|j d>xsd j}|s6tdd jxstdd j}|s%td]dd^l3m4})|)}|s td_dd||d`|d S|dak(rddbl5m6}*m7}+m8},m9}-|dcv}.|.s|*s tdddef|j dai}/|/j dgxsd jxs|,}0|+xsdh}1|/j dii}2d}3|2j djrN|2j dkr=|2dj|2dkdl}3|2j dmr|2dm|3dn<|2j dor|2do|3do<t#|xs|j dpxsd j}4t/ttjvj dqd j}5|-|4r|5sdaddr|0dsdt|1|0d)|du}ndadvdr|0dsdt|1|0|dw}|3r|3|dx<|StYj |}$|$r'|$jZd>k(rty|}#t{|#j d>s9dyj}|$j~}6|6rdz|6d{nd }7td||d}|7|d~t#|j dxsd jj%}d ?||k(r2|j dxsd jjd??xs!|#j dd jd}d }8|dk(rt||#j d>d }8n|dk(rdF}8nt#|j dxsd jj%}9t|j d}:|dvr&ddlBmC};|xs|j dpd }<|;||<}8n |:rt||9r|:}8nt|}=|=r|=}8|dvrddlBmF}>|>||8|}|dk(rtj|}||8||#j d>d |#j d?d`|d St)|||}||d<|S#t2$rd}Y wxYw#t2$r#}"t@jCd6|"d}!Yd}"~" d}"~"wwxYw#t$r|dCk7rt@jOdDYwxYw#t$r|dCk7rt@jOdJYwxYw#t$r|dCk7rt@jOdLYwxYw#t$r|dCk7rt@jOdQYCwxYw)a)Resolve runtime provider credentials for agent execution. target_model: Optional override for model_cfg.get("default") when computing provider-specific api_mode (e.g. OpenCode Zen/Go where different models route through different API surfaces). Callers performing an explicit mid-session model switch should pass the new model here so api_mode is derived from the model they are switching TO, not the stale persisted default. Other callers can leave it None to preserve existing behavior (api_mode derived from config). r)rr rNz provider z" is disabled in config (providers.z.enabled: false)moar[z moa://localzmoa-virtual-providerr;r8rz azure.comAZURE_ANTHROPIC_KEYANTHROPIC_API_KEYrRrOzazure-explicitr)rr`r/r0r)vertexz google-vertexz vertex-aiz gcp-vertexvertexai)get_vertex_configaVertex AI credentials could not be resolved. Vertex uses OAuth2 (not a static API key): provide a service-account JSON via GOOGLE_APPLICATION_CREDENTIALS (or VERTEX_CREDENTIALS_PATH) in ~/.hermes/.env, or run 'gcloud auth application-default login' for ADC. Set the GCP project/region under vertex: in config.yaml if they aren't embedded in the credentials. Install the extra with: pip install 'hermes-agent[vertex]'.rz vertex-oauth)rr/r0rrrU)rr8)rEz anthropic.comr2c36K|]}t|ywrf)r#)rir?rHs r+rkz+resolve_runtime_provider..s &lD9sr.)rrr`r/r0rOPENAI_BASE_URLr">rrCT>rrrrrryrzr{r|r}rc)r|r}rczINous pool entry agent_key expired/missing, refreshing selected pool entryz"Nous pool entry refresh failed: %szRNous pool entry agent_key still unavailable, falling through to runtime resolutionr)rU)rrrr`rrrrrrrportalr~rrzUAuto-detected Nous provider but credentials failed; falling through to next provider.rrPzhermes-auth-storerwrxzVAuto-detected Codex provider but credentials failed; falling through to next provider.rzZAuto-detected xAI OAuth provider but credentials failed; falling through to next provider.rzqwen-cli expires_at_ms)rrZrUrrrrz@Qwen OAuth credentials failed; falling through to next provider.r oauth_minimax))resolve_minimax_oauth_runtime_credentialsoauthz copilot-acpcommandargsprocess)rrZrUrrrrrr)r api_key_envzNo Azure Anthropic API key found. Set AZURE_ANTHROPIC_KEY or ANTHROPIC_API_KEY, or point key_env/api_key_env in your config.yaml model section at a custom env var.rtrvenvbedrock)has_aws_credentialsresolve_aws_auth_env_varresolve_bedrock_regionis_anthropic_bedrock_model> aws-bedrockamazon-bedrockawsamazonrzNo AWS credentials found for Bedrock. Configure one of: - AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - AWS_PROFILE (for SSO / named profiles) - IAM instance role (EC2, ECS, Lambda) Or run 'aws configure' to set up credentials.no_aws_credentials)coderegionzaws-sdk-default-chain guardrailguardrail_identifierguardrail_version)guardrailIdentifierguardrailVersionstream_processing_modestreamProcessingModetracer)AWS_BEARER_TOKEN_BEDROCKzhttps://bedrock-runtime.z.amazonaws.comzaws-sdk)rrZrUrrrbedrock_anthropicrr)rrZrUrrrrguardrail_configz, z Set r9z*No usable credentials found for provider 'z'.missing_api_key)rrrrrZrrrr)Irrrr rrr] ValueErrorr1r,r>rrragent.vertex_adapterrrrGrr2ryrYrrboolr rGrrrrr%rr^rtry_refresh_currentr rrrr_rrrrrrrFrrlistrrruagent.bedrock_adapterrrrrr%r&rrr}api_key_env_varsrr\rrrrXrrr)@rr/r0rrrr _full_cfg _provs_cfg_block _eff_base _azure_key azure_runtimertokenrUcustom_runtimer`rI_known_cloud_hostsrrexplicit_runtimeshould_use_poolenv_openai_base_urlrPhas_custom_endpointhas_runtime_overriderrrmin_ttl nous_state refreshedrrrr_is_azure_endpointhint_keyenv_varrurrrr is_explicit _bedrock_cfgr auth_source_grr_current_model_has_bearer_token env_nameshintrZrrar _effectiverrrHs@ @r+resolve_runtime_providerrs"4I>C I/9)T/J{+PTJ*d# 23 fd #,?,G.12011AC  U"*%-,"4   #(b//1I[([I-E  # * * , 8,b1779 8*B/557  $,!((-!&"4   _,61')-/%  __:+-xHN !* ,$"4   3-)+N /A+, %5%' 9==4:;AACIIK 9==4:;AAC LL8"  .6'9%5&7 1C,-)+H "#I0-)+ ,.O<9==4:;AACIIK 9==4:;AAC %&7<BBD")*?"D"J"J"L"  '" '&  L,>>"& #$4$I8IJ "8 8 )'' )((  &5y"4 $$&   0$765."5  v %"3"g&GNOG$UK>(/7Mt(T 6J ( G< hi% $ 8 8 :I(%E'8$?>"5."=! &-UK%F07?UW[0\!(!>"J $+? G+TLL!uv#%L  0E#5t<uj$7 4!#5#)  6 =4 %g.KT&R SE#.!IIj"5<! =57E*-!IIj"5<#>)HNN,<<  @[L,>,>,@@  E6 immH5;<BBD#GR0668E  IMM)4:;AAC126<<>@2B7==?E H+-EV $, "4   9  ),ii #6#8@ *  #}((B7 ""8,299;W?U?W.0K4K {B/ 77) *sww7J/K'*+A'B$'(;$<  ww/0;>?W;X !78www,/L )\KY]]9-EKLRRT 0JB!O!U!U!WX %n 5>O&06vhnM$% %)&8 G&.6vhnM$% &8G *:G& ' ##H-G7$$ 14X>!9!56 '":":;I+4U9+Q'"Drs<M" !&&   8 $'9$ 1CC /3= 5<&RB,61r"J.,8""$ 0(   >+/%)"&LL L L ( L # L LL^,(,#' %!   @ 0dN 0j#%)<<#< <~8,'+'+ AA$A% A  AN'+'+ KK$K% K  Kd'+'+"& fff$ f % f  ff\'+'+ XXX X $ X % XXz $&*'+"& U U $U % U   U   U pr-