Yj}rdZddlmZddlZddlZddlZddlmZddlm Z m Z m Z ej e ZddlmZddlmZmZmZmZmZddlmZdd lmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+dd l,m-Z-m.Z.m/Z/dd l0m1Z1dd l2m3Z3m4Z4m5Z5dZd[dZ6d\dZ7d]dZ8d^dZ9d_dZ:d`d Z;dad!Zdcd$Z?ddded'Z@dfd)ZAhd*ZBdgd-ZCdhd.ZDdid1ZEdddd2djd9ZFdddkd;ZG dldmd?ZHdndBZIdndCZJdodDZKdpdEZLd_dFZMdddGdqdIZNdhdJZOdrdLZPdddMdsdPZQdddMdtdQZRddddRdudSZSdddMdvdTZTdddddUdwdVZUdxdYZVdS)yzGShared runtime provider resolution for CLI, gateway, cron, and helpers.) annotationsN)urlparse)AnyDictOptional)auth)CredentialPoolPooledCredential credential_pool_matches_providerget_custom_provider_pool_key load_pool) get_secret) AuthErrorDEFAULT_CODEX_BASE_URLDEFAULT_QWEN_BASE_URLDEFAULT_XAI_OAUTH_BASE_URLPROVIDER_REGISTRY_agent_key_is_usable_nous_inference_env_overrideformat_auth_errorresolve_provider resolve_nous_runtime_credentials!resolve_codex_runtime_credentials%resolve_xai_oauth_runtime_credentials resolve_qwen_runtime_credentials$resolve_api_key_provider_credentials-resolve_external_process_provider_credentialshas_usable_secret)get_compatible_custom_providers load_confignormalize_extra_headers)OPENROUTER_BASE_URL)base_url_host_matchesbase_url_hostnameenv_intnamestrdefaultreturnc.t||}||n|S)aProfile-scoped replacement for ``os.getenv`` on credential/provider reads. Routes through the secret scope (Workstream A): identical to ``os.getenv`` when multiplexing is off, scope-aware (and fail-closed on an unscoped read) when on. Genuinely-global vars are handled inside ``get_secret`` and still read ``os.environ``. Keeps the ``(name, default) -> str`` contract every call site here already relies on. ) _get_secret)r'r)vals PC:\Users\server\AppData\Local\hermes\hermes-agent\hermes_cli\runtime_provider.py_getenvr/1s! dG $ $C/33w.valuecv|ddS)N -)striplowerreplacer1s r._normalize_custom_provider_namer9>s, ;;==   ( (c 2 22r0hostboolc\|pdd}|dvS)Nr&.>::10.0.0.0 localhost 127.0.0.1)r6rstrip)r:hs r._loopback_hostnamerDBs1 ##C((A < <!!i:&=&=## 4r0 model_cfgDict[str, Any]ct|d}t|}|dkr%|dkrtd|pdd}|p|pdS)aResolve api_mode for legacy/plain ``provider: custom`` endpoints. Custom endpoints should stay conservative by default. Only direct OpenAI/xAI URLs imply Responses API automatically; named custom providers can opt in via their own ``api_mode`` field. This also prevents a stale persisted ``model.api_mode: codex_responses`` from forcing generic relays onto the Responses path after upgrades or /reset. api_moderUzMIgnoring persisted custom api_mode=codex_responses for non-OpenAI endpoint %sz (unknown)Nchat_completions)_parse_api_modegetr\loggerinfo)r]rQconfigured_mode detected_modes r._resolve_plain_custom_api_moderhsz&immJ&?&?@@O,X66M+++ AR0R0R [  #      Am A/AAr0crt|}|sdStd|ddDrdS|dvsd|vrdSd|dD}|r+|dd vr!|d|r |dd v!t |d krdS|d }dd |D}|r|dsdS|d vrdS|d}t|dpd S)u_Look up `_API_KEY` in the env, derived from the base URL host. Examples: https://api.deepseek.com/v1 → DEEPSEEK_API_KEY https://api.groq.com/openai/v1 → GROQ_API_KEY https://api.mistral.ai/v1 → MISTRAL_API_KEY https://generativelanguage.googleapis.com/v1beta/openai/ → GOOGLEAPIS_API_KEY Returns the env value (stripped) or "". Never returns env vars whose names are already explicitly checked elsewhere — those are handled by their own host-gated paths (OPENAI/OPENROUTER/OLLAMA). The vendor label is the *registrable* portion of the hostname: strip ``api.`` / ``www.`` prefixes, then take the second-to-last label (``api.deepseek.com`` → ``deepseek``). Falls back to "" for hostnames that don't yield a usable vendor label (IPs, loopback, single-label hosts). r&c3>K|]}|VdSN)isdigit.0chs r. z(_host_derived_api_key..s* : :B2::<< : : : : : :r0r=)r@:cg|]}||Srt)rnlbls r. z)_host_derived_api_key..s 8 8 8cC 8c 8 8 8r0r)apiwwwc3FK|]}|r|ndVdS)_N)isalnumrms r.rpz(_host_derived_api_key..s3EEbjjll3EEEEEEr0)OPENAI OPENROUTEROLLAMA_API_KEY) r$anysplitpoplenjoinupperisalphar/r5)rQr[labelsvendor sanitizedenv_names r._host_derived_api_keyrsv&!**H r : :(.."5"5b"9 : : :::r>!!SH__r 8 8X^^C00 8 8 8F VAY.00 1  VAY.00 6{{QrBZFEEfEEEEEKKMMI IaL0022r666r%%%H Hb ! ! 'R . . 0 00r0cD|pd}|sdSt|pd}|sdS|dks*|ds|drdS|drdSt |dkrdSdS) uDecide whether a configured ``model.base_url`` may back native Anthropic. Native ``provider: anthropic`` resolution honors ``model.base_url`` so users can point at Anthropic-compatible endpoints (official Anthropic/Claude hosts, Azure Foundry, MiniMax/Zhipu/LiteLLM-style ``/anthropic`` proxies, Kimi's ``/coding`` route). But a config can carry a *stale* non-Anthropic URL — e.g. ``provider: anthropic`` left with ``base_url: https://openrouter.ai/api/v1`` after a provider switch — which would route Anthropic OAuth/setup-token traffic to an OpenAI-compatible aggregator and 404. Ignore those. Returns True only when the URL plausibly speaks the Anthropic Messages protocol; otherwise the caller falls back to ``https://api.anthropic.com``. r&FrVz.anthropic.comz .claude.comTz .azure.comrW)r5r$r6rYr\)rQ candidater[s r._anthropic_base_url_override_okrsR&&((I u!),,299;;H u&&&(*;*;r002288::06B==??EEGG th&&$0_4I4T4TU^4_4__ $7 77r0api_keyct|dpd}t |d}|rt d|r|St|dpd}|sdS ddlm}||| S#t$rYdSwxYw) Nrr&r`copilotr)rar)copilot_model_api_mode)r) r(rcr5r6rbrhermes_cli.modelsrrL)r]rrrf model_namers r._copilot_runtime_api_moder@simmJ77=2>>DDFFLLNN%immJ&?&?@@O? K^__Y]]9--344::<rUbedrock_converseracodex_app_serverrWrawrct|tr1|}|tvr|SdS)z@Validate an api_mode value from config. Returns None if invalid.N)rr(r5r6_VALID_API_MODES)rrZs r.rbrb`sD#sYY[[&&(( ) ) )  4r0c"tpdS)uVReturn the trusted Nous runtime base URL override, if configured. Delegates to ``auth._nous_inference_env_override`` so every ``NOUS_INFERENCE_BASE_URL`` read shares one normalization path (trailing-slash stripping, blank → empty). The env source is trusted and intentionally bypasses the network host allowlist there. r&)rrtr0r.!_nous_inference_base_url_overrideris ( ) ) /R/r0r`Optional[Dict[str, Any]]c|s|S|dvr|St|dpd}|dkrdS|S)uOptional opt-in: rewrite api_mode → "codex_app_server" for OpenAI/Codex providers when the user has explicitly enabled that runtime via `model.openai_runtime: codex_app_server` in config.yaml. Default behavior is preserved: when the key is unset, "auto", or empty, this function is a no-op. Only providers in {"openai", "openai-codex"} are eligible — other providers (anthropic, openrouter, etc.) cannot be rerouted through codex. Returns the (possibly-rewritten) api_mode.>openai openai-codexopenai_runtimer&r)r(rcr5r6)rr`r]runtimes r.%_maybe_apply_codex_app_server_runtimertsp 111)-- 0117R88>>@@FFHHG$$$!! Or0)r]pool target_modelentryr requested_providerrOptional[CredentialPool]rc  |p t}|p|dpd}t|ddpt|ddpdd}t|ddpt|dd}d} |d kr d } |pt}n|d kr d } |pt }n|d kr d} |pt }n|d kr%d} tj|} |p | r| jnd}n|dkrd} t|dpd } d} | dkrZt|dpd d} t| sd} | p|pd}n|dkr |pt}n|dkrd } n|dkrd} tp|}n|dkr5t|t|dd} |ptdj}n\|dkrt|dpd } | dkrst|dpd d} | r| }t!|d} | r| } |r/| dkr) ddlm}||}n#t&$rd}YnwxYw|r|} | dkrt)jdd|}nEt|dpd }tj|} | o0|d| jdk}||krO|rMt|dpd d} | r| }t!|d} |dvrddlm}|||} n(| rt/||r| } nt1|}|r|} |dvrddlm}||| |}t5|| |} |dkrt7j|}|| ||t|d d!||d"S)#Nr)r&runtime_base_urlrQrTruntime_api_key access_tokenrarrU xai-oauth qwen-oauth minimax-oauthrW anthropicrhttps://api.anthropic.com openrouterxainousr azure-foundryr`razure_foundry_model_api_mode/v1/?$ opencode-go opencode-zenopencode_model_api_modenormalize_opencode_base_url)rr`r]lmstudiosourcer)rr`rQrrcredential_poolr)rrcgetattrrBrrrrinference_base_urlr(r5r6rr"rrrbrrrLresubrrr\rrauth_mod$_normalize_lmstudio_runtime_base_url)rrrr]rreffective_modelrQrr`pconfigrFrErfrinferredrpool_url_is_defaultrrrs r. _resolve_runtime_from_pool_entryrs0.00I$Ey}}Y'?'?E2O1488bGE:W[<\<\b`bjjknooHe.55[XZ9[9[G!H>!!$55 [ $99 \ ! !%44 _ $ $ (#'11Ng M : :2 [ '9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! J8J/J \ ! !22 U  $ V  %466B( Y  ,YGXZ\8]8]^^N0;N _ $ $9==44:;;AACCIIKK ? * *y}}Z88>B??EEGGNNsSSL ('-immJ.G.GHHO +*  $x+??? JJJJJJ77HH     $# + + +viX66H!)-- ";";"ArBBHHJJPPRR $'11%h(//#*>*>'B\BcBcdgBhBh*h ( * */B *y}}Z88>B??EEGGNNsSSL ('))-- *C*CDD 6 6 6 B A A A A A..xIIHH  $!EhPc!d!d $&HH 099H $#222AAAAAA..x8LL5H H:@JJ%6220  s$K66 LL requestedc|r:|r&|St}|d}t |t r:|r&|St dd}|r|SdS)z=Resolve provider request from explicit arg, config, then env.rHERMES_INFERENCE_PROVIDERr&auto)r5r6rrcrr(r/)rr]rF env_providers r.resolve_requested_providerrs)Y__&&)  &&(((!##I==,,L,$$,););)=)=,!!##))+++6;;AACCIIKKL 6r0provider_labelapi_mode_override provider_namecPt||}|sdS t|}|sdS|}|dSt |ddpt |dd}|sdS||pt |pd||d||dS#t $rYdSwxYw) zXCheck if a credential pool exists for a custom endpoint and return a runtime dict if so.rNrrr&razpool:)rr`rQrrr)r r has_credentialsselectrr\rL)rQrrrpool_keyrr pool_api_keys r._try_resolve_from_custom_poolr0s,HMRRRH t""##%% 4  =4u&7>>d'%Q_acBdBd  4&)e-Eh-O-OeSe #(h((#     tts"#BB$B:B B%$B%resultNonecdD]:}||}t|tr|dkr||d<dS;dS)aqPropagate a per-provider output cap onto the resolved runtime dict. Accepts ``max_output_tokens`` or ``max_tokens`` on a ``custom_providers`` entry so a provider block can pin its own output limit. Gateway and CLI map this onto ``AIAgent.max_tokens`` only when the top-level ``model.max_tokens`` isn't set, so the documented global key still wins. )max_output_tokens max_tokensrrN)rcrint)rr_k_vs r._lift_max_output_tokensr PsY2 YYr]] b#   266*,F& ' FF r0c\t|d}|r||d<dSdS)zCopy a validated ``extra_headers`` dict from a provider entry. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Never log them. extra_headersN)r!rc)rrr s r._lift_extra_headersr _s? ,EIIo,F,FGGM0"/00r0c b t|pd}|sdS|dkrdS|dkri|dsT tj|}|pd|krdSn#t $rYnwxYwt}|d}t|trE| D]/\}}t|tst|}t|ddpd}|r"t|dnd} | s7t|ddpd} |||d|hvr"|dp+|d p|d pd} | r|d || | |d dd } |d} t| trt| | d<t|| t|dp|d} | r| | d<t!|| | cS|d d}|r(t|}|||d|hvr|dp+|d p|d pd} | r|| | |d dd } |d} t| trt| | d<t|| t|dp|d} | r| | d<t!|| | cS1|d}t|trt"ddSt'|}|sdS|D]G}t|ts|d }|d } t|trt| tsnt|}d|}t|ddpd}|rt|nd}|rd|nd}|||||hvr|| t|ddpdd} t|ddpd}|r|| d<|r|| d<|d} t| trt| | d<t|| t|d} | r| | d<t|ddpd}|r|| d<t!|| | cSdS)Nr&rrHr providerskey_envrrwrrQr' default_model)r'rQrr extra_bodyr` transportcustom_providerszcustom_providers in config.yaml is a dict, not a list. Each entry must be prefixed with '-' in YAML. Run 'hermes doctor' for details. provider_key)r'rQrr)r9rrrr5r6rr rcrritemsr(r/r rbr rdwarningr)rrequested_norm canonicalrrep_namer name_normrresolved_api_keyrQrrr` display_name display_normrr'menu_keyrprovider_key_normprovider_menu_keyrs r._get_named_custom_providerr"js45G5M2NNN t"t!!.*C*CI*N*N!  1.AAIR&&((..00NBBtC    D ]]F ;''I)T""=&'oo//< &< &NGUeT** 7@@I%))Ir228b99??AAG?FNww3399;;;B # O#&uyyB'?'?'E2#F#F#L#L#N#N '96K 6K6K!LLL 99U++^uyy/?/?^599ZCXCX^\^" % &' : :$,NN$4$4#3!&?B!?!? F "'|LL !lLBZLBZBZ%[[[$yy//b599U3C3CbuyyQ[G\G\b`bH&$0(0(8(8'7%*YY%C%C "" &+YY|%<%< %j$77D37 3C3CF<0+E6:::#2599Z3H3H3bEIIVaLbLb#c#c#:19F:./v>>>% zz"455"D)) /   t6v>> t!##%&&  yy  99Z(($$$ Jx,E,E  3D99 (Y((599^R88>B??EEGG MYa;LIII_a=NV9&7999TV )X7HJ[!\ \ \ JJLL ((599Y339r::@@BB   eii 2..4"55;;==  ( 'F9   2%1F> "YY|,, j$ ' ' 4#' #3#3F< E6***"599Z#8#899  *!)F: 7B//5266<<>>  )(F7Ov... 4sA== B  B cH t|duS#t$rYdSwxYw)u~Return True when config defines a custom provider matching the request. Thin public wrapper around :func:`_get_named_custom_provider` so other modules (e.g. the cronjob tool) can decide whether a provider name will actually resolve to a configured ``providers:`` / ``custom_providers:`` entry — without reaching into a private helper or duplicating the scan. NF)r"rL)rs r.has_named_custom_providerr$ s=)*<==TII uus  !!c~t|}|sdS t}n#t$rYdSwxYw|d}t |t r|D]\}}t |t s|dp+|dp|dpd}t||kr!dtt|cS t|}n#t$rd}YnwxYw|pgD]}t |t s|d}t |tr| sWt|d|krdt|cSdS) uDMap an endpoint URL back to its canonical ``custom:`` menu key. Returns the ``custom:`` slug of the first ``providers:`` / ``custom_providers:`` entry whose base_url matches, or ``None`` when no entry owns the URL. Session persistence stores the agent's *resolved* provider, and for every named custom endpoint that is the literal string ``"custom"`` — the entry name is lost, and the api_key is deliberately never persisted. The endpoint URL is the one durable fact that survives the round-trip, so this reverse lookup lets persist/rebuild paths recover the entry identity (and with it key_env/api_key/api_mode resolution via :func:`_get_named_custom_provider`) instead of failing with ``auth_unavailable`` or silently rebuilding with placeholder credentials. NrrwrrQr&rr') _normalize_base_url_for_matchr rLrcrrrr9r(rr5) rQtargetrrrr entry_urlrr's r.find_custom_provider_identityr)s  +8 4 4F t tt ;''I)T""Q'oo// Q QNGUeT**  %  SEIIe$4$4S *8M8MSQS -Y776AAP!@W!N!NPPPPPB :6BB     !'REE%&&  yy  $$$ DJJLL   (:)>)> ? ?6 I ID`` identity for a bare custom provider. The bare string ``"custom"`` is the *resolved billing class* shared by every named ``providers:`` / ``custom_providers:`` entry — it is NOT a routable provider identity (``resolve_runtime_provider("custom")`` falls through to the OpenRouter default URL with no api_key, which surfaces to the user as "No LLM provider configured"). Any code path that persists or restores a session's provider override must run the resolved provider through this helper so a bare ``"custom"`` is upgraded back to its durable ``custom:`` menu key. Two recovery sources, in priority order: 1. ``base_url`` — reverse-lookup the entry that owns the endpoint URL (the one fact that always survives the persistence round-trip when a URL was recorded). 2. ``config_provider`` — the active ``config.model.provider`` (or its ``provider``/``HERMES_INFERENCE_PROVIDER`` equivalent). When the agent was built without a base_url on the override (the recurring Desktop/TUI regression vector), the configured provider is the only durable identity left, so fall back to it when it names a real entry. Returns ``custom:`` when a routable identity is recovered, else ``None`` (caller keeps whatever it had — bare ``"custom"`` only as a last resort, e.g. a genuine ad-hoc endpoint with no config entry). r&rr>rrHrNr) r)r(r5rrcrLosenvironr9r"r)rQr*identityrcandidate_norms r.canonical_custom_identityr0Ksf@0::  OO)r**0022I  -//33J??E2FFLLNNII   III  LJNN#>CCIIKK 4Y??N ^/OOOt %i 0 0 <((33 &%%-^-- - =      4s*AA?? B B%D D DDct|pddS)Nr&rT)r(r5rBr6r8s r.r&r&s: u{   ! ! # # * *3 / / 5 5 7 77r0custom_providerc|d}t|tr|siSdt|iS)Nr)rcrr)r2rs r."_custom_provider_request_overridesr4sF $$\22J j$ ' 'z $z** ++r0explicit_api_keyexplicit_base_urlr6r7c  |pd}|r/|dkr) ddlm}||dkrd}n#t$rYnwxYw|dkr|r|d}t |dd}|rd|d<|St|dpt|d }t|d }|pd|r"td dnd|r"td dndt|g} td | Ddpd} dt|pd|| d|dSt|} | sdS|pdp| ddd}|sdSt |d| d| d}|r| d} | r| |d<t| dtr | d|d<t!| } | r+it#| dpi| |d<| drt#| d|d<|St|dpt|d }t|d }|pdt%| ddpdtt%| ddpdd|r"td dnd|r"td dndt|g} td| Dd} d| dpt|pd|| pdd| d|d}| dr | d|d<t| dtr | d|d<| drt#| d|d<t!| } | r| |d<|S)Nr&rHrrIrTz direct-aliasr openai.comopenai.azure.comrJOPENAI_API_KEYOPENROUTER_API_KEYc38K|]}t||VdSrkr)rncs r.rpz0_resolve_named_custom_runtime..s0 C C1.?.B.B CQ C C C C C Cr0no-key-requiredrarr`rQrrrrQr`r'rrrrequest_overridesr rrc38K|]}t||VdSrkr>rnrs r.rpz0_resolve_named_custom_runtime..s1bb)EVW`EaEabIbbbbbbr0zcustom_provider:rr`rQrr)r5r6rKrrLrBrr#r/rnextr\r"rcrrr4rr()rr6r7rrOrQ pool_result_da_is_openai_url_da_is_openrouterapi_key_candidatesrr2rrB_cp_is_openai_url_cp_is_openrouterrs r._resolve_named_custom_runtimerMs).B5577==??N.H44  M M M M M M  00H<P $"4    11CDDO t  b'')) /   z2 . . fSkk  t0(ODWDWXbDcDctCtGtGHNtOtOPPPK%((11  .#-K o))*=>> D D T/>?R/SK+ ,>OO  0{':;;ArBB0#0K+ ,    / / R+/0P+Q+QK (/,GG~K`aik}K~K~//JJ  R&&(( O   2 . . 4"55;;==O'' 266<"==CCEErJJPPRR7H P!2 & & , , . . .b6G P%r * * 0 0 2 2 2b h'' bb/AbbbdfggG#'' 33 #H - - //V_%8%8AS%T%TVVF7##3)'2w/%%&9::C@@K&56I&J"#?++I"&'G"H"H:?KK8&7"# MsA AAc t}t|dtr|dnd}t|dtr|dnd}d}dD]V}||}t|tr*|r|}nW|pd} |}| r/| dkr) ddlm} | | dkrd} n#t$rYnwxYwtdd} td d} d } |r+|s)| d kr |r|d krd } n| dkrt||rd } |pdp"| p | r|ndp| pt d }t|d}|p(| dko"| p|| ko|| pd d k}|r |tdtdg}n~t|d}t|d}t|d}|| r|nd|rtdnd|s|rtdnd|rtdndt|g}td|Dd}|s|rdnd}| dkrdnd}|dkrA|r?t!||t#|d| dkr|nd}|r|S|dkr|s|sd}||dkrt%||n2t#|dpt'|pd|||dS)NrQr&r)rrwrHrrIr"CUSTOM_BASE_URLFrTrTrJrr<r;z ollama.comr9r:OLLAMA_API_KEYc3zK|]6}t|t|pdV7dS)r&N)rr(r5rDs r.rpz._resolve_openrouter_runtime..sIjj)M^_hMiMijY_"   # # % %jjjjjjr0explicitz env/configr`rr@rarE)rrrcr(r5r6rKrrLr/rPr"rBr#rrFrrbrhr\)rr6r7r]rErF cfg_api_keykvrrOenv_openrouter_base_urlenv_custom_base_urluse_config_base_urlrQ_is_openrouter_url_is_openrouter_contextrJ_is_ollama_url_is_openai_url_is_openai_azurerreffective_providerrGs r._resolve_openrouter_runtimer_s "##I0:9==;T;TVY0Z0Zb9==,,,`bL0:9==;T;TVY0Z0Zb9==,,,`bLK  MM!   a   !'')) ''))K E(.B5577==??N%%''--//L .H44  M M M M M M  00H<>@@  '$5' V # # +<6#9#9&*# x ' ',X ,- - '#'   b''))   $7 ?L   R  #   fSkk  /xII0,& D $ K4K(K D 06B>>sCC C    ( ) ) $ % % 2(LII1(LII1((0J0J,,PT      X%%g%>P%#'  ) )39hGGG Y]]:66 7 7 #H - -    s?E E$#E$)r6r7rc t|pd}t|pdd}t|dpd}d}d}d} i} |dkrt|dpdd}t |dpd}t|d pdpd} |d } t | tr| } t|p|d pd} | r/|d kr) d dlm } | | }n#t$rd}YnwxYw|r|}tddd}|p|p|}|std|d krtjdd|}| dkr|r|}d}d}n d dlm}m}m}n&#t$r}td|d|d}~wwxYwt| dpdp|} ||}||}n/#t&$r"}tt||d}~wwxYw|}d}d}i}|dkr=t| dpd}|r||d<d|||||||dS|}|s' d dlm}|dpd}n#t$rd}YnwxYw|s"tdd}|std|s|rdnd}d|||d||d S)!aResolve an Azure Foundry runtime entry. Reads ``model.base_url`` + ``model.api_mode`` from config.yaml (or explicit overrides), pulls the API key from ``.env`` / env var, and strips a trailing ``/v1`` for Anthropic-style endpoints because the Anthropic SDK appends ``/v1/messages`` internally. When ``model.auth_mode == "entra_id"`` (and the model is OpenAI-style), the returned ``api_key`` is a zero-arg callable produced by :func:`agent.azure_identity_adapter.build_token_provider` rather than a string. Downstream code that constructs an OpenAI SDK client passes this through unchanged (the SDK accepts ``Callable[[], str]`` for ``api_key`` and calls it before every request). Code paths that need a string (logging, manual HTTP probes, header injection) must use the helpers in ``agent.azure_identity_adapter``. Raises :class:`AuthError` when required values are missing. r&rTrrarrrQr` auth_modeentrar)rWrrNAZURE_FOUNDRY_BASE_URLzpAzure Foundry requires a base URL. Set it via 'hermes model' or the AZURE_FOUNDRY_BASE_URL environment variable.rentra_idrR)EntraIdentityConfigSCOPE_AI_AZURE_DEFAULTbuild_token_providerzAzure Foundry Entra ID auth requires the 'azure-identity' package. Install it with: pip install azure-identity (import failed: )scope)ri)r)rr`rQrrarbrr) get_env_valueAZURE_FOUNDRY_API_KEYaAzure Foundry requires an API key. Set AZURE_FOUNDRY_API_KEY in ~/.hermes/.env or run 'hermes model' to configure. To use keyless Microsoft Entra ID auth instead, set model.auth_mode: entra_id in config.yaml (or pick 'Microsoft Entra ID' in 'hermes model').r)rr`rQrrarr)r(r5rBrcr6rbrrrrrLr/rrragent.azure_identity_adapterrerfrg ImportErrorhermes_cli.configrj)rr]r6r7rexplicit_base_url_cleanrFrE cfg_api_mode cfg_auth_mode cfg_entra_entrarrr env_base_urlrQrrrarerfrgrri entra_configtoken_provider clean_entraconfigured_scoperjs r._resolve_azure_foundry_runtimerys14+1r2288::!"3"9r::@@BBII#NNy}}Z006B77==??EEGGLL%LM "I&&9==44:;;AACCJJ3OO &y}}Z'@'@AAWEW IMM+66C)DDJJLLRRTTaXa w'' fd # # I,H)-- *B*BHbIIOOQQO$<+???  F F F F F F33ODDHH   HHH   $#L3R88>>@@GGLLL&F,F,H   ?   +++6)R22  "" ! #,GF!II     .'*...  IMM'**0b117799*)  322    "6!5\!J!J!J 3 3 3C))s2 3$GF"I  " ""9==#9#9#?R@@FFHH  8'7 G$($ " "4   G   7 7 7 7 7 7#m$;<<BGG   GGG  ?1266<<>>   7   - P0A PZZF# 0  sTG&& G54G55 J J# JJ#K88 L$LL$N N%$N%c  t|pd}t|pdd}|s|sdS|dkrt|dpd}d}|dkrZt|dpdd}t |sd}|p|pd}|}|s!ddlm} | }|std dd ||d |d S|d kr|pt}|}d} |sft} | dd}| d} |s+| dddp|}d d||d | |dS|dkrtj dpi} |p`tpRt| dp tjd}|pct| t!dt#ddr6t| dpdnd}| dp| d} |st%t't)dd} | dd}| d} |s+| dddp|}dd||d | |dS|dkrt+|||| St-j|}|re|jdkrYd}|jr:t)|jdd}|}|sF|d!vr9t3|} | ddd}n |p|j}|}|sPt3|} | dd}|s)| ddd}d}|d"krt7||}nC|d#krd}n:t9|d$}|r|}nt;|}|r|}|||d|d |d SdS)%Nr&rTrrrQrrresolve_anthropic_tokenNo Anthropic credentials found. Set ANTHROPIC_TOKEN or ANTHROPIC_API_KEY, run 'claude setup-token', or authenticate with 'claude /login'.rWrRrArr last_refreshrUrr`rQrrr~rrr<HERMES_NOUS_MIN_KEY_TTL_SECONDS agent_keyagent_key_expires_at expires_atHERMES_NOUS_TIMEOUT_SECONDS15timeout_secondsrarr`rQrrrrr)rr]r6r7> kimi-codingkimi-coding-cnrrr`)r(r5rBrcr6ragent.anthropic_adapterr|rrrrget_provider_auth_staterDEFAULT_NOUS_INFERENCE_URLrmaxr%rfloatr/ryr auth_typebase_url_env_varrrrrbr\)rrr]r6r7rFrErQrr|r~credsstaterrenv_urlr`rfrs r._resolve_explicit_runtimerPs+1r2288::-344::<<CCCHH $5t;9==44:;;AACCIIKK  ; & &y}}Z88>B??EEGGNNsSSL2<@@ "! $S S8S"  G G G G G G--//G V $,  "4    >!!$>(>"  M577Eii 2..G 99^44L$ M 99Z44;;C@@LH&)  ("4   6088>B  o022 o599122Yh6YZZ``bbiijmnn # #B A4HHII C +&&," - - 3 3 5 5 5  YY566Q%))L:Q:Q  M4 %g.KT&R&R S SEii 2..G<00J$ M 99Z44;;C@@LH*  $"4   ?""-1-/      #H--G+ 7$ 11  # Pg6;;AACCJJ3OOG$ A<<<krt4!d?YnwxYw|d@kr tE}d@dA| ddd | d9d| d:dB| dC|dDS#t$r$|d>krt4!dEYnwxYw|dFkr tG}dFdA| dpdd ptH| d9d| d:dB| dC|dDS#t$r$|d>krt4!dGYnwxYw|dHkr tK}dHd| ddd | d9d| d:dI| dJ|dKS#t$r$|d>krt4!dLYnwxYw|dMkrZtMj |}|rD|j'dNkr9ddOl(m)} | }|d |d|d9| d:dP|dS|dQkrtU|}dQd| ddd | d9d| dRdtW| dSpg| d:dT|dUS|dkrt| dpd } d:| dkrM| dpdd :tY:sd::pdV} d| vp:od: v}!|!rd} dWD]`}"t| |"pd}#|#r&t|#d} | rna| s6t| d9pd} | sDtd dp!td d} | stdXn!ddYl-m.}$|$} | stdZdd | | d[|dS|d\krdd]l/m0}%m1}&m2}'m3}(|d^v})|)s|%std_d`ati d\i}*|* dbpdp |'}+|&pdc},|* ddi}-d%}.|- derf|- dfrQ|-de|-dfdg}.|- dhr |-dh|.di<|- djr |-dj|.dj<t|p| dkpd}/t#tjj6 dld}0|(|/r|0sd\d dm|+dndo|,|+d#|dp}nd\dqdm|+dndo|,|+|dr}|.r|.|ds<|StMj |}|r|j'd9kr}to|}tq| d9s}6|p| dkd}7|6||7}3n(|5rt||4r|5}3nt| }8|8r|8}3|d~vrddl=mA}9|9||3| } |dkrtjC| } ||3| | d9d| d:d[|dSt|||}||d<|S)a)Resolve runtime provider credentials for agent execution. target_model: Optional override for model_cfg.get("default") when computing provider-specific api_mode (e.g. OpenCode Zen/Go where different models route through different API surfaces). Callers performing an explicit mid-session model switch should pass the new model here so api_mode is derived from the model they are switching TO, not the stale persisted default. Other callers can leave it None to preserve existing behavior (api_mode derived from config). moaraz moa://localzmoa-virtual-providerrAr&rz azure.comAZURE_ANTHROPIC_KEYANTHROPIC_API_KEYrWrTzazure-explicitr)rr]r6r7r)vertexz google-vertexz vertex-aiz gcp-vertexvertexair)get_vertex_configaVertex AI credentials could not be resolved. Vertex uses OAuth2 (not a static API key): provide a service-account JSON via GOOGLE_APPLICATION_CREDENTIALS (or VERTEX_CREDENTIALS_PATH) in ~/.hermes/.env, or run 'gcloud auth application-default login' for ADC. Set the GCP project/region under vertex: in config.yaml if they aren't embedded in the credentials. Install the extra with: pip install 'hermes-agent[vertex]'.rz vertex-oauth)rr6r7rrrQ)rr&)rJz anthropic.comr9c38K|]}t|VdSrk)r#)rnr:rEs r.rpz+resolve_runtime_provider..nsA&lD99r0r5)rrr]r6r7rOPENAI_BASE_URLr">rrHT>rrNrrrrrrrrri)rrrizINous pool entry agent_key expired/missing, refreshing selected pool entryz"Nous pool entry refresh failed: %szRNous pool entry agent_key still unavailable, falling through to runtime resolutionr)rQ)rrrr]rrrrrrrportalrrrzUAuto-detected Nous provider but credentials failed; falling through to next provider.rrUzhermes-auth-storer~rzVAuto-detected Codex provider but credentials failed; falling through to next provider.rzZAuto-detected xAI OAuth provider but credentials failed; falling through to next provider.rzqwen-cli expires_at_ms)rr`rQrrrrz@Qwen OAuth credentials failed; falling through to next provider.r oauth_minimax))resolve_minimax_oauth_runtime_credentialsoauthz copilot-acpcommandargsprocess)rr`rQrrrrrr)r api_key_envzNo Azure Anthropic API key found. Set AZURE_ANTHROPIC_KEY or ANTHROPIC_API_KEY, or point key_env/api_key_env in your config.yaml model section at a custom env var.r{r}envbedrock)has_aws_credentialsresolve_aws_auth_env_varresolve_bedrock_regionis_anthropic_bedrock_model> aws-bedrockamazon-bedrockawsamazonrzNo AWS credentials found for Bedrock. Configure one of: - AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - AWS_PROFILE (for SSO / named profiles) - IAM instance role (EC2, ECS, Lambda) Or run 'aws configure' to set up credentials.no_aws_credentials)coderegionzaws-sdk-default-chain guardrailguardrail_identifierguardrail_version)guardrailIdentifierguardrailVersionstream_processing_modestreamProcessingModetracer)AWS_BEARER_TOKEN_BEDROCKzhttps://bedrock-runtime.z.amazonaws.comzaws-sdk)rr`rQrrrbedrock_anthropicrr)rr`rQrrrrguardrail_configz, z Set r=z*No usable credentials found for provider 'z'.missing_api_key)rrrrr`rrrr)Drr5r/rBryragent.vertex_adapterrrrMr(rcr6rr_rrr;r rLrrrrr%rrdrtry_refresh_currentr rrrrerrrrrrrKrrlistrrr|agent.bedrock_adapterrrrrr r,r-rrrapi_key_env_varsrrbrrrr\rrr);rr6r7rr _eff_base _azure_key azure_runtimertokenrQcustom_runtimer]rF_known_cloud_hostsrrexplicit_runtimeshould_use_poolenv_openai_base_urlrVhas_custom_endpointhas_runtime_overriderrrmin_ttl nous_state refreshedrrrr_is_azure_endpointhint_keyenv_varr|rrrr is_explicit _bedrock_cfgr auth_source_grr_current_model_has_bearer_token env_nameshintr`rrfr _effectiverrrEs; @r.resolve_runtime_providerrs"4I>>U""*%-,"4    #(b//11I[(([I-E-E  # * * , , 8,b117799 8*B//5577  $,!((--!&"4    _,,61'))-/%    ___::::::++--x H N !* ,,$"4    3-)+N /A+, %5%'' 9==44:;;AACCIIKK 9==44:;;AACC  LL88"  . 6'9%5&7 1C,-)+H "##I0-)+  ,.O<9==44:;;AACCIIKK 9==44:;;AACC %&7<<BBDD")*?"D"D"J"J"L"L"  '" '&    'L,>>>"& #$4$I8IJJ "8 8 )'' )((  &5?y"""4  >$$&&>   0$7765."55  v  %"3"g&GNNOOG$UK>>(/7Mt(T(T 66J ( G<< & hiii% $ 8 8 : :II %%%LL!EsKKK $IIIIII%(%E'8$??>"5."==! &-UK%F%F07?UW[0\0\!(!>!>""J $&+? G+T+T&LL!uvvv#%L   0E#5t<<uj$77  4!#5#)  6 =4 %g.KT&R&R S SE#.!IIj"55<!! =577E*-!IIj"55<#>)HNN,<,<<  @[L,>,>,@,@@  % E6  immH55;<<BBDD#GR006688E DIMM)44:;;AACC 1266<<>>@2B77==?? E  H G G G G G++--E V $, "4    9            ),ii  #6#6#8#8 @ *  #}}((B77 ""8,,299;;W?U?U?W?W..00K4K {B// 77) * * 9sww7J/K/K 9'*+A'B$'(;$<   ww/00 Y;>?W;X !78www 9,/L )\KY]]9-E-EKLLRRTT 0JB!O!O!U!U!W!WXX % %n 5 5 >O &0MvMMM$% %)&8  GG&.MvMMM$% &8G  ;*:G& ' #H--GD 7$ 114X>>!9!5!566  '":;;I+4<'9''''"DOXOOOO!& 9==44:;;AACCIIKK  8 # #%MM*55;BBDDKKCPPLH599Z#<#<#C#CC#H#H% y 0EIIiQSrsyMM"""""" !!!!!!&&&&&&&&&&  8 $ $''''''988888$ 100000CCCCCCCCCC / / / / /3333==== 5555<&&&&RBBBB,61616161r""""J.,88888"""""$   0000>+/%)"&LLLLLL^,(,#' @    0000]]]]@    0000j#%)<<<<<<~8888,,,,'+'+ AAAAAAN'+'+ KKKKKKd'+'+"& ffffff\'+'+ XXXXXXz $&*'+"& @ @ @ @ @ @ Fr0