`gj%dZddlmZddlZddlZddlZddlmZdZd"dZ d#dZ dd  d$d Z d%d Z d&d Z d'd Zd&dZd(dZd&dZd&dddZd&dZd(dZdZd&dZdZd&dZd&dZd&dZd&dZd&dZd&dZd&dZd)dZd&d Z d&d!Z!y)*uwPer-provider model-selection wizard flows for ``hermes setup`` / ``hermes model``. Extracted from ``hermes_cli/main.py`` as part of the god-file decomposition campaign (``~/.hermes/plans/god-file-decomposition.md``, Phase 2 — splitting main.py handler/flow bodies out of the module). These 18 ``_model_flow_*`` functions are the interactive provider-setup branches dispatched by ``select_provider_and_model`` (which stays in main.py). Behavior-neutral: each function is lifted verbatim. ``select_provider_and_model`` in main.py re-imports them (``from hermes_cli.model_setup_flows import *``-style explicit import) so existing call sites — and test monkeypatches that target ``hermes_cli.main._model_flow_*`` — keep resolving against main.py's namespace. main.py-internal helpers the flows call (``_prompt_api_key``, ``_save_custom_provider``, the reasoning-effort/stepfun/qwen helpers, ``_run_anthropic_oauth_flow``, …) are imported lazily inside the flows (``from hermes_cli.main import ...`` resolves at call time, when main.py is fully loaded) so this module never imports ``hermes_cli.main`` at import time -> no import cycle. ) annotationsN) clear_model_endpoint_credentials) us.eu.ap.apac.jp.ca.sa.me.af.cj|xsdj}dD]\}}|j|s|cSy)zJMap an AWS region name to its inference-profile geo prefix ('' = unknown).))r)zus-us_gov)r)zeu-)r)zap-)r )zca-)r )zsa-)r )zme-)r )zaf-)lower startswith) region_namergeoregion_prefixess O/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/model_setup_flows.pybedrock_region_geo_prefixr)sC  !!#A! _ << (J  c|xsdjtfdtDd}|jdryt |}|sy|dk(r|dvS||k(S)a-True when *model_id* can be invoked from *region_name*'s endpoint. Bare foundation-model ids and ``global.*`` profiles route from anywhere. Geo-prefixed inference profiles (``us.*``, ``eu.*``, ...) only route from endpoints in their own geography. Unknown region shapes hide nothing. rc3FK|]}j|s|ywNr.0pmids r z5bedrock_model_routable_from_region..BsMa3>>!;LM!!Nglobal.Tr)rrr )rnextBEDROCK_GEO_PREFIXESrr)model_idr matched_georr!s @r"bedrock_model_routable_from_regionr):sl >r "CM#7MtTKcnnY7 #K 0C  e|555 # rr provider_namec6 ddlm}m}ddlm}m}|||xsd}|sy|d}t |tsy|jD]\}} t |tr&|j|r||k(st | ts=g} g} d} | D]g} t | trD| jddk(r0d } | jd }|r| jt|W| j| i| s||| | y#t$rYywxYw) abDrop stale ``model_config`` credentials from inactive custom pools. ``model_config`` means "the credential currently stored under ``model.api_key``". After an explicit custom-endpoint switch, any old custom pool still carrying that source points at the previous endpoint and can be selected before the freshly saved config is tried. r)CUSTOM_POOL_PREFIXget_custom_provider_pool_key)read_credential_poolwrite_credential_poolNr*Fsource model_configTid) removed_ids)agent.credential_poolr-r.hermes_cli.authr/r0 isinstancedictitemsstrrlistgetappend Exception)base_urlr+r-r.r/r0active_pool_keypoolspool_keyentriesretainedr4changedentryentry_ids r/_prune_replaced_custom_model_config_credentialsrHNs#&  P6 '/4  $T*%& !& S Hgx-**+=>.!'40HKG  'eT*uyy/Bn/T"G$yyH#**3x=9& '%hkR) S* s" D D CD > D DDc |gd} ddlm}|||d}|dk\rtd|S t|t |dD]"\}}|dk(rdnd}td|d|d |$t t d j }|d k(ry |dk(ryy#t$rYxwxYw#ttf$rd }Y/wxYw)zPrompt for reuse / reauthenticate / cancel with the standard radio UI. Returns one of ``"use"``, ``"reauth"``, ``"cancel"``. Falls back to a numbered prompt when curses is unavailable (piped stdin, non-TTY). )zUse existing credentialsz Reauthenticate (new OAuth login)Cancelr_curses_prompt_choice)usereauthcancel→  .  Choice [1/2/3]: 12rN3rOrM) hermes_cli.setuprLprintr> enumerateinputstripKeyboardInterruptEOFError)titlechoicesrLidxilabelmarkerchoices r_prompt_auth_credentials_choicergs G  :#E7A6 !8 G.s3 3   %Lgq)*5q&c 6(!A3b()* G+,224} } #     x (s##B2B' B$#B$'B;:B;c 4ddlm}ddlm}ddlm}m}m}m}ddl m }|dddd } |d xsd } | std t|| | d\} } | ryddl m } m}| d}|dd}||||d|| xs| }|r||ddl m}m}|}|j#d}t%|t&s |rd|ini}||d<d|d<||d<d|d<t)|d|||td|dytdy) z5OpenRouter provider: ensure API key, then pick model.r_prompt_api_key)OPENROUTER_BASE_URL)ProviderConfig_prompt_model_selection_save_model_choicedeactivate_provider) get_env_value openrouter OpenRouterapi_key)OPENROUTER_API_KEY)r3name auth_typeapi_key_env_varsrtrz&Get one at: https://openrouter.ai/keys provider_idN) model_idsget_pricing_for_providerT force_refresh current_modelpricingconfirm_providerconfirm_base_urlconfirm_api_key load_config save_configmodeldefaultproviderr?chat_completionsapi_modeFclear_api_modeDefault model set to: z (via OpenRouter) No change.)hermes_cli.mainrjhermes_constantsrkr6rlrmrnrohermes_cli.configrprZhermes_cli.modelsrzr{rrr<r7r8r)configrrjrkrlrmrnrorppconfig existing_key _resolvedabortrzr{openrouter_modelsrselectedrrcfgrs r_model_flow_openrouterrsA/4 0  0 G !!56<"L  67 &w ,WIu E!5'|4HG&#%,!1\ H8$ ?m %&*/Y&RE CL(j/j.j(uEC &xj0ABC lrc rtd|tdt|jdxsgdD]7\}}td|d|jdd |jd 9|jd xsi}td |jdd |jd y )zDPrint the full reference-models + aggregator breakdown for a preset.z Preset: z Reference models:reference_modelsrPstart rTr:r aggregatorz Aggregator: N)rZr[r<)rupresetrbslotaggs r_print_moa_presetrs Jtf   vzz*<=C1MH T SEDHHZ01488G3D2EFGH **\ " (bC OCGGJ/0#'''2B1C DErc ddlm}m}ddlm}m}ddlm}|t|tr|jdni}|jdxsi}|s tdyt|j} |jd xs| d} g} | D]} || jd xsi} | r%| jd d | jd nd}t|| jdxsg}| | k(rdnd}| j| d|d|d|| | vr| j!| nd} ddlm}|d| |}||dkr tdy| |}||}|}|jd }t|ts |rd|ini}||d <||d<d|d <t;|d |j=d!d|||||ttd"|d#t?||y#t&$rtdt)| dD]%\}}|dz |k(rdnd}td|d|d|' t+dt| dj-}n!#t.t0f$rtdYYywxYw|s|}nK t3dt5t| dz t7|dz }n#t8$rtdYYywxYwYwxYw)$uMixture of Agents virtual provider: pick a preset, then persist it. Unlike the other provider flows there is no credential step — MoA is a virtual provider whose presets reference already-configured providers. We always show the preset list (even when there is only one) so the user sees what they are selecting, then print the full preset breakdown on selection. rrnror)normalize_moa_configmoapresetszCNo MoA presets configured. Run `hermes moa configure ` first.Ndefault_presetrrrrrru ← defaultz (agg , z refs)rKz"Select a Mixture of Agents preset:rPrQrRrSrTz Choice [1-]: rrTrr?rz (via Mixture of Agents)) r6rnrorrrhermes_cli.moa_configrr7r8r<rZr;keyslenr=indexrYrLr>r[r\r]r^r_maxminint ValueErrorrpopr)rrrnrorrrrrnames default_namerowsnr agg_label ref_countsuffix default_idxrLrbrcrowreraw selected_namerrrs r_model_flow_moarsH:: Jvt4Lvzz%0RT UCggi &BG  ST  E77+,8aL D Iqz~~l+1rCFswwz*+1SWWW-=,>?B  '9:@bA $%$52 qc 2i[vhGH I0C!8,  ,   C !STQC1 => l# s[<HAK) &I43K)4JK)JK).K  K) K"K)!K""K)(K)c ddlm}m}m}m}m}m}m} m} m } ddl m } m } m }m}ddlm}|d}|r|j#dst%dt% t'j(t+|dd t+|d d t+|d d t+|d d t-t+|d dt+|dd xsdt+|dd t-t+|dd}| || d | xsi}||y ddlm}m}m}m}m}m}|}|s t%dy |}|d} |d}!|!s |d}"|"r|"}d}# |d}$|$r|$j#d d}#g}%d}&|!r< dd!l#m$}'m%}(|(d})|'|)d"#xsd}&||| |#\}} ||| d$\}}%n ||| |#\}} |s|%s t%d%y |!r>|s SystemExitrrr{rrrrr7relogin_requiredr:hermes_cli.nous_accountrrrrstriprr8r]rr)0rrargsrrmrnrrrrrrrprrrrstate mock_args _refreshedexcrr{rrrrrzcredsreloginmsg login_excrrrefreshed_creds_nous_portal_url _nous_staterrrr _account_infor_urlrrcurrent_model_cfg model_cfgs0 r_model_flow_nousrLsY    H #F +E  .1 >?   **"4t<%dOTB!$ T:dGT2lE BCi6>$!$ T:gdJ>? I  #4V#< = (]0b *:6  +,I  <=024'v.G%6I  >"O' -f5 */@"E %' %  9TJM6!1 D w 0  7)F w$) % %D w 0  7 / DE 34  ?$?(?GGLD %T;tf""_`'#-#/:r2 )R0 H8$ *b1 #FM:"JJw/ ' ../I )3 /4E4K4K4M"$5$;$;$=>II & *' ) ]002$1$8$8$=Ij ! MM*d +(3#w * + ,b 1 +R 0F &xj0BCD"6* lm     . /   N3%( )  4 S),E1E1E(23 (B$C  %cU+ , ; < 7$..#"&"$ ""  I'8'@A 7))566 7  .se45-J       : %"$  %sBN2N,O  RR':R7 N NNNO(O0OO RAR))QR Q4Q/*R/Q44R<RR R$#R$' R43R47 SSc(ddlm}m}m}m}m}m}m}ddlm } |} | jdrtdttd} | dk(r\tdt tj} || |d d |} | jdsHtdy | dk(r7y tdt tj} || |d d } |}|jdr|jd}|s ddlm}|}|jd}| |}|||d ||xsd}|r!|||d |td|dy tdy #t$rtd Yy t $r} td| Yd } ~ y d } ~ wwxYw#t$rtd Yy t $r} td| Yd } ~ y d } ~ wwxYw#t $rYwxYw#t $rYwxYw)z9OpenAI Codex provider: ensure logged in, then pick model.r)get_codex_auth_statusrmrnr_login_openai_codexrDEFAULT_CODEX_BASE_URL)get_codex_model_ids logged_inu OpenAI Codex credentials: ✓zOpenAI Codex credentials:rNz&Starting a fresh OpenAI Codex login...z openai-codexTforce_new_loginrNrz Login failed.rOz/Not logged into OpenAI Codex. Starting login...rs)!resolve_codex_runtime_credentials)rrrrrrrz (via OpenAI Codex)r)r6r rmrnrr rr hermes_cli.codex_modelsr r<rZrgrrrr>r)rrr rmrnrr rr r statusrfrr _codex_token _codex_statusr _codex_creds codex_modelsrs r_model_flow_openai_codexr-s)< " $F zz+ /0 01LM X  : ; G $..0 #%n5$(+,F::k*o& x   ?@   **,I  +<^+L ML -/   [ )(,,Y7L   I<>L'++I6L'LAL&#'/$* H8$#N4JK &xj0CDE ls 23 se,-   . /   N3%( )         s`,"F F=1)G6HF:F:"F55F:=G3G3G..G36 HH HH)rc ddlm}m}m}m}m}m}m} m} ddl m } |} | jdrtdttd} | dk(r[tdt tjt!t#|d d t#|d d  }||| ddn^| dk(rYy tdt tjt!t#|d d t#|d d  }||| d| } |}|jdxsdj)j+dxs|}t-| jdxs| jdxsg}|||xs |r|dnd}|r!|||d|td|dy tdy #t$$rtdYy t&$r}td|Yd }~y d }~wwxYw#t$$rtdYy t&$r}td|Yd }~y d }~wwxYw#t&$rYwxYw)zRxAI Grok OAuth (SuperGrok / Premium+) provider: ensure logged in, then pick model.r)get_xai_oauth_auth_statusrmrnr%resolve_xai_oauth_runtime_credentials_login_xai_oauthDEFAULT_XAI_OAUTH_BASE_URLr_PROVIDER_MODELSr u8 xAI Grok OAuth (SuperGrok / Premium+) credentials: ✓z2xAI Grok OAuth (SuperGrok / Premium+) credentials:rNz#Starting a fresh xAI OAuth login...rFrN)rrz xai-oauthTrrrrOzHNot logged into xAI Grok OAuth (SuperGrok / Premium+). Starting login...r?rrxaizgrok-build-0.1)rru. (via xAI Grok OAuth — SuperGrok / Premium+)r)r6rrmrnrrrrrrrr<rZrgrrrrrr>r]rr;)_configrrrrmrnrrrrrrrrfrrr?rmodelsrs r_model_flow_xai_oauthr#sD   3 & (F zz+ HI 0 @  X  7 8 G $..#GD,$FG#D)T: !%k2$(x   XY   **lE BCi6I Y(9+(F G*H 57IIj)/R668??DP"&&{3X7G7K7KE7RXVX YF&v]=y\bvVWyhxzH8$#K: &xj0^_` lY 23 se,-   . /   N3%( )      sP.AGAG?=H8G<G<$G77G<?H5H5H00H58 IIc4ddlm}ddlm}m}m}m}m}m}ddl m } |} | jdsftdtd| jd} | rtd | | jd rtd | jd y d } |d } | | d| d} | s t|} |xs | r| dnd}|| |d|}|r!|||d|td|dy tdy #t$rY`wxYw)zAQwen OAuth provider: reuse local Qwen CLI login, then pick model.r)_DEFAULT_QWEN_PORTAL_MODELS)get_qwen_auth_status resolve_qwen_runtime_credentialsrmrnrDEFAULT_QWEN_BASE_URLfetch_api_modelsr zNot logged into Qwen CLI OAuth.zRun: qwen auth qwen-oauth auth_filezExpected credentials file: errorzError: NT)refresh_if_expiringrsr?zqwen3-coder-plusz qwen-oauthrrrrz (via Qwen OAuth)r)rr%r6r&r'rmrnrr(rr*r<rZr>r;)r!rr%r&r'rmrnrr(r*rr+r"rrrs r_model_flow_qwen_oauthr/s/;3 ! #F ::k " /0 )*JJ{+  / {; < ::g  GFJJw/01 2F 0TJ!% "2E*4EF 12LVq 9KG&%. H 8$#L2GH &xj0ABC l#    sD DDc ddlm}m}m}m}m}m}m} m} m } |d} | r| jdsltdt tjt|ddxsdtt|d d t|d dxsd } | | | d |}ddlm}|jdg}|||d|d}|sy|||d|dtd|y#t $rtdYyt"$r}td|Yd}~yd}~wwxYw#|$r}t| |Yd}~yd}~wwxYw)z:MiniMax OAuth provider: ensure logged in, then pick model.r) rrmrnr)resolve_minimax_oauth_runtime_credentialsrr_login_minimax_oauthrz minimax-oauthrz0Not logged into MiniMax. Starting OAuth login...regionNglobalrFrr)r3rrrrrr?)rru✓ Using MiniMax model: )r6rrmrnrr1rrr2rr<rZrrrrrr>rr)rrrrrmrnrr1rrr2rrrrrrrzrs r_model_flow_minimax_oauthr5s[    $O 4E  .1 @A   **tXt4@lE BCi6>$I !,=o,N O9; 3 $$_b9I&(z* H x z1BC ( 345  . /   N3%( )    $%s7AC3D,3D) D)D$$D),E 1EE c x %ddlm}m}m}ddlm}m}ddlm}m }m }ddl m } |dxsd} |dxsd} td | rtd | | rtd | d d dt td| xsddj} | d| r| d d dznddj} | s| s tdy | xs| }|j%dstd|dy | xs| }|j'dj)%t+%fddD}|r%j-dsttdtdtd|j'dd td jj)}|d"vr&|j'ddz}| r|} td#|tdd$lm}|||}|j3d%r-|j3d&rtd'|d&d(|d&}| r|} n|j3d)>td*|j3d+d,t5|j3d)xsgd-nbtd.|j3d+d/|j3d0r3|d0}|j-drtd1|ntd2||j3d3}d}t7|t8r,t;|j3d4xsdj}|||5}|rtd6|n td7d}|j3d)xsg} t5|d8k(r\td9|dtd:jj)}|d"vr|d}ntd;j}nt5|d8kDrtd<t=|d8D]\}}td=|d>|td?t5|d@j}|j?r2d8tA|cxkrt5|krnn|tA|d8z }n|r|}ntd;j}tdAj}||}tdB|djxs|} d }!|rC tA|jCdCdjCdDdEjCdFdE}!|!dkrd }!|r|||}"|"j3d3}#t7|#t8s |#rdI|#ini}#|#|"d3<dJ|#dK<||#dL<|r||#dM<|r||#d4<n|#jGd4d ||"|t9|#|d3<tdN|dO|dPno| s| r||j3d3}$t7|$t8s|$rdI|$ini}$dJ|$dK<||$dL<|r||$dM<|r||$d4<n|$jGd4d |$|d3<tdQ||||xsd|!| |RtI|| Sy #t t"f$rtdYy wxYw#t t"f$rd!}YwxYw#t t"f$rtdYy wxYw#tD$rtdG|dHd }!YwxYw)TzCustom endpoint: collect URL, API key, and model name. Automatically saves the endpoint to ``custom_providers`` in config.yaml so it appears in the provider menu on subsequent runs. r)_auto_provider_name!_prompt_custom_api_mode_selection_save_custom_providerr)rprrmasked_secret_promptrrrz0Custom OpenAI-compatible endpoint configuration:z Current URL: z Current key: N...zAPI base URL [ze.g. https://api.example.com/v1r API key [optional Cancelled.zNo URL provided. Cancelled.zhttp://https:// Invalid URL: & (must start with http:// or https://)rc3&K|]}|v ywr)rh _url_lowers rr"z%_model_flow_custom..ls  Zs) localhostz 127.0.0.1z0.0.0.0z:11434z:8080z:5000z/v1z+ Hint: Did you mean to add /v1 at the end?z@ Most local model servers (Ollama, vLLM, llama.cpp) require it.z e.g. z Add /v1? [Y/n]: r>ryyesz Updated URL: )probe_api_models used_fallbackresolved_base_urlz)Warning: endpoint verification worked at zL/models, not the exact URL you entered. Saving the working base URL instead.r"zVerified endpoint via probed_url (z model(s) visible)z,Warning: could not verify this endpoint via z. Hermes will still save it.suggested_base_urlz8 If this server expects /v1 in the path, try base URL: z- If /v1 should not be in the base URL, try: rr)current_api_modez API mode: z API mode: auto-detectrPz Detected model: z Use this model? [Y/n]: z&Model name (e.g. gpt-4, llama-3-70b): z Available models:rrTz Select model [1-z] or type name: z8Context length in tokens [leave blank for auto-detect]: zDisplay name [,k000KzInvalid context length: u — will auto-detect.rcustomrr?rsr (via )zFEndpoint saved. Use `/model` in chat or `hermes model` to set a model.)context_lengthrurr*)%rr7r8r9r6rnrorrprrhermes_cli.secret_promptr;rZr\r]r^r_rrranyendswithrrLr<rr7r8r:r[isdigitrreplacerrrH)&rr7r8r9rnrorprrr; current_url current_keyr?rs effective_url effective_key _looks_local_add_v1rLprobe suggestedrrRr model_namedetected_modelsconfirmrcmpickcontext_length_strr display_namerZrr _caller_modelrHs& @r_model_flow_customrp<sL nmGII= 128bK 017RK <=  }-.  BQ045 G [M,MNc R %' '; BQ%/JOs S %'  K +,+ M  # #$; < m_,RST*{M %%c*002JRLJ//6  ;< PQ  ,,S12#67 01779??AG & &)005=M( OM?3 4 2 ]M :E yy!eii0C&D 7>Q8R7STR S 12 $H 8  ( $UYY|%<$=>EIIh'-2.//A C :599\;R:ST) *  99) *23I!!%(NykZEi[QR 7+#T*044Z@FBGMMO0)H XJ'( '(Jii)/RO  1 $ &q'9&:; <78>>@FFHG**,Q/ "#KLRRT  !A % ' (!/15 '1QCr!o& '$S%9$::JKeg ||~!s4y"HC4H"H,SY]; ! GHNNPJ" F %'  +=9 ~l^3?@FFHXL N " "**33e$e$N "!% :&m %&*/Y&RE CL$j)j ,E)   (E*  IIj$ 'C u+w &zl&qIJ w  ! 7+ -.:GY 6RM$, j!$1 j! '4M) $ (0M* %   j$ /'w VWb%  4"} x ( n>"8, G l x ( n " ,-?,@@VW X!N "sK6AY='Y##E0Y;AZY Y #Y87Y8;ZZZ98Z9c4ddlm}m}ddlm}m}m}m}ddlm }|jdi} t| tr| jddk(rt| jdd xsd } t| jd d xsd } t| jd xsd jjxsd } | jd xsi} t| tr| ni}nd } d } d } i}|dxsd }t!t!dt!dt!t!dt!dt!dt!dt!| rt!d| | r| dk(rdnd}t!d|| dk(r t!dn|rt!d|dddt! | xsd }t#d!|d"j}|xs| j)d$}|s t!d%y|j+d&st!d'|d(yt!t!d)t!d*t!d+t!d,t!d- | dk(rd.nd/}t#d0|d1jxs|}|d.k(}|rdnd }d }i}d}d }|r dd2lm}m}m}m}m} |rct! st!d6t!d7t|jd8xsd j}"|"xs}i}|"r|"|d8<t!t!d9|:}#|#d;<}$|$jd=r=|$jd>xsg}%|%rd?j;|%nd@}&t!dA|&dB|dCn|$jdDxsdE}'|$jdFxsdG}(t!dH|'t!dI|( t#dJjj})|)r|)dKvr t!dLy |#M}nIt!ddOlm }* |*dP|r|dddQzndRd"j}+|+xs|}|s t!dSyt!t!dT|jC|||U},tE|,jF}-|,jHxsd }.|.rW|.dk(rdnd}/t!dV|/|,jJrt!dW|,jJdC|-rt!dXtM|-dYnt!dZ|,jJt!t!d[t!d\t!d]t!d^t!d_ | d`k(rd.nd/}0t#da|0d1jxs|0}1|1d.k(rd`nd}.t!d }2|-rt!dbtO|-ddcddeD]\}3}4t!df|3dgdh|4tM|-dckDrt!ditM|-dcz djt! t#dk|xs|-dd"j}5|5s |xs|-d}2nw|5jQr/models`` probe → OpenAI-style + populates a picker with the returned deployment / model IDs. * Anthropic Messages probe fallback when ``/models`` fails. * Manual entry when every probe fails (private endpoints, etc.). Context lengths for the chosen model are resolved via the standard :func:`agent.model_metadata.get_model_context_length` chain (models.dev, provider metadata, hardcoded family fallbacks). rrrprrr) azure_detectrrz azure-foundryr?rr auth_modersentraAZURE_FOUNDRY_API_KEYzAzure Foundry Configurationz2==================================================z9Azure Foundry can host models with either OpenAI-style orz6Anthropic-style API endpoints. Hermes will probe yourz6endpoint to auto-detect the transport and the deployedzmodels when possible.z Current endpoint: rz OpenAI-stylezAnthropic-stylez Current API mode: entra_idz1 Current auth mode: Microsoft Entra ID (keyless)z Current auth mode: API key (Nr<z...)zhe.g. https://.openai.azure.com/openai/v1 or https://.services.ai.azure.com/anthropiczAPI endpoint URL [rr@rz$No endpoint URL provided. Cancelled.rArCrDzAuthentication:z= 1. API key (AZURE_FOUNDRY_API_KEY in .env)zO 2. Microsoft Entra ID (managed identity / workload identity / az login)zY Recommended by Microsoft. Works for both OpenAI-style and Anthropic-style endpoints.z? Requires the 'Azure AI User' role on the Foundry resource.rWrVzAuthentication mode [1/2] (z): )EntraIdentityConfigSCOPE_AI_AZURE_DEFAULTbuild_token_providerdescribe_active_credentialhas_azure_identity_installedu-⚠ Could not import azure-identity adapter: z Falling back to API key auth.Fu6◐ The 'azure-identity' package is not installed yet.z Hermes will install it now (the preflight below triggers the lazy-install). To skip lazy installs, run: pip install azure-identityru>◐ Probing Microsoft Entra ID credential chain (up to 10s)...)rg$@)rtimeout_secondsok env_sourcesrz default chainu✓ Entra ID token acquired (z, scope=rYr,zcredential chain exhaustedhintzqRun `az login`, attach a managed identity to this VM, or set AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET.u⚠ z Hint: z4Save Entra config anyway and validate later? [Y/n]: )rJrK Cancelled.)ru0⚠ Could not build token provider for probing: r:r>r=requiredzNo API key provided. Cancelled.u;◐ Probing endpoint to auto-detect transport and models...)rstoken_provideru✓ Detected API transport: z (u ✓ Found z# deployed model(s) on this endpointu⚠ Auto-detection incomplete: z7Select the API format your Azure Foundry endpoint uses:z. 1. OpenAI-style (POST /v1/chat/completions)z: For: GPT models, Llama, Mistral, and most open modelsz) 2. Anthropic-style (POST /v1/messages)z9 For: Claude models deployed via Anthropic API formatanthropic_messageszAPI format [1/2] (z"Available models on this endpoint:rPrrSz>2rTz ... and z' more (type name manually if not shown)z+Pick by number, or type a deployment name [zModel / deployment name [ze.g. gpt-5.4, claude-sonnet-4-6z"No model name provided. Cancelled.rrrZrrzMicrosoft Entra ID (keyless)zAPI keyu✓ Azure Foundry configured:z Endpoint: z API mode: z Auth: z Model: z Context length: rSz tokenszA Context length: not auto-detected (will fall back at runtime))-r6rnrorrprrr hermes_clirsr<r7r8r:r]rrZr\r^r_rragent.azure_identity_adapterrxryrzr{r| ImportErrorjoinr>r[r;detectr;r"rreasonrr[r^rrlookup_context_lengthr)>rrrnrorprrrrsrcurrent_base_urlrRcurrent_auth_mode _cur_entra current_entracurrent_api_key_lbl _placeholderr?rb _auth_default auth_choice use_entraauth_mode_labelrcentra_overridesr entra_scoperxryrzr{r|r_persisted_scope_overrider!infortagerrransr;rs detectiondiscovered_modelsr mode_labeldefault_choice mode_choiceeffective_modelrcr!rlrhctx_lenrr clean_entrakeyval auth_labels> r_model_flow_azure_foundryrs BH ( 7B'I)T"y}}Z'@O'Sy}}Z<BCy}}Z<BC k : GiHNNPVVXe\e]]7+1r &0T&B  % #$;<BO G '( (O G EF BC BC !" G %&6%789 #55 " %dV,-J& AB  .r/B.C4HI G   FF   c 2 %' 1!199#>M  45  # #$; < m_,RST G  IJ [\ ef KL0J>C / cB C I I K  s"I$-j9OMONK (   +- J K 3 %( (9(9'(B(Hb$I$O$O$Q!/I3I  $'@OG $  NO% *$O 88D>((=17RK,7$))K(_C 1#h{m1M N((7#C'CC88F#K  D,  HTF# $ RSYY[aacs,.l#  "1AN A *?OBQ/%7PZ[[^_eg  2?  3 4  G GH##%$I $( (8(8#9&&,"H&*<? JK 9: IJ $48L$LSRUN*>*:#>?EEG"! ,7#+='CU GO 23 1#2 6a@ &FAs BqfBse$ % &  !B & S!23b899`a   =m>cO`abOc=ddgheg  +C/@/CO \\^SY Q#c:K6Lb2Q Q/D A >O"O +M,^=^+__bceg  %5   2300% 1G . > -C GGG E eT "&+E"G 'E*%E* E*&E)(E+$U5A  'C!%%c*C#& C  ' (E'N  g e g")5kF7O&'("-%&',#+/A#AGXJ*3& G )*  01  -.  -.  1 23 $WQKw78 G QR Gc x ( n2 x ( n* ( G A#G H 3 4I'O  (^&x0 n%  " DSEJ K!N ""8,  . !  \"8,  . !  *"8,  . !  "8,  . !  s#a-*a5-b'c c32$d+*d:$e!e:a21a25bb c'c  cc0/c03 d<ddd76d7:eee76e7:ffc r ddlm}m}m}ddlm}m}ddlm}m }ddl m } |d} |d} |jdd } |jd d } |jd d }|jd d }|jd xsd j}| s"|r tjj|d } ||| }|jdd}t!|t"r|j%dv}g}|jdi}t!|t&r3|Dcgc]'}t#|jst#|)}}nJt!|t(r:|Dcgc]/}t!|t"s|js%t#|1}}t+d| t+d| |rt+d|t+|s|rt+dt-||}n&t+dddi}| r| |d<| | | fi|}|s|r|}|rd}|r||vr|j/|}t+dt-|d ddlm}|Dcgc]}||k(r|dn|c}dgz}|d| d||d d!}t+|dks|t-|k\r t+d"y#||}nc|r.t+d+ tAd,|d)jxs|}n3t+d- tAd.j}|s t+d/y#|||} | jd }!t!|!t&s |!rd0|!ini}!|!| d <|rYd1|jj%jKd2d3z|!d4<|!jMdd#|!jMd d#nd5|!d4<||| |!d<|r||!d <|jdd }"|"r|"|!d<n|!jMdd#|| ||r0|} | jd6}#t!|#t&r|#j|}$t!|$t&r||$d7<t#|jd8d xsd j}%t#|jd d xsd j}&tO|%xs|&}'|'r4|r2t#|$jd d xsd js||$d <|r2t#|$jd d xsd js||$d <|#| d6<|| n || ||| 9t+d:|t+d;| d<| d=y#cc}wcc}wcc}w#t4t6t8t:j<f$rt?|d$D]!\}}||k(rdnd }t+d%|d&||#t+d%t-|d$zd't+ tAd(t-|d$zd)j}|s t+d"Yy#tC|d$z }|dks|t-|k\r t+d"Yy#||}n&#tDtFtHf$rt+d*YYy#wxYwYhwxYw#tFtHf$rt+d*Yy#wxYw#tFtHf$rt+d*Yy#wxYw)>aHandle a named custom provider from config.yaml custom_providers list. Always probes the endpoint's /models API to let the user pick a model. If a model was previously saved, it is pre-selected in the menu. Falls back to the saved model if probing fails. r)%_custom_provider_api_key_config_value&_custom_provider_base_url_config_valuer9rrr)rur?rrrskey_envr provider_keydiscover_modelsT>0nofalser"z Provider: z URL: z Current: z2Using configured models (discover_models: false): zFetching available models...rg @zFound z model(s): )curses_radiolistz (current)rJzSelect model from r)rcancel_returns searchablerNrPrSrTz. Cancelz Choice [1-rr@z%Could not fetch models from endpoint.z Model name [z@Could not fetch models from endpoint. Enter model name manually. Model name: zNo model specified. Cancelled.rzcustom:rR-rrW providers default_model api_key_ref)ru ✅ Model set to: z Provider: rPrY)(rrrr9r6rnrorrrrr*r<r]osenvironr7r:rr8r;rZrrhermes_cli.curses_uirrNotImplementedErrorOSError subprocessSubprocessErrorr[r\rrr^r_r_rr)(r provider_inforrr9rnrorrr*rur?rrsr saved_modelrconfig_api_keydiscoverconfigured_models cfg_modelsrkr" fetch_kwargsrr menu_itemsrbrhrcrrrrcustom_api_mode providers_cfgprovider_entryoriginal_api_key_reforiginal_api_keyhad_inline_api_keys( r_model_flow_named_customrsEEG:2  DZ(H  R0H 2.G 2.G##GR0K!%%n5;BBDL w**.."-:='RN  !2D9H(C >>#+??#%""8R0J*d#-7J3q6<<>SVJJ J %& *Q*<CF   L   L #$ [M*+ G ) B3GXCYBZ[\" ,-!3' '/L $!'8D|D+&F  ;&0 ,,{3K s6{m<01$  =FL@AA$41#Z !; J#$TF!,$! C GQw#V,l#J(  56 k]#>?EEGV;J PQ ~.446J 2 3 z" -C GGG E eT "&+E"G % (:(:(<(B(B(D(L(LSRU(VVj *d# )T"$jB 8 j -E) #'' B7O+j *d#m , mT **..|B(%'%$'}'8'8B'G'M2#N#T#T#V %)*>*RBR%S"&& 2 29b A GRHNNP0>N9-3~'9'9)R'H'NB#O#U#U#W07N9-#0K C  h XV  -. M$r(1 -.qK D0':;U;UV !&!, -1)*k)9r1#Rs6(+, - Bs6{Q'x0 1 G jVq(9=>DDF,'#hl7cS[0,'#C[  18< n%  ."8,  . !  "8,  . !  sU> U"U8U U U'U"#AU'$U'8!Y9&Z"U''A8Y6 6Y ,Y Y  Y6 Y/+Y6.Y//Y65Y69ZZZ65Z6c ddlm}m}m}ddlm}m}m}m}m } ddl m } m } m } ddlm} m}m}m}m}m}d}||}| |}|j+dd}|j+d d}|st-d t-t-d t-d t-d t-dt-dt-t-dt-dt-dt-dt- t/dj1}|dk(r< ddlm}|}|r| d|t-dt-n t-dyn|dk(rnddlm} |dj1}|s t-dy dd lm }||\}} |st-d!| y | d|t-d"t-n t-dy| |}|j+dd}|j+d d}nP|d#vr&dd$l"m#}!|!|}"t-d%|dd&d'||"d(n|d)k(r t-d*n t-d+t-|jH}#||}$|$r2|$D%cgc]&}%|%j+d,s|%j+d,d(c}%n|||#}&|||$|-xs|}'|&r+|&D(cgc]}(|(s|( })}(t-d.tK|)d/n*| j+|g})|)rt-d0t-d1|)r||)|'||#|2}*n t/d3j1}*|*r||*|$|-xs|*}*| }+||+},||*|$|-}-d}.|-rt-d4|*d5||-|,6}.||*| }/|/j+d7}0tM|0tNs |0rd8|0ini}0|0|/d7<||0d9<|#|0d:<||*|$|-|0d;<tQ|0d<=|. ||/|.| |/|t-d>|*d?|jRd(|-r#|.d@k(r t-dAy|.rt-dB|.yyyt-dCy#t2t4f$r t-YywxYw#t:$r}t-d|Yd}~yd}~wwxYw#t2t4f$r t-YywxYw#tB$rY wxYwcc}%wcc}(w#t2t4f$rd}*YwxYw)DzAGitHub Copilot flow using env vars, gh CLI, or OAuth device code.r)_current_reasoning_effort"_prompt_reasoning_effort_selection_set_reasoning_effort)rrmrnro$resolve_api_key_provider_credentials)rrr)rr*fetch_github_model_cataloggithub_model_reasoning_effortscopilot_model_api_modenormalize_copilot_model_idcopilotrsrr1z.No GitHub token configured for GitHub Copilot.z Supported token types:uL → OAuth token (gho_*) via `copilot login` or device code flowuI → Fine-grained PAT (github_pat_*) with Copilot Requests permissionu= → GitHub App token (ghu_*) via environment variableuA ✗ Classic PAT (ghp_*) NOT supported by Copilot APIz Options:z1 1. Login with GitHub (OAuth device code flow)z 2. Enter a token manually 3. Cancelz Choice [1-3]: NrV)copilot_device_code_loginCOPILOT_GITHUB_TOKENz Copilot token saved.z Login cancelled or failed.z Login failed: rWr:z Token (COPILOT_GITHUB_TOKEN): Cancelled.)validate_copilot_tokenu ✗ z Token saved.>GH_TOKEN GITHUB_TOKENformat_secret_source_suffixz GitHub token: r<u ... ✓ (rYz gh auth tokenu* GitHub token: ✓ (from `gh auth token`)u GitHub token: ✓r3catalogrs Found  model(s) from GitHub CopilotL ⚠ Could not auto-detect models from GitHub Copilot — showing defaults.? Use "Enter custom model name" if you do not see your model.rrrSz supports reasoning controls.)current_effortrrrr?rFrrrXnonez"Reasoning disabled for this model.zReasoning effort set to: r)*rrrrr6rrmrnrorrrrrrrr*rrrrr<rZr\r]r^r_hermes_cli.copilot_authrr>r[r;rrhermes_cli.env_loaderrinference_base_urlrr7r8rru)1rrrrrrrmrnrorrrrrr*rrrrryrrrsr1rfrtokenrr;new_keyrvalidrr bw_suffixeffective_baseritem live_modelsnormalized_current_modelr' model_listr initial_cfgrreasoning_effortsselected_effortrrs1 r_model_flow_copilotrLs6ttKJK ,G 0 =Eii 2&G YYx $F  >?  () Z  YZ MN QR  l AB -. o  -.446F S= M13"#95A23G89s] E ./QRXXZn% J3G< sF3%.) 17 ; " # G . ! 4[A))Ir*8R( 1 1 I3F;I $WRa[M6(9+QO P  & > ? ' ( //N(1G )0B488D>$ B g~ 6 #     /:G8hhG G Z))FGH%))+r:  ^  S T* 2(+#   ^,224H &    "m 2;?:     Bxj => ?@!.O 8$m %&*/Y&RE CL'j*j2  j )uE  & !# 7C &xjw||nAFG &(:; 1/1BCD!  lq"8,  G    (./ &x0    6 CH*"8, H sx6Q9QR!R"&R2=R22R7:R7R<QQ R(Q;;RRR" R/.R/<SScdddlm}m}m}m}m}m}m}ddlm } m } m } ddl m } m} ~d}||}||}|jdxs|jdxsd}|jd xs |j }t#d t#d t#d t#d |t#d|t# ||}|jd xs|}d} |d}|jdd}| |}| |||xs|}|rJ|Dcgc]&}|jds|jdd(}}t#dt'|dn*| jdg}|rt#dt#d|r||||||}n t)dj+}|s t#dy| |||xs|}||| }|jd}t1|t2s |rd|ini}||d<||d<||d <d |d!<t5|d"#| ||t#d$|d%|j6d&y#t$$r#}t#d|t#dYd}~yd}~wwxYw#t$$rYwxYwcc}w#t,t.f$rd}YwxYw)'z4GitHub Copilot ACP flow using the local Copilot CLI.r)rrmrnro$get_external_process_provider_statusr-resolve_external_process_provider_credentials)rrrrz copilot-acpresolved_commandcommandrr?z? GitHub Copilot ACP delegates Hermes turns to `copilot --acp`.zB Hermes currently starts its own ACP subprocess for each request.zH Hermes uses your selected model as a hint for the Copilot ACP session.z Command: z Backend marker: u ⚠ z[ Set HERMES_COPILOT_ACP_COMMAND or COPILOT_CLI_PATH if Copilot CLI is installed elsewhere.Nrrsrr3rrrrrrrrrrrrFrrrXrY)r6rrmrnrorrrrrrrrrrr<rrZr>rr\r]r^r_r7r8rru)rrrrmrnrorrrrrrrrryrrrrrrcatalog_api_key catalog_credsrrrrrrrs r_model_flow_copilot_acprs ;K ,G 1+ >F %&L&**Y*?L9ZZ +Iw/I/IN KL NO TU K() *+ ~. /0 G=kJYYz*>J JJJ/.J/cddlm}ddlm}m}m}m}m}ddlm }m } m } m } ddl m} d} || }|jr|jdnd}|j xsd}d}|jD]&}||xst#j$|d}|s&n|||| \}}|ry |j'd }|r|}t)d |n|j*}t)d ||r||r | |dt)| j-|rdnd g}|r|||| ||}n t/dj1}|r||| }|j-d}t7|t8s |rd|ini}||d<| |d<||d<|j;dd t=|d| |||rdnd}t)d|d|dy t)dy #t2t4f$rd }YwxYw)uKimi / Moonshot model selection with automatic endpoint routing. - sk-kimi-* keys → api.kimi.com/coding/v1 (Kimi Coding Plan) - Other keys → api.moonshot.ai/v1 (legacy Moonshot) No manual base URL prompt — endpoint is determined by key prefix. rri)rKIMI_CODE_BASE_URLrmrnrorrrz kimi-codingrrxNzsk-kimi-u$ Detected Kimi Coding Plan key → u Using Moonshot endpoint → moonshotrzEnter model name: rrrr?rFrz Kimi CodingMoonshotrrXrYr)rrjr6rrrmrnrorrprrrrrrwbase_url_env_varrgetenvrrZrr<r\r]r^r_r7r8rr)rrrjrrrmrnrorprrrrryrr base_url_envrevris_coding_planrrrrrendpoint_labels r_model_flow_kimirs'0 3K ,G-4-E-Eg&&q)2G++1rLL&&$R(=BIIb",=   *;L% ",,Z8N+ 4^4DEF 33 .~.>?@ l3|R( G"%%~m:WYZJ* '(+(   1288:H8$m %&*/Y&RE CL'j*j *d#(uEC*8j &xj~6FaHI l-"8, H s%GG.-G.c~ddlm}m}m}m}ddlm}m}m}m } ddl m } m } m } m} ddlm}m}d}||}|j$r|j$dnd}|j&xsd}d}|j$D]&}| |xst)j*|d}|s&n||||\}}|ry d}|r | |xst)j*|d}|sM|j-d }t/|t0r,t3|j-d xsdj5}||xs |j6}d d |d dfdd|ddfg}g}|D]5\}}||k(r|j9d||df#|j;||f7|j;d||Dcgc]\}}| c}}}| ||ddk(r t=dy ||d} || }!|r | ||!|||!}"|"r(|"}#t=dt?|#d|j@dn-|j-|g}#|#rt=d|j@d|#r||#|||!|}$n tCdj5}$|$r||$| }%|%j-d }&t/|&t0s |&rd|&ini}&|&|%d <||&d<|!|&d <|&jIdd tK|&d | |%| t1|&|d <t=d!|$d"|j@dy t=dy cc}}w#tDtFf$rd }$YwxYw)#z6StepFun Step Plan flow with region-specific endpoints.r)_infer_stepfun_regionrj_prompt_provider_choice_stepfun_base_url_for_regionrrmrnrorr)rr*stepfunrrxNrr? internationalzInternational (rYchinazChina (u ← currently active)rOrJrOrr model(s) from  APIz$ Could not auto-detect models from u, API — showing Step Plan fallback catalog.rrrrrFrrrX)&rrrjrrr6rrmrnrorrprrrrrr*rwr rr r<r7r8r:r]rinsertr=rZrrur\r^r_rr)'rrrrjrrrrmrnrorprrrrr*ryrrr rr r current_basercurrent_regionregion_choicesordered_regions region_keyrd_ region_idxselected_regionrrrrrrs' r_model_flow_stepfunr$s}}  EK ,G-4-E-Eg&&q)2G++1rLL&&$R(=BIIb",=   *;L% L$\2Qbii b6Q JJw' i &y}}Z8>B?EEGL*<+U7;U;UVN :?KLA N  G8AB!DE NO+8 E  '  " "1zeWg}|D].}|d""j;s"|vr|j/|0gd! d<fd" ! !fd#}|j=|$|Dcgc]}|d }}td%t9|d&t9|d'n9|j?d(g}|rtd)t9|d*n td+y|r|||d(d,|d-.}n t!d/j#}|r|||}|j?d0}tA|tBs |rd1|ini}||d0<d(|d2<d,|d-|d3<|jEd4dtG|d56|j?d(i}tA|tBsi}||d7<||d(<|||td8|d9|d:ytd;y#t$r#tdtdtYywxYw#t$t&f$r tYywxYw#t$t&f$r tYywxYwcc}w#t$t&f$rd}YNwxYw)=u$AWS Bedrock provider: verify credentials, pick region, discover models. Uses the native Converse API via boto3 — not the OpenAI-compatible endpoint. Auth is handled by the AWS SDK default credential chain (env vars, profile, instance role), so no API key prompt is needed. rr&rr)has_aws_credentialsresolve_aws_auth_env_varresolve_bedrock_regiondiscover_bedrock_modelsu. ✗ boto3 is not installed. Install it with:z pip install boto3Nu< ⚠ No AWS credentials detected via environment variables.zE Bedrock will use boto3's default credential chain (IMDS, SSO, etc.)z AWS credentials: u ✓z< AWS credentials: boto3 default chain (instance role / SSO)z AWS Region [r Choose authentication method:z) 1. IAM credential chain (recommended)zB Works with EC2 instance roles, SSO, env vars, aws configurez 2. Bedrock API Keyu< Enter your Bedrock API Key directly — also supportsz5 team scenarios where an admin distributes keysz Choice [1]: rWz Discovering models in r=)z stability.z cohere.embedz twelvelabs.z us.stability.zus.cohere.embedzus.twelvelabs.zglobal.cohere.embedzglobal.twelvelabs.) safeguardvoxtralzpalmyra-visionr3c3@K|]}j|ywrrrs rr"z&_model_flow_bedrock.. s@3>>!$@sc3BK|]}|jvywr)r)rsr!s rr"z&_model_flow_bedrock.. sA1 #As)r$c3FK|]}j|s|ywrrrs rr"z&_model_flow_bedrock.. Jaq8IJr#) zanthropic.claude-sonnet-4-6zanthropic.claude-opus-4-6zanthropic.claude-haiku-4-5zamazon.nova-prozamazon.nova-litezamazon.nova-microz deepseek.v3zmeta.llama4-maverickzmeta.llama4-scoutcTtfdDd}|rt|dSS)Nc3FK|]}j|s|ywrrrs rr"z8_model_flow_bedrock.._base_id..= r@r#)r%r)r!_pp_PROFILE_PREFIXESs` r_base_idz%_model_flow_bedrock.._base_id< s-J#4JDQC%(3s3xy> 1c 1rc|d}|}tD]1\}}|j|sd||jdsdnd|fcS|jdrddd|fSddd|fS)Nr3rr$rP)r[r)rkr!basercrec_RECOMMENDED_BASESrEs r _sort_keyz&_model_flow_bedrock.._sort_key@ sD'CC=D#$67 R3??3'q3>>)+D!!SQQ R~~i(1a~%q!S> !r)rrz text model(s) (filtered from z total)r+z Using z, curated models (live discovery unavailable)zJ No models found. Check IAM permissions for bedrock:ListFoundationModels.zhttps://bedrock-runtime.z.amazonaws.comr.r-rrrr?rFrr3r.z (via AWS Bedrock, rYr/)r!r:returnr:)$r6rmrnrorrrrragent.bedrock_adapterr5r6r7r8rrZr\r]r^r_r3r\r)r=r&setr%addrrsortr<r7r8rr)#rrrmrnrorrrr5r6r7r8auth_varr region_inputr3rr_EXCLUDE_PREFIXES_EXCLUDE_SUBSTRINGSfilteredrkprofile_base_idsrCdedupedrKrrrrr2rDrJrEr!s# @@@@r_model_flow_bedrockrXs ;2      LM UV ')H #H:T23 LM G,-N~n-=SABHHJ  +^F +, G 56 NO "# HI AB G,-335 c#FFMB $VHC 01)&1K  I AD'C@.?@@A-@AA5c6B OOA  1<?5 5AD'CJ#4JDQC $$SS^4  5  AD'CNN#45++ NN1     2 "   #'./!ag/ / s:''Ec+FVEWW^ _ &)))R8  3z?++WX  \  * '&7x~N   ^,224H8$m %&*/Y&RE CL%j6vhnMj *d#(uEggi, +t,K & H$IC ( 2EfXQOP ni  >? %&  , x (  x ( p06"8, H sM N1O O? PP#1)OO O<;O<?PP#P87P8cHddlm}m}m}ddlm}m}m}ddlm }|dxs |dxsdj} | rtd| d n,td td td td t|} | jd} t| tsi} t| jdxsdj} t!d| xsddj} | xs| }t| jdxsdjxsd} t!d|dj}|xs|}|jdgxsddg}|dk(rd|dnd|d|d}|||d|}|r|||} | jd}t|ts |rd|ini}|| d<d|d <|j'd!d|j'd"dt)|d#$| jd}t|tsi}||d<||d<|| d<|| |td%|d&|d'ytd(y#t"t$f$r tYywxYw#t"t$f$r tYywxYw))uGoogle Vertex AI provider: Gemini via the OpenAI-compatible endpoint. Auth is OAuth2 — short-lived tokens minted from a service-account JSON or Application Default Credentials (ADC). No static API key. The credential *path* lives in .env (VERTEX_CREDENTIALS_PATH / GOOGLE_APPLICATION_CREDENTIALS); project ID and region are non-secret and saved to config.yaml under vertex:. rr&)rrrprVERTEX_CREDENTIALS_PATHGOOGLE_APPLICATION_CREDENTIALSrz, Vertex credentials: service account JSON (u) ✓z; Vertex credentials: Application Default Credentials (ADC)z5 Vertex uses OAuth2, not a static API key. Either:u9 • run 'gcloud auth application-default login', oruQ • set VERTEX_CREDENTIALS_PATH in ~/.hermes/.env to a service account JSONvertex project_idz GCP project ID [zfrom credentialsrNr3r4z Vertex region [zgoogle/gemini-3-pro-previewzgoogle/gemini-3-flash-previewzGhttps://aiplatform.googleapis.com/v1beta1/projects//locations/z/endpoints/openapirBz@-aiplatform.googleapis.com/v1beta1/projects//locations/r.rrrr?rFrr.z (via Google Vertex AI, rYr/)r6rmrnrorrrrprrr]rZr<r7r8r:r\r^r_rr)rrrmrnrorrrprsa_pathr vertex_cfgcurrent_project project_inputr]rrRr3rbase_url_previewrrvcfgs r_model_flow_vertexrd s JI2 /0  9 :   eg   DDFR(N00@DEKKM  +^F"%%h3%'8J X  H. 0x H.0 '#!) H8$m %&*/Y&RE CL$j *d# *d#(uEwwx $%D'\XH C ( 2J6(RSTU nw x (  x ( s$!I&6J&JJJ! J!c ddlm}ddlm}|Dcgc] \}}}}||f }}}}|xsdj j d}d}t |D] \} \}}||j dk(s| }n|r t|}|Dcgc] \}}|d|d} }}| jd|| |d } | |S| t|k(rQ td |d j } | s|S| jd s td|S| j dS|| dj dScc}}}wcc}}w#ttf$rt|cYSwxYw)aPresent a picker for Z.AI endpoint selection during setup. Offers the four official Z.AI endpoints (Global, China, Coding Plan Global, Coding Plan China) plus a custom-proxy option. The list is sourced from ``ZAI_ENDPOINTS`` in ``hermes_cli.auth`` so it stays in sync with the probe list. Returns the selected base URL. Falls back to *current_base* on cancel or error. r)r) ZAI_ENDPOINTSrrrPrYzCustom proxy URLzSelect Z.AI / GLM endpoint:)rr`zCustom base URL [rrAM Invalid URL — must start with http:// or https://. Keeping current value.rP)rrr6rfr]rr[rr=r\r^r_rZr) rrrfr!urlrdoptionsnormalized_currentrrbraroverrides r_select_zai_endpointrl s8-5BBB 035s|BGB&,"335<EE"!E"cddlm}ddlm}m}m}m}ddlm}m } m } m } ddl m } m} m}m}||}|j"r|j"dnd}|j$xsd}d}|j"D]&}||xst'j(|d}|s&n||||\}}|ry|d k(r|r dd lm}|t1d |r||ndxs(t'j(|xsddxs |j2}|||}|d k(rt1t1d t1dt1dt1dt1t1dt1dt1t1dt1t1dy|dk(r t1dn t1dt1d}|r ||xst'j(|d}|s | j5dxsi}t7|j5dxsdj9j;|k(r,t7|j5dxsdj9}|xs |j2}|dk(r t=|}|r||k7r |r | |||}nJ t?d|dj9}|r*|r(|jEds t1dn | |||}|d k(rDdd!lm#}dd"l m$}|xs |r||nd} || |#}!|!rt1d&tK|!d'n|d(k(r>dd)l m&}#|xs |r||nd} |#| |d*+}!|!rt1d&tK|!d,nx|d-k(rdd.l m} |xs |r||nd} | j5|g}$| | |}%|%r)|%}!t1d&tK|!d/|jNd0ng}& dd1l(m)}'|'|}&|&r|&D(chc]}(|(j;})}(tU|&}!|$D]E}(|(j;|)vs|!jW|(|)jY|(j;Gt1d&tK|!d2nw|$}!|!rrt1d3tK|!d4nX| j5|g}$g}& dd1l(m)}'|'|}&|&r|$ru|&D(chc]}(|(j;})}(tU|&}*|$D]E}(|(j;|)vs|*jW|(|)jY|(j;G|*}!n|&}!t1d&tK|!d2n|$r)tK|$d5k\r|$}!t1d3tK|!d4nv|xs |r||nd} | | |}%|%r?tK|%tK|$k\r(|%}!t1d&tK|!d/|jNd0n|$}!|!rt1d3tK|!d4|d6vrD|!D+cgc] }+|||+ }!}+|||}tUtZj]d7|!D}!|!r$i}, dd8l m/}-|-|xsi},||!||,|||9}.n t?d:j9}.|.r|d6vr |||.}.||.| }/|/j5d}0ta|0tZs |0rd;|0ini}0|0|/d<||0d<||0d<tc|0d<=|d6vr |||.|0d><n|0jed>d| |/|t1d?|.d@|jNdAyt1dBy#t.$rd}YywxYw#t.$rYwxYw#t@tBf$rt1d}YwxYw#|$r&}"t1d$|"t1d%g}!Yd}"~"d}"~"wwxYw#t.$rYwxYwcc}(w#t.$rYwxYwcc}(wcc}+w#t.$ri},YwxYw#t@tBf$rd}.YwxYw)CzCGeneric flow for API-key providers (z.ai, MiniMax, OpenCode, etc.).rrirrr)rr*opencode_model_api_modenormalize_opencode_model_idrrxNgemini)probe_gemini_tierz Checking Gemini API tier...freeuW❌ This Google API key is on the free tier (<= 250 requests/day for gemini-2.5-flash).z[ Hermes typically makes 3-10 API calls per user turn (tool iterations + auxiliary tasks),zO so the free tier is exhausted after a handful of messages and cannot sustainz an agent session.zX To use Gemini with Hermes, enable billing on your Google Cloud project and regeneratezK the key in a billing-enabled project: https://aistudio.google.com/apikeyzY Alternatives with workable free usage: DeepSeek, OpenRouter (free models), Groq, Nous.z*Not saving Gemini as the default provider.paidu Tier check: paid ✓z3 Tier check: could not verify (proceeding anyway).rrr?zaiz Base URL [rrArglmstudio)r)fetch_lmstudio_models)rsr?z" LM Studio rejected the request: zC Set LM_API_KEY (or update it) to match the server's bearer token.rz model(s) from LM Studioz ollama-cloud)fetch_ollama_cloud_modelsT)rsr?r}z model(s) from Ollama Cloudnovitar)rr)list_agentic_modelsz" model(s) from models.dev registryr,rr<> opencode-go opencode-zenc3&K|] }|s| ywrrF)rr!s rr"z/_model_flow_api_key_provider..) s'IS'Is)r{r~rrFrrrrXrYr)3rrjr6rrmrnrorrprrrrrr*rnrorwr rr agent.gemini_native_adapterrqr>rZrr<r:r]rrlr\r^r_rrrvrrwruagent.models_devryr;r=rOr8fromkeysr{r7rr)1rryrrjrrmrnrorprrrrr*rnrorrr rr rrq probe_basetierr_mr chosen_baserkrrvapi_key_for_proberrrwcuratedr mdev_modelsryrkseenmergedr!rr{rrrs1 r_model_flow_api_key_providerr& sz/   ,G-4-E-Eg&&q)2G++1rLL&&$R(=BIIb",=   *;L%  h< % E  ( 1 20<|,".99\/R4.--  %\:>Dv~B;2,-:9<BCv~./ KL GL$\2Qbii b6Q  ""7+1rB266*%+,224::< K"266*#5#;<BBD "?W%?%?Ne +>: ;.8\ < 5$ z.)9=>DDFH  &&'>?c|X6!)j -;(Ww]7-CTV .)NJ  HS_--EF G  &?(Ww]7-CTV /%#  HS_--HI J  6(Ww]7-CTV"&&{B7&'8.I $J HS_-_W\\N$O P "K @1+> +67a 77!+.  ,Awwy,"))!,+,Z 11STU$ $S_$55rs#&&{B7   <-k:K +67a 77k* ,Awwy, a(+,$ ( HS_--OP Q W* J S_--jk !-!*1 g&r ++A ' S 9  4KO $--'Iz'IIJ    B.{;ArG+ '(+(   ^,224H 9 92;IH8$m %&*/Y&RE CL'j*j(uE 9 9 7 X NE*  IIj$ 'C &xjw||nAFG lU % $  %@    "8,  GH 8  6se< = W XJ H  8,   8B " G "8, H s.\B\1 ]7 ]#^^!^&,^6!^;&__ \.-\.1 \>=\>] ] #^(^  ^ ^^& ^32^3 ___'&_'c`ddlm}ddlm}m}m}ddlm}m}m }m } ddl m } ddlm } | } d} ddlm}m}m}|}|r ||rd } d}| r | r| sd }t'| xr| xs| }| }|r| rkdd lm}dd lm}d }|d j.D]6}t1j2|d j5| k(s+||}|s6nt7d| ddd|n | r t7dt7t9d}|dk(rd }n|dk(ry|rt7t7dt7t7dt7dt7dt7 t;dj5}|dk(r ||sry|dk(r`t7t7dt7ddl m!} |dj5}|s t7d y| ||!t7d"n t7d#yt7| jEd g}|r |||d $}n t;d%j5}|r~|||}|jEd&}tG|tHs |rd'|ini}||d&<d |d(<|jKd)dtM||||t7d*|d+yt7d,y#t$$rYwxYw#t<t>f$r t7YywxYw#t<t>f$r t7YywxYw#t<t>f$rd}YwxYw)-uRFlow for Anthropic provider — OAuth subscription, API key, or Claude Code creds.r)_run_anthropic_oauth_flowr&)rrrsave_anthropic_api_keyr)get_anthropic_keyF)read_claude_code_credentialsis_claude_code_token_valid_is_oauth_tokenTr)rr anthropicz Anthropic credentials: Nr(r)u. Claude Code credentials: ✓ (auto-detected)zAnthropic credentials:rNrOr9z0 1. Claude Pro/Max subscription (OAuth login)z( 2. Anthropic API key (pay-per-token)rrUrVrWz> Get an API key at: https://platform.claude.com/settings/keysr:z API key (sk-ant-...): r)save_fnr*r/)rrz-Model name (e.g., claude-sonnet-4-20250514): rrrr?rz (via Anthropic)r)'rrr6rmrnrorrrrrrrragent.anthropic_adapterrrrr>rrrrrwrr r]rZrgr\r^r_r[r;r<r7r8rr) rrrrmrnrorrrrrrr cc_availablerrrcc_credsexisting_is_stale_oauth has_creds needs_authrrr1varrfr;rsrrrrs r_model_flow_anthropicr` sM9  32$&LL    01 28<L$ 5l"&l#C,C(CT IJ  I 9 M(5FF 99S"%++-=$?$DM$   +L",=+>gm_U  B C 01IJ X J x    /0  @A 89 o  /0668F S=,^< s] G R S G E ./IJPPRn% "7N C ( ) . !  G"%%k26J* '(   LMSSUH8$ m %&*/Y&RE CL'j *d#(/C &xj0@AB lm    l"8,  G   &x0  2"8, H sGK #K5K:&L KKK76K7:LLL-,L-)rr:rLr:)r'r:rr:rLr)r?r:r+r:rLNone)r`r:rLr:)r)rur:rr8rLr)rN)rr:rLr:)"__doc__ __future__rrrrrrr&rr)rHrgrrrrrr#r/r5rprrrrrr$r3rXrdrlrrrFrrrs(# > ".222 2j#LAHFR-j_BVpOTOb.`35l]@n ` ~/@ENsDj[zpd^@K\eN7,txt Ur