߲jfUdZddlZddlZddlmZmZmZmZmZm Z ddl m Z ddl m Z ejdZeZeed<ded ed ed ed df d Zdddddddddddddd ZehdZehdZded efdZded efdZded efdZdeded e eeeeefffdZdddddd d!d"d#d$ Zeeefed%<hd&Zd'eeefded efd(Z d)ed e eeefe!ffd*Z"d+d,d'eded eeeeffd-Z#d+d,d'eded eeeeffd.Z$d/ed eeeeffd0Z% dGd1eeeefd eeeeffd2Z&ded3eeeeefd1eeeeffd4Z' dHded3eeeeefd1eeeefd efd5Z(d'eeefd6ed eeeeffd7Z)d6eded3eeeeefd1eeeefd eeeeff d8Z*ded ee!fd9Z+ dHded3eeeeefd1eeeefd eeeffd:Z, dHd;eeefded3eeeeefd1eeeefd df d<Z-d=ed eeeffd>Z. dHded3eeeeefd1eeeefd eeeffd?Z/ dHd;eeefded3eeeeefd1eeeefd df d@Z0 dHded3eeeeefd1eeeefd efdAZ1 dHd6eded3eeeeefd1eeeefd ee2f dBZ3 dHd6ededCed3eeeeefd1eeeefd ee!f dDZ4dEeeeefd e!fdFZ5y)IaCustom-provider entry normalization and per-route lookups (TLS, headers, context length, capabilities). Split out of ``hermes_cli/config.py``; every name is re-imported there, so ``hermes_cli.config.`` keeps resolving (and monkeypatching) as before. Functions that call ``get_compatible_custom_providers`` / ``load_config*`` import them lazily from ``hermes_cli.config`` so tests patching that module still intercept the call. N)AnyDictIteratorListOptionalTuple)urlparse)normalize_route_base_urlzhermes_cli.config_PROVIDER_NORMALIZE_WARNED provider_key signaturemsgargsreturnc||xsd|f}|tvrytj|tj|g|y)zKEmit ``logger.warning(msg, *args)`` at most once per (provider, signature).?N)r addloggerwarning)r r rr dedup_keys @/home/ubuntu/.hermes/hermes-agent/hermes_cli/config_providers.py_warn_once_per_providerrs<$i0I..""9- NN3chat_completionscodex_responsesanthropic_messagesbedrock_converse) openai openai_chatz openai-chatzchat-completionschatcompletions responsesopenai_responseszopenai-responses anthropiczanthropic-messagesmessagesbedrockzbedrock-converse>0noofffalse>1onyestrueapi_modecj|j}tj|j|S)zUMap alias ``api_mode`` spellings to canonical transport names (unknown pass through).)strip_API_MODE_ALIASESgetlower)r.cleaneds r_canonical_api_moder5<s'nnG  ' ::rvaluec:|yt|jS)z%Provider identity fields are strings.)strr0)r6s rcoerce_provider_idr:Bs } u:   r providersct|tsiSi}|jD]\}}t|}|s|||<|S)zYCopy a ``providers:`` mapping so keys are strings (unquoted YAML ``2070:`` loads as int).) isinstancedictitemsr:)r;outstoredr6keys rstringify_provider_maprCIsM i & C"*  ( CH JrrBct|tsyt|}|sy|j|}t|tr||fS|j D]*\}}t||k(st|ts&||fcSy)zXReturn ``(stored_key, entry)`` matching *key* by string identity (exact hit, then scan).NN)r=r>r:r2r?)r;rBwantexactrAentrys rfind_provider_entryrIUs i & c "D  MM$ E%U{"*!  f % -*UD2I5= ! rapi_keybase_urlkey_env default_modelcontext_lengthrate_limit_delaysession_affinity_header) apiKeybaseUrlapiModekeyEnv apiKeyEnv defaultModel contextLengthrateLimitDelaysessionAffinityHeader_CAMEL_ALIASES>apiurlnamemodelmodelsrJkey_cmdrLr.rKprovider transport extra_body ssl_verify api_key_env ssl_ca_cert capabilitiesrM extra_headersrNdiscover_modelscatalog_providerrOmodels_discoveredstale_timeout_secondsrequest_timeout_secondsrPrHcPdD]}|j|}t|tr|js5|j}t j d|r|cSt |}|jr|jr|cStjd|xsd||y)zFirst usable URL among ``base_url``/``url``/``api``, or "". URLs with unresolved ``${ENV_VAR}`` / ``{region}`` placeholders are accepted unvalidated: they expand at runtime, and rejecting them here would silently drop the provider. )rKr\r[z \{[^}]+\}uPproviders.%s: '%s' value '%s' is not a valid URL (no scheme or host) — skippedrr8) r2r=r9r0researchr schemenetlocrr)rHr url_keyraw_url candidateparseds r_pick_provider_base_urlrw}s .5))G$7C(W]]_ MMO 99\9 - )$ ==V]]  .  C) 55$ rr_cd}t|tr9|r7t|}|jdddurd}|jdd||fSt|tr|ri}|D]}t|tr$|j ri||j <7t|tsH|j d}t|tr|j s|j d}t|tr|j s|jDcic] \}}|dvs ||c}}||j <||fSi|fScc}}w) a Normalize an entry's ``models`` to ``(models_dict, discovered_flag)``. The legacy in-mapping ``__discovered_model_catalog__`` sentinel is accepted and stripped; a plain list of ids or ``[{id: ...}]`` rows is converted so /model doesn't show (0) models. F__discovered_model_catalog__NT__explicit_model_allowlist__idr]>r{r])r=r>poplistr9r0r2r?)r_ discovered models_copynormalized_modelsitemmodel_idkvs r_normalize_provider_modelsrsC J&$F6l ??94 @D HJ6=J&&&$F,. JD$$24!$**,/dD)xx~Hh,HNN4D88F+h,HNN4D!%3JA.1H13J hnn. / J!*,, z>3Js E-Er8r c bttsytt|}dvr dvrdd<tj D].\}}|vs |vst |d|d|xsd||||<0t jtz t tjz }|rFt |ddjt|zd |xsdd jt|t|}tjd xs|}|r|sy||d |r|d <dtdtffd }dtdtddffd }|d|d|d|d|dd} |d| | r'jdrjds| d<|dd} |d| r t| nd|d|dd|d|dt!jd\} } |d| jddus| rdd<jd} t| trK|d| j Dcic](\}}t|trt|t"r||*c}}d d!fd"d#fd$d%ffD]%\}}|j|s||<'tjd&trtd&d&<|d't%jd'|d(|d(|d)|d)jd*}t|t"r|d*<St|tr#|j'r|j'd*<Scc}}w)+z>Return a runtime-compatible custom provider entry or ``None``.NrerLzcamel:z[providers.%s: camelCase key '%s' auto-mapped to '%s' (use snake_case to avoid this warning)rzunknown:,z-providers.%s: unknown config keys ignored: %sz, r])r]rKr keysrcd}|D]}j|}|snt|tr|jSdSNr8)r2r=r9r0)rvalrrHs r _strippedz3_normalize_custom_provider_entry.._strippedsF A))A,C )c2syy{::rfieldr6c|r||<yyN)rr6 normalizeds r_putz._normalize_custom_provider_entry.._puts  %Ju  rrJr`r.rbr8r^rMrjr_rkTrgrNc0t|txr|dkDSNr)r=intrs rz2_normalize_custom_provider_entry..sZ3%7%AAErrOc<t|ttfxr|dk\Sr)r=rfloatrs rrz2_normalize_custom_provider_entry..sz!c5\'B'MqAvrric.t|ttfSr)r=boolr9rs rrz2_normalize_custom_provider_entry..sjT3K&@rrcrhrPrfrd)r=r>r:rZr?rsetr_KNOWN_PROVIDER_KEYSjoinsortedrwr2r9rr5rrnormalize_extra_headersr0)rHr camelsnakeunknownrKr]rrrLr. models_dictr~rgrBr6rokrdrs` @r _normalize_custom_provider_entryrs eT " KE%l3L)5"8 /i&,,.( u E>e50 #ug.9#UE  3 !";;;&C&&& Ii()Ii() =1GG599]+EIIi4H$+ =![1Hh(2BG)G_56 Y'9:;989LMK; yy$%-*. &'99^,L,% ^)5););)=A%3#s# 5$(? JA B AB MN @A- r eii  %e Ju  -%))L)40#'l(;#< <  1%))O2LMN "I.G$HI -01<(J*d##- <   J $)9)9);#-#3#3#5 < 3As4-N+ ct||}|yd|di}dD]}||vs||||<d|vr|d|d<d|vr|d|d <|S) zDTranslate a legacy custom provider entry to the v12 providers shape.rNr[rK)r]rJrLr`r_rkrNrOrircrhrPrfrdrjr^rMr.rb)r)rHr rprovider_entryrs r)_custom_provider_entry_to_provider_configrs2%lSJ&+Z -C%DNT6 J $.u$5N5 ! 6 **4W*='Z&0&<{# rproviders_dictct|tsgSg}|jD]K\}}t|tr t|s"t |t |}|;|j |M|S)zUNormalize enabled ``providers`` config entries into the legacy custom-provider shape.r)r=r>r?is_provider_enabledrr:append)rcustom_providersrBrHrs r"providers_dict_to_custom_providersr/sw nd + -/$**,0 U eT "+>u+E 5eJ\]`Jab  !  # #J / 0 rconfigc(ddlm}||}|jd}|;t|ts+t j dt|jg}|xsgDcgc] }t|}}|t|jdz }dtttfdtdtfd }g}t}t}|D]} | || d } || d } t| jd d xsd jj!dj#} | | || df} | r| |vru| r| r| |vr~|j%| | r|j'| | s| s|j'| |Scc}w)zDeduplicated list view over legacy ``custom_providers`` and v12+ ``providers``. Never materialised back into config.yaml (it would duplicate entries in UIs). r) load_configrucustom_providers is a %s, expected a list — skipping legacy entries; 'providers:' entries are still used. Move provider configs to the 'providers:' section.r;rHrrcxt|j|dxsdjjSr)r9r2r0r3)rHrs r_normz.get_compatible_custom_providers.._normTs/599UB'-2.446<<>>rr r]rKr8/r^)hermes_cli.configrr2r=r}rrtype__name__rrrr9rrr0rstripr3rr)rrre candidatesr compatibleseen_provider_keysseen_name_url_pairsrHr r]rKpairs rget_compatible_custom_providersr=s . ~zz"45#J7G,N  f ! " + + -@P@VTVX!215XJX4VZZ 5LMMJ?T#s(^?C?C?(*J!e"u* = UN3 UF#uyyR06B7==?FFsKQQSheW 56 L,>>  H)r2)rKrrr target_urlrH entry_urls r_entries_for_routermsB ">vF  :&6=)(3J !%& ,UYYz-BC j0K  "!  "s4 BA5AB(B.B5 BBBBct|||D]J}dD]C}|j|}t|ts%|j s6t |ccSLy)aNCanonical ``api_mode`` of the first custom entry serving *base_url*, or ``""``. Route identity is the URL, not the host: a Codex proxy on ``127.0.0.1`` declares its wire protocol here and nowhere else, so metadata lookups keyed on the transport read it from the entry instead of guessing from the hostname (#116191). )r.rbr8)rr2r=r9r0r5)rKrrrHrr6s rget_custom_provider_api_moders\$H.>G2. 2EIIe$E%%%++-*511 22 rr^c|jd}t|tsy|j|}t|tr|SdS)zAReturn ``entry.models[model]`` when both are mappings, else None.r_N)r2r=r>)rHr^r_ model_cfgs r_route_model_cfgrs? YYx F fd # 5!I"9d39==rc#VKt|||D]}t||}||yw)zHYield the ``models.`` mapping of every entry matching *base_url*.N)rr)r^rKrrrHrs r_route_model_cfgsrs8 $H.>G$UE2  Os))c|yt|tr|St|tr4|jj }|t vrdS|t vrdSdSy)NFT)r=rr9r0r3 _FALSE_WORDS _TRUE_WORDS)r6lowereds r_coerce_ssl_verifyrsY }% %++-%%'</u]W =ST]Y]] rct|||D]l}i}|jd}t|tr#|j r|j |d<t |jd}|||d<|cSiS)zOReturn TLS settings from a matching ``custom_providers`` / ``providers`` entry.rfrd)rr2r=r9r0r)rKrrrHr@caverifys r get_custom_provider_tls_settingsrs $H.>G  YY} % b# 288:!#C #EIIl$;<   &C   Ir client_kwargscjt|||}|jdr|d|d<d|vr |d|d<yy)zCAttach per-provider TLS knobs to OpenAI client kwargs when matched.rfrdN)rr2)rrKrrtlss r*apply_custom_provider_tls_to_client_kwargsrsJ +85Ev NC ww}'*='9 m$s&),&7 l#rrhct|tr|siS|jDcic]\}}| t|t|c}}Scc}}w)zNormalize a raw ``extra_headers`` value into a ``dict[str, str]``. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Callers must never log the returned values. )r=r>r?r9)rhrrs rrrsF mT *- '4':':'< Ntq! CFCFN NN Ns AAcjt|||D]"}t|jd}|s |cSiS)u``extra_headers`` of the first route-matching entry declaring any, else ``{}``. SECURITY: values may carry credentials — callers must never log them.rh)rrr2)rKrrrHheaderss r!get_custom_provider_extra_headersrs? $H.>G)%))O*DE N Irct|||}|syt|jdxsi}|j|||d<y)zMerge per-provider ``extra_headers`` onto OpenAI client ``default_headers`` (provider wins over SDK defaults, most specific level). SECURITY: values may carry credentials; never log.Ndefault_headers)rr>r2update)rrKrrrhmergeds r4apply_custom_provider_extra_headers_to_client_kwargsrsL6h@PRXYM  -##$56<" =F MM- '-M#$rct|||D]F}|jd}t|ts%|j s6|j cSy)zHeader NAME declared as ``session_affinity_header`` on the route-matching entry, else "". Opt-in per provider (default off): Hermes never ships a session identifier to an endpoint that did not ask for one (#86241). rPr8)rr2r=r9r0)rKrrrHheaders r+get_custom_provider_session_affinity_headerrsO$H.>G"45 fc "v||~<<> !" rcddlm}m}|r|sy| |||n|}dtdttfd}t||||D]}||j d} | | cSt|||D]} || j d} | | cSy#t$r,|Yy|j d}t |t r|ng}YwxYw) aPer-model ``context_length`` override from a route-matching entry, or ``None``. Before this helper existed, the lookup was duplicated in ``run_agent.py``'s startup path only; every other path (notably ``/model`` switch) fell back to the 128K default. See #15779. rrload_config_readonlyNrrawrcV t|}|dkDr|SdS#ttf$rYywxYwr)r TypeError ValueError)rctxs r _positive_intz9get_custom_provider_context_length.._positive_int(s< c(CAgs'4':&  s ((rN) rrrrr2r=r}rrrrr) r^rKrrrrrrrrrHs r"get_custom_provider_context_lengthrsX  D ?Y_Yg?S?Umst (3(8C=('uh8H&Q IMM*:;< ?J$H.>GEII&678 ?J 1 D~**/0C&0d&;s   DsB C&%C C capabilitycddlm}m}|r|r|sy| ||}||}t ||||D]'}|j |}t |ts%|cSy#t$rYywxYw)zExplicit boolean capability for one custom-provider model, or ``None``. Scoped to the normalized route + exact runtime model id so aliases can declare capabilities.rrN)rrrrrr2r=r) r^rKrrrrrrr6s r$get_custom_provider_model_capabilityr=sX   ~./>vF 'uh8H&Q  j) eT "L   sA A)(A) provider_cfgct|tsy|jdd}t|tr|St|tr$|j j tvSt|S)zWhether a ``providers.`` block is enabled: default True; only an explicit ``enabled: false`` hides it from the picker, ``/models``, runtime resolver and doctor.Tenabled)r=r>r2rr9r0r3r)rflags rrrYs` lD )   It ,D$ $zz|!!#<77 :rrrE)6__doc__loggingrotypingrrrrrr urllib.parser hermes_cli.route_identityr getLoggerrrr __annotations__r9rr1 frozensetrrr5r:r>rCrIrZrrwrrrrrrrrrrrrrrrrrrrrrrrrrsW ==!>   . /#&%C'##CPSX\!%%*)"))%.$!*, 45 23 ;#;#; cc c d  3 S U3cSVh@X;X5Y $#%(6 "8S#X 834S>6suT#s(^T5I/JF(*] ]!$].6tCH~.F]B(* !$.6tCH~.F* s tDcN?S (,- T#s(^ $-04T#s(^0D-`tDcN34 T#s(^ $:8<'+tDcN34 T#s(^ $ &>DcN>3>8DcN;S>    tDcN34  T#s(^ $ *2$sCx.)A chtn8<'+tDcN34 T#s(^ $15S#X(8<'+ 8S> 8 8tDcN34 8 T#s(^ $ 815 8O3O4S>O8<'+  tDcN34  T#s(^ $ 15S#X  8<'+ .S> . .tDcN34 . T#s(^ $ .15 ."8<'+  tDcN34  T#s(^ $ 14 &8<'+ * **tDcN34* T#s(^ $ *19 *b8<'+  tDcN34  T#s(^ $  19 8 htCH~&> 4 r