߲j.UdZddlmZddlZddlmZmZmZeje Z e hdZ dZ eZded<dd Zdd Zdd Zdd Zdd ZddZddZddZd dZd!dZd"dZd#dZd$dZd%dZd&dZd'dZ y)(uModel-provider plugins as first-class citizens of ``hermes auth`` and the credential pool. A ``plugins/model-providers//`` profile (``providers.base.ProviderProfile``) is mirrored into ``hermes_cli.auth.PROVIDER_REGISTRY`` with the ``auth_type`` it declares, so ``resolve_provider()`` accepts it whatever its auth shape. Non-api-key plugins own their login through two optional profile callables that core consults BEFORE any built-in, name-keyed path: - ``auth_handler(action, args) -> bool`` for ``hermes auth add|status|logout|refresh `` (``args`` is the parsed CLI namespace; truthy = the plugin owned the action, falsy = built-in path). - ``refresh_credential(entry) -> Mapping | None`` for the credential pool: given the pooled ``PooledCredential`` it returns the rotated fields (``access_token``, ``refresh_token``, ``expires_at_ms`` …) or raises. A separate hook rather than ``auth_handler("refresh", …)`` because the pool has a credential row, not an argparse namespace, and needs tokens back, not a bool. Every function here late-imports ``hermes_cli.auth`` names: this module is imported by the auth facade right after ``PROVIDER_REGISTRY`` exists, and by ``agent.credential_pool``. ) annotationsN)AnyCallableOptional> kimi-codingkimi-coding-cnzaicustomcopilot openrouter)addstatuslogoutrefreshzset[str]PLUGIN_MIRRORED_PROVIDERScdtfd|jDxs |jtfd|jDdxsdfS)zXSplit a profile's ``env_vars`` into (api-key vars, base-URL var); the URL var may be "".cJ|jdxs|jdS)N _BASE_URL_URL)endswith)vs E/home/ubuntu/.hermes/hermes-agent/hermes_cli/auth_plugin_providers.pyz%_api_key_env_fields..(sqzz+.D!**V2Dc34K|]}|r |ywN.0ris_urls r z&_api_key_env_fields..)s:q !: c34K|]}|s |ywrrrs rr!z&_api_key_env_fields..*s6F1I!6r"N)tupleenv_varsnext)ppr s @r_api_key_env_fieldsr)&sH DF :R[[: : Ibkk 6R[[6 = C EErcddlm}m}m}|jt vry|j dk(rN|jsy||j|jxs |j|jgt|}nB||j|jxs |j|j |j}|||j<tj|jt||y)aMirror one profile into ``PROVIDER_REGISTRY`` under the ``auth_type`` it declares. Registering is what lets an out-of-tree provider pass ``resolve_provider()``'s known-provider gate ("Unknown provider"); OAuth-shaped plugins carry their own login via ``auth_handler``. r)PROVIDER_REGISTRYProviderConfig_api_key_providerNapi_key)inference_base_url)hermes_cli.authr+r,r-name_REGISTRY_PLUGIN_SKIP auth_typer& display_namebase_urlr)rr mirror_aliases)r(r+r,r-pconfigs rregister_plugin_providerr8-s UT ww'' ||y {{ #BGGR__-GoWjkmWno "//*DRWWbllgigrgrs!(bgg!!"''*7Brc ddlm}m}||}|duxr0|j|jk(xr||jdk(S#t$rYywxYw)zZTrue when *alias* resolves to the ``$HERMES_HOME`` plugin *pp* in the ``providers`` layer.r)get_provider_profileprovider_sourceFNuser) providersr:r; Exceptionr1)r(aliasr:r;owners r_user_owns_aliasrABs[C ! 'E   ]rww!6 ]?277;SW];]] sA AAc^ddlm}|jD]}||vs t||s|||<y)uPoint ``pp.aliases`` at *pconfig* so ``resolve_provider()`` resolves them too. A bundled plugin never steals an alias another row already holds; a ``$HERMES_HOME`` plugin whose alias the ``providers`` layer already resolves to it does — the same ownership rule as :func:`override_registry_row`, otherwise the alias kept resolving to the built-in row while ``providers.get_provider_profile`` followed the user's profile (#116668). rr+N)r0r+aliasesrA)r7r(r+r?s rr6r6Ls82/ ) )-=b%-H'. e $/rc|jr|j|_|jr|j|_|jdcxk(r|jk(r.ny|j rt |\|_}|r||_yyyy)uA ``$HERMES_HOME`` plugin re-registering a name that already has a row wins for the fields it declares — ``display_name``, ``base_url`` and, on api-key rows, ``env_vars`` (#48450, #116668). ``register_provider()`` is last-writer-wins for the profile; without this the runtime kept reading the built-in endpoint. In place, so alias rows sharing the object follow; idempotent, so re-sync is free. r.N) r4r1r5r/r3r&r)api_key_env_varsbase_url_env_var)r7r(url_vars roverride_registry_rowrI[sq    {{%'[[" ||y5G$5$55"++,?,C) ' '.G $ ;F5rcddlm}m} ddlm}m}|}d}|D]}|j|vr~|j|vxs|jtv}|rY|jtvrG||jdk(r2t||j|t||j|t|||j|vz }|S#t $rYywxYw)uMirror provider-plugin profiles into ``PROVIDER_REGISTRY``; return how many were added. Idempotent (existing entries are never replaced — a user plugin re-registering a bundled name only rewrites the fields it declares, see :func:`override_registry_row`), so it is safe from resolution paths. It runs at auth import and again whenever a name is missing (:func:`registry_lookup`) or when ``providers`` finishes discovery, because the import-time pass can observe a *partial* profile list: a plugin whose own imports pull ``hermes_cli.auth`` in mid-``_discover_providers()`` sees only what was registered so far, and every later plugin would otherwise fail with "Unknown provider" (#102123). r)BUILTIN_PROVIDER_IDSr+)list_providersr;r<) r0rKr+r=rLr;r>r1rr2rIr6r8)rKr+rLr;profilesaddedr(core_rows rsync_plugin_provider_registryrPksH=!# E . 77' 'ww"66^"''E^:^HBGG+@@_UWU\U\E]agEg%&7&@"E092>  $ --- . L sC CCcnddlm}|j|}|tr|j|}|S)zB``PROVIDER_REGISTRY.get`` that re-syncs plugin profiles on a miss.rrC)r0r+getrP) provider_idr+r7s rregistry_lookuprTs51##K0G8:#'' 4 Nrc> ddlm}||S#t$rYywxYw)z`The registered ``ProviderProfile`` for *provider*, or None (also when the layer is unavailable).r)r:N)r=r:r>)providerr:s rplugin_profilerWs+2  )) s  cLtt||d}t|r|SdSr)getattrrWcallable)rVr1hooks r _profile_hookr\s& >(+T4 8DD>4+t+rct|dS)N auth_handlerr\rVs rplugin_auth_handlerras > 22rct|dS)z^The profile's ``refresh_credential`` hook, i.e. whether its pooled OAuth rows are refreshable.refresh_credentialr_r`s rplugin_refresh_hookrds #7 88rc4ddlm}||vxs t|duS)zMBuilt-in refreshable set OR a plugin profile shipping ``refresh_credential``.r)REFRESHABLE_OAUTH_PROVIDERSN)agent.credential_poolrfrd)rVrfs ris_refreshable_oauth_providerrhs"A 2 2 _6I(6S[_6__rc t|}|y t|||S#t$rt$r/}t|d|dt |j d||d}~wwxYw)a Offer ``hermes auth `` to the provider's ``auth_handler``. True = the plugin owned the action (core prints nothing more). False = run the built-in path. A handler exception becomes a readable ``SystemExit`` naming provider and action. NFz auth handler failed for `z`: z: )rabool SystemExitr>type__name__)actionargsrVhandlerexcs rdispatch_plugin_authrrs "(+GqGFD)**  qH:%?xs4PS9K]K]J^^`ad`efgmppqs"A#*AA#c |tvryt|}||jdk(s t|yt d|d|jd|d|d S)aFail loud for a registered non-api-key plugin that ships no ``auth_handler``. Its login is not something core can perform (there is no token endpoint to call), and silently running the api-key prompt or reporting "Unknown provider" both hide the plugin bug. Nr.z Provider 'z' declares auth_type 'z8' but its plugin ships no auth_handler, so `hermes auth  zf` cannot be handled. Add `auth_handler=` to its ProviderProfile (see the model-provider plugin guide).)rrWr3rark)rVrnprofiles r!plugin_missing_auth_handler_errorrvs| 00X&G'++y8.sOAJJ!**Os%%zRun `hermes auth add z ` to sign in.) configuredrVr needs_refreshaccountsr5hint) rrgrentries access_token agent_keystriprrd refresh_tokenrjlenr')rSrrrlive refreshables rget_plugin_oauth_auth_statusrs33U##/#K088:lQq~~?bQRQ\Q\?b`b>i>i>kqlGl =!&9!&rs"#**   8 $ ""mn< '*e8+E *^ / / B*, 39 `q"Y" Tr